2022-01-26  Antoine Quint  <graouts@webkit.org>

        [Web Inspector] Graphics tab should display pseudo-elements for more than ::before and ::after
        https://bugs.webkit.org/show_bug.cgi?id=235234
        <rdar://87766777>

        Reviewed by Devin Rousso.

        Add a new `DOM.Styleable` type to be used as the parameter type for `requestEffectTarget()` callbacks.

        * inspector/protocol/Animation.json:
        * inspector/protocol/DOM.json:

2022-01-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not run testPingPongStackOverflow while running multithreaded MultithreadedMultiVMExecutionTest
        https://bugs.webkit.org/show_bug.cgi?id=235633

        Reviewed by Mark Lam.

        MultithreadedMultiVMExecutionTest is failing occasionally in CLoop test. This is because of the following.

        1. CLoop is slow, so multithreaded tests are running longly.
        2. Then, this multithreaded tests overlap with testPingPongStackOverflow.
        3. testPingPongStackOverflow changes global Options::maxPerThreadStackUsage to test stack-overflow behavior.
           This test is strongly assuming that there is only one thread using this VM. But this is wrong since
           MultithreadedMultiVMExecutionTest is running concurrently. Then this configuration change affects on
           the running MultithreadedMultiVMExecutionTest.
        4. Stack-overflow error happens in MultithreadedMultiVMExecutionTest if the changed option is observed in that test.

        We should not run testPingPongStackOverflow until MultithreadedMultiVMExecutionTest finishes since it assumes
        that there is only one user of this VM.

        This patch also cleans up / adds diagnosis of failures in MultithreadedMultiVMExecutionTest.

        * API/tests/MultithreadedMultiVMExecutionTest.cpp:
        (startMultithreadedMultiVMExecutionTest):
        (finalizeMultithreadedMultiVMExecutionTest):
        * API/tests/testapi.c:
        (main):

2022-01-25  Mark Lam  <mark.lam@apple.com>

        Gardening: build fix for CLoop.

        Not reviewed.

        Code for the USE(LIBPAS_JIT_HEAP) ExecutableMemoryHandle is only built in when
        ENABLE(JIT).  Update the header to reflect this so that CLoop builds don't try to
        link against it.

        * jit/ExecutableMemoryHandle.h:

2022-01-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Wasm module import should be done in sync when WebAssembly.instantiate gets module
        https://bugs.webkit.org/show_bug.cgi?id=235506

        Reviewed by Saam Barati.

        According to the spec, module imports need to be done synchronously when WebAssembly.instantiate
        is called with a wasm module[1].

        To align our implementation to this behavior, we split WebAssemblyModuleRecord::initializeImportsAndExports
        into WebAssemblyModuleRecord::initializeImports and WebAssemblyModuleRecord::initializeExports. The former
        does not require CalleeGroups so we can execute before compiling CalleeGroups.

        [1]: https://webassembly.github.io/spec/js-api/#asynchronously-instantiate-a-webassembly-module

        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::evaluate):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::setOwner):
        (JSC::Wasm::Instance::finalizeCreation): Deleted.
        * wasm/WasmModuleInformation.h:
        (JSC::Wasm::ModuleInformation::hasMemoryImport const):
        * wasm/js/JSWebAssembly.cpp:
        (JSC::instantiate):
        (JSC::resolve): Deleted.
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
        (JSC::JSWebAssemblyInstance::initializeImports):
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/WebAssemblyInstanceConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::initializeImports):
        (JSC::WebAssemblyModuleRecord::initializeExports):
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): Deleted.
        * wasm/js/WebAssemblyModuleRecord.h:

2022-01-24  Mark Lam  <mark.lam@apple.com>

        Rename Vector and FixedVector::findMatching to findIf to match stl naming.
        https://bugs.webkit.org/show_bug.cgi?id=234864
        rdar://87424746

        Reviewed by Yusuke Suzuki.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ArrayPatternNode::emitDirectBinding):

2022-01-24  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable Array#groupBy and Array#groupByToMap
        https://bugs.webkit.org/show_bug.cgi?id=235549

        Reviewed by Ross Kirsling.

        * runtime/OptionsList.h:

2022-01-24  Cameron McCormack  <heycam@apple.com>

        Remove VM::stringCache
        https://bugs.webkit.org/show_bug.cgi?id=235536

        Reviewed by Sam Weinig.

        We consult VM::stringCache when creating a JSString, but since
        bug 142115 we never insert anything into it.

        Removing this results in almost-significant improvements in the VueJS,
        Vanilla-ES2015, and jQuery sub-tests of Speedometer 2 (of 0.5-2%,
        0.03 <= p <= 0.05), and an almost significant 0.2% improvement in the
        overall score (p = 0.06).

        * runtime/JSString.cpp:
        (JSC::jsStringWithCacheSlowCase):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2022-01-24  Diego Pino Garcia  <dpino@igalia.com>

        Unreviewed, fix non-unified build after r288458

        * runtime/DeferredWorkTimer.h:

2022-01-24  Patrick Angle  <pangle@apple.com>

        Web Inspector: [Flexbox] Add instrumentation/protocol bits for flex layout containers
        https://bugs.webkit.org/show_bug.cgi?id=235454

        Reviewed by Devin Rousso.

        * inspector/protocol/CSS.json:

2022-01-24  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Fix regexp crash on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=234476

        Reviewed by Yusuke Suzuki.

        This patch fixes several regexp crashes on ARMv7 due to an incorrect
        offset to retrieve the 5th argument from the stack: in ARMv7, only
        4 arguments are passed via registers r0-r3i, and any other argument is
        placed on the stack, however, YarrJIT was trying to get the 5th arg
        from a fixed offset, so because the generateEnter() method pushed
        register into the stack, the offset was wrong. This patch fixes how
        the offset is calculated for MIPS and ARMv7.

        This patch also introduces some small changes:

        1. Added static_asserts that the YarrJIT calls do indeed have 5 arguments
        and that the 5th argument has the type that we expect (MatchingContextHolder*).

        2. Removed an unnecessary pointer from the MatchingContextHolder
        constructor.

        3. Fixed some warnings in the YarrJIT code here and there.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
        * runtime/RegExpInlines.h:
        (JSC::RegExp::matchInline):
        * yarr/YarrJIT.cpp:
        * yarr/YarrMatchingContextHolder.h:
        (JSC::Yarr::MatchingContextHolder::MatchingContextHolder):

2022-01-24  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Support import assertion syntax
        https://bugs.webkit.org/show_bug.cgi?id=235312

        Reviewed by Ross Kirsling.

        This patch adds syntax support for import assertion[1].
        This does not add the actual feature propagating import assertion
        to the module request yet.

        [1]: https://github.com/tc39/proposal-import-assertions

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ImportNode::emitBytecode):
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createImportExpr):
        (JSC::ASTBuilder::createImportAssertionList):
        (JSC::ASTBuilder::appendImportAssertion):
        (JSC::ASTBuilder::createImportDeclaration):
        (JSC::ASTBuilder::createExportAllDeclaration):
        (JSC::ASTBuilder::createExportNamedDeclaration):
        * parser/NodeConstructors.h:
        (JSC::ImportNode::ImportNode):
        (JSC::ImportDeclarationNode::ImportDeclarationNode):
        (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode):
        (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode):
        * parser/Nodes.h:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseImportAssertions):
        (JSC::Parser<LexerType>::parseImportDeclaration):
        (JSC::Parser<LexerType>::parseExportDeclaration):
        (JSC::Parser<LexerType>::parseMemberExpression):
        * parser/Parser.h:
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createImportExpr):
        (JSC::SyntaxChecker::createImportAssertionList):
        (JSC::SyntaxChecker::appendImportAssertion):
        (JSC::SyntaxChecker::createImportDeclaration):
        (JSC::SyntaxChecker::createExportAllDeclaration):
        (JSC::SyntaxChecker::createExportNamedDeclaration):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/OptionsList.h:

2022-01-24  Mark Lam  <mark.lam@apple.com>

        Add FixedVector::clear(), contains(), find(), and findMatching().
        https://bugs.webkit.org/show_bug.cgi?id=234855

        Reviewed by Yusuke Suzuki.

        Use FixedVector instead of Vector in DeferredWorkTimer::TicketData now that
        the needed APIs have been added.

        * runtime/DeferredWorkTimer.h:

2022-01-24  Joseph Griego  <jgriego@igalia.com>

        [Shadow Realms] Use WebCore module loaders for shadow realm importValue
        https://bugs.webkit.org/show_bug.cgi?id=234155

        Reviewed by Darin Adler.

        Add hook for creating the new realm object for shadow realms, since
        importValue requires the cooperation of the module loading logic to work
        right.

        * API/JSAPIGlobalObject.cpp:
        * jsc.cpp:
        * runtime/JSGlobalObject.cpp:
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::deriveShadowRealmGlobalObject):
        * runtime/ShadowRealmConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmObject.cpp:
        (JSC::ShadowRealmObject::create):
        * runtime/ShadowRealmObject.h:

2022-01-21  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r288400.
        https://bugs.webkit.org/show_bug.cgi?id=235470

        broke ARM64E build

        Reverted changeset:

        "[JSC][32bit] Fix regexp crash on ARMv7"
        https://bugs.webkit.org/show_bug.cgi?id=234476
        https://commits.webkit.org/r288400

2022-01-21  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Fix regexp crash on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=234476

        Reviewed by Yusuke Suzuki.

        This patch fixes several regexp crashes on ARMv7 due to an incorrect
        offset to retrieve the 5th argument from the stack: in ARMv7, only
        4 arguments are passed via registers r0-r3i, and any other argument is
        placed on the stack, however, YarrJIT was trying to get the 5th arg
        from a fixed offset, so because the generateEnter() method pushed
        register into the stack, the offset was wrong. This patch fixes how
        the offset is calculated for MIPS and ARMv7.

        This patch also introduces some small changes:

        1. Added static_asserts that the YarrJIT calls do indeed have 5 arguments
        and that the 5th argument has the type that we expect (MatchingContextHolder*).

        2. Removed an unnecessary pointer from the MatchingContextHolder
        constructor.

        3. Fixed some warnings in the YarrJIT code here and there.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
        * runtime/RegExpInlines.h:
        (JSC::RegExp::matchInline):
        * yarr/YarrJIT.cpp:
        * yarr/YarrMatchingContextHolder.h:
        (JSC::Yarr::MatchingContextHolder::MatchingContextHolder):

2022-01-21  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, follow-up after r288066
        https://bugs.webkit.org/show_bug.cgi?id=235271

        * runtime/DatePrototype.cpp:
        (JSC::applyToNumberToOtherwiseIgnoredArguments):
        (JSC::fillStructuresUsingDateArgs):
        (JSC::setNewValueFromTimeArgs):
        (JSC::setNewValueFromDateArgs):
        (JSC::applyToNumbersToTrashedArguments): Deleted.

2022-01-21  Mike Gorse  <mgorse@suse.com>

        Build failure with g++ 12: std::exchange undefined
        https://bugs.webkit.org/show_bug.cgi?id=235445

        Reviewed by Michael Catanzaro.

        * API/JSRetainPtr.h: Include <utility>

2022-01-21  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 branch-testing operations
        https://bugs.webkit.org/show_bug.cgi?id=235442

        Reviewed by Yusuke Suzuki.

        Implement MacroAssemblerRISCV64 branch-testing operations. The branching
        instructions being intentionally simple in RISC-V, and with no status
        register, scratch register has to be used to hold the testing result
        and perform a branch based on its value. This will disallow use of these
        implementations from Air, but that has to be address inside Air itself.

        When performing tests for values that are smaller than 64 bits in width,
        the tested value is zero-extended or, when necessary, loaded as an
        unsigned value, to impose zeroed upper bits that eliminate masking
        values that are too wide or get sign-extended when used as immediates.
        Post-masking, these shorter-width values still have to be sign-extended
        to accommodate branch instructions that are used when testing
        signedness.

        The test result value is then passed on, along with the desired
        condition, to the new branchTestFinalize() helper method that finally
        generates the appropriate branch.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::branchTest8):
        (JSC::MacroAssemblerRISCV64::branchTest16):
        (JSC::MacroAssemblerRISCV64::branchTest32):
        (JSC::MacroAssemblerRISCV64::branchTest64):
        (JSC::MacroAssemblerRISCV64::branchPtr):
        (JSC::MacroAssemblerRISCV64::branchTestFinalize):

2022-01-21  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 operations for bitfield, zero-counting, byte-swapping operations
        https://bugs.webkit.org/show_bug.cgi?id=235439

        Reviewed by Yusuke Suzuki.

        Add MacroAssemblerRISCV64 implementations that cover unsigned bitfield,
        leading-zero, trailing-zero and byte-swapping operations. All these
        operations are not supported in base RISC-V specifications. There are
        extensions currently being ratified that will introduce more useful
        instructions, but until then more verbose implementations will have
        to be used.

        For the unsigned bitfield operations, the desired result is achieved
        through shifting and masking. Scratch registers are only needed in
        case of the mask immediate being too large, but that will be properly
        handled by the higher-level JITs. For other operations covered in this
        patch  we have to use scratch registers and custom loops to implement
        the necessary behavior.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::extractUnsignedBitfield32):
        (JSC::MacroAssemblerRISCV64::extractUnsignedBitfield64):
        (JSC::MacroAssemblerRISCV64::insertUnsignedBitfieldInZero32):
        (JSC::MacroAssemblerRISCV64::insertUnsignedBitfieldInZero64):
        (JSC::MacroAssemblerRISCV64::countLeadingZeros32):
        (JSC::MacroAssemblerRISCV64::countLeadingZeros64):
        (JSC::MacroAssemblerRISCV64::countTrailingZeros32):
        (JSC::MacroAssemblerRISCV64::countTrailingZeros64):
        (JSC::MacroAssemblerRISCV64::byteSwap16):
        (JSC::MacroAssemblerRISCV64::byteSwap32):
        (JSC::MacroAssemblerRISCV64::byteSwap64):

2022-01-21  Alex Christensen  <achristensen@webkit.org>

        Fix build when using Visual Studio 2022
        https://bugs.webkit.org/show_bug.cgi?id=235440

        Reviewed by Antti Koivisto.

        It doesn't like having a switch with a default but no cases.
        This is cleaner with if statements anyways.
        Also make members const because I can.

        * jit/JITCode.cpp:
        (JSC::JITCode::calleeSaveRegisters const):
        * jit/JITCode.h:

2022-01-21  Lauro Moura  <lmoura@igalia.com>

        [CMake] Cannot link libTestRunnerInjectedBundle.so in non unified build
        https://bugs.webkit.org/show_bug.cgi?id=226088

        Reviewed by Adrian Perez de Castro.

        * wasm/js/JSWebAssemblyModule.h: Add missing header

2022-01-20  Pablo Saavedra  <psaavedra@igalia.com>

        Non-unified build fails due to forward declaration in JavaScriptCore/jit/JITStubRoutine.h
        https://bugs.webkit.org/show_bug.cgi?id=235409

        Unreviewed non-unified build fix.

        * jit/JITStubRoutine.h:

2022-01-20  Joseph Griego  <jgriego@igalia.com>

        [JSC] Add section directive in MacroAssemblerX86Common asm blocks
        https://bugs.webkit.org/show_bug.cgi?id=235406

        Reviewed by Yusuke Suzuki.

        These asm blocks aren't in a function body so they need a .text
        directive to prevent them from being included in some arbitrary section
        (say, an inline function's section) by happenstance, which was happening
        in the WPE build without UnifiedSources.

        * assembler/MacroAssemblerX86Common.cpp:

2022-01-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement Temporal.Now.instant()
        https://bugs.webkit.org/show_bug.cgi?id=234836

        Reviewed by Ross Kirsling.

        This patch implements Temporal.Now.instant() since Temporal.Instant is now implemented.
        It returns an instant which represents current wall time.

        * runtime/ISO8601.cpp:
        (JSC::ISO8601::ExactTime::now):
        * runtime/ISO8601.h:
        * runtime/TemporalNow.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2022-01-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix non-JIT Windows LLInt
        https://bugs.webkit.org/show_bug.cgi?id=235388

        Reviewed by Mark Lam.

        We should implement cCall3 which calls llint_link_call etc. from LLInt code.
        This implementation needs to work on Windows too, so it requires stack modification.
        While we do not have a problem on JIT Windows build, it is required for non JIT Windows
        build. (If JIT is enabled, LLInt is fine. But if JIT is entirely disabled, this change
        is required.)

        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::llint_link_call):
        (JSC::LLInt::llint_virtual_call):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/cloop.rb:
        * offlineasm/instructions.rb:

2022-01-19  Saam Barati  <sbarati@apple.com>

        Update ARM64EHash
        https://bugs.webkit.org/show_bug.cgi?id=235192

        Reviewed by Mark Lam.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * assembler/AssemblerBuffer.h:
        (JSC::ARM64EHash::ARM64EHash):
        (JSC::ARM64EHash::~ARM64EHash):
        (JSC::ARM64EHash::allocatePinForCurrentThreadAndInitializeHash):
        (JSC::ARM64EHash::deallocatePinForCurrentThread):
        (JSC::ARM64EHash::update):
        (JSC::ARM64EHash::pin):
        (JSC::ARM64EHash::currentHash):
        (JSC::ARM64EHash::setUpdatedHash):
        (JSC::AssemblerBuffer::AssemblerBuffer):
        (JSC::AssemblerBuffer::arm64eHash):
        (JSC::AssemblerBuffer::putIntegralUnchecked):
        (JSC::ARM64EHash::bitsForDiversifier): Deleted.
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::copyCompactAndLinkCode):
        (JSC::LinkBuffer::allocate):
        * assembler/SecureARM64EHashPins.cpp: Added.
        (JSC::WriteToJITRegionScope::WriteToJITRegionScope):
        (JSC::WriteToJITRegionScope::~WriteToJITRegionScope):
        (JSC::ValidateNonReentrancyScope::ValidateNonReentrancyScope):
        (JSC::ValidateNonReentrancyScope::~ValidateNonReentrancyScope):
        (JSC::allocateInExecutableMemory):
        (JSC::SecureARM64EHashPins::Page::Page):
        (JSC::initializePage):
        (JSC::SecureARM64EHashPins::metadata):
        (JSC::SecureARM64EHashPins::initializeAtStartup):
        (JSC::SecureARM64EHashPins::allocatePinForCurrentThreadImpl):
        (JSC::SecureARM64EHashPins::allocatePinForCurrentThread):
        (JSC::SecureARM64EHashPins::deallocatePinForCurrentThread):
        * assembler/SecureARM64EHashPins.h: Added.
        (JSC::SecureARM64EHashPins::firstPage):
        * assembler/SecureARM64EHashPinsInlines.h: Added.
        (JSC::SecureARM64EHashPins::keyForCurrentThread):
        (JSC::SecureARM64EHashPins::forEachPage):
        (JSC::SecureARM64EHashPins::forEachEntry):
        (JSC::SecureARM64EHashPins::findFirstEntry):
        (JSC::SecureARM64EHashPins::pinForCurrentThread):
        * heap/MarkedBlock.h:
        * heap/MarkedSpace.h:
        * heap/SlotVisitor.h:
        * jit/BaselineJITPlan.cpp:
        (JSC::BaselineJITPlan::BaselineJITPlan):
        (JSC::BaselineJITPlan::compileInThreadImpl):
        * jit/ExecutableAllocator.cpp:
        * parser/Parser.h:
        * runtime/InitializeThreading.cpp:
        (JSC::initialize):
        * runtime/IterationStatus.h: Removed.
        * runtime/JSCConfig.h:
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::parseAndCompileAir):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::parseAndCompileB3):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::compileFunction):

2022-01-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix YarrJIT backtrackCharacterClassNonGreedy breakpoint
        https://bugs.webkit.org/show_bug.cgi?id=235348

        Reviewed by Michael Saboff.

        YarrJIT's backtrackCharacterClassNonGreedy breakpoint is actually reachable. We should subtract index (since it is already incremented),
        and go to the normal nonGreedyFailures path.

        * yarr/YarrJIT.cpp:

2022-01-19  Michael Catanzaro  <mcatanzaro@gnome.org>

        Fix -Wreturn-type and -Wunused-parameter warnings, January 2022 edition
        https://bugs.webkit.org/show_bug.cgi?id=235336

        Reviewed by Adrian Perez de Castro.

        * wasm/WasmCompilationMode.h:
        (JSC::Wasm::isOSREntry):
        (JSC::Wasm::isAnyBBQ):
        (JSC::Wasm::isAnyOMG):

2022-01-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove Wasm::Table's m_mask
        https://bugs.webkit.org/show_bug.cgi?id=235329

        Reviewed by Mark Lam.

        This patch removes m_mask in Wasm::Table.
        The mask is removed in the other places, but forgot
        removing that in Wasm::Table.

        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::setLength):
        (JSC::Wasm::Table::clear):
        (JSC::Wasm::Table::set):
        (JSC::Wasm::Table::get const):
        (JSC::Wasm::FuncRefTable::setFunction):
        (JSC::Wasm::FuncRefTable::function const):
        (JSC::Wasm::FuncRefTable::instance const):
        * wasm/WasmTable.h:
        (JSC::Wasm::Table::offsetOfLength):
        (JSC::Wasm::Table::offsetOfMask): Deleted.
        (JSC::Wasm::Table::mask const): Deleted.

2022-01-18  Alex Christensen  <achristensen@webkit.org>

        Use c++2a instead of gnu++2a for Cocoa builds
        https://bugs.webkit.org/show_bug.cgi?id=234936

        Reviewed by Sam Weinig.

        * Configurations/Base.xcconfig:
        * Configurations/JavaScriptCore.xcconfig:
        * DerivedSources.make:

2022-01-18  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fails due to missing header in WasmCalleeGroup.cpp

        Unreviewed non-unified build fix.

        * wasm/WasmCalleeGroup.cpp: Add missing inclusion of the LinkBuffer.h header.

2022-01-16  Lauro Moura  <lmoura@igalia.com>

        Fix C++20 build warnings with GCC
        https://bugs.webkit.org/show_bug.cgi?id=235023

        Reviewed by Alex Christensen.

        Mostly related to deprecating operations between enums of different
        types and not capturing this by default in lambdas.

        * assembler/X86Assembler.h: Casting enums to same type.
        (JSC::X86Assembler::cmovcc):
        (JSC::X86Assembler::jccRel32):
        (JSC::X86Assembler::setccOpcode):
        * b3/B3CheckSpecial.cpp: Capture this in lambda.
        (JSC::B3::CheckSpecial::generate):
        * b3/B3Type.cpp: Replace is_pod_v is is_standard_layout_v and
        is_trivial_v
        * bytecode/AccessCase.cpp: Capture this in lambda.
        (JSC::AccessCase::generateImpl):
        * bytecode/CallLinkInfo.cpp: Ditto.
        (JSC::OptimizingCallLinkInfo::emitDirectFastPath):
        (JSC::OptimizingCallLinkInfo::emitDirectTailCallFastPath):
        (JSC::OptimizingCallLinkInfo::initializeDirectCall):
        * dfg/DFGSpeculativeJIT.cpp: Ditto.
        * dfg/DFGSpeculativeJIT64.cpp: Ditto.
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/ICStats.h: Cast enums to same type.
        (JSC::ICEvent::hash const):
        * jit/JITArithmetic.cpp: Capture this in lambda.
        (JSC::JIT::emitMathICSlow):
        * jit/JITSizeStatistics.cpp: Ditto.
        (JSC::JITSizeStatistics::markEnd):
        * runtime/VM.cpp: Ditto.
        (JSC::VM::deleteAllLinkedCode):
        (JSC::VM::deleteAllCode):
        (JSC::VM::shrinkFootprintWhenIdle):
        * wasm/WasmAirIRGenerator.cpp: Ditto.
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::addTableGet):
        (JSC::Wasm::AirIRGenerator::addTableSet):
        (JSC::Wasm::AirIRGenerator::addTableInit):
        (JSC::Wasm::AirIRGenerator::addTableFill):
        (JSC::Wasm::AirIRGenerator::addTableCopy):
        (JSC::Wasm::AirIRGenerator::addMemoryFill):
        (JSC::Wasm::AirIRGenerator::addMemoryCopy):
        (JSC::Wasm::AirIRGenerator::addMemoryInit):
        (JSC::Wasm::AirIRGenerator::emitCheckAndPreparePointer):
        (JSC::Wasm::AirIRGenerator::emitAtomicLoadOp):
        (JSC::Wasm::AirIRGenerator::emitAtomicStoreOp):
        (JSC::Wasm::AirIRGenerator::emitAtomicBinaryRMWOp):
        (JSC::Wasm::AirIRGenerator::emitAtomicCompareExchange):
        (JSC::Wasm::AirIRGenerator::atomicWait):
        (JSC::Wasm::AirIRGenerator::atomicNotify):
        (JSC::Wasm::AirIRGenerator::emitEntryTierUpCheck):
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::AirIRGenerator::addCallIndirect):
        (JSC::Wasm::AirIRGenerator::addCallRef):
        (JSC::Wasm::AirIRGenerator::emitChecksForModOrDiv):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I32TruncSF64>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I32TruncSF32>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I32TruncUF64>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I32TruncUF32>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I64TruncSF64>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I64TruncUF64>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I64TruncSF32>):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::I64TruncUF32>):
        * wasm/WasmB3IRGenerator.cpp: Ditto.
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::B3IRGenerator::addTableGet):
        (JSC::Wasm::B3IRGenerator::addTableSet):
        (JSC::Wasm::B3IRGenerator::addTableInit):
        (JSC::Wasm::B3IRGenerator::addTableFill):
        (JSC::Wasm::B3IRGenerator::addTableCopy):
        (JSC::Wasm::B3IRGenerator::emitIndirectCall):
        (JSC::Wasm::B3IRGenerator::addMemoryFill):
        (JSC::Wasm::B3IRGenerator::addMemoryInit):
        (JSC::Wasm::B3IRGenerator::addMemoryCopy):
        (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffsetForAtomicOps):
        (JSC::Wasm::B3IRGenerator::atomicWait):
        (JSC::Wasm::B3IRGenerator::atomicNotify):
        (JSC::Wasm::B3IRGenerator::emitEntryTierUpCheck):
        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        (JSC::Wasm::B3IRGenerator::addCallRef):
        (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
        * yarr/YarrJIT.cpp: Ditto.

2022-01-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix Date functions' argument coercion
        https://bugs.webkit.org/show_bug.cgi?id=235271

        Reviewed by Alexey Shvayka.

        Even if the input Date is NaN or the result looks like NaN, we need to coerce passed
        arguments to Number[1] since it has observable side effect.

        [1]: https://github.com/tc39/ecma262/pull/2136

        * runtime/DatePrototype.cpp:
        (JSC::applyToNumbersToTrashedArguments):
        (JSC::fillStructuresUsingTimeArgs):
        (JSC::fillStructuresUsingDateArgs):
        (JSC::setNewValueFromTimeArgs):
        (JSC::setNewValueFromDateArgs):

2022-01-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix misc issues in WebAssembly.Exception
        https://bugs.webkit.org/show_bug.cgi?id=235261

        Reviewed by Alexey Shvayka.

        1. Add @toStringTag to WebAssembly.Exception.prototype.
        2. Add argument count check for WebAssembly.Exception methods (since it is specified in WebIDL and these methods do not have optional parameters).

        * wasm/js/WebAssemblyExceptionPrototype.cpp:
        (JSC::WebAssemblyExceptionPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2022-01-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix misc WebAssembly.Table issues
        https://bugs.webkit.org/show_bug.cgi?id=235262

        Reviewed by Alexey Shvayka.

        * wasm/js/WebAssemblyTablePrototype.cpp:

2022-01-14  Yusuke Suzuki  <ysuzuki@apple.com> and Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC] Fix Linux 64bit compilation
        https://bugs.webkit.org/show_bug.cgi?id=235232

        Reviewed by Saam Barati.

        Define PAS_BMALLOC in all projects since JavaScriptCore includes some files which can require this macro variable.
        Previously, JSDollarVM.cpp includes these files first, then at that time, we can define PAS_BMALLOC.
        However, after enabling jit-heap, these files are included before JSDollarVM.cpp and include pas_config.h without
        PAS_BMALLOC definition, which later causes the problem when including pas_lock.h since non PAS_BMALLOC libpas requires
        darwin specific locking.

        Since defining PAS_BMALLOC does not matter to whether using libpas or not, this patch just defines it globally.
        And for Apple ports, we define this when we define BENABLE_LIBPAS.

        * tools/JSDollarVM.cpp:

2022-01-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix WebAssembly.Global's typename for "anyfunc"
        https://bugs.webkit.org/show_bug.cgi?id=235105

        Reviewed by Keith Miller.

        We should return "anyfunc" string instead of "funcref" according to the spec[1,2].

        [1]: https://webassembly.github.io/spec/js-api/#globals
        [2]: https://webassembly.github.io/spec/js-api/#tables

        * wasm/js/JSWebAssemblyGlobal.cpp:
        (JSC::JSWebAssemblyGlobal::type):
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::type):

2022-01-14  Mark Lam  <mark.lam@apple.com>

        JSStringJoiner's constructor should take a size_t length.
        https://bugs.webkit.org/show_bug.cgi?id=235217
        rdar://87538657

        Reviewed by Yusuke Suzuki.

        Also removed an unnecessary exception check in JSStringJoiner::append().
        This is because appendWithoutSideEffects() cannot throw any exceptions.

        * runtime/JSStringJoiner.h:
        (JSC::JSStringJoiner::JSStringJoiner):
        (JSC::JSStringJoiner::append):

2022-01-14  Alexey Shvayka  <ashvayka@apple.com>

        JSArray::fastSlice() should not convert the source from CoW
        https://bugs.webkit.org/show_bug.cgi?id=234990

        Reviewed by Yusuke Suzuki.

        Since we aren't modifying the source array in fastSlice() nor its slow path,
        there is no reason to convert it from CopyOnWrite.

        * runtime/JSArray.cpp:
        (JSC::JSArray::fastSlice):

2022-01-14  Saam Barati  <sbarati@apple.com>

        Make isJITPC fast
        https://bugs.webkit.org/show_bug.cgi?id=235241

        Reviewed by Yusuke Suzuki.

        Make it an inlined function, and stop tagging g_jscConfig.startExecutableMemory
        and g_jscConfig.endExecutableMemory, since they're in the Config page, and
        not mutable after it's frozen.

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):
        (JSC::isJITPC): Deleted.
        * jit/ExecutableAllocator.h:
        (JSC::isJITPC):

2022-01-14  Saam Barati  <sbarati@apple.com>

        Use IRC for Wasm, and Briggs for JS on ARM64
        https://bugs.webkit.org/show_bug.cgi?id=235235
        <rdar://87090631>

        Reviewed by Yusuke Suzuki and Robin Morisset.

        When I turned on IRC for everything in r287218, we saw some
        regressions on iOS on JetStream2. So, this patch makes it so
        JS code on arm64 goes back to using Briggs, and Wasm will
        use IRC.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        * b3/air/AirCode.h:
        (JSC::B3::Air::Code::setForceIRCRegisterAllocation):
        (JSC::B3::Air::Code::forceIRCRegisterAllocation):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::parseAndCompileB3):

2022-01-13  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] riscv64 backend should lower offlineasm instructions
        https://bugs.webkit.org/show_bug.cgi?id=234952
        <rdar://problem/87440612>

        Reviewed by Yusuke Suzuki.

        In the riscv64 offlineasm backend, instead of handling higher-level
        offlineasm instructions with different operand combinations and manually
        juggling temp registers, use the approach of aggressively lowering these
        opcodes into sequences of RISC-V instructions.

        Addresses and immediate values are lowered into usable forms where
        necessary. Different lowering phases handle any offlineasm instruction
        so that the resulting opcodes can be, with accompanying operands, used
        trivially to construct the RISC-V assembly.

        Lowered RISC-V opcodes use the 'rv_' prefix so that they can be easily
        diassociated from any offlineasm opcode that might share the same name.
        The prefix is removed when the assembly is finally generated.

        * offlineasm/riscv64.rb:

2022-01-13  Saam Barati  <sbarati@apple.com>

        Link Wasm code on the same thread that JITs
        https://bugs.webkit.org/show_bug.cgi?id=235201

        Reviewed by Yusuke Suzuki and Mark Lam.

        This is preparing us for the changes that'll be needed by
        https://bugs.webkit.org/show_bug.cgi?id=235192.
        
        It should also be a small perf improvement, as we're now linking
        in parallel instead of doing it after all compilations have finished.

        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::parseAndCompileB3):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::prepareImpl):
        (JSC::Wasm::BBQPlan::compileFunction):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        (JSC::Wasm::BBQPlan::initializeCallees):
        * wasm/WasmBBQPlan.h:

2022-01-13  Elliott Williams  <emw@apple.com>

        [XCBuild] Add "product dependencies" which influence workspace build order
        https://bugs.webkit.org/show_bug.cgi?id=235094

        Some ancillary targets (e.g. script-only targets like Derived Sources) do not have implicit
        dependencies visible to Xcode. In workspace builds, we need to give XCBuild additional
        information to ensure that they always run after their dependencies.

        This patch adds "Product Dependencies" phases, which are Copy Files phases that copy the
        _product_ of another dependency. The product names are also added to
        EXCLUDED_SOURCE_FILE_NAMES, making the actual copy a no-op, but these phases give XCBuild
        enough metadata to infer the relationship between targets.

        For example, JavaScriptCore's "Generate Unified Sources" target depends on headers from WTF,
        so it lists libWTF.a in its Product Dependencies. Xcode sees the relationship between the
        target doing the copy (Generate Unified Sources) and the target which produces the product
        (WTF) and schedules them accordingly.

        Because these dependencies are _implicit_ and the copy phases are no-ops, they do not
        influence command-line or production builds where each project is built separately.

        Reviewed by Alexey Proskuryakov.

        * Configurations/Base.xcconfig: Add EXCLUDED_SOURCE_FILE_NAMES
        * Configurations/JavaScriptCore.xcconfig: Inherit EXCLUDED_SOURCE_FILE_NAMES
        * JavaScriptCore.xcodeproj/project.pbxproj: Add Product Dependencies

2022-01-13  Tim Horton  <timothy_horton@apple.com>

        Fix a few Objective-C object leaks due to early returns in `init`
        https://bugs.webkit.org/show_bug.cgi?id=235162
        <rdar://problem/87489048>

        Reviewed by Wenson Hsieh.

        * API/JSValue.mm:
        (-[JSValue initWithValue:inContext:]):

2022-01-12  Mark Lam  <mark.lam@apple.com>

        [Re-landing] Update hashThreadState() to exclude __opaque_flags.
        https://bugs.webkit.org/show_bug.cgi?id=235081
        rdar://86282584

        Reviewed by Keith Miller.

        Removed some unused code.

        * runtime/MachineContext.h:
        (JSC::MachineContext::stackPointer):
        (JSC::MachineContext::framePointer):
        (JSC::MachineContext::instructionPointer):
        (JSC::MachineContext::linkRegister):
        (JSC::MachineContext::setStackPointer): Deleted.
        (JSC::MachineContext::setFramePointer): Deleted.
        (JSC::MachineContext::setLinkRegister): Deleted.

2022-01-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r287912.
        https://bugs.webkit.org/show_bug.cgi?id=235164

        ARM64/ARM64E Speedometer2 50% regression, probably breaking
        something

        Reverted changeset:

        "[RISCV64] riscv64 backend should lower offlineasm
        instructions"
        https://bugs.webkit.org/show_bug.cgi?id=234952
        https://commits.webkit.org/r287912

2022-01-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r287908.
        https://bugs.webkit.org/show_bug.cgi?id=235156

        Broke M1 Monterey JSC

        Reverted changeset:

        "Update hashThreadState() to exclude __opaque_flags."
        https://bugs.webkit.org/show_bug.cgi?id=235081
        https://commits.webkit.org/r287908

2022-01-11  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] riscv64 backend should lower offlineasm instructions
        https://bugs.webkit.org/show_bug.cgi?id=234952

        Reviewed by Yusuke Suzuki.

        In the riscv64 offlineasm backend, instead of handling higher-level
        offlineasm instructions with different operand combinations and manually
        juggling temp registers, use the approach of aggressively lowering these
        opcodes into sequences of RISC-V instructions.

        Addresses and immediate values are lowered into usable forms where
        necessary. Different lowering phases handle any offlineasm instruction
        so that the resulting opcodes can be, with accompanying operands, used
        trivially to construct the RISC-V assembly.

        Lowered RISC-V opcodes use the 'rv_' prefix so that they can be easily
        diassociated from any offlineasm opcode that might share the same name.
        The prefix is removed when the assembly is finally generated.

        * offlineasm/risc.rb: Also handle branch-on-arithmetic opcodes in the
        riscvLowerMisplacedAddress lowering phase.
        * offlineasm/riscv64.rb:

2022-01-11  Mark Lam  <mark.lam@apple.com>

        Update hashThreadState() to exclude __opaque_flags.
        https://bugs.webkit.org/show_bug.cgi?id=235081
        rdar://86282584

        Reviewed by Keith Miller.

        Removed some unused code.

        * runtime/MachineContext.h:
        (JSC::MachineContext::stackPointer):
        (JSC::MachineContext::framePointer):
        (JSC::MachineContext::instructionPointer):
        (JSC::MachineContext::linkRegister):
        (JSC::MachineContext::setStackPointer): Deleted.
        (JSC::MachineContext::setFramePointer): Deleted.
        (JSC::MachineContext::setLinkRegister): Deleted.

2022-01-11  Asumu Takikawa  <asumu@igalia.com>

        [Wasm] Unify memory import handling in module loader and JS cases
        https://bugs.webkit.org/show_bug.cgi?id=234116

        Reviewed by Yusuke Suzuki.

        Moves the memory import handling code to the Wasm module record and
        use the strategy used by the module loader to handle memory in all
        cases.

        * wasm/WasmModule.cpp:
        (JSC::Wasm::Module::copyInitialCalleeGroupToAllMemoryModes):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::tryCreate):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports):

2022-01-11  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix kind of error thrown by wasm module creation
        https://bugs.webkit.org/show_bug.cgi?id=235082

        Reviewed by Michael Saboff.

        It should throw WebAssembly.CompileError instead of WebAssembly.LinkError.
        This fixes occasional failure in wasm imports-oom.js test.

        * wasm/js/JSWebAssemblyModule.cpp:
        (JSC::JSWebAssemblyModule::createStub):

2022-01-11  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early January 2022 edition
        https://bugs.webkit.org/show_bug.cgi?id=235013

        Unreviewed non-unified build fixes.

        * wasm/js/JSWebAssemblyModule.cpp: Add missing JSWebAssemblyLinkError.h header.
        * wasm/js/JSWebAssemblyModule.h: Add missing forward declaration for the
        JSC::OptimizingCallLinkInfo type.

2022-01-10  Saam Barati  <sbarati@apple.com>

        Allow loop tier up to the Air tier
        https://bugs.webkit.org/show_bug.cgi?id=234587
        <rdar://problem/86968638>

        Reviewed by Yusuke Suzuki.

        This patch adds loop tier up from LLInt -> Air. To implement this, we use
        EntrySwitch to point at each loop header, making each loop an entrypoint.
        This is unlike BBQ->OMG tier up, where we compile a special OSR entry OMG
        callee. This seems like a good architecture for the Air tier, since we might end
        up with slightly worse throughput, but we won't need a different compilation
        for loops vs call entrypoints.
        
        This patch also fixes a bug in Air's O0 register allocation where it
        didn't properly account for all named registers in an instruction. There
        was a silly bug where we asked each arg if it were a temp, instead of
        asking the Inst for each of its temps, since an Arg can be an address
        but still use temps.

        * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp:
        (JSC::B3::Air::GenerateAndAllocateRegisters::generate):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::emitLoad):
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::finalizeEntrypoints):
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::AirIRGenerator::addLoop):
        (JSC::Wasm::parseAndCompileAir):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::parseAndCompileB3):
        (JSC::Wasm::parseAndCompile): Deleted.
        * wasm/WasmB3IRGenerator.h:
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::prepareImpl):
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::compileFunction):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        (JSC::Wasm::BBQPlan::initializeCallees):
        * wasm/WasmBBQPlan.h:
        * wasm/WasmCallee.h:
        * wasm/WasmCalleeGroup.h:
        * wasm/WasmFormat.h:
        * wasm/WasmIRGeneratorHelpers.h:
        (JSC::Wasm::computeExceptionHandlerAndLoopEntrypointLocations):
        (JSC::Wasm::computeExceptionHandlerLocations):
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::didCompleteCompilation):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOSREntryPlan.cpp:
        (JSC::Wasm::OSREntryPlan::work):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::WASM_SLOW_PATH_DECL):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):

2022-01-10  Alex Christensen  <achristensen@webkit.org>

        Start using C++20
        https://bugs.webkit.org/show_bug.cgi?id=233963

        Reviewed by Yusuke Suzuki.

        * Configurations/Base.xcconfig:
        * Configurations/JavaScriptCore.xcconfig:
        * DerivedSources.make:
        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * runtime/CachedTypes.cpp:
        * runtime/LiteralParser.h:
        * shell/PlatformPlayStation.cmake:

2022-01-10  Elliott Williams  <emw@apple.com>

        postprocess-headers.sh: Avoid redundant processing to speed up incremental Xcode builds
        https://bugs.webkit.org/show_bug.cgi?id=234941

        Reviewed by Jonathan Bedard.

        On builds made with the legacy build system (currently any CLI build for Apple platforms),
        postprocess-headers.sh always runs, even when no headers have been copied. PBXBuild doesn't
        have the necessary granularity to let us avoid running it when there are no headers to copy,
        however, this patch improves execution time by only running the postprocess rule when a
        header has changed since the last time it ran.

        This change reduces JavaScriptCore's null build time from ~18.3s to ~5.32s.

        * postprocess-headers.sh: Added timestamp check

2022-01-09  Sam Weinig  <weinig@apple.com>

        Remove support for Direct2D
        https://bugs.webkit.org/show_bug.cgi?id=234999

        Reviewed by Darin Adler.

        Direct2D and FTW have not been building for over a year. It is
        time to remove them.

        * PlatformFTW.cmake: Removed.

2022-01-07  Saam Barati  <sbarati@apple.com>

        Unreviewed. Appease an assertion that was broken by r287801 by slightly
        refactoring code so we don't clobber the same named register twice.

        * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp:
        (JSC::B3::Air::GenerateAndAllocateRegisters::generate):

2022-01-07  Saam Barati  <sbarati@apple.com>

        Add support for Wasm exceptions in the Air generator
        https://bugs.webkit.org/show_bug.cgi?id=231211
        <rdar://problem/84132861>

        Reviewed by Filip Pizlo.

        This patch adds support to Air for Wasm exceptions. The implementation
        is very similar to how we implement it in the B3 Wasm tier. This patch
        shares code with the B3 tier where it can.
        
        This patch also fixes a bug where you the early clobbered registers
        of a patchpoint could prevent the prior instruction from register allocating.
        For example, you can have the instructions I1, I2. Where I2 clobbers the
        entire register file. It doesn't mean I1 shouldn't be able to allocate
        registers. Instead, the clobber should occur after I1 executes. This patch
        fixes the issue.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp:
        (JSC::B3::Air::GenerateAndAllocateRegisters::generate):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::ControlData::ControlData):
        (JSC::Wasm::AirIRGenerator::ControlData::isTry):
        (JSC::Wasm::AirIRGenerator::ControlData::isCatch):
        (JSC::Wasm::AirIRGenerator::ControlData::convertTryToCatch):
        (JSC::Wasm::AirIRGenerator::ControlData::convertTryToCatchAll):
        (JSC::Wasm::AirIRGenerator::ControlData::tryStart const):
        (JSC::Wasm::AirIRGenerator::ControlData::tryEnd const):
        (JSC::Wasm::AirIRGenerator::ControlData::tryDepth const):
        (JSC::Wasm::AirIRGenerator::ControlData::catchKind const):
        (JSC::Wasm::AirIRGenerator::ControlData::exception const):
        (JSC::Wasm::AirIRGenerator::emitCallPatchpoint):
        (JSC::Wasm::AirIRGenerator::addStackMap):
        (JSC::Wasm::AirIRGenerator::takeStackmaps):
        (JSC::Wasm::AirIRGenerator::takeExceptionHandlers):
        (JSC::Wasm::AirIRGenerator::newTmp):
        (JSC::Wasm::AirIRGenerator::emitPatchpoint):
        (JSC::Wasm::AirIRGenerator::emitLoad):
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::finalizeEntrypoints):
        (JSC::Wasm::AirIRGenerator::forEachLiveValue):
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::AirIRGenerator::addTry):
        (JSC::Wasm::AirIRGenerator::addCatch):
        (JSC::Wasm::AirIRGenerator::addCatchAll):
        (JSC::Wasm::AirIRGenerator::addCatchToUnreachable):
        (JSC::Wasm::AirIRGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::AirIRGenerator::emitCatchImpl):
        (JSC::Wasm::AirIRGenerator::addDelegate):
        (JSC::Wasm::AirIRGenerator::addDelegateToUnreachable):
        (JSC::Wasm::AirIRGenerator::addThrow):
        (JSC::Wasm::AirIRGenerator::addRethrow):
        (JSC::Wasm::AirIRGenerator::addEndToUnreachable):
        (JSC::Wasm::AirIRGenerator::addCall):
        (JSC::Wasm::AirIRGenerator::emitIndirectCall):
        (JSC::Wasm::parseAndCompileAir):
        (JSC::Wasm::AirIRGenerator::preparePatchpointForExceptions):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::insertEntrySwitch):
        (JSC::Wasm::B3IRGenerator::emitCatchImpl):
        (JSC::Wasm::B3IRGenerator::addThrow):
        (JSC::Wasm::B3IRGenerator::addRethrow):
        (JSC::Wasm::PatchpointExceptionHandle::generate const): Deleted.
        (JSC::Wasm::buildEntryBufferForCatch): Deleted.
        (JSC::Wasm::computeExceptionHandlerLocations): Deleted.
        * wasm/WasmB3IRGenerator.h:
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::compileFunction):
        * wasm/WasmIRGeneratorHelpers.h: Added.
        (JSC::Wasm::PatchpointExceptionHandle::generate const):
        (JSC::Wasm::computeExceptionHandlerLocations):
        (JSC::Wasm::emitRethrowImpl):
        (JSC::Wasm::emitThrowImpl):
        (JSC::Wasm::buildEntryBufferForCatch):
        (JSC::Wasm::emitCatchPrologueShared):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::finalize):
        * wasm/WasmModuleInformation.h:
        * wasm/WasmOMGPlan.cpp:
        * wasm/WasmOSREntryPlan.cpp:
        * wasm/WasmStreamingParser.cpp:
        (JSC::Wasm::StreamingParser::parseCodeSectionSize):

2022-01-07  Alexey Shvayka  <ashvayka@apple.com>

        Expand the set of objects we take JSArray::fastSlice() path for
        https://bugs.webkit.org/show_bug.cgi?id=234539

        Reviewed by Yusuke Suzuki.

        Currently, Array.prototype's slice() / splice() methods take a fast path only for
        JSArray source objects. With this change, gcSafeMemcpy-based path is taken for any
        object with ordinary getOwnPropertySlotByIndex() method, which speeds up the common
        case of `[].slice.call(arguments)` by 140% (in strict mode only, see ClonedArguments).

        Also, once is https://webkit.org/b/234538 resolved, calling Array.prototype.slice()
        on a static NodeList, which is a common idiom to acquire map() / filter() methods,
        will become faster as well.

        This patch was thoroughly evaluated to be spec-perfect and memory-safe:

          - indexing mode check and holesMustForwardToPrototype() guarantee that there
            are no observable userland code to be invoked;
          - fastSlice() signature is upgraded to uint64_t so `nullptr` is returned in case
            of large "length", resulting in a RangeError being thrown on the slow path;
          - to handle the case of source array being shrinked after "length" lookup (see r175420),
            OOB read check is moved to JSArray::fastSlice() and refined to rely on vectorLength()
            so the double "length" lookup is avoided (added a test for this).

        All this (and more) is well covered by the test262 suite.

        This change improves Speedometer2/EmberJS-Debug-TodoMVC score by 0.5%: although the test
        is slow on its own, `[].slice.call(arguments)` is performed ~56k times per run.

        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSArray.cpp:
        (JSC::JSArray::fastSlice):
        * runtime/JSArray.h:

2022-01-07  Tim Horton  <timothy_horton@apple.com>

        Adopt linkedOnOrAfter() in more places
        https://bugs.webkit.org/show_bug.cgi?id=234951

        Reviewed by Wenson Hsieh.

        * API/JSWrapperMap.mm:
        (supportsInitMethodConstructors):
        * API/tests/testapi.cpp:
        (TestAPI::promiseDrainDoesNotEatExceptions):
        * API/tests/testapi.mm:
        (testMicrotaskWithFunction):
        * runtime/JSLock.cpp:
        (JSC::JSLock::willReleaseLock):
        * runtime/ObjectPrototype.cpp:
        (JSC::isPokerBros):
        Adopt linkedOnOrAfter.

2022-01-07  Alex Christensen  <achristensen@webkit.org>

        Unreviewed, reverting r287698.

        Broke an internal build

        Reverted changeset:

        "Start using C++20"
        https://bugs.webkit.org/show_bug.cgi?id=233963
        https://commits.webkit.org/r287698

2022-01-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Clean up StructureStubInfo
        https://bugs.webkit.org/show_bug.cgi?id=234943

        Reviewed by Saam Barati.

        Use std::unique_ptr<PolymorphicAccess> instead of raw pointer.

        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InstanceOfStatus.cpp:
        (JSC::InstanceOfStatus::computeForStubInfo):
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::deref):
        (JSC::StructureStubInfo::aboutToDie):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::summary const):
        (JSC::StructureStubInfo::containsPC const):
        (JSC::StructureStubInfo::~StructureStubInfo): Deleted.
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfCodePtr):
        (JSC::StructureStubInfo::offsetOfDoneLocation):
        (JSC::StructureStubInfo::offsetOfSlowPathStartLocation):
        (JSC::StructureStubInfo::offsetOfSlowOperation):
        (JSC::StructureStubInfo::offsetOfCountdown):

2022-01-06  Saam Barati  <sbarati@apple.com>

        preparePatchpointForExceptions needs to handle tuples
        https://bugs.webkit.org/show_bug.cgi?id=234909

        Reviewed by Yusuke Suzuki.

        We got the offsets wrong when building a stackmap in B3IRGenerator
        for exception sites. We need to index into StackmapGenerationParams
        differently from indexing into the patchpoint's children. StackmapGenerationParams
        reserves its first N entries for the N return values. The patchpoint's
        children contains no results though, so we don't need to account for
        the number of return values when indexing into the children() vector
        of the PatchpointValue. To make this code simpler, we keep track of the
        number of live values we need when throwing. These values are both
        at the end of StackmapGenerationParams and at the end of the children()
        vector. So we just look at the last "number of live values" in both
        vectors to get the correct ValueRep and correct type. The code for
        calls also didn't account for the fact that call arguments will be
        appended after the live values we're building into a stackmap. This
        patch fixes that code to always put the live values last.

        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::PatchpointExceptionHandle::generate const):
        (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions):

2022-01-06  Alex Christensen  <achristensen@webkit.org>

        Start using C++20
        https://bugs.webkit.org/show_bug.cgi?id=233963

        Reviewed by Yusuke Suzuki.

        * Configurations/Base.xcconfig:
        * Configurations/JavaScriptCore.xcconfig:
        * DerivedSources.make:
        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * runtime/CachedTypes.cpp:
        * runtime/LiteralParser.h:
        * shell/PlatformPlayStation.cmake:

2022-01-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove m_calleeSaveRegisters from CodeBlock::JITData and rename it to BaselineJITData
        https://bugs.webkit.org/show_bug.cgi?id=234555

        Reviewed by Saam Barati.

        This patch removes m_calleeSaveRegisters from CodeBlock::JITData, and moving it to each JITCode.
        This is reasonable since m_calleeSaveRegisters information belongs to JITCode, not CodeBlock.
        And in LLInt, Baseline, and DFG cases, m_calleeSaveRegisters is the same. So we do not have this
        field in these JITCode. Only FTL can have m_calleeSaveRegisters.

        By removing m_calleeSaveRegisters from CodeBlock::JITData, now it only includes Baseline JIT related
        data. So this patch renames CodeBlock::JITData to BaselineJITData.

        We also use TrailingArray for BaselineJITData so that we can remove one level indirection when loading
        JITConstantPool from JITData.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::getICStatusMap):
        (JSC::CodeBlock::findStubInfo):
        (JSC::CodeBlock::resetBaselineJITData):
        (JSC::CodeBlock::stronglyVisitStrongReferences):
        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
        (JSC::CodeBlock::findPC):
        (JSC::CodeBlock::ensureJITDataSlow): Deleted.
        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
        (JSC::CodeBlock::resetJITData): Deleted.
        (JSC::CodeBlock::calleeSaveRegisters const): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetOfBaselineJITData):
        (JSC::CodeBlock::baselineJITData):
        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
        (JSC::CodeBlock::JITData::offsetOfJITConstantPool): Deleted.
        (JSC::CodeBlock::ensureJITData): Deleted.
        (JSC::CodeBlock::offsetOfJITData): Deleted.
        (JSC::CodeBlock::baselineJITConstantPool): Deleted.
        * bytecode/Repatch.cpp:
        (JSC::linkPolymorphicCall):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::emitRestoreCalleeSaves):
        (JSC::DFG::JITCompiler::emitSaveCalleeSaves):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::calleeSaveSlot):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::compileInThreadImpl):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGStackLayoutPhase.cpp:
        (JSC::DFG::StackLayoutPhase::run):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLJITCode.h:
        (JSC::FTL::JITCode::calleeSaveRegisters const):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * interpreter/StackVisitor.cpp:
        (JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::executableFor):
        (JSC::AssemblyHelpers::emitSaveOrCopyLLIntBaselineCalleeSavesFor):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitSaveThenMaterializeTagRegisters):
        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): Deleted.
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor): Deleted.
        (JSC::AssemblyHelpers::emitSaveCalleeSaves): Deleted.
        (JSC::AssemblyHelpers::emitRestoreCalleeSaves): Deleted.
        * jit/BaselineJITCode.h:
        * jit/CallFrameShuffleData.cpp:
        * jit/CallFrameShuffleData.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
        (JSC::JIT::emitSaveCalleeSaves):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        * jit/JIT.h:
        * jit/JITCode.cpp:
        (JSC::JITCode::calleeSaveRegisters const):
        * jit/JITCode.h:
        * jit/JITInlines.h:
        (JSC::JIT::loadConstant):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        * jit/RegisterAtOffsetList.cpp:
        (JSC::RegisterAtOffsetList::dfgCalleeSaveRegisters):
        * jit/RegisterAtOffsetList.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * tools/VMInspector.cpp:
        (JSC::VMInspector::dumpRegisters):

2022-01-04  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] Fix non-ninja build of zydis
        https://bugs.webkit.org/show_bug.cgi?id=234854

        Unreviewed build fix

        * PlatformPlayStation.cmake: Set Zycore.c as CXX

2022-01-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove JSWebAssemblyCalleeGroup cell
        https://bugs.webkit.org/show_bug.cgi?id=234780

        Reviewed by Saam Barati.

        This cell is not observable to users. And this cell just holds Wasm-to-JS stubs,
        but it is the same to all memory modes. Thus, we should just generate it in VM-linked
        Wasm::Module (it means, we should have it in JSWebAssemblyModule), and we do not need
        to have / allocate JSWebAssemblyCalleeGroup cell.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::deleteAllCodeBlocks):
        * heap/Heap.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * wasm/WasmBinding.h:
        * wasm/js/JSWebAssemblyCalleeGroup.cpp: Removed.
        * wasm/js/JSWebAssemblyCalleeGroup.h: Removed.
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::visitChildrenImpl):
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/JSWebAssemblyModule.cpp:
        (JSC::JSWebAssemblyModule::createStub):
        (JSC::JSWebAssemblyModule::visitChildrenImpl):
        (JSC::JSWebAssemblyModule::clearJSCallICs):
        (JSC::JSWebAssemblyModule::finalizeUnconditionally):
        (JSC::JSWebAssemblyModule::generateWasmToJSStubs):
        (JSC::JSWebAssemblyModule::calleeGroup): Deleted.
        (JSC::JSWebAssemblyModule::setCalleeGroup): Deleted.
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/WebAssemblyModuleConstructor.cpp:
        * wasm/js/WebAssemblyWrapperFunction.h:

2022-01-04  Yusuke Suzuki  <ysuzuki@apple.com>

        WebAssembly i32.atomic.wait timeout value incorrectly interpreted by factor 1000
        https://bugs.webkit.org/show_bug.cgi?id=234833

        Reviewed by Michael Saboff.

        Wasm atomics' timeout should be interpreted as nanoseconds.

        * wasm/WasmOperations.cpp:
        (JSC::Wasm::wait):

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix build failure
        https://bugs.webkit.org/show_bug.cgi?id=232723

        * runtime/ArrayPrototype.cpp:
        (JSC::toLocaleString):

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        Array.prototype.toLocaleString does not respect deletion of Object.prototype.toLocaleString
        https://bugs.webkit.org/show_bug.cgi?id=232723

        Reviewed by Alexey Shvayka.

        This patch implements ECMA402 Array.prototype.toLocaleString[1]. The new implementation invokes "toLocaleString"
        method for each elements.

        [1]: https://tc39.es/ecma402/#sup-array.prototype.tolocalestring

        * runtime/ArrayPrototype.cpp:
        (JSC::toLocaleString):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::slowJoin):

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix Intl.PluralRules.selectRange input validation
        https://bugs.webkit.org/show_bug.cgi?id=234817

        Reviewed by Alexey Shvayka.

        Add specified argument validation[1] to Intl.PluralRules.selectRange.

        [1]: https://tc39.es/proposal-intl-numberformat-v3/out/pluralrules/proposed.html#sec-intl.pluralrules.prototype.selectrange

        * runtime/IntlPluralRules.cpp:
        (JSC::IntlPluralRules::selectRange const):
        * runtime/IntlPluralRulesPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Update UCD to Unicode 14.0.0
        https://bugs.webkit.org/show_bug.cgi?id=234811

        Reviewed by Sam Weinig.

        This is yearly update of UCD data.

        * ucd/CaseFolding.txt:
        * ucd/DerivedBinaryProperties.txt:
        * ucd/DerivedCoreProperties.txt:
        * ucd/DerivedNormalizationProps.txt:
        * ucd/PropList.txt:
        * ucd/PropertyAliases.txt:
        * ucd/PropertyValueAliases.txt:
        * ucd/ScriptExtensions.txt:
        * ucd/Scripts.txt:
        * ucd/UnicodeData.txt:
        * ucd/emoji-data.txt:
        * yarr/generateYarrUnicodePropertyTables.py:

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Read-modify-write operation's second put-to-scope should not throw error if binding does not exist
        https://bugs.webkit.org/show_bug.cgi?id=234813

        Reviewed by Alexey Shvayka.

        This patch fixes a bug throwing RefereceError when read-modify-write's read operation removes binding from object.
        Throwing error should happen only when evaluating it under strict mode.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::PostfixNode::emitResolve):
        (JSC::PrefixNode::emitResolve):
        (JSC::ReadModifyResolveNode::emitBytecode):
        (JSC::ShortCircuitReadModifyResolveNode::emitBytecode):

2022-01-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix length of Intl.NumberFormat.formatRange and Intl.PluralRules.selectRange
        https://bugs.webkit.org/show_bug.cgi?id=234806

        Reviewed by Alexey Shvayka.

        These length's numbers are wrong. This patch fixes them.

        * runtime/IntlNumberFormatPrototype.cpp:
        (JSC::IntlNumberFormatPrototype::finishCreation):
        * runtime/IntlPluralRulesPrototype.cpp:
        (JSC::IntlPluralRulesPrototype::finishCreation):

2022-01-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use emitPutProperty / emitGetPropertyValue consistently to handle private names in edge cases
        https://bugs.webkit.org/show_bug.cgi?id=234794

        Reviewed by Alexey Shvayka.

        This patch consistently uses emitPutProperty / emitGetPropertyValue so that we handle private names
        in edge cases.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::TaggedTemplateNode::emitBytecode):
        (JSC::ForInNode::emitLoopHeader):
        (JSC::ForOfNode::emitBytecode):
        (JSC::AssignmentElementNode::bindValue const):

2022-01-02  Zan Dobersek  <zdobersek@igalia.com>

        Remove unused AbstractMacroAssembler::repatchJumpToNop() function
        https://bugs.webkit.org/show_bug.cgi?id=234777

        Reviewed by Yusuke Suzuki.

        Remove the unused AbstractMacroAssembler::repatchJumpToNop() function,
        along with the underlying relinkJumpToNop() functions on ISA-specific
        assembler classes.

        * assembler/ARM64Assembler.h:
        (JSC::ARM64Assembler::relinkJumpToNop): Deleted.
        * assembler/ARMv7Assembler.h:
        (JSC::ARMv7Assembler::relinkJumpToNop): Deleted.
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::repatchJumpToNop): Deleted.
        * assembler/MIPSAssembler.h:
        (JSC::MIPSAssembler::relinkJumpToNop): Deleted.
        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Assembler::relinkJumpToNop): Deleted.
        * assembler/X86Assembler.h:
        (JSC::X86Assembler::relinkJumpToNop): Deleted.

2022-01-02  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Make DFG, FTL, B3, WASM buildable on CPU(RISCV64)
        https://bugs.webkit.org/show_bug.cgi?id=234775

        Reviewed by Yusuke Suzuki.

        Enable building DFG, FTL, B3 and WASM subsystems on 64-bit RISC-V.
        Necessary guards and missing bits are added to make things buildable,
        but actual enabling of these features at build-time is left for later.
        Even when enabled at build-time in the future, there'll likey be open
        issues that will require disabling different features at run-time.

        MacroAssemblerRISCV64::setCarry() no-op method is added for now. Carry
        flag retrieval isn't exactly possible on RISC-V, so the uses of it will
        have to be addressed some other way.

        The patchpointScratchRegister value is defined for CPU(RISCV64). As
        on ARM64, the value matches MacroAssemblerRISCV64::dataTempRegister.

        In B3, we follow ARM64 in the pinned extended-offset-address use and
        stack argument lowering.

        in WASM, we can again mirror ARM64 around LLInt callee registers and
        slots as well as executing the epilogue of a OSR-entry callee.

        * assembler/MacroAssembler.h: Provide lea64() for CPU(RISCV64) as well.
        * assembler/MacroAssemblerRISCV64.h:
        * b3/B3Common.cpp:
        (JSC::B3::pinnedExtendedOffsetAddrRegister):
        * b3/air/AirLowerStackArgs.cpp:
        (JSC::B3::Air::lowerStackArgs):
        * jit/GPRInfo.h:
        * wasm/WasmCallee.cpp:
        (JSC::Wasm::LLIntCallee::calleeSaveRegisters):
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::didCompleteCompilation):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::doOSREntry):

2022-01-02  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Enable building LLInt WebAssembly via the riscv64 offlineasm backend
        https://bugs.webkit.org/show_bug.cgi?id=234776

        Reviewed by Yusuke Suzuki.

        Sprinkle RISCV64 conditions around WebAssembly.asm as appropriate.
        For division, we can reuse the divi(s)/divq(s) instructions already
        available in offlineasm. RISC-V additionally provides remainder
        instructions, so the necessary offlineasm instructions are added
        and used for RISCV64.

        In the offlineasm riscv64 backend, the division and remainder
        instruction handling is improved to properly cover signed and unsigned
        variants. For other instructions used in LLint WebAssembly
        implementation like left or right rotation, trailing- or leading-zero
        counting, order-based floating-point comparison, load-reserved and
        store-conditional operations, the riscv64WASMPlaceholder helper is used
        to generate an ebreak instruction that will halt the program at runtime
        but will not throw a build-time error. Proper implementations will be
        provided once WebAssembly support on RISCV64 is taken up.

        * llint/WebAssembly.asm:
        * offlineasm/instructions.rb:
        * offlineasm/riscv64.rb:

2022-01-02  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Get testmasm building for CPU(RISCV64)
        https://bugs.webkit.org/show_bug.cgi?id=234774

        Reviewed by Yusuke Suzuki.

        Add missing MacroAssemblerRISCV64 methods used in testmasm. Placeholders
        are used for now, proper implementations will be introduced later.

        In testmasm itself, we avoid testing the condition-flags register values
        since, like on MIPS, that register isn't available on RISC-V.

        * assembler/MacroAssemblerRISCV64.h:
        * assembler/testmasm.cpp:
        (JSC::testProbeModifiesStackPointer):
        (JSC::testProbeModifiesStackValues):

2021-12-31  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Replace UDIS86 with Zydis
        https://bugs.webkit.org/show_bug.cgi?id=234765

        Reviewed by Michael Saboff.

        UDIS86 is not updated from 2014. Since it is missing relatively new SIMD opcodes,
        we cannot disassemble these opcodes when implementing Wasm SIMD.
        This patch replaces UDIS86 with Zydis, which is actively developed and used in
        SpiderMonkey too. It is under MIT license.

        This patch imports Zydis v3.2.1.

            1. Import header and C files of Zydis and Zycore in a flattened manner.
            2. Add directory names to the files (e.g. `Zydis/Decoder.c` => `ZydisDecoder.c`) to make it easy to build in JSC build.
            3. Replace header includes from `#include <Zydis/XXX.h>` to `#include "ZydisXXX.h"`.
            4. Fix compile errors with our stricter compiler flags.
            5. Remove Zycore API files and ZycoreArgParse.[hc] since they are not used.

        We didn't add files to Sources.txt since unified builds do not support C files currently.

2022-01-01  Jeff Miller  <jeffm@apple.com>

        Update user-visible copyright strings to include 2022
        https://bugs.webkit.org/show_bug.cgi?id=234263

        Reviewed by Anders Carlsson.

        * Info.plist:

2021-12-30  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, end-of-year 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=234755

        Unreviewed non-unified build fixes.

        * runtime/DeferredWorkTimer.h: Add missing JSCast.h header.

2021-12-28  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 operations for floating-point branches
        https://bugs.webkit.org/show_bug.cgi?id=234631

        Reviewed by Yusuke Suzuki.

        Add the floating-point branching operation implementations in
        MacroAssemblerRISCV64. Unordered status of values is determined through
        the fclass instruction and then handled as appropriate for the desired
        condition.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::branchFloat):
        (JSC::MacroAssemblerRISCV64::branchDouble):
        (JSC::MacroAssemblerRISCV64::branchDoubleNonZero):
        (JSC::MacroAssemblerRISCV64::branchDoubleZeroOrNaN):
        (JSC::MacroAssemblerRISCV64::branchTruncateDoubleToInt32):
        (JSC::MacroAssemblerRISCV64::branchConvertDoubleToInt32):
        (JSC::MacroAssemblerRISCV64::branchFP):

2021-12-28  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 operations for testing, comparison
        https://bugs.webkit.org/show_bug.cgi?id=234630

        Reviewed by Yusuke Suzuki.

        Add MacroAssemblerRISCV64 implementations for the different variants of
        compare and test instructions.

        For comparisons, the implementations set up the two values in separate
        registers and perform the comparison per the inquired relation, writing
        out the result into the destination register.

        For tests, the two values are set up and put through the bitwise AND,
        with the result evaluated and the destination register filled out
        according to the inquired result condition.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::compare8):
        (JSC::MacroAssemblerRISCV64::compare32):
        (JSC::MacroAssemblerRISCV64::compare64):
        (JSC::MacroAssemblerRISCV64::test8):
        (JSC::MacroAssemblerRISCV64::test32):
        (JSC::MacroAssemblerRISCV64::test64):
        (JSC::MacroAssemblerRISCV64::compareFinalize):
        (JSC::MacroAssemblerRISCV64::testFinalize):

2021-12-28  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 operations with patchable elements
        https://bugs.webkit.org/show_bug.cgi?id=234635

        Reviewed by Yusuke Suzuki.

        Add MacroAssemblerRISCV64 implementations for operations that generate
        patchable code sections. This covers moves, stores and branches.

        For moves and stores of pointer values, the patchable section is
        achieved by generating a immediate loader instruction sequence with all
        the placeholder instructions (nops) included.

        Some methods that had their noop implementations provided until now have
        been removed since they are not necessary anymore.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::moveWithPatch):
        (JSC::MacroAssemblerRISCV64::storePtrWithPatch):
        (JSC::MacroAssemblerRISCV64::branch32WithPatch):
        (JSC::MacroAssemblerRISCV64::branchPtrWithPatch):
        (JSC::MacroAssemblerRISCV64::patchableBranch64):

2021-12-28  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Enable signal-based VM traps for CPU(RISCV64)
        https://bugs.webkit.org/show_bug.cgi?id=234719

        Reviewed by Yusuke Suzuki.

        Enable signal-based VM traps on RISCV64. On Linux, this depends on
        generating a SIGSEGV or SIGBUS signal. The former can be generated
        through a simple storage instruction that sources the address from
        the zero register.

        This storage instruction is generated on the desired location through
        the RISCV64Assembler::replaceWithVMHalt() method.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::replaceWithVMHalt):
        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Assembler::replaceWithVMHalt):

2021-12-28  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Define HAVE_MACHINE_CONTEXT, provide mcontext_t accessors for CPU(RISCV64)
        https://bugs.webkit.org/show_bug.cgi?id=234718

        Reviewed by Yusuke Suzuki.

        Define HAVE_MACHINE_CONTEXT for RISCV64. In the MachineContext.h
        header, CPU(RISCV64)-specific accessors into the mcontext_t struct
        are also provided.

        * runtime/MachineContext.h:
        (JSC::MachineContext::stackPointerImpl):
        (JSC::MachineContext::framePointerImpl):
        (JSC::MachineContext::instructionPointerImpl):
        (JSC::MachineContext::argumentPointer<1>):
        (JSC::MachineContext::llintInstructionPointer):

2021-12-27  Yusuke Suzuki  <ysuzuki@apple.com>

        Consider merging Wasm::FunctionCodeBlock and Wasm::LLIntCallee
        https://bugs.webkit.org/show_bug.cgi?id=203691

        Reviewed by Filip Pizlo.

        This patch merges Wasm::FunctionCodeBlock into Wasm::LLIntCallee since both
        are one-on-one and what they want to represent are the same. We change
        Wasm::FunctionCodeBlock to Wasm::FunctionCodeBlockGenerator so that we can
        use FixedVector in Wasm::LLIntCallee which makes Wasm::LLIntCallee small,
        and this is similar to what JS side is doing (UnlinkedCodeBlockGenerator).

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/BytecodeDumper.cpp:
        (JSC::Wasm::BytecodeDumper::dumpBlock):
        (JSC::Wasm::BytecodeDumper::dumpConstants):
        (JSC::Wasm::BytecodeDumper::constantName const):
        * bytecode/BytecodeDumper.h:
        * interpreter/Interpreter.cpp:
        (JSC::CatchInfo::CatchInfo):
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/WebAssembly.asm:
        * wasm/WasmCallee.cpp:
        (JSC::Wasm::LLIntCallee::LLIntCallee):
        (JSC::Wasm::LLIntCallee::outOfLineJumpOffset):
        (JSC::Wasm::LLIntCallee::outOfLineJumpTarget):
        (JSC::Wasm::LLIntCallee::linkExceptionHandlers): Deleted.
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::llintFunctionCodeBlock const): Deleted.
        * wasm/WasmFunctionCodeBlockGenerator.cpp: Renamed from Source/JavaScriptCore/wasm/WasmFunctionCodeBlock.cpp.
        (JSC::Wasm::FunctionCodeBlockGenerator::setInstructions):
        (JSC::Wasm::FunctionCodeBlockGenerator::addOutOfLineJumpTarget):
        (JSC::Wasm::FunctionCodeBlockGenerator::outOfLineJumpOffset):
        (JSC::Wasm::FunctionCodeBlockGenerator::addSignature):
        (JSC::Wasm::FunctionCodeBlockGenerator::addJumpTable):
        (JSC::Wasm::FunctionCodeBlockGenerator::numberOfJumpTables const):
        * wasm/WasmFunctionCodeBlockGenerator.h: Renamed from Source/JavaScriptCore/wasm/WasmFunctionCodeBlock.h.
        (JSC::Wasm::FunctionCodeBlockGenerator::FunctionCodeBlockGenerator):
        (JSC::Wasm::FunctionCodeBlockGenerator::tierUpCounter):
        * wasm/WasmGeneratorTraits.h:
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::parseAndCompileBytecode):
        (JSC::Wasm::LLIntGenerator::LLIntGenerator):
        (JSC::Wasm::LLIntGenerator::finalize):
        (JSC::Wasm::LLIntGenerator::addLoop):
        (JSC::Wasm::LLIntGenerator::addSwitch):
        * wasm/WasmLLIntGenerator.h:
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::compileFunction):
        (JSC::Wasm::LLIntPlan::didCompleteCompilation):
        * wasm/WasmLLIntPlan.h:
        * wasm/WasmLLIntTierUpCounter.h:
        (JSC::Wasm::LLIntTierUpCounter::LLIntTierUpCounter):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::shouldJIT):
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::WASM_SLOW_PATH_DECL):
        (JSC::LLInt::doWasmCallIndirect):
        (JSC::LLInt::doWasmCallRef):

2021-12-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use SlowPathReturnType instead of EncodedMatchResult
        https://bugs.webkit.org/show_bug.cgi?id=234686

        Reviewed by Filip Pizlo.

        This patch replaces YarrJIT's EncodedMatchResult with SlowPathReturnType so that
        CCallHelpers can handle it correctly.

        * runtime/MatchResult.h:
        (JSC::MatchResult::MatchResult):
        (JSC::MatchResult::failed):
        * runtime/SlowPathReturnType.h:
        (JSC::decodeResult):
        * yarr/YarrJIT.h:

2021-12-23  Mark Lam  <mark.lam@apple.com>

        Make DeferredWorkTimer::addPendingWork() return a Ticket.
        https://bugs.webkit.org/show_bug.cgi?id=234628
        rdar://84260429

        Reviewed by Yusuke Suzuki.

        1. Make Ticket a unique token instead of the JSObject* target object.
           The Ticket is now a pointer to the TicketData in the pending work list.

        2. Instead of taking a Ticket argument, DeferredWorkTimer::addPendingWork() now
           takes a JSObject* `target` argument explicitly, and returns the Ticket for the
           added TicketData instead.

           All the relevant DeferredWorkTimer APIS already take a Ticket as an argument.
           This ensures that addPendingWork() is called before we start doing work with
           these APIs (especially scheduleWorkSoon()).

        3. Previously, addPendingWork() will only save one instance of TicketData for
           a given JSObject* key.  With this patch, we'll register a new TicketData
           instance for every call to addPendingWork(), and return a unique Ticket for it.

           This is needed because it may be possible for 2 different clients to call
           addPendingWork() and scheduleWorkSoon() with the same target JSObject* but with
           different sets of dependencies.

           Secondly, even is the both sets of dependencies are identical, a client may
           call addPendingWork() and scheduleWorkSoon() with the same JSObject* target
           more than once because it intended to schedule more than 1 task to run.

           Note that DeferredWorkTimer::doWork() consumes the corresponding TicketData
           (i.e. removes it from the m_pendingTickets list) for each task as it is run.
           To ensure that the dependencies for each task is protected, we'll either need
           to ref count the TicketData for the same target object (and hold off on removing
           it from the list), or we'll need to register a different TicketData instance
           for each task.  Ref counting can solve the second issue above, but does not
           solve the first.  So, this patch goes with the more generic solution to allow
           each task to have its own TicketData instance (and, its own unique Ticket).

        4. Previously, if the client cancels pending work, we would remove the TicketData
           immediately from the m_pendingTickets list.  This opens up an opportunity for
           the same TicketData memory to be re-allocated by another client.  This, in turn,
           would make the Ticket token not unique and potentially allow a cancelled ticket
           to be reused before DeferredWorkTimer::doWork() is called.

           This patch changes DeferredWorkTimer::cancelPendingWork() to only clear the
           contents of the TicketData instead.  TicketData::scriptExecutionOwner being
           null is used as an indication that the ticket has been cancelled.  Since the
           TicketData itself is not "freed" yet, all TicketData will remain unique until
           DeferredWorkTimer::doWork().

           Consequently, DeferredWorkTimer::doWork() will now check for cancelled tickets
           and remove them from the m_pendingTickets list.

        5. JSFinalizationRegistry was previously calling DeferredWorkTimer::hasPendingWork()
           to check if it has already scheduled a task, so as not to reschedule again until
           after the previously scheduled task has been run.  This does not play nice
           with the new Ticket API, because this hasPendingWork() check needs to be done
           before calling addPendingWork(), and hence, the Ticket is not available yet.

           Fortunately, JSFinalizationRegistry should know if it has already scheduled
           a task itself.  This patch adds a m_hasAlreadyScheduledWork flag to 
           JSFinalizationRegistry that can be used for this check instead.

        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * runtime/DeferredWorkTimer.cpp:
        (JSC::DeferredWorkTimer::TicketData::TicketData):
        (JSC::DeferredWorkTimer::TicketData::vm):
        (JSC::DeferredWorkTimer::TicketData::cancel):
        (JSC::DeferredWorkTimer::doWork):
        (JSC::DeferredWorkTimer::addPendingWork):
        (JSC::DeferredWorkTimer::hasPendingWork):
        (JSC::DeferredWorkTimer::hasDependancyInPendingWork):
        (JSC::DeferredWorkTimer::cancelPendingWork):
        * runtime/DeferredWorkTimer.h:
        (JSC::DeferredWorkTimer::TicketData::target):
        * runtime/JSFinalizationRegistry.cpp:
        (JSC::JSFinalizationRegistry::finalizeUnconditionally):
        * runtime/JSFinalizationRegistry.h:
        * wasm/WasmStreamingCompiler.cpp:
        (JSC::Wasm::StreamingCompiler::StreamingCompiler):
        (JSC::Wasm::StreamingCompiler::~StreamingCompiler):
        (JSC::Wasm::StreamingCompiler::didComplete):
        (JSC::Wasm::StreamingCompiler::fail):
        (JSC::Wasm::StreamingCompiler::cancel):
        * wasm/WasmStreamingCompiler.h:
        * wasm/js/JSWebAssembly.cpp:
        (JSC::JSWebAssembly::webAssemblyModuleValidateAsync):
        (JSC::instantiate):
        (JSC::compileAndInstantiate):
        (JSC::JSWebAssembly::webAssemblyModuleInstantinateAsync):

2021-12-22  Saam Barati  <sbarati@apple.com>

        LLInt should loop OSR into BBQ and BBQ should loop OSR into OMG
        https://bugs.webkit.org/show_bug.cgi?id=234542

        Reviewed by Yusuke Suzuki.

        It's a startup perf improvement on some Wasm benchmarks I'm running to have
        Wasm LLInt do loop OSR entry into BBQ instead of OMG. This improves this
        benchmark by 5%. There is probably more perf to be had here. Currently,
        we're just OSR entering into B3 BBQ O1. However, in the future, we should
        just compile a single Air BBQ Callee that allows for OSR entry at loop
        boundaries. Maybe we can model this using EntrySwitch without any real
        harm to throughput.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * assembler/MacroAssemblerCodeRef.cpp:
        (JSC::shouldDumpDisassemblyFor):
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::parseAndCompile):
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::setOSREntryCallee): Deleted.
        * wasm/WasmCalleeGroup.h:
        * wasm/WasmCompilationMode.cpp:
        (JSC::Wasm::makeString):
        * wasm/WasmCompilationMode.h:
        (JSC::Wasm::isOSREntry):
        (JSC::Wasm::isAnyBBQ):
        (JSC::Wasm::isAnyOMG):
        * wasm/WasmOMGForOSREntryPlan.cpp: Removed.
        * wasm/WasmOMGForOSREntryPlan.h: Removed.
        * wasm/WasmOSREntryPlan.cpp: Copied from Source/JavaScriptCore/wasm/WasmOMGForOSREntryPlan.cpp.
        (JSC::Wasm::OSREntryPlan::OSREntryPlan):
        (JSC::Wasm::OSREntryPlan::work):
        (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan): Deleted.
        (JSC::Wasm::OMGForOSREntryPlan::work): Deleted.
        * wasm/WasmOSREntryPlan.h: Copied from Source/JavaScriptCore/wasm/WasmOMGForOSREntryPlan.h.
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::doOSREntry):
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::updateCallSitesToCallUs):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::WASM_SLOW_PATH_DECL):

2021-12-22  Alex Christensen  <achristensen@webkit.org>

        Fix compiling with pickier compiler
        https://bugs.webkit.org/show_bug.cgi?id=234593

        Reviewed by Brady Eidson.

        * API/tests/Regress141275.mm:
        (-[JSTEvaluator initWithScript:]):
        * API/tests/testapi.mm:
        (checkModuleWasRejected):

2021-12-22  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add RISCV64 support in YARR
        https://bugs.webkit.org/show_bug.cgi?id=234547

        Reviewed by Yusuke Suzuki.

        Add RISCV64 support to YARR. This covers providing the required register
        and immediate defitinitions, as well as also enabling codepaths shared
        with other 64-bit architectures.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::load16): YARR JIT also requires a load16()
        overload that loads from an ExtendedAddress.
        * yarr/YarrJIT.cpp:
        * yarr/YarrJITRegisters.h:

2021-12-22  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Fix RISCV64Assembler::ImmediateDecomposition in debug builds
        https://bugs.webkit.org/show_bug.cgi?id=234594

        Unreviewed, fix the RISCV64Assembler::ImmediateDecomposition constructor
        to build in debug mode (fixing the assert) as well as run properly in
        that mode (performing manual sign-extension on the lower 12 bits of the
        IImmediate value as required for this type of immediates).

        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Instructions::ImmediateDecomposition::ImmediateDecomposition):

2021-12-21  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add or enable missing CPU(RISCV64) codepaths in baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=234551

        Reviewed by Yusuke Suzuki.

        Sprinkle the necessary CPU(RISCV64) build guards as well as additional
        RISCV64-specific codepaths encapsualted by those build guards in the
        baseline JIT code. In many cases we can align with the code that ARM64
        is already using.

        In InlineAccess, the byte-sizes for access and replacement operations
        are based on a mix of educated guessing and aggressive testing.

        In baseline JIT, we can usually adopt what ARM64 already does since the
        similarities are big enough.

        * bytecode/InlineAccess.h: The sizes here are based on the estimated
        count of necessary instructions for access or replacement, and were
        tested with the enabled crash-inducing fallback in linkCodeInline().
        (JSC::InlineAccess::sizeForPropertyAccess):
        (JSC::InlineAccess::sizeForPropertyReplace):
        (JSC::InlineAccess::sizeForLengthAccess):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitLoadStructure):
        (JSC::AssemblyHelpers::debugCall):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitSaveThenMaterializeTagRegisters):
        (JSC::AssemblyHelpers::emitRestoreSavedTagRegisters):
        (JSC::AssemblyHelpers::prologueStackPointerDelta):
        (JSC::AssemblyHelpers::emitFunctionPrologue):
        (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
        (JSC::AssemblyHelpers::emitFunctionEpilogue):
        (JSC::AssemblyHelpers::preserveReturnAddressAfterCall):
        (JSC::AssemblyHelpers::restoreReturnAddressBeforeReturn):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::prepareForTailCallSlow):
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::prepareForTailCall):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        * jit/RegisterSet.cpp:
        (JSC::RegisterSet::macroScratchRegisters):
        (JSC::RegisterSet::dfgCalleeSaveRegisters):
        (JSC::RegisterSet::ftlCalleeSaveRegisters):
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):

2021-12-21  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add missing MacroAssemblerRISCV64 floating-point rounding, comparison methods
        https://bugs.webkit.org/show_bug.cgi?id=234475

        Reviewed by Yusuke Suzuki.

        Add missing MacroAssemblerRISCV64 methods that cover floating-point
        rounding and comparison operations. Manually detecting NaN values is
        possible by classifying floating-point values, and subsequently
        rounding operation or different comparison conditions have to be
        handled appropriately.

        Single-precision and double-precision implementations can neatly be
        handled in singular templated helper methods, and precision-specific
        codepaths can be determined at compile-time.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::ceilFloat):
        (JSC::MacroAssemblerRISCV64::ceilDouble):
        (JSC::MacroAssemblerRISCV64::floorFloat):
        (JSC::MacroAssemblerRISCV64::floorDouble):
        (JSC::MacroAssemblerRISCV64::roundTowardNearestIntFloat):
        (JSC::MacroAssemblerRISCV64::roundTowardNearestIntDouble):
        (JSC::MacroAssemblerRISCV64::roundTowardZeroFloat):
        (JSC::MacroAssemblerRISCV64::roundTowardZeroDouble):
        (JSC::MacroAssemblerRISCV64::compareFloat):
        (JSC::MacroAssemblerRISCV64::compareDouble):
        (JSC::MacroAssemblerRISCV64::roundFP):
        (JSC::MacroAssemblerRISCV64::compareFP):

2021-12-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        CSP: Include the sample in eval violation reports
        https://bugs.webkit.org/show_bug.cgi?id=234390

        Reviewed by Kate Cheney.

        * interpreter/Interpreter.cpp:
        (JSC::eval): Pass the code to reportViolationForUnsafeEval().
        * runtime/DirectEvalExecutable.cpp:
        (JSC::DirectEvalExecutable::create): Ditto.
        * runtime/FunctionConstructor.cpp:
        (JSC::stringifyFunction): Helper function with the code to stringify function to be called also for the csp
        violation report.
        (JSC::constructFunction): Call stringifyFunction() to get the code for reportViolationForUnsafeEval().
        (JSC::constructFunctionSkippingEvalEnabledCheck): Use stringifyFunction().
        * runtime/IndirectEvalExecutable.cpp:
        (JSC::IndirectEvalExecutable::createImpl): Pass the code to reportViolationForUnsafeEval().
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::reportViolationForUnsafeEval): Add string parameter for the code sample.
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION): Pass the code to reportViolationForUnsafeEval().

2021-12-21  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add basic MacroAssemblerRISCV64 branching methods
        https://bugs.webkit.org/show_bug.cgi?id=234474

        Reviewed by Yusuke Suzuki.

        Add MacroAssemblerRISCV64 implementations for the basic branching
        methods. RelationalCondition enum values are aliased to the branching
        condition values in RISCV64Assembler. The makeBranch() helper method
        is added that generates the final branching instruction for the given
        condition and the two registers holding values for the comparison and
        returns the Jump object based on the label constructed at the location
        of the branching placeholder.

        Branching methods essentially consist of preparing the two registers
        and calling the makeBranch() method. For 8-bit and 32-bit comparisons
        the compared values have to be sign-extended into the scratch registers
        because the branching instructions don't operate on partial values. This
        might cause friction in higher JIT levels where the use of scratch
        registers is disallowed.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::invert):
        (JSC::MacroAssemblerRISCV64::branch8):
        (JSC::MacroAssemblerRISCV64::branch32):
        (JSC::MacroAssemblerRISCV64::branch64):
        (JSC::MacroAssemblerRISCV64::branch32WithUnalignedHalfWords):
        (JSC::MacroAssemblerRISCV64::makeBranch):

2021-12-21  Geza Lore  <glore@igalia.com>

        [JSC][ARMv7] Minor code size improvements
        https://bugs.webkit.org/show_bug.cgi?id=234387

        Reviewed by Yusuke Suzuki.

        A few mew code size improvements to ARMv7/Thumb-2

        - Use ldrd/strd in mode places (via AssemblyHelpers:loadValue
        and AssemblyHelpers::storeValue)

        - Use BIC immediate instruction instead of AND where appropriate

        - Use a 2-byte ADDS instead of a 4-byte CMN when possible. This
        applies very often as it handles testing JSValue tags.

        - Use addressTempRegister in branch32

        Overall saving of about 3.5% code size on JetStream2, according to
        --dumpLinkBufferStats.

        * assembler/ARMv7Assembler.h:
        (JSC::ARMv7Assembler::bic):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::and32):
        (JSC::MacroAssemblerARMv7::storePair32):
        (JSC::MacroAssemblerARMv7::compare32AndSetFlags):
        (JSC::MacroAssemblerARMv7::branch32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::storePair32):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::fillJSValue):
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::storeValue):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_mov):

2021-12-19  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] OpPow should have a "small int exponent" fast path at lower tiers
        https://bugs.webkit.org/show_bug.cgi?id=234408

        Reviewed by Yusuke Suzuki.

        DFG has an ArithPow fast path which just multiplies in a loop when the exponent is an int between 0 and 1000;
        this can be done at lower tiers too.

        Implementing this at LLInt gives the following speedup with JIT disabled:

                                  Before                    After

        pow-int-int         193.7180+-0.4897     ^    100.3569+-1.9804        ^ definitely 1.9303x faster
        pow-double-int      194.0744+-0.7998     ^    100.0346+-0.8655        ^ definitely 1.9401x faster

        <geometric>         193.8824+-0.4667     ^    100.0964+-0.9922        ^ definitely 1.9370x faster

        Implementing this at Baseline gives similar results with DFG disabled:

                                          Before                    After

        pow-int-int         195.6251+-0.9577     ^     99.9627+-0.3307        ^ definitely 1.9570x faster
        pow-double-int      196.1975+-0.9307     ^    101.0056+-0.3124        ^ definitely 1.9424x faster

        <geometric>         195.8786+-0.5883     ^    100.4767+-0.2333        ^ definitely 1.9495x faster

        Results are neutral otherwise.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_op_pow):
        (JSC::JIT::emitSlow_op_pow):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-12-18  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Fix undefined behavior causing miscompilation with clang 13 on ARM
        https://bugs.webkit.org/show_bug.cgi?id=234399

        Reviewed by Yusuke Suzuki.

        Compiling JSC with clang 13 on ARMv7 on linux was broken because clang
        was marking the constant Infinity as poison during constant folding, if
        either -O2 or -O3 were used, causing the constant to not being
        initialized.

        This patch removes the undefined behaviour by preventing the
        static_cast to int32_t if the double is either inf or NaN.

        * runtime/MathCommon.h:
        (JSC::canBeInt32):
        (JSC::canBeStrictInt32):

2021-12-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not allocate m_bbqCallee and m_omgCallee until it becomes necessary
        https://bugs.webkit.org/show_bug.cgi?id=234457

        Reviewed by Saam Barati.

        WebAssembly memory import will require initializing both Wasm::CalleeGroup.
        So, we should shrink memory size of Wasm::CalleeGroup as much as possible
        to avoid memory regression. This patch allocates m_bbqCallee and m_omgCallee
        only when it becomes available.

        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        * wasm/WasmCalleeGroup.cpp:
        (JSC::Wasm::CalleeGroup::CalleeGroup):
        * wasm/WasmCalleeGroup.h:
        (JSC::Wasm::CalleeGroup::compilationFinished): Deleted.
        (JSC::Wasm::CalleeGroup::runnable): Deleted.
        (JSC::Wasm::CalleeGroup::errorMessage): Deleted.
        (JSC::Wasm::CalleeGroup::functionImportCount const): Deleted.
        (JSC::Wasm::CalleeGroup::embedderEntrypointCalleeFromFunctionIndexSpace): Deleted.
        (JSC::Wasm::CalleeGroup::wasmEntrypointCalleeFromFunctionIndexSpace): Deleted.
        (JSC::Wasm::CalleeGroup::wasmBBQCalleeFromFunctionIndexSpace): Deleted.
        (JSC::Wasm::CalleeGroup::entrypointLoadLocationFromFunctionIndexSpace): Deleted.
        (JSC::Wasm::CalleeGroup::wasmToWasmExitStub): Deleted.
        (JSC::Wasm::CalleeGroup::mode const): Deleted.
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::updateCallSitesToCallUs):
        * wasm/WasmPlan.h:

2021-12-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [WTF] Introduce TrailingArray
        https://bugs.webkit.org/show_bug.cgi?id=234201

        Reviewed by Darin Adler.

        Use ThreadSafeRefCountedFixedVector in ObjectPropertyConditionSet and Wasm::LLIntCallees.

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::baselineJITConstantPool):
        * bytecode/ObjectPropertyConditionSet.cpp:
        (JSC::ObjectPropertyConditionSet::mergedWith const):
        (JSC::ObjectPropertyConditionSet::dumpInContext const):
        (JSC::ObjectPropertyConditionSet::isValidAndWatchable const):
        * bytecode/ObjectPropertyConditionSet.h:
        (JSC::ObjectPropertyConditionSet::invalid):
        (JSC::ObjectPropertyConditionSet::create):
        (JSC::ObjectPropertyConditionSet::isValid const):
        (JSC::ObjectPropertyConditionSet::size const):
        (JSC::ObjectPropertyConditionSet::begin const):
        (JSC::ObjectPropertyConditionSet::end const):
        (JSC::ObjectPropertyConditionSet::ObjectPropertyConditionSet): Deleted.
        (JSC::ObjectPropertyConditionSet::releaseRawPointer): Deleted.
        (JSC::ObjectPropertyConditionSet::adoptRawPointer): Deleted.
        (JSC::ObjectPropertyConditionSet::fromRawPointer): Deleted.
        (JSC::ObjectPropertyConditionSet::Data::Data): Deleted.
        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        * jit/JITInlines.h:
        (JSC::JIT::loadConstant):
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * wasm/WasmCallee.h:
        (JSC::Wasm::LLIntCallees::create): Deleted.
        (JSC::Wasm::LLIntCallees::at const): Deleted.
        (JSC::Wasm::LLIntCallees::data const): Deleted.
        (JSC::Wasm::LLIntCallees::LLIntCallees): Deleted.
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::create):
        (JSC::Wasm::CodeBlock::CodeBlock):
        * wasm/WasmCodeBlock.h:
        * wasm/WasmModule.cpp:
        (JSC::Wasm::Module::Module):
        (JSC::Wasm::Module::getOrCreateCodeBlock):
        * wasm/WasmModule.h:

2021-12-17  Saam Barati  <sbarati@apple.com>

        Use IRC by default on arm64
        https://bugs.webkit.org/show_bug.cgi?id=234449

        Reviewed by Yusuke Suzuki.

        I'm seeing a Wasm perf improvement on some benchmarks of ~12% by switching
        from Briggs to IRC. Let's make IRC the default on arm64.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        * b3/air/AirAllocateRegistersByGraphColoring.h:
        (JSC::B3::Air::useIRC): Deleted.

2021-12-17  Saam Barati  <sbarati@apple.com>

        Support WasmAddress in B3 CSE
        https://bugs.webkit.org/show_bug.cgi?id=234051
        <rdar://problem/86552957>

        Reviewed by Filip Pizlo and Yusuke Suzuki.

        This patch adds support in B3's CSE phase to handle WasmAddressValue computations.
        The reason this can't partake in pure CSE is that WasmAddressValue reads pinned.
        To support this, we keep track of which blocks write pinned. If we're trying to
        replace a value V2 with V1 because it appears there is a redundancy, we check if
        any paths from V1 to V2 write pinned. If none do, we proceed with the replacement.

        * b3/B3EliminateCommonSubexpressions.cpp:

2021-12-17  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Implement linking and patching support in RISCV64Assembler
        https://bugs.webkit.org/show_bug.cgi?id=234398

        Reviewed by Yusuke Suzuki.

        Populate RISCV64Assembler class with the necessary implementations and
        facilities to support linking and patching operations. Implementations
        of different methods in MacroAssemblerRISCV64 covering calls, jumps
        and patches are also added.

        Helper structs are added in the RISCV64Assembler class that cover
        linking of jumps, calls or branches and patching of pointer values.
        Relevant methods are also implemented to utilize these helpers.

        RISCV64Assembler also gains helper methods that generate placeholders
        for the specific type of linking or patching. The passed-in functor is
        then invoked, enabling the user (MacroAssemblerRISCV64 implementation)
        to additionally generate the desired instruction sequence that utilizes
        the given placeholder.

        In MacroAssemblerRISCV64, different noop methods covering jumps, calls,
        linking and patching are replaced with the appropriate implementations.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::readCallTarget):
        (JSC::MacroAssemblerRISCV64::replaceWithJump):
        (JSC::MacroAssemblerRISCV64::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerRISCV64::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerRISCV64::linkCall):
        (JSC::MacroAssemblerRISCV64::repatchCall):
        (JSC::MacroAssemblerRISCV64::jump):
        (JSC::MacroAssemblerRISCV64::farJump):
        (JSC::MacroAssemblerRISCV64::nearCall):
        (JSC::MacroAssemblerRISCV64::nearTailCall):
        (JSC::MacroAssemblerRISCV64::threadSafePatchableNearCall):
        (JSC::MacroAssemblerRISCV64::ret):
        (JSC::MacroAssemblerRISCV64::call):
        (JSC::MacroAssemblerRISCV64::callOperation):
        (JSC::MacroAssemblerRISCV64::startOfPatchableBranchPtrWithPatchOnAddress): Deleted.
        (JSC::MacroAssemblerRISCV64::startOfPatchableBranch32WithPatchOnAddress): Deleted.
        (JSC::MacroAssemblerRISCV64::revertJumpReplacementToPatchableBranchPtrWithPatch): Deleted.
        (JSC::MacroAssemblerRISCV64::revertJumpReplacementToPatchableBranch32WithPatch): Deleted.
        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Instructions::ImmediateBase::immediateMask):
        (JSC::RISCV64Instructions::ImmediateBase::v):
        (JSC::RISCV64Instructions::ImmediateDecomposition::ImmediateDecomposition):
        (JSC::RISCV64Assembler::getDifferenceBetweenLabels):
        (JSC::RISCV64Assembler::getCallReturnOffset):
        (JSC::RISCV64Assembler::labelIgnoringWatchpoints):
        (JSC::RISCV64Assembler::labelForWatchpoint):
        (JSC::RISCV64Assembler::label):
        (JSC::RISCV64Assembler::linkJump):
        (JSC::RISCV64Assembler::linkCall):
        (JSC::RISCV64Assembler::linkPointer):
        (JSC::RISCV64Assembler::maxJumpReplacementSize):
        (JSC::RISCV64Assembler::patchableJumpSize):
        (JSC::RISCV64Assembler::repatchPointer):
        (JSC::RISCV64Assembler::relinkJump):
        (JSC::RISCV64Assembler::relinkJumpToNop):
        (JSC::RISCV64Assembler::relinkCall):
        (JSC::RISCV64Assembler::replaceWithJump):
        (JSC::RISCV64Assembler::revertJumpReplacementToPatch):
        (JSC::RISCV64Assembler::readCallTarget):
        (JSC::RISCV64Assembler::cacheFlush):
        (JSC::RISCV64Assembler::fillNops):
        (JSC::RISCV64Assembler::jumpPlaceholder):
        (JSC::RISCV64Assembler::branchPlaceholder):
        (JSC::RISCV64Assembler::pointerCallPlaceholder):
        (JSC::RISCV64Assembler::nearCallPlaceholder):
        (JSC::RISCV64Assembler::LinkJumpOrCallImpl::apply):
        (JSC::RISCV64Assembler::LinkJumpImpl::placeholderInsn):
        (JSC::RISCV64Assembler::LinkJumpImpl::generatePlaceholder):
        (JSC::RISCV64Assembler::LinkCallImpl::placeholderInsn):
        (JSC::RISCV64Assembler::LinkCallImpl::generatePlaceholder):
        (JSC::RISCV64Assembler::LinkBranchImpl::placeholderInsn):
        (JSC::RISCV64Assembler::LinkBranchImpl::generatePlaceholder):
        (JSC::RISCV64Assembler::LinkBranchImpl::apply):
        (JSC::RISCV64Assembler::PatchPointerImpl::placeholderInsn):
        (JSC::RISCV64Assembler::PatchPointerImpl::generatePlaceholder):
        (JSC::RISCV64Assembler::PatchPointerImpl::apply):
        (JSC::RISCV64Assembler::PatchPointerImpl::read):

2021-12-16  Saam Barati  <sbarati@apple.com>

        Use arm64's fmax/fmin instructions in Wasm
        https://bugs.webkit.org/show_bug.cgi?id=234367

        Reviewed by Keith Miller.

        This patch adds support in B3 for FMax and FMin. We use this for Wasm's f32/64
        min/max operations. On arm64, we select the arm64 fmin/fmax instructions
        for these B3 opcodes. On x86, we lower these to control flow to calculate the
        result inside of lower macros.
        
        This speeds up Wasm programs that make heavy usage of min/max.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::floatMax):
        (JSC::MacroAssemblerARM64::floatMin):
        (JSC::MacroAssemblerARM64::doubleMax):
        (JSC::MacroAssemblerARM64::doubleMin):
        * b3/B3Common.h:
        (JSC::B3::fMax):
        (JSC::B3::fMin):
        * b3/B3ConstDoubleValue.cpp:
        (JSC::B3::ConstDoubleValue::fMinConstant const):
        (JSC::B3::ConstDoubleValue::fMaxConstant const):
        * b3/B3ConstDoubleValue.h:
        * b3/B3ConstFloatValue.cpp:
        (JSC::B3::ConstFloatValue::fMinConstant const):
        (JSC::B3::ConstFloatValue::fMaxConstant const):
        * b3/B3ConstFloatValue.h:
        * b3/B3LowerMacros.cpp:
        * b3/B3LowerToAir.cpp:
        * b3/B3Opcode.cpp:
        (WTF::printInternal):
        * b3/B3Opcode.h:
        * b3/B3ReduceStrength.cpp:
        * b3/B3Validate.cpp:
        * b3/B3Value.cpp:
        (JSC::B3::Value::fMinConstant const):
        (JSC::B3::Value::fMaxConstant const):
        (JSC::B3::Value::effects const):
        (JSC::B3::Value::key const):
        (JSC::B3::Value::typeFor):
        * b3/B3Value.h:
        * b3/B3ValueInlines.h:
        * b3/B3ValueKey.cpp:
        (JSC::B3::ValueKey::materialize const):
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_1.cpp:
        (run):
        * b3/testb3_7.cpp:
        (testFMaxMin):
        (testFloatMaxMin):
        (testDoubleMaxMin):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::addFloatingPointMinOrMax):
        (JSC::Wasm::AirIRGenerator::addOp<OpType::F32Min>):
        * wasm/wasm.json:

2021-12-16  Caitlin Potter  <caitp@igalia.com>

        [JSC] only emit pointer validation for ARM64E
        https://bugs.webkit.org/show_bug.cgi?id=234402

        Reviewed by Yusuke Suzuki and Mark Lam.

        JIT thunks no longer emit `push <reg>; pop <reg>;` on
        non-ARM64E arches with the emitPointerValidation macro.

        * jit/ThunkGenerators.cpp:
        (JSC::emitPointerValidation):

2021-12-16  Michael Saboff  <msaboff@apple.com>

        Create symlinks pointing to alternate root framework locations
        https://bugs.webkit.org/show_bug.cgi?id=234374

        Reviewed by Filip Pizlo.

        Added build variables and build step to create symlinks pointing to the alternate
        build locations from the current framework install location.

        * Configurations/JavaScriptCore.xcconfig:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Scripts/create-symlink-to-altroot.sh: Added.

2021-12-16  Devin Rousso  <drousso@apple.com>

        Implement Array.prototype.groupBy and Array.prototype.groupByToMap
        https://bugs.webkit.org/show_bug.cgi?id=234327

        Reviewed by Yusuke Suzuki.

        Implement new Array Grouping proposal <https://tc39.es/proposal-array-grouping/>, which just
        reached Stage 3.

        `Array.prototype.groupBy`/`Array.prototype.groupByToMap` will return a `{}`/`Map` where each
        value in the array is put into a "bucket" keyed by the return value of the provoded callback.

        ```js
        const array = [1, 2, 3, 4];

        array.groupBy(n => n % 2 ? "odd" : "even") // { odd: [1, 3], even: [2, 4] }
        array.groupByToMap(n => n % 2 ? "odd" : "even") // new Map([["odd", [1, 3]], ["even", [2, 4]])
        ```

        * builtins/ArrayPrototype.js:
        (groupBy): Added.
        (groupByToMap): Added.
        * runtime/ArrayPrototype.cpp:
        (JSC::ArrayPrototype::finishCreation):

        * bytecode/BytecodeIntrinsicRegistry.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::BytecodeIntrinsicNode::emit_intrinsic_toPropertyKey): Added.
        Allow `@toPropertyKey` to be used in builtins to convert a value to a property key. This is
        used to avoid converting the return value of the callback given to `groupBy` more than once.

        * builtins/BuiltinNames.h:
        * bytecode/LinkTimeConstant.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        Allow `@Map` to be used in builtins to create a primordial `Map` instance. This is used to
        avoid side effects when creating and populating the `Map` returned by `groupByToMap`.

        * runtime/OptionsList.h:
        Add `useArrayGroupByMethod` option.

2021-12-15  Yusuke Suzuki  <ysuzuki@apple.com>

        Rename Wasm::CodeBlock to Wasm::CalleeGroup
        https://bugs.webkit.org/show_bug.cgi?id=203694

        Reviewed by Mark Lam.

        This is not a CodeBlock. And the name causes confusion with JSC::CodeBlock, which is not at all related.
        This patch renames it to Wasm::CalleeGroup.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::deleteAllCodeBlocks):
        * heap/Heap.h:
        (JSC::Heap::forEachCodeBlockSpace):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::BBQPlan):
        (JSC::Wasm::BBQPlan::work):
        * wasm/WasmBBQPlan.h:
        * wasm/WasmCalleeGroup.cpp: Renamed from Source/JavaScriptCore/wasm/WasmCodeBlock.cpp.
        (JSC::Wasm::CalleeGroup::create):
        (JSC::Wasm::CalleeGroup::createFromExisting):
        (JSC::Wasm::CalleeGroup::CalleeGroup):
        (JSC::Wasm::CalleeGroup::~CalleeGroup):
        (JSC::Wasm::CalleeGroup::waitUntilFinished):
        (JSC::Wasm::CalleeGroup::compileAsync):
        (JSC::Wasm::CalleeGroup::isSafeToRun):
        (JSC::Wasm::CalleeGroup::setCompilationFinished):
        * wasm/WasmCalleeGroup.h: Renamed from Source/JavaScriptCore/wasm/WasmCodeBlock.h.
        * wasm/WasmInstance.cpp:
        (JSC::Wasm::Instance::initElementSegment):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::calleeGroup const):
        (JSC::Wasm::Instance::isImportFunction const):
        (JSC::Wasm::Instance::codeBlock const): Deleted.
        * wasm/WasmMachineThreads.h:
        * wasm/WasmModule.cpp:
        (JSC::Wasm::Module::getOrCreateCalleeGroup):
        (JSC::Wasm::Module::compileSync):
        (JSC::Wasm::Module::compileAsync):
        (JSC::Wasm::Module::copyInitialCalleeGroupToAllMemoryModes):
        (JSC::Wasm::Module::getOrCreateCodeBlock): Deleted.
        (JSC::Wasm::Module::copyInitialCodeBlockToAllMemoryModes): Deleted.
        * wasm/WasmModule.h:
        (JSC::Wasm::Module::calleeGroupFor):
        (JSC::Wasm::Module::codeBlockFor): Deleted.
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan):
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGForOSREntryPlan.h:
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::OMGPlan):
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOMGPlan.h:
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::triggerOMGReplacementCompile):
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::updateCallSitesToCallUs):
        * wasm/WasmPlan.h:
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::doWasmCall):
        * wasm/js/JSWebAssembly.cpp:
        (JSC::resolve):
        (JSC::instantiate):
        * wasm/js/JSWebAssemblyCalleeGroup.cpp: Renamed from Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.cpp.
        (JSC::JSWebAssemblyCalleeGroup::create):
        (JSC::JSWebAssemblyCalleeGroup::JSWebAssemblyCalleeGroup):
        (JSC::JSWebAssemblyCalleeGroup::finishCreation):
        (JSC::JSWebAssemblyCalleeGroup::destroy):
        (JSC::JSWebAssemblyCalleeGroup::clearJSCallICs):
        (JSC::JSWebAssemblyCalleeGroup::visitChildrenImpl):
        (JSC::JSWebAssemblyCalleeGroup::finalizeUnconditionally):
        * wasm/js/JSWebAssemblyCalleeGroup.h: Renamed from Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h.
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::visitChildrenImpl):
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/JSWebAssemblyModule.cpp:
        (JSC::JSWebAssemblyModule::calleeGroup):
        (JSC::JSWebAssemblyModule::setCalleeGroup):
        (JSC::JSWebAssemblyModule::visitChildrenImpl):
        (JSC::JSWebAssemblyModule::codeBlock): Deleted.
        (JSC::JSWebAssemblyModule::setCodeBlock): Deleted.
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports):
        * wasm/js/WebAssemblyWrapperFunction.h:

2021-12-15  Joseph Griego  <jgriego@igalia.com>

        [Shadow Realms] Wrapped functions must only throw TypeError from calling realm
        https://bugs.webkit.org/show_bug.cgi?id=234357

        Reviewed by Yusuke Suzuki.

        This wrapping logic already exists for ShadowRealm.prototype.evaluate
        but not for calls to wrapped functions. at present, this requires some
        awkward manouvering to actually throw a typeerror from the shadow realm,
        since the wrapper code always runs in the incubating realm.

        Hopefully we can make this less messy soon by replacing this
        implementation with one more integrated with the runtime.

        This case wasn't covered by existing JSC or test262 tests; added
        coverage both upstream in t262 and in this patch.

        * builtins/ShadowRealmPrototype.js:
        (wrapped):
        (globalPrivate.wrap):

2021-12-14  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] OpInstanceofCustom should be in CommonSlowPaths
        https://bugs.webkit.org/show_bug.cgi?id=234316

        Reviewed by Alexey Shvayka.

        No tier has a fast path for OpInstanceofCustom and this is unlikely to change anytime soon.
        As such, we should not be having LLInt and Baseline implement *separate* slow paths for this operation;
        this patch straightforwardly makes use of CommonSlowPaths instead.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof_custom): Deleted.
        (JSC::JIT::emitSlow_op_instanceof_custom): Deleted.
        * llint/LLIntSlowPaths.cpp:
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/CommonSlowPaths.h:

2021-12-14  Jean-Yves Avenard  <jya@apple.com>

        Rename SharedBuffer classes.
        https://bugs.webkit.org/show_bug.cgi?id=233677
        rdar://problem/85963900

        Reviewed by Youenn Fablet.

        SharedBuffer are renamed FragmentedSharedBuffer and
        ContiguousSharedBuffer to SharedBuffer to better reflect their actual
        types.

        * runtime/ArrayBuffer.h:

2021-12-13  Saam Barati  <sbarati@apple.com>

        WasmB3IRGenerator should estimate static execution counts
        https://bugs.webkit.org/show_bug.cgi?id=234284

        Reviewed by Filip Pizlo.

        This enables the register allocator to make better decisions.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * b3/B3BasicBlock.h:
        (JSC::B3::BasicBlock::setFrequency):
        * b3/B3EstimateStaticExecutionCounts.cpp: Added.
        (JSC::B3::estimateStaticExecutionCounts):
        * b3/B3EstimateStaticExecutionCounts.h: Added.
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::parseAndCompile):

2021-12-13  Brady Eidson  <beidson@apple.com>

        Teach webpushtool to register and "host" the daemon.
        https://bugs.webkit.org/show_bug.cgi?id=234265

        Reviewed by Tim Horton.

        * inspector/ConsoleMessage.h: Remove `using JSC::MessageType` because it makes it hard for others
          to also have a `MessageType` type.
        * inspector/JSGlobalObjectConsoleClient.h:
        * runtime/ConsoleTypes.h:

2021-12-13  Saam Barati  <sbarati@apple.com>

        Roll back r286345, r286387, r286471, r286667, r286849
        https://bugs.webkit.org/show_bug.cgi?id=234268

        Reviewed by Mark Lam.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::AccessCase):
        (JSC::AccessCase::forEachDependentCell const):
        (JSC::AccessCase::dump const):
        (JSC::AccessCase::propagateTransitions const):
        (JSC::AccessCase::generateWithGuard):
        (JSC::AccessCase::canBeShared):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::structure const):
        (JSC::AccessCase::newStructure const):
        (JSC::AccessCase::hash const):
        (JSC::AccessCase::AccessCase):
        * bytecode/ArrayProfile.cpp:
        (JSC::ArrayProfile::computeUpdatedPrediction):
        * bytecode/ArrayProfile.h:
        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::stronglyVisitWeakReferences):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadata::GetByIdModeMetadata):
        (JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeFromLLInt):
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InstanceOfStatus.cpp:
        (JSC::InstanceOfStatus::computeForStubInfo):
        * bytecode/InternalFunctionAllocationProfile.h:
        (JSC::InternalFunctionAllocationProfile::offsetOfStructure):
        (JSC::InternalFunctionAllocationProfile::structure):
        (JSC::InternalFunctionAllocationProfile::clear):
        (JSC::InternalFunctionAllocationProfile::visitAggregate):
        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
        (JSC::InternalFunctionAllocationProfile::offsetOfStructureID): Deleted.
        * bytecode/PolyProtoAccessChain.cpp:
        (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
        * bytecode/PolyProtoAccessChain.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::visitWeak const):
        * bytecode/PutByIdFlags.h:
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeFromLLInt):
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/SpeculatedType.cpp:
        (JSC::speculationFromCell):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::deref):
        (JSC::StructureStubInfo::aboutToDie):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::summary const):
        (JSC::StructureStubInfo::containsPC const):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::branchWeakStructure):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::finalize):
        * dfg/DFGSpeculativeJIT.cpp:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::emitUntypedBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * heap/AbstractSlotVisitor.h:
        * heap/AbstractSlotVisitorInlines.h:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::runEndPhase):
        * heap/Heap.h:
        (JSC::Heap::structureIDTable):
        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::tryMallocBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::freeBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::commitBlock): Deleted.
        (JSC::IsoAlignedMemoryAllocator::decommitBlock): Deleted.
        * heap/IsoAlignedMemoryAllocator.h:
        * heap/IsoMemoryAllocatorBase.cpp: Removed.
        * heap/IsoMemoryAllocatorBase.h: Removed.
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::tryAllocateFromLowerTier):
        * heap/IsoSubspace.h:
        * heap/PreciseAllocation.cpp:
        (JSC::PreciseAllocation::createForLowerTier):
        (JSC::PreciseAllocation::tryCreateForLowerTier): Deleted.
        * heap/PreciseAllocation.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
        * heap/SlotVisitor.h:
        * heap/SlotVisitorInlines.h:
        * heap/StructureAlignedMemoryAllocator.cpp: Removed.
        * heap/StructureAlignedMemoryAllocator.h: Removed.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
        (JSC::AssemblyHelpers::emitLoadStructure):
        (JSC::AssemblyHelpers::emitLoadPrototype):
        (JSC::AssemblyHelpers::emitRandomThunk):
        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
        (JSC::AssemblyHelpers::branchIfValue):
        (JSC::AssemblyHelpers::emitNonNullDecodeStructureID): Deleted.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchStructure):
        (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::PolymorphicAccessJITStubRoutine::computeHash):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * jit/JITStubRoutine.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::performLLIntGetByID):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BigIntPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BooleanPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/DatePrototype.cpp:
        (JSC::formateDateInstance):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::sanitizedMessageString):
        (JSC::ErrorInstance::sanitizedNameString):
        (JSC::ErrorInstance::sanitizedToString):
        * runtime/ErrorPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::visitChildrenImpl):
        * runtime/FunctionExecutable.h:
        * runtime/FunctionPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/FunctionRareData.cpp:
        (JSC::FunctionRareData::visitChildrenImpl):
        * runtime/FunctionRareData.h:
        * runtime/HasOwnPropertyCache.h:
        * runtime/InitializeThreading.cpp:
        (JSC::initialize):
        * runtime/JSCConfig.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::dumpInContextAssumingStructure const):
        (JSC::JSValue::dumpForBacktrace const):
        * runtime/JSCell.cpp:
        (JSC::JSCell::toObjectSlow const):
        * runtime/JSCell.h:
        (JSC::JSCell::clearStructure):
        * runtime/JSCellInlines.h:
        (JSC::JSCell::structure const):
        (JSC::JSCell::setStructure):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        (JSC::JSObject::createInitialUndecided):
        (JSC::JSObject::createInitialInt32):
        (JSC::JSObject::createInitialDouble):
        (JSC::JSObject::createInitialContiguous):
        (JSC::JSObject::createArrayStorage):
        (JSC::JSObject::convertUndecidedToArrayStorage):
        (JSC::JSObject::convertInt32ToArrayStorage):
        (JSC::JSObject::convertDoubleToArrayStorage):
        (JSC::JSObject::convertContiguousToArrayStorage):
        (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition):
        (JSC::JSObject::putDirectNonIndexAccessorWithoutTransition):
        * runtime/JSObject.h:
        (JSC::JSObject::nukeStructureAndSetButterfly):
        (JSC::JSObject::getPropertySlot):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getPropertySlot):
        (JSC::JSObject::getNonIndexPropertySlot):
        (JSC::JSObject::putDirectWithoutTransition):
        (JSC::JSObject::putDirectInternal):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/NumberPrototype.cpp:
        (JSC::toThisNumber):
        * runtime/ObjectPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::objectPrototypeToString):
        * runtime/RegExpPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/StringPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/Structure.cpp:
        (JSC::Structure::Structure):
        (JSC::Structure::~Structure):
        (JSC::Structure::flattenDictionaryStructure):
        (JSC::Structure::dump const):
        (JSC::Structure::canCachePropertyNameEnumerator const):
        * runtime/Structure.h:
        (JSC::Structure::id const):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        (JSC::StructureChain::visitChildrenImpl):
        * runtime/StructureID.h: Removed.
        * runtime/StructureIDBlob.h:
        (JSC::StructureIDBlob::StructureIDBlob):
        * runtime/StructureIDTable.cpp: Added.
        (JSC::StructureIDTable::StructureIDTable):
        (JSC::StructureIDTable::makeFreeListFromRange):
        (JSC::StructureIDTable::resize):
        (JSC::StructureIDTable::flushOldTables):
        (JSC::StructureIDTable::allocateID):
        (JSC::StructureIDTable::deallocateID):
        * runtime/StructureIDTable.h: Added.
        (JSC::nukedStructureIDBit):
        (JSC::nuke):
        (JSC::isNuked):
        (JSC::decontaminate):
        (JSC::StructureIDTable::base):
        (JSC::StructureIDTable::size const):
        (JSC::StructureIDTable::table const):
        (JSC::StructureIDTable::decode):
        (JSC::StructureIDTable::encode):
        (JSC::StructureIDTable::get):
        (JSC::StructureIDTable::tryGet):
        (JSC::StructureIDTable::validate):
        (JSC::StructureIDTable::deallocateID):
        (JSC::StructureIDTable::allocateID):
        (JSC::StructureIDTable::flushOldTables):
        * runtime/StructureRareData.cpp:
        (JSC::StructureRareData::StructureRareData):
        * runtime/StructureRareData.h:
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
        * runtime/SymbolPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::processLogEntries):
        (JSC::TypeProfilerLog::visit):
        * runtime/VM.h:
        (JSC::VM::getStructure):
        (JSC::VM::tryGetStructure):
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrierStructureID::WriteBarrierStructureID): Deleted.
        (JSC::WriteBarrierStructureID::get const): Deleted.
        (JSC::WriteBarrierStructureID::operator* const): Deleted.
        (JSC::WriteBarrierStructureID::operator-> const): Deleted.
        (JSC::WriteBarrierStructureID::clear): Deleted.
        (JSC::WriteBarrierStructureID::operator bool const): Deleted.
        (JSC::WriteBarrierStructureID::operator! const): Deleted.
        (JSC::WriteBarrierStructureID::setWithoutWriteBarrier): Deleted.
        (JSC::WriteBarrierStructureID::unvalidatedGet const): Deleted.
        (JSC::WriteBarrierStructureID::value const): Deleted.
        * runtime/WriteBarrierInlines.h:
        (JSC::WriteBarrierStructureID::set): Deleted.
        (JSC::WriteBarrierStructureID::setMayBeNull): Deleted.
        (JSC::WriteBarrierStructureID::setEarlyValue): Deleted.
        * tools/HeapVerifier.cpp:
        (JSC::HeapVerifier::validateJSCell):
        * tools/Integrity.cpp:
        * tools/Integrity.h:
        * tools/IntegrityInlines.h:
        (JSC::Integrity::auditStructureID):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):
        (JSC::JSDollarVM::visitChildrenImpl):
        * tools/JSDollarVM.h:
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * wasm/js/WebAssemblyGlobalPrototype.cpp:
        (JSC::getGlobal):

2021-12-13  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector for wasm exception in Wasm::Instance
        https://bugs.webkit.org/show_bug.cgi?id=234224

        Reviewed by Saam Barati.

        Since we know # of exception tags when instantiating Wasm::Instance,
        we can use FixedVector instead of Vector. This is the same to Table,
        Functions etc.

        We also remove Wasm::Tag::m_id. Since we do not copy Wasm::Tag and
        we always allocate Wasm::Tag from heap, we can just use pointer
        comparison. Then, we do not need to have this m_id.

        * wasm/WasmInstance.cpp:
        (JSC::Wasm::Instance::Instance):
        (JSC::Wasm::Instance::setTag):
        (JSC::Wasm::Instance::addTag): Deleted.
        * wasm/WasmInstance.h:
        * wasm/WasmModuleInformation.h:
        (JSC::Wasm::ModuleInformation::internalExceptionCount const):
        * wasm/WasmTag.cpp:
        * wasm/WasmTag.h:
        (JSC::Wasm::Tag::create): Deleted.
        (JSC::Wasm::Tag::parameterCount const): Deleted.
        (JSC::Wasm::Tag::parameter const): Deleted.
        (JSC::Wasm::Tag::operator== const): Deleted.
        (JSC::Wasm::Tag::operator!= const): Deleted.
        (JSC::Wasm::Tag::signature const): Deleted.
        (JSC::Wasm::Tag::Tag): Deleted.
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports):

2021-12-13  waddlesplash  <waddlesplash@gmail.com>

        ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC).
        https://bugs.webkit.org/show_bug.cgi?id=232165

        Reviewed by Yusuke Suzuki.

        Following r281910 two additional slots were added
        to g_config in order to store these pointers for use in bmalloc and Gigacage. However, when
        USE(SYSTEM_MALLOC) is enabled, there are no slots reserved for Gigacage, and so this collided
        with g_wtfConfig and overwrote data there instead.

        This should fix crashes seen on Haiku, which enables USE(SYSTEM_MALLOC).

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):

2021-12-13  Elliott Williams  <emw@apple.com>

        Deployment target for macOS 11+ does not follow minor version bumps
        https://bugs.webkit.org/show_bug.cgi?id=233906

        Reviewed by Alexey Proskuryakov.

        * Configurations/DebugRelease.xcconfig:

2021-12-13  Adrian Perez de Castro  <aperez@igalia.com>

        Unreviewed build fix after r286936

        * wasm/WasmOSREntryData.h: Replace wrong inclusion of wtf/Vector.h (unused) with the correct
        wtf/FixedVector.h one.
        * wasm/WasmTierUpCount.h: Add missing WasmOSREntryData.h inclusion.

2021-12-13  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 implementations for trivial floating-point-register operations
        https://bugs.webkit.org/show_bug.cgi?id=234223

        Reviewed by Yusuke Suzuki.

        Add implementations for the trivial floating-point register operations
        in MacroAssemblerRISCV64. This covers moves, loads, stores, arithmetics,
        basic conversion and truncation and the lightweight logical operations.

        The two floating-point temporary registers needed in some operations are
        listed. The rounding and comparison operations are left for later as
        they require a more complex implementation due to the necessary manual
        NaN checks.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::swap):
        (JSC::MacroAssemblerRISCV64::moveZeroToFloat):
        (JSC::MacroAssemblerRISCV64::moveZeroToDouble):
        (JSC::MacroAssemblerRISCV64::moveFloat):
        (JSC::MacroAssemblerRISCV64::moveFloatTo32):
        (JSC::MacroAssemblerRISCV64::move32ToFloat):
        (JSC::MacroAssemblerRISCV64::moveDouble):
        (JSC::MacroAssemblerRISCV64::moveDoubleTo64):
        (JSC::MacroAssemblerRISCV64::move64ToDouble):
        (JSC::MacroAssemblerRISCV64::loadFloat):
        (JSC::MacroAssemblerRISCV64::loadDouble):
        (JSC::MacroAssemblerRISCV64::storeFloat):
        (JSC::MacroAssemblerRISCV64::storeDouble):
        (JSC::MacroAssemblerRISCV64::addFloat):
        (JSC::MacroAssemblerRISCV64::addDouble):
        (JSC::MacroAssemblerRISCV64::subFloat):
        (JSC::MacroAssemblerRISCV64::subDouble):
        (JSC::MacroAssemblerRISCV64::mulFloat):
        (JSC::MacroAssemblerRISCV64::mulDouble):
        (JSC::MacroAssemblerRISCV64::divFloat):
        (JSC::MacroAssemblerRISCV64::divDouble):
        (JSC::MacroAssemblerRISCV64::sqrtFloat):
        (JSC::MacroAssemblerRISCV64::sqrtDouble):
        (JSC::MacroAssemblerRISCV64::absFloat):
        (JSC::MacroAssemblerRISCV64::absDouble):
        (JSC::MacroAssemblerRISCV64::andFloat):
        (JSC::MacroAssemblerRISCV64::andDouble):
        (JSC::MacroAssemblerRISCV64::orFloat):
        (JSC::MacroAssemblerRISCV64::orDouble):
        (JSC::MacroAssemblerRISCV64::negateFloat):
        (JSC::MacroAssemblerRISCV64::negateDouble):
        (JSC::MacroAssemblerRISCV64::convertInt32ToFloat):
        (JSC::MacroAssemblerRISCV64::convertInt32ToDouble):
        (JSC::MacroAssemblerRISCV64::convertInt64ToFloat):
        (JSC::MacroAssemblerRISCV64::convertInt64ToDouble):
        (JSC::MacroAssemblerRISCV64::convertUInt64ToFloat):
        (JSC::MacroAssemblerRISCV64::convertUInt64ToDouble):
        (JSC::MacroAssemblerRISCV64::convertFloatToDouble):
        (JSC::MacroAssemblerRISCV64::convertDoubleToFloat):
        (JSC::MacroAssemblerRISCV64::truncateFloatToInt32):
        (JSC::MacroAssemblerRISCV64::truncateFloatToUint32):
        (JSC::MacroAssemblerRISCV64::truncateFloatToInt64):
        (JSC::MacroAssemblerRISCV64::truncateFloatToUint64):
        (JSC::MacroAssemblerRISCV64::truncateDoubleToInt32):
        (JSC::MacroAssemblerRISCV64::truncateDoubleToUint32):
        (JSC::MacroAssemblerRISCV64::truncateDoubleToInt64):
        (JSC::MacroAssemblerRISCV64::truncateDoubleToUint64):

2021-12-12  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add MacroAssemblerRISCV64 implementations for trivial general-purpose-register operations
        https://bugs.webkit.org/show_bug.cgi?id=233992

        Reviewed by Yusuke Suzuki.

        Add implementations for the trivial general-purpose-register operations
        in MacroAssemblerRISCV64. This covers non-patchable loads and stores,
        shifts, logical operations, zero- and sign-extensions, moves and swaps,
        stack operations as well as miscellaneous operations like aborts,
        breakpoints and nops.

        The loadImmediate helper methods are added to handle loading of
        different types of immediate values. This should replace move() calls
        when a sign-extended immediate load is desired, whereas move() for
        a 32-bit immediate is expected to perform no sign extension.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::add32):
        (JSC::MacroAssemblerRISCV64::add64):
        (JSC::MacroAssemblerRISCV64::sub32):
        (JSC::MacroAssemblerRISCV64::mul32):
        (JSC::MacroAssemblerRISCV64::lshift32):
        (JSC::MacroAssemblerRISCV64::lshift64):
        (JSC::MacroAssemblerRISCV64::rshift32):
        (JSC::MacroAssemblerRISCV64::rshift64):
        (JSC::MacroAssemblerRISCV64::urshift32):
        (JSC::MacroAssemblerRISCV64::urshift64):
        (JSC::MacroAssemblerRISCV64::load8):
        (JSC::MacroAssemblerRISCV64::load8SignedExtendTo32):
        (JSC::MacroAssemblerRISCV64::load16):
        (JSC::MacroAssemblerRISCV64::load16Unaligned):
        (JSC::MacroAssemblerRISCV64::load16SignedExtendTo32):
        (JSC::MacroAssemblerRISCV64::load32):
        (JSC::MacroAssemblerRISCV64::load32WithUnalignedHalfWords):
        (JSC::MacroAssemblerRISCV64::load64):
        (JSC::MacroAssemblerRISCV64::loadPair32):
        (JSC::MacroAssemblerRISCV64::store8):
        (JSC::MacroAssemblerRISCV64::store16):
        (JSC::MacroAssemblerRISCV64::store32):
        (JSC::MacroAssemblerRISCV64::store64):
        (JSC::MacroAssemblerRISCV64::storePair32):
        (JSC::MacroAssemblerRISCV64::zeroExtend8To32):
        (JSC::MacroAssemblerRISCV64::zeroExtend16To32):
        (JSC::MacroAssemblerRISCV64::zeroExtend32ToWord):
        (JSC::MacroAssemblerRISCV64::signExtend8To32):
        (JSC::MacroAssemblerRISCV64::signExtend16To32):
        (JSC::MacroAssemblerRISCV64::signExtend32ToPtr):
        (JSC::MacroAssemblerRISCV64::and32):
        (JSC::MacroAssemblerRISCV64::and64):
        (JSC::MacroAssemblerRISCV64::or8):
        (JSC::MacroAssemblerRISCV64::or16):
        (JSC::MacroAssemblerRISCV64::or32):
        (JSC::MacroAssemblerRISCV64::or64):
        (JSC::MacroAssemblerRISCV64::xor32):
        (JSC::MacroAssemblerRISCV64::xor64):
        (JSC::MacroAssemblerRISCV64::not32):
        (JSC::MacroAssemblerRISCV64::not64):
        (JSC::MacroAssemblerRISCV64::neg32):
        (JSC::MacroAssemblerRISCV64::neg64):
        (JSC::MacroAssemblerRISCV64::move):
        (JSC::MacroAssemblerRISCV64::swap):
        (JSC::MacroAssemblerRISCV64::push):
        (JSC::MacroAssemblerRISCV64::pushPair):
        (JSC::MacroAssemblerRISCV64::pop):
        (JSC::MacroAssemblerRISCV64::popPair):
        (JSC::MacroAssemblerRISCV64::abortWithReason):
        (JSC::MacroAssemblerRISCV64::breakpoint):
        (JSC::MacroAssemblerRISCV64::nop):
        (JSC::MacroAssemblerRISCV64::loadImmediate):

2021-12-12  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector to shrink some of Wasm data structures
        https://bugs.webkit.org/show_bug.cgi?id=234206

        Reviewed by Saam Barati.

        We can use FixedVector to shrink some of Wasm data structures including Wasm::Callee.

        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::PatchpointExceptionHandle::generate const):
        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
        * wasm/WasmCallee.cpp:
        (JSC::Wasm::LLIntCallee::linkExceptionHandlers):
        (JSC::Wasm::OptimizingJITCallee::linkExceptionHandlers):
        (JSC::Wasm::OptimizingJITCallee::stackmap const):
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::hasExceptionHandlers const):
        (JSC::Wasm::JITCallee::wasmToWasmCallsites):
        (JSC::Wasm::OptimizingJITCallee::OptimizingJITCallee):
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::CodeBlock):
        * wasm/WasmCodeBlock.h:
        * wasm/WasmHandlerInfo.cpp:
        (JSC::Wasm::HandlerInfo::handlerForIndex):
        * wasm/WasmHandlerInfo.h:
        * wasm/WasmOSREntryData.h:
        (JSC::Wasm::OSREntryData::OSREntryData):
        (JSC::Wasm::OSREntryData::values):
        (JSC::Wasm::OSREntryValue::OSREntryValue): Deleted.
        (JSC::Wasm::OSREntryValue::type const): Deleted.
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::updateCallSitesToCallUs):
        * wasm/WasmTierUpCount.cpp:
        (JSC::Wasm::TierUpCount::addOSREntryData):
        * wasm/WasmTierUpCount.h:
        * wasm/js/JSWebAssemblyCodeBlock.cpp:
        (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
        * wasm/js/JSWebAssemblyCodeBlock.h:

2021-12-11  Saam Barati  <sbarati@apple.com>

        Teach the sampling profiler how to display origin data for B3 Wasm
        https://bugs.webkit.org/show_bug.cgi?id=234097

        Reviewed by Yusuke Suzuki.

        This teaches the SamplingProfiler how to gather origin data for
        Wasm. We reuse the PCToCodeOriginMap from JS, and store the wasm
        function offset data inside of CodeOrigin's BytecodeIndex.
        
        For now, this patch is only doing this for B3, because the Air backend
        doesn't currently generate filled in OpcodeOrigin data. We'll fix that
        in: https://bugs.webkit.org/show_bug.cgi?id=234182
        
        Also, this capability isn't yet supported in Web Inspector. We'll want
        to do that in a future change as we improve Web Inspector's ability to
        debug Wasm code. When that time comes, we'll have to generate the
        PCToCodeOriginMap based on debugging info, and not just 'useSamplingProfiler'
        JSC option.
        
        The data now shows up like this for hottest bytecodes:
        
        Hottest bytecodes as <numSamples   'functionName#hash:JITType:bytecodeIndex'>
           524    '<?>.wasm-function[2373]:OMG:0x21a'
           414    '<?>.wasm-function[2363]:OMG:0x1ae'
           395    '<?>.wasm-function[2373]:OMG:0x418'
           354    '<?>.wasm-function[2373]:OMG:0x34f'
           270    '<?>.wasm-function[2373]:OMG:0x352'
           256    '<?>.wasm-function[2363]:OMG:0x152'


        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * jit/PCToCodeOriginMap.cpp:
        (JSC::PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder):
        * jit/PCToCodeOriginMap.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::FrameWalker::recordJITFrame):
        (JSC::SamplingProfiler::processUnverifiedStackTraces):
        (JSC::SamplingProfiler::reportTopBytecodes):
        * runtime/SamplingProfiler.h:
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::origin):
        (JSC::Wasm::parseAndCompileAir):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::parseAndCompile):
        (JSC::Wasm::computePCToCodeOriginMap):
        * wasm/WasmB3IRGenerator.h:
        (): Deleted.
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        (JSC::Wasm::BBQPlan::initializeCallees):
        * wasm/WasmCalleeRegistry.h:
        (JSC::Wasm::CalleeRegistry::unregisterCallee):
        (JSC::Wasm::CalleeRegistry::addPCToCodeOriginMap):
        (JSC::Wasm::CalleeRegistry::WTF_REQUIRES_LOCK):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOpcodeOrigin.h:
        (JSC::Wasm::OpcodeOrigin::OpcodeOrigin):

2021-12-11  Mark Lam  <mark.lam@apple.com>

        Automatically forbid JS execution when we throw a TerminationException.
        https://bugs.webkit.org/show_bug.cgi?id=234188

        Reviewed by Yusuke Suzuki.

        For Worker threads, we throw a TerminationException when Worker.terminate() is
        called.  Once the TerminationException is thrown, we expect to completely unwind
        out of any JS frames on the stack, and we also expect the client to never call
        into JS again.  Previously, WebCore will call VM:setExecutionForbidden() to flag
        that we should not re-enter the VM anymore.  On JSC side, this executionForbidden()
        is used to prevent micro-tasks from firing.  On WebCore side, it is used to prevent
        many things from running, including firing events.

        Previously, we reply on WebCore side to catch the TerminationException, determine
        that it is the TerminationException, and then call VM:setExecutionForbidden().
        This is tedious and error prone as there may be places in WebCore that should call
        VM:setExecutionForbidden() but is missed.  This has been the source of some bugs
        with the handling of the Worker termination in the past.

        In this patch, we change VM to setExecutionForbidden() immediately when we throw
        the TerminationException, but only if VM::m_executionForbiddenOnTermination is set.
        Currently, we'll only set VM:m_executionForbiddenOnTermination for Workers because
        for legacy reasons, other clients of JSC has the ability to re-enter the VM after
        a TerminationException unwinds out (which is ok to do when used under some
        controlled conditions).  Until we can determine that it is safe to adopt this
        "execution forbidden on termination" behavior universally, we'll adopt it only for
        workers.

        In a subsequent patch, we can also look into removing all the places in WebCore
        that checks for TerminationException in order to call VM:setExecutionForbidden().
        We'll leave those in place for now though they should be redundant after this patch.

        Also add some ASSERTs to document invariants regarding states used in the handing
        of TerminationException.

        * runtime/VM.cpp:
        (JSC::VM::setException):
        (JSC::VM::throwTerminationException):
        * runtime/VM.h:
        (JSC::VM::forbidExecutionOnTermination):

2021-12-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Wasm catch thunk should be JIT code to use ExceptionHandlerPtrTag
        https://bugs.webkit.org/show_bug.cgi?id=234183

        Reviewed by Tadeu Zagallo.

        ExceptionHandlerPtrTag is only usable for JITCode. Thus, we should not tag wasm catch LLInt code with it.
        This patch fixes it by using trampoline. This is the same to normal LLInt's handleCatchThunk.

        * assembler/JITOperationList.cpp:
        (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt):
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::handleWasmCatch):
        (JSC::LLInt::handleWasmCatchAll):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::handleWasmCatchThunk):
        (JSC::LLInt::handleWasmCatchAllThunk):
        * llint/LLIntThunks.h:

2021-12-10  Michael Saboff  <msaboff@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=234173
        Update Install Paths for build system changes

        Reviewed by Yusuke Suzuki.

        Updated install paths for changes in the build system that use a system path prefix.

        * Configurations/Base.xcconfig:

2021-12-10  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Add callee save registers for MIPS
        https://bugs.webkit.org/show_bug.cgi?id=233766

        Reviewed by Mark Lam.

        This patch enables callee save registers for mips, which fixes an
        assertion violation from the call frame shufflers in some tests if
        jsc was built with assertions enabled (either debug or release+assert
        mode).

        * jit/RegisterSet.cpp:
        (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
        (JSC::RegisterSet::dfgCalleeSaveRegisters):

2021-12-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] isTaggedJSCCodePtrImpl does not have proper implementation for JITCage & JITCode combination
        https://bugs.webkit.org/show_bug.cgi?id=234186

        Reviewed by Mark Lam.

        If JITCage is enabled and target code is JITCode, we should use tagJSCCodePtrImpl.

        * runtime/JSCPtrTag.h:
        (JSC::isTaggedJSCCodePtrImpl):

2021-12-10  Don Olmstead  <don.olmstead@sony.com>

        Add FileSystem function to read a file at a path
        https://bugs.webkit.org/show_bug.cgi?id=234103

        Reviewed by Alex Christensen.

        Use FileSystem::readEntireFile.

        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::backendCommands const):

2021-12-10  Tadeu Zagallo  <tzagallo@apple.com>

        Remove Mac-specific ARM64EHash implementation
        https://bugs.webkit.org/show_bug.cgi?id=234150

        Reviewed by Saam Barati.

        Currently we have a weaker implementation of ARM64EHash on mac, but we measured it and it's not
        any faster than the stricter version we use on iOS. We are removing the mac-specific version and
        switching it to use the stricter version.

        * assembler/AssemblerBuffer.h:

2021-12-10  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, mid December 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=234106

        Unreviewed non-unified build fixes.

        * wasm/js/WasmToJS.h: Remove unneeded forward declaration of CallLinkInfo, add forward
        declaration of OptimizingCallLinkInfo.

2021-12-09  Alex Christensen  <achristensen@webkit.org>

        Prepare for transition to C++20
        https://bugs.webkit.org/show_bug.cgi?id=234022

        Reviewed by Yusuke Suzuki.

        * bytecode/SuperSampler.cpp:
        * bytecode/SuperSampler.h:
        * heap/GCSegmentedArray.h:
        (JSC::GCSegmentedArrayIterator::operator== const):
        (JSC::GCSegmentedArrayIterator::operator!= const):
        (JSC::GCSegmentedArrayIterator::operator==): Deleted.
        (JSC::GCSegmentedArrayIterator::operator!=): Deleted.
        * jit/RegisterSet.h:
        (JSC::RegisterSet::iterator::operator== const):
        (JSC::RegisterSet::iterator::operator!= const):
        (JSC::RegisterSet::iterator::operator==): Deleted.
        (JSC::RegisterSet::iterator::operator!=): Deleted.
        * parser/Parser.h:
        (JSC::ScopeRef::operator== const):
        (JSC::ScopeRef::operator!= const):
        (JSC::ScopeRef::operator==): Deleted.
        (JSC::ScopeRef::operator!=): Deleted.
        * parser/ParserTokens.h:
        * runtime/GenericOffset.h:
        (JSC::GenericOffset::operator== const):
        (JSC::GenericOffset::operator!= const):
        (JSC::GenericOffset::operator< const):
        (JSC::GenericOffset::operator> const):
        (JSC::GenericOffset::operator<= const):
        (JSC::GenericOffset::operator>= const):
        * runtime/PropertyTable.h:

2021-12-09  Saam Barati  <sbarati@apple.com>

        Procedure::setNeedsPCToOriginMap should call Code::forcePreservationOfB3Origins
        https://bugs.webkit.org/show_bug.cgi?id=234093

        Reviewed by Yusuke Suzuki.

        We need to do this to ensure the sampling profiler works in FTL.
        The reason this was sometimes working was Air::Code's constructor
        was looking at Procedure's m_needsPCToOriginMap before it was initialized,
        in its constructor. This is because Procedure was constructing Code
        before all its fields were initialized. This patch fixes that bug to
        construct Code after Procedure has all its fields initialized.

        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::Procedure):
        (JSC::B3::Procedure::setNeedsPCToOriginMap):
        * b3/B3Procedure.h:
        (JSC::B3::Procedure::setNeedsPCToOriginMap): Deleted.

2021-12-09  Saam Barati  <sbarati@apple.com>

        Add an option to dump the B3 IR for an allowlist of Wasm function indices
        https://bugs.webkit.org/show_bug.cgi?id=234028

        Reviewed by Tadeu Zagallo.

        * b3/B3Common.cpp:
        (JSC::B3::shouldDumpIR):
        * b3/B3Common.h:
        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):
        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::dump const):
        (JSC::B3::Procedure::setShouldDumpIR):
        * b3/B3Procedure.h:
        (JSC::B3::Procedure::shouldDumpIR const):
        * b3/air/AirGenerate.cpp:
        (JSC::B3::Air::prepareForGeneration):
        * b3/testb3.h:
        (shouldBeVerbose):
        (lowerToAirForTesting):
        * b3/testb3_6.cpp:
        (testInterpreter):
        (testMoveConstants):
        * b3/testb3_7.cpp:
        (testReduceStrengthReassociation):
        * runtime/OptionsList.h:
        * tools/FunctionAllowlist.cpp:
        (JSC::FunctionAllowlist::shouldDumpWasmFunction const):
        * tools/FunctionAllowlist.h:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::shouldDumpIRFor):
        (JSC::Wasm::parseAndCompile):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):

2021-12-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Introduce BaselineCallLinkInfo and OptimizingCallLinkInfo to shrink sizeof(BaselineCallLinkInfo)
        https://bugs.webkit.org/show_bug.cgi?id=233985

        Reviewed by Mark Lam.

        This patch introduces BaselineCallLinkInfo and OptimizingCallLinkInfo to shrink sizeof(BaselineCallLinkInfo).
        BaselineCallLinkInfo is included in metadata, and allocated for LLInt and Baseline. So shrinking it can make
        metadata small for LLInt and Baseline, which exists for all live functions.

        We also reorder OpIteratorOpen::Metadata and OpIteratorNext::Metadata to shrink sizes.

        sizeof(BaselineCallLinkInfo) becomes 88, while the old sizeof(CallLinkInfo) was 120.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/BytecodeList.rb:
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::setMonomorphicCallee):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::OptimizingCallLinkInfo::emitFastPath):
        (JSC::OptimizingCallLinkInfo::emitTailCallFastPath):
        (JSC::OptimizingCallLinkInfo::emitSlowPath):
        (JSC::CallLinkInfo::emitDataICSlowPath):
        (JSC::OptimizingCallLinkInfo::slowPathStart):
        (JSC::OptimizingCallLinkInfo::fastPathStart):
        (JSC::OptimizingCallLinkInfo::emitDirectFastPath):
        (JSC::OptimizingCallLinkInfo::emitDirectTailCallFastPath):
        (JSC::OptimizingCallLinkInfo::initializeDirectCall):
        (JSC::OptimizingCallLinkInfo::setDirectCallTarget):
        (JSC::BaselineCallLinkInfo::initialize):
        (JSC::CallLinkInfo::slowPathStart): Deleted.
        (JSC::CallLinkInfo::fastPathStart): Deleted.
        (JSC::CallLinkInfo::emitFastPath): Deleted.
        (JSC::CallLinkInfo::emitTailCallFastPath): Deleted.
        (JSC::CallLinkInfo::emitSlowPath): Deleted.
        (JSC::CallLinkInfo::initializeDataIC): Deleted.
        (JSC::CallLinkInfo::emitDirectFastPath): Deleted.
        (JSC::CallLinkInfo::emitDirectTailCallFastPath): Deleted.
        (JSC::CallLinkInfo::initializeDirectCall): Deleted.
        (JSC::CallLinkInfo::setDirectCallTarget): Deleted.
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::type const):
        (JSC::CallLinkInfo::CallLinkInfo):
        (JSC::CallLinkInfo::calleeGPR const):
        (JSC::CallLinkInfo::callLinkInfoGPR const):
        (JSC::CallLinkInfo::setCallLinkInfoGPR):
        (JSC::CallLinkInfo::setUpCall): Deleted.
        (JSC::CallLinkInfo::setCodeLocations): Deleted.
        (JSC::CallLinkInfo::calleeGPR): Deleted.
        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFor):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::getICStatusMap):
        (JSC::CodeBlock::jettison):
        * bytecode/GetterSetterAccessCase.h:
        * bytecode/PolymorphicAccess.h:
        * bytecode/Repatch.cpp:
        (JSC::revertCall):
        (JSC::linkDirectCall):
        * bytecode/Repatch.h:
        * dfg/DFGCommonData.h:
        (JSC::DFG::CommonData::addCallLinkInfo):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::addJSCall):
        (JSC::DFG::JITCompiler::addJSDirectCall):
        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
        (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::createForBaselineOrLLIntTailCall):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
        (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
        (JSC::createICJITStubRoutine):
        * jit/GCAwareJITStubRoutine.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (): Deleted.
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WasmToJS.h:

2021-12-08  Asumu Takikawa  <asumu@igalia.com>

        Support WebAssembly.Memory imports in Wasm/ESM modules.
        https://bugs.webkit.org/show_bug.cgi?id=184745

        Reviewed by Yusuke Suzuki.

        Changes how Wasm code is initialized for modules that are loaded
        by the module loader and have memory imports. The initial code for
        the LLInt tier is copied to all memory modes, so that the memory
        import can be initialized after compilation. When LLInt is turned
        off, the compilation of B3/Air code is delayed until the memory is
        initialized.

        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::createFromExisting):
        (JSC::Wasm::CodeBlock::CodeBlock):
        * wasm/WasmCodeBlock.h:
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::finalizeCreation):
        (JSC::Wasm::Instance::module const):
        (JSC::Wasm::Instance::codeBlock const):
        (JSC::Wasm::Instance::memory const):
        (JSC::Wasm::Instance::isImportFunction const):
        (JSC::Wasm::Instance::module): Deleted.
        (JSC::Wasm::Instance::codeBlock): Deleted.
        (JSC::Wasm::Instance::memory): Deleted.
        * wasm/WasmModule.cpp:
        (JSC::Wasm::Module::copyInitialCodeBlockToAllMemoryModes):
        * wasm/WasmModule.h:
        * wasm/js/JSWebAssembly.cpp:
        (JSC::instantiate):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::tryCreate):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports):

2021-12-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Introduce WriteBarrierStructureID
        https://bugs.webkit.org/show_bug.cgi?id=233918

        Reviewed by Mark Lam.

        This patch adds WriteBarrierStructureID class, which is similar to WriteBarrier<Structure>, but internally,
        it holds StructureID, so sizeof(WriteBarrierStructureID) is 4. This class is useful to use StructureID for
        memory saving while keeping WriteBarrier<Structure>'s useful features (automatically inserts write-barrier when
        setting etc.). This also paves the way to introducing DOMStructures array with WriteBarrierStructureID instead
        of costly HashMap<ClassInfo*, WriteBarrier<Structure>>.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::AccessCase):
        (JSC::AccessCase::forEachDependentCell const):
        (JSC::AccessCase::dump const):
        (JSC::AccessCase::propagateTransitions const):
        (JSC::AccessCase::canBeShared):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::structure const):
        (JSC::AccessCase::newStructure const):
        (JSC::AccessCase::hash const):
        (JSC::AccessCase::AccessCase):
        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InstanceOfStatus.cpp:
        (JSC::InstanceOfStatus::computeForStubInfo):
        * bytecode/InternalFunctionAllocationProfile.h:
        (JSC::InternalFunctionAllocationProfile::offsetOfStructureID):
        (JSC::InternalFunctionAllocationProfile::structure):
        (JSC::InternalFunctionAllocationProfile::clear):
        (JSC::InternalFunctionAllocationProfile::visitAggregate):
        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
        (JSC::InternalFunctionAllocationProfile::offsetOfStructure): Deleted.
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::deref):
        (JSC::StructureStubInfo::aboutToDie):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::summary const):
        (JSC::StructureStubInfo::containsPC const):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): Deleted.
        * dfg/DFGSpeculativeJIT.cpp:
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * heap/AbstractSlotVisitor.h:
        * heap/AbstractSlotVisitorInlines.h:
        (JSC::AbstractSlotVisitor::append):
        (JSC::AbstractSlotVisitor::appendHidden):
        * heap/SlotVisitor.h:
        * heap/SlotVisitorInlines.h:
        (JSC::SlotVisitor::append):
        (JSC::SlotVisitor::appendHidden):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitNonNullDecodeStructureID):
        (JSC::AssemblyHelpers::emitLoadStructure):
        * jit/AssemblyHelpers.h:
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::visitChildrenImpl):
        * runtime/FunctionExecutable.h:
        * runtime/FunctionRareData.cpp:
        (JSC::FunctionRareData::visitChildrenImpl):
        * runtime/FunctionRareData.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/StructureRareData.cpp:
        (JSC::StructureRareData::StructureRareData):
        * runtime/StructureRareData.h:
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrierStructureID::WriteBarrierStructureID):
        (JSC::WriteBarrierStructureID::get const):
        (JSC::WriteBarrierStructureID::operator* const):
        (JSC::WriteBarrierStructureID::operator-> const):
        (JSC::WriteBarrierStructureID::clear):
        (JSC::WriteBarrierStructureID::operator bool const):
        (JSC::WriteBarrierStructureID::operator! const):
        (JSC::WriteBarrierStructureID::setWithoutWriteBarrier):
        (JSC::WriteBarrierStructureID::unvalidatedGet const):
        (JSC::WriteBarrierStructureID::value const):
        * runtime/WriteBarrierInlines.h:
        (JSC::WriteBarrierStructureID::set):
        (JSC::WriteBarrierStructureID::setMayBeNull):
        (JSC::WriteBarrierStructureID::setEarlyValue):
        * tools/JSDollarVM.cpp:
        (JSC::JSDollarVM::finishCreation):
        (JSC::JSDollarVM::visitChildrenImpl):
        * tools/JSDollarVM.h:

2021-12-07  Saam Barati  <sbarati@apple.com>

        TypedArray prototype set should go down the fast path when using non clamped integer types of the same byte size
        https://bugs.webkit.org/show_bug.cgi?id=233905

        Reviewed by Keith Miller.

        We can use memmove in this scenario because the bitpattern of the
        data between the signed and unsigned values will be the same.

        This patch also fixes a bug where we were looking at the wrong
        pointer when determining to do a forward or backwards loop in
        our memmove. We were looking at the vector instead of vector+offset.

        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::set):

2021-12-07  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Add LLInt IC for try_get_by_id of own cacheable value
        https://bugs.webkit.org/show_bug.cgi?id=233830

        Reviewed by Yusuke Suzuki.

        This patch adds an LLInt IC for the "own cacheable value" path of try_get_by_id;
        this is the simplest case and basically the same as get_by_id_direct.

        Performance is neutral with JIT enabled as well as on current uses of try_get_by_id in JSC
        (e.g. hasObservableSideEffectsForRegexpSplit), but microbenchmarks of try_get_by_id itself see a 2x speedup:

                                             Before                    After

        try-get-by-id-polymorphic      123.8361+-0.4562     ^     61.7586+-0.3770        ^ definitely 2.0052x faster
        try-get-by-id-basic            124.4437+-0.6091     ^     61.0340+-0.1924        ^ definitely 2.0389x faster

        <geometric>                    124.1207+-0.3130     ^     61.3865+-0.2019        ^ definitely 2.0220x faster


        * bytecode/BytecodeList.rb:
        * bytecode/CodeBlock.cpp:
        * bytecode/GetByStatus.cpp:
        * llint/LLIntSlowPaths.cpp:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-12-07  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r286502 and r286580.
        https://bugs.webkit.org/show_bug.cgi?id=233930

        Speedometer2 0.7% regression

        Reverted changesets:

        "Remove StructureIDBlob"
        https://bugs.webkit.org/show_bug.cgi?id=233723
        https://commits.webkit.org/r286502

        "TypeInfo should be materializable from Structures as a single
        load."
        https://bugs.webkit.org/show_bug.cgi?id=233875
        https://commits.webkit.org/r286580

2021-12-07  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add more MacroAssemblerRISCV64 helper infrastructure
        https://bugs.webkit.org/show_bug.cgi?id=233805

        Reviewed by Yusuke Suzuki.

        Introduce RISCV64Assembler::ImmediateLoader, a helper class that
        generates the operations necessary for loading any immediate value into
        some register. This can be as simple as using ADDI to load 12-bit values
        or a combination of LUI, ADDI and possibly additional combinations of
        LSHIFT and ADDI instructions. There's also a placeholder mode which
        generates no-ops for unused operation slots, in order to enable
        future patching and repatching for other immediate values.

        MacroAssemblerRISCV64::Imm is introduced as a private helper struct that
        groups together validity and construction operations for the different
        immediate types implemented in the RISCV64Instructions namespace.

        In MacroAssemblerRISCV64, resolveAddress() overloads are provided to
        help generate most optimal address loading sequencing. RISC-V addressing
        mode utilizes a base register and a 12-bit signed offset. When needed,
        additional computation is done on the address object's parameters and
        stored in the destination register through which the load can then be
        performed.

        Helper TempRegister and LazyTempRegister structs are added to the
        MacroAssemblerRISCV64 class, along with the respective temps() and
        lazyTemp() methods. temps() returns the TempRegister object, with the
        template parameters defining which of the two scratch register types
        should be allowed for use through this object. Release-time assert
        on the m_allowScratchRegister value is done at the point of calling
        temps(). lazyTemp() only handles one scratch register, and the assert
        is done only when the register is actually used, and not just reserved
        for use. This enables simpler implementations that better handle both
        modes of scratch register usage (allowed or disallowed).

        To get things rolling, the first set of MacroAssemblerRISCV64 methods
        is implemented. Addition, subtraction and multiplication definitions
        are provided, with the templated no-op declarations removed.

        * assembler/MacroAssemblerRISCV64.h:
        (JSC::MacroAssemblerRISCV64::TempRegister::data):
        (JSC::MacroAssemblerRISCV64::TempRegister::memory):
        (JSC::MacroAssemblerRISCV64::LazyTempRegister::LazyTempRegister):
        (JSC::MacroAssemblerRISCV64::LazyTempRegister::operator RegisterID):
        (JSC::MacroAssemblerRISCV64::temps):
        (JSC::MacroAssemblerRISCV64::lazyTemp):
        (JSC::MacroAssemblerRISCV64::add32):
        (JSC::MacroAssemblerRISCV64::add64):
        (JSC::MacroAssemblerRISCV64::sub32):
        (JSC::MacroAssemblerRISCV64::sub64):
        (JSC::MacroAssemblerRISCV64::mul32):
        (JSC::MacroAssemblerRISCV64::mul64):
        (JSC::MacroAssemblerRISCV64::Imm::isValid):
        (JSC::MacroAssemblerRISCV64::Imm::I):
        (JSC::MacroAssemblerRISCV64::Imm::S):
        (JSC::MacroAssemblerRISCV64::Imm::B):
        (JSC::MacroAssemblerRISCV64::Imm::U):
        (JSC::MacroAssemblerRISCV64::Imm::J):
        (JSC::MacroAssemblerRISCV64::resolveAddress):
        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Assembler::ImmediateLoader::ImmediateLoader):
        (JSC::RISCV64Assembler::ImmediateLoader::moveInto):

2021-12-06  Keith Miller  <keith_miller@apple.com>

        TypeInfo should be materializable from Structures as a single load.
        https://bugs.webkit.org/show_bug.cgi?id=233875

        Reviewed by Mark Lam.

        This is mostly just the members of Structure and JSCell so that
        JSType and InlineTypeFlags are at the end of the JSCell header.

        * assembler/testmasm.cpp:
        (JSC::testBranchIfType):
        (JSC::testBranchIfNotType):
        * ftl/FTLAbstractHeapRepository.cpp:
        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
        * runtime/JSCell.h:
        * runtime/JSCellInlines.h:
        (JSC::JSCell::JSCell):
        * runtime/Structure.h:
        (JSC::Structure::typeInfo const):

2021-12-06  Mark Lam  <mark.lam@apple.com>

        Remove unneeded virtual allocator methods from Subspace.
        https://bugs.webkit.org/show_bug.cgi?id=233891
        rdar://86117970

        Reviewed by Yusuke Suzuki.

        Since the virtual allocate() and allocateFor() methods are now deleted, we can
        also rename the inline allocateNonVirtual() and allocatorForNonVirtual() methods
        to simply allocate() and allocateFor().  Similarly, rename
        allocatorForNonVirtualConcurrently() to allocatorForConcurrently().

        There are 2 places that still invokes the non-inline version of
        CompleteSubspace::allocatorFor().  For this reason, we introduce a
        CompleteSubsace::allocatorForNonInline() to keep the linkage the same.  There's a
        chance that the compiler/linker may already inline the method in 1 or both of
        these places, but we'll offer allocatorForNonInline() to keep the code expressing
        the same thing and let the compiler/linker decide whether to inline it or not just
        as before.

        This is purely a re-factoring patch.  There are no behavior changes, except for
        the removal of those 2 entries from the vtbls.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/ObjectAllocationProfileInlines.h:
        (JSC::ObjectAllocationProfileBase<Derived>::initializeProfile):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::allocatorForNonInline):
        (JSC::CompleteSubspace::tryAllocateSlow):
        (JSC::CompleteSubspace::allocatorFor): Deleted.
        (JSC::CompleteSubspace::allocate): Deleted.
        * heap/CompleteSubspace.h:
        (JSC::CompleteSubspace::allocatorFor):
        (JSC::CompleteSubspace::allocatorForNonVirtual): Deleted.
        * heap/CompleteSubspaceInlines.h:
        (JSC::CompleteSubspace::allocate):
        (JSC::CompleteSubspace::allocateNonVirtual): Deleted.
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::allocatorFor): Deleted.
        (JSC::IsoSubspace::allocate): Deleted.
        * heap/IsoSubspace.h:
        (JSC::IsoSubspace::allocatorFor):
        (JSC::IsoSubspace::allocatorForNonVirtual): Deleted.
        * heap/IsoSubspaceInlines.h:
        (JSC::IsoSubspace::allocate):
        (JSC::IsoSubspace::allocateNonVirtual): Deleted.
        * heap/Subspace.h:
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::tryCreateUninitialized):
        (JSC::Butterfly::createUninitialized):
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::growArrayRight):
        (JSC::Butterfly::reallocArrayRightIfPossible):
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::overrideThings):
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
        * runtime/HashMapImpl.h:
        (JSC::HashMapBuffer::create):
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        * runtime/JSArray.h:
        (JSC::JSArray::tryCreate):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::createWithLength):
        * runtime/JSCellInlines.h:
        (JSC::allocatorForConcurrently):
        (JSC::tryAllocateCellHelper):
        (JSC::allocatorForNonVirtualConcurrently): Deleted.
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::create):
        * runtime/ScopedArguments.cpp:
        (JSC::ScopedArguments::createUninitialized):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):

2021-12-06  Patrick Angle  <pangle@apple.com>

        Web Inspector: Support Cascade Layers in the Styles sidebar
        https://bugs.webkit.org/show_bug.cgi?id=233208

        Reviewed by Devin Rousso.

        Add new values to `CSS.Grouping`'s `type` enum for cascade layers and make the `text` optional since an
        anonymous layer will not have a name or other text.

        * inspector/protocol/CSS.json:

2021-12-03  Keith Miller  <keith_miller@apple.com>

        Remove StructureIDBlob
        https://bugs.webkit.org/show_bug.cgi?id=233723

        Reviewed by Yusuke Suzuki.

        StructureIDBlob isn't very useful now that StructureIDs are just the
        bottom bits of the pointer on 64 bit platforms. In a follow up patch
        I'll change the layout of JSCell and Structure so that TypeInfo creation
        can be a single load platforms that allow (and don't penalize) misaligned loads.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_put_to_scope):
        * runtime/Structure.cpp:
        (JSC::Structure::Structure):
        (JSC::Structure::addNewPropertyTransition):
        (JSC::Structure::removeNewPropertyTransition):
        (JSC::Structure::attributeChangeTransition):
        (JSC::Structure::nonPropertyTransitionSlow):
        (JSC::Structure::setBrandTransition):
        * runtime/Structure.h:
        (JSC::Structure::id const):
        (JSC::Structure::objectInitializationBlob const):
        (JSC::Structure::idBlob const):
        (JSC::Structure::isProxy const):
        (JSC::Structure::typeInfo const):
        (JSC::Structure::indexingType const):
        (JSC::Structure::indexingMode const):
        (JSC::Structure::fencedIndexingMode):
        (JSC::Structure::indexingModeIncludingHistory const):
        (JSC::Structure::indexingModeIncludingHistoryOffset):
        (JSC::Structure::structureIDOffset): Deleted.
        * runtime/StructureIDBlob.h: Removed.
        * runtime/StructureInlines.h:
        (JSC::Structure::hasIndexingHeader const):
        * tools/VMInspectorInlines.h:
        (JSC::VMInspector::verifyCellSize):

2021-12-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] shell's $.globalObjectFor is not safe for non object cells
        https://bugs.webkit.org/show_bug.cgi?id=233794

        Reviewed by Saam Barati.

        Only Object cells can have Structures having JSGlobalObject.

        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):

2021-12-02  Saam Barati  <sbarati@apple.com>

        Lower structureHeapAddressSize on more memory limited ARM64 devices
        https://bugs.webkit.org/show_bug.cgi?id=233786
        <rdar://85940431>

        Reviewed by Yusuke Suzuki.

        Some processes using JSC are failing the mmap for the 1GB region.
        Let's lower the region size to 512MB on lower memory iOS devices.

        * runtime/JSCConfig.h:

2021-12-02  Saam Barati  <sbarati@apple.com>

        Fix OOM crash in JSValue::toWTFStringForConsole
        https://bugs.webkit.org/show_bug.cgi?id=233775
        <rdar://85259423>

        Reviewed by Mark Lam.

        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::toWTFStringForConsole const):

2021-12-02  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Fix effective address loading for LabelReferences with offsets
        https://bugs.webkit.org/show_bug.cgi?id=233754

        Reviewed by Yusuke Suzuki.

        r286345 (and subsequent change in r286372) introduced a load from a
        label address with an additional offset. To properly handle this,
        RISCV64 offlineasm generates the desired load-effective-address
        instruction but now also generates an additional add instruction when
        an offset value is present for that lea.

        * offlineasm/riscv64.rb:

2021-12-02  Geza Lore  <glore@igalia.com>

        [JSC] Generated code size reductions for baseline JIT (all architectures)
        https://bugs.webkit.org/show_bug.cgi?id=233474

        Reviewed by Yusuke Suzuki.

        This patch introduces a few improvements that reduce the generated
        code size.

        Target independent improvements to the Baseline JIT:

        1. Some bytecodes that are very frequent (e.g.: get_by_id, call) share
        the same instructions at the tail end of the fast and slow paths.
        Instead of duplicating these in the slow path, then branch to the next
        sequential bytecode on the fast path, make the slow path branch to and
        reuse these common instructions, which then naturally fall through to
        the next sequential bytecode.

        2. Minor tweaks in a few places to remove redundant reloading of
        immediates and remove redundant moves.

        3. Remove a small number of redundant unconditional branches from some
        DataIC fast paths.

        ARMv7/Thumb-2 specific improvements:

        4. Add assembler support for LDRD and STRD (load/store a pair of
        32-bit GPRs) and use them throughout via loadValue/storeValue. This
        yields denser code as it often eliminates repeated temporary register
        setups (especially for a BaseIndex access), and also due to point 4
        below. This is also potentially a performance improvement on
        micro-architectures with a 64-bit LSU data-path.

        5. Instructions using only r0-r7 as operands can often use a short,
        16-bit encoding in Thumb-2, so prefer to use low order registers
        as temporaries wherever possible.

        The net effect of this patch is that the emitted baseline code during
        a run of JetStream2 is ~6.6% smaller on x86_64, ~5.1% smaller on
        ARM64, and ~24% smaller on ARMv7/Thumb-2. On ARMv7/Thumb-2, DFG code
        is also ~5.3% smaller, while on other architectures the DFG code is
        unaffected.

        On ARMv7/Thumb-2, this patch also yields an ~2% improvement in
        JetStream2 scores on my test machine.

        * assembler/ARMv7Assembler.h:
        (JSC::ARMv7Assembler::ldrd):
        (JSC::ARMv7Assembler::strd):
        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg4Reg4Reg4Imm8):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::addPtr):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::bestTempRegister):
        (JSC::MacroAssemblerARMv7::scratchRegister):
        (JSC::MacroAssemblerARMv7::add32):
        (JSC::MacroAssemblerARMv7::sub32):
        (JSC::MacroAssemblerARMv7::loadPair32):
        (JSC::MacroAssemblerARMv7::store32):
        (JSC::MacroAssemblerARMv7::storePair32):
        (JSC::MacroAssemblerARMv7::compare32AndSetFlags):
        (JSC::MacroAssemblerARMv7::test32):
        (JSC::MacroAssemblerARMv7::branch32):
        (JSC::MacroAssemblerARMv7::farJump):
        (JSC::MacroAssemblerARMv7::call):
        (JSC::MacroAssemblerARMv7::compare32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::loadPair32):
        (JSC::MacroAssemblerMIPS::storePair32):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::storeValue):
        (JSC::AssemblyHelpers::loadValue):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::setFastPathResumePoint):
        (JSC::JIT::fastPathResumePoint const):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_enter):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_brand):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emitWriteBarrier):

2021-12-01  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early December 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=233699

        Unreviewed non-unified build fixes.

        * dfg/DFGCodeOriginPool.h: Add missing CodeOrigin.h header.
        * heap/Heap.cpp: Add missing GigacageAlignedMemoryAllocator.h header.
        * heap/IsoSubspace.cpp: Add missing IsoAlignedMemoryAllocator.h header, and remove
        IsoMemoryAllocatorBase.h as it is included by the former.
        * runtime/StackFrame.h: Add missing BytecodeIndex.h header.
        * runtime/StructureID.h: Add missing wtf/HashTraits.h header.
        * tools/Integrity.h: Add missing StructureID.h header.

2021-12-01  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] RegExpTestInline DFG / FTL nodes should introduce a write-barrier
        https://bugs.webkit.org/show_bug.cgi?id=233716

        Reviewed by Michael Saboff.

        Since RegExpTestInline fast path stores cells into JSGlobalObject's RegExpCachedResult field,
        we need to consider about inserting a write-barrier onto JSGlobalObject.
        This patch adds RegExpTestInline to DFGStoreBarrierInsertionPhase so that DFG / FTL inserts
        a write-barrier appropriately.

        * dfg/DFGStoreBarrierInsertionPhase.cpp:

2021-12-01  Keith Miller  <keith_miller@apple.com>

        Add static_assert the value we use to initialize a StructureID buffer should be 0.
        https://bugs.webkit.org/show_bug.cgi?id=233720

        Reviewed by Yusuke Suzuki.

        Also, add static assert that the zero we are putting into the buffer
        matches the default StructureID constructor.

        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        * runtime/StructureID.h:
        (JSC::StructureID::bits const):

2021-12-01  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, use void* to suppress GCC warning
        https://bugs.webkit.org/show_bug.cgi?id=233379

        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):

2021-12-01  Mikhail R. Gadelha  <mikhail@igalia.com>

        Disable madd4 instruction generation globally for MIPS
        https://bugs.webkit.org/show_bug.cgi?id=233713

        Reviewed by Yusuke Suzuki.

        This is an improved version of r285788 and follows the approach used
        in r231301. This patch removes the volatile attribute from the double 
        variable and adds a -mno-madd4 flag globally when compiling on MIPS.

        * CMakeLists.txt:
        * runtime/ParseInt.h:
        (JSC::parseInt):

2021-12-01  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix CLoop build
        https://bugs.webkit.org/show_bug.cgi?id=233379

        * llint/LowLevelInterpreter64.asm:

2021-12-01  Xan Lopez  <xan@igalia.com>

        [JSC] Fix potential build break related to StructureID.h
        https://bugs.webkit.org/show_bug.cgi?id=233693

        Reviewed by Adrian Perez de Castro.

        * runtime/StructureID.h: include StdIntExtras.h for CPURegister.

2021-12-01  Xan Lopez  <xan@igalia.com>

        [JSC] Remove debug print left over from previous patch
        https://bugs.webkit.org/show_bug.cgi?id=233692

        Unreviewed follow-up patch.

        * offlineasm/x86.rb: remove debug print.

2021-11-30  Mark Lam  <mark.lam@apple.com>

        Move Subspaces from VM to Heap.
        https://bugs.webkit.org/show_bug.cgi?id=233648
        rdar://85875751

        Reviewed by Saam Barati.

        Subspaces are Heap data structures to begin with, and this refactoring is needed
        in preparation for the global GC.

        1. Embed HeapCellType and IsoHeapCellType instances in Heap directly instead of
           malloc'ing them separately and referencing them via unique_ptrs.  These
           instances are always instantiated unconditionally anyway.  This change
           eliminates the unneeded busy work to allocate them separately.

        2. Introduce a HeapSubspaceTypes.h that #include all the types that we have
           subspaces for.  This makes it so that Heap.cpp's #include list is not flooded
           with these types with subspaces, and that it'll be easier to discern between
           these Subspace types from other data structures needed for implementing Heap.

        3. Add VM accessor methods for subspaces that forward to Heap.  This will make it
           easier for us to redirect to a thread local allocator later for the global GC.

        4. Remove unneeded #includes in VM.h.

        5. Remove unused CodeBlockSet::iterateViaSubspaces().

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/DFGExitProfile.h:
        * bytecode/EvalCodeBlock.h:
        * bytecode/ExecutableToCodeBlockEdge.cpp:
        (JSC::ExecutableToCodeBlockEdge::visitChildrenImpl):
        (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
        (JSC::ExecutableToCodeBlockEdge::runConstraint):
        * bytecode/ExecutableToCodeBlockEdge.h:
        * bytecode/FunctionCodeBlock.h:
        * bytecode/ModuleProgramCodeBlock.h:
        * bytecode/ProgramCodeBlock.h:
        * bytecode/Repatch.h:
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
        (JSC::UnlinkedFunctionExecutable::finalizeUnconditionally):
        * bytecode/UnlinkedFunctionExecutable.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * generator/DSL.rb:
        * heap/CodeBlockSet.h:
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterateViaSubspaces): Deleted.
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::deleteAllCodeBlocks):
        (JSC::Heap::deleteAllUnlinkedCodeBlocks):
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepInFinalize):
        (JSC::Heap::addCoreConstraints):
        * heap/Heap.h:
        (JSC::Heap::gigacageAuxiliarySpace):
        (JSC::Heap::SpaceAndSet::SpaceAndSet):
        (JSC::Heap::SpaceAndSet::setFor):
        (JSC::Heap::forEachCodeBlockSpace):
        (JSC::Heap::forEachScriptExecutableSpace):
        * heap/HeapSubspaceTypes.h: Added.
        * heap/IsoHeapCellType.h:
        * heap/IsoInlinedHeapCellType.h:
        * heap/IsoInlinedHeapCellTypeInlines.h: Added.
        (JSC::IsoInlinedHeapCellType<CellType>::IsoInlinedHeapCellType):
        (JSC::IsoInlinedHeapCellType<CellType>::DestroyFunc::operator const):
        (JSC::IsoInlinedHeapCellType<CellType>::finishSweep const):
        (JSC::IsoInlinedHeapCellType<CellType>::destroy const):
        * heap/MarkedBlockInlines.h:
        * inspector/JSInjectedScriptHostPrototype.h:
        * inspector/JSJavaScriptCallFramePrototype.h:
        * interpreter/CallFrame.h:
        * jsc.cpp:
        (JSCMemoryFootprint::subspaceFor):
        (JSFileDescriptor::subspaceFor):
        * runtime/AggregateErrorPrototype.h:
        * runtime/ArrayIteratorPrototype.h:
        * runtime/AsyncFromSyncIteratorPrototype.h:
        * runtime/AsyncFunctionPrototype.h:
        * runtime/AsyncGeneratorFunctionPrototype.h:
        * runtime/AsyncGeneratorPrototype.h:
        * runtime/AsyncIteratorPrototype.h:
        * runtime/AtomicsObject.h:
        * runtime/BigIntPrototype.h:
        * runtime/BrandedStructure.h:
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::tryCreateUninitialized):
        (JSC::Butterfly::createUninitialized):
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::growArrayRight):
        (JSC::Butterfly::reallocArrayRightIfPossible):
        * runtime/CachedTypes.h:
        * runtime/ClonedArguments.h:
        * runtime/ConsoleObject.h:
        * runtime/CustomGetterSetter.h:
        (JSC::CustomGetterSetter::subspaceFor):
        * runtime/DOMAttributeGetterSetter.h:
        * runtime/DateInstance.h:
        * runtime/DatePrototype.h:
        * runtime/DirectArguments.h:
        * runtime/ErrorPrototype.h:
        * runtime/Exception.h:
        * runtime/FinalizationRegistryPrototype.h:
        * runtime/FunctionExecutable.h:
        * runtime/GeneratorFunctionPrototype.h:
        * runtime/GeneratorPrototype.h:
        * runtime/GetterSetter.h:
        * runtime/HashMapImpl.h:
        (JSC::HashMapBuffer::create):
        * runtime/InternalFunction.h:
        (JSC::InternalFunction::subspaceFor):
        * runtime/IntlCollatorPrototype.h:
        * runtime/IntlDateTimeFormatPrototype.h:
        * runtime/IntlDisplayNamesPrototype.h:
        * runtime/IntlListFormatPrototype.h:
        * runtime/IntlLocalePrototype.h:
        * runtime/IntlNumberFormatPrototype.h:
        * runtime/IntlObject.h:
        * runtime/IntlPluralRulesPrototype.h:
        * runtime/IntlRelativeTimeFormatPrototype.h:
        * runtime/IntlSegmentIteratorPrototype.h:
        * runtime/IntlSegmenterPrototype.h:
        * runtime/IntlSegmentsPrototype.h:
        * runtime/IteratorPrototype.h:
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        * runtime/JSArray.h:
        (JSC::JSArray::subspaceFor):
        (JSC::JSArray::tryCreate):
        * runtime/JSArrayBufferPrototype.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::createWithLength):
        * runtime/JSBigInt.h:
        * runtime/JSCallee.h:
        (JSC::JSCallee::subspaceFor):
        * runtime/JSDataViewPrototype.h:
        * runtime/JSFunction.h:
        (JSC::JSFunction::subspaceFor):
        * runtime/JSGenericTypedArrayViewPrototype.h:
        * runtime/JSGlobalLexicalEnvironment.h:
        * runtime/JSImmutableButterfly.h:
        (JSC::JSImmutableButterfly::subspaceFor):
        * runtime/JSLexicalEnvironment.h:
        (JSC::JSLexicalEnvironment::subspaceFor):
        * runtime/JSModuleLoader.h:
        * runtime/JSONObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSFinalObject::subspaceFor):
        * runtime/JSPromise.h:
        (JSC::JSPromise::subspaceFor):
        * runtime/JSPromisePrototype.h:
        (JSC::JSPromisePrototype::subspaceFor):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::create):
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/JSProxy.h:
        (JSC::JSProxy::subspaceFor):
        * runtime/JSString.h:
        (JSC::JSString::subspaceFor):
        * runtime/JSTypedArrayViewPrototype.h:
        * runtime/MapIteratorPrototype.h:
        * runtime/MapPrototype.h:
        * runtime/MathObject.h:
        * runtime/NativeErrorPrototype.h:
        * runtime/NativeExecutable.h:
        * runtime/NumberObject.h:
        (JSC::NumberObject::subspaceFor):
        * runtime/ObjectPrototype.h:
        * runtime/ProgramExecutable.h:
        * runtime/PropertyTable.h:
        * runtime/ReflectObject.h:
        * runtime/RegExp.h:
        * runtime/RegExpObject.h:
        * runtime/RegExpPrototype.h:
        * runtime/RegExpStringIteratorPrototype.h:
        * runtime/ScopedArguments.cpp:
        (JSC::ScopedArguments::createUninitialized):
        * runtime/ScopedArguments.h:
        * runtime/SetIteratorPrototype.h:
        * runtime/SetPrototype.h:
        * runtime/ShadowRealmPrototype.h:
        * runtime/SparseArrayValueMap.h:
        * runtime/StringIteratorPrototype.h:
        * runtime/StringObject.h:
        (JSC::StringObject::subspaceFor):
        * runtime/Structure.h:
        (JSC::Structure::subspaceFor):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        * runtime/StructureChain.h:
        * runtime/StructureRareData.h:
        * runtime/SymbolPrototype.h:
        * runtime/SymbolTable.h:
        * runtime/TemporalCalendarPrototype.h:
        * runtime/TemporalDurationPrototype.h:
        * runtime/TemporalInstantPrototype.h:
        * runtime/TemporalNow.h:
        * runtime/TemporalObject.h:
        * runtime/TemporalPlainTimePrototype.h:
        * runtime/TemporalTimeZonePrototype.h:
        * runtime/ThrowScope.cpp:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::cellHeapCellType):
        (JSC::VM::destructibleObjectHeapCellType):
        (JSC::VM::primitiveGigacageAuxiliarySpace):
        (JSC::VM::jsValueGigacageAuxiliarySpace):
        (JSC::VM::immutableButterflyJSValueGigacageAuxiliarySpace):
        (JSC::VM::gigacageAuxiliarySpace):
        (JSC::VM::cellSpace):
        (JSC::VM::variableSizedCellSpace):
        (JSC::VM::destructibleObjectSpace):
        (JSC::VM::arraySpace):
        (JSC::VM::bigIntSpace):
        (JSC::VM::calleeSpace):
        (JSC::VM::clonedArgumentsSpace):
        (JSC::VM::customGetterSetterSpace):
        (JSC::VM::dateInstanceSpace):
        (JSC::VM::domAttributeGetterSetterSpace):
        (JSC::VM::exceptionSpace):
        (JSC::VM::executableToCodeBlockEdgeSpace):
        (JSC::VM::functionSpace):
        (JSC::VM::getterSetterSpace):
        (JSC::VM::globalLexicalEnvironmentSpace):
        (JSC::VM::internalFunctionSpace):
        (JSC::VM::jsProxySpace):
        (JSC::VM::nativeExecutableSpace):
        (JSC::VM::numberObjectSpace):
        (JSC::VM::plainObjectSpace):
        (JSC::VM::promiseSpace):
        (JSC::VM::propertyNameEnumeratorSpace):
        (JSC::VM::propertyTableSpace):
        (JSC::VM::regExpSpace):
        (JSC::VM::regExpObjectSpace):
        (JSC::VM::ropeStringSpace):
        (JSC::VM::scopedArgumentsSpace):
        (JSC::VM::sparseArrayValueMapSpace):
        (JSC::VM::stringSpace):
        (JSC::VM::stringObjectSpace):
        (JSC::VM::structureChainSpace):
        (JSC::VM::structureRareDataSpace):
        (JSC::VM::structureSpace):
        (JSC::VM::brandedStructureSpace):
        (JSC::VM::symbolTableSpace):
        (JSC::VM::executableToCodeBlockEdgesWithConstraints):
        (JSC::VM::executableToCodeBlockEdgesWithFinalizers):
        (JSC::VM::codeBlockSpace):
        (JSC::VM::functionExecutableSpace):
        (JSC::VM::programExecutableSpace):
        (JSC::VM::unlinkedFunctionExecutableSpace):
        (JSC::VM::setFuzzerAgent): Deleted.
        (JSC::VM::SpaceAndSet::SpaceAndSet): Deleted.
        (JSC::VM::SpaceAndSet::setFor): Deleted.
        (JSC::VM::forEachCodeBlockSpace): Deleted.
        (JSC::VM::forEachScriptExecutableSpace): Deleted.
        * runtime/VMInlines.h:
        (JSC::VM::setFuzzerAgent):
        * runtime/WeakMapPrototype.h:
        * runtime/WeakObjectRefPrototype.h:
        * runtime/WeakSetPrototype.h:
        * tools/JSDollarVM.cpp:
        * tools/JSDollarVM.h:
        * wasm/js/JSWebAssembly.h:
        * wasm/js/WebAssemblyCompileErrorPrototype.h:
        * wasm/js/WebAssemblyExceptionPrototype.h:
        * wasm/js/WebAssemblyGlobalPrototype.h:
        * wasm/js/WebAssemblyInstancePrototype.h:
        * wasm/js/WebAssemblyLinkErrorPrototype.h:
        * wasm/js/WebAssemblyMemoryPrototype.h:
        * wasm/js/WebAssemblyModulePrototype.h:
        * wasm/js/WebAssemblyRuntimeErrorPrototype.h:
        * wasm/js/WebAssemblyTablePrototype.h:
        * wasm/js/WebAssemblyTagPrototype.h:

2021-11-30  Keith Miller  <keith_miller@apple.com>

        Structures should be allocated out of an aligned pool of memory so StructureID->Structure* is fast.
        https://bugs.webkit.org/show_bug.cgi?id=233379

        Reviewed by Yusuke Suzuki.

        This patch changes the 64-bit pointer variant of StructureID to
        just be the bottom bits of a reserved address space for
        structures. With this system the decoding of a StructureID is just
        adding the bits to the start of the structure address space (saved
        in JSCConfig).  We also take care to ignore any high bits of a
        StructureID outside the reserved address range.  This prevents a
        data corruption from causing us to read past the structure space,
        much like the gigacage.

        Now that StructureIDs can be directly determined from the
        Structure* (and visa versa) we no longer need StructureIDTable,
        which has been removed. Also, as Structures are still IsoHeaped
        but not allocated by fastMalloc, there's a new
        AlignedMemoryAllocator subclass that gets MarkedBlocks out of a
        simple static allocator.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::forEachDependentCell const):
        (JSC::AccessCase::propagateTransitions const):
        (JSC::AccessCase::generateWithGuard):
        * bytecode/ArrayProfile.cpp:
        (JSC::ArrayProfile::computeUpdatedPrediction):
        * bytecode/ArrayProfile.h:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::stronglyVisitWeakReferences):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadata::GetByIdModeMetadata):
        (JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeFromLLInt):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/PolyProtoAccessChain.cpp:
        (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
        * bytecode/PolyProtoAccessChain.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::visitWeak const):
        * bytecode/PutByIdFlags.h:
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeFromLLInt):
        * bytecode/SpeculatedType.cpp:
        (JSC::speculationFromCell):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::branchWeakStructure):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::finalize):
        * dfg/DFGSpeculativeJIT.cpp:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::emitUntypedBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * heap/Heap.cpp:
        (JSC::Heap::runEndPhase):
        * heap/Heap.h:
        (JSC::Heap::structureIDTable): Deleted.
        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::tryMallocBlock):
        (JSC::IsoAlignedMemoryAllocator::freeBlock):
        (JSC::IsoAlignedMemoryAllocator::commitBlock):
        (JSC::IsoAlignedMemoryAllocator::decommitBlock):
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory): Deleted.
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory): Deleted.
        * heap/IsoAlignedMemoryAllocator.h:
        * heap/IsoMemoryAllocatorBase.cpp: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp.
        (JSC::IsoMemoryAllocatorBase::IsoMemoryAllocatorBase):
        (JSC::IsoMemoryAllocatorBase::~IsoMemoryAllocatorBase):
        (JSC::IsoMemoryAllocatorBase::releaseMemoryFromSubclassDestructor):
        (JSC::IsoMemoryAllocatorBase::tryAllocateAlignedMemory):
        (JSC::IsoMemoryAllocatorBase::freeAlignedMemory):
        * heap/IsoMemoryAllocatorBase.h: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h.
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::tryAllocateFromLowerTier):
        * heap/IsoSubspace.h:
        * heap/PreciseAllocation.cpp:
        (JSC::PreciseAllocation::tryCreateForLowerTier):
        (JSC::PreciseAllocation::createForLowerTier): Deleted.
        * heap/PreciseAllocation.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
        * heap/StructureAlignedMemoryAllocator.cpp: Added.
        (JSC::StructureAlignedMemoryAllocator::StructureAlignedMemoryAllocator):
        (JSC::StructureAlignedMemoryAllocator::~StructureAlignedMemoryAllocator):
        (JSC::StructureAlignedMemoryAllocator::dump const):
        (JSC::StructureAlignedMemoryAllocator::tryAllocateMemory):
        (JSC::StructureAlignedMemoryAllocator::freeMemory):
        (JSC::StructureAlignedMemoryAllocator::tryReallocateMemory):
        (JSC::StructureMemoryManager::StructureMemoryManager):
        (JSC::StructureMemoryManager::tryMallocStructureBlock):
        (JSC::StructureMemoryManager::freeStructureBlock):
        (JSC::StructureAlignedMemoryAllocator::initializeStructureAddressSpace):
        (JSC::StructureAlignedMemoryAllocator::tryMallocBlock):
        (JSC::StructureAlignedMemoryAllocator::freeBlock):
        (JSC::StructureAlignedMemoryAllocator::commitBlock):
        (JSC::StructureAlignedMemoryAllocator::decommitBlock):
        * heap/StructureAlignedMemoryAllocator.h: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
        (JSC::AssemblyHelpers::emitLoadStructure):
        (JSC::AssemblyHelpers::emitLoadPrototype):
        (JSC::AssemblyHelpers::emitRandomThunk):
        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
        (JSC::AssemblyHelpers::branchIfValue):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchStructure):
        (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::PolymorphicAccessJITStubRoutine::computeHash):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * jit/JITStubRoutine.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::performLLIntGetByID):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/x86.rb:
        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BigIntPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/BooleanPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/DatePrototype.cpp:
        (JSC::formateDateInstance):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::sanitizedMessageString):
        (JSC::ErrorInstance::sanitizedNameString):
        (JSC::ErrorInstance::sanitizedToString):
        * runtime/ErrorPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/FunctionPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/HasOwnPropertyCache.h:
        * runtime/InitializeThreading.cpp:
        (JSC::initialize):
        * runtime/JSCConfig.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::dumpInContextAssumingStructure const):
        (JSC::JSValue::dumpForBacktrace const):
        * runtime/JSCell.cpp:
        (JSC::JSCell::toObjectSlow const):
        * runtime/JSCell.h:
        (JSC::JSCell::clearStructure):
        * runtime/JSCellInlines.h:
        (JSC::JSCell::structure const):
        (JSC::JSCell::setStructure):
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        (JSC::JSObject::createInitialUndecided):
        (JSC::JSObject::createInitialInt32):
        (JSC::JSObject::createInitialDouble):
        (JSC::JSObject::createInitialContiguous):
        (JSC::JSObject::createArrayStorage):
        (JSC::JSObject::convertUndecidedToArrayStorage):
        (JSC::JSObject::convertInt32ToArrayStorage):
        (JSC::JSObject::convertDoubleToArrayStorage):
        (JSC::JSObject::convertContiguousToArrayStorage):
        (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition):
        (JSC::JSObject::putDirectNonIndexAccessorWithoutTransition):
        * runtime/JSObject.h:
        (JSC::JSObject::nukeStructureAndSetButterfly):
        (JSC::JSObject::getPropertySlot):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getPropertySlot):
        (JSC::JSObject::getNonIndexPropertySlot):
        (JSC::JSObject::putDirectWithoutTransition):
        (JSC::JSObject::putDirectInternal):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/NumberPrototype.cpp:
        (JSC::toThisNumber):
        * runtime/ObjectPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::objectPrototypeToString):
        * runtime/RegExpPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/StringPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/Structure.cpp:
        (JSC::Structure::Structure):
        (JSC::Structure::~Structure):
        (JSC::Structure::flattenDictionaryStructure):
        (JSC::Structure::dump const):
        (JSC::Structure::canCachePropertyNameEnumerator const):
        * runtime/Structure.h:
        (JSC::Structure::id const):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::visitChildrenImpl):
        * runtime/StructureID.h: Added.
        (JSC::StructureID::nuke const):
        (JSC::StructureID::isNuked const):
        (JSC::StructureID::decontaminate const):
        (JSC::StructureID::operator bool const):
        (JSC::StructureID::operator== const):
        (JSC::StructureID::operator!= const):
        (JSC::StructureID::bits const):
        (JSC::StructureID::StructureID):
        (JSC::StructureID::isHashTableDeletedValue const):
        (JSC::StructureID::decode const):
        (JSC::StructureID::encode):
        (JSC::StructureIDHash::hash):
        (JSC::StructureIDHash::equal):
        * runtime/StructureIDBlob.h:
        * runtime/StructureIDTable.cpp: Removed.
        * runtime/StructureIDTable.h: Removed.
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
        * runtime/SymbolPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::processLogEntries):
        (JSC::TypeProfilerLog::visit):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::getStructure): Deleted.
        (JSC::VM::tryGetStructure): Deleted.
        * tools/HeapVerifier.cpp:
        (JSC::HeapVerifier::validateJSCell):
        * tools/Integrity.cpp:
        * tools/Integrity.h:
        * tools/IntegrityInlines.h:
        (JSC::Integrity::auditStructureID):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * wasm/js/WebAssemblyGlobalPrototype.cpp:
        (JSC::getGlobal):

2021-11-30  Alexey Shvayka  <ashvayka@apple.com>

        Rename "queueTaskToEventLoop" to "queueMicrotaskToEventLoop"
        https://bugs.webkit.org/show_bug.cgi?id=233639

        Reviewed by Mark Lam.

        This change improves grep-ability and avoids confusion since JSDOMWindowBase's
        queueMicrotaskToEventLoop() is capable only of scheduling microtasks (hence its signature).
        ECMA-262 has no notion of macrotasks, and now JSC hasn't as well.

        No behavior change.

        * API/JSAPIGlobalObject.cpp:
        * API/JSAPIGlobalObject.mm:
        * jsc.cpp:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::queueMicrotask):
        * runtime/JSGlobalObject.h:

2021-11-30  Saam Barati  <sbarati@apple.com>

        GetMyArgumentByValOutOfBounds needs to check for negative indices
        https://bugs.webkit.org/show_bug.cgi?id=232966
        <rdar://problem/85519898>

        Reviewed by Yusuke Suzuki.

        Negative indices inside of GetMyArgumentByValOutOfBounds would cause
        us to have the resulting value be undefined, instead of a full blown
        lookup that properly consults the prototype chain and such. The reason for
        this is negative indices would show up as "out of bounds", which would
        lead this node to result in undefined. But negative indices really should
        be treated as string property names, and can't be treated like normal out
        of bounds positive integers.
        
        This patch makes it so we speculate that we don't see negative indices. If
        we do see negative indices, we stop performing the transformation inside
        of arguments elimination so we don't end up in an OSR exit loop.

        * dfg/DFGArgumentsEliminationPhase.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):

2021-11-30  Geza Lore  <glore@igalia.com>

        [JSC] Unify most Baseline ops between JSVALUE64 and JSVALUE32_64
        https://bugs.webkit.org/show_bug.cgi?id=233424

        Reviewed by Yusuke Suzuki.

        This patch unifies the Baseline JIT implementations of most bytecode
        ops between the JSVALUE32_64 and JSVALUE64 platforms. There are very
        few changes to the generated code on JSVALUE64 (and all are fairly
        trivial, e.g.: removal of redundant moves in the slow path), apart
        from machine register substitutions. My measurements on x86_64
        indicate the patch is performance neutral there (which is what we
        expect).

        On ARMv7/Thumb-2 JetStream2 shows a 0.4% improvement. This is due to
        some of the improved implementations picked up from the JSVALUE64
        versions.

        Also remove various unused code.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfBoolean):
        (JSC::AssemblyHelpers::branchIfNotBoolean):
        (JSC::AssemblyHelpers::isUndefined):
        * jit/GPRInfo.h:
        * jit/JIT.cpp:
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_op_unsigned):
        (JSC::JIT::emit_compareAndJumpImpl):
        (JSC::JIT::emit_compareUnsignedAndJumpImpl):
        (JSC::JIT::emit_compareUnsignedImpl):
        (JSC::JIT::emit_compareAndJumpSlowImpl):
        (JSC::JIT::emit_op_inc):
        (JSC::JIT::emit_op_dec):
        (JSC::JIT::emit_op_mod):
        (JSC::JIT::emitBitBinaryOpFastPath):
        (JSC::JIT::emit_op_bitnot):
        (JSC::JIT::emitRightShiftFastPath):
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        (JSC::JIT::emit_op_div):
        * jit/JITArithmetic32_64.cpp: Removed.
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitGetVirtualRegisterPayload):
        (JSC::JIT::emitPutVirtualRegister):
        (JSC::JIT::emitJumpSlowCaseIfNotInt):
        (JSC::JIT::loadCodeBlockConstantPayload):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emit_op_is_empty):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_is_boolean):
        (JSC::JIT::emit_op_is_number):
        (JSC::JIT::emit_op_is_big_int):
        (JSC::JIT::emit_op_is_cell_with_type):
        (JSC::JIT::emit_op_is_object):
        (JSC::JIT::emit_op_to_primitive):
        (JSC::JIT::emit_op_to_property_key):
        (JSC::JIT::emit_op_not):
        (JSC::JIT::emit_op_jundefined_or_null):
        (JSC::JIT::emit_op_jnundefined_or_null):
        (JSC::JIT::emit_op_jeq_ptr):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_eq):
        (JSC::JIT::emit_op_neq):
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_string):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_get_parent_scope):
        (JSC::JIT::emit_op_get_scope):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_check_tdz):
        (JSC::JIT::emit_op_new_regexp):
        (JSC::JIT::emit_op_get_rest_length):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::compileOpEqCommon):
        (JSC::JIT::compileOpEqSlowCommon):
        (JSC::JIT::emit_op_eq):
        (JSC::JIT::emit_op_neq):
        (JSC::JIT::emit_op_jeq):
        (JSC::JIT::emit_op_jneq):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emitSlow_op_jneq):
        (JSC::JIT::compileOpStrictEqCommon):
        (JSC::JIT::emit_op_stricteq):
        (JSC::JIT::emit_op_nstricteq):
        (JSC::JIT::emit_op_jstricteq):
        (JSC::JIT::emit_op_jnstricteq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emit_enumerator_has_propertyImpl):
        (JSC::JIT::emitWriteBarrier):
        * jit/JSInterfaceJIT.h:
        (JSC::JSInterfaceJIT::emitLoadJSCell):

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt
        https://bugs.webkit.org/show_bug.cgi?id=233610
        rdar://85820476

        Reviewed by Saam Barati.

        Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash
        if the value is double AnyInt etc.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):

2021-11-29  Saam Barati  <sbarati@apple.com>

        FTL's implementation of HasIndexedProperty for InBounds accesses checks the inverse of what it should be checking when exiting by seeing a hole
        https://bugs.webkit.org/show_bug.cgi?id=233408
        <rdar://problem/85787251>

        Reviewed by Mark Lam.

        The implementation of an InBounds HasIndexedProperty in FTL, when speculating, we
        would exit when we did not see a hole, not when we did see a hole. This is
        the inverse of what we need to do, we should exit when we do see a hole.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] slice should be aware of TerminationException
        https://bugs.webkit.org/show_bug.cgi?id=233593
        rdar://85823844

        Reviewed by Mark Lam.

        Since termination exception can happen at any time, assertNoException is wrong.

        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add Intl.NumberFormat.formatRangeToParts
        https://bugs.webkit.org/show_bug.cgi?id=233540

        Reviewed by Ross Kirsling.

        This patch implements Intl.NumberFormat#formatRangeToParts if ICU is 69 or greater.
        It also cleans up / optimizes existing Intl.NumberFormat#formatToParts implementation.

        We first collect all fields generated by ICU. And then, flattening nested fields into
        non-overlapping sequence of parts via flattenFields.

        * runtime/IntlNumberFormat.cpp:
        (JSC::flattenFields):
        (JSC::numberFieldsPracticallyEqual):
        (JSC::IntlNumberFormat::formatRangeToPartsInternal):
        (JSC::IntlNumberFormat::formatRangeToParts const):
        (JSC::IntlNumberFormat::formatToPartsInternal):
        (JSC::IntlNumberFormat::formatToParts const):
        * runtime/IntlNumberFormat.h:
        * runtime/IntlNumberFormatPrototype.cpp:
        (JSC::IntlNumberFormatPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlRelativeTimeFormat.cpp:
        (JSC::IntlRelativeTimeFormat::formatToParts const):

2021-11-29  Michael Catanzaro  <mcatanzaro@gnome.org>

        [GTK] 2.35.1 fails to build for Fedora: undefined reference to 'llint_link_call'
        https://bugs.webkit.org/show_bug.cgi?id=233574

        Unreviewed, add missing attributes.

        * llint/LLIntSlowPaths.h:

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Public Class Field initialization is slow
        https://bugs.webkit.org/show_bug.cgi?id=232479

        Reviewed by Alexey Shvayka.

        Class public field implementation did not have optimization for initializing class fields: using
        runtime call to initialize fields instead of IC. This patch leverages put_by_id / put_by_val with
        direct flag so that we can enable IC.

        Currently, we are not changing original putDirect semantics since it is out of this patch's scope.
        We will look into it and probably changing it in a separate patch, but not in this patch.

                                                             ToT                     Patched

        class-fields-classic-constructor-assignments
                                                       17.1491+-2.6327           15.0906+-0.6795          might be 1.1364x faster
        class-fields-public-fields                    409.4328+-8.3140     ^     20.2752+-2.0835        ^ definitely 20.1938x faster
        class-fields-private-fields                    27.2621+-1.3858           25.1810+-3.9873          might be 1.0826x faster

        * bytecompiler/NodesCodegen.cpp:
        (JSC::DefineFieldNode::emitBytecode):
        * runtime/CommonSlowPaths.h:
        (JSC::CommonSlowPaths::putDirectWithReify):
        * runtime/JSObject.cpp:
        (JSC::JSObject::putDirectCustomAccessor):
        (JSC::JSObject::putDirectNonIndexAccessor):
        * runtime/JSObject.h:
        (JSC::JSObject::putDirect):
        (JSC::JSObject::putDirectRespectingExtensibility):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::putInlineFast):
        (JSC::JSObject::putDirectInternal):
        (JSC::JSObject::putOwnDataProperty):
        (JSC::JSObject::putOwnDataPropertyMayBeIndex):

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] private name operation should use RETURN_IF_EXCEPTION
        https://bugs.webkit.org/show_bug.cgi?id=233577
        rdar://85813869

        Reviewed by Mark Lam.

        Because of TerminatedExecutionError, error can be thrown at any time.

        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        (JSC::putPrivateNameOptimize):
        (JSC::putPrivateName):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Move m_incomingPolymorphicCalls out of CodeBlock::JITData
        https://bugs.webkit.org/show_bug.cgi?id=233415

        Reviewed by Mark Lam and Darin Adler.

        This patch moves m_incomingPolymorphicCalls from CodeBlock::JITData to CodeBlock since it is now used
        in LLInt too if JIT is enabled. To keep CodeBlock small, this patch shrinks sizeof(SentinelLinkedList).

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::linkIncomingPolymorphicCall):
        (JSC::CodeBlock::unlinkIncomingCalls):
        * bytecode/CodeBlock.h:

2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode
        https://bugs.webkit.org/show_bug.cgi?id=233571
        rdar://85812164

        Reviewed by Mark Lam.

        If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic.
        In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength.
        And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled.

        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):

2021-11-29  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Populate RISCV64Assembler with instruction-generation methods
        https://bugs.webkit.org/show_bug.cgi?id=233256

        Reviewed by Yusuke Suzuki.

        Sprinkle RISCV64Assembler class with helper methods for generating the
        desired instruction values.

        Immediate types from the RISCV64Instructions namespace are introduced
        into the class for easier usage here and in the MacroAssemblerRISCV64
        class. Instruction-generating methods roughly match the different
        instruction types in the RISCV64Instructions namespace.

        A few optimizations are done around floating-point instructions. We can
        use one base method which expects the desired FP size as a template
        parameter, and the appropriate RISCV64Instructions type can then be
        selected based on that size value. Different combinations for FP move
        and conversion instructions are also grouped behind a single method,
        with thorough compile-time validation done to prevent generating
        invalid instructions.

        A few helper methods intended for masking, sign-extension and
        zero-extension are also added. The Condition enum is fixed to list only
        RISCV-viable conditions, with the values ordered so that a simple
        XOR-by-one of a given value will produce the value of the inverted
        condition.

        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Assembler::invert):
        (JSC::RISCV64Assembler::luiInsn):
        (JSC::RISCV64Assembler::auipcInsn):
        (JSC::RISCV64Assembler::jalInsn):
        (JSC::RISCV64Assembler::jalrInsn):
        (JSC::RISCV64Assembler::beqInsn):
        (JSC::RISCV64Assembler::bneInsn):
        (JSC::RISCV64Assembler::bltInsn):
        (JSC::RISCV64Assembler::bgeInsn):
        (JSC::RISCV64Assembler::bltuInsn):
        (JSC::RISCV64Assembler::bgeuInsn):
        (JSC::RISCV64Assembler::lbInsn):
        (JSC::RISCV64Assembler::lhInsn):
        (JSC::RISCV64Assembler::lwInsn):
        (JSC::RISCV64Assembler::ldInsn):
        (JSC::RISCV64Assembler::lbuInsn):
        (JSC::RISCV64Assembler::lhuInsn):
        (JSC::RISCV64Assembler::lwuInsn):
        (JSC::RISCV64Assembler::sbInsn):
        (JSC::RISCV64Assembler::shInsn):
        (JSC::RISCV64Assembler::swInsn):
        (JSC::RISCV64Assembler::sdInsn):
        (JSC::RISCV64Assembler::addiInsn):
        (JSC::RISCV64Assembler::sltiInsn):
        (JSC::RISCV64Assembler::sltiuInsn):
        (JSC::RISCV64Assembler::xoriInsn):
        (JSC::RISCV64Assembler::oriInsn):
        (JSC::RISCV64Assembler::andiInsn):
        (JSC::RISCV64Assembler::slliInsn):
        (JSC::RISCV64Assembler::srliInsn):
        (JSC::RISCV64Assembler::sraiInsn):
        (JSC::RISCV64Assembler::addInsn):
        (JSC::RISCV64Assembler::subInsn):
        (JSC::RISCV64Assembler::sllInsn):
        (JSC::RISCV64Assembler::sltInsn):
        (JSC::RISCV64Assembler::sltuInsn):
        (JSC::RISCV64Assembler::xorInsn):
        (JSC::RISCV64Assembler::srlInsn):
        (JSC::RISCV64Assembler::sraInsn):
        (JSC::RISCV64Assembler::orInsn):
        (JSC::RISCV64Assembler::andInsn):
        (JSC::RISCV64Assembler::ecallInsn):
        (JSC::RISCV64Assembler::ebreakInsn):
        (JSC::RISCV64Assembler::addiwInsn):
        (JSC::RISCV64Assembler::slliwInsn):
        (JSC::RISCV64Assembler::srliwInsn):
        (JSC::RISCV64Assembler::sraiwInsn):
        (JSC::RISCV64Assembler::addwInsn):
        (JSC::RISCV64Assembler::subwInsn):
        (JSC::RISCV64Assembler::sllwInsn):
        (JSC::RISCV64Assembler::srlwInsn):
        (JSC::RISCV64Assembler::srawInsn):
        (JSC::RISCV64Assembler::mulInsn):
        (JSC::RISCV64Assembler::mulhInsn):
        (JSC::RISCV64Assembler::mulhsuInsn):
        (JSC::RISCV64Assembler::mulhuInsn):
        (JSC::RISCV64Assembler::divInsn):
        (JSC::RISCV64Assembler::divuInsn):
        (JSC::RISCV64Assembler::remInsn):
        (JSC::RISCV64Assembler::remuInsn):
        (JSC::RISCV64Assembler::mulwInsn):
        (JSC::RISCV64Assembler::divwInsn):
        (JSC::RISCV64Assembler::divuwInsn):
        (JSC::RISCV64Assembler::remwInsn):
        (JSC::RISCV64Assembler::remuwInsn):
        (JSC::RISCV64Assembler::flwInsn):
        (JSC::RISCV64Assembler::fldInsn):
        (JSC::RISCV64Assembler::fswInsn):
        (JSC::RISCV64Assembler::fsdInsn):
        (JSC::RISCV64Assembler::fmaddInsn):
        (JSC::RISCV64Assembler::fmsubInsn):
        (JSC::RISCV64Assembler::fnmsubInsn):
        (JSC::RISCV64Assembler::fnmaddInsn):
        (JSC::RISCV64Assembler::faddInsn):
        (JSC::RISCV64Assembler::fsubInsn):
        (JSC::RISCV64Assembler::fmulInsn):
        (JSC::RISCV64Assembler::fdivInsn):
        (JSC::RISCV64Assembler::fsqrtInsn):
        (JSC::RISCV64Assembler::fsgnjInsn):
        (JSC::RISCV64Assembler::fsgnjnInsn):
        (JSC::RISCV64Assembler::fsgnjxInsn):
        (JSC::RISCV64Assembler::fminInsn):
        (JSC::RISCV64Assembler::fmaxInsn):
        (JSC::RISCV64Assembler::feqInsn):
        (JSC::RISCV64Assembler::fltInsn):
        (JSC::RISCV64Assembler::fleInsn):
        (JSC::RISCV64Assembler::fclassInsn):
        (JSC::RISCV64Assembler::fcvtInsn):
        (JSC::RISCV64Assembler::fmvInsn):
        (JSC::RISCV64Assembler::fenceInsn):
        (JSC::RISCV64Assembler::lrwInsn):
        (JSC::RISCV64Assembler::scwInsn):
        (JSC::RISCV64Assembler::lrdInsn):
        (JSC::RISCV64Assembler::scdInsn):
        (JSC::RISCV64Assembler::amoswapwInsn):
        (JSC::RISCV64Assembler::amoaddwInsn):
        (JSC::RISCV64Assembler::amoxorwInsn):
        (JSC::RISCV64Assembler::amoandwInsn):
        (JSC::RISCV64Assembler::amoorwInsn):
        (JSC::RISCV64Assembler::amoswapdInsn):
        (JSC::RISCV64Assembler::amoadddInsn):
        (JSC::RISCV64Assembler::amoxordInsn):
        (JSC::RISCV64Assembler::amoanddInsn):
        (JSC::RISCV64Assembler::amoordInsn):
        (JSC::RISCV64Assembler::nop):
        (JSC::RISCV64Assembler::maskRegister):
        (JSC::RISCV64Assembler::signExtend):
        (JSC::RISCV64Assembler::zeroExtend):
        (JSC::RISCV64Assembler::insn):
        (JSC::RISCV64Assembler::insnFP):
        (JSC::RISCV64Assembler::isValidShiftAmount):

2021-11-29  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Stop linking JavaScriptCore.framework with libz because it doesn't use any symbols from it
        https://bugs.webkit.org/show_bug.cgi?id=233550

        Reviewed by Anders Carlsson.

        Every compile produces a message like:

        Ld /Users/mmaxfield/Build/Products/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore normal (in target 'JavaScriptCore' from project 'JavaScriptCore')
        ld: warning: linking with (/usr/lib/libz.1.dylib) but not using any symbols from it

        * JavaScriptCore.xcodeproj/project.pbxproj:

2021-11-26  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, late November 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=233493

        Unreviewed non-unified build fixes.

        * jit/ThunkGenerators.h: Add missing inclusion of CallMode.h header, move header
        inclusions inside the ENABLE(JIT) guard.

2021-11-24  Zan Dobersek  <zdobersek@igalia.com>

        MacroAssembler: remove unused load/store methods for addresses with patchable offsets
        https://bugs.webkit.org/show_bug.cgi?id=233251

        Reviewed by Yusuke Suzuki.

        Remove MacroAssembler methods for load and store operations on addresses
        with patchable offset values as they're not used in any place anymore.

        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch): Deleted.
        (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch): Deleted.
        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch): Deleted.
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::load32WithAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerARM64::load32WithCompactAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerARM64::store32WithAddressOffsetPatch): Deleted.
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::load32WithAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerARMv7::store32WithAddressOffsetPatch): Deleted.
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerMIPS::load32WithCompactAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch): Deleted.
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerX86Common::load32WithCompactAddressOffsetPatch): Deleted.
        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch): Deleted.

2021-11-24  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Fix floating-point register listings in FPRInfo.h
        https://bugs.webkit.org/show_bug.cgi?id=233243

        Reviewed by Yusuke Suzuki.

        As with general-purpose registers, fpRegT0 to fpRegT7 assignments have
        to match the argument registers. Index-to-FPRReg mapping functions are
        updated accordingly.

        * jit/FPRInfo.h:
        (JSC::FPRInfo::toRegister):
        (JSC::FPRInfo::toIndex):

2021-11-24  Aditi Singh  <asingh@igalia.com>

        [JSC] Implement Date.prototype.toTemporalInstant()
        https://bugs.webkit.org/show_bug.cgi?id=232075

        Reviewed by Yusuke Suzuki.

        * runtime/CommonIdentifiers.h:
        * runtime/DatePrototype.cpp:
        (JSC::DatePrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-11-23  Don Olmstead  <don.olmstead@sony.com>

        Non-unified build fixes, mid November 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=233450

        Unreviewed non-unified build fixes.

        * heap/IsoHeapCellType.h:
        * jit/ThunkGenerators.h:

2021-11-22  Geza Lore  <glore@igalia.com>

        [JSC] Make sharing of unlinked baseline code possible on JSVALUE32_64
        https://bugs.webkit.org/show_bug.cgi?id=232624

        Reviewed by Yusuke Suzuki.

        This patch contains a few different changes, which taken together make
        it possible to share the unlinked baseline JIT code between different
        CodeBlocks on JSVALUE32_64 platforms. Note that by default, code
        sharing is disabled on JSVALUE32_64 due to the increased executable
        memory usage it may cause. The reson the executable memory usage might
        increase is that the UnlinkedCodeBlock has a longer lifetime than the
        corresponding linked CodeBlocks (due to the CodeCache I'm told), and
        when using code sharing, it holds a reference to the JITed code. This
        then prevents recycling of executable memory while the
        UnlinkedCodeBlock is live, while without sharing we could have
        reclaimed some of the executable memory earlier.

        The high level changes in this pach are:

        1. A lot of baseline implementations of the opcodes that needed
        changing for the unlinked baseline are now unified between the
        JSVALUE64 and JSVALUE32_64 platforms. Note that while this required
        adding some abstraction, the code generated by the baseline JIT on
        JSVALUE64 should be identical using this abstraction compared to
        before.

        2. I added a JSRInfo class which defines standard names for certain
        JSValueReg instances. This enables a lot of the unification in the
        point above to be expressed in a very simple manner, with very little
        transformation of the existing code. Again, this should have no impact
        on the generated code on JSVALUE64, apart from some register
        substitutions.

        3. The sizes of the resolve_scope and get_from_scope ops increased
        significantly with the unlinked baseline. This can cause issues on
        some JSVALUE32_64 targets where memory is more precious, so for these
        two ops I swapped in the implementations under EXTRA_CTI_THUNKS, which
        implement these using shared stubs. These stubs work on all platforms
        that support ENABLE(JIT), so they are now the only implementation and
        I have removed the basic bloated versions.

        4. Removed some unused code and fields I discovered while working on
        this, strictly speaking this is not necessary for the functional
        change.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::storeValue):
        (JSC::AssemblyHelpers::isNull):
        (JSC::AssemblyHelpers::isNotNull):
        (JSC::AssemblyHelpers::emitTurnUndefinedIntoNull):
        (JSC::AssemblyHelpers::noOverlap):
        (JSC::AssemblyHelpers::noOverlapImpl):
        (JSC::AssemblyHelpers::noOverlapImplRegMask):
        * jit/GPRInfo.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_compareAndJumpImpl):
        (JSC::JIT::emit_compareUnsignedAndJumpImpl):
        (JSC::JIT::emit_compareUnsignedImpl):
        (JSC::JIT::emit_op_mod):
        (JSC::JIT::emit_compareAndJump):
        (JSC::JIT::emit_compareUnsignedAndJump):
        (JSC::JIT::emit_compareUnsigned):
        (JSC::JIT::emit_compareAndJumpSlow):
        (JSC::JIT::emitBinaryDoubleOp):
        * jit/JITArithmetic32_64.cpp:
        (JSC::JIT::emit_op_unsigned):
        (JSC::JIT::emit_op_inc):
        (JSC::JIT::emit_op_dec):
        * jit/JITCall.cpp:
        (JSC::JIT::emit_op_ret):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        * jit/JITInlines.h:
        (JSC::JIT::getConstantOperand):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitGetVirtualRegister):
        (JSC::JIT::emitPutVirtualRegister):
        (JSC::JIT::emitGetVirtualRegisterPayload):
        (JSC::JIT::emitGetVirtualRegisterTag):
        (JSC::JIT::emitLoadDouble):
        (JSC::loadAddrOfCodeBlockConstantBuffer):
        (JSC::JIT::loadCodeBlockConstant):
        (JSC::JIT::loadCodeBlockConstantPayload):
        (JSC::JIT::loadCodeBlockConstantTag):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_mov):
        (JSC::JIT::emit_op_end):
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_is_undefined_or_null):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::valueIsFalseyGenerator):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jeq_ptr):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_eq):
        (JSC::JIT::emit_op_jeq):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::valueIsTruthyGenerator):
        (JSC::JIT::emit_op_neq):
        (JSC::JIT::emit_op_jneq):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emit_op_instanceof_custom):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitNewFuncCommon):
        (JSC::JIT::emitNewFuncExprCommon):
        (JSC::JIT::emit_op_new_array_with_size):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_prologue):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        (JSC::JIT::emit_op_get_argument):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emit_op_is_empty):
        (JSC::JIT::emit_op_is_boolean):
        (JSC::JIT::emit_op_is_number):
        (JSC::JIT::emit_op_is_cell_with_type):
        (JSC::JIT::emit_op_is_object):
        (JSC::JIT::emit_op_to_primitive):
        (JSC::JIT::emit_op_to_property_key):
        (JSC::JIT::emit_op_not):
        (JSC::JIT::emit_op_jundefined_or_null):
        (JSC::JIT::emit_op_jnundefined_or_null):
        (JSC::JIT::emit_op_jeq_ptr):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_eq):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emit_op_jeq):
        (JSC::JIT::compileOpEqJumpSlow):
        (JSC::JIT::emit_op_neq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emit_op_jneq):
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_string):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_get_parent_scope):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::emit_op_check_tdz):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_put_to_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        (JSC::JIT::emit_op_put_internal_field):
        (JSC::JIT::emit_op_get_property_enumerator):
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emitSlow_op_enumerator_get_by_val):
        (JSC::JIT::emit_op_enumerator_in_by_val):
        (JSC::JIT::emit_op_enumerator_has_own_property):
        (JSC::JIT::emitWriteBarrier):
        * jit/JITPropertyAccess32_64.cpp: Removed.
        * jit/JSInterfaceJIT.h:
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        * jit/ThunkGenerators.h:
        * runtime/OptionsList.h:

2021-11-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Move RepatchXXX from jit to bytecode
        https://bugs.webkit.org/show_bug.cgi?id=233395

        Reviewed by Mark Lam.

        They are also used by non JIT code too.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/Repatch.cpp: Renamed from Source/JavaScriptCore/jit/Repatch.cpp.
        * bytecode/Repatch.h: Renamed from Source/JavaScriptCore/jit/Repatch.h.
        * bytecode/RepatchInlines.h: Renamed from Source/JavaScriptCore/jit/RepatchInlines.h.

2021-11-19  Asumu Takikawa  <asumu@igalia.com>

        Fix WebAssembly memory.fill out of bounds error message
        https://bugs.webkit.org/show_bug.cgi?id=233392

        Reviewed by Yusuke Suzuki.

        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::addMemoryFill):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addMemoryFill):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::WASM_SLOW_PATH_DECL):

2021-11-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r286030.
        https://bugs.webkit.org/show_bug.cgi?id=233387

        5% JetStream2 regression

        Reverted changeset:

        "DFGByteCodeParser.cpp should avoid resizing the Operands<> of
        every BasicBlock on every inlining"
        https://bugs.webkit.org/show_bug.cgi?id=228053
        https://commits.webkit.org/r286030

2021-11-19  Saam Barati  <sbarati@apple.com>

        Fix assertion added in r285592
        https://bugs.webkit.org/show_bug.cgi?id=233373
        rdar://85451012

        Reviewed by Keith Miller.

        The assertion added in r285592 should not apply to Symbols. This patch
        fixes that error. We don't care if a Symbol can be parsed as an index
        since the string value in a Symbol is just its description, not the 
        actual property.

        * dfg/DFGValidate.cpp:

2021-11-19  Joseph Griego  <jgriego@igalia.com>

        [JSC] Shadow realms: set correct Function prototype on wrapped functions
        https://bugs.webkit.org/show_bug.cgi?id=233143

        Reviewed by Yusuke Suzuki.

        At present, the Function prototype set on each of the returned wrapped
        functions will be the Function object from the realm the shadow realm
        builtin is from--to comply with the latest draft of the shadow realms
        spec [1], wrapped function objects should have the Function prototype
        from the realm the wrapper object is destined for, instead.

        At present, this requires tracking both the calling (destination) and
        target (source) realm and switching between the two as function
        arguments are wrapped (when the notion of source and destination realm
        also flips)

        Adds a simple builtin (moveFunctionToRealm) that can switch the Function
        prototype given only the Shadow Realm object corresponding to the
        correct global object.

        Also marks the corresponding part of test262 as passing.

        [1] https://tc39.es/proposal-shadowrealm/ sections 2.1, 2.2


        * builtins/BuiltinNames.h:
        * builtins/ShadowRealmPrototype.js:
        (wrapped):
        (globalPrivate.wrap):
        (evaluate):
        (importValue):
        (globalPrivate.wrap.wrapped): Deleted.
        * bytecode/LinkTimeConstant.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/ShadowRealmPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmPrototype.h:

2021-11-19  Robin Morisset  <rmorisset@apple.com>

        AirFixObviousSpills should be optimized
        https://bugs.webkit.org/show_bug.cgi?id=228052

        Reviewed by Yusuke Suzuki.

        There were two problems with AirFixObviousSpills:
        - merge() had a quadratic blow-up, as for each element in a vector, it was searching it in a different vector.
        - it would visit blocks even when their state at head had not changed.

        I fixed the first problem by making sure that the vectors are sorted before calling merge, and making use of that invariant in the search of the vectors
        (see filterVectorAgainst)
        This reduced the total time spent in that phase from 390ms to 230ms, and the worst case time spent in that phase for one function from 100ms to 30ms (all of the results in this Changelog are for JetStream2 on a M1 MBP).

        I fixed the second problem even more easily by adding a m_shouldVisit BitVector. I also moved the m_wasVisited boolean that was in State to a m_notBottom BitVector for simplicity and symmetry.
        That change further reduced the total/max time from 230ms/30ms to 140ms/16ms.

        * b3/air/AirFixObviousSpills.cpp:

2021-11-18  Robin Morisset  <rmorisset@apple.com>

        [JSC/Air] Optimize enableMovesOnValueAndAdjacents in IRC
        https://bugs.webkit.org/show_bug.cgi?id=228615

        Reviewed by Saam Barati.

        The Iterated Register Coalescing (IRC) register allocator spends a very significant fraction of its time in JS2 in enableMovesOnValueAndAdjacents (816ms out of 2.07s spent in register allocation for Wasm code in one run I looked at with Instruments).
        The reason is that if this function is called on N nodes that are neighbors of each other, then enableMovesOnValue (which is kinda expensive as it iterates a SmallSet which is not always small) will be called N times on each of the N nodes. This can trivially be fixed by keeping track of which nodes need enableMovesOnValue called on them and only calling it on them once.

        It is a bit tricky to measure the performance impact of this, as it heavily depends on whether some very large functions reach Air or not, so there is a lot of noise.
        Here are the numbers out of 4 runs of JS2 (cli version) on an M1 MBP with --airForceIRCAllocator=1:
        Baseline       : total time in allocateRegistersByGraphColoring ranges from 2090ms to 3018ms, most time for a single function ranges from 631ms to 849ms
        With this patch: total time in allocateRegistersByGraphColoring ranges from 1580ms to 2333ms, most time for a single function ranges from 337ms to 560ms
        So despite the noise it seems quite clearly a win.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:

2021-11-18  Mark Lam  <mark.lam@apple.com>

        SubSpace constructors should take a const HeapCellType& instead of a HeapCellType*.
        https://bugs.webkit.org/show_bug.cgi?id=233341
        rdar://85573277

        Reviewed by Yusuke Suzuki.

        This helps document that HeapCellTypes are immutable once they are instantiated,
        and that SubSpaces won't be modifying them.

        Also remove the const on CellAttributes return values since it is not needed nor
        meaningful.

        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::attributes const):
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::CompleteSubspace):
        * heap/CompleteSubspace.h:
        * heap/HeapCellType.cpp:
        (JSC::HeapCellType::finishSweep const):
        (JSC::HeapCellType::destroy const):
        (JSC::HeapCellType::finishSweep): Deleted.
        (JSC::HeapCellType::destroy): Deleted.
        * heap/HeapCellType.h:
        (JSC::HeapCellType::attributes const):
        * heap/IsoHeapCellType.cpp:
        (JSC::IsoHeapCellType::finishSweep const):
        (JSC::IsoHeapCellType::destroy const):
        (JSC::IsoHeapCellType::finishSweep): Deleted.
        (JSC::IsoHeapCellType::destroy): Deleted.
        * heap/IsoHeapCellType.h:
        * heap/IsoInlinedHeapCellType.h:
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        * heap/IsoSubspace.h:
        * heap/IsoSubspacePerVM.cpp:
        (JSC::IsoSubspacePerVM::forVM):
        * heap/IsoSubspacePerVM.h:
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::Handle::attributes const):
        (JSC::MarkedBlock::attributes const):
        * heap/PreciseAllocation.h:
        (JSC::PreciseAllocation::attributes const):
        * heap/Subspace.cpp:
        (JSC::Subspace::initialize):
        * heap/Subspace.h:
        (JSC::Subspace::heapCellType const):
        * heap/SubspaceInlines.h:
        (JSC::Subspace::attributes const):
        * runtime/JSDestructibleObjectHeapCellType.cpp:
        (JSC::JSDestructibleObjectHeapCellType::finishSweep const):
        (JSC::JSDestructibleObjectHeapCellType::destroy const):
        (JSC::JSDestructibleObjectHeapCellType::finishSweep): Deleted.
        (JSC::JSDestructibleObjectHeapCellType::destroy): Deleted.
        * runtime/JSDestructibleObjectHeapCellType.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):

2021-11-18  Mark Lam  <mark.lam@apple.com>

        Rename PropertyMapHashTable.h to PropertyTable.h to match the class.
        https://bugs.webkit.org/show_bug.cgi?id=233333
        rdar://85565760

        Reviewed by Yusuke Suzuki.

        Also renamed some supporting data structures to match.  This is just a refactoring
        patch.  There are no behavior changes.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * runtime/PropertyMapHashTable.h: Removed.
        * runtime/PropertyTable.cpp:
        * runtime/PropertyTable.h: Copied from Source/JavaScriptCore/runtime/PropertyMapHashTable.h.
        (JSC::PropertyTable::find):
        (JSC::PropertyTable::get):
        (JSC::PropertyTable::add):
        (JSC::PropertyTable::remove):
        (JSC::PropertyTable::reinsert):
        (JSC::PropertyTable::rehash):
        * runtime/Structure.cpp:
        (JSC::PropertyTableStatisticsExitLogger::PropertyTableStatisticsExitLogger):
        (JSC::PropertyTableStatisticsExitLogger::~PropertyTableStatisticsExitLogger):
        (JSC::PropertyMapStatisticsExitLogger::PropertyMapStatisticsExitLogger): Deleted.
        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger): Deleted.
        * runtime/StructureInlines.h:
        * runtime/VM.cpp:

2021-11-18  Mark Lam  <mark.lam@apple.com>

        CellAttributes should be returned by value.
        https://bugs.webkit.org/show_bug.cgi?id=233335
        rdar://85568435

        Reviewed by Yusuke Suzuki.

        CellAttributes fits in 16 bits, and client code never modifies returned CellAttributes
        values.  Hence, there is no reason to return them by reference.

        Also fixed a bit-rotted comment in SubSpace.h.

        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::attributes const):
        * heap/HeapCellType.h:
        (JSC::HeapCellType::attributes const):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::Handle::attributes const):
        (JSC::MarkedBlock::attributes const):
        * heap/PreciseAllocation.h:
        (JSC::PreciseAllocation::attributes const):
        * heap/Subspace.h:
        * heap/SubspaceInlines.h:
        (JSC::Subspace::attributes const):

2021-11-18  Robin Morisset  <rmorisset@apple.com>

        DFGByteCodeParser.cpp should avoid resizing the Operands<> of every BasicBlock on every inlining
        https://bugs.webkit.org/show_bug.cgi?id=228053

        Reviewed by Saam Barati.

        The dfg bytecode parser only makes use of block->variablesAtTail.
        But currently it updates the size of variablesAtHead, valuesAtHead, valuesAtTail and intersectionOfPastValuesAtHead every single time it changes the number of Tmps and/or Locals.
        This happens notably whenever it inlines a function.

        It is not nearly as cheap as it looks, as each resizing may reallocate a Vector, requires filling the new slots with zeros, and requires moving the existing values (which are all 0) to the new Vector.
        This was obvious when looking at profiling of JS2: bzero + memmove are the two hottest C++ functions, and the manipulation of Operands is partly responsible.

        This patch fixes this by only resizing block->variablesAtTail during the execution of the bytecode parser, and initializing all of the other operands at the very end of it.
        It also merges the adjustment of numLocals and of numTmps for variablesAtTail during inlining, to avoid accidentally moving data twice.

        On JetStream2 on an M1 MBP, it changes the total time spent in the DFGByteCodeParser from 1240-1260ms to 1155-1170ms.

        * bytecode/Operands.h:
        (JSC::Operands::ensureLocalsAndTmps):
        * dfg/DFGBasicBlock.cpp:
        * dfg/DFGBasicBlock.h:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::ensureLocalsForVariablesAtTail):
        (JSC::DFG::ByteCodeParser::ensureLocalsAndTmpsForVariablesAtTail):
        (JSC::DFG::ByteCodeParser::allocateBlock):
        (JSC::DFG::ByteCodeParser::allocateTargetableBlock):
        (JSC::DFG::ByteCodeParser::allocateUntargetableBlock):
        (JSC::DFG::ByteCodeParser::inlineCall):
        (JSC::DFG::ByteCodeParser::handleVarargsInlining):
        (JSC::DFG::ByteCodeParser::handleGetById):
        (JSC::DFG::ByteCodeParser::handlePutById):
        (JSC::DFG::ByteCodeParser::parse):

2021-11-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add branchTest16 operation
        https://bugs.webkit.org/show_bug.cgi?id=233275

        Reviewed by Mark Lam.

        This patch adds branchTest16 to all macro assemblers. And it also fixes the existing bug of
        edge case of branchTest8: when we cannot represent the imm as ARM logical value, then we are
        failing to emit the right instructions. Probably this bug does not appear since we are not using
        such a value as an imm for branchTest8. We added tests to testmasm so that these code is stressed
        now.

        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::branchTest16):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::branchTest32):
        (JSC::MacroAssemblerARM64::branchTest8):
        (JSC::MacroAssemblerARM64::branchTest16):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchTest16):
        (JSC::MacroAssemblerARMv7::test32):
        (JSC::MacroAssemblerARMv7::test8):
        * assembler/MacroAssemblerHelpers.h:
        (JSC::MacroAssemblerHelpers::mask16OnCondition):
        (JSC::MacroAssemblerHelpers::load16OnCondition):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::load16):
        (JSC::MacroAssemblerMIPS::load16SignedExtendTo32):
        (JSC::MacroAssemblerMIPS::mask16OnTest):
        (JSC::MacroAssemblerMIPS::branchTest16):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::branchTest16):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::branchTest16):
        * assembler/X86Assembler.h:
        (JSC::X86Assembler::cmpw_im):
        (JSC::X86Assembler::testw_im):
        * assembler/testmasm.cpp:
        (JSC::testBranchTest8):
        (JSC::testBranchTest16):

2021-11-18  David Kilzer  <ddkilzer@apple.com>

        Add missing dependencies for <wtf/Platform.h> when generating derived sources
        <https://webkit.org/b/233304>
        <rdar://problem/85533245>

        Reviewed by Darin Adler.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        (Derived Sources : Generate Derived Sources):
        - Add an input dependency on the script run from the build phase
          script.

        * DerivedSources-input.xcfilelist:
        - Update after changes to DerivedSoures.make.  WebKit headers
          included by <wtf/Platform.h> are now listed.
        * DerivedSources.make:
        (platform_h_compiler_command): Add.
        (FEATURE_AND_PLATFORM_DEFINES):
        - Extract compiler command into a call routine for reuse.
        (PLATFORM_HEADER_DIR): Add.
        (PLATFORM_HEADER_DEPENDENCIES): Add.
        (FEATURE_AND_PLATFORM_DEFINE_DEPENDENCIES):
        - Generate a makefile dependency list for <wtf/Platform.h>, then
          filter it to list only WebKit project headers.

2021-11-18  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] jsc_value_object_define_property_accessor() throws an exception when called on a value without a wrapper instance
        https://bugs.webkit.org/show_bug.cgi?id=233253

        Reviewed by Michael Catanzaro.

        We assumed that getter and setter were always methods, so we always try to set the initial parameter as the
        instance. When called with a value not having an instance we get an exception because the expected instance is
        nullptr. This patch changes the behavior of jsc_value_object_define_property_accessor() to call the getter and
        setter as functions, but keeping the behavior of jsc_class_add_property() in which case they are still called as
        methods.

        * API/glib/JSCClass.cpp:
        (jsc_class_add_property): Use jscValueAddPropertyAccessor().
        * API/glib/JSCValue.cpp:
        (jsObjectCall): Remove useless break after return.
        (jscValueObjectDefinePropertyAccessor): Helper to define the property accessor using the given function type for
        the getter and setter.
        (jsc_value_object_define_property_accessor): Call jscValueObjectDefinePropertyAccessor() with function as
        function type.
        (jscValueAddPropertyAccessor): Call jscValueObjectDefinePropertyAccessor() with method as function type.
        * API/glib/JSCValuePrivate.h:

2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] TypedArray GetArrayLength should not use Reuse
        https://bugs.webkit.org/show_bug.cgi?id=233299
        rdar://85502079

        Reviewed by Robin Morisset.

        We should not perform OSR exit after assigning a value to a reused register, otherwise,
        OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
        OSR exit after loading a length, so we should not use reused register for length.

        * dfg/DFGSpeculativeJIT.cpp:

2021-11-17  Saam Barati  <sbarati@apple.com>

        Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
        https://bugs.webkit.org/show_bug.cgi?id=233271
        <rdar://85259288>

        Reviewed by Yusuke Suzuki.

        We have a fast path for running memmove when both the thing being
        copied from and the thing being copied to have the same typed array
        type. However, when copying from a Uint8Array into a Uint8ClampedArray,
        or vice versa, we were going down the slow path. In this case,
        we can still take the fast path, since we're guaranteed that storing
        into a Uint8ClampedArray from a Uint8Array will never actually need
        to clamp values. And when storing from a Uint8ClampedArray into a
        Uint8Array, the values can trivially be copied over.

        This patch is a 100x speedup on the attached microbenchmark.

        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::set):

2021-11-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Revise JSON.parse atomize policy
        https://bugs.webkit.org/show_bug.cgi?id=233231

        Reviewed by Mark Lam.

        This patch improves JSON.parse performance by the following two changes.

        1. Introduce JSONAtomStringCache. It is inspired from HTMLAtomStringCache. It offers cheap
           fixed-sized cache stored in VM. Since it is in VM, we do not need to clear it every time
           we call JSON.parse. We clear this cache when full GC happens. It contributes to
           flight-todomvc-json-parse by 5%.
        2. Do not atomize long string. Profiling of JSON.parse said that most of time is used for
           atomizing of Strings. There is a tradeoff that, atomizing strings can reduce duplicate string
           allocations, but it has a performance penalty. V8 limits atomizing for <= 10 length strings,
           and SpiderMonkey does not atomize strings. In this patch, we aligned our atomizing policy to
           V8, so we do not atomize strings if the length is longer than 10. It contributes to
           flight-todomvc-json-parse by 50%.

        Many microbenchmarks show the improvement.
                                                                 ToT                     Patched

            json-parse-object-reviver-same-value           78.2683+-0.9598           77.7784+-0.9488
            vanilla-es2015-babel-webpack-todomvc-json-parse
                                                           99.9129+-0.5508     ^     85.8160+-0.8721        ^ definitely 1.1643x faster
            json-parse-array-reviver-same-value            63.5891+-0.8066           63.2895+-0.7336
            flight-todomvc-json-parse                      52.4230+-0.4474     ^     34.1159+-0.2378        ^ definitely 1.5366x faster
            json-parse-object-reviver                      80.8417+-0.5042           80.6393+-0.8087
            json-parse-leaf-object                         51.6836+-0.6754     ^     46.8983+-0.1578        ^ definitely 1.1020x faster
            vanilla-es2015-todomvc-json-parse             100.5916+-0.9399     ^     85.9522+-0.8470        ^ definitely 1.1703x faster
            vanilla-todomvc-json-parse                     76.4518+-0.4341     ^     64.2318+-0.7621        ^ definitely 1.1902x faster
            json-parse-array-reviver                       76.1276+-0.8529           75.9747+-0.9002

        And Speedometer2 shows 0.8% improvement.

            ----------------------------------------------------------------------------------------------------------------------------------
            |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
            ----------------------------------------------------------------------------------------------------------------------------------
            | Elm-TodoMVC                          |109.046667   |108.546667   |0.995415  | 0.197186                                         |
            | VueJS-TodoMVC                        |21.813333    |21.566667    |0.988692  | 0.313141                                         |
            | EmberJS-TodoMVC                      |117.796667   |118.086667   |1.002462  | 0.558244                                         |
            | Flight-TodoMVC                       |64.273333    |62.260000    |0.968675  | 0.000000 (significant)                           |
            | BackboneJS-TodoMVC                   |42.856667    |42.863333    |1.000156  | 0.975025                                         |
            | Preact-TodoMVC                       |16.326667    |16.673333    |1.021233  | 0.298674                                         |
            | AngularJS-TodoMVC                    |123.146667   |122.413333   |0.994045  | 0.160282                                         |
            | Inferno-TodoMVC                      |57.510000    |57.533333    |1.000406  | 0.947767                                         |
            | Vanilla-ES2015-TodoMVC               |61.133333    |59.200000    |0.968375  | 0.000000 (significant)                           |
            | Angular2-TypeScript-TodoMVC          |38.863333    |38.963333    |1.002573  | 0.860359                                         |
            | VanillaJS-TodoMVC                    |51.296667    |49.423333    |0.963480  | 0.000000 (significant)                           |
            | jQuery-TodoMVC                       |210.933333   |210.596667   |0.998404  | 0.590132                                         |
            | EmberJS-Debug-TodoMVC                |326.093333   |324.890000   |0.996310  | 0.156955                                         |
            | React-TodoMVC                        |81.113333    |81.360000    |1.003041  | 0.335615                                         |
            | React-Redux-TodoMVC                  |132.560000   |132.256667   |0.997712  | 0.306072                                         |
            | Vanilla-ES2015-Babel-Webpack-TodoMVC |60.073333    |59.026667    |0.982577  | 0.000883 (significant)                           |
            ----------------------------------------------------------------------------------------------------------------------------------
            a mean = 280.29390
            b mean = 282.51413
            pValue = 0.0000083325
            (Bigger means are better.)
            1.008 times better
            Results ARE significant

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * heap/Heap.cpp:
        (JSC::Heap::finalize):
        * runtime/JSONAtomStringCache.h: Added.
        (JSC::JSONAtomStringCache::makeIdentifier):
        (JSC::JSONAtomStringCache::clear):
        (JSC::JSONAtomStringCache::cacheSlot):
        (JSC::JSONAtomStringCache::cache):
        * runtime/JSONAtomStringCacheInlines.h: Added.
        (JSC::JSONAtomStringCache::make):
        (JSC::JSONAtomStringCache::vm const):
        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser<CharType>::makeIdentifier):
        (JSC::LiteralParser<CharType>::makeJSString):
        (JSC::LiteralParser<CharType>::parsePrimitiveValue):
        (JSC::LiteralParser<CharType>::parse):
        * runtime/LiteralParser.h:
        * runtime/VM.h:

2021-11-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use operation path when PutByVal child1 is not speculated as a Cell
        https://bugs.webkit.org/show_bug.cgi?id=233147
        rdar://85344310

        Reviewed by Mark Lam.

        r285530 removed non CellUse / non KnownCellUse case incorrectly (when we do not have Cell edge,
        then we should use the slow operation path). This patch recovers it.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compilePutByVal):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

2021-11-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use CallLinkInfo in LLInt
        https://bugs.webkit.org/show_bug.cgi?id=232746

        Reviewed by Saam Barati.

        This patch integrates normal CallLinkInfo into LLInt and remove adhoc LLIntCallLinkInfo.
        So that we can simplify our IC software stack, and unifying call IC mechanism into one CallLinkInfo.

        1. LLInt can fully use our polymorphic call IC, and we no longer need to reset call IC when
           tiering up from LLInt to Baseline JIT since both now uses the same CallLinkInfo data structure.
           DFG and FTL can also retrieve call information from this CallLinkInfo.
        2. LLInt varargs calls get the same level of optimization to Baseline. Previously it does not have
           call IC.
        3. When JIT is disabled, we disable polymorphic call IC since it requires dynamic code generation.
           In that case, we only use monomorphic one, which is the same to the old LLIntCallLinkInfo.
        4. CallLinkInfo::doneLocation is set up only after Baseline JIT. We adjust call IC code so that
           we no longer rely on doneLocation when using DataIC. This allows us to smoothly tiering up
           from LLInt to Baseline JIT while using the same CallLinkInfo.
           We set up doneLocation in Baseline JIT just because DFG OSR exit requires when exiting to
           Baseline JIT code.
        5. We remove CallLinkInfo from JIT constant pool, and we store CallLinkInfo in metadata so that
           LLInt and Baseline JIT quickly access to that and keeping unlinked Baseline JIT working.
        6. We implement LLInt version of call IC thunks so that we can use them even when JIT is disabled.

        Speedometer2 is neutral. JetStream2 is 0.7% progressed.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/CodeLocation.h:
        * assembler/LinkBuffer.cpp:
        (JSC::shouldDumpDisassemblyFor): Deleted.
        * assembler/LinkBuffer.h:
        * assembler/MacroAssemblerCodeRef.cpp:
        (JSC::shouldDumpDisassemblyFor):
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodePtr::dumpWithName const):
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeOperandsForCheckpoint.h:
        (JSC::callLinkInfoFor):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::clearStub):
        (JSC::CallLinkInfo::setMonomorphicCallee):
        (JSC::CallLinkInfo::clearCallee):
        (JSC::CallLinkInfo::visitWeak):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitTailCallFastPath):
        (JSC::CallLinkInfo::emitTailCallDataICFastPath):
        (JSC::CallLinkInfo::emitSlowPath):
        (JSC::CallLinkInfo::initializeDataIC):
        (JSC::CallLinkInfo::emitDirectTailCallFastPath):
        (JSC::CallLinkInfo::revertCallToStub):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::isLinked const):
        (JSC::CallLinkInfo::stub const):
        (JSC::CallLinkInfo::updateMaxArgumentCountIncludingThis):
        (JSC::CallLinkInfo::forEachDependentCell const):
        (JSC::CallLinkInfo::setSlowStub): Deleted.
        (JSC::CallLinkInfo::clearSlowStub): Deleted.
        (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFor):
        (JSC::CallLinkStatus::computeFromLLInt): Deleted.
        * bytecode/CallLinkStatus.h:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::getICStatusMap):
        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
        (JSC::CodeBlock::linkIncomingCall):
        (JSC::CodeBlock::unlinkIncomingCalls):
        (JSC::CodeBlock::jettison):
        (JSC::CodeBlock::getArrayProfile):
        (JSC::CodeBlock::updateAllArrayProfilePredictions):
        * bytecode/CodeBlock.h:
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachLLIntOrBaselineCallLinkInfo):
        (JSC::CodeBlock::forEachLLIntCallLinkInfo): Deleted.
        * bytecode/LLIntCallLinkInfo.h: Removed.
        * bytecode/Opcode.h:
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::callerReturnPC):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitVirtualCall):
        (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
        * jit/AssemblyHelpers.h:
        * jit/BaselineJITCode.h:
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::createForBaselineOrLLIntTailCall):
        * jit/CallFrameShuffleData.h:
        * jit/JIT.cpp:
        (JSC::JIT::addUnlinkedCallLinkInfo):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::emit_op_ret):
        (JSC::JIT::returnFromBaselineGenerator):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::op_ret_handlerGenerator): Deleted.
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        (JSC::handleHostCall): Deleted.
        (JSC::virtualForWithFunction): Deleted.
        * jit/Repatch.cpp:
        (JSC::linkSlowPathTo):
        (JSC::linkSlowFor):
        (JSC::webAssemblyOwner):
        (JSC::linkMonomorphicCall):
        (JSC::revertCall):
        (JSC::unlinkCall):
        (JSC::jsToWasmICCodePtr):
        (JSC::linkVirtualFor):
        (JSC::linkPolymorphicCall):
        * jit/Repatch.h:
        * jit/RepatchInlines.h: Added.
        (JSC::handleHostCall):
        (JSC::linkFor):
        (JSC::virtualForWithFunction):
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::virtualThunkForRegularConstruct): Deleted.
        (JSC::virtualThunkForTailConstruct): Deleted.
        (JSC::virtualThunkForConstructCall): Deleted.
        * jit/ThunkGenerators.h:
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::llint_link_call):
        (JSC::LLInt::llint_virtual_call):
        (JSC::LLInt::handleHostCall):
        (JSC::LLInt::setUpCall):
        (JSC::LLInt::varargsSetup):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::commonCallEval):
        (JSC::LLInt::genericCall): Deleted.
        * llint/LLIntSlowPaths.h:
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::createJSGateThunk):
        (JSC::LLInt::createTailCallGate):
        (JSC::LLInt::returnLocationThunk):
        * llint/LLIntThunks.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter.cpp:
        (JSC::CLoopRegister::operator CallLinkInfo*):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/cloop.rb:
        * offlineasm/instructions.rb:
        * runtime/ExecutableBase.h:
        * runtime/FunctionExecutable.h:
        * runtime/Gate.h:
        * runtime/VM.cpp:
        (JSC::VM::getCTILinkCall):
        (JSC::VM::getCTIThrowExceptionFromCallSlowPath):
        (JSC::VM::getCTIVirtualCall):
        * runtime/VM.h:

2021-11-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Initialize m_usesT2
        https://bugs.webkit.org/show_bug.cgi?id=233095

        Reviewed by Alexey Shvayka.

        m_usesT2 is not initialized as "false" correctly.

        * yarr/YarrJIT.cpp:

2021-11-14  Mikhail R. Gadelha  <mikhail@igalia.com>

        Prevent fused multiply add during ParseInt
        https://bugs.webkit.org/show_bug.cgi?id=232951

        Reviewed by Yusuke Suzuki.

        When parsing the string in parseInt, gcc can wrongfully generate
        a fused multiply-add instruction, causing the conversion to be wrong
        for some high values. An add followed by a multiply gives the correct
        result and it is the code generated most of the times.

        This patch adds a volatile qualifier to the number variable, so the
        compiler doesn't try to optimize it, and enables a failing test on
        mips.

        Alternative solutions that I tried but gcc seems to ignore: #pragma
        STDC FP_CONTRACT OFF, compiling with -ffp-contract=off, and setting function
        attributes __attribute__((optimize("fp-contract=off"))) and
        __attribute__((optimize("-ffp-contract=off"))), so volative seems to be
        a good compromise.

        The issue was found when cross compiling to mips with gcc 8.4.0 and
        options -ffp-contract=off -mmadd4.

        * runtime/ParseInt.h:
        (JSC::parseInt):

2021-11-12  Darin Adler  <darin@apple.com>

        Make sort-Xcode-project-file idempotent
        https://bugs.webkit.org/show_bug.cgi?id=233077

        Reviewed by Wenson Hsieh.

        * JavaScriptCore.xcodeproj/project.pbxproj: Sorted.

2021-11-11  Mark Lam  <mark.lam@apple.com>

        Refactor allocateCell() and tryAllocateCell() to take VM& instead of Heap&.
        https://bugs.webkit.org/show_bug.cgi?id=233028
        rdar://85329680

        Reviewed by Yusuke Suzuki.

        allocateCell() and tryAllocateCell() can fetch Heap& from VM& themselves.  This
        allows us to make all the client code more terse, and also makes it easier to
        redirect the underlying heap to allocate from later for global GC work.
        Additionally, this will help make the global GC patch less of a mega patch and
        easier to review later.

        * API/JSAPIGlobalObject.h:
        * API/JSAPIValueWrapper.h:
        * API/JSCallbackConstructor.h:
        * API/JSCallbackFunction.cpp:
        (JSC::JSCallbackFunction::create):
        * API/JSCallbackObject.cpp:
        (JSC::JSCallbackObject<JSGlobalObject>::create):
        * API/JSCallbackObject.h:
        * API/ObjCCallbackFunction.mm:
        (JSC::ObjCCallbackFunction::create):
        * API/glib/JSAPIWrapperGlobalObject.cpp:
        (JSC::JSCallbackObject<JSAPIWrapperGlobalObject>::create):
        * API/glib/JSCCallbackFunction.cpp:
        (JSC::JSCCallbackFunction::create):
        * bytecode/EvalCodeBlock.h:
        * bytecode/ExecutableToCodeBlockEdge.cpp:
        (JSC::ExecutableToCodeBlockEdge::create):
        * bytecode/FunctionCodeBlock.h:
        * bytecode/ModuleProgramCodeBlock.h:
        * bytecode/ProgramCodeBlock.h:
        * bytecode/UnlinkedEvalCodeBlock.h:
        * bytecode/UnlinkedFunctionCodeBlock.h:
        * bytecode/UnlinkedFunctionExecutable.h:
        * bytecode/UnlinkedModuleProgramCodeBlock.h:
        * bytecode/UnlinkedProgramCodeBlock.h:
        * debugger/DebuggerScope.cpp:
        (JSC::DebuggerScope::create):
        * inspector/JSInjectedScriptHost.h:
        * inspector/JSInjectedScriptHostPrototype.h:
        * inspector/JSJavaScriptCallFrame.h:
        * inspector/JSJavaScriptCallFramePrototype.h:
        * jsc.cpp:
        (JSCMemoryFootprint::create):
        (JSFileDescriptor::create):
        * runtime/AggregateErrorConstructor.h:
        * runtime/AggregateErrorPrototype.h:
        * runtime/ArrayConstructor.h:
        * runtime/ArrayIteratorPrototype.h:
        * runtime/ArrayPrototype.cpp:
        (JSC::ArrayPrototype::create):
        * runtime/AsyncFromSyncIteratorPrototype.cpp:
        (JSC::AsyncFromSyncIteratorPrototype::create):
        * runtime/AsyncFunctionConstructor.h:
        * runtime/AsyncFunctionPrototype.h:
        * runtime/AsyncGeneratorFunctionConstructor.h:
        * runtime/AsyncGeneratorFunctionPrototype.h:
        * runtime/AsyncGeneratorPrototype.h:
        * runtime/AsyncIteratorPrototype.h:
        * runtime/AtomicsObject.cpp:
        (JSC::AtomicsObject::create):
        * runtime/BigIntConstructor.h:
        * runtime/BigIntObject.cpp:
        (JSC::BigIntObject::create):
        * runtime/BigIntPrototype.h:
        * runtime/BooleanConstructor.h:
        * runtime/BooleanObject.h:
        (JSC::BooleanObject::create):
        * runtime/BooleanPrototype.h:
        * runtime/BrandedStructure.cpp:
        (JSC::BrandedStructure::create):
        * runtime/CachedTypes.cpp:
        (JSC::CachedProgramCodeBlock::decode const):
        (JSC::CachedModuleCodeBlock::decode const):
        (JSC::CachedEvalCodeBlock::decode const):
        (JSC::CachedFunctionCodeBlock::decode const):
        (JSC::CachedFunctionExecutable::decode const):
        * runtime/ClonedArguments.cpp:
        (JSC::ClonedArguments::createEmpty):
        * runtime/ConsoleObject.h:
        * runtime/CustomGetterSetter.h:
        (JSC::CustomGetterSetter::create):
        * runtime/DOMAttributeGetterSetter.h:
        * runtime/DateConstructor.h:
        * runtime/DateInstance.h:
        * runtime/DatePrototype.h:
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::createUninitialized):
        * runtime/DirectEvalExecutable.cpp:
        (JSC::DirectEvalExecutable::create):
        * runtime/ErrorConstructor.h:
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::create):
        * runtime/ErrorPrototype.h:
        * runtime/Exception.cpp:
        (JSC::Exception::create):
        * runtime/FinalizationRegistryConstructor.h:
        * runtime/FinalizationRegistryPrototype.h:
        * runtime/FunctionConstructor.h:
        * runtime/FunctionExecutable.h:
        * runtime/FunctionPrototype.h:
        * runtime/FunctionRareData.cpp:
        (JSC::FunctionRareData::create):
        * runtime/GeneratorFunctionConstructor.h:
        * runtime/GeneratorFunctionPrototype.h:
        * runtime/GeneratorPrototype.h:
        * runtime/GetterSetter.h:
        * runtime/HashMapImpl.h:
        * runtime/IndirectEvalExecutable.cpp:
        (JSC::IndirectEvalExecutable::createImpl):
        * runtime/InternalFunction.cpp:
        (JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined):
        * runtime/IntlCollator.cpp:
        (JSC::IntlCollator::create):
        * runtime/IntlCollatorConstructor.cpp:
        (JSC::IntlCollatorConstructor::create):
        * runtime/IntlCollatorPrototype.cpp:
        (JSC::IntlCollatorPrototype::create):
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::create):
        * runtime/IntlDateTimeFormatConstructor.cpp:
        (JSC::IntlDateTimeFormatConstructor::create):
        * runtime/IntlDateTimeFormatPrototype.cpp:
        (JSC::IntlDateTimeFormatPrototype::create):
        * runtime/IntlDisplayNames.cpp:
        (JSC::IntlDisplayNames::create):
        * runtime/IntlDisplayNamesConstructor.cpp:
        (JSC::IntlDisplayNamesConstructor::create):
        * runtime/IntlDisplayNamesPrototype.cpp:
        (JSC::IntlDisplayNamesPrototype::create):
        * runtime/IntlListFormat.cpp:
        (JSC::IntlListFormat::create):
        * runtime/IntlListFormatConstructor.cpp:
        (JSC::IntlListFormatConstructor::create):
        * runtime/IntlListFormatPrototype.cpp:
        (JSC::IntlListFormatPrototype::create):
        * runtime/IntlLocale.cpp:
        (JSC::IntlLocale::create):
        * runtime/IntlLocaleConstructor.cpp:
        (JSC::IntlLocaleConstructor::create):
        * runtime/IntlLocalePrototype.cpp:
        (JSC::IntlLocalePrototype::create):
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::create):
        * runtime/IntlNumberFormatConstructor.cpp:
        (JSC::IntlNumberFormatConstructor::create):
        * runtime/IntlNumberFormatPrototype.cpp:
        (JSC::IntlNumberFormatPrototype::create):
        * runtime/IntlObject.cpp:
        (JSC::IntlObject::create):
        * runtime/IntlPluralRules.cpp:
        (JSC::IntlPluralRules::create):
        * runtime/IntlPluralRulesConstructor.cpp:
        (JSC::IntlPluralRulesConstructor::create):
        * runtime/IntlPluralRulesPrototype.cpp:
        (JSC::IntlPluralRulesPrototype::create):
        * runtime/IntlRelativeTimeFormat.cpp:
        (JSC::IntlRelativeTimeFormat::create):
        * runtime/IntlRelativeTimeFormatConstructor.cpp:
        (JSC::IntlRelativeTimeFormatConstructor::create):
        * runtime/IntlRelativeTimeFormatPrototype.cpp:
        (JSC::IntlRelativeTimeFormatPrototype::create):
        * runtime/IntlSegmentIterator.cpp:
        (JSC::IntlSegmentIterator::create):
        * runtime/IntlSegmentIteratorPrototype.cpp:
        (JSC::IntlSegmentIteratorPrototype::create):
        * runtime/IntlSegmenter.cpp:
        (JSC::IntlSegmenter::create):
        * runtime/IntlSegmenterConstructor.cpp:
        (JSC::IntlSegmenterConstructor::create):
        * runtime/IntlSegmenterPrototype.cpp:
        (JSC::IntlSegmenterPrototype::create):
        * runtime/IntlSegments.cpp:
        (JSC::IntlSegments::create):
        * runtime/IntlSegmentsPrototype.cpp:
        (JSC::IntlSegmentsPrototype::create):
        * runtime/IteratorPrototype.h:
        * runtime/JSArray.h:
        (JSC::JSArray::createWithButterfly):
        * runtime/JSArrayBuffer.cpp:
        (JSC::JSArrayBuffer::create):
        * runtime/JSArrayBufferConstructor.h:
        * runtime/JSArrayBufferPrototype.cpp:
        (JSC::JSArrayBufferPrototype::create):
        * runtime/JSArrayIterator.cpp:
        (JSC::JSArrayIterator::create):
        (JSC::JSArrayIterator::createWithInitialValues):
        * runtime/JSAsyncFunction.cpp:
        (JSC::JSAsyncFunction::createImpl):
        * runtime/JSAsyncGenerator.cpp:
        (JSC::JSAsyncGenerator::create):
        * runtime/JSAsyncGeneratorFunction.cpp:
        (JSC::JSAsyncGeneratorFunction::createImpl):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::createWithLength):
        * runtime/JSBoundFunction.cpp:
        (JSC::JSBoundFunction::create):
        * runtime/JSCallee.h:
        (JSC::JSCallee::create):
        * runtime/JSCell.h:
        * runtime/JSCellInlines.h:
        (JSC::allocateCell):
        (JSC::tryAllocateCell):
        * runtime/JSCustomGetterFunction.cpp:
        (JSC::JSCustomGetterFunction::create):
        * runtime/JSCustomSetterFunction.cpp:
        (JSC::JSCustomSetterFunction::create):
        * runtime/JSDataView.cpp:
        (JSC::JSDataView::create):
        * runtime/JSDataViewPrototype.cpp:
        (JSC::JSDataViewPrototype::create):
        * runtime/JSFinalizationRegistry.cpp:
        (JSC::JSFinalizationRegistry::create):
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::create):
        * runtime/JSFunction.h:
        (JSC::JSFunction::createImpl):
        * runtime/JSGenerator.cpp:
        (JSC::JSGenerator::create):
        * runtime/JSGeneratorFunction.cpp:
        (JSC::JSGeneratorFunction::createImpl):
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::create):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::create):
        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
        (JSC::JSGenericTypedArrayViewPrototype<ViewClass>::create):
        * runtime/JSGlobalLexicalEnvironment.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::create):
        (JSC::JSGlobalObject::createWithCustomMethodTable):
        * runtime/JSImmutableButterfly.h:
        (JSC::JSImmutableButterfly::tryCreate):
        * runtime/JSInternalPromise.cpp:
        (JSC::JSInternalPromise::create):
        * runtime/JSInternalPromiseConstructor.cpp:
        (JSC::JSInternalPromiseConstructor::create):
        * runtime/JSInternalPromisePrototype.cpp:
        (JSC::JSInternalPromisePrototype::create):
        * runtime/JSLexicalEnvironment.h:
        (JSC::JSLexicalEnvironment::create):
        * runtime/JSMap.cpp:
        (JSC::JSMap::clone):
        * runtime/JSMap.h:
        * runtime/JSMapIterator.cpp:
        (JSC::JSMapIterator::createWithInitialValues):
        * runtime/JSMapIterator.h:
        * runtime/JSModuleEnvironment.cpp:
        (JSC::JSModuleEnvironment::create):
        * runtime/JSModuleLoader.h:
        * runtime/JSModuleNamespaceObject.h:
        * runtime/JSModuleRecord.cpp:
        (JSC::JSModuleRecord::create):
        * runtime/JSNativeStdFunction.cpp:
        (JSC::JSNativeStdFunction::create):
        * runtime/JSONObject.h:
        * runtime/JSObject.h:
        (JSC::JSFinalObject::createWithButterfly):
        * runtime/JSPromise.cpp:
        (JSC::JSPromise::create):
        * runtime/JSPromiseConstructor.cpp:
        (JSC::JSPromiseConstructor::create):
        * runtime/JSPromisePrototype.cpp:
        (JSC::JSPromisePrototype::create):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::create):
        * runtime/JSProxy.h:
        (JSC::JSProxy::create):
        * runtime/JSScriptFetchParameters.h:
        * runtime/JSScriptFetcher.h:
        * runtime/JSSet.cpp:
        (JSC::JSSet::clone):
        * runtime/JSSet.h:
        * runtime/JSSetIterator.cpp:
        (JSC::JSSetIterator::createWithInitialValues):
        * runtime/JSSetIterator.h:
        * runtime/JSSourceCode.h:
        * runtime/JSString.cpp:
        (JSC::JSString::createEmptyString):
        (JSC::StringObject::create):
        * runtime/JSString.h:
        (JSC::JSString::create):
        (JSC::JSString::createHasOtherOwner):
        * runtime/JSStringIterator.h:
        * runtime/JSTemplateObjectDescriptor.cpp:
        (JSC::JSTemplateObjectDescriptor::create):
        * runtime/JSTypedArrayViewConstructor.h:
        * runtime/JSTypedArrayViewPrototype.cpp:
        (JSC::JSTypedArrayViewPrototype::create):
        * runtime/JSWeakMap.h:
        * runtime/JSWeakObjectRef.h:
        * runtime/JSWeakSet.h:
        * runtime/JSWithScope.cpp:
        (JSC::JSWithScope::create):
        * runtime/MapConstructor.h:
        * runtime/MapIteratorPrototype.h:
        * runtime/MapPrototype.h:
        * runtime/MathObject.h:
        * runtime/ModuleProgramExecutable.cpp:
        (JSC::ModuleProgramExecutable::create):
        * runtime/NativeErrorConstructor.h:
        * runtime/NativeErrorPrototype.h:
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::create):
        * runtime/NullGetterFunction.h:
        * runtime/NullSetterFunction.h:
        * runtime/NumberConstructor.h:
        * runtime/NumberObject.h:
        (JSC::NumberObject::create):
        * runtime/NumberPrototype.h:
        * runtime/ObjectConstructor.h:
        * runtime/ObjectPrototype.cpp:
        (JSC::ObjectPrototype::create):
        * runtime/ProgramExecutable.h:
        * runtime/PropertyTable.cpp:
        (JSC::PropertyTable::create):
        (JSC::PropertyTable::clone):
        * runtime/ProxyConstructor.cpp:
        (JSC::ProxyConstructor::create):
        * runtime/ProxyObject.h:
        * runtime/ProxyRevoke.cpp:
        (JSC::ProxyRevoke::create):
        * runtime/ReflectObject.h:
        * runtime/RegExp.cpp:
        (JSC::RegExp::createWithoutCaching):
        * runtime/RegExpConstructor.h:
        * runtime/RegExpObject.h:
        * runtime/RegExpPrototype.h:
        * runtime/RegExpStringIteratorPrototype.h:
        * runtime/ScopedArguments.cpp:
        (JSC::ScopedArguments::createUninitialized):
        * runtime/ScopedArgumentsTable.cpp:
        (JSC::ScopedArgumentsTable::create):
        (JSC::ScopedArgumentsTable::tryCreate):
        * runtime/SetConstructor.h:
        * runtime/SetIteratorPrototype.h:
        * runtime/SetPrototype.h:
        * runtime/ShadowRealmConstructor.h:
        * runtime/ShadowRealmObject.cpp:
        (JSC::ShadowRealmObject::create):
        * runtime/ShadowRealmPrototype.h:
        * runtime/SparseArrayValueMap.cpp:
        (JSC::SparseArrayValueMap::create):
        * runtime/StrictEvalActivation.h:
        * runtime/StringConstructor.h:
        * runtime/StringIteratorPrototype.h:
        * runtime/StringObject.h:
        (JSC::StringObject::create):
        * runtime/StringPrototype.cpp:
        (JSC::StringPrototype::create):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        * runtime/StructureInlines.h:
        (JSC::Structure::create):
        (JSC::Structure::createStructure):
        * runtime/StructureRareData.cpp:
        (JSC::StructureRareData::create):
        * runtime/Symbol.cpp:
        (JSC::SymbolObject::create):
        (JSC::Symbol::create):
        (JSC::Symbol::createWithDescription):
        * runtime/SymbolConstructor.h:
        * runtime/SymbolObject.h:
        * runtime/SymbolPrototype.h:
        * runtime/SymbolTable.h:
        * runtime/TemporalCalendar.cpp:
        (JSC::TemporalCalendar::create):
        * runtime/TemporalCalendarConstructor.cpp:
        (JSC::TemporalCalendarConstructor::create):
        * runtime/TemporalCalendarPrototype.cpp:
        (JSC::TemporalCalendarPrototype::create):
        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::create):
        * runtime/TemporalDurationConstructor.cpp:
        (JSC::TemporalDurationConstructor::create):
        * runtime/TemporalDurationPrototype.cpp:
        (JSC::TemporalDurationPrototype::create):
        * runtime/TemporalInstant.cpp:
        (JSC::TemporalInstant::create):
        * runtime/TemporalInstantConstructor.cpp:
        (JSC::TemporalInstantConstructor::create):
        * runtime/TemporalInstantPrototype.cpp:
        (JSC::TemporalInstantPrototype::create):
        * runtime/TemporalNow.cpp:
        (JSC::TemporalNow::create):
        * runtime/TemporalObject.cpp:
        (JSC::TemporalObject::create):
        * runtime/TemporalPlainTime.cpp:
        (JSC::TemporalPlainTime::create):
        * runtime/TemporalPlainTimeConstructor.cpp:
        (JSC::TemporalPlainTimeConstructor::create):
        * runtime/TemporalPlainTimePrototype.cpp:
        (JSC::TemporalPlainTimePrototype::create):
        * runtime/TemporalTimeZone.cpp:
        (JSC::TemporalTimeZone::createFromID):
        (JSC::TemporalTimeZone::createFromUTCOffset):
        * runtime/TemporalTimeZoneConstructor.cpp:
        (JSC::TemporalTimeZoneConstructor::create):
        * runtime/TemporalTimeZonePrototype.cpp:
        (JSC::TemporalTimeZonePrototype::create):
        * runtime/WeakMapConstructor.h:
        * runtime/WeakMapPrototype.h:
        * runtime/WeakObjectRefConstructor.h:
        * runtime/WeakObjectRefPrototype.h:
        * runtime/WeakSetConstructor.h:
        * runtime/WeakSetPrototype.h:
        * testRegExp.cpp:
        * tools/JSDollarVM.cpp:
        * tools/JSDollarVM.h:
        * wasm/js/JSToWasmICCallee.cpp:
        (JSC::JSToWasmICCallee::create):
        * wasm/js/JSWebAssembly.cpp:
        (JSC::JSWebAssembly::create):
        * wasm/js/JSWebAssemblyCodeBlock.cpp:
        (JSC::JSWebAssemblyCodeBlock::create):
        * wasm/js/JSWebAssemblyException.h:
        * wasm/js/JSWebAssemblyGlobal.cpp:
        (JSC::JSWebAssemblyGlobal::tryCreate):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::tryCreate):
        * wasm/js/JSWebAssemblyMemory.cpp:
        (JSC::JSWebAssemblyMemory::tryCreate):
        * wasm/js/JSWebAssemblyModule.cpp:
        (JSC::JSWebAssemblyModule::createStub):
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::tryCreate):
        * wasm/js/JSWebAssemblyTag.cpp:
        (JSC::JSWebAssemblyTag::create):
        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
        (JSC::WebAssemblyCompileErrorConstructor::create):
        * wasm/js/WebAssemblyCompileErrorPrototype.cpp:
        (JSC::WebAssemblyCompileErrorPrototype::create):
        * wasm/js/WebAssemblyExceptionConstructor.cpp:
        (JSC::WebAssemblyExceptionConstructor::create):
        * wasm/js/WebAssemblyExceptionPrototype.cpp:
        (JSC::WebAssemblyExceptionPrototype::create):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::create):
        * wasm/js/WebAssemblyGlobalConstructor.cpp:
        (JSC::WebAssemblyGlobalConstructor::create):
        * wasm/js/WebAssemblyGlobalPrototype.cpp:
        (JSC::WebAssemblyGlobalPrototype::create):
        * wasm/js/WebAssemblyInstanceConstructor.cpp:
        (JSC::WebAssemblyInstanceConstructor::create):
        * wasm/js/WebAssemblyInstancePrototype.cpp:
        (JSC::WebAssemblyInstancePrototype::create):
        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
        (JSC::WebAssemblyLinkErrorConstructor::create):
        * wasm/js/WebAssemblyLinkErrorPrototype.cpp:
        (JSC::WebAssemblyLinkErrorPrototype::create):
        * wasm/js/WebAssemblyMemoryConstructor.cpp:
        (JSC::WebAssemblyMemoryConstructor::create):
        * wasm/js/WebAssemblyMemoryPrototype.cpp:
        (JSC::WebAssemblyMemoryPrototype::create):
        * wasm/js/WebAssemblyModuleConstructor.cpp:
        (JSC::WebAssemblyModuleConstructor::create):
        * wasm/js/WebAssemblyModulePrototype.cpp:
        (JSC::WebAssemblyModulePrototype::create):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::create):
        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
        (JSC::WebAssemblyRuntimeErrorConstructor::create):
        * wasm/js/WebAssemblyRuntimeErrorPrototype.cpp:
        (JSC::WebAssemblyRuntimeErrorPrototype::create):
        * wasm/js/WebAssemblyTableConstructor.cpp:
        (JSC::WebAssemblyTableConstructor::create):
        * wasm/js/WebAssemblyTablePrototype.cpp:
        (JSC::WebAssemblyTablePrototype::create):
        * wasm/js/WebAssemblyTagConstructor.cpp:
        (JSC::WebAssemblyTagConstructor::create):
        * wasm/js/WebAssemblyTagPrototype.cpp:
        (JSC::WebAssemblyTagPrototype::create):
        * wasm/js/WebAssemblyWrapperFunction.cpp:
        (JSC::WebAssemblyWrapperFunction::create):

2021-11-12  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early November 2021 edition, bis x2

        Unreviewed non-unified build fixes.

        * jit/JITWorklist.cpp: Add missing DeferGCInlines.h header.

2021-11-11  Mark Lam  <mark.lam@apple.com>

        Add VM::writeBarrier() and VM::mutatorFence().
        https://bugs.webkit.org/show_bug.cgi?id=233019
        rdar://85318693

        Reviewed by Saam Barati.

        These are ALWAYS_INLINE functions that will forward the call to the Heap versions.
        Adding these allows us to make all the client code more terse, and also makes it
        easier to redirect the underlying writeBarrier implementation later for global GC
        work.  Additionally, this will help make the global GC patch less of a mega patch
        and easier to review later.

        Also remove unused Heap::writeBarrierWithoutFence().

        This is a refactoring patch.  There is no behavior change.

        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::link):
        * bytecode/ObjectPropertyCondition.h:
        (JSC::ObjectPropertyCondition::presence):
        (JSC::ObjectPropertyCondition::absence):
        (JSC::ObjectPropertyCondition::absenceOfSetEffect):
        (JSC::ObjectPropertyCondition::equivalence):
        (JSC::ObjectPropertyCondition::hasStaticProperty):
        (JSC::ObjectPropertyCondition::hasPrototype):
        * bytecode/PropertyCondition.h:
        (JSC::PropertyCondition::absence):
        (JSC::PropertyCondition::absenceOfSetEffect):
        (JSC::PropertyCondition::equivalence):
        (JSC::PropertyCondition::hasPrototype):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::considerCaching):
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::UnlinkedFunctionExecutable::decodeCachedCodeBlocks):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::finalize):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::finalize):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalize):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::writeBarrierWithoutFence): Deleted.
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::setupGetByIdPrototypeCache):
        (JSC::LLInt::performLLIntGetByID):
        (JSC::LLInt::llint_write_barrier_slow):
        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/AuxiliaryBarrierInlines.h:
        (JSC::AuxiliaryBarrier<T>::AuxiliaryBarrier):
        (JSC::AuxiliaryBarrier<T>::set):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::finishCreation):
        * runtime/InferredValue.h:
        (JSC::InferredValue<JSCellType>::InferredValueWatchpointSet::notifyWriteSlow):
        (JSC::InferredValue<JSCellType>::notifyWriteSlow):
        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::shiftCountWithAnyIndexingType):
        (JSC::JSArray::unshiftCountWithAnyIndexingType):
        * runtime/JSArrayInlines.h:
        (JSC::JSArray::pushInline):
        * runtime/JSCellInlines.h:
        (JSC::JSCell::finishCreation):
        (JSC::JSCell::setStructure):
        * runtime/JSFinalizationRegistry.cpp:
        (JSC::JSFinalizationRegistry::registerTarget):
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::allocateRareData):
        (JSC::JSFunction::allocateAndInitializeRareData):
        * runtime/JSObject.cpp:
        (JSC::JSObject::putByIndex):
        * runtime/JSObject.h:
        (JSC::JSObject::trySetIndexQuickly):
        (JSC::JSObject::setIndexQuickly):
        * runtime/JSWeakObjectRef.h:
        * runtime/LazyPropertyInlines.h:
        (JSC::ElementType>::setMayBeNull):
        * runtime/ObjectInitializationScope.cpp:
        (JSC::ObjectInitializationScope::~ObjectInitializationScope):
        * runtime/ObjectInitializationScope.h:
        (JSC::ObjectInitializationScope::~ObjectInitializationScope):
        * runtime/RegExpCachedResult.cpp:
        (JSC::RegExpCachedResult::lastResult):
        * runtime/RegExpCachedResult.h:
        (JSC::RegExpCachedResult::record):
        * runtime/RegExpObject.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::installCode):
        * runtime/Structure.cpp:
        (JSC::Structure::flattenDictionaryStructure):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::finishCreation):
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::setCachedPropertyNameEnumerator):
        * runtime/VM.h:
        (JSC::VM::writeBarrier):
        (JSC::VM::writeBarrierSlowPath):
        (JSC::VM::mutatorFence):
        * runtime/WriteBarrierInlines.h:
        (JSC::Traits>::setEarlyValue):
        (JSC::RawValueTraits<Unknown>>::set):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/js/JSWebAssemblyInstance.h:

2021-11-11  Mark Lam  <mark.lam@apple.com>

        Disable JIT runs of the ExecutionTimeLimitTest when !ENABLE(JIT).
        https://bugs.webkit.org/show_bug.cgi?id=233003

        Reviewed by Yusuke Suzuki.

        * API/tests/ExecutionTimeLimitTest.cpp:
        (testExecutionTimeLimit):

2021-11-11  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early November 2021 edition, bis
        https://bugs.webkit.org/show_bug.cgi?id=232998

        Unreviewed non-unified build fixes.

        * interpreter/Interpreter.cpp: Add missing JSWebAssemblyInstance.h header.
        * jit/JITInlineCacheGenerator.cpp: Remove unneeded JIT.h, as it is already included
        transitively by JITInlines.h instead.
        * llint/LLIntExceptions.cpp: Replace inclusion of WasmContext.h with WasmContextInlines.h
        * wasm/WasmStreamingCompiler.cpp: Add missing JSBigInt.h header.
        * wasm/js/JSWebAssemblyException.cpp: Add missing AuxiliaryBarrierInlines.h, JSBigInt.h,
        JSCJSValueInlines.h and JSCellInlines.h
        * wasm/js/JSWebAssemblyException.h: Add missing JSObject.h header.
        * wasm/js/JSWebAssemblyTag.cpp: Add missing JSCellInlines.h, JSObjectInlines.h, and
        StructureInlines.h headers.
        * wasm/js/JSWebAssemblyTag.h: Add missing JSObject.h header.
        * wasm/js/WebAssemblyExceptionConstructor.cpp: Add missing JSWebAssemblyTag.h header.
        * wasm/js/WebAssemblyExceptionPrototype.cpp: Add missing headers JSWebAssemblyException.h
        and JSWebAssemblyTag.h
        * wasm/js/WebAssemblyTagPrototype.cpp: Add missing headers JSCellInlines.h,
        JSObjectInlines.h, JSWebAssemblyTag.h, and StructureInlines.h

2021-11-11  Mark Lam  <mark.lam@apple.com>

        Rename Heap::isCurrentThreadBusy() to Heap::currentThreadIsDoingGCWork().
        https://bugs.webkit.org/show_bug.cgi?id=233005
        rdar://85307204

        Reviewed by Saam Barati.

        This rename clarifies what the "busy" part is about.  Also remove some unused code:
        Heap::isValidAllocation(), isValidThreadState(), and isValidSharedInstanceThreadState().

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::jettison):
        * heap/Heap.cpp:
        (JSC::Heap::currentThreadIsDoingGCWork):
        (JSC::Heap::isValidAllocation): Deleted.
        (JSC::Heap::isCurrentThreadBusy): Deleted.
        * heap/Heap.h:
        * jsc.cpp:
        (jscmain):
        * runtime/VM.h:
        (JSC::VM::isCollectorBusyOnCurrentThread):

2021-11-11  Michael Saboff  <msaboff@apple.com>

        Inline RegExp.test JIT code in DFG and FTL
        https://bugs.webkit.org/show_bug.cgi?id=230469

        Reviewed by Saam Barati.

        Restructured YarrJIT from inheriting from MacroAssembler to having a MacroAssembler
        member.  Added a new path to Yarr JIT code to compile inline code by changing how the
        code is entered and exited.  Added statistic to the normal compilation path to record
        the size of the matching code generated, the amount of stack space needed, and if
        the code can be inlined.  This patch only inlines 8bit code, as this seems to cover
        the most common performance sensitive cases.  Adding 16 bit, non-Unicode inlining
        would be straightforward.  The code is structured to take the inlined path for the
        case of non-rope string arguments.  For other cases, we fall back to calling out
        to C++ paths.

        Here are the perf results running the newly added regexp-test-inlined micro
        benchmark (time in msec):
                        Baseline       With this patch     Result
            ARM64   137.3849+-3.0740   64.9282+-0.7348  2.12x faster
            X86-64  220.2616+-19.2814 105.2034+-6.8722  2.09x faster

        As part of this change, found that the strength reduction didn't work properly for the
        existing cases for RegExpExec, RegExpTest and related since we added that checks for
        overriding the RegExp object.  Clobberize for tryGetById was clobber top, but added
        an exception for RegExp.lastIndex.  This fix allowed many of the strength reductions
        cases to start working again, namely the costant folding cases.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGCommonData.h:
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::convertToRegExpTestInline):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasHeapPrediction):
        (JSC::DFG::Node::hasCellOperand):
        (JSC::DFG::Node::hasCellOperand2):
        (JSC::DFG::Node::cellOperand2):
        * dfg/DFGNodeType.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * runtime/OptionsList.h:
        * runtime/RegExp.h:
        * runtime/StackAlignment.h:
        (JSC::argumentCountForStackSize):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::jitCompile):
        (JSC::Yarr::jitCompileInlinedTest):
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrBoyerMoyerData::saveMaps):
        (JSC::Yarr::YarrBoyerMoyerData::clearMaps):
        (JSC::Yarr::YarrBoyerMoyerData::tryReuseBoyerMooreBitmap const):
        (JSC::Yarr::YarrCodeBlock::InlineStats::InlineStats):
        (JSC::Yarr::YarrCodeBlock::InlineStats::set):
        (JSC::Yarr::YarrCodeBlock::InlineStats::clear):
        (JSC::Yarr::YarrCodeBlock::InlineStats::codeSize const):
        (JSC::Yarr::YarrCodeBlock::InlineStats::stackSize const):
        (JSC::Yarr::YarrCodeBlock::InlineStats::canInline const):
        (JSC::Yarr::YarrCodeBlock::InlineStats::needsTemp2 const):
        (JSC::Yarr::YarrCodeBlock::set8BitCode):
        (JSC::Yarr::YarrCodeBlock::set16BitCode):
        (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::set8BitInlineStats):
        (JSC::Yarr::YarrCodeBlock::set16BitInlineStats):
        (JSC::Yarr::YarrCodeBlock::get8BitInlineStats):
        (JSC::Yarr::YarrCodeBlock::get16BitInlineStats):
        (JSC::Yarr::YarrCodeBlock::clear):
        (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreBitmap const): Deleted.
        * yarr/YarrJITRegisters.h: Added.
        (JSC::Yarr::YarrJITRegisters::YarrJITRegisters):

2021-11-10  Mark Lam  <mark.lam@apple.com>

        Move m_doesGC from Heap to VM.
        https://bugs.webkit.org/show_bug.cgi?id=232975
        rdar://85277492

        Reviewed by Filip Pizlo.

        m_doesGC is only needed for ENABLE(DFG_DOES_GC_VALIDATION), and is used for checking
        if the VM thread's execution is in a state that can allow GC to run.  Hence, it is
        more related to VM thread execution as opposed to the state of the Heap.  This patch
        moves m_doesGC from Heap to VM to get it out of the way of upcoming Global GC work.

        Also change DeferGC, DeferGCForAWhile, and GCDeferralContext to take a VM& instead
        of a Heap&.  DeferGC and GCDeferralContext need to access VM& in order to call
        VM::verifyCanGC().  DeferGCForAWhile does not need VM&, but we're changing it to be
        consistent with DeferGC.  There should be no perf impact for this change.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::jettison):
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::UnlinkedFunctionExecutable::decodeCachedCodeBlocks):
        * bytecode/Watchpoint.cpp:
        (JSC::WatchpointSet::fireAllWatchpoints):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::generate):
        * dfg/DFGDoesGCCheck.cpp:
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileLoopHint):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::tryAllocateSlow):
        (JSC::CompleteSubspace::reallocatePreciseAllocationNonVirtual):
        * heap/CompleteSubspaceInlines.h:
        (JSC::CompleteSubspace::allocateNonVirtual):
        * heap/DeferGC.h:
        (JSC::DeferGC::DeferGC): Deleted.
        (JSC::DeferGC::~DeferGC): Deleted.
        (JSC::DeferGCForAWhile::DeferGCForAWhile): Deleted.
        (JSC::DeferGCForAWhile::~DeferGCForAWhile): Deleted.
        * heap/DeferGCInlines.h: Added.
        (JSC::DeferGC::DeferGC):
        (JSC::DeferGC::~DeferGC):
        (JSC::DeferGCForAWhile::DeferGCForAWhile):
        (JSC::DeferGCForAWhile::~DeferGCForAWhile):
        * heap/GCDeferralContext.h:
        * heap/GCDeferralContextInlines.h:
        (JSC::GCDeferralContext::GCDeferralContext):
        (JSC::GCDeferralContext::~GCDeferralContext):
        * heap/Heap.cpp:
        (JSC::Heap::collectNow):
        (JSC::Heap::collectAsync):
        (JSC::Heap::collectSync):
        (JSC::Heap::stopIfNecessarySlow):
        (JSC::Heap::collectIfNecessaryOrDefer):
        * heap/Heap.h:
        (JSC::Heap::addressOfDoesGC): Deleted.
        (JSC::Heap::setDoesGCExpectation): Deleted.
        (JSC::Heap::verifyCanGC): Deleted.
        * heap/HeapInlines.h:
        (JSC::Heap::acquireAccess):
        (JSC::Heap::stopIfNecessary):
        * heap/HeapSnapshotBuilder.cpp:
        (JSC::HeapSnapshotBuilder::json):
        * heap/IncrementalSweeper.cpp:
        (JSC::IncrementalSweeper::sweepNextBlock):
        * heap/LocalAllocatorInlines.h:
        (JSC::LocalAllocator::allocate):
        * heap/PreciseAllocation.cpp:
        (JSC::PreciseAllocation::tryCreate):
        (JSC::PreciseAllocation::createForLowerTier):
        * inspector/JSInjectedScriptHost.cpp:
        (Inspector::JSInjectedScriptHost::queryHolders):
        * inspector/agents/InspectorHeapAgent.cpp:
        (Inspector::InspectorHeapAgent::getPreview):
        (Inspector::InspectorHeapAgent::getRemoteObject):
        * inspector/agents/InspectorScriptProfilerAgent.cpp:
        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
        * interpreter/ShadowChickenInlines.h:
        (JSC::ShadowChicken::iterate):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::completeAllReadyPlansForVM):
        (JSC::JITWorklist::waitUntilAllPlansForVMAreReady):
        (JSC::JITWorklist::completeAllPlansForVM):
        (JSC::JITWorklist::removeAllReadyPlansForVM):
        * jit/Repatch.cpp:
        (JSC::fireWatchpointsAndClearStubIfNeeded):
        (JSC::tryCacheGetBy):
        (JSC::tryCacheArrayGetByVal):
        (JSC::tryCachePutBy):
        (JSC::tryCacheArrayPutByVal):
        (JSC::tryCacheDeleteBy):
        (JSC::tryCacheInBy):
        (JSC::tryCacheHasPrivateBrand):
        (JSC::tryCacheCheckPrivateBrand):
        (JSC::tryCacheSetPrivateBrand):
        (JSC::tryCacheInstanceOf):
        (JSC::linkPolymorphicCall):
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * runtime/CachedTypes.cpp:
        (JSC::decodeCodeBlockImpl):
        * runtime/ConcurrentJSLock.h:
        (JSC::GCSafeConcurrentJSLocker::GCSafeConcurrentJSLocker):
        * runtime/ExceptionFuzz.cpp:
        (JSC::doExceptionFuzzing):
        * runtime/JSArray.cpp:
        (JSC::JSArray::unshiftCountWithArrayStorage):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::slowDownAndWasteMemory):
        * runtime/JSCellInlines.h:
        * runtime/JSGenericTypedArrayViewInlines.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::haveABadTime):
        * runtime/JSObject.cpp:
        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
        (JSC::JSObject::createInitialUndecided):
        (JSC::JSObject::createInitialInt32):
        (JSC::JSObject::createInitialDouble):
        (JSC::JSObject::createInitialContiguous):
        (JSC::JSObject::createArrayStorage):
        (JSC::JSObject::convertUndecidedToArrayStorage):
        (JSC::JSObject::convertInt32ToArrayStorage):
        (JSC::JSObject::convertDoubleToArrayStorage):
        (JSC::JSObject::convertContiguousToArrayStorage):
        (JSC::JSObject::increaseVectorLength):
        (JSC::JSObject::ensureLengthSlow):
        (JSC::JSObject::reallocateAndShrinkButterfly):
        (JSC::createCustomGetterFunction):
        (JSC::createCustomSetterFunction):
        * runtime/JSString.h:
        (JSC::jsSingleCharacterString):
        (JSC::JSString::toAtomString const):
        (JSC::JSString::toExistingAtomString const):
        (JSC::JSString::value const):
        (JSC::JSString::tryGetValue const):
        (JSC::JSRopeString::unsafeView const):
        (JSC::JSRopeString::viewWithUnderlyingString const):
        (JSC::JSString::unsafeView const):
        * runtime/JSSymbolTableObject.h:
        (JSC::symbolTablePut):
        * runtime/RegExpKey.h:
        * runtime/RegExpMatchesArray.cpp:
        (JSC::createEmptyRegExpMatchesArray):
        * runtime/RegExpMatchesArray.h:
        (JSC::createRegExpMatchesArray):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::stackTracesAsJSON):
        (JSC::SamplingProfiler::reportTopFunctions):
        (JSC::SamplingProfiler::reportTopBytecodes):
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::prepareForExecutionImpl):
        * runtime/Structure.cpp:
        (JSC::Structure::materializePropertyTable):
        (JSC::Structure::addNewPropertyTransition):
        (JSC::Structure::removeNewPropertyTransition):
        (JSC::Structure::changePrototypeTransition):
        (JSC::Structure::attributeChangeTransition):
        (JSC::Structure::toDictionaryTransition):
        (JSC::Structure::nonPropertyTransitionSlow):
        (JSC::Structure::flattenDictionaryStructure):
        * runtime/StructureInlines.h:
        (JSC::Structure::add):
        (JSC::Structure::remove):
        (JSC::Structure::attributeChange):
        * runtime/VM.h:
        (JSC::VM::addressOfDoesGC):
        (JSC::VM::setDoesGCExpectation):
        (JSC::VM::verifyCanGC):

2021-11-10  Saam Barati  <sbarati@apple.com>

        in_by_val should not constant fold to in_by_id when the property is a property index
        https://bugs.webkit.org/show_bug.cgi?id=232753

        Reviewed by Yusuke Suzuki.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGValidate.cpp:

2021-11-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r285246.
        https://bugs.webkit.org/show_bug.cgi?id=232907

        Broke FixedVector

        Reverted changeset:

        "[JSC] Clean up StructureStubInfo initialization"
        https://bugs.webkit.org/show_bug.cgi?id=232652
        https://commits.webkit.org/r285246

2021-11-09  Robin Morisset  <rmorisset@apple.com>

        Using WASM function size as the cap for choosing a register allocator causes performance regressions.
        https://bugs.webkit.org/show_bug.cgi?id=217290
        <rdar://problem/69934870>

        Reviewed by Yusuke Suzuki.

        This patch just increases --maximumTmpsForGraphColoring from 25k to 60k.

        It was originally lowered to prevent jetsams in some wasm webpages such as mruby-wasm.aotoki.dev.
        These jetsams were caused by excessive memory consumption by the interference graphs used by AirAllocateRegistersByGraphColoring and AirAllocateStackByGraphColoring.
        I massively optimized these interference graphs in the following two patches (effect on mruby-wasm.aotoki.dev):
        - https://trac.webkit.org/changeset/277714/webkit (262MB + 262MB -> 20MB + 10MB in register allocator)
        - https://trac.webkit.org/changeset/278186/webkit (221MB + 399MB -> 6.5MB + 10.5MB in stack slot allocator)
        So it should now be safe to increase --maximumTmpsForGraphColoring.

        It is valuable to increase it, because some webpages such as https://dos.zone/en/play/https%3A%2F%2Fdoszone-uploads.s3.dualstack.eu-central-1.amazonaws.com%2Foriginal%2F2X%2Fb%2Fb4b5275904d86a4ab8a20917b2b7e34f0df47bf7.jsdos see massive performance wins/losses depending on whether we register allocate all of their wasm functions or not.
        For example that page has two functions with ~54k temporaries, and its integrated benchmark has a score increase from about 27 to about 70 on an M1 MBP 2020 when they are register allocated.
        External reports suggest that this the performance difference is even larger on older machines (5.5 to 48).

        * runtime/OptionsList.h:

2021-11-09  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Add assembly, disassembly infrastructure
        https://bugs.webkit.org/show_bug.cgi?id=232870

        Reviewed by Yusuke Suzuki.

        Provide the necessary facilities for assembling and disassembling
        RISC-V instructions. This is just a preliminary patch that introduces
        the necessary assembly and disassembly infrastructure while actual
        enhancements to RISCV64Assembler and MacroAssemblerRISCV64 classes are
        left for later.

        In RISCV64Assembler.h header, necessary helper functions, enumerations
        and structs are introduced that enable crafting instruction values in
        accordance with the base RISC-V specification. All the necessary
        immediate and instruction types are supported, and the relevant
        instruction definitions are introduced and become usable in future work.

        For debugging purposes, a custom RISC-V disassembler is also introduced
        and is enabled when appropriate. The implementation utilizes
        functionality introduced in RISCV64Assembler.h, and different formatters
        are introduced to handle special cases even among the established
        instruction types.

        * Sources.txt:
        * assembler/RISCV64Assembler.h:
        (JSC::RISCV64Instructions::registerValue):
        (JSC::RISCV64Instructions::InstructionValue::InstructionValue):
        (JSC::RISCV64Instructions::InstructionValue::field):
        (JSC::RISCV64Instructions::InstructionValue::opcode):
        (JSC::RISCV64Instructions::ImmediateBase::isValid):
        (JSC::RISCV64Instructions::ImmediateBase::v):
        (JSC::RISCV64Instructions::ImmediateBase::ImmediateBase):
        (JSC::RISCV64Instructions::ImmediateBase::field):
        (JSC::RISCV64Instructions::IImmediate::IImmediate):
        (JSC::RISCV64Instructions::IImmediate::value):
        (JSC::RISCV64Instructions::SImmediate::SImmediate):
        (JSC::RISCV64Instructions::SImmediate::value):
        (JSC::RISCV64Instructions::BImmediate::BImmediate):
        (JSC::RISCV64Instructions::BImmediate::value):
        (JSC::RISCV64Instructions::UImmediate::UImmediate):
        (JSC::RISCV64Instructions::UImmediate::value):
        (JSC::RISCV64Instructions::JImmediate::JImmediate):
        (JSC::RISCV64Instructions::JImmediate::value):
        (JSC::RISCV64Instructions::RegistersBase::Size):
        (JSC::RISCV64Instructions::RTypeBase::construct):
        (JSC::RISCV64Instructions::RTypeBase::matches):
        (JSC::RISCV64Instructions::RTypeBase::rd):
        (JSC::RISCV64Instructions::RTypeBase::rs1):
        (JSC::RISCV64Instructions::RTypeBase::rs2):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::construct):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::matches):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rd):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rs1):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rs2):
        (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rm):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::construct):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::matches):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rd):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rs1):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rs2):
        (JSC::RISCV64Instructions::RTypeBaseWithAqRl::aqrl):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::construct):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::matches):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rd):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs1):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs2):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs3):
        (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rm):
        (JSC::RISCV64Instructions::ITypeBase::construct):
        (JSC::RISCV64Instructions::ITypeBase::matches):
        (JSC::RISCV64Instructions::ITypeBase::rd):
        (JSC::RISCV64Instructions::ITypeBase::rs1):
        (JSC::RISCV64Instructions::STypeBase::construct):
        (JSC::RISCV64Instructions::STypeBase::matches):
        (JSC::RISCV64Instructions::STypeBase::rs1):
        (JSC::RISCV64Instructions::STypeBase::rs2):
        (JSC::RISCV64Instructions::BTypeBase::construct):
        (JSC::RISCV64Instructions::BTypeBase::matches):
        (JSC::RISCV64Instructions::BTypeBase::rs1):
        (JSC::RISCV64Instructions::BTypeBase::rs2):
        (JSC::RISCV64Instructions::UTypeBase::construct):
        (JSC::RISCV64Instructions::UTypeBase::matches):
        (JSC::RISCV64Instructions::UTypeBase::rd):
        (JSC::RISCV64Instructions::JTypeBase::construct):
        (JSC::RISCV64Instructions::JTypeBase::matches):
        (JSC::RISCV64Instructions::JTypeBase::rd):
        (JSC::RISCV64Instructions::SLLI::construct):
        (JSC::RISCV64Instructions::SRLI::construct):
        (JSC::RISCV64Instructions::SRAI::construct):
        (JSC::RISCV64Instructions::SLLIW::construct):
        (JSC::RISCV64Instructions::SRLIW::construct):
        (JSC::RISCV64Instructions::SRAIW::construct):
        (JSC::RISCV64Instructions::FCVTImpl::construct):
        (JSC::RISCV64Instructions::FMVImpl::construct):
        * disassembler/RISCV64Disassembler.cpp: Added.
        (JSC::RISCV64Disassembler::StringBufferBase::data):
        (JSC::RISCV64Disassembler::StringBufferBase::size):
        (JSC::RISCV64Disassembler::StringBufferBase::createString):
        (JSC::RISCV64Disassembler::registerName<RISCV64Instructions::RegistersBase::GType>):
        (JSC::RISCV64Disassembler::registerName<RISCV64Instructions::RegistersBase::FType>):
        (JSC::RISCV64Disassembler::roundingMode):
        (JSC::RISCV64Disassembler::memoryOperationFlags):
        (JSC::RISCV64Disassembler::aqrlFlags):
        (JSC::RISCV64Disassembler::InstructionList::contains):
        (JSC::RISCV64Disassembler::RTypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeR2Formatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeWithRoundingModeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeWithRoundingModeFSQRTFormatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeWithRoundingModeFCVTFormatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeWithAqRlDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::RTypeWithAqRlLRFormatting::disassemble):
        (JSC::RISCV64Disassembler::R4TypeWithRoundingModeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::ITypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::ITypeImmediateAsOffsetFormatting::disassemble):
        (JSC::RISCV64Disassembler::STypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::BTypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::UTypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::JTypeDefaultFormatting::disassemble):
        (JSC::RISCV64Disassembler::FenceInstructionFormatting::disassemble):
        (JSC::RISCV64Disassembler::FenceIInstructionFormatting::disassemble):
        (JSC::RISCV64Disassembler::EnvironmentInstructionFormatting::disassemble):
        (JSC::RISCV64Disassembler::DisassemblyFormatting::disassemble):
        (JSC::RISCV64Disassembler::Disassembler::disassemble):
        (JSC::RISCV64Disassembler::Disassembler<InsnType>::disassemble):
        (JSC::RISCV64Disassembler::disassembleOpcode):
        (JSC::tryToDisassemble):

2021-11-09  Mikhail R. Gadelha  <mikhail@igalia.com>

        Refactoring and PutByVal cleanup
        https://bugs.webkit.org/show_bug.cgi?id=232265

        Reviewed by Saam Barati.

        Follow-up from https://bugs.webkit.org/show_bug.cgi?id=232242,
        this patch includes several small code changes but the patch doesn't
        add/remove any feature:

        1. Removed several calls to operationPutByVal*Cell* that were
        only used by the 32 bit code paths due to the lack of registers.
        These calls were replaced by the calls used by the 64 bit paths,
        that expect EncodedJSValues
        2. Because of #1, this patch removes those methods, since no one
        uses them anymore.
        3. Created compilePutByVal to handle all cases (similar to compileGetByVal).
        4. Removed the Edge& childX from the PutByVal handling (and all methods
        that expected them) in favor of getting them from node when needed.
        5. Unified compileContiguousPutByVal so it could be used by both 32
        and 64 bit archs.
        6. Removed a lot of whitespace.

        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
        (JSC::DFG::SpeculativeJIT::compilePutByVal):
        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetPrivateName): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetPrivateNameById): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithString): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithSymbol): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByValWithThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutPrivateNameById): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags): Deleted.
        (JSC::DFG::SpeculativeJIT::compileParseInt): Deleted.
        (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance): Deleted.
        (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells): Deleted.
        (JSC::DFG::SpeculativeJIT::compileInstanceOf): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueBitNot): Deleted.
        (JSC::DFG::SpeculativeJIT::compileBitwiseNot): Deleted.
        (JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueBitwiseOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileBitwiseOp): Deleted.
        (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueLShiftOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueBitRShift): Deleted.
        (JSC::DFG::SpeculativeJIT::compileShiftOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueAdd): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueSub): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMathIC): Deleted.
        (JSC::DFG::SpeculativeJIT::compileInstanceOfCustom): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIsCellWithType): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithAdd): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithAbs): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithClz32): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithSub): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIncOrDec): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueNegate): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithNegate): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueMul): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithMul): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueDiv): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithDiv): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithFRound): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValueMod): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithMod): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithRounding): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithUnary): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithSqrt): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithMinMax): Deleted.
        (JSC::DFG::compileArithPowIntegerFastPath): Deleted.
        (JSC::DFG::SpeculativeJIT::compileValuePow): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArithPow): Deleted.
        (JSC::DFG::SpeculativeJIT::compare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCompareUnsigned): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStrictEq): Deleted.
        (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSymbolEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringIdentEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringIdentCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSameValue): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToBooleanString): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToBooleanStringOrOther): Deleted.
        (JSC::DFG::SpeculativeJIT::emitStringBranch): Deleted.
        (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch): Deleted.
        (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer): Deleted.
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetScope): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSkipScope): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetGlobalObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetGlobalThis): Deleted.
        (JSC::DFG::SpeculativeJIT::canBeRope): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewFunction): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetFunctionName): Deleted.
        (JSC::DFG::SpeculativeJIT::compileVarargsLength): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLoadVarargs): Deleted.
        (JSC::DFG::SpeculativeJIT::compileForwardVarargs): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateActivation): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetFromArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutToArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetArgument): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateArgumentsButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateRest): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSpread): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewArray): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetRestLength): Deleted.
        (JSC::DFG::SpeculativeJIT::emitPopulateSliceIndex): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArraySlice): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArrayIndexOf): Deleted.
        (JSC::DFG::SpeculativeJIT::compileArrayPush): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNotifyWrite): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIsObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileTypeOfIsObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIsCallable): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIsConstructor): Deleted.
        (JSC::DFG::SpeculativeJIT::compileTypeOf): Deleted.
        (JSC::DFG::SpeculativeJIT::emitStructureCheck): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckIsConstant): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckStructure): Deleted.
        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): Deleted.
        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetButterfly): Deleted.
        (JSC::DFG::allocateTemporaryRegistersForSnippet): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCallDOM): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCheckJSCast): Deleted.
        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf): Deleted.
        (JSC::DFG::getExecutable): Deleted.
        (JSC::DFG::SpeculativeJIT::compileFunctionToString): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNumberToStringWithValidRadixConstant): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNumberToStringWithRadix): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewStringObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewSymbol): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): Deleted.
        (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewRegexp): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateCellType): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateInt32): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNumber): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateDoubleRepReal): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateBoolean): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateCell): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateCellOrOther): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateFunction): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateFinalObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateRegExpObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateArray): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateProxyObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateDerivedArray): Deleted.
        (JSC::DFG::SpeculativeJIT::speculatePromiseObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateDateObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateMapObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateSetObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateWeakMapObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateWeakSetObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateDataViewObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateString): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateStringOrOther): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateStringIdent): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateStringObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNotStringVar): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNotSymbol): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateHeapBigInt): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNotCell): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNotCellNorBigInt): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNotDouble): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateOther): Deleted.
        (JSC::DFG::SpeculativeJIT::speculateMisc): Deleted.
        (JSC::DFG::SpeculativeJIT::speculate): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchImm): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchChar): Deleted.
        (JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitchString): Deleted.
        (JSC::DFG::SpeculativeJIT::emitSwitch): Deleted.
        (JSC::DFG::SpeculativeJIT::addBranch): Deleted.
        (JSC::DFG::SpeculativeJIT::linkBranches): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStoreBarrier): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutAccessorById): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById): Deleted.
        (JSC::DFG::SpeculativeJIT::compileResolveScope): Deleted.
        (JSC::DFG::SpeculativeJIT::compileResolveScopeForHoistingFuncDeclInEval): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetGlobalVariable): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutGlobalVariable): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetDynamicVar): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutDynamicVar): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetClosureVar): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutClosureVar): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetInternalField): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutInternalField): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRegExpTest): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStringReplace): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRegExpExecNonGlobalOrSticky): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRegExpMatchFast): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLazyJSConstant): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult): Deleted.
        (JSC::DFG::SpeculativeJIT::compileDefineDataProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetMapBucketHead): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetMapBucketNext): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLoadKeyFromMapBucket): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLoadValueFromMapBucket): Deleted.
        (JSC::DFG::SpeculativeJIT::compileExtractValueFromWeakMapGet): Deleted.
        (JSC::DFG::SpeculativeJIT::compileThrow): Deleted.
        (JSC::DFG::SpeculativeJIT::compileThrowStaticError): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractIndex): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractMode): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorInByVal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasOwnProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByIdFlush): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutById): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByIdDirect): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByIdWithThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetByOffset): Deleted.
        (JSC::DFG::SpeculativeJIT::compilePutByOffset): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMatchStructure): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetExecutable): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetGetter): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetSetter): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetCallee): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetCallee): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetArgumentCountIncludingThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compileStrCat): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewArrayBuffer): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewTypedArray): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames): Deleted.
        (JSC::DFG::SpeculativeJIT::compileObjectAssign): Deleted.
        (JSC::DFG::SpeculativeJIT::compileObjectCreate): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateThis): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreatePromise): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateInternalFieldObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateGenerator): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCreateAsyncGenerator): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObjectImpl): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewGenerator): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewAsyncGenerator): Deleted.
        (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToPrimitive): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToPropertyKey): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToNumeric): Deleted.
        (JSC::DFG::SpeculativeJIT::compileCallNumberConstructor): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLogShadowChickenPrologue): Deleted.
        (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): Deleted.
        (JSC::DFG::SpeculativeJIT::compileSetAdd): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMapSet): Deleted.
        (JSC::DFG::SpeculativeJIT::compileWeakMapGet): Deleted.
        (JSC::DFG::SpeculativeJIT::compileWeakSetAdd): Deleted.
        (JSC::DFG::SpeculativeJIT::compileWeakMapSet): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetPrototypeOf): Deleted.
        (JSC::DFG::SpeculativeJIT::compileIdentity): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
        (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal): Deleted.
        (JSC::DFG::SpeculativeJIT::compileClearCatchLocals): Deleted.
        (JSC::DFG::SpeculativeJIT::compileProfileType): Deleted.
        (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
        (JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::genericJSValuePeepholeBranch): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHeapBigIntEquality): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMakeRope): Deleted.
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted.
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): Deleted.
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfEmpty):
        (JSC::AssemblyHelpers::branchIfNotEmpty):

2021-11-09  Saam Barati  <sbarati@apple.com>

        When inlining NewSymbol in the DFG don't universally call ToString on the input
        https://bugs.webkit.org/show_bug.cgi?id=232754

        Reviewed by Robin Morisset.

        When inlining Symbol(x) in the DFG, we were always calling ToString on x.
        However, this is wrong spec wise. If x is undefined, the symbol should
        produce a description value of `undefined`, but calling ToString on x was causing
        us to produce a description with the string `"undefined"`.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGClobbersExitState.cpp:
        (JSC::DFG::clobbersExitState):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewSymbol):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNewSymbol):

2021-11-09  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, suppress scope check failures on Debug JSC tests
        https://bugs.webkit.org/show_bug.cgi?id=215438

        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat):

2021-11-08  Alex Christensen  <achristensen@webkit.org>

        Parse redirect and modify-headers actions for WKContentRuleList
        https://bugs.webkit.org/show_bug.cgi?id=232838

        Reviewed by Tim Hatcher.

        * inspector/InspectorBackendDispatcher.cpp:
        (Inspector::BackendDispatcher::getObject):

2021-11-08  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix the newly added code
        https://bugs.webkit.org/show_bug.cgi?id=215438

        * runtime/TemporalObject.cpp:
        (JSC::roundNumberToIncrement):

2021-11-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement IntlNumberFormat v3
        https://bugs.webkit.org/show_bug.cgi?id=215438

        Reviewed by Ross Kirsling.

        This patch implements part of Intl.NumberFormat v3 proposal[1].
        It adds (1) several new options to Intl.NumberFormat, (2) adds
        formatRange and formatRangeToParts to Intl.NumberFormat and Intl.PluralRules,
        and (3) adds toIntlMathematicalValue support, which allows some of Intl.NumberFormat
        functions to take "string" decimal form.

        We cannot implement some features because it requires super new ICU.

            - trailingZeroDisplay (requires ICU 69)
            - halfCeil / halfFloor (requires ICU 69)
            - signDisplay: "negative" (requires ICU 69)
            - formatRangeToParts (requires ICU 70)

        [1]: https://github.com/tc39/proposal-intl-numberformat-v3

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/BigIntPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/CommonIdentifiers.h:
        * runtime/IntlNumberFormat.cpp:
        (JSC::UNumberFormatterDeleter::operator()):
        (JSC::UNumberRangeFormatterDeleter::operator()):
        (JSC::partTypeString):
        (JSC::IntlNumberFormat::initializeNumberFormat):
        (JSC::IntlNumberFormat::format const):
        (JSC::IntlNumberFormat::formatRange const):
        (JSC::IntlNumberFormat::signDisplayString):
        (JSC::IntlNumberFormat::roundingModeString):
        (JSC::IntlNumberFormat::trailingZeroDisplayString):
        (JSC::IntlNumberFormat::roundingPriorityString):
        (JSC::IntlNumberFormat::useGroupingValue):
        (JSC::IntlNumberFormat::resolvedOptions const):
        (JSC::IntlNumberFormat::formatToPartsInternal):
        (JSC::IntlNumberFormat::formatToParts const):
        * runtime/IntlNumberFormat.h:
        (JSC::IntlMathematicalValue::IntlMathematicalValue):
        (JSC::IntlMathematicalValue::ensureNonDouble):
        (JSC::IntlMathematicalValue::numberType const):
        (JSC::IntlMathematicalValue::sign const):
        (JSC::IntlMathematicalValue::tryGetDouble const):
        (JSC::IntlMathematicalValue::getString const):
        (JSC::IntlMathematicalValue::numberTypeFromDouble):
        * runtime/IntlNumberFormatInlines.h:
        (JSC::setNumberFormatDigitOptions):
        (JSC::appendNumberFormatDigitOptionsToSkeleton):
        (JSC::toIntlMathematicalValue):
        * runtime/IntlNumberFormatPrototype.cpp:
        (JSC::IntlNumberFormatPrototype::create):
        (JSC::IntlNumberFormatPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlNumberFormatPrototype.h:
        * runtime/IntlObjectInlines.h:
        (JSC::intlStringOrBooleanOption):
        * runtime/IntlPluralRules.cpp:
        (JSC::UPluralRulesDeleter::operator()):
        (JSC::IntlPluralRules::initializePluralRules):
        (JSC::IntlPluralRules::resolvedOptions const):
        (JSC::IntlPluralRules::select const):
        (JSC::IntlPluralRules::selectRange const):
        * runtime/IntlPluralRules.h:
        * runtime/IntlPluralRulesPrototype.cpp:
        (JSC::IntlPluralRulesPrototype::create):
        (JSC::IntlPluralRulesPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlPluralRulesPrototype.h:
        * runtime/IntlRelativeTimeFormat.cpp:
        (JSC::IntlRelativeTimeFormat::formatToParts const):
        * runtime/JSBigInt.h:
        (JSC::JSBigInt::tryExtractDouble):
        * runtime/MathCommon.h:
        (JSC::isNegativeZero):
        * runtime/TemporalObject.cpp:
        (JSC::roundNumberToIncrement):
        * runtime/TemporalObject.h:

2021-11-08  Saam Barati  <sbarati@apple.com>

        We need to PreferNumber when calling toPrimitive for negate
        https://bugs.webkit.org/show_bug.cgi?id=232679

        Reviewed by Alexey Shvayka.

        We were forgetting to do this in a few implementations of the negate
        bytecode. So depending on which variant you took, you could get different
        results.

        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):

2021-11-05  Russell Epstein  <repstein@apple.com>

        Cherry-pick r284635. rdar://problem/85039977

    [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52
    https://bugs.webkit.org/show_bug.cgi?id=232059
    
    Reviewed by Saam Barati.
    
    JSTests:
    
    * stress/inserted-gettypedarraylengthasint52-should-have-int52-result-for-put-by-val.js: Added.
    (foo.bar):
    (foo):
    
    Source/JavaScriptCore:
    
    When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52.
    
    * dfg/DFGSSALoweringPhase.cpp:
    (JSC::DFG::SSALoweringPhase::handleNode):
    
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284635 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2021-10-21  Yusuke Suzuki  <ysuzuki@apple.com>

            [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52
            https://bugs.webkit.org/show_bug.cgi?id=232059

            Reviewed by Saam Barati.

            When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52.

            * dfg/DFGSSALoweringPhase.cpp:
            (JSC::DFG::SSALoweringPhase::handleNode):

2021-11-04  Alexey Shvayka  <ashvayka@apple.com>

        We need to PreferNumber when calling toPrimitive for coercion to BigInt
        https://bugs.webkit.org/show_bug.cgi?id=232720

        Reviewed by Saam Barati.

        The difference between "default" and "number" hints is observable only via
        Symbol.toPrimitive method.

        This patch aligns hints in ToBigInt [1] and BigInt constructor [2] with the
        spec, V8, and SpiderMonkey.

        [1]: https://tc39.es/ecma262/#sec-tobigint (step 1)
        [2]: https://tc39.es/ecma262/#sec-bigint-constructor-number-value (step 2)

        * runtime/BigIntConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::toBigInt const):

2021-11-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Clean up StructureStubInfo initialization
        https://bugs.webkit.org/show_bug.cgi?id=232652

        Reviewed by Saam Barati.

        This patch enhances FixedVector to initialize it from the other containers.
        So we can simplify baseline StructureStubInfo initialization.
        Now, StructureStubInfo::initializeFromUnlinkedStructureStubInfo becomes
        StructureStubInfo constructor taking const UnlinkedStructureStubInfo&.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::StructureStubInfo):
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): Deleted.
        * bytecode/StructureStubInfo.h:
        * jit/JIT.cpp:
        (JSC::JIT::link):

2021-11-02  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Add LLInt fast path for OpMod on x86_64
        https://bugs.webkit.org/show_bug.cgi?id=232644

        Reviewed by Saam Barati and Yusuke Suzuki.

        This patch ports the x86_64 fast path for OpMod from baseline JIT to LLInt.

        This is quite similar to OpDiv but the implementation avoids using binaryOpCustomStore
        because OpMod is not a ProfiledBinaryOp.

        Performance results appear negligible with all JIT tiers enabled;
        relevant microbenchmarks with JIT off are as follows.

                                                    Before                    After

        int-or-other-mod-then-get-by-val      158.0136+-0.9338     ^     39.7698+-0.4394        ^ definitely 3.9732x faster
        integer-modulo                         15.1972+-0.4197     ^      7.1461+-0.1530        ^ definitely 2.1266x faster
        mod-boolean                           145.4011+-2.0483     ?    146.1243+-1.6816        ?
        mod-boolean-double                    145.6148+-1.8530     ?    145.9380+-1.7073        ?
        mod-untyped                           286.9585+-3.9535          284.0360+-4.1221          might be 1.0103x faster
        negative-zero-modulo                    1.2951+-0.1275     ^      1.0220+-0.0412        ^ definitely 1.2672x faster

        <geometric>                            51.5408+-0.8164     ^     34.7341+-0.3365        ^ definitely 1.4839x faster

        * jit/GPRInfo.h: Add assertions.
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-11-02  Don Olmstead  <don.olmstead@sony.com>

        Non-unified build fixes early November 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=232589

        Unreviewed non-unified build fixes.

        * API/JSAPIGlobalObject.cpp:
        * bytecode/EvalCodeBlock.cpp:
        * bytecode/FunctionCodeBlock.cpp:
        * bytecode/ModuleProgramCodeBlock.cpp:
        * bytecode/ProgramCodeBlock.cpp:
        * jit/JITInlineCacheGenerator.h:
        * runtime/CustomGetterSetter.cpp:
        * runtime/JSScriptFetcher.cpp:
        * runtime/JSSourceCode.cpp:
        * runtime/ShadowRealmObject.cpp:
        * runtime/ShadowRealmPrototype.cpp:
        * runtime/TemporalInstant.cpp:

2021-11-02  Philip Chimento  <pchimento@igalia.com>

        [JSC] Implement Temporal.Instant
        https://bugs.webkit.org/show_bug.cgi?id=229826

        Reviewed by Yusuke Suzuki.

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/ISO8601.cpp:
        (JSC::ISO8601::parseInstant): Add a parsing function for Instant strings
          reusing as much as possible from the other parsing functions.
        (JSC::ISO8601::ExactTime::fromISOPartsAndOffset): Static method for
          creating from ISO calendar components and UTC offset.
        (JSC::ISO8601::checkedCastDoubleToInt128): Helper function for checking
          whether a double can fit into an int128 without overflow.
        (JSC::ISO8601::ExactTime::add const):
        (JSC::ISO8601::ExactTime::round):
        (JSC::ISO8601::ExactTime::difference const):
        (JSC::ISO8601::ExactTime::round const):
        * runtime/ISO8601.h:
        (JSC::ISO8601::ExactTime::ExactTime): Add an ExactTime type that wraps
          an Int128 and can do the basic operations. This type can be reused in
          Temporal.ZonedDateTime.
        (JSC::ISO8601::ExactTime::fromEpochSeconds):
        (JSC::ISO8601::ExactTime::fromEpochMilliseconds):
        (JSC::ISO8601::ExactTime::fromEpochMicroseconds):
        (JSC::ISO8601::ExactTime::epochSeconds const):
        (JSC::ISO8601::ExactTime::epochMilliseconds const):
        (JSC::ISO8601::ExactTime::epochMicroseconds const):
        (JSC::ISO8601::ExactTime::epochNanoseconds const):
        (JSC::ISO8601::ExactTime::nanosecondsFraction const):
        (JSC::ISO8601::ExactTime::asString const):
        (JSC::ISO8601::ExactTime::isValid const):
        (JSC::ISO8601::ExactTime::operator< const):
        (JSC::ISO8601::ExactTime::operator<= const):
        (JSC::ISO8601::ExactTime::operator== const):
        (JSC::ISO8601::ExactTime::operator!= const):
        (JSC::ISO8601::ExactTime::operator>= const):
        (JSC::ISO8601::ExactTime::operator> const):
        * runtime/IntlDateTimeFormat.h:
        * runtime/IntlDateTimeFormatPrototype.cpp:
        (JSC::IntlDateTimeFormat::handleDateTimeValue): Add a minimal
          implementation of the HandleDateTimeValue abstract op from the
          Temporal specification, only covering Temporal.Instant.
        (JSC::JSC_DEFINE_HOST_FUNCTION): Use it in the existing
          Intl.DateTimeFormat methods.
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::createFrom): Add an overload that takes an Int128.
        * runtime/JSBigInt.h: Remove declaration for nonexistent toUint64Heap().
        * runtime/JSDateMath.cpp: Move timeToMS() into WTF.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::instantStructure):
        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::toLimitedDuration): Added.
        * runtime/TemporalDuration.h:
        * runtime/TemporalInstant.cpp: Added.
        (JSC::TemporalInstant::createStructure):
        (JSC::TemporalInstant::TemporalInstant):
        (JSC::TemporalInstant::create):
        (JSC::TemporalInstant::tryCreateIfValid):
        (JSC::TemporalInstant::toInstant):
        (JSC::TemporalInstant::from):
        (JSC::TemporalInstant::fromEpochSeconds):
        (JSC::TemporalInstant::fromEpochMilliseconds):
        (JSC::TemporalInstant::fromEpochMicroseconds):
        (JSC::TemporalInstant::fromEpochNanoseconds):
        (JSC::TemporalInstant::compare):
        * runtime/TemporalInstant.h: Added.
        * runtime/TemporalInstantConstructor.cpp: Added.
        (JSC::TemporalInstantConstructor::create):
        (JSC::TemporalInstantConstructor::createStructure):
        (JSC::TemporalInstantConstructor::TemporalInstantConstructor):
        (JSC::TemporalInstantConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalInstantConstructor.h: Added.
        * runtime/TemporalInstantPrototype.cpp: Added.
        (JSC::TemporalInstantPrototype::create):
        (JSC::TemporalInstantPrototype::createStructure):
        (JSC::TemporalInstantPrototype::TemporalInstantPrototype):
        (JSC::TemporalInstantPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/TemporalInstantPrototype.h: Added.
        * runtime/TemporalObject.cpp:
        (JSC::createInstantConstructor): Added.
        (JSC::formatSecondsStringPart): Added.
        (JSC::abs): Added for clarity.
        (JSC::roundNumberToIncrement): Add overload for Int128.
        * runtime/TemporalObject.h:
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-11-02  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC][LLInt] Reverse unintended effects of r285152
        https://bugs.webkit.org/show_bug.cgi?id=232633

        Reviewed by Saam Barati.

        The previous patch was not intended to change the generated assembly whatsoever,
        but it turns out that 3-argument syntax produces, e.g. `vsub` instead of `sub` on x86.

        As such, this patch does away with the 3-arg cases and merely clarifies names as `rhs, lhs` across the board.

        (Also: Fix a line from the previous patch where a macro was not referring to a passed label properly.)

        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-11-02  Saam Barati  <sbarati@apple.com>

        EnumeratorGetByVal for IndexedMode+OwnStructureMode doesn't always recover the property name
        https://bugs.webkit.org/show_bug.cgi?id=231321
        <rdar://problem/84211697>

        Reviewed by Yusuke Suzuki.

        When running an EnumeratorGetByVal in IndexedMode+OwnStructureMode, we may
        go to the slow path. However, we were incorrectly going to the slow path
        before recovering the actual property name. Instead, we were passing in
        the integer index value to the get by val.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-11-02  Patrick Angle  <pangle@apple.com>

        WebDriver: [Cocoa] support `acceptInsecureCerts` capability
        https://bugs.webkit.org/show_bug.cgi?id=231789

        Reviewed by BJ Burg.

        Add necessary plumbing to support the `acceptInsecureCerts` WebDriver capability.

        * inspector/remote/RemoteInspectorConstants.h:
        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
        (Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):

2021-11-01  Mark Lam  <mark.lam@apple.com>

        Remove some unused Heap fields.
        https://bugs.webkit.org/show_bug.cgi?id=232604

        Reviewed by Yusuke Suzuki.

        * heap/Heap.cpp:
        (JSC::Heap::notifyThreadStopping):
        * heap/Heap.h:

2021-11-01  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC][LLInt] Non-commutative binops are hard to reason about when operands are labelled in reverse
        https://bugs.webkit.org/show_bug.cgi?id=232598

        Reviewed by Saam Barati.

        In offlineasm, `OP a, b, c` is `c = a OP b` but `OP a, b` is `b = b OP a`.

        This can make identifiers like `left` and `right` quite confusing --
        simple cases like `subd left, right` are already misleading, while OpDiv literally
        passes its RHS to a macro as `left` and then checks `left` for division by zero.
        It becomes difficult to keep this all in one's brain without rewriting it on paper.

        This patch may not constitute a "complete solution", but it at least makes our naming honest:
        1. Use 3-argument syntax (as `left, right, result`) whenever possible.
        2. When not possible (e.g. because `bsubio` isn't flexible about its arguments or
           because x86 doesn't have 3-argument shift operations), then say `rhs, lhs` explicitly.

        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-11-01  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] LLIntCallee should have two replacements
        https://bugs.webkit.org/show_bug.cgi?id=228552
        rdar://81217357

        Reviewed by Saam Barati.

        LLIntCallee can be used for signaling memory and bounds-checking memory.
        Thus it should have two replacements for each mode.

        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::setOSREntryCallee):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::updateCallSitesToCallUs):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::WASM_SLOW_PATH_DECL):

2021-11-01  Saam Barati  <sbarati@apple.com>

        ArrayBuffer species watchpoint being invalidated doesn't mean it's not an ArrayBuffer constructor from the same global object
        https://bugs.webkit.org/show_bug.cgi?id=231322
        <rdar://problem/84212078>

        Reviewed by Yusuke Suzuki.

        We were relying on the watchpoint to tell us if the Array species watchpoint
        for 'constructor' is set to the right value. However, the watchpoint being
        fired doesn't guarantee that it won't be the right value. For example, we
        might not be able to install the watchpoint because the replacement watchpoint
        may already be fired.

        * runtime/JSArrayBufferPrototype.cpp:
        (JSC::arrayBufferSpeciesConstructorSlow):

2021-11-01  Robin Morisset  <rmorisset@apple.com>

        JSGenericTypedArrayView<Adaptor>::set crashes if the length + objectOffset is > UINT32_MAX
        https://bugs.webkit.org/show_bug.cgi?id=231975
        rdar://84402043

        Reviewed by Yusuke Suzuki.

        UINT_MAX (and anything above it) is not a valid array index, so we cannot use JSObject::get(JSGlobalObject*, unsigned) with an index that big.
        This was pointed by Yusuke in his review of my recent patch that introduced the problem (https://bugs.webkit.org/show_bug.cgi?id=229353#c21),
        but I misunderstood the code and thought we could never get values that big at that point, thus only putting a RELEASE_ASSERT.
        In this patch I instead apply his original suggestion to have a first loop using the (fast) JSObject::get(),
        and a second loop for any large indices, using a slower but safe code path.

        I also fixed an unrelated bug I noticed in Clobberize/AbstractInterpreter while testing the rest of the patch:
        they were not aware that NewTypedArray can take a Int52RepUse child.

        Finally, while trying to properly test this change, I discovered that genericTypedArrayViewProtoFuncSlice
        (which is the only caller of JSGenericTypedArrayView<Adaptor>::set which passes it a non-0 objectOffset)
        was still using unsigned everywhere instead of size_t, and that the same was true of all other functions in the same file.
        So I fixed it in the same patch.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * runtime/JSArrayBufferConstructor.cpp:
        (JSC::JSGenericArrayBufferConstructor<sharingMode>::constructImpl):
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::constructGenericTypedArrayViewImpl):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
        (JSC::argumentClampedIndexFromStartOrEnd):
        (JSC::genericTypedArrayViewProtoFuncSet):
        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
        (JSC::genericTypedArrayViewProtoFuncIncludes):
        (JSC::genericTypedArrayViewProtoFuncIndexOf):
        (JSC::genericTypedArrayViewProtoFuncJoin):
        (JSC::genericTypedArrayViewProtoFuncFill):
        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
        (JSC::genericTypedArrayViewProtoFuncSlice):
        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):

2021-10-31  Cameron McCormack  <heycam@apple.com>

        Update Web IDL links to new URL
        https://bugs.webkit.org/show_bug.cgi?id=232533
        <rdar://problem/84842937>

        Reviewed by Sam Weinig.

        * wasm/js/WebAssemblyMemoryConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyTableConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-10-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Having StructureStubInfo and CallLinkInfo via FixedVector for Baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=232521

        Reviewed by Saam Barati.

        We know # of StructureStubInfo and # of CallLinkInfo after compiling Baseline JIT code.
        So when installing a code into CodeBlock, we do not need to use Bag<>. Instead we can just
        use FixedVector to allocate these instances.

        We keep FixedVector<StructureStubInfo> and FixedVector<CallLinkInfo> in JITData for Baseline JIT.
        And moving Bag<StructureStubInfo> and Bag<CallLinkInfo> to DFG::CommonData when they are instantiated
        for DFG / FTL codes.

        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::CallLinkInfo): Deleted.
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::CallLinkInfo):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::getICStatusMap):
        (JSC::CodeBlock::findStubInfo):
        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
        (JSC::CodeBlock::resetJITData):
        (JSC::CodeBlock::stronglyVisitStrongReferences):
        (JSC::CodeBlock::jettison):
        (JSC::CodeBlock::findPC):
        (JSC::CodeBlock::addOptimizingStubInfo): Deleted.
        (JSC::CodeBlock::addCallLinkInfo): Deleted.
        * bytecode/CodeBlock.h:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::StructureStubInfo): Deleted.
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::StructureStubInfo):
        * dfg/DFGCommonData.h:
        (JSC::DFG::CommonData::addCallLinkInfo):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileDeleteById):
        (JSC::DFG::SpeculativeJIT::compileDeleteByVal):
        (JSC::DFG::SpeculativeJIT::compileInById):
        (JSC::DFG::SpeculativeJIT::compileInByVal):
        (JSC::DFG::SpeculativeJIT::compileHasPrivate):
        (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal):
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
        (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand):
        (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand):
        (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/BaselineJITCode.h:
        * jit/JIT.cpp:
        (JSC::JIT::addUnlinkedCallLinkInfo):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITByIdGenerator::JITByIdGenerator):
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
        (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator):
        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
        (JSC::JITDelByValGenerator::JITDelByValGenerator):
        (JSC::JITDelByIdGenerator::JITDelByIdGenerator):
        (JSC::JITInByValGenerator::JITInByValGenerator):
        (JSC::JITInByIdGenerator::JITInByIdGenerator):
        (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator):
        (JSC::JITGetByValGenerator::JITGetByValGenerator):
        (JSC::JITPutByValGenerator::JITPutByValGenerator):
        (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_instanceof):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emit_op_enumerator_get_by_val):

2021-10-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Clean up Baseline StructureStubInfo management
        https://bugs.webkit.org/show_bug.cgi?id=232513

        Reviewed by Saam Barati.

        1. We should keep Generator::m_stubInfo nullptr. And we add some assertions about it since it should not
           be allocated and used.
        2. We found that propertyIsInt32 for op_get_by_val and op_put_by_val is not appropriately configured for
           UnlinkedStructureStubInfo (it was accidentally set for the above wasted StructureStubInfo). This patch
           attaches that information.
        3. We keep UnlinkedStructureStubInfo in a FixedVector in BaselineJITCode. While we need to keep pointer
           identity while compiling Baseline JIT, after that, we no longer need to keep that since these pointers
           are not embedded into JIT code. This patch allocates UnlinkedStructureStubInfo via SegmentedVector during
           compilation to keep pointer identity, but when finalizing, we allocate FixedVector and copy the above content
           to that to keep memory as small as possible. We should do similar thing to UnlinkedCallLinkInfo, StructureStubInfo etc.
           for baseline, but this should be done in a separate patch.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::addOptimizingStubInfo):
        (JSC::CodeBlock::addStubInfo): Deleted.
        * bytecode/CodeBlock.h:
        * bytecode/PutKind.h:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * bytecode/StructureStubInfo.h:
        * jit/BaselineJITCode.h:
        * jit/JIT.cpp:
        (JSC::JIT::addUnlinkedStructureStubInfo):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITInlineCacheGenerator::finalize):
        (JSC::JITByIdGenerator::JITByIdGenerator):
        (JSC::JITByIdGenerator::finalize):
        (JSC::JITGetByIdGenerator::generateFastPath):
        (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator):
        (JSC::JITGetByIdWithThisGenerator::generateFastPath):
        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
        (JSC::JITPutByIdGenerator::generateFastPath):
        (JSC::JITDelByValGenerator::JITDelByValGenerator):
        (JSC::JITDelByValGenerator::generateFastPath):
        (JSC::JITDelByValGenerator::finalize):
        (JSC::JITDelByIdGenerator::JITDelByIdGenerator):
        (JSC::JITDelByIdGenerator::generateFastPath):
        (JSC::JITDelByIdGenerator::finalize):
        (JSC::JITInByValGenerator::JITInByValGenerator):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByValGenerator::finalize):
        (JSC::JITInByIdGenerator::generateFastPath):
        (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator):
        (JSC::JITInstanceOfGenerator::generateFastPath):
        (JSC::JITInstanceOfGenerator::finalize):
        (JSC::JITGetByValGenerator::JITGetByValGenerator):
        (JSC::JITGetByValGenerator::generateFastPath):
        (JSC::JITGetByValGenerator::finalize):
        (JSC::JITPutByValGenerator::JITPutByValGenerator):
        (JSC::JITPutByValGenerator::generateFastPath):
        (JSC::JITPutByValGenerator::finalize):
        (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator):
        (JSC::JITPrivateBrandAccessGenerator::generateFastPath):
        (JSC::JITPrivateBrandAccessGenerator::finalize):
        (JSC::garbageStubInfo): Deleted.
        * jit/JITInlineCacheGenerator.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_instanceof):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emit_op_enumerator_get_by_val):

2021-10-29  Dmitry Bezhetskov  <dbezhetskov@igalia.com>

        [WASM-Function-References] Add support for (ref.null heaptype)
        https://bugs.webkit.org/show_bug.cgi?id=229707

        Reviewed by Yusuke Suzuki.

        Added support for (ref.null $t) from the typed function references proposal:
        https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md#optional-references.
        Since now we can have null references I've also updated call_ref implementation to check the target reference for null.
        According to the spec (https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md#functions)
        we must trap on null.

        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::addCallRef):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addCallRef):
        * wasm/WasmExceptionType.h:
        * wasm/WasmFormat.h:
        (JSC::Wasm::isTypeIndexHeapType):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        * wasm/WasmParser.h:
        (JSC::Wasm::Parser<SuccessType>::parseHeapType):
        (JSC::Wasm::Parser<SuccessType>::parseValueType):
        * wasm/WasmSectionParser.cpp:
        (JSC::Wasm::SectionParser::parseInitExpr):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::doWasmCallRef):


2021-10-28  Saam Barati  <sbarati@apple.com>

        Don't call type() on Structure, instead call type() on its typeInfo()
        https://bugs.webkit.org/show_bug.cgi?id=232414

        Reviewed by Yusuke Suzuki.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * runtime/Structure.h:
        (JSC::Structure::type):

2021-10-27  Dmitry Bezhetskov  <dbezhetskov@igalia.com>

        [WASM-Function-References] Add call_ref spec tests
        https://bugs.webkit.org/show_bug.cgi?id=229710
        
        Reviewed by Yusuke Suzuki.
        
        Removed redundand TypeKind::TypeIdx because new Ref and RefNull opcodes cover
        the same cases.
        Also use new internal representation of Funcref/Externref when typed
        function references proposal is enabled.
        
        * bytecode/BytecodeDumper.cpp:
        (JSC::Wasm::BytecodeDumper::formatConstant const):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::gRef):
        (JSC::Wasm::AirIRGenerator::tmpForType):
        (JSC::Wasm::AirIRGenerator::emitCCall):
        (JSC::Wasm::AirIRGenerator::moveOpForValueType):
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::addLocal):
        (JSC::Wasm::AirIRGenerator::addConstant):
        (JSC::Wasm::AirIRGenerator::addRefFunc):
        (JSC::Wasm::AirIRGenerator::gTypeIdx): Deleted.
        * wasm/WasmCallingConvention.h:
        (JSC::Wasm::WasmCallingConvention::marshallLocation const):
        (JSC::Wasm::JSCallingConvention::marshallLocation const):
        * wasm/WasmFormat.h:
        (JSC::Wasm::isValueType):
        (JSC::Wasm::isRefType):
        (JSC::Wasm::isExternref):
        (JSC::Wasm::isFuncref):
        (JSC::Wasm::FuncrefType):
        (JSC::Wasm::ExternrefType):
        (JSC::Wasm::isRefWithTypeIndex):
        (JSC::Wasm::isSubtype):
        (JSC::Wasm::isDefaultableType):
        (JSC::Wasm::TableInformation::wasmType const):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        * wasm/WasmGlobal.cpp:
        (JSC::Wasm::Global::get const):
        (JSC::Wasm::Global::set):
        (JSC::Wasm::Global::visitAggregateImpl):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
        (JSC::Wasm::LLIntGenerator::callInformationForCallee):
        (JSC::Wasm::LLIntGenerator::addArguments):
        (JSC::Wasm::LLIntGenerator::addLocal):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmParser.h:
        (JSC::Wasm::Parser<SuccessType>::parseValueType):
        * wasm/WasmSectionParser.cpp:
        (JSC::Wasm::SectionParser::parseInitExpr):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::wasmType const):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::marshallJSResult):
        * wasm/js/JSWebAssemblyGlobal.cpp:
        (JSC::JSWebAssemblyGlobal::type):
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::defaultValueForReferenceType):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * wasm/js/WebAssemblyGlobalConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::linkImpl):
        * wasm/wasm.json:

2021-10-27  Geza Lore  <glore@igalia.com>

        [JSC][32bit] Fix CSR restore on DFG tail calls, add extra register on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=230622

        Reviewed by Keith Miller.

        This re-introduces the patch reverted by
        https://trac.webkit.org/changeset/284911/webkit
        with the C_LOOP interpreter now fixed.

        The only difference between the original patch and this version is in
        LowLevelInterpreter32_64.asm and LowLevelInterpreter64.asm, which
        need the PC base (PB) register restored on C_LOOP on return from a
        call, as C_LOOP does not seem to handle this as a proper callee save
        register (CSR). On non C_LOOP builds, the CSR restore mechanism takes
        care of this, so removed the superfluous instructions.

        --- Original ChangeLog ---

        This patch does two things:

        1. Adds an extra callee save register (CSR) to be available to DFG on
        ARMv7. To do this properly required the following:

        2. Implements the necessary shuffling in CallFrameShuffler on 32-bit
        architectures that is required to restore CSRs properly after a tail
        call on these architectures. This also fixes the remaining failures in
        the 32-bit build of the unlinked baseline JIT.

        * bytecode/ValueRecovery.cpp:
        (JSC::ValueRecovery::dumpInContext const):
        * bytecode/ValueRecovery.h:
        (JSC::ValueRecovery::calleeSaveRegDisplacedInJSStack):
        (JSC::ValueRecovery::isInJSStack const):
        (JSC::ValueRecovery::dataFormat const):
        (JSC::ValueRecovery::withLocalsOffset const):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * jit/CachedRecovery.cpp:
        (JSC::CachedRecovery::loadsIntoGPR const):
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
        * jit/CallFrameShuffleData.h:
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::CallFrameShuffler):
        * jit/CallFrameShuffler.h:
        (JSC::CallFrameShuffler::snapshot const):
        (JSC::CallFrameShuffler::addNew):
        * jit/CallFrameShuffler32_64.cpp:
        (JSC::CallFrameShuffler::emitLoad):
        (JSC::CallFrameShuffler::emitDisplace):
        * jit/GPRInfo.h:
        (JSC::GPRInfo::toRegister):
        (JSC::GPRInfo::toIndex):
        * jit/RegisterSet.cpp:
        (JSC::RegisterSet::dfgCalleeSaveRegisters):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2021-10-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r284255.
        https://bugs.webkit.org/show_bug.cgi?id=232353

        breaks 32-bit watch CLoop.

        Reverted changeset:

        "[JSC][32bit] Fix CSR restore on DFG tail calls, add extra
        register on ARMv7"
        https://bugs.webkit.org/show_bug.cgi?id=230622
        https://commits.webkit.org/r284255

2021-10-26  Xan López  <xan@igalia.com>

        [JSC] Improve offlineasm debug annotations for Linux/ELF
        https://bugs.webkit.org/show_bug.cgi?id=232303

        Reviewed by Mark Lam.

        This patch does two things:

        Add the .size and .type directives to every llint "function"
        (global, llint opcode, 'glue'). This allows a debugger to tell you
        in what logical function you are inside the giant chunk of code
        that is the llint interpreter. So instead of something like this:

        (gdb) x/5i $pc
          => 0xf5f8af60 <wasmLLIntPCRangeStart+3856>:  b.n     0xf5f8af6c <wasmLLIntPCRangeStart+3868>
             0xf5f8af62 <wasmLLIntPCRangeStart+3858>:  ldr     r2, [r7, #8]
             0xf5f8af64 <wasmLLIntPCRangeStart+3860>:  ldr     r2, [r2, #28]
             0xf5f8af66 <wasmLLIntPCRangeStart+3862>:  subs    r0, #16
             0xf5f8af68 <wasmLLIntPCRangeStart+3864>:  ldr.w   r0, [r2, r0, lsl #3]

        you get something like this:

        (gdb) x/5i $pc
          => 0xf5f8c770 <wasm_f32_add+12>:      bge.n   0xf5f8c77c <wasm_f32_add+24>
             0xf5f8c772 <wasm_f32_add+14>:      add.w   r6, r7, r9, lsl #3
             0xf5f8c776 <wasm_f32_add+18>:      vldr    d0, [r6]
             0xf5f8c77a <wasm_f32_add+22>:      b.n     0xf5f8c78c <wasm_f32_add+40>
             0xf5f8c77c <wasm_f32_add+24>:      ldr     r2, [r7, #8]

        The other change adds a local symbol (in addition to an internal
        label) to all the "glue" labels. That allows wasm opcodes to be
        seen by the debugger (and the user to break on them), among other
        things.

        * CMakeLists.txt: tell offlineasm we use the ELF binary format on Linux.
        * llint/LowLevelInterpreter.cpp: emit a non-local label for "glue" labels.
        * offlineasm/asm.rb: emit the .size and .type directives for every
        llint "function" on ELF systems.

2021-10-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757
        https://bugs.webkit.org/show_bug.cgi?id=232269

        Reviewed by Robin Morisset.

        Now, condition in InternalFunction is changed in r284757. We need to update
        this assertion accordingly. It is tested (and crashing) in the existing stress test[1].

        [1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js

        * bytecode/InternalFunctionAllocationProfile.h:
        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):

2021-10-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Don't branch around register allocation in DFG enumerator get by val
        https://bugs.webkit.org/show_bug.cgi?id=232260
        rdar://84544469

        Reviewed by Robin Morisset.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):

2021-10-25  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Don't speculate Cell on PutByVal
        https://bugs.webkit.org/show_bug.cgi?id=232242

        Reviewed by Yusuke Suzuki.

        This patch is similar to https://bugs.webkit.org/show_bug.cgi?id=232052
        but smaller: given that we have more registers available, we don't have
        to speculate Cells anymore.

        This patch removes the Cell speculation during the DFG FixUp phase and
        adjust the operationPutByVal* calls to use the generic version (instead
        of the Cell versions).

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):

2021-10-25  Geza Lore  <gezalore@gmail.com>

        [JSC][32bit] Use DataIC in Baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=232079

        Reviewed by Yusuke Suzuki.

        This patch ports the JSVALUE32_64 baseline JIT to use DataICs.

        The majority of the involved opcodes (all but one) could be easily
        modified to use a common implementation between JSVALUE64 and
        JSVALUE32_64 platforms by abstracting over machine registers holding a
        JSValue using JSValueReg types instead of GPRReg.

        The only non-trivial additional abstraction needed was over the ideal
        argument registers used in a function call, so loading the arguments
        from memory can put them straight in the ABI specific argument
        register whenever possible, or appropriate temporaries otherwise. For
        this I added CCallHelpers::preferredArgumentGPR (for passing host
        pointers and other primitive types that fit in a machine register on
        the host platform), and CCallHelpers::preferredArgumentJSR (for
        passing JSValue/EncodedJSValue). Please see the description of these
        in the code.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * assembler/ARMv7Assembler.h:
        (JSC::ARMv7Assembler::strb):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitDataICFastPath):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfNotObject):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::sizeOfArg):
        (JSC::CCallHelpers::pickJSR):
        (JSC::CCallHelpers::preferredArgumentJSR):
        (JSC::CCallHelpers::preferredArgumentGPR):
        * jit/CallFrameShuffler.h:
        * jit/GPRInfo.h:
        (JSC::JSValueRegs::operator== const):
        (JSC::JSValueRegs::operator!= const):
        (JSC::JSValueRegs::tagGPR const):
        (JSC::JSValueRegs::payloadGPR const):
        (JSC::JSValueRegs::uses const):
        (JSC::JSValueRegs::overlaps const):
        (JSC::JSValueRegs::JSValueRegs):
        (JSC::JSValueRegs::payloadOnly):
        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::emit_op_ret):
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCall32_64.cpp: Removed.
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
        * jit/JITOpcodes.cpp:
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_put_by_val_direct):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        * jit/JITPropertyAccess32_64.cpp:

2021-10-24  Alexey Shvayka  <ashvayka@apple.com>

        InternalFunction::createSubclassStructure() should use prototype's global object
        https://bugs.webkit.org/show_bug.cgi?id=231874

        Reviewed by Yusuke Suzuki.

        In case NewTarget has a cross-realm "prototype" object, even though the instance
        structure is created with correct [[Prototype]], it's m_globalObject is of NewTarget's
        realm instead of prototype's.

        That is observable in various places, including when calling CustomAccessor, fast paths
        for iteration protocol / collection constructors, isHavingABadTime() handling etc.

        This patch fixes structure's global object to be correct: per spec [1], we fallback to
        NewTarget's realm only if "prototype" is a primitive.

        [1]: https://tc39.es/ecma262/#sec-getprototypefromconstructor (step 3.b)

        * runtime/InternalFunction.cpp:
        (JSC::InternalFunction::createSubclassStructure):

2021-10-22  Justin Michaud  <justin_michaud@apple.com>

        Fix nits from 232019
        https://bugs.webkit.org/show_bug.cgi?id=232180

        Reviewed by Saam Barati.

        We only need one write barrier, since we only need to guarantee that we read the status of the write barrier before we read from the structure cache.
        If we are delayed in watching the watchpoint, it does not change any of the interleavings.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):

2021-10-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] GetTypedArrayLengthAsInt52 must be inserted only when we ensure that input is TypedArray via array-mode-based filtering
        https://bugs.webkit.org/show_bug.cgi?id=232168
        rdar://84366658

        Reviewed by Robin Morisset.

        GetTypedArrayLengthAsInt52 works only when input is TypedArray, which should be validated via array-mode (and already inserted checks in fixup).
        Accidentally we were inserting it without checking typed-array condition in SSA lowering phase. This patch adds a condition which ensures it
        is TypedArray.

        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

2021-10-22  Mark Lam  <mark.lam@apple.com>

        Change Heap::writeBarrier() to do the cheaper check first.
        https://bugs.webkit.org/show_bug.cgi?id=232172

        Reviewed by Robin Morisset.

        It's cheaper to do a check using incoming args (which are already loaded in
        registers) than to do a check which requires memory loads.

        * heap/HeapInlines.h:
        (JSC::Heap::writeBarrier):

2021-10-22  Asumu Takikawa  <asumu@igalia.com>

        Change WebAssembly module import linking time to evaluate step.
        https://bugs.webkit.org/show_bug.cgi?id=231114

        Reviewed by Yusuke Suzuki.

        Moves the Wasm module import linking code to execute in the
        module evaluation step, which is the behavior specified in the
        Wasm/ESM-integration proposal:

          https://github.com/WebAssembly/esm-integration/tree/main/proposals/esm-integration#evaluate

        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::link):
        (JSC::AbstractModuleRecord::evaluate):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):
        (JSC::WebAssemblyModuleRecord::initializeImportsAndExports):
        (JSC::WebAssemblyModuleRecord::linkImpl): Deleted.
        * wasm/js/WebAssemblyModuleRecord.h:

2021-10-22  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Re-enable compileEnumeratorGetByVal fast path
        https://bugs.webkit.org/show_bug.cgi?id=232052

        Reviewed by Yusuke Suzuki.

        In https://bugs.webkit.org/show_bug.cgi?id=229543, the compileEnumeratorGetByVal
        fast path had to be disabled in 32 bits due to not having enough registers.
        There are enough registers available now, so we can re-enable the fast path and
        removed the speculation that the baseEdge of both enumeratorGetByVal and
        getByVal is a Cell in 32 bits.

        I've also updated the 32 bits version of compileGetByVal to be closer to the 64
        bits version: using DFG_CRASH instead of RELEASE_ASSERT_NOT_REACHED, using nullptr
        instead of 0, and removed some whitespaces.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted.
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted.

2021-10-22  Saam Barati  <sbarati@apple.com>

        canDoFastSpread should also check that the Structure is from the global object we're watching
        https://bugs.webkit.org/show_bug.cgi?id=231976
        <rdar://84340372>

        Reviewed by Keith Miller.

        Just reorder the checks for clarity.

        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::canDoFastSpread):

2021-10-22  Robin Morisset  <rmorisset@apple.com>

        --reportBytecodeCompileTimes=1 should correctly report the bytecode size
        https://bugs.webkit.org/show_bug.cgi?id=232118

        Reviewed by Michael Saboff.

        generate() calls m_writer.finalize() which moves m_instructions, so when we later query its size we get 0.
        The solution is simply to put the size in an out-parameter just before calling finalize().

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::generate):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::generate):

2021-10-22  Mark Lam  <mark.lam@apple.com>

        Remove unneeded Heap::m_vm.
        https://bugs.webkit.org/show_bug.cgi?id=232132

        Reviewed by Yusuke Suzuki.

        Heap::vm() already computes the associated VM& using offset math.  This entails
        subtracting a constant from Heap's this pointer, which is faster than loading from
        a field.

        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::releaseDelayedReleasedObjects):
        (JSC::Heap::protect):
        (JSC::Heap::unprotect):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::completeAllJITPlans):
        (JSC::Heap::iterateExecutingAndCompilingCodeBlocks):
        (JSC::Heap::gatherJSStackRoots):
        (JSC::Heap::gatherScratchBufferRoots):
        (JSC::Heap::removeDeadCompilerWorklistEntries):
        (JSC::Heap::gatherExtraHeapData):
        (JSC::Heap::deleteAllCodeBlocks):
        (JSC::Heap::deleteAllUnlinkedCodeBlocks):
        (JSC::Heap::finishChangingPhase):
        (JSC::Heap::collectInMutatorThread):
        (JSC::Heap::finishRelinquishingConn):
        (JSC::Heap::deleteSourceProviderCaches):
        (JSC::Heap::didFinishCollection):
        (JSC::Heap::isValidAllocation):
        (JSC::Heap::addCoreConstraints):
        * heap/Heap.h:

2021-10-21  Saam Barati  <sbarati@apple.com>

        Clean up some code around checking the state of Watchpoints
        https://bugs.webkit.org/show_bug.cgi?id=232111

        Reviewed by Yusuke Suzuki.

        No need to have state() and stateOnJSThread(), since they're now the same.
        Also, there is no need to check the allocation watchpoint twice for the
        function/internal function allocation profiles.

        * bytecode/Watchpoint.h:
        (JSC::WatchpointSet::isStillValid const):
        (JSC::WatchpointSet::stateOnJSThread const): Deleted.
        (JSC::WatchpointSet::isStillValidOnJSThread const): Deleted.
        (JSC::InlineWatchpointSet::stateOnJSThread const): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::handleCreateInternalFieldObject):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * runtime/ArrayPrototype.cpp:
        (JSC::speciesWatchpointIsValid):
        (JSC::canUseDefaultArrayJoinForToString):
        * runtime/InferredValue.h:
        (JSC::InferredValue::notifyWrite):
        (JSC::InferredValue::stateOnJSThread const): Deleted.
        * runtime/JSArrayBufferPrototypeInlines.h:
        (JSC::speciesWatchpointIsValid):
        * runtime/ObjectPropertyChangeAdaptiveWatchpoint.h:

2021-10-21  Mark Lam  <mark.lam@apple.com>

        Remove an unused field: Heap::m_copyingRememberedSet.
        https://bugs.webkit.org/show_bug.cgi?id=232119

        Reviewed by Robin Morisset.

        * heap/Heap.h:

2021-10-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 NodeResultInt52
        https://bugs.webkit.org/show_bug.cgi?id=232100

        Reviewed by Robin Morisset.

        This patch makes GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 have NodeResultInt52 by default.
        And DFG validation should skip Int52 validation before fixup phase, as we are doing for double results.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
        * dfg/DFGValidate.cpp:

2021-10-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52
        https://bugs.webkit.org/show_bug.cgi?id=232059

        Reviewed by Saam Barati.

        When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52.

        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):

2021-10-21  Michael Saboff  <msaboff@apple.com>

        Add missing overflow check to DFGIntegerRangeOptimizationPhase::filterConstant()
        https://bugs.webkit.org/show_bug.cgi?id=232058

        Reviewed by Robin Morisset.

        Added overflow check.

        * dfg/DFGIntegerRangeOptimizationPhase.cpp:

2021-10-20  Yusuke Suzuki  <ysuzuki@apple.com>

        *IsSane API's could take in the Structure's we're consulting, or they can be out parameters, so we don't rely on the CPU's memory ordering
        https://bugs.webkit.org/show_bug.cgi?id=231996

        Reviewed by Filip Pizlo.

        objectPrototypeIsSane, arrayPrototypeChainIsSane, and stringPrototypeChainIsSane reloads structures from prototype objects while the caller
        is already getting them and validating them. This introduces a race condition where structure transition happens just before calling these
        APIs and we will see different structures which are already validated. This is simply wrong: if we validate one structure, then we should
        continue using that and we should put a watchpoint on this structure. We should not reload structures from the prototype again.

        We add Concurrently postfix to these functions, and passing structures to these APIs to continue using these structures instead of reloading
        it from prototype objects. This eliminate the race condition we had, and this removes the necessity of load-load-fence on watchpoint state
        retrieval.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::refine const):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::setSaneChainIfPossible):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAtImpl):
        * runtime/JSGlobalObject.h:
        * runtime/JSGlobalObjectInlines.h:
        (JSC::JSGlobalObject::objectPrototypeIsSane):
        (JSC::JSGlobalObject::arrayPrototypeChainIsSaneConcurrently):
        (JSC::JSGlobalObject::stringPrototypeChainIsSaneConcurrently):
        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
        (JSC::JSGlobalObject::stringPrototypeChainIsSane):

2021-10-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] ArithAbs should care about INT32_MIN
        https://bugs.webkit.org/show_bug.cgi?id=232051
        rdar://84338648

        Reviewed by Michael Saboff.

        ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.

        * dfg/DFGIntegerRangeOptimizationPhase.cpp:

2021-10-20  Justin Michaud  <justin_michaud@apple.com>

        We should watch isHavingABadTime if we read from the structureCache
        https://bugs.webkit.org/show_bug.cgi?id=232019

        Reviewed by Yusuke Suzuki.

        We should lock the structure cache when we clear it, and the compiler thread should
        watch isHavingABadTime in the case that the cache might get cleared.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::haveABadTime):
        * runtime/StructureCache.cpp:
        (JSC::StructureCache::clear):
        * runtime/StructureCache.h:
        (JSC::StructureCache::clear): Deleted.

2021-10-20  Michael Saboff  <msaboff@apple.com>

        Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo()
        https://bugs.webkit.org/show_bug.cgi?id=232024

        Reviewed by Tadeu Zagallo.

        Added overflow check before comparing for equality.

        * dfg/DFGIntegerRangeOptimizationPhase.cpp:

2021-10-20  Michael Catanzaro  <mcatanzaro@gnome.org>

        Do not use strerror()
        https://bugs.webkit.org/show_bug.cgi?id=231913

        Reviewed by Chris Dumez.

        * API/JSScript.mm:
        (-[JSScript writeCache:]):
        * API/tests/testapi.mm:
        (resolvePathToScripts):
        * jsc.cpp:
        * runtime/BytecodeCacheError.cpp:
        (JSC::BytecodeCacheError::StandardError::message const):
        * tools/FunctionAllowlist.cpp:
        (JSC::FunctionAllowlist::FunctionAllowlist):
        * tools/FunctionOverrides.cpp:
        (JSC::FunctionOverrides::parseOverridesInFile):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::MemoryHandle::~MemoryHandle):
        (JSC::Wasm::Memory::tryCreate):
        (JSC::Wasm::Memory::growShared):
        (JSC::Wasm::Memory::grow):

2021-10-20  Michael Catanzaro  <mcatanzaro@gnome.org>

        Suppress a -Wreturn-type warning
        https://bugs.webkit.org/show_bug.cgi?id=229681
        <rdar://81603387>

        Unreviewed.

        * wasm/WasmFormat.h:
        (JSC::Wasm::typeToString):

2021-10-19  Tadeu Zagallo  <tzagallo@apple.com>

        Address post-landing feedback to wasm exceptions
        https://bugs.webkit.org/show_bug.cgi?id=231973

        Reviewed by Saam Barati.

        Address comments left by Saam in https://bugs.webkit.org/show_bug.cgi?id=229681
        after the patch landed. This includes deleting some unused code, and renaming a
        couple variables and methods, but the biggest change is copying the callee saves
        to VMEntry in the llint rethrow.

        * interpreter/Interpreter.cpp:
        (JSC::CatchInfo::CatchInfo):
        (JSC::UnwindFunctor::operator() const):
        * interpreter/Interpreter.h:
        (JSC::CatchInfo::CatchInfo): Deleted.
        * jit/JSInterfaceJIT.h:
        (JSC::JSInterfaceJIT::convertCalleeToVM): Deleted.
        * llint/WebAssembly.asm:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::ControlData::ControlData):
        (JSC::Wasm::B3IRGenerator::ControlData::tryDepth const):
        (JSC::Wasm::B3IRGenerator::connectControlAtEntrypoint):
        (JSC::Wasm::B3IRGenerator::addLoop):
        (JSC::Wasm::B3IRGenerator::addTry):
        (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions):
        (JSC::Wasm::B3IRGenerator::emitCatchImpl):
        (JSC::Wasm::B3IRGenerator::addDelegateToUnreachable):
        (JSC::Wasm::B3IRGenerator::addThrow):
        (JSC::Wasm::B3IRGenerator::addRethrow):
        (JSC::Wasm::B3IRGenerator::addEndToUnreachable):
        (JSC::Wasm::B3IRGenerator::connectControlEntry): Deleted.
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::llintFunctionCodeBlock const):
        (JSC::Wasm::Callee::functionCodeBlock const): Deleted.
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::unifyValuesWithBlock):
        (JSC::Wasm::LLIntGenerator::addTry):
        (JSC::Wasm::LLIntGenerator::addThrow):
        (JSC::Wasm::LLIntGenerator::repatch): Deleted.
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmOperations.h:

2021-10-19  Alexey Proskuryakov  <ap@apple.com>

        Eagerly resolve python3 path in Makefiles
        https://bugs.webkit.org/show_bug.cgi?id=231979

        Reviewed by Jonathan Bedard.

        * DerivedSources.make:

2021-10-19  Saam Barati  <sbarati@apple.com>

        canDoFastSpread should also check that the Structure is from the global object we're watching
        https://bugs.webkit.org/show_bug.cgi?id=231976
        <rdar://84340372>

        Reviewed by Keith Miller.

        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::canDoFastSpread):

2021-10-19  Chris Dumez  <cdumez@apple.com>

        [clang 13] Suppress sign comparison warnings
        https://bugs.webkit.org/show_bug.cgi?id=231188
        <rdar://problem/84110570>

        Reviewed by Alex Christensen.

        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::backendCommands const):

2021-10-18  Yusuke Suzuki  <ysuzuki@apple.com>

        Wasm Table can take arbitrary default value
        https://bugs.webkit.org/show_bug.cgi?id=231933
        rdar://84327812

        Reviewed by Robin Morisset.

        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::grow):

2021-10-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix.

        * DerivedSources-input.xcfilelist:

2021-10-18  Phillip Mates  <pmates@igalia.com>

        shadow realms implementation
        https://bugs.webkit.org/show_bug.cgi?id=230602

        Reviewed by Yusuke Suzuki.

        Implementation of the Shadow Realms proposal (stage 3 in TC39) [1]

        Main APIs added are
         - `new ShadowRealm()`
           creates an object that has its own global object and module graph.
         - ShadowRealm.prototype.evaluate(sourceText)
           this allows for evaluating code in the context of the realm, which
           has its own module graph and global object.
         - ShadowRealm.prototype.importValue(specifier, exportName)
           this allows importing module exports in the the context of the
           realm, which has its own module graph and global object.

        The main detail of the Shadow Realm implementation is that values
        passed between realms must be either primitives or wrapped callables.
        Wrapped callables themselves are callables that check that their
        arguments and return values are also either primitives or wrapped
        callables. This detail is implemented via JS builtins + a few new
        intrinsics.

        Can be enabled using `--useShadowRealm=true`

        [1]: https://github.com/tc39/proposal-shadowrealm

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * builtins/BuiltinNames.h:
        * builtins/ShadowRealmPrototype.js: Added.
        (globalPrivate.wrap.wrapped):
        (globalPrivate.wrap):
        (evaluate):
        (importValue):
        * bytecode/BytecodeIntrinsicRegistry.h:
        * bytecode/LinkTimeConstant.h:
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::emitIsShadowRealm):
        * bytecompiler/NodesCodegen.cpp:
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseMemberExpression):
        * runtime/CommonIdentifiers.h:
        * runtime/IndirectEvalExecutable.cpp:
        (JSC::IndirectEvalExecutable::createImpl):
        (JSC::IndirectEvalExecutable::create):
        (JSC::IndirectEvalExecutable::tryCreate):
        * runtime/IndirectEvalExecutable.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        (JSC::JSGlobalObject::createWithCustomMethodTable):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::shadowRealmPrototype const):
        (JSC::JSGlobalObject::shadowRealmStructure const):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSType.cpp:
        (WTF::printInternal):
        * runtime/JSType.h:
        * runtime/OptionsList.h:
        * runtime/ShadowRealmConstructor.cpp: Added.
        (JSC::ShadowRealmConstructor::ShadowRealmConstructor):
        (JSC::ShadowRealmConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmConstructor.h: Added.
        * runtime/ShadowRealmObject.cpp: Added.
        (JSC::ShadowRealmObject::ShadowRealmObject):
        (JSC::ShadowRealmObject::visitChildrenImpl):
        (JSC::ShadowRealmObject::create):
        (JSC::ShadowRealmObject::finishCreation):
        * runtime/ShadowRealmObject.h: Added.
        * runtime/ShadowRealmPrototype.cpp: Added.
        (JSC::ShadowRealmPrototype::ShadowRealmPrototype):
        (JSC::ShadowRealmPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmPrototype.h: Added.
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-10-18  Saam Barati  <sbarati@apple.com>

        Don't load metadata base pointer in EXTRA_CTI_THUNKS
        https://bugs.webkit.org/show_bug.cgi?id=231850

        Reviewed by Yusuke Suzuki.

        We were loading the metadata table base pointer dynamically. But in
        unlinked baseline JIT, it's already pinned in a register. Let's just
        use the register instead of recomputing what's already there. This is
        a small speedup in throughput of unlinked baseline JIT code for scope
        operations.

        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::generateOpGetFromScopeThunk):

2021-10-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use USE(LARGE_TYPED_ARRAY)
        https://bugs.webkit.org/show_bug.cgi?id=231885

        Reviewed by Sam Weinig.

        Fix USE(ADDRESS64) with USE(LARGE_TYPED_ARRAY). USE(ADDRESS64) is not correct (it should be CPU(ADDRESS64)).
        It is coverted by JSTests/stress/typed-array-large-eventually-oob.js.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-10-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL
        https://bugs.webkit.org/show_bug.cgi?id=231884
        rdar://84357099

        Reviewed by Robin Morisset.

        The child5 of PutByVal should be KnownInt32Use or Int52RepUse.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

2021-10-16  Mark Lam  <mark.lam@apple.com>

        Make LLIntAssembly.h more readable.
        https://bugs.webkit.org/show_bug.cgi?id=231876

        Reviewed by Yusuki Suzuki.

        In this patch, I did the following:

        1. Changed `CodeOrigin` to only dump the filename, and not the full path.

        2. Deferred printing the ".loc" metadata in `$asm.debugAnnotation` till we format
           the line to dump in `$asm.formatDump`.  This enabled the ".loc" metadata to be
           dumped on the same line as the asm instruction.

        3. Changed `$asm.codeOrigin` to not dump multiple codeOrigin comments.  The only
           times when there appears to be "multiple" codeOrigins for any given instruction
           is if the instruction before it was elided, thereby leaving the elided
           instruction's codeOrigin to be mis-attributed to the subsequent instruction.

        4. Moved the MIPS `Assembler.putStr` method to asm.rb.  This method was already
           commonly used in arm.rb and arm64.rb previously.  Hence, it belongs in common
           code.

           Also enhanced it to support indenting by the column width of ".loc" debug
           annotations if `$enableDebugAnnotations` is true.  This keeps the ".loc" column
           on the left clear of other content, thereby making it easy to visually filter
           out that column when scanning through the generated asm code.

        5. Changed some code that called `outp.puts` directly to call `$asm.putStr` instead.
           This yields the nice alignment for easy visual filtering described in (4). 

        6. Changed `$preferredCommentStartColumn` to be at column 40 to make the generated
           asm code more compact.  However, if the backend is the C_LOOP, then change it
           back to 60 because C_LOOP code is more verbose and need the extra space.

        Demo time:
        Before this patch, LLIntAssembly.h looks like this:
        ```
        #if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT
        OFFLINE_ASM_BEGIN
        OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
        ".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
        ".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
        ".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
        ".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
        ".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
        ".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
        ".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"
        ".loc 1 1672\n"
            "\tbrk #0xc471\n"                                        // JavaScriptCore/llint/LowLevelInterpreter.asm:1672
        ".loc 1 1681\n"

        OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
        ".loc 1 1066\n"
            "\tpacibsp\n"                                            // JavaScriptCore/llint/LowLevelInterpreter.asm:1066
        ".loc 1 1070\n"
            "\tstp x29, x30, [sp, #-16]!\n"                          // JavaScriptCore/llint/LowLevelInterpreter.asm:1070
        ".loc 1 1075\n"
            "\tmov x29, sp\n"                                        // JavaScriptCore/llint/LowLevelInterpreter.asm:1075
        ".loc 1 1090\n"
            "\tsub sp, x29, #176\n"                                  // JavaScriptCore/llint/LowLevelInterpreter.asm:1090
        ".loc 3 169\n"
            "\tmovz x13, #48040, lsl #0\n"                           // JavaScriptCore/llint/LowLevelInterpreter64.asm:169
        ".loc 3 169\n"
            "\tadd x17, x1, x13, lsl #0\n"                           // JavaScriptCore/llint/LowLevelInterpreter64.asm:169
        ".loc 3 169\n"
            "\tldr w4, [x17, #0]\n"                                  // JavaScriptCore/llint/LowLevelInterpreter64.asm:169
        ".loc 3 170\n"
            "\tcbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntry__checkVMEntryPermission) "\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:170
        ".loc 3 172\n"
            "\tstr x1, [sp, #0]\n"                                   // JavaScriptCore/llint/LowLevelInterpreter64.asm:172

        ...

        ".loc 3 309\n"
            "\tmov x3, x0\n"                                         // JavaScriptCore/llint/LowLevelInterpreter64.asm:309
        ".loc 1 1\n"
        #if OS(DARWIN)
            "\tL_offlineasm_loh_adrp_1:\n"                           // JavaScriptCore/llint/LowLevelInterpreter.asm:1
            "\tadrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE\n"
            "\tL_offlineasm_loh_ldr_1:\n"
            "\tldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF]\n"
        #elif OS(LINUX)
            "\tadrp x2, :got:" LOCAL_REFERENCE(g_config) "\n"
            "\tldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "]\n"
        #else
        #error Missing globaladdr implementation
        #endif
        ".loc 1 1\n"
            "\tadd x2, x2, #3072\n"                                  // JavaScriptCore/llint/LowLevelInterpreter.asm:1
        ```

        After this patch, LLIntAssembly.h looks like this:
        ```
        #if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT

                          OFFLINE_ASM_BEGIN
                          OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
                          ".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
                          ".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
                          ".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
                          ".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
                          ".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
                          ".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
                          ".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"
        ".loc 1 1672\n"       "brk #0xc471 \n"                     // LowLevelInterpreter.asm:1672

        ".loc 1 1681\n"   OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
        ".loc 1 1066\n"       "pacibsp \n"                         // LowLevelInterpreter.asm:1066
        ".loc 1 1070\n"       "stp x29, x30, [sp, #-16]! \n"       // LowLevelInterpreter.asm:1070
        ".loc 1 1075\n"       "mov x29, sp \n"                     // LowLevelInterpreter.asm:1075
        ".loc 1 1090\n"       "sub sp, x29, #176 \n"               // LowLevelInterpreter.asm:1090
        ".loc 3 169\n"        "movz x13, #48040, lsl #0 \n"        // LowLevelInterpreter64.asm:169
                              "add x17, x1, x13, lsl #0 \n"
                              "ldr w4, [x17, #0] \n"
        ".loc 3 170\n"        "cbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntry__checkVMEntryPermission) " \n" // LowLevelInterpreter64.asm:170
        ".loc 3 172\n"        "str x1, [sp, #0] \n"                // LowLevelInterpreter64.asm:172

        ...

        ".loc 3 309\n"        "mov x3, x0 \n"                      // LowLevelInterpreter64.asm:309
                          #if OS(DARWIN)
        ".loc 1 1\n"          "L_offlineasm_loh_adrp_1: \n"        // LowLevelInterpreter.asm:1
                              "adrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE \n"
                              "L_offlineasm_loh_ldr_1: \n"
                              "ldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF] \n"
                          #elif OS(LINUX)
                              "adrp x2, :got:" LOCAL_REFERENCE(g_config) " \n"
                              "ldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "] \n"
                          #else
                          #error Missing globaladdr implementation
                          #endif
        ".loc 1 1\n"          "add x2, x2, #3072 \n"
        ```

        * offlineasm/asm.rb:
        * offlineasm/cloop.rb:
        * offlineasm/config.rb:
        * offlineasm/mips.rb:
        * offlineasm/parser.rb:

2021-10-16  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use SourceID in SamplingProfiler
        https://bugs.webkit.org/show_bug.cgi?id=231855

        Reviewed by Mark Lam.

        SamplingProfiler was still using intptr_t. We replace it with SourceID.
        We also define internalSourceID and aggregatedExternalSourceID in SourceID.h.
        They are special SourceID internally used in SamplingProfiler.

        * bytecode/SourceID.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::StackFrame::sourceID):
        (JSC::SamplingProfiler::reportTopFunctions):
        * runtime/SamplingProfiler.h:

2021-10-16  Robin Morisset  <rmorisset@apple.com>

        Allow WASM to use up to 4GB
        https://bugs.webkit.org/show_bug.cgi?id=229353
        rdar://81603447

        Reviewed by Yusuke Suzuki.

        While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work:
        - 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being size_t.
        - This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size.
            In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52)
        - Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number.
            I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples
        - In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52
        - I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B.
        - I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL.
            I then updated the runtime functions used by the slow paths to correctly update it.

        Unfortunately I ran out of time to add all the speculations/update all the fast paths.
        So the following will have to wait for a follow-up patch:
        - Accepting large indices in the fast path of GetByVal in the LLInt
        - Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess
        - Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX

        The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array.

        Other minor changes in this patch:
        - Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0)
        - Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues.
        - Fixed a variety of obsolete comments
        - Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right)
            (there was already support for the same but with TrustedImm64)
        - Made various AbstractMacroAssembler function constexpr as part of the previous point

        * assembler/AbstractMacroAssembler.cpp:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
        (JSC::AbstractMacroAssembler::Imm32::Imm32):
        (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const):
        (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
        (JSC::AbstractMacroAssembler::Imm64::Imm64):
        (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const):
        (JSC::AbstractMacroAssembler::canBlind):
        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::branch64):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
        (JSC::MacroAssemblerARM64::branch64):
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength64):
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted.
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::canBlind):
        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::needsScratchFPR const):
        (JSC::AccessCase::generateWithGuard):
        * bytecode/ArrayProfile.h:
        (JSC::ArrayProfile::setMayBeLargeTypedArray):
        (JSC::ArrayProfile::mayBeLargeTypedArray const):
        (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile):
        (JSC::UnlinkedArrayProfile::update):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::refine const):
        * dfg/DFGArrayMode.h:
        (JSC::DFG::ArrayMode::ArrayMode):
        (JSC::DFG::ArrayMode::mayBeLargeTypedArray const):
        (JSC::DFG::ArrayMode::withType const):
        (JSC::DFG::ArrayMode::withSpeculation const):
        (JSC::DFG::ArrayMode::withConversion const):
        (JSC::DFG::ArrayMode::withTypeAndConversion const):
        (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const):
        (JSC::DFG::ArrayMode::speculationFromProfile):
        (JSC::DFG::ArrayMode::withSpeculationFromProfile const):
        (JSC::DFG::ArrayMode::withProfile const):
        (JSC::DFG::ArrayMode::operator== const):
        (JSC::DFG::ArrayMode::withArrayClass const): Deleted.
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGCommon.h:
        (JSC::DFG::enableInt52):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::convertToGetArrayLength):
        (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.
        * dfg/DFGGenerationInfo.h:
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasStorageChild const):
        (JSC::DFG::Node::storageChildIndex):
        (JSC::DFG::Node::hasArrayMode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::newTypedArrayWithSize):
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
        (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGTypeCheckHoistingPhase.cpp:
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
        * dfg/DFGValidate.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::load64NonNegative):
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITOperations.cpp:
        (JSC::putByVal):
        (JSC::getByVal):
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::getByVal):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArrayBuffer.cpp:
        (JSC::SharedArrayBufferContents::SharedArrayBufferContents):
        (JSC::ArrayBufferContents::ArrayBufferContents):
        (JSC::ArrayBufferContents::tryAllocate):
        (JSC::ArrayBuffer::create):
        (JSC::ArrayBuffer::createAdopted):
        (JSC::ArrayBuffer::createFromBytes):
        (JSC::ArrayBuffer::tryCreate):
        (JSC::ArrayBuffer::createUninitialized):
        (JSC::ArrayBuffer::tryCreateUninitialized):
        (JSC::ArrayBuffer::createInternal):
        (JSC::ArrayBuffer::clampValue):
        (JSC::ArrayBuffer::clampIndex const):
        (JSC::ArrayBuffer::sliceWithClampedIndex const):
        * runtime/ArrayBuffer.h:
        (JSC::ArrayBufferContents::sizeInBytes const):
        (JSC::ArrayBuffer::byteLength const):
        (JSC::ArrayBuffer::gcSizeEstimateInBytes const):
        * runtime/ArrayBufferView.cpp:
        (JSC::ArrayBufferView::ArrayBufferView):
        * runtime/ArrayBufferView.h:
        (JSC::ArrayBufferView::byteOffset const):
        (JSC::ArrayBufferView::byteLength const):
        (JSC::ArrayBufferView::verifyByteOffsetAlignment):
        (JSC::ArrayBufferView::verifySubRangeLength):
        (JSC::ArrayBufferView::clampOffsetAndNumElements):
        (JSC::ArrayBufferView::setImpl):
        (JSC::ArrayBufferView::setRangeImpl):
        (JSC::ArrayBufferView::getRangeImpl):
        (JSC::ArrayBufferView::zeroRangeImpl):
        (JSC::ArrayBufferView::calculateOffsetAndLength): Deleted.
        * runtime/AtomicsObject.cpp:
        * runtime/DataView.cpp:
        (JSC::DataView::DataView):
        (JSC::DataView::create):
        * runtime/DataView.h:
        * runtime/GenericTypedArrayView.h:
        * runtime/GenericTypedArrayViewInlines.h:
        (JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView):
        (JSC::GenericTypedArrayView<Adaptor>::create):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreate):
        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::subarray const): Deleted.
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        (JSC::JSArrayBufferView::byteLength const):
        (JSC::JSArrayBufferView::slowDownAndWasteMemory):
        (JSC::JSArrayBufferView::possiblySharedImpl):
        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::sizeOf):
        (JSC::JSArrayBufferView::ConstructionContext::length const):
        (JSC::JSArrayBufferView::length const):
        * runtime/JSArrayBufferViewInlines.h:
        (JSC::JSArrayBufferView::byteOffsetImpl):
        (JSC::JSArrayBufferView::byteOffset):
        (JSC::JSArrayBufferView::byteOffsetConcurrently):
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::toIndex const):
        (JSC::JSValue::toTypedArrayIndex const):
        * runtime/JSDataView.cpp:
        (JSC::JSDataView::create):
        (JSC::JSDataView::createUninitialized):
        (JSC::JSDataView::set):
        (JSC::JSDataView::setIndex):
        * runtime/JSDataView.h:
        * runtime/JSDataViewPrototype.cpp:
        (JSC::getData):
        (JSC::setData):
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::constructGenericTypedArrayViewWithArguments):
        (JSC::constructGenericTypedArrayViewImpl):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::create):
        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
        (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::tryGetIndexQuickly const):
        (JSC::JSObject::trySetIndexQuickly):
        (JSC::JSObject::canSetIndexQuickly): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getIndexQuicklyForTypedArray const):
        (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType):
        (JSC::JSObject::trySetIndexQuicklyForTypedArray):
        (JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted.
        * runtime/Operations.h:
        (JSC::getByValWithIndex):
        * wasm/WasmPageCount.h:

2021-10-15  Ross Kirsling  <ross.kirsling@sony.com>

        Realize Mac CMake build of WebCore and WebKit
        https://bugs.webkit.org/show_bug.cgi?id=231749

        Reviewed by Alex Christensen.

        * PlatformMac.cmake:
        * shell/PlatformMac.cmake:

2021-10-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize Structure::getConcurrently
        https://bugs.webkit.org/show_bug.cgi?id=231825

        Reviewed by Filip Pizlo.

        From artrace data, we found that Structure::getConcurrently is taking fair amount of time
        in Speedometer2 *in the main thread*! This is because Structure::getConcurrently is used
        in PropertyCondition, and its validation can be called in the main thread when watched
        Structure transition happens, ObjectPropertyConditionSet is created for IC etc.

        Structure::getConcurrently is slow since it is using Structure::forEachPropertyConcurrently.
        We can optimize Structure::getConcurrently since,

            1. We do not need to track seen properties via seenProperties HashSet.
            2. We can handle TransitionKind::PropertyDeletion.
            3. We can use PropertyTable::get.

        We are seeing consistent 0.4% improvement in Speedometer2 (I ran 120 Speedometer2 runs twice and both said 0.4% improvement).

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |106.201667   |106.030000   |0.998384  | 0.666695                                         |
        | VueJS-TodoMVC                        |21.955000    |21.985000    |1.001366  | 0.898294                                         |
        | EmberJS-TodoMVC                      |120.720000   |119.938333   |0.993525  | 0.055063                                         |
        | BackboneJS-TodoMVC                   |40.306667    |40.023333    |0.992971  | 0.054858                                         |
        | Preact-TodoMVC                       |16.273333    |15.968333    |0.981258  | 0.135893                                         |
        | AngularJS-TodoMVC                    |123.325000   |122.596667   |0.994094  | 0.079212                                         |
        | Vanilla-ES2015-TodoMVC               |60.116667    |60.168333    |1.000859  | 0.691981                                         |
        | Inferno-TodoMVC                      |58.945000    |58.538333    |0.993101  | 0.155753                                         |
        | Flight-TodoMVC                       |57.846667    |57.808333    |0.999337  | 0.868408                                         |
        | Angular2-TypeScript-TodoMVC          |38.595000    |38.260000    |0.991320  | 0.392602                                         |
        | VanillaJS-TodoMVC                    |50.316667    |50.185000    |0.997383  | 0.609335                                         |
        | jQuery-TodoMVC                       |208.376667   |208.933333   |1.002671  | 0.196406                                         |
        | EmberJS-Debug-TodoMVC                |338.481667   |336.755000   |0.994899  | 0.007485                                         |
        | React-TodoMVC                        |82.533333    |82.091667    |0.994649  | 0.037482                                         |
        | React-Redux-TodoMVC                  |133.703333   |133.258333   |0.996672  | 0.069242                                         |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.346667    |59.600000    |1.004269  | 0.203370                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 282.95715
        b mean = 284.07606
        pValue = 0.0013877157
        (Bigger means are better.)
        1.004 times better
        Results ARE significant

        * runtime/Structure.cpp:
        (JSC::Structure::getConcurrently):

2021-10-15  Geza Lore  <glore@igalia.com>

        [JSC][32bit] Fix CSR restore on DFG tail calls, add extra register on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=230622

        Reviewed by Saam Barati.

        This patch does two things:

        1. Adds an extra callee save register (CSR) to be available to DFG on
        ARMv7. To do this properly required the following:

        2. Implements the necessary shuffling in CallFrameShuffler on 32-bit
        architectures that is required to restore CSRs properly after a tail
        call on these architectures. This also fixes the remaining failures in
        the 32-bit build of the unlinked baseline JIT.

        * bytecode/ValueRecovery.cpp:
        (JSC::ValueRecovery::dumpInContext const):
        * bytecode/ValueRecovery.h:
        (JSC::ValueRecovery::calleeSaveRegDisplacedInJSStack):
        (JSC::ValueRecovery::isInJSStack const):
        (JSC::ValueRecovery::dataFormat const):
        (JSC::ValueRecovery::withLocalsOffset const):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * jit/CachedRecovery.cpp:
        (JSC::CachedRecovery::loadsIntoGPR const):
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
        * jit/CallFrameShuffleData.h:
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::CallFrameShuffler):
        * jit/CallFrameShuffler.h:
        (JSC::CallFrameShuffler::snapshot const):
        (JSC::CallFrameShuffler::addNew):
        * jit/CallFrameShuffler32_64.cpp:
        (JSC::CallFrameShuffler::emitLoad):
        (JSC::CallFrameShuffler::emitDisplace):
        * jit/GPRInfo.h:
        (JSC::GPRInfo::toRegister):
        (JSC::GPRInfo::toIndex):
        * jit/RegisterSet.cpp:
        (JSC::RegisterSet::dfgCalleeSaveRegisters):
        * llint/LowLevelInterpreter32_64.asm:

2021-10-15  Robin Morisset  <rmorisset@apple.com>

        Revert r284230, my last fixes to the watch build make it break tests
        https://bugs.webkit.org/show_bug.cgi?id=231797

        Unreviewed.

        Revert "Allow WASM to use up to 4GB"

        * assembler/AbstractMacroAssembler.cpp:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
        (JSC::AbstractMacroAssembler::Imm32::Imm32):
        (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const):
        (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
        (JSC::AbstractMacroAssembler::Imm64::Imm64):
        (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const):
        (JSC::AbstractMacroAssembler::canBlind):
        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::and64):
        (JSC::MacroAssembler::branch64): Deleted.
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength32):
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength64): Deleted.
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::canBlind):
        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::needsScratchFPR const):
        (JSC::AccessCase::generateWithGuard):
        * bytecode/ArrayProfile.h:
        (JSC::UnlinkedArrayProfile::update):
        (JSC::ArrayProfile::setMayBeLargeTypedArray): Deleted.
        (JSC::ArrayProfile::mayBeLargeTypedArray const): Deleted.
        (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::refine const):
        * dfg/DFGArrayMode.h:
        (JSC::DFG::ArrayMode::ArrayMode):
        (JSC::DFG::ArrayMode::action const):
        (JSC::DFG::ArrayMode::withSpeculation const):
        (JSC::DFG::ArrayMode::withArrayClass const):
        (JSC::DFG::ArrayMode::withSpeculationFromProfile const):
        (JSC::DFG::ArrayMode::withProfile const):
        (JSC::DFG::ArrayMode::withType const):
        (JSC::DFG::ArrayMode::withConversion const):
        (JSC::DFG::ArrayMode::withTypeAndConversion const):
        (JSC::DFG::ArrayMode::operator== const):
        (JSC::DFG::ArrayMode::mayBeLargeTypedArray const): Deleted.
        (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const): Deleted.
        (JSC::DFG::ArrayMode::speculationFromProfile): Deleted.
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGCommon.h:
        (JSC::DFG::enableInt52):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::prependGetArrayLength):
        * dfg/DFGGenerationInfo.h:
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasStorageChild const):
        (JSC::DFG::Node::storageChildIndex):
        (JSC::DFG::Node::hasArrayMode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::newTypedArrayWithSize):
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
        (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
        (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): Deleted.
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): Deleted.
        * dfg/DFGTypeCheckHoistingPhase.cpp:
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
        * dfg/DFGValidate.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): Deleted.
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::load32NonNegative):
        (JSC::FTL::Output::load64NonNegative): Deleted.
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITOperations.cpp:
        (JSC::putByVal):
        (JSC::getByVal):
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::getByVal):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArrayBuffer.cpp:
        (JSC::SharedArrayBufferContents::SharedArrayBufferContents):
        (JSC::ArrayBufferContents::ArrayBufferContents):
        (JSC::ArrayBufferContents::tryAllocate):
        (JSC::ArrayBuffer::create):
        (JSC::ArrayBuffer::createAdopted):
        (JSC::ArrayBuffer::createFromBytes):
        (JSC::ArrayBuffer::tryCreate):
        (JSC::ArrayBuffer::createUninitialized):
        (JSC::ArrayBuffer::tryCreateUninitialized):
        (JSC::ArrayBuffer::createInternal):
        (JSC::ArrayBuffer::clampValue):
        (JSC::ArrayBuffer::clampIndex const):
        (JSC::ArrayBuffer::sliceWithClampedIndex const):
        * runtime/ArrayBuffer.h:
        (JSC::ArrayBufferContents::sizeInBytes const):
        (JSC::ArrayBuffer::byteLength const):
        (JSC::ArrayBuffer::gcSizeEstimateInBytes const):
        * runtime/ArrayBufferView.cpp:
        (JSC::ArrayBufferView::ArrayBufferView):
        * runtime/ArrayBufferView.h:
        (JSC::ArrayBufferView::byteOffset const):
        (JSC::ArrayBufferView::byteLength const):
        (JSC::ArrayBufferView::verifyByteOffsetAlignment):
        (JSC::ArrayBufferView::verifySubRangeLength):
        (JSC::ArrayBufferView::clampOffsetAndNumElements):
        (JSC::ArrayBufferView::setImpl):
        (JSC::ArrayBufferView::setRangeImpl):
        (JSC::ArrayBufferView::getRangeImpl):
        (JSC::ArrayBufferView::zeroRangeImpl):
        (JSC::ArrayBufferView::calculateOffsetAndLength):
        * runtime/AtomicsObject.cpp:
        * runtime/DataView.cpp:
        (JSC::DataView::DataView):
        (JSC::DataView::create):
        * runtime/DataView.h:
        * runtime/GenericTypedArrayView.h:
        * runtime/GenericTypedArrayViewInlines.h:
        (JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView):
        (JSC::GenericTypedArrayView<Adaptor>::create):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreate):
        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::subarray const):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        (JSC::JSArrayBufferView::byteLength const):
        (JSC::JSArrayBufferView::slowDownAndWasteMemory):
        (JSC::JSArrayBufferView::possiblySharedImpl):
        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::sizeOf):
        (JSC::JSArrayBufferView::ConstructionContext::length const):
        (JSC::JSArrayBufferView::length const):
        * runtime/JSArrayBufferViewInlines.h:
        (JSC::JSArrayBufferView::byteOffsetImpl):
        (JSC::JSArrayBufferView::byteOffset):
        (JSC::JSArrayBufferView::byteOffsetConcurrently):
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::toIndex const):
        (JSC::JSValue::toTypedArrayIndex const): Deleted.
        * runtime/JSDataView.cpp:
        (JSC::JSDataView::create):
        (JSC::JSDataView::createUninitialized):
        (JSC::JSDataView::set):
        (JSC::JSDataView::setIndex):
        * runtime/JSDataView.h:
        * runtime/JSDataViewPrototype.cpp:
        (JSC::getData):
        (JSC::setData):
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::constructGenericTypedArrayViewWithArguments):
        (JSC::constructGenericTypedArrayViewImpl):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::create):
        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
        (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::tryGetIndexQuickly const):
        (JSC::JSObject::canSetIndexQuickly):
        (JSC::JSObject::trySetIndexQuickly): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::canSetIndexQuicklyForTypedArray const):
        (JSC::JSObject::getIndexQuicklyForTypedArray const):
        (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType): Deleted.
        (JSC::JSObject::trySetIndexQuicklyForTypedArray): Deleted.
        * runtime/Operations.h:
        (JSC::getByValWithIndex):
        * wasm/WasmPageCount.h:

2021-10-14  Robin Morisset  <rmorisset@apple.com>

        Allow WASM to use up to 4GB
        https://bugs.webkit.org/show_bug.cgi?id=229353
        rdar://81603447

        Reviewed by Yusuke Suzuki.

        While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work:
        - 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being size_t.
        - This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size.
            In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52)
        - Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number.
            I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples
        - In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52
        - I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B.
        - I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL.
            I then updated the runtime functions used by the slow paths to correctly update it.

        Unfortunately I ran out of time to add all the speculations/update all the fast paths.
        So the following will have to wait for a follow-up patch:
        - Accepting large indices in the fast path of GetByVal in the LLInt
        - Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess
        - Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX

        The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array.

        Other minor changes in this patch:
        - Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0)
        - Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues.
        - Fixed a variety of obsolete comments
        - Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right)
            (there was already support for the same but with TrustedImm64)
        - Made various AbstractMacroAssembler function constexpr as part of the previous point

        * assembler/AbstractMacroAssembler.cpp:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
        (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
        (JSC::AbstractMacroAssembler::Imm32::Imm32):
        (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const):
        (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
        (JSC::AbstractMacroAssembler::Imm64::Imm64):
        (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const):
        (JSC::AbstractMacroAssembler::canBlind):
        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::branch64):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
        (JSC::MacroAssemblerARM64::branch64):
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength64):
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted.
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::canBlind):
        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::needsScratchFPR const):
        (JSC::AccessCase::generateWithGuard):
        * bytecode/ArrayProfile.h:
        (JSC::ArrayProfile::setMayBeLargeTypedArray):
        (JSC::ArrayProfile::mayBeLargeTypedArray const):
        (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile):
        (JSC::UnlinkedArrayProfile::update):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::refine const):
        * dfg/DFGArrayMode.h:
        (JSC::DFG::ArrayMode::ArrayMode):
        (JSC::DFG::ArrayMode::mayBeLargeTypedArray const):
        (JSC::DFG::ArrayMode::withType const):
        (JSC::DFG::ArrayMode::withSpeculation const):
        (JSC::DFG::ArrayMode::withConversion const):
        (JSC::DFG::ArrayMode::withTypeAndConversion const):
        (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const):
        (JSC::DFG::ArrayMode::speculationFromProfile):
        (JSC::DFG::ArrayMode::withSpeculationFromProfile const):
        (JSC::DFG::ArrayMode::withProfile const):
        (JSC::DFG::ArrayMode::operator== const):
        (JSC::DFG::ArrayMode::withArrayClass const): Deleted.
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGCommon.h:
        (JSC::DFG::enableInt52):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::convertToGetArrayLength):
        (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.
        * dfg/DFGGenerationInfo.h:
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasStorageChild const):
        (JSC::DFG::Node::storageChildIndex):
        (JSC::DFG::Node::hasArrayMode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::newTypedArrayWithSize):
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
        (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGTypeCheckHoistingPhase.cpp:
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
        * dfg/DFGValidate.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::load64NonNegative):
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITOperations.cpp:
        (JSC::putByVal):
        (JSC::getByVal):
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::getByVal):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArrayBuffer.cpp:
        (JSC::SharedArrayBufferContents::SharedArrayBufferContents):
        (JSC::ArrayBufferContents::ArrayBufferContents):
        (JSC::ArrayBufferContents::tryAllocate):
        (JSC::ArrayBuffer::create):
        (JSC::ArrayBuffer::createAdopted):
        (JSC::ArrayBuffer::createFromBytes):
        (JSC::ArrayBuffer::tryCreate):
        (JSC::ArrayBuffer::createUninitialized):
        (JSC::ArrayBuffer::tryCreateUninitialized):
        (JSC::ArrayBuffer::createInternal):
        (JSC::ArrayBuffer::clampValue):
        (JSC::ArrayBuffer::clampIndex const):
        (JSC::ArrayBuffer::sliceWithClampedIndex const):
        * runtime/ArrayBuffer.h:
        (JSC::ArrayBufferContents::sizeInBytes const):
        (JSC::ArrayBuffer::byteLength const):
        (JSC::ArrayBuffer::gcSizeEstimateInBytes const):
        * runtime/ArrayBufferView.cpp:
        (JSC::ArrayBufferView::ArrayBufferView):
        * runtime/ArrayBufferView.h:
        (JSC::ArrayBufferView::byteOffset const):
        (JSC::ArrayBufferView::byteLength const):
        (JSC::ArrayBufferView::verifyByteOffsetAlignment):
        (JSC::ArrayBufferView::verifySubRangeLength):
        (JSC::ArrayBufferView::clampOffsetAndNumElements):
        (JSC::ArrayBufferView::setImpl):
        (JSC::ArrayBufferView::setRangeImpl):
        (JSC::ArrayBufferView::getRangeImpl):
        (JSC::ArrayBufferView::zeroRangeImpl):
        (JSC::ArrayBufferView::calculateOffsetAndLength): Deleted.
        * runtime/AtomicsObject.cpp:
        * runtime/DataView.cpp:
        (JSC::DataView::DataView):
        (JSC::DataView::create):
        * runtime/DataView.h:
        * runtime/GenericTypedArrayView.h:
        * runtime/GenericTypedArrayViewInlines.h:
        (JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView):
        (JSC::GenericTypedArrayView<Adaptor>::create):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreate):
        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized):
        (JSC::GenericTypedArrayView<Adaptor>::subarray const): Deleted.
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        (JSC::JSArrayBufferView::byteLength const):
        (JSC::JSArrayBufferView::slowDownAndWasteMemory):
        (JSC::JSArrayBufferView::possiblySharedImpl):
        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::sizeOf):
        (JSC::JSArrayBufferView::ConstructionContext::length const):
        (JSC::JSArrayBufferView::length const):
        * runtime/JSArrayBufferViewInlines.h:
        (JSC::JSArrayBufferView::byteOffsetImpl):
        (JSC::JSArrayBufferView::byteOffset):
        (JSC::JSArrayBufferView::byteOffsetConcurrently):
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::toIndex const):
        (JSC::JSValue::toTypedArrayIndex const):
        * runtime/JSDataView.cpp:
        (JSC::JSDataView::create):
        (JSC::JSDataView::createUninitialized):
        (JSC::JSDataView::set):
        (JSC::JSDataView::setIndex):
        * runtime/JSDataView.h:
        * runtime/JSDataViewPrototype.cpp:
        (JSC::getData):
        (JSC::setData):
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::constructGenericTypedArrayViewWithArguments):
        (JSC::constructGenericTypedArrayViewImpl):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::create):
        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
        (JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
        (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::tryGetIndexQuickly const):
        (JSC::JSObject::trySetIndexQuickly):
        (JSC::JSObject::canSetIndexQuickly): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getIndexQuicklyForTypedArray const):
        (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType):
        (JSC::JSObject::trySetIndexQuicklyForTypedArray):
        (JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted.
        * runtime/Operations.h:
        (JSC::getByValWithIndex):
        * wasm/WasmPageCount.h:

2021-10-14  Saam Barati  <sbarati@apple.com>

        Make unlinked Baseline JIT scope operations bias the order of checks to the ResolveType that profiling tells us we are likely to be
        https://bugs.webkit.org/show_bug.cgi?id=231715

        Reviewed by Yusuke Suzuki.

        This is a small throughout win in the code generated by unlinked baseline JIT.

        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::emit_op_put_to_scope):

2021-10-14  Alex Christensen  <achristensen@webkit.org>

        Remove Variant.h
        https://bugs.webkit.org/show_bug.cgi?id=231744

        Reviewed by Darin Adler.

        * jit/AssemblyHelpers.h:
        * jit/SnippetReg.h:
        * parser/Lexer.cpp:
        * parser/VariableEnvironment.h:
        * runtime/BytecodeCacheError.h:
        * runtime/CachePayload.h:
        * runtime/CacheUpdate.h:
        * runtime/TemporalObject.h:
        * runtime/TemporalTimeZone.h:
        * wasm/WasmLLIntGenerator.cpp:

2021-10-14  Tadeu Zagallo  <tzagallo@apple.com>

        Wasm LLInt should zero bytecodeIndex before throwing
        https://bugs.webkit.org/show_bug.cgi?id=231688
        <rdar://84207898>

        Reviewed by Yusuke Suzuki.

        After r283852, the unwinder can now ask WebAssembly frames for their bytecodeIndex.
        We do write to the bytecodeIndex when throwing from the wasm `throw` opcode, but we
        failed to write when trapping (e.g.  throwing an OOB or Unreachable). The value of
        the bytecodeIndex in this is case is not interesting, since these exceptions can't be
        caught from Wasm, all we need to know is ensure there isn't an invalid left-over
        value in that stack slot, so we zero it.

        * llint/WebAssembly.asm:

2021-10-14  Myles C. Maxfield  <mmaxfield@apple.com>

        All the SDKVariant.xcconfig files should match
        https://bugs.webkit.org/show_bug.cgi?id=231663

        Reviewed by Youenn Fablet.

        The linter says they're all supposed to match.
        Source/ThirdParty/libwebrtc/Configurations/SDKVariant.xcconfig has an extra section,
        and if you delete that section the build fails, so this patch broadcasts that extra
        section to all the other SDKVariant.xcconfig files.

        * Configurations/SDKVariant.xcconfig:

2021-10-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix with recent SDKs.

        Use std::invoke_result<> instead of std::result_of<>, as it was deprecated in C++17.

        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::getPropertySlot const):
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getPropertySlot const):
        * runtime/ParseInt.h:
        (JSC::toStringView):

2021-10-14  Zan Dobersek  <zdobersek@igalia.com>

        [RISCV64] Support logical operations with immediates on BaseIndex addresses in LLInt
        https://bugs.webkit.org/show_bug.cgi?id=231734

        Reviewed by Yusuke Suzuki.

        RISCV64 offlineasm implementation gains support for performing logical
        operations with immediate values on BaseIndex adresses, fixing the build
        and bringing things back into operational state.

        For this to function properly, BaseIndex loading is reworked so that no
        additional scratch register is necessary for computing the target
        address.

        * offlineasm/riscv64.rb:

2021-10-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r284151.
        https://bugs.webkit.org/show_bug.cgi?id=231740

        WTR

        Reverted changeset:

        "Test coverage for JSC shadow realms implementation"
        https://bugs.webkit.org/show_bug.cgi?id=230602
        https://commits.webkit.org/r284151

2021-10-14  Phillip Mates  <pmates@igalia.com>

        shadow realms implementation
        https://bugs.webkit.org/show_bug.cgi?id=230602

        Reviewed by Yusuke Suzuki.

        Implementation of the Shadow Realms proposal (stage 3 in TC39) [1]

        Main APIs added are
         - `new ShadowRealm()`
           creates an object that has its own global object and module graph.
         - ShadowRealm.prototype.evaluate(sourceText)
           this allows for evaluating code in the context of the realm, which
           has its own module graph and global object.
         - ShadowRealm.prototype.importValue(specifier, exportName)
           this allows importing module exports in the the context of the
           realm, which has its own module graph and global object.

        The main detail of the Shadow Realm implementation is that values
        passed between realms must be either primitives or wrapped callables.
        Wrapped callables themselves are callables that check that their
        arguments and return values are also either primitives or wrapped
        callables. This detail is implemented via JS builtins + a few new
        intrinsics.

        Can be enabled using `--useShadowRealm=true`

        [1]: https://github.com/tc39/proposal-shadowrealm

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * builtins/BuiltinNames.h:
        * builtins/ShadowRealmPrototype.js: Added.
        (globalPrivate.wrap.wrapped):
        (globalPrivate.wrap):
        (evaluate):
        (importValue):
        * bytecode/BytecodeIntrinsicRegistry.h:
        * bytecode/LinkTimeConstant.h:
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::emitIsShadowRealm):
        * bytecompiler/NodesCodegen.cpp:
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseMemberExpression):
        * runtime/CommonIdentifiers.h:
        * runtime/IndirectEvalExecutable.cpp:
        (JSC::IndirectEvalExecutable::createImpl):
        (JSC::IndirectEvalExecutable::create):
        (JSC::IndirectEvalExecutable::tryCreate):
        * runtime/IndirectEvalExecutable.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        (JSC::JSGlobalObject::createWithCustomMethodTable):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::shadowRealmPrototype const):
        (JSC::JSGlobalObject::shadowRealmStructure const):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSType.cpp:
        (WTF::printInternal):
        * runtime/JSType.h:
        * runtime/OptionsList.h:
        * runtime/ShadowRealmConstructor.cpp: Added.
        (JSC::ShadowRealmConstructor::ShadowRealmConstructor):
        (JSC::ShadowRealmConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmConstructor.h: Added.
        * runtime/ShadowRealmObject.cpp: Added.
        (JSC::ShadowRealmObject::ShadowRealmObject):
        (JSC::ShadowRealmObject::visitChildrenImpl):
        (JSC::ShadowRealmObject::create):
        (JSC::ShadowRealmObject::finishCreation):
        * runtime/ShadowRealmObject.h: Added.
        * runtime/ShadowRealmPrototype.cpp: Added.
        (JSC::ShadowRealmPrototype::ShadowRealmPrototype):
        (JSC::ShadowRealmPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ShadowRealmPrototype.h: Added.
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-10-13  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, speculative build fix with new clang

        Speculative since I cannot install this clang now.

        * b3/B3ValueRep.h:

2021-10-13  Jean-Yves Avenard  <jya@apple.com>

        Clearly distinguish serial from concurrent WorkQueue
        https://bugs.webkit.org/show_bug.cgi?id=231418
        rdar://problem/84021977

        Reviewed by Chris Dumez.

        Replace instances of WorkQueue being constructed as a concurrent one
        with ConcurrentWorkQueue.
        Remove the now unnecessary use of WorkQueue::Type::Serial in constructor.

        * jit/ExecutableAllocator.cpp:
        (JSC::dumpJITMemory):
        * runtime/Watchdog.cpp:
        (JSC::Watchdog::Watchdog):

2021-10-13  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, build fix with new clang

        * wasm/WasmValueLocation.h:

2021-10-13  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Update adjusted thread numbers
        https://bugs.webkit.org/show_bug.cgi?id=231696

        Reviewed by Saam Barati.

        This adjusted numbers were empirically obtained at that time.
        But after that, we switched bmalloc to libpas in ARM64 macOS
        so that we removed scalability bottleneck in concurrent compilers.

        We evaluated and adjusted the configuration again.

        It improves Speedometer2 by 0.9% and JetStream2 by 0.7%.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |116.361667   |115.145000   |0.989544  | 0.000869 (significant)                           |
        | VueJS-TodoMVC                        |23.195000    |22.483333    |0.969318  | 0.002243 (significant)                           |
        | EmberJS-TodoMVC                      |124.720000   |121.211667   |0.971870  | 0.000000 (significant)                           |
        | BackboneJS-TodoMVC                   |43.923333    |43.771667    |0.996547  | 0.338425                                         |
        | Preact-TodoMVC                       |16.791667    |17.013333    |1.013201  | 0.337214                                         |
        | AngularJS-TodoMVC                    |129.860000   |128.475000   |0.989335  | 0.000838 (significant)                           |
        | Vanilla-ES2015-TodoMVC               |61.703333    |61.625000    |0.998730  | 0.534118                                         |
        | Inferno-TodoMVC                      |62.638333    |62.101667    |0.991432  | 0.045766                                         |
        | Flight-TodoMVC                       |63.878333    |63.723333    |0.997574  | 0.578999                                         |
        | Angular2-TypeScript-TodoMVC          |41.601667    |40.015000    |0.961861  | 0.000070 (significant)                           |
        | VanillaJS-TodoMVC                    |51.065000    |50.830000    |0.995398  | 0.284824                                         |
        | jQuery-TodoMVC                       |213.223333   |212.976667   |0.998843  | 0.536898                                         |
        | EmberJS-Debug-TodoMVC                |333.051667   |331.588333   |0.995606  | 0.032867                                         |
        | React-TodoMVC                        |82.665000    |82.540000    |0.998488  | 0.542365                                         |
        | React-Redux-TodoMVC                  |134.823333   |133.665000   |0.991409  | 0.000002 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.983333    |59.941667    |0.999305  | 0.700077                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 271.53654
        b mean = 274.08757
        pValue = 0.0000000000
        (Bigger means are better.)
        1.009 times better
        Results ARE significant

        -------------------------------------------------------------------------------------------------------------------------
        |          subtest          |     pts      |     pts      |  b / a   | pValue (significance using False Discovery Rate) |
        -------------------------------------------------------------------------------------------------------------------------
        | gaussian-blur             |545.633826    |544.387097    |0.997715  | 0.632889                                         |
        | HashSet-wasm              |47.725969     |53.977426     |1.130986  | 0.014208                                         |
        | gcc-loops-wasm            |46.592278     |45.484195     |0.976217  | 0.188166                                         |
        | json-parse-inspector      |252.822356    |254.060654    |1.004898  | 0.261381                                         |
        | prepack-wtb               |60.534710     |60.580410     |1.000755  | 0.932640                                         |
        | date-format-xparb-SP      |445.456679    |450.988456    |1.012418  | 0.563115                                         |
        | WSL                       |1.814989      |1.806757      |0.995464  | 0.035202                                         |
        | OfflineAssembler          |191.018184    |191.527453    |1.002666  | 0.512619                                         |
        | cdjs                      |194.872003    |197.611972    |1.014060  | 0.006522                                         |
        | UniPoker                  |522.254384    |520.751124    |0.997122  | 0.738800                                         |
        | json-stringify-inspector  |272.090046    |269.563607    |0.990715  | 0.156680                                         |
        | crypto-sha1-SP            |788.203441    |786.796976    |0.998216  | 0.889433                                         |
        | Basic                     |705.357988    |704.506995    |0.998794  | 0.851524                                         |
        | chai-wtb                  |108.246674    |109.283047    |1.009574  | 0.313095                                         |
        | crypto-aes-SP             |716.467647    |722.010176    |1.007736  | 0.589988                                         |
        | Babylon                   |669.393771    |670.186691    |1.001185  | 0.908244                                         |
        | string-unpack-code-SP     |400.848798    |397.690936    |0.992122  | 0.379538                                         |
        | stanford-crypto-aes       |448.517790    |450.916593    |1.005348  | 0.421547                                         |
        | raytrace                  |834.526654    |876.061864    |1.049771  | 0.000000 (significant)                           |
        | multi-inspector-code-load |398.195009    |400.638554    |1.006137  | 0.624663                                         |
        | hash-map                  |588.390020    |593.336508    |1.008407  | 0.032313                                         |
        | stanford-crypto-pbkdf2    |705.031717    |714.947310    |1.014064  | 0.451490                                         |
        | coffeescript-wtb          |41.104563     |41.590079     |1.011812  | 0.104485                                         |
        | Box2D                     |457.517551    |457.676651    |1.000348  | 0.938025                                         |
        | lebab-wtb                 |63.284589     |63.746412     |1.007298  | 0.021550                                         |
        | tsf-wasm                  |121.000104    |116.584889    |0.963511  | 0.566993                                         |
        | base64-SP                 |627.310289    |631.360337    |1.006456  | 0.380323                                         |
        | navier-stokes             |717.211598    |715.546883    |0.997679  | 0.776740                                         |
        | jshint-wtb                |52.822264     |53.067727     |1.004647  | 0.265734                                         |
        | regex-dna-SP              |444.626036    |444.565652    |0.999864  | 0.981250                                         |
        | async-fs                  |232.138408    |234.088380    |1.008400  | 0.084059                                         |
        | crypto-md5-SP             |738.555352    |739.048809    |1.000668  | 0.936794                                         |
        | first-inspector-code-load |272.911902    |274.186589    |1.004671  | 0.223172                                         |
        | segmentation              |53.421830     |53.253527     |0.996850  | 0.488595                                         |
        | typescript                |26.619459     |26.404921     |0.991941  | 0.021613                                         |
        | octane-code-load          |1229.345392   |1238.504125   |1.007450  | 0.273224                                         |
        | float-mm.c                |17.443005     |17.474949     |1.001831  | 0.160549                                         |
        | quicksort-wasm            |472.609429    |490.175315    |1.037168  | 0.134603                                         |
        | Air                       |420.285523    |422.507814    |1.005288  | 0.535574                                         |
        | splay                     |472.850630    |484.805521    |1.025283  | 0.202943                                         |
        | ai-astar                  |663.547782    |684.429114    |1.031469  | 0.035910                                         |
        | acorn-wtb                 |68.978436     |69.675311     |1.010103  | 0.085505                                         |
        | gbemu                     |159.998563    |154.256612    |0.964112  | 0.052665                                         |
        | richards                  |957.006036    |970.082604    |1.013664  | 0.080437                                         |
        | 3d-cube-SP                |539.329388    |548.346324    |1.016719  | 0.126931                                         |
        | espree-wtb                |71.026174     |72.950691     |1.027096  | 0.005430                                         |
        | bomb-workers              |100.837095    |102.616328    |1.017645  | 0.024650                                         |
        | tagcloud-SP               |293.735729    |295.721652    |1.006761  | 0.604433                                         |
        | mandreel                  |150.843346    |151.169263    |1.002161  | 0.406810                                         |
        | 3d-raytrace-SP            |503.282797    |508.519569    |1.010405  | 0.330728                                         |
        | delta-blue                |1064.779647   |1085.099791   |1.019084  | 0.111789                                         |
        | ML                        |143.453624    |144.404535    |1.006629  | 0.054459                                         |
        | regexp                    |465.598651    |469.139986    |1.007606  | 0.040131                                         |
        | crypto                    |1534.715604   |1518.978823   |0.989746  | 0.398916                                         |
        | richards-wasm             |144.325337    |144.296964    |0.999803  | 0.993066                                         |
        | earley-boyer              |831.216095    |862.902139    |1.038120  | 0.089284                                         |
        | octane-zlib               |27.146237     |27.203847     |1.002122  | 0.668749                                         |
        | date-format-tofte-SP      |390.913746    |391.453527    |1.001381  | 0.837893                                         |
        | n-body-SP                 |1142.063928   |1139.347984   |0.997622  | 0.764020                                         |
        | pdfjs                     |183.711632    |185.851180    |1.011646  | 0.144519                                         |
        | FlightPlanner             |908.621057    |901.866743    |0.992566  | 0.434806                                         |
        | uglify-js-wtb             |34.644842     |34.797497     |1.004406  | 0.126209                                         |
        | babylon-wtb               |82.702004     |83.505631     |1.009717  | 0.092402                                         |
        | stanford-crypto-sha256    |810.898597    |810.480366    |0.999484  | 0.943677                                         |
        -------------------------------------------------------------------------------------------------------------------------
        a mean = 242.30806
        b mean = 243.91901
        pValue = 0.0014473755
        (Bigger means are better.)
        1.007 times better
        Results ARE significant

        * runtime/Options.cpp:
        (JSC::overrideDefaults):

2021-10-13  Mikhail R. Gadelha  <mikhail@igalia.com>

        [JSC][32bit] Fix wrong branchAdd32 assembly for ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=231362

        Reviewed by Yusuke Suzuki.

        After the unlinked baseline jit was merged, a new branchAdd32 method
        needed to be implemented for ARMv7, however, the first version
        submitted by me used the add32 method to perform the add before
        branching.

        In this patch, we fix the call to add32 by adding a new private method
        add32Impl with an optional parameter that selects either add or adds,
        make branchAdd32 call the adds version.

        (Patch co-authored with Geza Lore)

        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchAdd32):

2021-10-12  Alexey Proskuryakov  <ap@apple.com>

        Invoke build scripts with python3 explicitly
        https://bugs.webkit.org/show_bug.cgi?id=231587

        Reviewed by Jonathan Bedard.

        Much of the work to support Python 3 was done years ago, but we need this to
        actually use Python 3 on macOS.

        Python 3 no longer raises ValueError on relative module import failure, so changed
        that to the correct ImportError.

        * DerivedSources.make:
        * Scripts/UpdateContents.py:
        * Scripts/cssmin.py:
        * Scripts/generate-combined-inspector-json.py:
        * Scripts/generate-js-builtins.py:
        * Scripts/inline-and-minify-stylesheets-and-scripts.py:
        * Scripts/lazywriter.py:
        * Scripts/make-js-file-arrays.py:
        * Scripts/wkbuiltins/builtins_generate_combined_header.py:
        * Scripts/wkbuiltins/builtins_generate_combined_implementation.py:
        * Scripts/wkbuiltins/builtins_generate_internals_wrapper_header.py:
        * Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:
        * Scripts/wkbuiltins/builtins_generate_separate_header.py:
        * Scripts/wkbuiltins/builtins_generate_separate_implementation.py:
        * Scripts/wkbuiltins/builtins_generate_wrapper_header.py:
        * Scripts/wkbuiltins/builtins_generate_wrapper_implementation.py:
        * Scripts/wkbuiltins/builtins_generator.py:
        * Scripts/wkbuiltins/builtins_model.py:
        * Scripts/wkbuiltins/builtins_templates.py:
        * disassembler/udis86/ud_opcode.py:
        (UdOpcodeTable.entries):
        (UdOpcodeTables.addSSE2AVXInsn):
        (itemslist): Deleted.
        * inspector/scripts/codegen/cpp_generator.py:
        * inspector/scripts/codegen/cpp_generator_templates.py:
        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
        * inspector/scripts/codegen/generate_js_backend_commands.py:
        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
        * inspector/scripts/codegen/generate_objc_configuration_header.py:
        * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
        * inspector/scripts/codegen/generate_objc_header.py:
        * inspector/scripts/codegen/generate_objc_internal_header.py:
        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py:
        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
        * inspector/scripts/codegen/generator.py:
        * inspector/scripts/codegen/generator_templates.py:
        * inspector/scripts/codegen/models.py:
        * inspector/scripts/codegen/objc_generator.py:
        * inspector/scripts/codegen/objc_generator_templates.py:
        * inspector/scripts/generate-inspector-protocol-bindings.py:
        * wasm/generateWasm.py:
        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
        * wasm/generateWasmOpsHeader.py:
        * yarr/create_regex_tables:
        (in): Deleted.
        * yarr/generateYarrCanonicalizeUnicode:
        * yarr/generateYarrUnicodePropertyTables.py:
        * yarr/hasher.py:

2021-10-13  Alex Christensen  <achristensen@webkit.org>

        Remove WTF::Variant and WTF::get
        https://bugs.webkit.org/show_bug.cgi?id=231675

        Reviewed by Chris Dumez.

        * bytecode/StructureStubClearingWatchpoint.cpp:
        (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndInstallWatchpoint):
        (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfValue):
        * jit/SnippetReg.h:
        (JSC::SnippetReg::gpr const):
        (JSC::SnippetReg::fpr const):
        (JSC::SnippetReg::jsValueRegs const):
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * parser/Lexer.cpp:
        (JSC::Lexer<T>::lexWithoutClearingLineTerminator):
        * parser/VariableEnvironment.cpp:
        (JSC::CompactTDZEnvironment::toTDZEnvironmentSlow const):
        * parser/VariableEnvironment.h:
        (JSC::CompactTDZEnvironment::toTDZEnvironment const):
        * runtime/CacheUpdate.cpp:
        (JSC::CacheUpdate::asGlobal const):
        (JSC::CacheUpdate::asFunction const):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCompactTDZEnvironment::encode):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::ControlType::isCatch):
        (JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const):
        (JSC::Wasm::LLIntGenerator::addLoop):
        (JSC::Wasm::LLIntGenerator::addElseToUnreachable):
        (JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
        (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):
        (JSC::Wasm::LLIntGenerator::addRethrow):

2021-10-13  Diego Pino Garcia  <dpino@igalia.com>

        [GTK] Unreviewed, build fix for Ubuntu 18.04 after r283852

        * wasm/WasmB3IRGenerator.h:

2021-10-12  Ross Kirsling  <ross.kirsling@sony.com>

        Non-unified build fixes, October 2021 edition.
        https://bugs.webkit.org/show_bug.cgi?id=231654

        Reviewed by Don Olmstead.

        * runtime/ControlFlowProfiler.h:

2021-10-12  Alex Christensen  <achristensen@webkit.org>

        Use std::variant instead of WTF::Variant
        https://bugs.webkit.org/show_bug.cgi?id=231629

        Reviewed by Chris Dumez.

        * bytecode/StructureStubClearingWatchpoint.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOM):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfValue):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfTruthy):
        (JSC::AssemblyHelpers::branchIfFalsey):
        * jit/SnippetReg.h:
        * jsc.cpp:
        * parser/Lexer.h:
        * parser/VariableEnvironment.h:
        * runtime/BytecodeCacheError.h:
        * runtime/CachePayload.cpp:
        (JSC::CachePayload::CachePayload):
        * runtime/CachePayload.h:
        * runtime/CacheUpdate.h:
        * runtime/ISO8601.cpp:
        (JSC::ISO8601::parseTimeZoneBracketedAnnotation):
        * runtime/ISO8601.h:
        * wasm/WasmLLIntGenerator.cpp:

2021-10-12  Chris Dumez  <cdumez@apple.com>

        Decrease use of makeWeakPtr()
        https://bugs.webkit.org/show_bug.cgi?id=231615

        Reviewed by Alex Christensen.

        Decrease use of makeWeakPtr() and use WeakPtr { } directly instead.

        * inspector/JSGlobalObjectInspectorController.cpp:
        (Inspector::JSGlobalObjectInspectorController::consoleClient const):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::registerInstance):

2021-10-12  Saam Barati  <sbarati@apple.com>

        Fix spec-correctness when inlining __proto__ intrinsic using get_by_id_with_this
        https://bugs.webkit.org/show_bug.cgi?id=231559

        Reviewed by Yusuke Suzuki.

        My original fix in r283512 has some theoretical spec correctness issues.
        I'm not sure if they can be materialized or not since we only use
        get_by_id_with_this in very limited scenarios. However, this patch just
        makes it so we call the getter instead of attempting to inline it
        when using get_by_id_with_this.

        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck): Deleted.
        * jit/AssemblyHelpers.h:
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):

2021-10-12  Alex Christensen  <achristensen@webkit.org>

        Use STL instead of WTF::get_if, WTF::Monostate, WTF::visit, and WTF::holds_alternative
        https://bugs.webkit.org/show_bug.cgi?id=231582

        Reviewed by Darin Adler.

        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfValue):
        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        * parser/Lexer.cpp:
        (JSC::Lexer<T>::lexWithoutClearingLineTerminator):
        * parser/VariableEnvironment.h:
        (JSC::CompactTDZEnvironment::toTDZEnvironment const):
        * runtime/CacheUpdate.cpp:
        (JSC::CacheUpdate::isGlobal const):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCompactTDZEnvironment::encode):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::ControlType::isLoop):
        (JSC::Wasm::LLIntGenerator::ControlType::isTopLevel):
        (JSC::Wasm::LLIntGenerator::ControlType::isBlock):
        (JSC::Wasm::LLIntGenerator::ControlType::isIf):
        (JSC::Wasm::LLIntGenerator::ControlType::isTry):
        (JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch):
        (JSC::Wasm::LLIntGenerator::ControlType::isCatch):
        (JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const):
        (JSC::Wasm::LLIntGenerator::ControlType::branchTargetArity const):
        (JSC::Wasm::LLIntGenerator::ControlType::branchTargetType const):
        (JSC::Wasm::LLIntGenerator::addElse):
        (JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
        (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::LLIntGenerator::addRethrow):
        (JSC::Wasm::LLIntGenerator::addEndToUnreachable):

2021-10-12  Alex Christensen  <achristensen@webkit.org>

        Begin migration from WTF::Variant to std::variant
        https://bugs.webkit.org/show_bug.cgi?id=231086

        Reviewed by Chris Dumez.

        * bytecode/StructureStubClearingWatchpoint.cpp:
        (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOM):
        * runtime/TemporalTimeZone.cpp:
        (JSC::TemporalTimeZone::createFromID):
        (JSC::TemporalTimeZone::createFromUTCOffset):

2021-10-11  Saam Barati  <sbarati@apple.com>

        Remove ImplicitAddress
        https://bugs.webkit.org/show_bug.cgi?id=230820
        <rdar://problem/83826318>

        Reviewed by Yusuke Suzuki.

        Because we rely on implicit conversion from RegisterID to int values,
        some compilers (aka MSVC) might convert a constant RegisterID that's passed in
        to nullptr instead of calling the implicit constructor in ImplicitAddress.
        
        For example, I got bit by this when I had code that did:
        loadPtr(regT0, xyz)
        
        This called the loadPtr(void*, RegisterID) function with nullptr passed as
        the first argument instead of the loadPtr(ImplicitAddress, RegisterID)
        function.
        
        Let's avoid any such problems in the future by just not using ImplicitAddress.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::ImplicitAddress::ImplicitAddress): Deleted.
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::pushToSave):
        (JSC::MacroAssembler::popToRestore):
        (JSC::MacroAssembler::loadPtr):
        (JSC::MacroAssembler::storePtr):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::load64):
        (JSC::MacroAssemblerARM64::load32):
        (JSC::MacroAssemblerARM64::load16):
        (JSC::MacroAssemblerARM64::load16Unaligned):
        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::load8):
        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
        (JSC::MacroAssemblerARM64::store64):
        (JSC::MacroAssemblerARM64::store32):
        (JSC::MacroAssemblerARM64::store16):
        (JSC::MacroAssemblerARM64::store8):
        (JSC::MacroAssemblerARM64::loadDouble):
        (JSC::MacroAssemblerARM64::loadFloat):
        (JSC::MacroAssemblerARM64::storeDouble):
        (JSC::MacroAssemblerARM64::storeFloat):
        (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):
        (JSC::MacroAssemblerARM64::popToRestore):
        (JSC::MacroAssemblerARM64::pushToSave):
        (JSC::MacroAssemblerARM64::storePtrWithPatch):
        (JSC::MacroAssemblerARM64::loadAcq8SignedExtendTo32):
        (JSC::MacroAssemblerARM64::loadAcq8):
        (JSC::MacroAssemblerARM64::storeRel8):
        (JSC::MacroAssemblerARM64::loadAcq16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::loadAcq16):
        (JSC::MacroAssemblerARM64::storeRel16):
        (JSC::MacroAssemblerARM64::loadAcq32):
        (JSC::MacroAssemblerARM64::loadAcq64):
        (JSC::MacroAssemblerARM64::storeRel32):
        (JSC::MacroAssemblerARM64::storeRel64):
        (JSC::MacroAssemblerARM64::loadLink8):
        (JSC::MacroAssemblerARM64::loadLinkAcq8):
        (JSC::MacroAssemblerARM64::storeCond8):
        (JSC::MacroAssemblerARM64::storeCondRel8):
        (JSC::MacroAssemblerARM64::loadLink16):
        (JSC::MacroAssemblerARM64::loadLinkAcq16):
        (JSC::MacroAssemblerARM64::storeCond16):
        (JSC::MacroAssemblerARM64::storeCondRel16):
        (JSC::MacroAssemblerARM64::loadLink32):
        (JSC::MacroAssemblerARM64::loadLinkAcq32):
        (JSC::MacroAssemblerARM64::storeCond32):
        (JSC::MacroAssemblerARM64::storeCondRel32):
        (JSC::MacroAssemblerARM64::loadLink64):
        (JSC::MacroAssemblerARM64::loadLinkAcq64):
        (JSC::MacroAssemblerARM64::storeCond64):
        (JSC::MacroAssemblerARM64::storeCondRel64):
        (JSC::MacroAssemblerARM64::extractSimpleAddress):
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::atomicXchgAdd8):
        (JSC::MacroAssemblerARM64E::atomicXchgAdd16):
        (JSC::MacroAssemblerARM64E::atomicXchgAdd32):
        (JSC::MacroAssemblerARM64E::atomicXchgAdd64):
        (JSC::MacroAssemblerARM64E::atomicXchgXor8):
        (JSC::MacroAssemblerARM64E::atomicXchgXor16):
        (JSC::MacroAssemblerARM64E::atomicXchgXor32):
        (JSC::MacroAssemblerARM64E::atomicXchgXor64):
        (JSC::MacroAssemblerARM64E::atomicXchgOr8):
        (JSC::MacroAssemblerARM64E::atomicXchgOr16):
        (JSC::MacroAssemblerARM64E::atomicXchgOr32):
        (JSC::MacroAssemblerARM64E::atomicXchgOr64):
        (JSC::MacroAssemblerARM64E::atomicXchgClear8):
        (JSC::MacroAssemblerARM64E::atomicXchgClear16):
        (JSC::MacroAssemblerARM64E::atomicXchgClear32):
        (JSC::MacroAssemblerARM64E::atomicXchgClear64):
        (JSC::MacroAssemblerARM64E::atomicXchg8):
        (JSC::MacroAssemblerARM64E::atomicXchg16):
        (JSC::MacroAssemblerARM64E::atomicXchg32):
        (JSC::MacroAssemblerARM64E::atomicXchg64):
        (JSC::MacroAssemblerARM64E::atomicStrongCAS8):
        (JSC::MacroAssemblerARM64E::atomicStrongCAS16):
        (JSC::MacroAssemblerARM64E::atomicStrongCAS32):
        (JSC::MacroAssemblerARM64E::atomicStrongCAS64):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::or8):
        (JSC::MacroAssemblerARMv7::or16):
        (JSC::MacroAssemblerARMv7::or32):
        (JSC::MacroAssemblerARMv7::load32):
        (JSC::MacroAssemblerARMv7::load8):
        (JSC::MacroAssemblerARMv7::load8SignedExtendTo32):
        (JSC::MacroAssemblerARMv7::load16):
        (JSC::MacroAssemblerARMv7::load16SignedExtendTo32):
        (JSC::MacroAssemblerARMv7::store32):
        (JSC::MacroAssemblerARMv7::store16):
        (JSC::MacroAssemblerARMv7::loadDouble):
        (JSC::MacroAssemblerARMv7::loadFloat):
        (JSC::MacroAssemblerARMv7::storeDouble):
        (JSC::MacroAssemblerARMv7::storeFloat):
        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::load8):
        (JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
        (JSC::MacroAssemblerMIPS::load32):
        (JSC::MacroAssemblerMIPS::load16):
        (JSC::MacroAssemblerMIPS::store8):
        (JSC::MacroAssemblerMIPS::store16):
        (JSC::MacroAssemblerMIPS::store32):
        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
        (JSC::MacroAssemblerMIPS::loadFloat):
        (JSC::MacroAssemblerMIPS::loadDouble):
        (JSC::MacroAssemblerMIPS::storeFloat):
        (JSC::MacroAssemblerMIPS::storeDouble):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::load32):
        (JSC::MacroAssemblerX86Common::load16Unaligned):
        (JSC::MacroAssemblerX86Common::load8):
        (JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
        (JSC::MacroAssemblerX86Common::load16):
        (JSC::MacroAssemblerX86Common::store32):
        (JSC::MacroAssemblerX86Common::store16):
        (JSC::MacroAssemblerX86Common::loadDouble):
        (JSC::MacroAssemblerX86Common::loadFloat):
        (JSC::MacroAssemblerX86Common::storeDouble):
        (JSC::MacroAssemblerX86Common::storeFloat):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::load8):
        (JSC::MacroAssemblerX86_64::load32):
        (JSC::MacroAssemblerX86_64::store32):
        (JSC::MacroAssemblerX86_64::load64):
        (JSC::MacroAssemblerX86_64::store64):
        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
        * assembler/testmasm.cpp:
        (JSC::testBranchTruncateDoubleToInt32):
        (JSC::testLoadPrePostIndex32):
        (JSC::testLoadPrePostIndex64):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStringSlice):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        (JSC::DFG::SpeculativeJIT::compileClearCatchLocals):
        * ftl/FTLLocation.cpp:
        (JSC::FTL::Location::restoreInto const):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::debugCall):
        (JSC::AssemblyHelpers::sanitizeStackInline):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitGetVarFromIndirectPointer):
        * jit/ThunkGenerators.cpp:
        (JSC::arityFixupGenerator):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * yarr/YarrJIT.cpp:

2021-10-11  Saam Barati  <sbarati@apple.com>

        Share more code that uses ScratchRegisterAllocator in the ICs
        https://bugs.webkit.org/show_bug.cgi?id=231125
        <rdar://problem/84066374>

        Reviewed by Sam Weinig.

        We had the same code to allocate a scratch register allocator copy pasted
        all over the IC code. This patch refactors that to use a shared helper.
        
        Also, Delete was using a ScratchRegisterAllocator for no reason (it never
        allocated a scratch register), so I deleted that code.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):
        (JSC::AccessCase::generateImpl):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::makeDefaultScratchAllocator):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):

2021-10-11  Saam Barati  <sbarati@apple.com>

        Don't branch around register allocation in DFG enumerator get by val and pass in the right LValue type to strictInt52ToJSValue
        https://bugs.webkit.org/show_bug.cgi?id=231465
        <rdar://83876470>

        Reviewed by Yusuke Suzuki.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-10-11  Geza Lore  <glore@igalia.com>

        [JSC][ARMv7] Make LLInt CSR save/restore order match the JITs
        https://bugs.webkit.org/show_bug.cgi?id=231517

        Reviewed by Saam Barati.

        Since the new unlinked baseline JIT was introduced, the baseline JIT
        uses the metadata table GPR the same way as the LLInt does, and relies
        on it being in a saved CSR in emit_op_catch. This unearthed an issue
        in the order in which LLInt on ARMv7 stores and restores CSRs when
        trying to handle exceptions. This patch fixes the mismatch.

        * llint/LowLevelInterpreter.asm:

2021-10-11  Alex Christensen  <achristensen@webkit.org>

        Prepare to switch from WTF::Variant to std::variant
        https://bugs.webkit.org/show_bug.cgi?id=231239

        Reviewed by Chris Dumez.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOM):
        * parser/Lexer.cpp:
        (JSC::Lexer<T>::parseHex):
        (JSC::Lexer<T>::parseBinary):
        (JSC::Lexer<T>::parseOctal):
        (JSC::Lexer<T>::parseDecimal):
        * runtime/CachePayload.cpp:
        (JSC::CachePayload::data const):
        (JSC::CachePayload::size const):
        * runtime/CacheUpdate.cpp:
        (JSC::CacheUpdate::CacheUpdate):

2021-10-11  Keith Miller  <keith_miller@apple.com>

        SourceID should have a type name and only be 32-bits
        https://bugs.webkit.org/show_bug.cgi?id=231436

        Reviewed by Filip Pizlo.

        This patch gives SourceID a proper type name and shrinks it to
        32-bits on 64-bit systems. Shrinking the size makes room on
        SourceProvider for metadata in a future patch I'm working on.
        It's also pretty unlikely that any system has more than ~4 billion
        script tags, evals, wasm modules so shinking the size is unlikely
        to cause any debugger/profiling issues.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/TypeLocation.h:
        * debugger/Debugger.cpp:
        (JSC::Debugger::toggleBreakpoint):
        (JSC::Debugger::pauseIfNeeded):
        * debugger/DebuggerLocation.h:
        (JSC::DebuggerLocation::DebuggerLocation):
        * debugger/DebuggerPrimitives.h:
        * inspector/JavaScriptCallFrame.h:
        (Inspector::JavaScriptCallFrame::sourceID const):
        * inspector/ScriptCallStackFactory.cpp:
        (Inspector::CreateScriptCallStackFunctor::operator() const):
        (Inspector::createScriptCallStackFromException):
        * interpreter/StackVisitor.cpp:
        (JSC::StackVisitor::Frame::sourceID):
        * interpreter/StackVisitor.h:
        * parser/Nodes.h:
        (JSC::ScopeNode::sourceID const):
        * parser/SourceCode.h:
        (JSC::SourceCode::SourceCode):
        (JSC::SourceCode::firstLine const):
        (JSC::SourceCode::startColumn const):
        (JSC::SourceCode::providerID const):
        (JSC::SourceCode::provider const):
        (JSC::SourceCode::operator== const):
        (JSC::SourceCode::operator!= const):
        (JSC::makeSource):
        (JSC::SourceCode::subExpression const):
        * parser/SourceProvider.cpp:
        (JSC::SourceProvider::getID):
        * parser/SourceProvider.h:
        (JSC::SourceProvider::asID):
        * runtime/ControlFlowProfiler.cpp:
        (JSC::ControlFlowProfiler::getBasicBlockLocation):
        (JSC::ControlFlowProfiler::getBasicBlocksForSourceID const):
        (JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):
        (JSC::ControlFlowProfiler::basicBlockExecutionCountAtTextOffset):
        * runtime/ControlFlowProfiler.h:
        * runtime/FunctionHasExecutedCache.cpp:
        (JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
        (JSC::FunctionHasExecutedCache::insertUnexecutedRange):
        (JSC::FunctionHasExecutedCache::removeUnexecutedRange):
        (JSC::FunctionHasExecutedCache::getFunctionRanges):
        * runtime/FunctionHasExecutedCache.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::StackFrame::sourceID):
        * runtime/SamplingProfiler.h:
        * runtime/ScriptExecutable.h:
        (JSC::ScriptExecutable::sourceID const):
        * runtime/StackFrame.cpp:
        (JSC::StackFrame::sourceID const):
        * runtime/StackFrame.h:
        * runtime/TypeLocationCache.cpp:
        (JSC::TypeLocationCache::getTypeLocation):
        * runtime/TypeLocationCache.h:
        * runtime/TypeProfiler.cpp:
        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
        (JSC::TypeProfiler::findLocation):
        * runtime/TypeProfiler.h:
        (JSC::QueryKey::QueryKey):
        (JSC::QueryKey::isHashTableDeletedValue const):

2021-10-11  Geza Lore  <glore@igalia.com>

        [JSC][32bit] Fix profiling in baseline
        https://bugs.webkit.org/show_bug.cgi?id=231368

        Reviewed by Yusuke Suzuki.

        Fixes profiling omissions introduced with the recent 32-bit baseline
        build fixes, and also brings the rest of profile updates in-line with
        the unlinked baseline on 64-bit platforms.

        * jit/JIT.h:
        * jit/JITCall32_64.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITInlines.h:
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):

2021-10-10  Sihui Liu  <sihui_liu@apple.com>

        Add support for iterating FileSystemDirectoryHandle
        https://bugs.webkit.org/show_bug.cgi?id=231142
        <rdar://problem/83848092>

        Reviewed by Youenn Fablet and Yusuke Suzuki.

        * CMakeLists.txt:
        * runtime/JSBoundFunction.h:
        * runtime/JSGlobalObject.h:
        * runtime/JSGlobalObjectInlines.h:
        (JSC::JSGlobalObject::performPromiseThenFunction const):
        * runtime/JSPromise.cpp:
        (JSC::JSPromise::createNewPromiseCapability):
        (JSC::JSPromise::convertCapabilityToDeferredData):
        (JSC::JSPromise::createDeferredData):
        (JSC::JSPromise::performPromiseThen):
        * runtime/JSPromise.h:

2021-10-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Refine RegExp#compile based on regexp-legacy-features proposal
        https://bugs.webkit.org/show_bug.cgi?id=231486

        Reviewed by Alexey Shvayka.

        This patch refines RegExp#compile based regexp-legacy-features proposal[1].
        We add legacyFeaturesDisabledFlag flag to RegExpObject so that we can
        detect [[LegacyFeaturesEnabled]].

        We also add regExpRecompiledWatchpoint to JSGlobalObject. We have strength
        reduction in DFG / FTL, but we should recompile DFG / FTL code when RegExp
        is recompiled. Since it is rare, instead of having this watchpoint per
        RegExpObject, we hold it in JSGlobalObject.

        [1]: https://github.com/tc39/proposal-regexp-legacy-features

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewRegexp):
        (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::regExpRecompiledWatchpoint):
        (JSC::JSGlobalObject::isRegExpRecompiled const):
        * runtime/RegExpConstructor.cpp:
        (JSC::areLegacyFeaturesEnabled):
        (JSC::regExpCreate):
        (JSC::constructRegExp):
        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::RegExpObject):
        * runtime/RegExpObject.h:
        * runtime/RegExpPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-10-08  Saam Barati  <sbarati@apple.com>

        Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser
        https://bugs.webkit.org/show_bug.cgi?id=230823
        <rdar://problem/83565088>

        Reviewed by Yusuke Suzuki.

        When I ported the phase to run right after bytecode parsing, I wanted
        to maintain the same behavior as the prior pass that ran after CPS
        rethreading. I noticed a slight bug in some of my logic that changed
        some of heuristics and how they'd effect double voting.
        
        The old patch was mimicking the "is loaded from" bit by using the NodeFlags.
        Howver, this has some issues with how this interacts with our other uses
        of NodeFlags. So, to make things simple, I just add a new "VariableIsUsed"
        bit.

        * dfg/DFGBackwardsPropagationPhase.cpp:
        (JSC::DFG::BackwardsPropagationPhase::propagate):

2021-10-08  Tadeu Zagallo  <tzagallo@apple.com> and Keith Miller  <keith_miller@apple.com>

        Implement the WebAssembly exception handling proposal
        https://bugs.webkit.org/show_bug.cgi?id=229681
        <rdar://81603387>

        Reviewed by Keith Miller.

        Add support for the WebAssembly exception handling proposal, as per
        the WIP spec: https://github.com/WebAssembly/exception-handling

        The proposal includes 6 new instructions: try, catch, catch_all,
        delegate, throw and rethrow. All the instructions are supported by
        the LLInt and B3 generators, but not yet supported in Air. Any
        functions use exceptions will use B3 in BBQ.

        A few important notes about the implementation:
        - In B3, since we can now have multiple entrypoints (one for the
        function entry + 1 for each catch/catch_all), we can no longer just
        replace every value in the stack with a Phi when we find a new
        entrypoint. This worked so far because of the assumption that any
        block couldn't access its enclosing stack, and since the enclosing stack
        would only be accessible when we exited the current block, we added Phis
        at the end of each block when we had a new entrypoint. Now, since we have to capture all
        live values at any point that might throw (calls, throw and rethrow),
        we break that assumption. To simplify all the possible ways we might
        have to merge the state from multiple entrypoints we now use B3
        Variables to represent stack slots.
        - Some extra information is required to be able to properly restore
        the state when catching an exception:
            - We added a field VM::calleeForWasmCatch. This field is necessary
            because whenever we throw, we might end up in JavaScript, which
            assumes the callee is a cell and uses it to get the VM and restore
            callee saves. The issue is when catching exceptions in wasm we
            still need the original callee, and if throwing and catching from
            the same frame, that call frame slot has now been overwritten, so
            we store its original value in the VM field.
            - We also need to store the current Wasm Instance into the call
            frame's slot for the `this` argument. The instance is used both by
            the unwinder, to check if the exception being thrown matches the
            exceptions handled by catch candidates, and by the catch implementation,
            which is necessary when throwing from a cross instance call where both
            the callee save or TLS will have the callee's instance.
            - We store the current opcode for the llint, or the
            call site index for B3, in the call frame slot for the argument
            count tag. The call site index is used by the unwinder to check
            if a given catch can handle the exception being thrown.

        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/BytecodeList.rb:
        * bytecode/HandlerInfo.h:
        * bytecode/Instruction.h:
        (JSC::BaseInstruction::name const):
        * interpreter/CallFrame.cpp:
        (JSC::CallFrame::bytecodeIndex const):
        * interpreter/CallFrame.h:
        (JSC::CallSiteIndex::CallSiteIndex):
        (JSC::CallSiteIndex::hash const):
        (JSC::CallSiteIndex::deletedValue):
        (JSC::CallSiteIndex::isHashTableDeletedValue const):
        (JSC::CallSiteIndexHash::hash):
        (JSC::CallSiteIndexHash::equal):
        * interpreter/Interpreter.cpp:
        (JSC::CatchInfo::CatchInfo):
        (JSC::UnwindFunctor::UnwindFunctor):
        (JSC::UnwindFunctor::operator() const):
        (JSC::Interpreter::unwind):
        * interpreter/Interpreter.h:
        (JSC::CatchInfo::CatchInfo):
        * interpreter/StackVisitor.cpp:
        (JSC::StackVisitor::readNonInlinedFrame):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBufferImpl):
        * jit/AssemblyHelpers.h:
        * jit/JITExceptions.cpp:
        (JSC::genericUnwind):
        * jit/JSInterfaceJIT.h:
        (JSC::JSInterfaceJIT::convertCalleeToVM):
        * llint/LLIntData.h:
        (JSC::LLInt::getCodeRef):
        (JSC::LLInt::getWide16CodeRef):
        (JSC::LLInt::getWide32CodeRef):
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::wasmReturnToThrow):
        (JSC::LLInt::handleWasmCatch):
        (JSC::LLInt::handleWasmCatchAll):
        * llint/LLIntExceptions.h:
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/WebAssembly.asm:
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::ErrorInstance):
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::setCatchableFromWasm):
        (JSC::ErrorInstance::isCatchableFromWasm const):
        * runtime/JSGlobalObject.cpp:
        * runtime/JSGlobalObject.h:
        * runtime/OptionsList.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::calleeForWasmCatchOffset):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::ControlData::isTry):
        (JSC::Wasm::AirIRGenerator::ControlData::isCatch):
        (JSC::Wasm::AirIRGenerator::ControlData::isAnyCatch):
        (JSC::Wasm::AirIRGenerator::ControlData::isLoop):
        (JSC::Wasm::AirIRGenerator::ControlData::isBlock):
        (JSC::Wasm::AirIRGenerator::ControlData::dump const):
        (JSC::Wasm::AirIRGenerator::addTry):
        (JSC::Wasm::AirIRGenerator::addCatch):
        (JSC::Wasm::AirIRGenerator::addCatchToUnreachable):
        (JSC::Wasm::AirIRGenerator::addCatchAll):
        (JSC::Wasm::AirIRGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::AirIRGenerator::addDelegate):
        (JSC::Wasm::AirIRGenerator::addDelegateToUnreachable):
        (JSC::Wasm::AirIRGenerator::addThrow):
        (JSC::Wasm::AirIRGenerator::addRethrow):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::ControlData::ControlData):
        (JSC::Wasm::B3IRGenerator::ControlData::isTry):
        (JSC::Wasm::B3IRGenerator::ControlData::isAnyCatch):
        (JSC::Wasm::B3IRGenerator::ControlData::isLoop):
        (JSC::Wasm::B3IRGenerator::ControlData::isBlock):
        (JSC::Wasm::B3IRGenerator::ControlData::isCatch):
        (JSC::Wasm::B3IRGenerator::ControlData::dump const):
        (JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatch):
        (JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatchAll):
        (JSC::Wasm::B3IRGenerator::ControlData::tryStart const):
        (JSC::Wasm::B3IRGenerator::ControlData::tryEnd const):
        (JSC::Wasm::B3IRGenerator::ControlData::tryDepth const):
        (JSC::Wasm::B3IRGenerator::ControlData::catchKind const):
        (JSC::Wasm::B3IRGenerator::ControlData::exception const):
        (JSC::Wasm::B3IRGenerator::ControlData::stackSize const):
        (JSC::Wasm::B3IRGenerator::didPopValueFromStack):
        (JSC::Wasm::B3IRGenerator::addStackMap):
        (JSC::Wasm::B3IRGenerator::takeStackmaps):
        (JSC::Wasm::B3IRGenerator::takeExceptionHandlers):
        (JSC::Wasm::B3IRGenerator::push):
        (JSC::Wasm::B3IRGenerator::get):
        (JSC::Wasm::B3IRGenerator::set):
        (JSC::Wasm::PatchpointExceptionHandle::generate const):
        (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffset):
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::B3IRGenerator::insertEntrySwitch):
        (JSC::Wasm::B3IRGenerator::insertConstants):
        (JSC::Wasm::B3IRGenerator::addRefIsNull):
        (JSC::Wasm::B3IRGenerator::addTableGet):
        (JSC::Wasm::B3IRGenerator::addTableSet):
        (JSC::Wasm::B3IRGenerator::addRefFunc):
        (JSC::Wasm::B3IRGenerator::addTableInit):
        (JSC::Wasm::B3IRGenerator::addTableSize):
        (JSC::Wasm::B3IRGenerator::addTableGrow):
        (JSC::Wasm::B3IRGenerator::addTableFill):
        (JSC::Wasm::B3IRGenerator::addTableCopy):
        (JSC::Wasm::B3IRGenerator::getLocal):
        (JSC::Wasm::B3IRGenerator::emitIndirectCall):
        (JSC::Wasm::B3IRGenerator::addGrowMemory):
        (JSC::Wasm::B3IRGenerator::addCurrentMemory):
        (JSC::Wasm::B3IRGenerator::addMemoryFill):
        (JSC::Wasm::B3IRGenerator::addMemoryInit):
        (JSC::Wasm::B3IRGenerator::addMemoryCopy):
        (JSC::Wasm::B3IRGenerator::setLocal):
        (JSC::Wasm::B3IRGenerator::getGlobal):
        (JSC::Wasm::B3IRGenerator::setGlobal):
        (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
        (JSC::Wasm::B3IRGenerator::emitLoadOp):
        (JSC::Wasm::B3IRGenerator::load):
        (JSC::Wasm::B3IRGenerator::emitStoreOp):
        (JSC::Wasm::B3IRGenerator::store):
        (JSC::Wasm::B3IRGenerator::sanitizeAtomicResult):
        (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffsetForAtomicOps):
        (JSC::Wasm::B3IRGenerator::emitAtomicLoadOp):
        (JSC::Wasm::B3IRGenerator::atomicLoad):
        (JSC::Wasm::B3IRGenerator::emitAtomicStoreOp):
        (JSC::Wasm::B3IRGenerator::atomicStore):
        (JSC::Wasm::B3IRGenerator::emitAtomicBinaryRMWOp):
        (JSC::Wasm::B3IRGenerator::atomicBinaryRMW):
        (JSC::Wasm::B3IRGenerator::emitAtomicCompareExchange):
        (JSC::Wasm::B3IRGenerator::atomicCompareExchange):
        (JSC::Wasm::B3IRGenerator::atomicWait):
        (JSC::Wasm::B3IRGenerator::atomicNotify):
        (JSC::Wasm::B3IRGenerator::truncSaturated):
        (JSC::Wasm::B3IRGenerator::addSelect):
        (JSC::Wasm::B3IRGenerator::addConstant):
        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::B3IRGenerator::loadFromScratchBuffer):
        (JSC::Wasm::B3IRGenerator::connectControlEntry):
        (JSC::Wasm::B3IRGenerator::addLoop):
        (JSC::Wasm::B3IRGenerator::addTopLevel):
        (JSC::Wasm::B3IRGenerator::addBlock):
        (JSC::Wasm::B3IRGenerator::addIf):
        (JSC::Wasm::B3IRGenerator::addElse):
        (JSC::Wasm::B3IRGenerator::addElseToUnreachable):
        (JSC::Wasm::B3IRGenerator::addTry):
        (JSC::Wasm::B3IRGenerator::addCatch):
        (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions):
        (JSC::Wasm::B3IRGenerator::addCatchToUnreachable):
        (JSC::Wasm::B3IRGenerator::addCatchAll):
        (JSC::Wasm::B3IRGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::B3IRGenerator::emitCatchImpl):
        (JSC::Wasm::B3IRGenerator::addDelegate):
        (JSC::Wasm::B3IRGenerator::addDelegateToUnreachable):
        (JSC::Wasm::B3IRGenerator::addThrow):
        (JSC::Wasm::B3IRGenerator::addRethrow):
        (JSC::Wasm::B3IRGenerator::addReturn):
        (JSC::Wasm::B3IRGenerator::addBranch):
        (JSC::Wasm::B3IRGenerator::addSwitch):
        (JSC::Wasm::B3IRGenerator::endBlock):
        (JSC::Wasm::B3IRGenerator::addEndToUnreachable):
        (JSC::Wasm::B3IRGenerator::createCallPatchpoint):
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        (JSC::Wasm::B3IRGenerator::addCallRef):
        (JSC::Wasm::B3IRGenerator::unify):
        (JSC::Wasm::B3IRGenerator::unifyValuesWithBlock):
        (JSC::Wasm::parseAndCompile):
        (JSC::Wasm::computeExceptionHandlerLocations):
        (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32DivS>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32RemS>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32DivU>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32RemU>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64DivS>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64RemS>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64DivU>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64RemU>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
        * wasm/WasmB3IRGenerator.h:
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::prepareImpl):
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::compileFunction):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        (JSC::Wasm::BBQPlan::initializeCallees):
        * wasm/WasmBBQPlan.h:
        * wasm/WasmCallee.cpp:
        (JSC::Wasm::Callee::handlerForIndex):
        (JSC::Wasm::LLIntCallee::LLIntCallee):
        (JSC::Wasm::LLIntCallee::linkExceptionHandlers):
        (JSC::Wasm::OptimizingJITCallee::linkExceptionHandlers):
        (JSC::Wasm::OptimizingJITCallee::stackmap const):
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::hasExceptionHandlers const):
        (JSC::Wasm::Callee::functionCodeBlock const):
        (JSC::Wasm::OptimizingJITCallee::OptimizingJITCallee):
        * wasm/WasmCallingConvention.h:
        (JSC::Wasm::WasmCallingConvention::callInformationFor const):
        * wasm/WasmFormat.h:
        (JSC::Wasm::typeToString):
        (JSC::Wasm::isValidExternalKind):
        (JSC::Wasm::makeString):
        * wasm/WasmFunctionCodeBlock.h:
        (JSC::Wasm::FunctionCodeBlock::numberOfExceptionHandlers const):
        (JSC::Wasm::FunctionCodeBlock::exceptionHandler):
        (JSC::Wasm::FunctionCodeBlock::addExceptionHandler):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::isTryOrCatch):
        (JSC::Wasm::FunctionParser<Context>::parseExceptionIndex):
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
        * wasm/WasmHandlerInfo.cpp: Added.
        (JSC::Wasm::HandlerInfo::initialize):
        (JSC::Wasm::HandlerInfo::handlerForIndex):
        * wasm/WasmHandlerInfo.h: Added.
        (JSC::Wasm::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
        (JSC::Wasm::HandlerInfo::tag const):
        (JSC::Wasm::HandlerInfo::delegateTarget const):
        * wasm/WasmInstance.cpp:
        (JSC::Wasm::Instance::~Instance):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::addTag):
        (JSC::Wasm::Instance::tag const):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::ControlType::try_):
        (JSC::Wasm::LLIntGenerator::ControlType::catch_):
        (JSC::Wasm::LLIntGenerator::ControlType::isLoop):
        (JSC::Wasm::LLIntGenerator::ControlType::isBlock):
        (JSC::Wasm::LLIntGenerator::ControlType::isIf):
        (JSC::Wasm::LLIntGenerator::ControlType::isTry):
        (JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch):
        (JSC::Wasm::LLIntGenerator::ControlType::isCatch):
        (JSC::Wasm::LLIntGenerator::unifyValuesWithBlock):
        (JSC::Wasm::LLIntGenerator::walkExpressionStack):
        (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
        (JSC::Wasm::parseAndCompileBytecode):
        (JSC::Wasm::LLIntGenerator::LLIntGenerator):
        (JSC::Wasm::LLIntGenerator::repatch):
        (JSC::Wasm::LLIntGenerator::finalize):
        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
        (JSC::Wasm::LLIntGenerator::callInformationForCallee):
        (JSC::Wasm::LLIntGenerator::addArguments):
        (JSC::Wasm::LLIntGenerator::addLoop):
        (JSC::Wasm::LLIntGenerator::addTry):
        (JSC::Wasm::LLIntGenerator::finalizePreviousBlockForCatch):
        (JSC::Wasm::LLIntGenerator::addCatch):
        (JSC::Wasm::LLIntGenerator::addCatchToUnreachable):
        (JSC::Wasm::LLIntGenerator::addCatchAll):
        (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable):
        (JSC::Wasm::LLIntGenerator::addDelegate):
        (JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):
        (JSC::Wasm::LLIntGenerator::addThrow):
        (JSC::Wasm::LLIntGenerator::addRethrow):
        (JSC::Wasm::LLIntGenerator::endBlock):
        (JSC::Wasm::LLIntGenerator::addEndToUnreachable):
        * wasm/WasmLLIntGenerator.h:
        * wasm/WasmLimits.h:
        * wasm/WasmModuleInformation.cpp:
        * wasm/WasmModuleInformation.h:
        (JSC::Wasm::ModuleInformation::exceptionIndexSpaceSize const):
        (JSC::Wasm::ModuleInformation::isImportedExceptionFromExceptionIndexSpace const):
        (JSC::Wasm::ModuleInformation::signatureIndexFromExceptionIndexSpace const):
        (JSC::Wasm::ModuleInformation::importExceptionCount const):
        (JSC::Wasm::ModuleInformation::isDeclaredException const):
        (JSC::Wasm::ModuleInformation::addDeclaredException):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOSREntryData.h:
        (JSC::Wasm::OSREntryData::values):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::loadValuesIntoBuffer):
        (JSC::Wasm::doOSREntry):
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmOperations.h:
        * wasm/WasmSectionParser.cpp:
        (JSC::Wasm::SectionParser::parseImport):
        (JSC::Wasm::SectionParser::parseExport):
        (JSC::Wasm::SectionParser::parseException):
        * wasm/WasmSections.h:
        (JSC::Wasm::validateOrder):
        * wasm/WasmSignature.cpp:
        (JSC::Wasm::SignatureInformation::SignatureInformation):
        (JSC::Wasm::SignatureInformation::signatureFor):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::WASM_SLOW_PATH_DECL):
        * wasm/WasmSlowPaths.h:
        * wasm/WasmStreamingParser.cpp:
        (JSC::Wasm::StreamingParser::parseCodeSectionSize):
        * wasm/WasmTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/WasmTag.h: Copied from Source/JavaScriptCore/wasm/WasmLLIntGenerator.h.
        (JSC::Wasm::Tag::create):
        (JSC::Wasm::Tag::parameterCount const):
        (JSC::Wasm::Tag::parameter const):
        (JSC::Wasm::Tag::operator== const):
        (JSC::Wasm::Tag::operator!= const):
        (JSC::Wasm::Tag::signature const):
        (JSC::Wasm::Tag::Tag):
        * wasm/WasmThunks.cpp:
        * wasm/WasmThunks.h:
        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
        (CodeGenerator.generateOpcode):
        (CodeGenerator.makeResult):
        (CodeGenerator.generate):
        * wasm/generateWasmOpsHeader.py:
        (typeMacroizer):
        * wasm/js/JSWebAssembly.cpp:
        * wasm/js/JSWebAssemblyException.cpp: Added.
        (JSC::JSWebAssemblyException::JSWebAssemblyException):
        (JSC::JSWebAssemblyException::finishCreation):
        (JSC::JSWebAssemblyException::visitChildrenImpl):
        (JSC::JSWebAssemblyException::destroy):
        (JSC::JSWebAssemblyException::getArg const):
        * wasm/js/JSWebAssemblyException.h: Added.
        (JSC::JSWebAssemblyException::subspaceFor):
        (JSC::JSWebAssemblyException::createStructure):
        (JSC::JSWebAssemblyException::create):
        (JSC::JSWebAssemblyException::tag const):
        (JSC::JSWebAssemblyException::payload const):
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::toJSValue):
        (JSC::fromJSValue):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::tryCreate):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/JSWebAssemblyRuntimeError.cpp:
        (JSC::createJSWebAssemblyRuntimeError):
        * wasm/js/JSWebAssemblyRuntimeError.h:
        * wasm/js/JSWebAssemblyTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp.
        (JSC::JSWebAssemblyTag::create):
        (JSC::JSWebAssemblyTag::createStructure):
        (JSC::JSWebAssemblyTag::JSWebAssemblyTag):
        * wasm/js/JSWebAssemblyTag.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyExceptionConstructor.cpp: Added.
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::WebAssemblyExceptionConstructor::create):
        (JSC::WebAssemblyExceptionConstructor::createStructure):
        (JSC::WebAssemblyExceptionConstructor::finishCreation):
        (JSC::WebAssemblyExceptionConstructor::WebAssemblyExceptionConstructor):
        * wasm/js/WebAssemblyExceptionConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/js/WebAssemblyExceptionPrototype.cpp: Added.
        (JSC::WebAssemblyExceptionPrototype::create):
        (JSC::WebAssemblyExceptionPrototype::createStructure):
        (JSC::WebAssemblyExceptionPrototype::finishCreation):
        (JSC::WebAssemblyExceptionPrototype::WebAssemblyExceptionPrototype):
        (JSC::getException):
        (JSC::getTag):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyExceptionPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::linkImpl):
        * wasm/js/WebAssemblyTagConstructor.cpp: Added.
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::WebAssemblyTagConstructor::createTag):
        (JSC::WebAssemblyTagConstructor::create):
        (JSC::WebAssemblyTagConstructor::createStructure):
        (JSC::WebAssemblyTagConstructor::finishCreation):
        (JSC::WebAssemblyTagConstructor::WebAssemblyTagConstructor):
        * wasm/js/WebAssemblyTagConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/js/WebAssemblyTagPrototype.cpp: Added.
        (JSC::WebAssemblyTagPrototype::create):
        (JSC::WebAssemblyTagPrototype::createStructure):
        (JSC::WebAssemblyTagPrototype::finishCreation):
        (JSC::WebAssemblyTagPrototype::WebAssemblyTagPrototype):
        (JSC::getTag):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyTagPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h.
        * wasm/wasm.json:

2021-10-08  Jer Noble  <jer.noble@apple.com>

        [Build-time perf] Forward-declare more things in Element.h
        https://bugs.webkit.org/show_bug.cgi?id=231283

        Reviewed by Myles C. Maxfield.

        Add two new forwarding headers: one for Strong, and as a dependency, one for Handle.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * heap/Handle.h:
        * heap/HandleForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h.
        * heap/Strong.h:
        * heap/StrongForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h.
        * runtime/Forward.h:

2021-10-08  Ross Kirsling  <ross.kirsling@sony.com> and Stephan Szabo  <stephan.szabo@sony.com>

        [JSC] Add private C API for JSGlobalObject::setEvalEnabled
        https://bugs.webkit.org/show_bug.cgi?id=231448

        Reviewed by Yusuke Suzuki.

        WebCore can prohibit eval (and Function constructor) usage in JS execution based on content security policy;
        this patch gives embedders the ability to do similarly.

        * API/JSContextRef.cpp:
        (JSGlobalContextSetEvalEnabled): Added.
        * API/JSContextRefPrivate.h:
        * API/tests/testapi.c:

2021-10-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] UnlinkedCodeBlock::m_instructions can be nullptr
        https://bugs.webkit.org/show_bug.cgi?id=231445
        rdar://83975933

        Reviewed by Mark Lam.

        UnlinkedCodeBlock is first created with m_instructions = nullptr.
        If BytecodeGenerator failed (due to OOM error etc.), then we keep it nullptr.
        So, when destroying UnlinkedCodeBlock, we should have nullptr check.

        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):

2021-10-08  Saam Barati  <sbarati@apple.com>

        RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
        https://bugs.webkit.org/show_bug.cgi?id=231382
        <rdar://83722151>

        Reviewed by Mark Lam.

        Because of the RegExp.prototype.compile API, we don't know if the RegExp
        produced by RegExpExec will have indices or not, because that bit of
        information can be reset by the RegExp.prototype.compile API. So, we
        conservatively say that it can produce either structure. 

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

2021-10-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        `highWaterMark` should be a readonly WebIDL attribute of queuing strategies
        https://bugs.webkit.org/show_bug.cgi?id=231355

        Reviewed by Youenn Fablet.

        Removes now unused @Object.@defineProperty private method.
        In most cases, property descriptor merging is unnecessary and @putDirect should be used instead.

        * runtime/ObjectConstructor.cpp:
        (JSC::ObjectConstructor::finishCreation):

2021-10-07  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed, build fix for non-unified JSC.

        * dfg/DFGBackwardsPropagationPhase.cpp:
        Add missing include.

2021-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Reenable -fvisibility=hidden
        https://bugs.webkit.org/show_bug.cgi?id=181916

        Reviewed by Michael Catanzaro.

        * shell/PlatformGTK.cmake:

2021-10-07  Philip Chimento  <pchimento@igalia.com>

        [JSC] Temporal tweaks to pass more test262 tests
        https://bugs.webkit.org/show_bug.cgi?id=231331

        Reviewed by Yusuke Suzuki.

        * runtime/ISO8601.h:
        (JSC::ISO8601::Duration::operator[]): Add an overload for Duration[]
          that indexes by TemporalUnit enum instead of integer index.
        (JSC::ISO8601::Duration::operator[] const):
        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::fromDurationLike): Access Duration properties in
          the order defined in the specification.
        (JSC::TemporalDuration::with const): Access Duration properties in the
          order defined in the specification.
        (JSC::TemporalDuration::round const): Temporarily throw an exception
          here instead of failing an assertion, when attempting to use
          unimplemented relativeTo functionality.
        * runtime/TemporalObject.cpp:
        (JSC::temporalUnitPluralPropertyName): Rename from
          temporalUnitPropertyName.
        (JSC::temporalUnitSingularPropertyName): Added.
        * runtime/TemporalObject.h: Add array corresponding to the table in the
          spec text specifying alphabetical access order for unit properties.
        * runtime/TemporalPlainTime.cpp:
        (JSC::toTemporalTimeRecord): Access PlainTime properties in the order
          defined in the specification.
        (JSC::toPartialTime): Access PlainTime properties in the order defined
          in the specification.

2021-10-06  Fujii Hironori  <Hironori.Fujii@sony.com>

        Python 3: run-inspector-generator-tests and generate-inspector-protocol-bindings.py
        https://bugs.webkit.org/show_bug.cgi?id=231055

        Reviewed by Jonathan Bedard.

        BaseException.message has been deprecated as of Python 2.6. Use
        str(e) instead.

        It seems that using frozenset causes flaky test failures in Python
        3. Stopped using frozenset.

        Rebaselined test expected results with Python 3. This change is
        not Python 2 compatible because Python 2 represent a unicode text
        as u'pagee' while Python 3 does 'pagee'.

        * inspector/scripts/codegen/models.py:
        * inspector/scripts/generate-inspector-protocol-bindings.py:
        * inspector/scripts/tests/expected/fail-on-command-targetType-matching-domain-debuggableType.json-error:
        * inspector/scripts/tests/expected/fail-on-command-targetTypes-value.json-error:
        * inspector/scripts/tests/expected/fail-on-domain-debuggableTypes-value.json-error:
        * inspector/scripts/tests/expected/fail-on-domain-targetType-matching-domain-debuggableType.json-error:
        * inspector/scripts/tests/expected/fail-on-domain-targetTypes-value.json-error:
        * inspector/scripts/tests/expected/fail-on-event-targetType-matching-domain-debuggableType.json-error:
        * inspector/scripts/tests/expected/fail-on-event-targetTypes-value.json-error:

2021-10-06  Mark Lam  <mark.lam@apple.com>

        Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal.
        https://bugs.webkit.org/show_bug.cgi?id=231252
        rdar://83310320

        Reviewed by Yusuke Suzuki.

        We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal().
        Adding a null check here as a speculative fix to mitigate crashes while we
        investigate further.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::handlePutByVal):

2021-10-06  Saam Barati  <sbarati@apple.com>

        Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser
        https://bugs.webkit.org/show_bug.cgi?id=230823
        <rdar://problem/83565088>

        Reviewed by Robin Morisset.

        We've found yet another bug where pruning code after OSR exits
        before running backwards propagation leads to us breaking the spec
        in weird IR situations. In the particular test case here, we end
        up not thinking we care about negative zero for an ArithNegate,
        and we exit the program while recovering the value 0 instead of -0.
        
        Fundamentally, backwards propagation wants to see all bytecode uses.
        Therefore, it seems like a more sound strategy to run backwards propagation
        before we end up mucking with the graph. This patch makes it so we run
        backwards propagation inside bytecode parser before we prune the IR.
        That way, the phase sees the graph as if it's an IR over the whole bytecode
        graph.

        * bytecode/Operands.h:
        (JSC::Operands::operator!= const):
        * dfg/DFGBackwardsPropagationPhase.cpp:
        (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
        (JSC::DFG::BackwardsPropagationPhase::run):
        (JSC::DFG::BackwardsPropagationPhase::mergeFlags):
        (JSC::DFG::BackwardsPropagationPhase::propagate):
        (JSC::DFG::performBackwardsPropagation):
        * dfg/DFGBackwardsPropagationPhase.h:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parse):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::compileInThreadImpl):
        * dfg/DFGUnificationPhase.cpp:
        (JSC::DFG::UnificationPhase::run):

2021-10-06  Xan López  <xan@igalia.com>

        [JSC][32bit] Remove a bunch of compiler warnings
        https://bugs.webkit.org/show_bug.cgi?id=231091

        Reviewed by Carlos Alberto Lopez Perez.

        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit): silence warning about unused
        variable, it's not used in 32-bit.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_enter): use an unsigned int for the loop count.

2021-10-06  Carlos Garcia Campos  <cgarcia@igalia.com>

        [WPE][GTK] TestJSC incorrectly expects garbage collector to collect variables still on the stack
        https://bugs.webkit.org/show_bug.cgi?id=222972

        Reviewed by Michael Catanzaro.

        Add JSCContextInternal.h header to be used by unit tests to use private JSC API and add
        jscContextGarbageCollect().

        * API/glib/JSCContext.cpp:
        (jscContextGarbageCollect): Moved from unit tests here adding a parameter to optionally call
        sanitizeStackForVM() before doing the garbage collection.
        * API/glib/JSCContextInternal.h: Added.

2021-10-06  Jer Noble  <jer.noble@apple.com>

        [Build-time perf] Forward declare JS TypedArrays
        https://bugs.webkit.org/show_bug.cgi?id=231196

        Reviewed by Tim Horton.

        Add a new file, Forward.h, containing forward declarations of commonly used JavaScriptCore types. Removed duplicate declarations
        of TypedArray classes from TypedArrayAdapters.h and TypedArrays.h.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * runtime/Forward.h: Added.
        * runtime/TypedArrayAdaptors.h:
        * runtime/TypedArrayAdaptersForwardDeclarations.h: Added.
        * runtime/TypedArrays.h:

2021-10-06  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix wrong edge type from get-by-val in 32 bits
        https://bugs.webkit.org/show_bug.cgi?id=231179

        Reviewed by Yusuke Suzuki.

        After https://bugs.webkit.org/show_bug.cgi?id=230801, a different type
        can be set in DFG nodes, however, in 32 bits jsc was always setting the
        type to Cell. This caused jsc to abort when verify the type of the edge:

        DFG ASSERTION FAILED: Edge verification error: D@64->Check:Object:D@60 was expected to have type Object but has type Cell (43984760078335)

        This patch changes the 32 bits version of the compileEnumeratorGetByVal
        to manually speculate the edge if it is a Cell, since a differente Kind
        could've been during Fixup.

        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):

2021-10-05  Saam Barati  <sbarati@apple.com>

        Don't pass DontBuildStrings to next token after parsing an empty parameter list
        https://bugs.webkit.org/show_bug.cgi?id=225094
        <rdar://problem/77231778>

        Reviewed by Yusuke Suzuki.

        We might need the string, it turns out!

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseArguments):

2021-10-05  Patrick Angle  <pangle@apple.com>

        Web Inspector: Show color space for canvases in the Graphics tab on the overview cards
        https://bugs.webkit.org/show_bug.cgi?id=231205

        Reviewed by Devin Rousso.

        Use an enum instead of strings for color space values sent to the frontend.

        * inspector/protocol/Canvas.json:
        * inspector/scripts/codegen/generator.py:

2021-10-05  Mark Lam  <mark.lam@apple.com>

        CodeBlock should not add/remove LoopHintExecutionCounters.
        https://bugs.webkit.org/show_bug.cgi?id=231209
        rdar://83571235

        Reviewed by Saam Barati.

        This is because cached unlinked baseline JIT code would retain a pointer to those
        counters.  Hence, the UnlinkedCodeBlock should do the add /remove of the counters
        instead.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::~CodeBlock):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::initializeLoopHintExecutionCounter):
        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):
        * bytecode/UnlinkedCodeBlock.h:
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):

2021-10-05  Kate Cheney  <katherine_cheney@apple.com>

        CSP: unsafe-eval tests timing out or failing
        https://bugs.webkit.org/show_bug.cgi?id=231113
        <rdar://problem/83425041>

        Reviewed by Brent Fulgham.

        Many imported unsafe-eval tests are failing because we don't report
        violations to the DOM or report URI when an eval is blocked. This
        patch adds support for that by calling
        ContentSecurityPolicy::allowEval() when eval is disabled.

        Eventually I think we can remove the evalEnabled() code and check the
        CSP policy instead, but I will save that for another patch.

        * API/JSAPIGlobalObject.cpp:
        * API/JSAPIGlobalObject.mm:
        * interpreter/Interpreter.cpp:
        (JSC::eval):
        * jsc.cpp:
        * runtime/DirectEvalExecutable.cpp:
        (JSC::DirectEvalExecutable::create):
        * runtime/FunctionConstructor.cpp:
        (JSC::constructFunction):
        * runtime/IndirectEvalExecutable.cpp:
        (JSC::IndirectEvalExecutable::create):
        * runtime/JSGlobalObject.cpp:
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::reportViolationForUnsafeEval):
        Per the spec we should send the report to the element's document and
        bubble it up to the window.

        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-10-05  Xan López  <xan@igalia.com>

        [JSC][32bit] Fix bugs after unlinked baseline jit
        https://bugs.webkit.org/show_bug.cgi?id=231232

        Reviewed by Yusuke Suzuki.

        Fix a bunch of bugs introduced with unlinked baseline jit. As of
        now we are disabling DataIC on baseline JIT to get things working
        ASAP, making that work will be the next step. This makes us almost
        go back to green bots.

        (Patch co-authored with Geza Lore)

        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::emitDataICFastPath): ASSERT we are not using DataIC on 32-bit.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::hasDebuggerRequests const):
        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileOpCall): don't use DataIC.
        (JSC::JIT::compileOpCallSlowCase): set missing label.
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC): disable DataIC on baseline JIT for 32-bit.
        * jit/JITInlines.h:
        (JSC::JIT::getConstantOperand): get constants from the CodeBlock,
        since we don't do sharing on 32-bit.
        (JSC::JIT::emitValueProfilingSite): remove an overzealous ASSERT.
        (JSC::JIT::loadConstant): use sizeof(void*) instead of '8', makes
        things work on 32-bit.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_debug): share this with 32-bit.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_debug): Deleted.
        * llint/LowLevelInterpreter32_64.asm: do not thrash the PC register.

2021-10-05  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] JSPropertyNameEnumerator should not have cached prototype chain since empty JSPropertyNameEnumerator is shared
        https://bugs.webkit.org/show_bug.cgi?id=231202
        rdar://83815122

        Reviewed by Keith Miller.

        r282014 assumed an invariant that JSPropertyNameEnumerator's StructureChain is immutable.
        This invariant is also used in validation of JSPropertyNameEnumerator. However, this
        invariant was broken since we now have shared empty sentinel JSPropertyNameEnumerator, which can
        be used for different structures having different prototype chain.

        Since now we have shared JSPropertyNameEnumerator, JSPropertyNameEnumerator should not have
        StructureChain in its member. When invalidating StructureChain in Structure, we also clear
        cached JSPropertyNameEnumerator so that we do not get a stale JSPropertyNameEnumerator from
        Structure even though watchpoint-based validation is not used.

        This patch also removes ValidatedViaWatchpoint flag in JSPropertyNameEnumerator due to the same
        reason. We should not modify JSPropertyNameEnumerator once it is instantiated. Instead, we encode
        this flag as a lowest bit of m_cachedPropertyNameEnumerator. If it is validated via traversing (not watchpoints),
        then this bit is set. So when loading that pointer from StructureRareData, we can quickly detect
        it without even accessing to the enumerator. This fixes the issue, and it is even cleaner.
        We rename m_cachedPropertyNameEnumerator to m_cachedPropertyNameEnumeratorAndFlag since it now
        includes this flag.

        While reviewing the code, we also found that watchpoint-based validation didn't care about PolyProto.
        We should disable watchpoint-based validation if PolyProto is used.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter64.asm:
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
        * runtime/JSPropertyNameEnumerator.h:
        (JSC::propertyNameEnumerator):
        * runtime/Structure.cpp:
        (JSC::Structure::visitChildrenImpl):
        (JSC::Structure::setCachedPropertyNameEnumerator):
        (JSC::Structure::cachedPropertyNameEnumeratorAndFlag const):
        * runtime/Structure.h:
        (JSC::Structure::propertyNameEnumeratorShouldWatch const):
        * runtime/StructureInlines.h:
        (JSC::Structure::prototypeChain const):
        (JSC::Structure::clearCachedPrototypeChain):
        * runtime/StructureRareData.cpp:
        (JSC::StructureRareData::visitChildrenImpl):
        * runtime/StructureRareData.h:
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::cachedPropertyNameEnumerator const):
        (JSC::StructureRareData::cachedPropertyNameEnumeratorAndFlag const):
        (JSC::StructureRareData::setCachedPropertyNameEnumerator):
        (JSC::StructureChainInvalidationWatchpoint::fireInternal):
        (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
        (JSC::StructureRareData::clearCachedPropertyNameEnumerator):
        (JSC::StructureRareData::invalidateWatchpointBasedValidation): Deleted.

2021-10-04  Saam Barati  <sbarati@apple.com>

        Display return values in nicer way in the jsc REPL and add a prettyPrint function
        https://bugs.webkit.org/show_bug.cgi?id=230931
        <rdar://problem/83698777>

        Reviewed by Tadeu Zagallo.

        Currently, print(1), print("1"), and print([1]) all print to stdout
        simply as "1" (without the quotes). Same for values when running the
        REPL. This isn't super helpful. Let's print quotes for strings, and
        brackets for arrays. This patch adds a prettyPrint function to do
        that, since we have a lot of tests that depend on the old print behavior.
        
        This patch also makes values printed in the REPL the new pretty style.


        * jsc.cpp:
        (toCString):
        (printInternal):
        (JSC_DEFINE_HOST_FUNCTION):
        (runInteractive):
        (cStringFromViewWithString): Deleted.
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::toWTFStringForConsole const):
        * runtime/JSCJSValue.h:

2021-10-04  Saam Barati  <sbarati@apple.com>

        IntrinsicGetterAccessCase implementation of __proto__ needs to handle get_by_id_with_this
        https://bugs.webkit.org/show_bug.cgi?id=229951
        <rdar://problem/82787527>

        Reviewed by Yusuke Suzuki.

        The whole point of get_by_id_with_this is to have different
        slot base values for |this| vs the slot base when invoking
        getters. However, our intrinsic getter inlining wasn't respecting
        this. This patch makes the __proto__ intrinsic getter do the right
        thing. For typed array intrinsic getters, if they have different
        |this| value vs slot base, we chose not to inline them, because
        the type checks are not on the |this| value, so they're not guaranteed
        to be typed arrays. We can improve upon this in the future.

        * bytecode/IntrinsicGetterAccessCase.h:
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck):
        * jit/AssemblyHelpers.h:
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter):
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):

2021-10-03  Don Olmstead  <don.olmstead@sony.com>

        Non-unified build fixes, early October 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=231143

        Unreviewed non-unified build fixes.

        * jit/BaselineJITCode.cpp:

2021-10-03  Lauro Moura  <lmoura@igalia.com>

        Remove control reaches end of non-void function warning

        Unreviewed. Warning introduced in r283139.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):

2021-10-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DateTimeFormat.resolvedOptions shouldn't return an object with other date/time properties if dateStyle or timeStyle are set
        https://bugs.webkit.org/show_bug.cgi?id=231041

        Reviewed by Ross Kirsling.

        When "dateStyle" or "timestyle" option is specified in Intl.DateTimeFormat, we should not expose detailed
        resolved format information in resolvedOptions, since specifying these options is not what the user of
        this Intl.DateTimeFormat intended. This is specified in the spec[1] step 5-d.

        [1]: https://tc39.es/ecma402/#sec-intl.datetimeformat.prototype.resolvedoptions

        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::resolvedOptions const):

2021-10-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable Intl.DisplayNames without ICU version check
        https://bugs.webkit.org/show_bug.cgi?id=231122

        Reviewed by Ross Kirsling.

        Now every port requires ICU 61.2 or later. Since Intl.DisplayNames requires ICU 61, we can enable it without ICU version check.
        This simplifies Intl.DisplayNames code.

        * runtime/IntlDisplayNames.cpp:
        (JSC::IntlDisplayNames::initializeDisplayNames):
        (JSC::IntlDisplayNames::of const):
        * runtime/IntlDisplayNames.h:
        * runtime/IntlObject.cpp:
        (JSC::IntlObject::finishCreation):

2021-10-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build
        https://bugs.webkit.org/show_bug.cgi?id=231120

        Reviewed by Ross Kirsling.

        We now assume that ICU is 64.2 or later in Darwin since Mojave WebKit build is no longer supported.
        We enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build.

        * runtime/IntlDateTimeFormat.h:

2021-10-02  Yusuke Suzuki  <ysuzuki@apple.com>

        Remove JSC hack after r283410
        https://bugs.webkit.org/show_bug.cgi?id=230261

        Reviewed by Mark Lam.

        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertyDescriptor):
        * runtime/PropertySlot.h:

2021-10-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r283293.
        https://bugs.webkit.org/show_bug.cgi?id=231116

        changing print() broke a lot of random things

        Reverted changeset:

        "Print values in a nicer way in the jsc shell"
        https://bugs.webkit.org/show_bug.cgi?id=230931
        https://commits.webkit.org/r283293

2021-10-01  Yusuke Suzuki  <ysuzuki@apple.com>

        Disable new incumbent-window until it is fully implemented
        https://bugs.webkit.org/show_bug.cgi?id=230261
        <rdar://problem/83099726>

        Reviewed by Chris Dumez and Geoffrey Garen.

        * interpreter/CallFrame.cpp:
        (JSC::CallFrame::globalObjectOfClosestCodeBlock):
        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertyDescriptor):
        * runtime/PropertySlot.h:

2021-10-01  Xan López  <xan@igalia.com>

        [JSC][32bit] Fix build after unlinked baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=230803

        Reviewed by Saam Barati.

        This is enough to make things build, but pretty much nothing works
        yet. Will fix in a follow-up, this way we at least give people a
        chance at not introducing more build regressions.

        (With some code by Mikhail R. Gadelha and Geza Lore)

        * CMakeLists.txt:
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branch32):
        (JSC::MacroAssemblerARMv7::branchAdd32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchAdd32):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis):
        * jit/JIT.h:
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileOpCall):
        * jit/JITInlines.h:
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_loop_hint):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitVarInjectionCheck):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_brand):
        (JSC::JIT::emitResolveClosure):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitPutGlobalVariableIndirect):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::emitVarInjectionCheck): Deleted.
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:

2021-10-01  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove CodeBlock::m_numberOfNonArgumentValueProfiles since we can get the same value from UnlinkedCodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=231066

        Reviewed by Robin Morisset.

        Since UnlinkedCodeBlock has UnlinkedValueProfile FixedVector, we can get CodeBlock::m_numberOfNonArgumentValueProfiles
        from UnlinkedCodeBlock. So CodeBlock does not need to keep it in its member.
        We also reorder some fields to shrink sizeof(CodeBlock) after this change.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::numberOfNonArgumentValueProfiles):
        (JSC::CodeBlock::totalNumberOfValueProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::numberOfValueProfiles const):
        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles const):

2021-10-01  Olivier Blin  <olivier.blin@softathome.com>

        [JSC][GLib] Fix typo in WrapperMap creation methods
        https://bugs.webkit.org/show_bug.cgi?id=231076

        Reviewed by Michael Catanzaro.

        * API/glib/JSCContext.cpp:
        (jscContextGetOrCreateJSWrapper):
        (jscContextCreateContextWithJSWrapper):
        * API/glib/JSCWrapperMap.cpp:
        (JSC::WrapperMap::createJSWrapper):
        (JSC::WrapperMap::createContextWithJSWrapper):
        (JSC::WrapperMap::createJSWrappper): Deleted.
        (JSC::WrapperMap::createContextWithJSWrappper): Deleted.
        * API/glib/JSCWrapperMap.h:

2021-09-30  Yusuke Suzuki  <ysuzuki@apple.com>

        Upgrade GCC requirement to 8.3.0
        https://bugs.webkit.org/show_bug.cgi?id=231042

        Reviewed by Darin Adler.

        * runtime/ConfigFile.cpp:
        (JSC::ConfigFile::canonicalizePaths):

2021-09-30  Saam Barati  <sbarati@apple.com>

        Regressions (r283288): [ macOS Debug ] webgl/2.0.0/conformance/state/gl-object-get-calls.html is timing out
        https://bugs.webkit.org/show_bug.cgi?id=231024
        <rdar://problem/83723856>

        Reviewed by Mark Lam.

        Speed up our debug assert by not using a probe.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):

2021-09-30  Saam Barati  <sbarati@apple.com>

        The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
        https://bugs.webkit.org/show_bug.cgi?id=230804
        <rdar://problem/83543951>

        Reviewed by Yusuke Suzuki.

        This patch fixes a couple bugs:
        - We were constant folding typeof on ProxyObject to "object"
          even when ProxyObject might produce a callable Proxy, and hence,
          should produce "function". This was a bug in AI.
        - This also fixes a similar bug in IsCallable's implementation in
          the FTL where we assumed that ProxyObject's type can't be callable.

        * bytecode/SpeculatedType.h:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-09-30  Fujii Hironori  <Hironori.Fujii@sony.com>

        Python 3 fails to run run-builtins-generator-tests : ModuleNotFoundError: No module named 'builtins_model'
        https://bugs.webkit.org/show_bug.cgi?id=230870

        Reviewed by Jonathan Bedard.

        BaseException.message has been deprecated as of Python 2.6. Use
        str(e) instead.

        Implicit relative imports have been deprecated in Python 3.
        Basically, relative imports should be used. However, the scripts
        in wkbuiltins directory are flattened when they are copied to
        WebKitBuild directory. So, relative imports can't be used.

        So, append wkbuiltins directory to sys.path as a workaround.

        * Scripts/generate-js-builtins.py:

2021-09-29  Mark Lam  <mark.lam@apple.com>

        DFG strength reduction on % operator should handle an INT_MIN divisor.
        https://bugs.webkit.org/show_bug.cgi?id=230391
        <rdar://problem/83229740>

        Reviewed by Robin Morisset.

        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):

2021-09-29  Saam Barati  <sbarati@apple.com>

        Print values in a nicer way in the jsc shell
        https://bugs.webkit.org/show_bug.cgi?id=230931

        Reviewed by Tadeu Zagallo.

        Currently, print(1), print("1"), and print([1]) all print to stdout
        simply as "1" (without the quotes). Same for values when running the
        REPL. This isn't super helpful. Let's print quotes for strings, and
        brackets for arrays.

        Some tests rely on the old print behavior. Those tests now use the legacyPrint
        instead.

        * jsc.cpp:
        (toCString):
        (printInternal):
        (JSC_DEFINE_HOST_FUNCTION):
        (runInteractive):
        (cStringFromViewWithString): Deleted.
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::toWTFStringForConsole const):
        * runtime/JSCJSValue.h:

2021-09-29  Saam Barati  <sbarati@apple.com>

        We need to load the baseline JIT's constant pool register after OSR exit to checkpoints if we return to baseline code
        https://bugs.webkit.org/show_bug.cgi?id=230972
        <rdar://83659469>

        Reviewed by Mark Lam and Yusuke Suzuki.

        Consider the following:
        - We have a CodeBlock A.
        - DFG or FTL compiles an exit to A when A is still LLInt code. This means
          the OSR exit code will materialize registers as if A is LLInt.
        - We tier up A to Baseline JIT code.
        - Now, we take the exit to A as if it's LLInt. But the checkpoint OSR exit
          code will actually jump to the tiered up baseline code when it's done,
          because it determines where to jump at runtime. Because of this, when
          we return from the checkpoint code, and if we are jumping into baseline
          code, we must always load the constant pool register.
        - There's no need to load the metadata register because that register is
          shared with LLInt code, and will already contain the right value.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::dispatchToNextInstructionDuringExit):
        (JSC::LLInt::llint_slow_path_checkpoint_osr_exit_from_inlined_call):
        (JSC::LLInt::llint_slow_path_checkpoint_osr_exit):
        (JSC::LLInt::dispatchToNextInstruction): Deleted.
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:

2021-09-29  Basuke Suzuki  <basuke.suzuki@sony.com>

        Suppress warnings for implicit copy assignment operator/copy constructor with clang 13
        https://bugs.webkit.org/show_bug.cgi?id=230963

        Reviewed by Mark Lam.

        Added default copy constructor to suppress warning.

        * bytecode/Operands.h:

2021-09-29  Basuke Suzuki  <basuke.suzuki@sony.com>

        [JSC] Add objectTypeCounts to JSGetMemoryUsageStatistics
        https://bugs.webkit.org/show_bug.cgi?id=230957

        Reviewed by Yusuke Suzuki.

        * API/JSBase.cpp: Added objectTypeCounts property
        (JSGetMemoryUsageStatistics):
        * API/JSBasePrivate.h: Added description of objectTypeCounts property
        * jsc.cpp: Added memoryUsageStatistics() function

2021-09-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove CodeBlock::m_llintExecuteCounter
        https://bugs.webkit.org/show_bug.cgi?id=230938

        Reviewed by Keith Miller.

        CodeBlock::m_llintExecuteCounter is a pointer pointing the middle of UnlinkedCodeBlock.
        So this is not necessary to have this pointer separately to access to that from LLInt,
        since loading UnlinkedCodeBlock and accessing to the middle of that do the same number
        of loads.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::jitSoon):
        (JSC::CodeBlock::jitNextInvocation):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::checkIfJITThresholdReached):
        (JSC::CodeBlock::dontJITAnytimeSoon):
        (JSC::CodeBlock::llintExecuteCounter const):
        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
        * llint/LowLevelInterpreter.asm:

2021-09-29  Saam Barati  <sbarati@apple.com>

        Code inside strength reduction can incorrectly prove that we know what lastIndex is
        https://bugs.webkit.org/show_bug.cgi?id=230802
        <rdar://problem/83543699>

        Reviewed by Mark Lam.

        The phase was searching backwards in the graph to see if it found the RegExp
        node. However, the RegExp node might be a JSConstant. Hence, the program
        didn't allocate it. So we can't assume that we know what the lastIndex is.
        We were incorrectly assuming it was "0" in a program like this:
        a: JSConstant(RegExp)
        b: RegExpExec(@a)
        
        And we assumed we're invoking RegExpExec with lastIndex is 0, because we found
        our RegExp in a backwards search. This is likely because we're also matching
        NewRegExp nodes, in which case, it is valid to say lastIndex is 0.
        
        This caused us to return a constant value that would've been the exec
        result had we invoked it with a NewRegExpNode.

        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::run):
        (JSC::DFG::StrengthReductionPhase::handleNode):

2021-09-29  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector in JITConstantPool
        https://bugs.webkit.org/show_bug.cgi?id=230937

        Reviewed by Keith Miller.

        This patch changes JITConstantPool to use FixedVector. This allocates exact size
        of memory and Making sizeof(JITConstantPool) smaller. We also use CompactPointerTuple
        for JITConstantPool::Value since it is faster for access.

        To achieve that, in JIT, we append Value to normal Vector. And when finalizing BaselineJITCode
        we construct JITConstantPool from that Vector.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        * jit/BaselineJITCode.h:
        (JSC::JITConstantPool::JITConstantPool):
        (JSC::JITConstantPool::add): Deleted.
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        (JSC::JIT::addToConstantPool):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitNewFuncCommon):
        (JSC::JIT::emitNewFuncExprCommon):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emit_op_enumerator_get_by_val):

2021-09-28  Saam Barati  <sbarati@apple.com>

        DoesGCCheck does not use enough bits for nodeIndex
        https://bugs.webkit.org/show_bug.cgi?id=230915
        <rdar://83297515>

        Reviewed by Mark Lam.

        * dfg/DFGDoesGCCheck.h:
        (JSC::DFG::DoesGCCheck::DoesGCCheck):
        (JSC::DFG::DoesGCCheck::encode):
        (JSC::DFG::DoesGCCheck::set):
        (JSC::DFG::DoesGCCheck::expectDoesGC const):
        (JSC::DFG::DoesGCCheck::isSpecial const):
        (JSC::DFG::DoesGCCheck::special):
        (JSC::DFG::DoesGCCheck::nodeOp):
        (JSC::DFG::DoesGCCheck::nodeIndex):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileLoopHint):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):

2021-09-28  Alex Christensen  <achristensen@webkit.org>

        Mostly fix Mac CMake build
        https://bugs.webkit.org/show_bug.cgi?id=230868

        Reviewed by Don Olmstead.

        * shell/PlatformMac.cmake:

2021-09-28  Saam Barati  <sbarati@apple.com>

        Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
        https://bugs.webkit.org/show_bug.cgi?id=230798

        Reviewed by Yusuke Suzuki.

        This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
        have an index into a table instead of storing a pointer to the profile in its metadata.
        Then, we can just load the profile using the index in the bytecode, which saves memory.

        * bytecode/BytecodeList.rb:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::binaryArithProfileForPC):
        (JSC::CodeBlock::unaryArithProfileForPC):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
        (JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitUnaryOp):
        (JSC::BytecodeGenerator::emitInc):
        (JSC::BytecodeGenerator::emitDec):
        * bytecompiler/BytecodeGenerator.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emit_op_div):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::updateArithProfileForUnaryArithOp):
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):

2021-09-28  Alexey Shvayka  <shvaikalesh@gmail.com>

        Speed up setting JSFunction's "prototype" property
        https://bugs.webkit.org/show_bug.cgi?id=230864

        Reviewed by Yusuke Suzuki.

        This patch:

          1. Removes "prototype" lookup from put(), which was non-inlineable and created an
             interim object with "constructor" field. Instead, the new value is put directly,
             with correct attributes, and respecting an altered receiver. This results in 2.8X
             perf boost for very common case of setting "prototype": `Cat.prototype = new Animal`.

          2. Simplifies initialization of class constructor's prototype object, removing tentacles
             from getOwnPropertySlot() and extracting constructPrototypeObject() helper. Provides
             a fast path for op_define_data_property, speeding up `class` creation by ~40%, while
             reifies normal function's prototype with correct attributes for Object.defineProperty().

        * runtime/JSFunction.cpp:
        (JSC::constructPrototypeObject):
        (JSC::JSFunction::getOwnPropertySlot):
        (JSC::JSFunction::put):
        (JSC::JSFunction::defineOwnProperty):

2021-09-27  Yusuke Suzuki  <ysuzuki@apple.com>

        [WTF] Add ApproximateTime
        https://bugs.webkit.org/show_bug.cgi?id=230876

        Reviewed by Filip Pizlo.

        This patch adds ApproximateTime, which offers monotonically increasing time but with coarse-grained resolution.
        ApproximateTime::now() is faster than normal MonotonicTime::now(), so that we can use this when we do not care
        about high resolution. For example, in Darwin x64, it is ~4x faster.
        Internally, it is using mach_approximate_time() in Darwin, clock_gettime+CLOCK_MONOTONIC_COARSE in Linux, and
        clock_gettime+CLOCK_MONOTONIC_FAST in FreeBSD. On the other platforms, we simply use the same source to MonotonicTime.

            wall-time-now             102.2614+-0.2449
            approximate-time-now       23.2583+-0.4083
            monotonic-time-now         88.8518+-2.4106

        We would like to use it in some places in JavaScriptCore in a subsequent patch: CodeBlock's creation time, GC time etc.

        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-09-28  Alexey Shvayka  <shvaikalesh@gmail.com>

        Tweak isCallable() to early return `true` for InternalFunction instances
        https://bugs.webkit.org/show_bug.cgi?id=230869

        Reviewed by Yusuke Suzuki.

        With this change, isCallable() avoids calling into InternalFunction::getCallData(),
        which is concurrency-aware and guaranteed to never return CallData::Type::None.
        We have a similar optimization for JSFunction.

        * runtime/JSCellInlines.h:
        (JSC::JSCell::isCallableWithConcurrency):

2021-09-27  Saam Barati  <sbarati@apple.com>

        Build an unlinked baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=229223
        <rdar://problem/82321772>

        Reviewed by Yusuke Suzuki.

        This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
        code produced by this baseline JIT can be shared between all CodeBlocks that
        share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
        from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
        instance, this new CodeBlock just starts off executing in the baseline JIT
        "for free".
        
        To make this work, the code we emit now needs to be independent of a specific
        CodeBlock instance. We use a CodeBlock instance for minimal profiling information
        when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
        we need CodeBlock specific information, we load it. This usually means things
        like we'll load things from the Metadata dynamically. This patch also adds a
        "linked constant pool" concept, and anytime we instantiate such a CodeBlock,
        we also need to instantiate this "linked constant pool". This contains things
        like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
        etc.
        
        Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
        made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
        Instead, we jump to the IC, and the IC jumps back by loading the "done" location
        from the StructureStubInfo dynamically. This simplifies the design to not be
        based on the arm64 calling convention, and keeps the same performance characteristics. 
        
        This patch also adds a new version of InlineAccess that is only used in baseline
        JIT (for now). In the future, we can make the DFG/FTL also use this for Data
        ICs. But we don't need to do that yet since those tiers don't use data ICs by
        default. The baseline JIT now has a pure data IC approach to InlineAccess. So
        instead of repatching code, we repatch fields we load dynamically.
        
        This patch also cleans up a few things in OSR exit, where both DFG/FTL were
        storing callee saves to the callee saves buffer in a weird place, and separate
        from one another. I noticed this code can be simplified if we just store
        callee saves at the end of the OSR exit handler, and from common JIT emission
        code.
        
        This patch also fixes a bug where we could end up with the wrong (and always
        more negative) SP in the baseline JIT. This could happen when we OSR exit
        from an inlined getter/setter. The OSR exit code puts the return PC when
        returning to the call site of the getter/setter to be the inline cache's
        "done location". However, this "done location" didn't used to restore SP.
        This patch conservatively makes it so that we restore the SP at these sites.
        
        This is measured as a 1% speedup on Speedometer2.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::fromStructureStubInfo):
        (JSC::AccessCase::generateImpl):
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeOperandsForCheckpoint.h:
        (JSC::valueProfileOffsetFor):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::fastPathStart):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitFastPath):
        (JSC::CallLinkInfo::emitTailCallFastPath):
        (JSC::CallLinkInfo::emitDataICFastPath):
        (JSC::CallLinkInfo::emitTailCallDataICFastPath):
        (JSC::CallLinkInfo::emitDataICSlowPath):
        (JSC::CallLinkInfo::initializeDataIC):
        (JSC::CallLinkInfo::emitDirectFastPath):
        (JSC::CallLinkInfo::emitDirectTailCallFastPath):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
        (JSC::CallLinkInfo::slowStub): Deleted.
        (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::frameRegisterCount):
        (JSC::CodeBlock::binaryArithProfileForPC):
        (JSC::CodeBlock::unaryArithProfileForPC):
        (JSC::CodeBlock::findPC):
        (JSC::CodeBlock::jitSoon):
        (JSC::CodeBlock::jitNextInvocation):
        (JSC::CodeBlock::dumpMathICStats):
        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
        (JSC::CodeBlock::addJITAddIC): Deleted.
        (JSC::CodeBlock::addJITMulIC): Deleted.
        (JSC::CodeBlock::addJITSubIC): Deleted.
        (JSC::CodeBlock::addJITNegIC): Deleted.
        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
        (JSC::CodeBlock::thresholdForJIT): Deleted.
        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::JITData::offsetOfJITConstantPool):
        (JSC::CodeBlock::offsetOfJITData):
        (JSC::CodeBlock::offsetOfArgumentValueProfiles):
        (JSC::CodeBlock::offsetOfConstantsVectorBuffer):
        (JSC::CodeBlock::baselineJITConstantPool):
        (JSC::CodeBlock::checkIfJITThresholdReached):
        (JSC::CodeBlock::dontJITAnytimeSoon):
        (JSC::CodeBlock::llintExecuteCounter const):
        (JSC::CodeBlock::offsetOfDebuggerRequests):
        (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
        (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::CodeBlock::addressOfNumParameters): Deleted.
        (JSC::CodeBlock::isKnownCell): Deleted.
        (JSC::CodeBlock::addMathIC): Deleted.
        (JSC::CodeBlock::setJITCodeMap): Deleted.
        (JSC::CodeBlock::jitCodeMap): Deleted.
        (JSC::CodeBlock::switchJumpTable): Deleted.
        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachValueProfile):
        (JSC::CodeBlock::jitCodeMap):
        (JSC::CodeBlock::baselineSwitchJumpTable):
        (JSC::CodeBlock::baselineStringSwitchJumpTable):
        (JSC::CodeBlock::dfgSwitchJumpTable):
        (JSC::CodeBlock::dfgStringSwitchJumpTable):
        * bytecode/ExecutableToCodeBlockEdge.h:
        * bytecode/ExecutionCounter.cpp:
        (JSC::ExecutionCounter<countingVariant>::setThreshold):
        * bytecode/ExecutionCounter.h:
        (JSC::ExecutionCounter::clippedThreshold):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
        (JSC::GetByIdModeMetadata::offsetOfMode):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::generateSelfPropertyAccess):
        (JSC::InlineAccess::canGenerateSelfPropertyReplace):
        (JSC::InlineAccess::generateSelfPropertyReplace):
        (JSC::InlineAccess::isCacheableArrayLength):
        (JSC::InlineAccess::generateArrayLength):
        (JSC::InlineAccess::isCacheableStringLength):
        (JSC::InlineAccess::generateStringLength):
        (JSC::InlineAccess::generateSelfInAccess):
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InlineAccess.h:
        * bytecode/IterationModeMetadata.h:
        (JSC::IterationModeMetadata::offsetOfSeenModes):
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::offsetOfArrayProfile):
        * bytecode/Opcode.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::succeed):
        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfDoneLocation):
        * bytecode/SuperSampler.cpp:
        (JSC::printSuperSamplerState):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::UnlinkedCodeBlock::hasIdentifier):
        (JSC::UnlinkedCodeBlock::thresholdForJIT):
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::constantRegister):
        (JSC::UnlinkedCodeBlock::instructionAt const):
        (JSC::UnlinkedCodeBlock::bytecodeOffset):
        (JSC::UnlinkedCodeBlock::instructionsSize const):
        (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
        (JSC::UnlinkedCodeBlock::binaryArithProfile):
        (JSC::UnlinkedCodeBlock::unaryArithProfile):
        (JSC::UnlinkedCodeBlock::llintExecuteCounter):
        * bytecode/UnlinkedMetadataTable.h:
        (JSC::UnlinkedMetadataTable::offsetInMetadataTable):
        * bytecode/ValueProfile.h:
        (JSC::ValueProfileBase::ValueProfileBase):
        (JSC::ValueProfileBase::clearBuckets):
        (JSC::ValueProfile::offsetOfFirstBucket):
        * dfg/DFGCommonData.h:
        * dfg/DFGJITCode.cpp:
        * dfg/DFGJITCode.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::callerReturnPC):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
        (JSC::DFG::SpeculativeJIT::compileValueAdd):
        (JSC::DFG::SpeculativeJIT::compileValueSub):
        (JSC::DFG::SpeculativeJIT::compileValueNegate):
        (JSC::DFG::SpeculativeJIT::compileValueMul):
        (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLJITCode.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::addMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * generator/Metadata.rb:
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::storeProperty):
        (JSC::AssemblyHelpers::emitVirtualCall):
        (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):
        * jit/BaselineJITCode.cpp: Added.
        (JSC::MathICHolder::addJITAddIC):
        (JSC::MathICHolder::addJITMulIC):
        (JSC::MathICHolder::addJITSubIC):
        (JSC::MathICHolder::addJITNegIC):
        (JSC::MathICHolder::adoptMathICs):
        (JSC::BaselineJITCode::BaselineJITCode):
        (JSC::BaselineJITCode::~BaselineJITCode):
        * jit/BaselineJITCode.h: Added.
        (JSC::JITConstantPool::add):
        (JSC::JITConstantPool::size const):
        (JSC::JITConstantPool::at const):
        * jit/BaselineJITPlan.cpp:
        (JSC::BaselineJITPlan::finalize):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::logShadowChickenTailPacketImpl):
        (JSC::CCallHelpers::logShadowChickenTailPacket):
        * jit/CCallHelpers.h:
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
        * jit/CallFrameShuffleData.h:
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::CallFrameShuffler):
        (JSC::CallFrameShuffler::prepareForTailCall):
        * jit/CallFrameShuffler.h:
        (JSC::CallFrameShuffler::snapshot const):
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::emitNotifyWriteWatchpoint):
        (JSC::JIT::emitVarReadOnlyCheck):
        (JSC::JIT::assertStackPointerOffset):
        (JSC::JIT::resetSP):
        (JSC::JIT::emitPutCodeBlockToFrameInPrologue):
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
        (JSC::JIT::emitRestoreCalleeSaves):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        (JSC::JIT::finalizeOnMainThread):
        (JSC::JIT::privateCompile):
        (JSC::JIT::frameRegisterCountFor):
        (JSC::JIT::stackPointerOffsetFor):
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_compareAndJumpSlowImpl):
        (JSC::JIT::emit_compareAndJumpSlow):
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        (JSC::JIT::emit_op_div):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * jit/JITCall.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        (JSC::JITCode::pcToCodeOriginMap):
        * jit/JITCompilationKey.cpp:
        (JSC::JITCompilationKey::dump const):
        * jit/JITCompilationKey.h:
        (JSC::JITCompilationKey::JITCompilationKey):
        (JSC::JITCompilationKey::operator! const):
        (JSC::JITCompilationKey::isHashTableDeletedValue const):
        (JSC::JITCompilationKey::operator== const):
        (JSC::JITCompilationKey::hash const):
        (JSC::JITCompilationKey::profiledBlock const): Deleted.
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITInlineCacheGenerator::finalize):
        (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITDelByValGenerator::generateFastPath):
        (JSC::JITDelByIdGenerator::generateFastPath):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInstanceOfGenerator::generateFastPath):
        (JSC::JITGetByValGenerator::generateFastPath):
        (JSC::JITPutByValGenerator::generateFastPath):
        (JSC::JITPrivateBrandAccessGenerator::generateFastPath):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::isOperandConstantDouble):
        (JSC::JIT::isOperandConstantInt):
        (JSC::JIT::isKnownCell):
        (JSC::JIT::getConstantOperand):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        (JSC::JIT::linkSlowCaseIfNotJSCell):
        (JSC::JIT::advanceToNextCheckpoint):
        (JSC::JIT::emitJumpSlowToHotForCheckpoint):
        (JSC::JIT::isOperandConstantChar):
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        (JSC::JIT::emitLoadDouble):
        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
        (JSC::JIT::emitGetVirtualRegister):
        (JSC::JIT::jumpTarget):
        (JSC::JIT::loadPtrFromMetadata):
        (JSC::JIT::load32FromMetadata):
        (JSC::JIT::load8FromMetadata):
        (JSC::JIT::store8ToMetadata):
        (JSC::JIT::store32ToMetadata):
        (JSC::JIT::materializePointerIntoMetadata):
        (JSC::JIT::loadConstant):
        (JSC::JIT::loadGlobalObject):
        (JSC::JIT::loadCodeBlockConstant):
        (JSC::JIT::copiedGetPutInfo): Deleted.
        (JSC::JIT::copiedArithProfile): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_mov):
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_to_primitive):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::valueIsFalseyGenerator):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jeq_ptr):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::valueIsTruthyGenerator):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::op_throw_handlerGenerator):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_debug):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emitSlow_op_jneq):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_check_traps):
        (JSC::JIT::op_check_traps_handlerGenerator):
        (JSC::JIT::emit_op_new_regexp):
        (JSC::JIT::emitNewFuncCommon):
        (JSC::JIT::emitNewFuncExprCommon):
        (JSC::JIT::emit_op_new_array):
        (JSC::JIT::emit_op_new_array_with_size):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        (JSC::JIT::emit_op_profile_control_flow):
        (JSC::JIT::emit_op_get_argument):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::compileOpEqJumpSlow):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPlan.cpp:
        (JSC::JITPlan::key):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_brand):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emitResolveClosure):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emit_enumerator_has_propertyImpl):
        (JSC::JIT::emitWriteBarrier):
        (JSC::JIT::emitPutGlobalVariable): Deleted.
        (JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
        (JSC::JIT::emitPutClosureVar): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):
        (JSC::tryCachePutBy):
        (JSC::tryCacheInBy):
        (JSC::unlinkCall):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CacheableIdentifier.h:
        * runtime/CacheableIdentifierInlines.h:
        (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCodeBlock::numBinaryArithProfiles const):
        (JSC::CachedCodeBlock::numUnaryArithProfiles const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):
        * runtime/CommonSlowPaths.cpp:
        (JSC::updateArithProfileForUnaryArithOp):
        * runtime/FunctionExecutable.h:
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::prepareForExecutionImpl):
        * wasm/WasmLLIntTierUpCounter.h:
        (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
        (JSC::Wasm::LLIntTierUpCounter::optimizeSoon):
        * wasm/WasmTierUpCount.cpp:
        (JSC::Wasm::TierUpCount::TierUpCount):
        * wasm/WasmTierUpCount.h:
        (JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
        (JSC::Wasm::TierUpCount::optimizeNextInvocation):
        (JSC::Wasm::TierUpCount::optimizeSoon):

2021-09-27  Xan López  <xan@igalia.com>

        [JSC][32bit] Fix build after r283098
        https://bugs.webkit.org/show_bug.cgi?id=230856

        Unreviewed build fix.

        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_jeq_ptr): remove unused (broken) line.

2021-09-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r283102, r283103 and r283104.
        https://bugs.webkit.org/show_bug.cgi?id=230854

        It regresses JetStream2 on iOS devices

        Reverted changesets:

        "Build an unlinked baseline JIT"
        https://bugs.webkit.org/show_bug.cgi?id=229223
        https://commits.webkit.org/r283102

        "Unreviewed, fix CLoop build"
        https://bugs.webkit.org/show_bug.cgi?id=229223
        https://commits.webkit.org/r283103

        "Unreviewed, fix CLoop build part 2"
        https://bugs.webkit.org/show_bug.cgi?id=229223
        https://commits.webkit.org/r283104

2021-09-27  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix CLoop build part 2
        https://bugs.webkit.org/show_bug.cgi?id=229223

        * llint/LowLevelInterpreter64.asm:

2021-09-27  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix CLoop build
        https://bugs.webkit.org/show_bug.cgi?id=229223

        * llint/LLIntOfflineAsmConfig.h:
        * llint/LowLevelInterpreter64.asm:

2021-09-27  Saam Barati  <sbarati@apple.com>

        Build an unlinked baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=229223
        <rdar://problem/82321772>

        Reviewed by Yusuke Suzuki.

        This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
        code produced by this baseline JIT can be shared between all CodeBlocks that
        share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
        from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
        instance, this new CodeBlock just starts off executing in the baseline JIT
        "for free".
        
        To make this work, the code we emit now needs to be independent of a specific
        CodeBlock instance. We use a CodeBlock instance for minimal profiling information
        when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
        we need CodeBlock specific information, we load it. This usually means things
        like we'll load things from the Metadata dynamically. This patch also adds a
        "linked constant pool" concept, and anytime we instantiate such a CodeBlock,
        we also need to instantiate this "linked constant pool". This contains things
        like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
        etc.
        
        Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
        made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
        Instead, we jump to the IC, and the IC jumps back by loading the "done" location
        from the StructureStubInfo dynamically. This simplifies the design to not be
        based on the arm64 calling convention, and keeps the same performance characteristics. 
        
        This patch also adds a new version of InlineAccess that is only used in baseline
        JIT (for now). In the future, we can make the DFG/FTL also use this for Data
        ICs. But we don't need to do that yet since those tiers don't use data ICs by
        default. The baseline JIT now has a pure data IC approach to InlineAccess. So
        instead of repatching code, we repatch fields we load dynamically.
        
        This patch also cleans up a few things in OSR exit, where both DFG/FTL were
        storing callee saves to the callee saves buffer in a weird place, and separate
        from one another. I noticed this code can be simplified if we just store
        callee saves at the end of the OSR exit handler, and from common JIT emission
        code.
        
        This patch also fixes a bug where we could end up with the wrong (and always
        more negative) SP in the baseline JIT. This could happen when we OSR exit
        from an inlined getter/setter. The OSR exit code puts the return PC when
        returning to the call site of the getter/setter to be the inline cache's
        "done location". However, this "done location" didn't used to restore SP.
        This patch conservatively makes it so that we restore the SP at these sites.
        
        This is measured as a 1% speedup on Speedometer2.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::fromStructureStubInfo):
        (JSC::AccessCase::generateImpl):
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeOperandsForCheckpoint.h:
        (JSC::valueProfileOffsetFor):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::fastPathStart):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitFastPath):
        (JSC::CallLinkInfo::emitTailCallFastPath):
        (JSC::CallLinkInfo::emitDataICFastPath):
        (JSC::CallLinkInfo::emitTailCallDataICFastPath):
        (JSC::CallLinkInfo::emitDataICSlowPath):
        (JSC::CallLinkInfo::initializeDataIC):
        (JSC::CallLinkInfo::emitDirectFastPath):
        (JSC::CallLinkInfo::emitDirectTailCallFastPath):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
        (JSC::CallLinkInfo::slowStub): Deleted.
        (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::frameRegisterCount):
        (JSC::CodeBlock::binaryArithProfileForPC):
        (JSC::CodeBlock::unaryArithProfileForPC):
        (JSC::CodeBlock::findPC):
        (JSC::CodeBlock::jitSoon):
        (JSC::CodeBlock::jitNextInvocation):
        (JSC::CodeBlock::dumpMathICStats):
        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
        (JSC::CodeBlock::addJITAddIC): Deleted.
        (JSC::CodeBlock::addJITMulIC): Deleted.
        (JSC::CodeBlock::addJITSubIC): Deleted.
        (JSC::CodeBlock::addJITNegIC): Deleted.
        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
        (JSC::CodeBlock::thresholdForJIT): Deleted.
        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::JITData::offsetOfJITConstantPool):
        (JSC::CodeBlock::offsetOfJITData):
        (JSC::CodeBlock::offsetOfArgumentValueProfiles):
        (JSC::CodeBlock::offsetOfConstantsVectorBuffer):
        (JSC::CodeBlock::baselineJITConstantPool):
        (JSC::CodeBlock::checkIfJITThresholdReached):
        (JSC::CodeBlock::dontJITAnytimeSoon):
        (JSC::CodeBlock::llintExecuteCounter const):
        (JSC::CodeBlock::offsetOfDebuggerRequests):
        (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
        (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::CodeBlock::addressOfNumParameters): Deleted.
        (JSC::CodeBlock::isKnownCell): Deleted.
        (JSC::CodeBlock::addMathIC): Deleted.
        (JSC::CodeBlock::setJITCodeMap): Deleted.
        (JSC::CodeBlock::jitCodeMap): Deleted.
        (JSC::CodeBlock::switchJumpTable): Deleted.
        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachValueProfile):
        (JSC::CodeBlock::jitCodeMap):
        (JSC::CodeBlock::baselineSwitchJumpTable):
        (JSC::CodeBlock::baselineStringSwitchJumpTable):
        (JSC::CodeBlock::dfgSwitchJumpTable):
        (JSC::CodeBlock::dfgStringSwitchJumpTable):
        * bytecode/ExecutableToCodeBlockEdge.h:
        * bytecode/ExecutionCounter.cpp:
        (JSC::ExecutionCounter<countingVariant>::setThreshold):
        * bytecode/ExecutionCounter.h:
        (JSC::ExecutionCounter::clippedThreshold):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
        (JSC::GetByIdModeMetadata::offsetOfMode):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::generateSelfPropertyAccess):
        (JSC::InlineAccess::canGenerateSelfPropertyReplace):
        (JSC::InlineAccess::generateSelfPropertyReplace):
        (JSC::InlineAccess::isCacheableArrayLength):
        (JSC::InlineAccess::generateArrayLength):
        (JSC::InlineAccess::isCacheableStringLength):
        (JSC::InlineAccess::generateStringLength):
        (JSC::InlineAccess::generateSelfInAccess):
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InlineAccess.h:
        * bytecode/IterationModeMetadata.h:
        (JSC::IterationModeMetadata::offsetOfSeenModes):
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::offsetOfArrayProfile):
        * bytecode/Opcode.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::succeed):
        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfDoneLocation):
        * bytecode/SuperSampler.cpp:
        (JSC::printSuperSamplerState):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::UnlinkedCodeBlock::hasIdentifier):
        (JSC::UnlinkedCodeBlock::thresholdForJIT):
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::constantRegister):
        (JSC::UnlinkedCodeBlock::instructionAt const):
        (JSC::UnlinkedCodeBlock::bytecodeOffset):
        (JSC::UnlinkedCodeBlock::instructionsSize const):
        (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
        (JSC::UnlinkedCodeBlock::binaryArithProfile):
        (JSC::UnlinkedCodeBlock::unaryArithProfile):
        (JSC::UnlinkedCodeBlock::llintExecuteCounter):
        * bytecode/UnlinkedMetadataTable.h:
        (JSC::UnlinkedMetadataTable::offsetInMetadataTable):
        * bytecode/ValueProfile.h:
        (JSC::ValueProfileBase::ValueProfileBase):
        (JSC::ValueProfileBase::clearBuckets):
        (JSC::ValueProfile::offsetOfFirstBucket):
        * dfg/DFGCommonData.h:
        * dfg/DFGJITCode.cpp:
        * dfg/DFGJITCode.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::callerReturnPC):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
        (JSC::DFG::SpeculativeJIT::compileValueAdd):
        (JSC::DFG::SpeculativeJIT::compileValueSub):
        (JSC::DFG::SpeculativeJIT::compileValueNegate):
        (JSC::DFG::SpeculativeJIT::compileValueMul):
        (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLJITCode.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::addMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * generator/Metadata.rb:
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::storeProperty):
        (JSC::AssemblyHelpers::emitVirtualCall):
        (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):
        * jit/BaselineJITCode.cpp: Added.
        (JSC::MathICHolder::addJITAddIC):
        (JSC::MathICHolder::addJITMulIC):
        (JSC::MathICHolder::addJITSubIC):
        (JSC::MathICHolder::addJITNegIC):
        (JSC::MathICHolder::adoptMathICs):
        (JSC::BaselineJITCode::BaselineJITCode):
        (JSC::BaselineJITCode::~BaselineJITCode):
        * jit/BaselineJITCode.h: Added.
        (JSC::JITConstantPool::add):
        (JSC::JITConstantPool::size const):
        (JSC::JITConstantPool::at const):
        * jit/BaselineJITPlan.cpp:
        (JSC::BaselineJITPlan::finalize):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::logShadowChickenTailPacketImpl):
        (JSC::CCallHelpers::logShadowChickenTailPacket):
        * jit/CCallHelpers.h:
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
        * jit/CallFrameShuffleData.h:
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::CallFrameShuffler):
        (JSC::CallFrameShuffler::prepareForTailCall):
        * jit/CallFrameShuffler.h:
        (JSC::CallFrameShuffler::snapshot const):
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::emitNotifyWriteWatchpoint):
        (JSC::JIT::emitVarReadOnlyCheck):
        (JSC::JIT::assertStackPointerOffset):
        (JSC::JIT::resetSP):
        (JSC::JIT::emitPutCodeBlockToFrameInPrologue):
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
        (JSC::JIT::emitRestoreCalleeSaves):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        (JSC::JIT::finalizeOnMainThread):
        (JSC::JIT::privateCompile):
        (JSC::JIT::frameRegisterCountFor):
        (JSC::JIT::stackPointerOffsetFor):
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_compareAndJumpSlowImpl):
        (JSC::JIT::emit_compareAndJumpSlow):
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        (JSC::JIT::emit_op_div):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * jit/JITCall.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        (JSC::JITCode::pcToCodeOriginMap):
        * jit/JITCompilationKey.cpp:
        (JSC::JITCompilationKey::dump const):
        * jit/JITCompilationKey.h:
        (JSC::JITCompilationKey::JITCompilationKey):
        (JSC::JITCompilationKey::operator! const):
        (JSC::JITCompilationKey::isHashTableDeletedValue const):
        (JSC::JITCompilationKey::operator== const):
        (JSC::JITCompilationKey::hash const):
        (JSC::JITCompilationKey::profiledBlock const): Deleted.
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITInlineCacheGenerator::finalize):
        (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITDelByValGenerator::generateFastPath):
        (JSC::JITDelByIdGenerator::generateFastPath):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInstanceOfGenerator::generateFastPath):
        (JSC::JITGetByValGenerator::generateFastPath):
        (JSC::JITPutByValGenerator::generateFastPath):
        (JSC::JITPrivateBrandAccessGenerator::generateFastPath):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::isOperandConstantDouble):
        (JSC::JIT::isOperandConstantInt):
        (JSC::JIT::isKnownCell):
        (JSC::JIT::getConstantOperand):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        (JSC::JIT::linkSlowCaseIfNotJSCell):
        (JSC::JIT::advanceToNextCheckpoint):
        (JSC::JIT::emitJumpSlowToHotForCheckpoint):
        (JSC::JIT::isOperandConstantChar):
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        (JSC::JIT::emitLoadDouble):
        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
        (JSC::JIT::emitGetVirtualRegister):
        (JSC::JIT::jumpTarget):
        (JSC::JIT::loadPtrFromMetadata):
        (JSC::JIT::load32FromMetadata):
        (JSC::JIT::load8FromMetadata):
        (JSC::JIT::store8ToMetadata):
        (JSC::JIT::store32ToMetadata):
        (JSC::JIT::materializePointerIntoMetadata):
        (JSC::JIT::loadConstant):
        (JSC::JIT::loadGlobalObject):
        (JSC::JIT::loadCodeBlockConstant):
        (JSC::JIT::copiedGetPutInfo): Deleted.
        (JSC::JIT::copiedArithProfile): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_mov):
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_to_primitive):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::valueIsFalseyGenerator):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jeq_ptr):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::valueIsTruthyGenerator):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::op_throw_handlerGenerator):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_debug):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emitSlow_op_jneq):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_check_traps):
        (JSC::JIT::op_check_traps_handlerGenerator):
        (JSC::JIT::emit_op_new_regexp):
        (JSC::JIT::emitNewFuncCommon):
        (JSC::JIT::emitNewFuncExprCommon):
        (JSC::JIT::emit_op_new_array):
        (JSC::JIT::emit_op_new_array_with_size):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        (JSC::JIT::emit_op_profile_control_flow):
        (JSC::JIT::emit_op_get_argument):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::compileOpEqJumpSlow):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPlan.cpp:
        (JSC::JITPlan::key):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_brand):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emitResolveClosure):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emit_enumerator_has_propertyImpl):
        (JSC::JIT::emitWriteBarrier):
        (JSC::JIT::emitPutGlobalVariable): Deleted.
        (JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
        (JSC::JIT::emitPutClosureVar): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):
        (JSC::tryCachePutBy):
        (JSC::tryCacheInBy):
        (JSC::unlinkCall):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CacheableIdentifier.h:
        * runtime/CacheableIdentifierInlines.h:
        (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCodeBlock::numBinaryArithProfiles const):
        (JSC::CachedCodeBlock::numUnaryArithProfiles const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):
        * runtime/CommonSlowPaths.cpp:
        (JSC::updateArithProfileForUnaryArithOp):
        * runtime/FunctionExecutable.h:
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::prepareForExecutionImpl):
        * wasm/WasmLLIntTierUpCounter.h:
        (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
        (JSC::Wasm::LLIntTierUpCounter::optimizeSoon):
        * wasm/WasmTierUpCount.cpp:
        (JSC::Wasm::TierUpCount::TierUpCount):
        * wasm/WasmTierUpCount.h:
        (JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
        (JSC::Wasm::TierUpCount::optimizeNextInvocation):
        (JSC::Wasm::TierUpCount::optimizeSoon):

2021-09-27  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use op_jeq_ptr for empty JSPropertyNameEnumerator check
        https://bugs.webkit.org/show_bug.cgi?id=230817

        Reviewed by Saam Barati.

        We use op_jeq_ptr for empty JSPropertyNameEnumerator check instead of stricteq for smaller
        bytecode size and efficient branching in LLInt and Baseline. In DFG and FTL, both will get
        the same nodes.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ForInNode::emitBytecode):

2021-09-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize PutByVal with for-in
        https://bugs.webkit.org/show_bug.cgi?id=230801

        Reviewed by Saam Barati.

        We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
        And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
        The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
        forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
        the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

        In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
        pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
        since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
        is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
        as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

        To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
        not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
        for existing jneq_ptr bytecode.

        We also clean up DFG operation related to PutByVal.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |116.010000   |112.701667   |0.971482  | 0.000000 (significant)                           |
        | VueJS-TodoMVC                        |22.995000    |23.023333    |1.001232  | 0.907086                                         |
        | EmberJS-TodoMVC                      |125.498333   |125.525000   |1.000212  | 0.932546                                         |
        | BackboneJS-TodoMVC                   |45.700000    |45.975000    |1.006018  | 0.084799                                         |
        | Preact-TodoMVC                       |16.681667    |16.610000    |0.995704  | 0.722758                                         |
        | AngularJS-TodoMVC                    |123.753333   |123.740000   |0.999892  | 0.971431                                         |
        | Vanilla-ES2015-TodoMVC               |61.255000    |61.380000    |1.002041  | 0.300654                                         |
        | Inferno-TodoMVC                      |58.646667    |58.948333    |1.005144  | 0.267611                                         |
        | Flight-TodoMVC                       |73.283333    |72.801667    |0.993427  | 0.207389                                         |
        | Angular2-TypeScript-TodoMVC          |39.746667    |40.015000    |1.006751  | 0.449821                                         |
        | VanillaJS-TodoMVC                    |50.096667    |49.823333    |0.994544  | 0.162020                                         |
        | jQuery-TodoMVC                       |212.870000   |213.196667   |1.001535  | 0.371944                                         |
        | EmberJS-Debug-TodoMVC                |331.878333   |332.710000   |1.002506  | 0.094499                                         |
        | React-TodoMVC                        |83.078333    |82.726667    |0.995767  | 0.076143                                         |
        | React-Redux-TodoMVC                  |136.018333   |133.935000   |0.984683  | 0.000000 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333    |59.643333    |0.998326  | 0.393671                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 271.75873
        b mean = 272.45804
        pValue = 0.0263030803
        (Bigger means are better.)
        1.003 times better
        Results ARE significant

        * builtins/BuiltinNames.h:
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeUseDef.cpp:
        (JSC::computeUsesForBytecodeIndexImpl):
        (JSC::computeDefsForBytecodeIndexImpl):
        * bytecode/LinkTimeConstant.h:
        * bytecode/Opcode.h:
        (JSC::isBranch):
        * bytecode/PreciseJumpTargetsInlines.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::GenericLabel<JSGeneratorTraits>::setLocation):
        (JSC::BytecodeGenerator::emitJumpIfSentinelString):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ForInNode::emitBytecode):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::putByValInternal):
        (JSC::DFG::putByValCellInternal):
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_jeq_ptr):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_jeq_ptr):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_enumerator_next):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/SmallStrings.cpp:
        (JSC::SmallStrings::initializeCommonStrings):
        (JSC::SmallStrings::visitStrongReferences):
        * runtime/SmallStrings.h:
        (JSC::SmallStrings::sentinelString const):

2021-09-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r283095.
        https://bugs.webkit.org/show_bug.cgi?id=230815

        We should land the original patch since this does not work
        with bytecode cache

        Reverted changeset:

        "[JSC] Optimize PutByVal with for-in"
        https://bugs.webkit.org/show_bug.cgi?id=230801
        https://commits.webkit.org/r283095

2021-09-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize PutByVal with for-in
        https://bugs.webkit.org/show_bug.cgi?id=230801

        Reviewed by Saam Barati.

        We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
        And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
        The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
        forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
        the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

        In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
        pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
        since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
        is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
        as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

        To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
        not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
        for existing jneq_ptr bytecode.

        We also clean up DFG operation related to PutByVal.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |116.010000   |112.701667   |0.971482  | 0.000000 (significant)                           |
        | VueJS-TodoMVC                        |22.995000    |23.023333    |1.001232  | 0.907086                                         |
        | EmberJS-TodoMVC                      |125.498333   |125.525000   |1.000212  | 0.932546                                         |
        | BackboneJS-TodoMVC                   |45.700000    |45.975000    |1.006018  | 0.084799                                         |
        | Preact-TodoMVC                       |16.681667    |16.610000    |0.995704  | 0.722758                                         |
        | AngularJS-TodoMVC                    |123.753333   |123.740000   |0.999892  | 0.971431                                         |
        | Vanilla-ES2015-TodoMVC               |61.255000    |61.380000    |1.002041  | 0.300654                                         |
        | Inferno-TodoMVC                      |58.646667    |58.948333    |1.005144  | 0.267611                                         |
        | Flight-TodoMVC                       |73.283333    |72.801667    |0.993427  | 0.207389                                         |
        | Angular2-TypeScript-TodoMVC          |39.746667    |40.015000    |1.006751  | 0.449821                                         |
        | VanillaJS-TodoMVC                    |50.096667    |49.823333    |0.994544  | 0.162020                                         |
        | jQuery-TodoMVC                       |212.870000   |213.196667   |1.001535  | 0.371944                                         |
        | EmberJS-Debug-TodoMVC                |331.878333   |332.710000   |1.002506  | 0.094499                                         |
        | React-TodoMVC                        |83.078333    |82.726667    |0.995767  | 0.076143                                         |
        | React-Redux-TodoMVC                  |136.018333   |133.935000   |0.984683  | 0.000000 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333    |59.643333    |0.998326  | 0.393671                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 271.75873
        b mean = 272.45804
        pValue = 0.0263030803
        (Bigger means are better.)
        1.003 times better
        Results ARE significant

        * builtins/BuiltinNames.h:
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeUseDef.cpp:
        (JSC::computeUsesForBytecodeIndexImpl):
        (JSC::computeDefsForBytecodeIndexImpl):
        * bytecode/LinkTimeConstant.h:
        * bytecode/Opcode.h:
        (JSC::isBranch):
        * bytecode/PreciseJumpTargetsInlines.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::GenericLabel<JSGeneratorTraits>::setLocation):
        (JSC::BytecodeGenerator::emitJumpIfSentinelString):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ForInNode::emitBytecode):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::putByValInternal):
        (JSC::DFG::putByValCellInternal):
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_jeq_ptr):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_jeq_ptr):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_enumerator_next):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/SmallStrings.cpp:
        (JSC::SmallStrings::initializeCommonStrings):
        (JSC::SmallStrings::visitStrongReferences):
        * runtime/SmallStrings.h:
        (JSC::SmallStrings::sentinelString const):

2021-09-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r283083 and r283088.
        https://bugs.webkit.org/show_bug.cgi?id=230806

        Windows pors are crashing

        Reverted changesets:

        "Build an unlinked baseline JIT"
        https://bugs.webkit.org/show_bug.cgi?id=229223
        https://commits.webkit.org/r283083

        "Make byte codes with arithmetic profiles switch to using an
        index instead of a pointer in metadata"
        https://bugs.webkit.org/show_bug.cgi?id=230798
        https://commits.webkit.org/r283088

2021-09-26  Saam Barati  <sbarati@apple.com>

        Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
        https://bugs.webkit.org/show_bug.cgi?id=230798

        Reviewed by Yusuke Suzuki.

        This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
        have an index into a table instead of storing a pointer to the profile in its metadata.
        Then, we can just load the profile using the index in the bytecode, which saves memory.

        * bytecode/BytecodeList.rb:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::binaryArithProfileForPC):
        (JSC::CodeBlock::unaryArithProfileForPC):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
        (JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitUnaryOp):
        (JSC::BytecodeGenerator::emitInc):
        (JSC::BytecodeGenerator::emitDec):
        * bytecompiler/BytecodeGenerator.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emit_op_div):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::updateArithProfileForUnaryArithOp):
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):

2021-09-25  Saam Barati  <sbarati@apple.com>

        Build an unlinked baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=229223
        <rdar://problem/82321772>

        Reviewed by Yusuke Suzuki.

        This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
        code produced by this baseline JIT can be shared between all CodeBlocks that
        share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
        from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
        instance, this new CodeBlock just starts off executing in the baseline JIT
        "for free".
        
        To make this work, the code we emit now needs to be independent of a specific
        CodeBlock instance. We use a CodeBlock instance for minimal profiling information
        when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
        we need CodeBlock specific information, we load it. This usually means things
        like we'll load things from the Metadata dynamically. This patch also adds a
        "linked constant pool" concept, and anytime we instantiate such a CodeBlock,
        we also need to instantiate this "linked constant pool". This contains things
        like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
        etc.
        
        Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
        made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
        Instead, we jump to the IC, and the IC jumps back by loading the "done" location
        from the StructureStubInfo dynamically. This simplifies the design to not be
        based on the arm64 calling convention, and keeps the same performance characteristics. 
        
        This patch also adds a new version of InlineAccess that is only used in baseline
        JIT (for now). In the future, we can make the DFG/FTL also use this for Data
        ICs. But we don't need to do that yet since those tiers don't use data ICs by
        default. The baseline JIT now has a pure data IC approach to InlineAccess. So
        instead of repatching code, we repatch fields we load dynamically.
        
        This patch also cleans up a few things in OSR exit, where both DFG/FTL were
        storing callee saves to the callee saves buffer in a weird place, and separate
        from one another. I noticed this code can be simplified if we just store
        callee saves at the end of the OSR exit handler, and from common JIT emission
        code.
        
        This patch also fixes a bug where we could end up with the wrong (and always
        more negative) SP in the baseline JIT. This could happen when we OSR exit
        from an inlined getter/setter. The OSR exit code puts the return PC when
        returning to the call site of the getter/setter to be the inline cache's
        "done location". However, this "done location" didn't used to restore SP.
        This patch conservatively makes it so that we restore the SP at these sites.
        
        This is measured as a 1% speedup on Speedometer2.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::fromStructureStubInfo):
        (JSC::AccessCase::generateImpl):
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeOperandsForCheckpoint.h:
        (JSC::valueProfileOffsetFor):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::fastPathStart):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitFastPath):
        (JSC::CallLinkInfo::emitTailCallFastPath):
        (JSC::CallLinkInfo::emitDataICFastPath):
        (JSC::CallLinkInfo::emitTailCallDataICFastPath):
        (JSC::CallLinkInfo::emitDataICSlowPath):
        (JSC::CallLinkInfo::initializeDataIC):
        (JSC::CallLinkInfo::emitDirectFastPath):
        (JSC::CallLinkInfo::emitDirectTailCallFastPath):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
        (JSC::CallLinkInfo::slowStub): Deleted.
        (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
        (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::finalizeJITInlineCaches):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::frameRegisterCount):
        (JSC::CodeBlock::binaryArithProfileForPC):
        (JSC::CodeBlock::unaryArithProfileForPC):
        (JSC::CodeBlock::findPC):
        (JSC::CodeBlock::jitSoon):
        (JSC::CodeBlock::jitNextInvocation):
        (JSC::CodeBlock::dumpMathICStats):
        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
        (JSC::CodeBlock::addJITAddIC): Deleted.
        (JSC::CodeBlock::addJITMulIC): Deleted.
        (JSC::CodeBlock::addJITSubIC): Deleted.
        (JSC::CodeBlock::addJITNegIC): Deleted.
        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
        (JSC::CodeBlock::thresholdForJIT): Deleted.
        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::JITData::offsetOfJITConstantPool):
        (JSC::CodeBlock::offsetOfJITData):
        (JSC::CodeBlock::offsetOfArgumentValueProfiles):
        (JSC::CodeBlock::offsetOfConstantsVectorBuffer):
        (JSC::CodeBlock::baselineJITConstantPool):
        (JSC::CodeBlock::checkIfJITThresholdReached):
        (JSC::CodeBlock::dontJITAnytimeSoon):
        (JSC::CodeBlock::llintExecuteCounter const):
        (JSC::CodeBlock::offsetOfDebuggerRequests):
        (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
        (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::CodeBlock::addressOfNumParameters): Deleted.
        (JSC::CodeBlock::isKnownCell): Deleted.
        (JSC::CodeBlock::addMathIC): Deleted.
        (JSC::CodeBlock::setJITCodeMap): Deleted.
        (JSC::CodeBlock::jitCodeMap): Deleted.
        (JSC::CodeBlock::switchJumpTable): Deleted.
        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachValueProfile):
        (JSC::CodeBlock::jitCodeMap):
        (JSC::CodeBlock::baselineSwitchJumpTable):
        (JSC::CodeBlock::baselineStringSwitchJumpTable):
        (JSC::CodeBlock::dfgSwitchJumpTable):
        (JSC::CodeBlock::dfgStringSwitchJumpTable):
        * bytecode/ExecutableToCodeBlockEdge.h:
        * bytecode/ExecutionCounter.cpp:
        (JSC::ExecutionCounter<countingVariant>::setThreshold):
        * bytecode/ExecutionCounter.h:
        (JSC::ExecutionCounter::clippedThreshold):
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
        (JSC::GetByIdModeMetadata::offsetOfMode):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::generateSelfPropertyAccess):
        (JSC::InlineAccess::canGenerateSelfPropertyReplace):
        (JSC::InlineAccess::generateSelfPropertyReplace):
        (JSC::InlineAccess::isCacheableArrayLength):
        (JSC::InlineAccess::generateArrayLength):
        (JSC::InlineAccess::isCacheableStringLength):
        (JSC::InlineAccess::generateStringLength):
        (JSC::InlineAccess::generateSelfInAccess):
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        * bytecode/InlineAccess.h:
        * bytecode/IterationModeMetadata.h:
        (JSC::IterationModeMetadata::offsetOfSeenModes):
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::offsetOfArrayProfile):
        * bytecode/Opcode.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::succeed):
        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.
        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::computeForStubInfo):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
        (JSC::StructureStubInfo::inlineAccessBaseStructure):
        (JSC::StructureStubInfo::offsetOfDoneLocation):
        * bytecode/SuperSampler.cpp:
        (JSC::printSuperSamplerState):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::UnlinkedCodeBlock::hasIdentifier):
        (JSC::UnlinkedCodeBlock::thresholdForJIT):
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::constantRegister):
        (JSC::UnlinkedCodeBlock::instructionAt const):
        (JSC::UnlinkedCodeBlock::bytecodeOffset):
        (JSC::UnlinkedCodeBlock::instructionsSize const):
        (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
        (JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
        (JSC::UnlinkedCodeBlock::binaryArithProfile):
        (JSC::UnlinkedCodeBlock::unaryArithProfile):
        (JSC::UnlinkedCodeBlock::llintExecuteCounter):
        * bytecode/UnlinkedMetadataTable.h:
        (JSC::UnlinkedMetadataTable::offsetInMetadataTable):
        * bytecode/ValueProfile.h:
        (JSC::ValueProfileBase::ValueProfileBase):
        (JSC::ValueProfileBase::clearBuckets):
        (JSC::ValueProfile::offsetOfFirstBucket):
        * dfg/DFGCommonData.h:
        * dfg/DFGJITCode.cpp:
        * dfg/DFGJITCode.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::callerReturnPC):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
        (JSC::DFG::SpeculativeJIT::compileValueAdd):
        (JSC::DFG::SpeculativeJIT::compileValueSub):
        (JSC::DFG::SpeculativeJIT::compileValueNegate):
        (JSC::DFG::SpeculativeJIT::compileValueMul):
        (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLJITCode.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::addMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * generator/Metadata.rb:
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::storeProperty):
        (JSC::AssemblyHelpers::emitVirtualCall):
        (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):
        * jit/BaselineJITCode.cpp: Added.
        (JSC::MathICHolder::addJITAddIC):
        (JSC::MathICHolder::addJITMulIC):
        (JSC::MathICHolder::addJITSubIC):
        (JSC::MathICHolder::addJITNegIC):
        (JSC::MathICHolder::adoptMathICs):
        (JSC::BaselineJITCode::BaselineJITCode):
        (JSC::BaselineJITCode::~BaselineJITCode):
        * jit/BaselineJITCode.h: Added.
        (JSC::JITConstantPool::add):
        (JSC::JITConstantPool::size const):
        (JSC::JITConstantPool::at const):
        * jit/BaselineJITPlan.cpp:
        (JSC::BaselineJITPlan::finalize):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::logShadowChickenTailPacketImpl):
        (JSC::CCallHelpers::logShadowChickenTailPacket):
        * jit/CCallHelpers.h:
        * jit/CallFrameShuffleData.cpp:
        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
        * jit/CallFrameShuffleData.h:
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::CallFrameShuffler):
        (JSC::CallFrameShuffler::prepareForTailCall):
        * jit/CallFrameShuffler.h:
        (JSC::CallFrameShuffler::snapshot const):
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::emitNotifyWriteWatchpoint):
        (JSC::JIT::emitVarReadOnlyCheck):
        (JSC::JIT::assertStackPointerOffset):
        (JSC::JIT::resetSP):
        (JSC::JIT::emitPutCodeBlockToFrameInPrologue):
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
        (JSC::JIT::emitRestoreCalleeSaves):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        (JSC::JIT::finalizeOnMainThread):
        (JSC::JIT::privateCompile):
        (JSC::JIT::frameRegisterCountFor):
        (JSC::JIT::stackPointerOffsetFor):
        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_compareAndJumpSlowImpl):
        (JSC::JIT::emit_compareAndJumpSlow):
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        (JSC::JIT::emit_op_div):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * jit/JITCall.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::emitPutCallResult):
        (JSC::JIT::compileSetupFrame):
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        (JSC::JITCode::pcToCodeOriginMap):
        * jit/JITCompilationKey.cpp:
        (JSC::JITCompilationKey::dump const):
        * jit/JITCompilationKey.h:
        (JSC::JITCompilationKey::JITCompilationKey):
        (JSC::JITCompilationKey::operator! const):
        (JSC::JITCompilationKey::isHashTableDeletedValue const):
        (JSC::JITCompilationKey::operator== const):
        (JSC::JITCompilationKey::hash const):
        (JSC::JITCompilationKey::profiledBlock const): Deleted.
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITInlineCacheGenerator::finalize):
        (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
        (JSC::generateGetByIdInlineAccess):
        (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITDelByValGenerator::generateFastPath):
        (JSC::JITDelByIdGenerator::generateFastPath):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
        (JSC::JITInstanceOfGenerator::generateFastPath):
        (JSC::JITGetByValGenerator::generateFastPath):
        (JSC::JITPutByValGenerator::generateFastPath):
        (JSC::JITPrivateBrandAccessGenerator::generateFastPath):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::isOperandConstantDouble):
        (JSC::JIT::isOperandConstantInt):
        (JSC::JIT::isKnownCell):
        (JSC::JIT::getConstantOperand):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        (JSC::JIT::linkSlowCaseIfNotJSCell):
        (JSC::JIT::advanceToNextCheckpoint):
        (JSC::JIT::emitJumpSlowToHotForCheckpoint):
        (JSC::JIT::isOperandConstantChar):
        (JSC::JIT::emitValueProfilingSite):
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        (JSC::JIT::emitLoadDouble):
        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
        (JSC::JIT::emitGetVirtualRegister):
        (JSC::JIT::jumpTarget):
        (JSC::JIT::loadPtrFromMetadata):
        (JSC::JIT::load32FromMetadata):
        (JSC::JIT::load8FromMetadata):
        (JSC::JIT::store8ToMetadata):
        (JSC::JIT::store32ToMetadata):
        (JSC::JIT::materializePointerIntoMetadata):
        (JSC::JIT::loadConstant):
        (JSC::JIT::loadGlobalObject):
        (JSC::JIT::loadCodeBlockConstant):
        (JSC::JIT::copiedGetPutInfo): Deleted.
        (JSC::JIT::copiedArithProfile): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_mov):
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_to_primitive):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::valueIsFalseyGenerator):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::valueIsTruthyGenerator):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::op_throw_handlerGenerator):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_debug):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emitSlow_op_jneq):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_check_traps):
        (JSC::JIT::op_check_traps_handlerGenerator):
        (JSC::JIT::emit_op_new_regexp):
        (JSC::JIT::emitNewFuncCommon):
        (JSC::JIT::emitNewFuncExprCommon):
        (JSC::JIT::emit_op_new_array):
        (JSC::JIT::emit_op_new_array_with_size):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        (JSC::JIT::emit_op_profile_control_flow):
        (JSC::JIT::emit_op_get_argument):
        (JSC::JIT::emit_op_get_prototype_of):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_overrides_has_instance):
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_typeof_is_undefined):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_jneq_ptr):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::compileOpEqJumpSlow):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_to_numeric):
        (JSC::JIT::emit_op_to_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::emit_op_create_this):
        (JSC::JIT::emit_op_to_this):
        (JSC::JIT::emit_op_profile_type):
        (JSC::JIT::emit_op_log_shadow_chicken_tail):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPlan.cpp:
        (JSC::JITPlan::key):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_brand):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emitResolveClosure):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emit_enumerator_has_propertyImpl):
        (JSC::JIT::emitWriteBarrier):
        (JSC::JIT::emitSlow_op_get_from_scope): Deleted.
        (JSC::JIT::emitPutGlobalVariable): Deleted.
        (JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
        (JSC::JIT::emitPutClosureVar): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_getter_by_id):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emitVarInjectionCheck):
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::emit_op_put_to_scope):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_get_internal_field):
        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):
        (JSC::tryCachePutBy):
        (JSC::tryCacheInBy):
        (JSC::unlinkCall):
        * jit/ThunkGenerators.cpp:
        (JSC::handleExceptionGenerator):
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        * jit/ThunkGenerators.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CacheableIdentifier.h:
        * runtime/CacheableIdentifierInlines.h:
        (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCodeBlock::numBinaryArithProfiles const):
        (JSC::CachedCodeBlock::numUnaryArithProfiles const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):
        * runtime/CommonSlowPaths.cpp:
        (JSC::updateArithProfileForUnaryArithOp):
        * runtime/FunctionExecutable.h:
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::prepareForExecutionImpl):
        * wasm/WasmLLIntTierUpCounter.h:
        (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
        (JSC::Wasm::LLIntTierUpCounter::optimizeSoon):
        * wasm/WasmTierUpCount.cpp:
        (JSC::Wasm::TierUpCount::TierUpCount):
        * wasm/WasmTierUpCount.h:
        (JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
        (JSC::Wasm::TierUpCount::optimizeNextInvocation):
        (JSC::Wasm::TierUpCount::optimizeSoon):

2021-09-24 Rick Waldron <waldron.rick@gmail.com>

        [JSC] Add checkScriptSyntax function to jsc host environment
        https://bugs.webkit.org/show_bug.cgi?id=230631

        Reviewed by Yusuke Suzuki.

        Introduce a function called checkScriptSyntax() that performs the same
        operation as checkModuleSyntax(), without the module specific semantics.
        Updates tests that were using eval() to verify syntax.

        * jsc.cpp:
        (functionCheckScriptSyntax)

2021-09-23  Philip Chimento  <pchimento@igalia.com>

        Various tweaks in preparation for Temporal.Instant
        https://bugs.webkit.org/show_bug.cgi?id=230331

        Reviewed by Yusuke Suzuki.

        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::fromDurationLike): Use
          temporalUnitPropertyName().
        (JSC::TemporalDuration::toISO8601Duration): Improve error message to
          include the invalid string.
        (JSC::TemporalDuration::with const): Use temporalUnitPropertyName().
        (JSC::TemporalDuration::toString): Use formatSecondsStringFraction().
        * runtime/TemporalObject.cpp:
        (JSC::ellipsizeAt): Add helper to ellipsize string at certain length.
        (JSC::temporalUnitPropertyName): Move code from TemporalDuration into
          a function which will be reused in other Temporal types.
        (JSC::temporalFractionalSecondDigits): Handle NaN as per
          specification, and improve error message to include the invalid
          value.
        (JSC::formatSecondsStringFraction): Move code from TemporalDuration
          into a function which will be reused in other Temporal types.
        * runtime/TemporalObject.h:

2021-09-23  Devin Rousso  <drousso@apple.com>

        Web Inspector: Graphics: add instrumentation for new `CanvasRenderingContext2DSettings`
        https://bugs.webkit.org/show_bug.cgi?id=225180
        <rdar://problem/77587429>

        Reviewed by BJ Burg.

        * inspector/protocol/Canvas.json:
        Add `colorSpace` and `desynchronized` to `Canvas.ContextAttributes`.

2021-09-23  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Handle syntactic production for `#x in expr` correctly
        https://bugs.webkit.org/show_bug.cgi?id=230668

        Reviewed by Yusuke Suzuki.

        The production for `#x in expr` is easy to get wrong.

            RelationalExpression[In, Yield, Await] :
                ShiftExpression[?Yield, ?Await]
                RelationalExpression[?In, ?Yield, ?Await] < ShiftExpression[?Yield, ?Await]
                RelationalExpression[?In, ?Yield, ?Await] > ShiftExpression[?Yield, ?Await]
                RelationalExpression[?In, ?Yield, ?Await] <= ShiftExpression[?Yield, ?Await]
                RelationalExpression[?In, ?Yield, ?Await] >= ShiftExpression[?Yield, ?Await]
                RelationalExpression[?In, ?Yield, ?Await] instanceof ShiftExpression[?Yield, ?Await]
                [+In] RelationalExpression[+In, ?Yield, ?Await] in ShiftExpression[?Yield, ?Await]
                [+In] PrivateIdentifier in ShiftExpression[?Yield, ?Await]

        We were ensuring that a standalone private name `#x` is always followed by operator `in`;
        this patch further ensures that that particular `in` can't have its LHS misparsed as a RelationalExpression.

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseBinaryExpression):
        Verify the precedence of the topmost operator on the stack (if any) when parsing standalone `#x`.

2021-09-22  Mikhail R. Gadelha  <mikhail@igalia.com>

        Null pointer dereference in JSC::GetByStatus
        https://bugs.webkit.org/show_bug.cgi?id=229674

        Reviewed by Yusuke Suzuki. 

        In GetByStatus::computeForStubInfoWithoutExitSiteFeedback, there are
        several places that dereference the stubInfo argument when calling the
        GetByStatus constructor. To prevent a nullptr dereference, the pointer
        is not dereferenced anymore, and a check was added to check if stubInfo
        is a valid pointer before accessing it.

        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::GetByStatus):
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByStatus.h:

2021-09-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Filter algorithmic numbering systems from enumeration data
        https://bugs.webkit.org/show_bug.cgi?id=230660

        Reviewed by Ross Kirsling.

        Algorithmic numbering systems' handling is not included in normal ICU build.
        This patch filters out them from available numbering systems.

        * runtime/IntlObject.cpp:
        (JSC::availableNumberingSystems):

2021-09-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Adjust Intl currency enumeration
        https://bugs.webkit.org/show_bug.cgi?id=230656

        Reviewed by Ross Kirsling.

        1. List up all available currencies.
        2. Introduce a work-around for VES, LSM, and EQE

        * runtime/IntlObject.cpp:
        (JSC::availableCurrencies):

2021-09-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] emoji and eor collations are missing
        https://bugs.webkit.org/show_bug.cgi?id=230652

        Reviewed by Ross Kirsling.

        Due to ICU's bug, "emoji" and "eor" collations are missing from enumeration.
        This patch adds work-around for this.

        * runtime/IntlObject.cpp:
        (JSC::availableCollations):

2021-09-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Intl unicode identifier type will reject underscore
        https://bugs.webkit.org/show_bug.cgi?id=230645

        Reviewed by Ross Kirsling.

        We reject '_' since BCP-47 rejects it and we should follow BCP-47 in all Intl inputs.

        * runtime/IntlObject.cpp:
        (JSC::isUnicodeLocaleIdentifierType):

2021-09-21  Alexey Shvayka  <shvaikalesh@gmail.com>

        [WebIDL] DOM constructors should extend InternalFunction
        https://bugs.webkit.org/show_bug.cgi?id=228763

        Reviewed by Sam Weinig.

        Introduce finishCreation(VM&) overload to preserve the current property order of
        WebIDL constructors, and to defer a large code change needed for passing through
        `length` / `name` parameters (bug #230584).

        * runtime/InternalFunction.cpp:
        (JSC::InternalFunction::InternalFunction):
        (JSC::InternalFunction::finishCreation):
        * runtime/InternalFunction.h:

2021-09-21  Chris Dumez  <cdumez@apple.com>

        Reduce use of makeRef() and use Ref { } instead
        https://bugs.webkit.org/show_bug.cgi?id=230585

        Reviewed by Alex Christensen.

        * debugger/Debugger.cpp:
        (JSC::Debugger::setBreakpoint):
        (JSC::Debugger::schedulePauseForSpecialBreakpoint):
        * llint/LLIntEntrypoint.cpp:
        (JSC::LLInt::setFunctionEntrypoint):
        (JSC::LLInt::setEvalEntrypoint):
        (JSC::LLInt::setProgramEntrypoint):
        (JSC::LLInt::setModuleProgramEntrypoint):
        * runtime/JSString.cpp:
        (JSC::JSRopeString::resolveRopeToExistingAtomString const):
        * runtime/VM.cpp:
        (JSC::jitCodeForCallTrampoline):
        (JSC::jitCodeForConstructTrampoline):
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::CodeBlock):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::OMGPlan):
        * wasm/WasmSignature.cpp:
        (JSC::Wasm::SignatureInformation::signatureFor):
        * wasm/WasmSignatureInlines.h:
        (JSC::Wasm::SignatureInformation::get):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        * wasm/js/JSWebAssemblyInstance.h:

2021-09-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] CompareStrictEq is omitting String check incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=230582
        rdar://83237121

        Reviewed by Mark Lam.

        1. Add left and right prefixes to neitherDoubleNorHeapBigIntChild and notDoubleChild edges since
           registers are named with left and right. Without this prefix, it is hard to follow in the code.
        2. Remove leftGPR and rightGPR and use leftRegs.payloadGPR() and rightRegs.payloadGPR() to avoid
           having different variables pointing to the same registers.
        3. DFG needsTypeCheck is done with wrong type filters. As a result, necessary checks are omitted.
           This patch fixes that. FTL does not have the same problem.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileNeitherDoubleNorHeapBigIntToNotDoubleStrictEquality):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-09-21  Mark Lam  <mark.lam@apple.com>

        Replace a few ASSERTs with static_asserts in the ARM64 MacroAssemblers.
        https://bugs.webkit.org/show_bug.cgi?id=230569

        Reviewed by Yusuke Suzuki.

        * assembler/ARM64Assembler.h:
        * assembler/ARM64EAssembler.h:

2021-09-21  Justin Michaud  <justin_michaud@apple.com>

        Differential testing: live statement don't execute
        https://bugs.webkit.org/show_bug.cgi?id=229939

        Reviewed by Saam Barati.

        In statements are supposed to throw if they are applied to a non-object. We incorrectly converted
        InByVals into HasIndexedProperty any time they were a cell, so we silently converted non-objects. Before converting
        an InByVal, we first speculate that the base is an object now.

        We do not always require an object edge for HasIndexedProperty because enumerator next() does not
        throw if it encounters a cell that requires conversion during the call to toObject (for example, a
        string literal). That is, we should silently convert the string during enumeration, but not for an
        In statement, and so HasIndexedProperty is prepared to handle both cases.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::convertToHasIndexedProperty):

2021-09-21  Mikhail R. Gadelha  <mikhail@igalia.com>

        Prevent test from accessing FP registers if they are not available (e.g., arm softFP)
        https://bugs.webkit.org/show_bug.cgi?id=230493

        Unreviewed gardening.

        The patch from https://bugs.webkit.org/show_bug.cgi?id=228543 introduced
        explicity calls to FP registers, however, they are not available in archs
        that emulate FPs. This patch adds an #ifdef to only enable the test if
        the arch has FP registers.

        * assembler/testmasm.cpp:
        (JSC::testStoreBaseIndex):

2021-09-20  Chris Dumez  <cdumez@apple.com>

        Stop using makeRef(*this) / makeRefPtr(this)
        https://bugs.webkit.org/show_bug.cgi?id=230464

        Reviewed by Alex Christensen.

        * inspector/InjectedScriptHost.cpp:
        (Inspector::InjectedScriptHost::wrapper):
        * inspector/remote/RemoteConnectionToTarget.cpp:
        (Inspector::RemoteConnectionToTarget::close):
        * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
        (Inspector::RemoteConnectionToTarget::setup):
        (Inspector::RemoteConnectionToTarget::close):
        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::compileAsync):
        * wasm/WasmNameSection.h:
        (JSC::Wasm::NameSection::get):
        * wasm/WasmStreamingCompiler.cpp:
        (JSC::Wasm::StreamingCompiler::didReceiveFunctionData):

2021-09-17  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix CellTag being set 32 bits even if the base is not a cell
        https://bugs.webkit.org/show_bug.cgi?id=230364

        Reviewed by Yusuke Suzuki.

        Initial patch by Caio Lima.

        In 32 bits the tag of the base was not being preserved before calling
        the slow path and was instead being always being set to cellTag.

        This patch slightly changes the code to instead of setting the cellTag,
        it now calls the slow path using only the payload if the base is a cell,
        otherwise it uses tag+payload.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):

2021-09-17  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add fast property enumeration mode for JSON.stringify
        https://bugs.webkit.org/show_bug.cgi?id=230393

        Reviewed by Mark Lam.

        We collected profiles and found several subtests are using JSON.stringify enough. And generated strings are many serialized leaf objects.

        This patch adds fast object property enumeration. When we know that source object meets some conditions, we can say that,
        as long as structure is not changed, we can continue using property names and offset collected from the structure.
        This way removes non observable [[Get]] operations to accelerate JSON.stringify performance for major object iteration cases.

        We also extend MarkedArgumentBuffer: introducing MarkedArgumentBufferWithSize which can take default inline capacity as a template
        parameter. This is used in JSON.stringify to increase the buffer because now we also need to record structures in MarkedArgumentBuffer.

        This offers 0.4% improvement in Speedometer2 (EmberJS-TodoMVC, Vanilla-XXX, EmberJS-Debug-TodoMVC, they have enough amount of JSON.stringify
        time).

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |117.710000   |117.751667   |1.000354  | 0.883246                                         |
        | VueJS-TodoMVC                        |24.500000    |24.311667    |0.992313  | 0.365130                                         |
        | EmberJS-TodoMVC                      |126.646667   |125.738333   |0.992828  | 0.002587 (significant)                           |
        | BackboneJS-TodoMVC                   |47.873333    |47.911667    |1.000801  | 0.762509                                         |
        | Preact-TodoMVC                       |17.020000    |17.070000    |1.002938  | 0.786799                                         |
        | AngularJS-TodoMVC                    |129.856667   |129.353333   |0.996124  | 0.177632                                         |
        | Vanilla-ES2015-TodoMVC               |61.698333    |61.120000    |0.990626  | 0.000003 (significant)                           |
        | Inferno-TodoMVC                      |62.840000    |62.496667    |0.994536  | 0.312340                                         |
        | Flight-TodoMVC                       |77.095000    |76.936667    |0.997946  | 0.702724                                         |
        | Angular2-TypeScript-TodoMVC          |39.740000    |39.191667    |0.986202  | 0.053485                                         |
        | VanillaJS-TodoMVC                    |49.008333    |48.346667    |0.986499  | 0.000638 (significant)                           |
        | jQuery-TodoMVC                       |216.785000   |217.188333   |1.001861  | 0.270747                                         |
        | EmberJS-Debug-TodoMVC                |344.230000   |342.993333   |0.996407  | 0.012262 (significant)                           |
        | React-TodoMVC                        |85.461667    |85.411667    |0.999415  | 0.758049                                         |
        | React-Redux-TodoMVC                  |140.681667   |140.640000   |0.999704  | 0.871277                                         |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.928333    |59.351667    |0.990377  | 0.000000 (significant)                           |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 264.40650
        b mean = 265.51533
        pValue = 0.0005567357
        (Bigger means are better.)
        1.004 times better
        Results ARE significant

        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        * runtime/ArgList.cpp:
        (JSC::MarkedArgumentBufferBase::addMarkSet):
        (JSC::MarkedArgumentBufferBase::markLists):
        (JSC::MarkedArgumentBufferBase::slowEnsureCapacity):
        (JSC::MarkedArgumentBufferBase::expandCapacity):
        (JSC::MarkedArgumentBufferBase::slowAppend):
        (JSC::MarkedArgumentBuffer::addMarkSet): Deleted.
        (JSC::MarkedArgumentBuffer::markLists): Deleted.
        (JSC::MarkedArgumentBuffer::slowEnsureCapacity): Deleted.
        (JSC::MarkedArgumentBuffer::expandCapacity): Deleted.
        (JSC::MarkedArgumentBuffer::slowAppend): Deleted.
        * runtime/ArgList.h:
        (JSC::MarkedArgumentBufferWithSize::MarkedArgumentBufferWithSize):
        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer): Deleted.
        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer): Deleted.
        (JSC::MarkedArgumentBuffer::size const): Deleted.
        (JSC::MarkedArgumentBuffer::isEmpty const): Deleted.
        (JSC::MarkedArgumentBuffer::at const): Deleted.
        (JSC::MarkedArgumentBuffer::clear): Deleted.
        (JSC::MarkedArgumentBuffer::appendWithAction): Deleted.
        (JSC::MarkedArgumentBuffer::append): Deleted.
        (JSC::MarkedArgumentBuffer::appendWithCrashOnOverflow): Deleted.
        (JSC::MarkedArgumentBuffer::removeLast): Deleted.
        (JSC::MarkedArgumentBuffer::last): Deleted.
        (JSC::MarkedArgumentBuffer::takeLast): Deleted.
        (JSC::MarkedArgumentBuffer::ensureCapacity): Deleted.
        (JSC::MarkedArgumentBuffer::hasOverflowed): Deleted.
        (JSC::MarkedArgumentBuffer::overflowCheckNotNeeded): Deleted.
        (JSC::MarkedArgumentBuffer::fill): Deleted.
        (JSC::MarkedArgumentBuffer::slotFor const): Deleted.
        (JSC::MarkedArgumentBuffer::mallocBase): Deleted.
        (JSC::MarkedArgumentBuffer::setNeedsOverflowCheck): Deleted.
        (JSC::MarkedArgumentBuffer::clearNeedsOverflowCheck): Deleted.
        * runtime/JSONObject.cpp:
        (JSC::Stringifier::Holder::hasFastObjectProperties const):
        (JSC::Stringifier::appendStringifiedValue):
        (JSC::Stringifier::Holder::Holder):
        (JSC::Stringifier::Holder::appendNextProperty):
        * runtime/ObjectConstructorInlines.h:
        (JSC::canPerformFastPropertyEnumerationForJSONStringify):

2021-09-17  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed fix for JSCOnly build with ENABLE_DFG_JIT off.

        * b3/testb3_1.cpp:
        * wasm/WasmEntryPlan.cpp:
        * wasm/WasmLLIntPlan.cpp:
        * wasm/WasmOperations.cpp:
        * wasm/WasmSignature.cpp:
        * wasm/WasmSignature.h:
        * wasm/generateWasmOpsHeader.py:
        * wasm/js/JSToWasm.h:

2021-09-17  Angelos Oikonomopoulos  <angelos@igalia.com>

        Unbreak GCC_OFFLINEASM_SOURCE_MAP when LTO is in use
        https://bugs.webkit.org/show_bug.cgi?id=230061
        <rdar://problem/83166173>

        Reviewed by Michael Catanzaro.

        Our ASM postprocessing hack is incompatible with
        LTO. Unconditionally disable LTO for LowLevelInterpreter.cxx when
        GCC_OFFLINEASM_SOURCE_MAP is in use.

        * CMakeLists.txt:

2021-09-17  Justin Michaud  <justin_michaud@apple.com>

        Improve access case printing and show inline capacity for structures
        https://bugs.webkit.org/show_bug.cgi?id=230357

        Reviewed by Saam Barati.

        This just makes the printing of access cases slightly more readable.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::dump const):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::dumpImpl const):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::dumpImpl const):
        * bytecode/GetterSetterAccessCase.h:
        * bytecode/InstanceOfAccessCase.cpp:
        (JSC::InstanceOfAccessCase::dumpImpl const):
        * bytecode/InstanceOfAccessCase.h:
        * bytecode/ProxyableAccessCase.cpp:
        (JSC::ProxyableAccessCase::dumpImpl const):
        * bytecode/ProxyableAccessCase.h:
        * heap/Heap.cpp:
        (JSC::Heap::runEndPhase):
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::dumpInContextAssumingStructure const):
        * runtime/Structure.cpp:
        (JSC::Structure::dump const):

2021-09-17  Justin Michaud  <justin_michaud@apple.com>

        PutByVal and PutPrivateName ICs should emit a write barrier if a butterfly might be allocated
        https://bugs.webkit.org/show_bug.cgi?id=230378

        Reviewed by Yusuke Suzuki.

        Right now, PutByVal and PutPrivateName check the value type to determine 
        if a write barrier is needed. For example, putting a primitive is considered 
        to not require a write barrier. This makes sense, except for the case when we 
        might allocate or re-allocate a butterfly in the IC. This does not emit a write 
        barrier, and so the GC might miss the new butterfly. That is somewhat undesirable. 
        This is a temporary conservative fix. If we don't write to the butterfly pointer,
        then we still don't need a write barrier; this work is captured by 
        https://bugs.webkit.org/show_bug.cgi?id=230377

        * dfg/DFGStoreBarrierInsertionPhase.cpp:

2021-09-16  Saam Barati  <sbarati@apple.com>

        Don't throw an exception in the middle of linking a CodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=230367

        Reviewed by Yusuke Suzuki.

        It's cleaner, and probably more correct, to wait until we're done linking
        the instruction stream before throwing any exceptions from CodeBlock::finishCreation.
        This guarantees, for example, that all metadata structs are initialized.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::initializeTemplateObjects):
        * bytecode/CodeBlock.h:
        * runtime/JSScope.cpp:
        (JSC::abstractAccess):
        (JSC::JSScope::abstractResolve):

2021-09-16  Saam Barati  <sbarati@apple.com>

        Move some profiling to UnlinkedCodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=230078
        <rdar://problem/82947571>

        Reviewed by Yusuke Suzuki.

        This patch adds UnlinkedValueProfile and UnlinkedArrayProfile to
        UnlinkedCodeBlock. These profiles serialize the data in ValueProfile
        and ArrayProfile. Each time a CodeBlock updates value profiles,
        it mixes in up to date information from the unlinked profiles, and
        also writes back data to the unlinked profiles, so the data is shared
        between CodeBlocks of the same UnlinkedCodeBlock.
        
        This patch also fixes a pre-existing bug where we would sometimes think
        we had more metadata table entries than we really had in practice. This is
        because MetadataTable::forEach used the next opcode's start pointer. That
        pointer was aligned to that opcode's metadata alignment. So that might make
        the previous opcode think it had an extra 1-7 entries (depending on size,
        alignment, etc). This patch fixes that by having the next opcode's start
        offset in the table always be the end offset of the previous opcode, and we
        align the start pointer when using it.
        
        This was measured as a ~0.5% speedup on Speedometer2.

        * bytecode/ArrayProfile.h:
        (JSC::UnlinkedArrayProfile::update):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::updateAllValueProfilePredictionsAndCountLiveness):
        (JSC::CodeBlock::updateAllArrayProfilePredictions):
        (JSC::CodeBlock::updateAllArrayPredictions):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::metadata):
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachArrayProfile): Deleted.
        * bytecode/MetadataTable.cpp:
        (JSC::DeallocTable::withOpcodeType):
        * bytecode/MetadataTable.h:
        (JSC::MetadataTable::get):
        (JSC::MetadataTable::forEach):
        (JSC::MetadataTable::getWithoutAligning):
        (JSC::MetadataTable::getImpl): Deleted.
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::unlinkedValueProfile):
        (JSC::UnlinkedCodeBlock::unlinkedArrayProfile):
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedMetadataTable.cpp:
        (JSC::UnlinkedMetadataTable::finalize):
        * bytecode/UnlinkedMetadataTable.h:
        (JSC::UnlinkedMetadataTable::isFinalized):
        (JSC::UnlinkedMetadataTable::hasMetadata):
        * bytecode/UnlinkedMetadataTableInlines.h:
        (JSC::UnlinkedMetadataTable::numEntries):
        * bytecode/ValueProfile.h:
        (JSC::UnlinkedValueProfile::update):
        * bytecompiler/BytecodeGenerator.h:
        * llint/LowLevelInterpreter.asm:
        * runtime/CachedTypes.cpp:
        (JSC::CachedCodeBlock::numValueProfiles const):
        (JSC::CachedCodeBlock::numArrayProfiles const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):

2021-09-16  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r282478.
        https://bugs.webkit.org/show_bug.cgi?id=230358


        Reverted changeset:

        "Move some profiling to UnlinkedCodeBlock"
        https://bugs.webkit.org/show_bug.cgi?id=230078
        https://commits.webkit.org/r282478

2021-09-16  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix crash in 32 bits due to not enough scratch registers available
        https://bugs.webkit.org/show_bug.cgi?id=230241

        Reviewed by Filip Pizlo.

        Since patch 229229 (Polymorphic PutByVal) landed, jsc is now reaching
        the case Transition in `AccessCase::generateImpl` which needs three
        scratch registers when reallocating, but in ARMv7/MIPS, there are only
        two registers available.

        So in this patch, `AccessCase::createTransition` is changed to actually
        check if there are enough registers available before creating the
        AccessCase object.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):

2021-09-15  Saam Barati  <sbarati@apple.com>

        Move some profiling to UnlinkedCodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=230078
        <rdar://problem/82947571>

        Reviewed by Yusuke Suzuki.

        This patch moves ValueProfiles and ArrayProfiles for non-call opcodes into
        UnlinkedCodeBlock. This way, the data is shared between the linked CodeBlocks
        of the same UnlinkedCodeBlock. The profiling bet here is that when the same code
        runs in a different global object, it largely runs in the same way. We've made
        this same bet in other ways with our profiling, and it largely makes sense
        to do for ValueProfile and ArrayProfile since they both hold global object
        independent data.
        
        Because ArrayProfiles are now shared between CodeBlocks, the existing m_usesOriginalArrayStructures
        bit is slightly harder to track now, since the ArrayProfile may see inputs from a different
        global object, an array may be an original array in one lexical global object,
        but not another. So we now track when an ArrayProfile sees a different global
        object than the lexical global object, and when we observe exits in the DFG,
        we propagate that bit to the m_usesOriginalArrayStructures bit.
        
        This patch also makes it so we no longer hold the CodeBlock lock when
        processing ValueProfiles and ArrayProfiles. We now allow multiple compiler
        threads to race against each other when updating these profiles. This is fine.
        It may end up with incomplete data in the profiles, but it won't corrupt them.
        
        This patch also makes it so we finalized visited UnlinkedCodeBlocks to finalize
        their value profiles. We no longer do that work inside CodeBlock for the
        ValueProfiles that UnlinkedCodeBlock owns. This also means that we have to
        WriteBarrier UnlinkedCodeBlock when executing in the LLInt, Baseline, and
        other areas, such as OSR exit, and in the GC when a CodeBlock was executing.
        That way we're guaranteed to visit the UnlinkedCodeBlock, add it to the
        visited set, and then finalize it at the end of GC.
        
        This patch also makes it so that inside CodeBlock::finishCreation, we finish
        linking before we do anything that can throw an exception. It's not valid to
        finalize a CodeBlock that isn't linked.
        
        This was measured as a 0.5-1% speedup on Speedometer2.

        * bytecode/ArrayProfile.cpp:
        (JSC::ArrayProfile::computeUpdatedPrediction):
        (JSC::ArrayProfile::briefDescription):
        (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
        * bytecode/ArrayProfile.h:
        (JSC::ArrayProfile::ArrayProfile):
        (JSC::ArrayProfile::observedArrayModes const):
        (JSC::ArrayProfile::mayInterceptIndexedAccesses const):
        (JSC::ArrayProfile::mayStoreToHole const):
        (JSC::ArrayProfile::outOfBounds const):
        (JSC::ArrayProfile::usesOriginalArrayStructures const):
        (JSC::ArrayProfile::setDoesNotUseOriginalArrayStructures):
        (JSC::ArrayProfile::observedDifferentGlobalObject const):
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeOperandsForCheckpoint.h:
        (JSC::valueProfileForImpl):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::initializeTemplateObjects):
        (JSC::CodeBlock::setNumParameters):
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::getArrayProfile):
        (JSC::CodeBlock::updateAllValueProfilePredictionsAndCountLiveness):
        (JSC::CodeBlock::updateAllArrayPredictions):
        (JSC::CodeBlock::tryGetValueProfileForBytecodeIndex):
        (JSC::CodeBlock::valueProfilePredictionForBytecodeIndex):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetOfUnlinkedCodeBlock):
        (JSC::CodeBlock::numberOfArgumentValueProfiles):
        (JSC::CodeBlock::valueProfileForArgument):
        (JSC::CodeBlock::metadata):
        * bytecode/CodeBlockInlines.h:
        (JSC::CodeBlock::forEachValueProfile):
        (JSC::CodeBlock::forEachArrayProfile):
        * bytecode/DFGExitProfile.cpp:
        (JSC::DFG::ExitProfile::hasAnyExitsAt const):
        * bytecode/DFGExitProfile.h:
        * bytecode/GetByIdMetadata.h:
        (JSC::GetByIdModeMetadata::setArrayLengthMode):
        * bytecode/LazyOperandValueProfile.cpp:
        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
        (JSC::LazyOperandValueProfileParser::prediction const):
        * bytecode/MetadataTable.cpp:
        (JSC::DeallocTable::withOpcodeType):
        * bytecode/MetadataTable.h:
        (JSC::MetadataTable::get):
        (JSC::MetadataTable::forEach):
        (JSC::MetadataTable::getWithoutAligning):
        (JSC::MetadataTable::getImpl): Deleted.
        * bytecode/Opcode.h:
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::visitChildrenImpl):
        (JSC::UnlinkedCodeBlock::allocateSharedProfiles):
        (JSC::UnlinkedCodeBlock::finalizeUnconditionally):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::hasAnyExitsAt const):
        (JSC::UnlinkedCodeBlock::hasAnyExitsAt):
        (JSC::UnlinkedCodeBlock::valueProfile):
        (JSC::UnlinkedCodeBlock::arrayProfile):
        (JSC::UnlinkedCodeBlock::numValueProfiles const):
        (JSC::UnlinkedCodeBlock::numArrayProfiles const):
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedMetadataTable.cpp:
        (JSC::UnlinkedMetadataTable::finalize):
        * bytecode/UnlinkedMetadataTable.h:
        (JSC::UnlinkedMetadataTable::isFinalized):
        (JSC::UnlinkedMetadataTable::hasMetadata):
        * bytecode/UnlinkedMetadataTableInlines.h:
        (JSC::UnlinkedMetadataTable::numEntries):
        * bytecode/ValueProfile.h:
        (JSC::ValueProfileBase::ValueProfileBase):
        (JSC::ValueProfileBase::clearBuckets):
        (JSC::ValueProfileBase::briefDescription):
        (JSC::ValueProfileBase::computeUpdatedPrediction):
        (JSC::ValueProfile::offsetOfFirstBucket):
        (JSC::ValueProfileBase::classInfo const): Deleted.
        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::fromObserved):
        * dfg/DFGArrayMode.h:
        (JSC::DFG::ArrayMode::withSpeculationFromProfile const):
        (JSC::DFG::ArrayMode::withProfile const):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
        (JSC::DFG::ByteCodeParser::getArrayMode):
        (JSC::DFG::ByteCodeParser::handleVarargsInlining):
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::handlePutByVal):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
        * dfg/DFGGraph.h:
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::osrWriteBarrier):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGPredictionInjectionPhase.cpp:
        (JSC::DFG::PredictionInjectionPhase::run):
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterateViaSubspaces):
        * heap/Heap.cpp:
        (JSC::Heap::finalizeMarkedUnconditionalFinalizers):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::runEndPhase):
        (JSC::Heap::addCoreConstraints):
        * jit/JIT.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        * jit/JITOperations.cpp:
        (JSC::putByValOptimize):
        (JSC::directPutByValOptimize):
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::performLLIntGetByID):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::getByVal):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * profiler/ProfilerBytecodeSequence.cpp:
        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
        * runtime/CachedTypes.cpp:
        (JSC::CachedCodeBlock::numValueProfiles const):
        (JSC::CachedCodeBlock::numArrayProfiles const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):
        * runtime/CommonSlowPaths.cpp:
        (JSC::iteratorNextTryFastImpl):
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/JSScope.cpp:
        (JSC::abstractAccess):
        (JSC::JSScope::abstractResolve):
        * runtime/VM.cpp:
        * runtime/VM.h:
        (JSC::VM::forEachUnlinkedCodeBlockSpace):
        (JSC::VM::forEachCodeBlockSpace): Deleted.

2021-09-15  Michael Catanzaro  <mcatanzaro@gnome.org>

        Avoid GCC warnings introduced in r282125
        https://bugs.webkit.org/show_bug.cgi?id=230154

        Reviewed by Fujii Hironori.

        Yusuke suggested casting to UChar to avoid -Wswitch-out-of-range. This works!

        Also, avoid -Wredundant-move by removing one unnecessary WTFMove.

        * runtime/ISO8601.cpp:
        (JSC::ISO8601::parseTimeZoneBracketedAnnotation):
        (JSC::ISO8601::canBeTimeZone):
        (JSC::ISO8601::parseTimeZone):

2021-09-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize leaf object creation in JSON.parse
        https://bugs.webkit.org/show_bug.cgi?id=230298

        Reviewed by Keith Miller.

        This patch optimizes JSON.parse.

        1. Use table in isJSONWhiteSpace.
        2. Extract primitive value creation as parsePrimitiveValue function to use it in different place.
        3. Add leaf-object creation fast path. Previously, when creating a leaf-object from JSON.parse we
           are too generic and jumping around the code. Instead we add a fast path that does not perform
           unnecessary operations and code gets tight.

        It offers 3-4% improvement in microbenchmarks.
                                                             ToT                     Patched

        vanilla-es2015-babel-webpack-todomvc-json-parse
                                                      104.7169+-0.1113     ^    101.4836+-0.2168        ^ definitely 1.0319x faster
        flight-todomvc-json-parse                      53.9074+-0.0957     ^     52.1347+-0.0802        ^ definitely 1.0340x faster
        vanilla-es2015-todomvc-json-parse             104.9373+-0.1631     ^    101.4978+-0.1073        ^ definitely 1.0339x faster
        vanilla-todomvc-json-parse                     79.1330+-0.0963     ^     76.7568+-0.1606        ^ definitely 1.0310x faster

        This offers 0.2% improvement in Speedometer2.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |116.860000   |116.825000   |0.999700  | 0.901070                                         |
        | VueJS-TodoMVC                        |24.658333    |24.763333    |1.004258  | 0.571728                                         |
        | EmberJS-TodoMVC                      |126.666667   |126.335000   |0.997382  | 0.289517                                         |
        | BackboneJS-TodoMVC                   |48.435000    |48.523333    |1.001824  | 0.455638                                         |
        | Preact-TodoMVC                       |17.585000    |17.368333    |0.987679  | 0.247658                                         |
        | AngularJS-TodoMVC                    |129.576667   |129.398333   |0.998624  | 0.625634                                         |
        | Vanilla-ES2015-TodoMVC               |62.746667    |62.241667    |0.991952  | 0.000019 (significant)                           |
        | Inferno-TodoMVC                      |63.741667    |63.495000    |0.996130  | 0.448861                                         |
        | Flight-TodoMVC                       |78.021667    |77.306667    |0.990836  | 0.087137                                         |
        | Angular2-TypeScript-TodoMVC          |39.823333    |39.923333    |1.002511  | 0.736279                                         |
        | VanillaJS-TodoMVC                    |50.073333    |49.791667    |0.994375  | 0.136495                                         |
        | jQuery-TodoMVC                       |221.300000   |221.586667   |1.001295  | 0.418008                                         |
        | EmberJS-Debug-TodoMVC                |340.145000   |339.965000   |0.999471  | 0.691490                                         |
        | React-TodoMVC                        |85.698333    |85.650000    |0.999436  | 0.761586                                         |
        | React-Redux-TodoMVC                  |140.510000   |140.785000   |1.001957  | 0.285922                                         |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |60.928333    |60.500000    |0.992970  | 0.000069 (significant)                           |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 262.15844
        b mean = 262.72261
        pValue = 0.0428052487
        (Bigger means are better.)
        1.002 times better
        Results ARE significant

        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser<CharType>::makeIdentifier):
        (JSC::isJSONWhiteSpace):
        (JSC::LiteralParser<CharType>::Lexer::lex):
        (JSC::LiteralParser<CharType>::parsePrimitiveValue):
        (JSC::LiteralParser<CharType>::parse):
        * runtime/LiteralParser.h:

2021-09-14  Don Olmstead  <don.olmstead@sony.com>

        Non-unified build fixes, mid September 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=230110

        Unreviewed non-unified build fixes.

        * runtime/TemporalPlainTimeConstructor.cpp:
        * runtime/TemporalPlainTimePrototype.cpp:

2021-09-14  Ross Kirsling  <ross.kirsling@sony.com>

        [Win] JSRemoteInspector.h missing stdint include
        https://bugs.webkit.org/show_bug.cgi?id=230275

        Reviewed by Don Olmstead.

        * API/JSRemoteInspector.h:
        Include stdint for uint8_t definition on Windows.

2021-09-14  Xan Lopez  <xan@igalia.com>

        [JSC] Remove unnecessary exception checks in DFGOperations
        https://bugs.webkit.org/show_bug.cgi?id=230247

        Reviewed by Caio Araujo Neponoceno de Lima.

        JSValue::decode cannot throw an exception, remove a couple of
        unnecessary RETURN_IF_EXCEPTION() calls.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):

2021-09-14  Xan López  <xan@igalia.com>

        [JSC] ASSERT failed in stress/for-in-tests.js (32bit)
        https://bugs.webkit.org/show_bug.cgi?id=229543

        Reviewed by Yusuke Suzuki.

        Since r280760 DFG::SpeculativeJIT::compileEnumeratorGetByVal uses
        too many registers for 32bit. Revert to the slow path as a
        temporary measure to avoid crashes, we'll try to reenable the
        optimizations later on (see bug #230189).

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION): define a generic call
        operation for compileEnumeratorGetByVal.
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp: move the current version of
        compileEnumeratorGetByVal to 64bit, since it won't work on 32bit.
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): call the generic call op always.
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): use the previous version here.
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH): refactor a bit the slow path
        for enumeratorGetByVal so it can be called from DFG as a call
        operation.
        * runtime/CommonSlowPaths.h:
        (JSC::CommonSlowPaths::opEnumeratorGetByVal):

2021-09-13  Xan López  <xan@igalia.com>

        [JSC][32bit] in-by-val fails inside for-in loop after delete
        https://bugs.webkit.org/show_bug.cgi?id=230150

        Reviewed by Carlos Garcia Campos.

        The order of payload and tag was reversed when constructing the
        base value for compileEnumeratorHasProperty.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):

2021-09-10  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] Support running applications with ENABLE_STATIC_JSC=ON
        https://bugs.webkit.org/show_bug.cgi?id=230170

        Reviewed by Ross Kirsling.

        Updating loading code to not load libJavaScriptCore shared library
        if we are using a static version.

        * shell/playstation/Initializer.cpp:

2021-09-09  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Clean up current state of Temporal API
        https://bugs.webkit.org/show_bug.cgi?id=230130

        Reviewed by Yusuke Suzuki.

        This patch perfoms a variety of cleanup tasks following the implementation of Temporal.PlainTime.

          1. Do away with the alias Subdurations and refer to ISO8601::Duration directly.
             (But we can still say "subduration" when referring to a single ordered field, as in `largestSubduration`.)
          2. Represent ToTemporalDuration, ToTemporalDurationRecord, and ToLimitedTemporalDuration more directly in code,
             as TemporalDuration::{toTemporalDuration, fromDurationLike, toISO8601Duration}.
             (Note: The last of these doesn't take a disallowedFields parameter;
                    Temporal.Instant can do this after the fact, since no one else makes use of this functionality.)
          3. Extract intlOption<RoundingMode> into a helper function, `temporalRoundingMode`.
          4. Remove largestSubplainTime(), which was declared but not defined.
          5. Correct spelling of TemporalPlainTime::constrainTime().

        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::create):
        (JSC::TemporalDuration::TemporalDuration):
        (JSC::TemporalDuration::tryCreateIfValid):
        (JSC::TemporalDuration::fromDurationLike): Added.
        (JSC::TemporalDuration::toISO8601Duration): Added.
        (JSC::TemporalDuration::toTemporalDuration): Added.
        (JSC::TemporalDuration::from):
        (JSC::totalNanoseconds):
        (JSC::TemporalDuration::compare):
        (JSC::TemporalDuration::sign):
        (JSC::TemporalDuration::with const):
        (JSC::TemporalDuration::negated const):
        (JSC::TemporalDuration::abs const):
        (JSC::largestSubduration): Added.
        (JSC::TemporalDuration::balance):
        (JSC::TemporalDuration::add const):
        (JSC::TemporalDuration::subtract const):
        (JSC::TemporalDuration::round):
        (JSC::TemporalDuration::round const):
        (JSC::TemporalDuration::total const):
        (JSC::TemporalDuration::toString const):
        (JSC::TemporalDuration::toString):
        (JSC::TemporalDuration::fromNonDurationValue): Deleted.
        (JSC::TemporalDuration::toDuration): Deleted.
        (JSC::TemporalDuration::toDurationRecord): Deleted.
        (JSC::TemporalDuration::largestSubduration const): Deleted.
        * runtime/TemporalDuration.h:
        * runtime/TemporalDurationConstructor.cpp:
        * runtime/TemporalDurationPrototype.cpp:
        * runtime/TemporalObject.cpp:
        (JSC::temporalRoundingMode): Added.
        * runtime/TemporalObject.h:
        * runtime/TemporalPlainTime.cpp:
        (JSC::TemporalPlainTime::round const):
        (JSC::TemporalPlainTime::toString const):
        (JSC::constrainTime): Added.
        (JSC::regulateTime):
        (JSC::TemporalPlainTime::add const):
        (JSC::TemporalPlainTime::subtract const):
        (JSC::extractDifferenceOptions):
        (JSC::constraintTime): Deleted.
        (JSC::toLimitedTemporalDuration): Deleted.
        * runtime/TemporalPlainTime.h:

2021-09-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Intl.Locale weekendInfo should list all weekend days instead of range
        https://bugs.webkit.org/show_bug.cgi?id=230108

        Reviewed by Ross Kirsling.

        We cannot assume that weekend is contiguous. For example, Burnei's weekend is Friday and Sunday.
        This is raised in [1], and our conclusion in Sep-9 meeting is that we should have an array which
        includes all the weekend days. The change is merged in [2], and this patch changes our implementation
        accordingly.

        [1]: https://github.com/tc39/proposal-intl-locale-info/issues/25
        [2]: https://github.com/tc39/proposal-intl-locale-info/commit/afb1e269dd698476a2514129235cdad88af60e6f

        * runtime/IntlLocale.cpp:
        (JSC::IntlLocale::weekInfo):
        * runtime/IntlObjectInlines.h:
        (JSC::createArrayFromIntVector):

2021-09-09  Darin Adler  <darin@apple.com>

        Improve performance by using StringView, not "const StringView&"
        https://bugs.webkit.org/show_bug.cgi?id=229834

        Reviewed by Anders Carlsson.

        * parser/Lexer.h:
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::setFormatsFromPattern):
        * runtime/IntlDateTimeFormat.h:
        Use StringView, not const StringView&.

2021-09-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize op_get_property_enumerator further
        https://bugs.webkit.org/show_bug.cgi?id=230086

        Reviewed by Saam Barati.

        1. This patch adds fast path of op_get_property_enumerator to LLInt and Baseline. Previously, we only had this fast path in DFG and FTL.
        2. From the profiled data, Speedometer2/React-Redux-TodoMVC has GetPropertyEnumerator(CellOrOther). However, DFG and FTL only optimized
           GetPropertyEnumerator(Cell). We add CellOrOther and Other cases: if the argument is Other, then we can constant fold it to the
           empty enumerator. If the argument is CellOrOther, we can check first, and return empty enumerator for Other case.
        3. This patch also cleans up StructureRareData lookup by introducing StructureType to JSType.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |117.388333   |117.680000   |1.002485  | 0.269607                                         |
        | VueJS-TodoMVC                        |24.918333    |24.651667    |0.989298  | 0.157665                                         |
        | EmberJS-TodoMVC                      |126.430000   |126.296667   |0.998945  | 0.673803                                         |
        | BackboneJS-TodoMVC                   |48.695000    |48.411667    |0.994181  | 0.019164                                         |
        | Preact-TodoMVC                       |17.268333    |17.511667    |1.014091  | 0.199775                                         |
        | AngularJS-TodoMVC                    |130.246667   |129.850000   |0.996954  | 0.261543                                         |
        | Vanilla-ES2015-TodoMVC               |63.626667    |63.611667    |0.999764  | 0.912112                                         |
        | Inferno-TodoMVC                      |63.881667    |63.600000    |0.995591  | 0.385440                                         |
        | Flight-TodoMVC                       |78.158333    |78.606667    |1.005736  | 0.284177                                         |
        | Angular2-TypeScript-TodoMVC          |39.448333    |39.411667    |0.999071  | 0.890825                                         |
        | VanillaJS-TodoMVC                    |50.858333    |51.130000    |1.005342  | 0.195409                                         |
        | jQuery-TodoMVC                       |225.318333   |226.256667   |1.004164  | 0.011190                                         |
        | EmberJS-Debug-TodoMVC                |340.150000   |338.450000   |0.995002  | 0.000063 (significant)                           |
        | React-TodoMVC                        |85.703333    |85.606667    |0.998872  | 0.549298                                         |
        | React-Redux-TodoMVC                  |141.985000   |140.418333   |0.988966  | 0.000000 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.505000    |61.705000    |1.003252  | 0.079817                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 260.98021
        b mean = 261.16020
        pValue = 0.4985041089
        (Bigger means are better.)
        1.001 times better
        Results ARE NOT significant

        * bytecode/SpeculatedType.cpp:
        (JSC::dumpSpeculation):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
        (JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfStructure):
        (JSC::AssemblyHelpers::branchIfNotStructure):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_property_enumerator):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/BrandedStructure.cpp:
        (JSC::BrandedStructure::create):
        * runtime/JSType.cpp:
        (WTF::printInternal):
        * runtime/JSType.h:
        * runtime/Structure.cpp:
        (JSC::Structure::Structure):
        (JSC::Structure::create):
        * runtime/Structure.h:
        (JSC::Structure::isRareData):
        (JSC::Structure::isRareData const): Deleted.
        * runtime/StructureInlines.h:
        (JSC::Structure::create):
        (JSC::Structure::createStructure):
        * runtime/StructureRareData.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):

2021-09-09  Patrick Angle  <pangle@apple.com>

        run-webkit-archive crashes with dyld error
        https://bugs.webkit.org/show_bug.cgi?id=228060

        Reviewed by Alex Christensen.

        Add a compatibility symbol for the old `WTF::Optional` version of `BackendDispatcher::reportProtocolError` in
        versions of Safari shipping with macOS Big Sur and earlier. This has the side effect of not surfacing protocol
        errors and instead silently discarding them when crossing this API boundary. Newer versions of macOS ship using
        the newer symbol and are therefor not affected and will continue to surface protocol errors to the frontend.

        * runtime/SymbolStubsForSafariCompatibility.mm:
        (Inspector::BackendDispatcher::reportProtocolError):

2021-09-09  Justin Michaud  <justin_michaud@apple.com>

        Differential testing: incorrect constant propagation around Uint8ClampedArray
        https://bugs.webkit.org/show_bug.cgi?id=229869

        We casted int52 values to int32 before clamping, which caused any value with the 32nd bit
        set to be interpreted as negative. The fix is to check the full-size value when deciding to clamp.

        Reviewed by Saam Barati.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-09-09  Robin Morisset  <rmorisset@apple.com>

        Optimize compareStrictEq when neither side is a double and at least one is not a BigInt
        https://bugs.webkit.org/show_bug.cgi?id=226755
        <rdar://problem/79321542>

        Reviewed by Yusuke Suzuki.

        This is a very similar patch to https://bugs.webkit.org/show_bug.cgi?id=226676.
        The difference is that here we allow Strings on both side of the comparison, so we must add code to handle equality among strings.

        Like for that other patch, the optimization is disabled for BigInt32.
        Enabling it in that case would either need modifying the speculation (from banning HeapBigInt to banning all BigInts), or ensuring that we can never have a HeapBigInt so small it compares equal to a BigInt32.

        I only implemented this optimization on 64-bits: it is just painful to write code that handles registers at such a low-level without a 32-bit machine to test things locally.
        If anyone wants to make this optimization work on 32-bit, I don't foretell any major difficulty.

        Finally, like quite a few other useKinds already, this case does not make the CompareStrictEq merge with an adjacent Branch.
        The reason is simply that this patch relies on compileStringEquality, which currently does not support that feature.
        I intend to fix this (for all useKinds at once) in a separate patch.

        Effect on microbenchmarks:
        poly-stricteq-not-double                  46.8000+-0.4110     ^     23.5872+-0.3061        ^ definitely 1.9841x faster
        poly-stricteq-not-double-nor-string       16.6880+-0.2317           16.3627+-0.3729          might be 1.0199x faster
        poly-stricteq                             49.2175+-0.6047           48.9532+-0.6758

        I looked at how many cases of Untyped/Untyped compareStrictEq have been fixed by this patch and two other recent patches.
        On JetStream2:
        - https://bugs.webkit.org/show_bug.cgi?id=226621: 731 instances
        - https://bugs.webkit.org/show_bug.cgi?id=226676: 944 instances
        - This patch: only 26 instances
        This leaves 20 instances of Untyped/Untyped.

        On Speedometer2.0:
        - https://bugs.webkit.org/show_bug.cgi?id=226621: 1587 instances
        - https://bugs.webkit.org/show_bug.cgi?id=226676: 2784 instances
        - This patch: 891 instances
        This leaves 75 instances of Untyped/Untyped.

        * bytecode/SpeculatedType.h:
        (JSC::isNeitherDoubleNorHeapBigIntSpeculation):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::shouldSpeculateNeitherDoubleNorHeapBigInt):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::SafeToExecuteEdge::operator()):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStrictEq):
        (JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality):
        (JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality):
        (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
        (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt):
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
        (JSC::DFG::SpeculativeJIT::speculate):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileNeitherDoubleNorHeapBigIntToNotDoubleStrictEquality):
        * dfg/DFGUseKind.cpp:
        (WTF::printInternal):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):
        (JSC::DFG::checkMayCrashIfInputIsEmpty):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-09-07  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, add files to xcodeproj
        https://bugs.webkit.org/show_bug.cgi?id=229892

        * JavaScriptCore.xcodeproj/project.pbxproj:

2021-09-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement Temporal.PlainTime
        https://bugs.webkit.org/show_bug.cgi?id=229892

        Reviewed by Darin Adler.

        This patch implements Temporal.PlainTime[1]. This is time representation which is not associated to
        calendars and timezones. This is tuple of hour, minute, second, millisecond, microsecond, and nanosecond.

        1. We add full-fledged ISO8601 DateTime / Time parser, so that Temporal.PlainTime.from can extract
           time as specified.

        2. ISO8601::PlainTime is used for already-validated PlainTime data. When performing arithmetics, we first
           do that in ISO8601::Duration, and then we validate and convert it to PlainTime.

        We also found several spec issues, and reported in [2,3,4].

        [1]: https://tc39.es/proposal-temporal/#sec-temporal-plaintime-objects
        [2]: https://github.com/tc39/proposal-temporal/issues/1803
        [3]: https://github.com/tc39/proposal-temporal/issues/1804
        [4]: https://github.com/tc39/proposal-temporal/issues/1805

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * Sources.txt:
        * runtime/CommonIdentifiers.h:
        * runtime/ISO8601.cpp:
        (JSC::ISO8601::parseTimeZoneName):
        (JSC::ISO8601::parseDecimalInt32):
        (JSC::ISO8601::parseDuration):
        (JSC::ISO8601::parseTimeSpec):
        (JSC::ISO8601::parseTimeZoneNumericUTCOffset):
        (JSC::ISO8601::parseTimeZoneBracketedAnnotation):
        (JSC::ISO8601::canBeTimeZone):
        (JSC::ISO8601::parseTimeZone):
        (JSC::ISO8601::parseTime):
        (JSC::ISO8601::daysInMonth):
        (JSC::ISO8601::parseDate):
        (JSC::ISO8601::parseDateTime):
        (JSC::ISO8601::formatTimeZoneOffsetString):
        (JSC::ISO8601::temporalTimeToString):
        (JSC::ISO8601::isValidDuration):
        * runtime/ISO8601.h:
        (JSC::ISO8601::Duration::Duration):
        (JSC::ISO8601::Duration::operator[]):
        (JSC::ISO8601::Duration::operator[] const):
        (JSC::ISO8601::Duration::begin const):
        (JSC::ISO8601::Duration::end const):
        (JSC::ISO8601::Duration::clear):
        (JSC::ISO8601::Duration::operator- const):
        (JSC::ISO8601::PlainTime::PlainTime):
        (JSC::ISO8601::PlainTime::operator==):
        (JSC::ISO8601::PlainDate::PlainDate):
        (JSC::ISO8601::PlainDate::year const):
        (JSC::ISO8601::PlainDate::month const):
        (JSC::ISO8601::PlainDate::day const):
        * runtime/IntlObject.cpp:
        (JSC::utcTimeZoneIDSlow):
        * runtime/IntlObject.h:
        (JSC::utcTimeZoneID):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::plainTimeStructure):
        * runtime/TemporalCalendarConstructor.cpp:
        (JSC::TemporalCalendarConstructor::finishCreation):
        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::tryCreateIfValid):
        (JSC::TemporalDuration::fromNonDurationValue):
        (JSC::TemporalDuration::toDuration):
        (JSC::TemporalDuration::toDurationRecord):
        (JSC::TemporalDuration::toString const):
        (JSC::TemporalDuration::toString):
        (JSC::isValidDuration): Deleted.
        (JSC::TemporalDuration::fromObject): Deleted.
        * runtime/TemporalDuration.h:
        * runtime/TemporalNow.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalObject.cpp:
        (JSC::createPlainTimeConstructor):
        (JSC::secondsStringPrecision):
        (JSC::toTemporalOverflow):
        * runtime/TemporalObject.h:
        * runtime/TemporalPlainTime.cpp: Added.
        (JSC::TemporalPlainTime::create):
        (JSC::TemporalPlainTime::createStructure):
        (JSC::TemporalPlainTime::TemporalPlainTime):
        (JSC::TemporalPlainTime::finishCreation):
        (JSC::TemporalPlainTime::visitChildrenImpl):
        (JSC::toPlainTime):
        (JSC::TemporalPlainTime::tryCreateIfValid):
        (JSC::nonNegativeModulo):
        (JSC::balanceTime):
        (JSC::roundTime):
        (JSC::TemporalPlainTime::round const):
        (JSC::TemporalPlainTime::toString const):
        (JSC::propertyName):
        (JSC::toTemporalTimeRecord):
        (JSC::toPartialTime):
        (JSC::constraintTime):
        (JSC::regulateTime):
        (JSC::toTemporalCalendarWithISODefault):
        (JSC::getTemporalCalendarWithISODefault):
        (JSC::TemporalPlainTime::from):
        (JSC::TemporalPlainTime::compare):
        (JSC::toLimitedTemporalDuration):
        (JSC::addTime):
        (JSC::TemporalPlainTime::add const):
        (JSC::TemporalPlainTime::subtract const):
        (JSC::TemporalPlainTime::with const):
        (JSC::differenceTime):
        (JSC::extractDifferenceOptions):
        (JSC::TemporalPlainTime::until const):
        (JSC::TemporalPlainTime::since const):
        * runtime/TemporalPlainTime.h: Added.
        * runtime/TemporalPlainTimeConstructor.cpp: Added.
        (JSC::TemporalPlainTimeConstructor::create):
        (JSC::TemporalPlainTimeConstructor::createStructure):
        (JSC::TemporalPlainTimeConstructor::TemporalPlainTimeConstructor):
        (JSC::TemporalPlainTimeConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalPlainTimeConstructor.h: Copied from Source/JavaScriptCore/runtime/TemporalTimeZone.h.
        * runtime/TemporalPlainTimePrototype.cpp: Added.
        (JSC::TemporalPlainTimePrototype::create):
        (JSC::TemporalPlainTimePrototype::createStructure):
        (JSC::TemporalPlainTimePrototype::TemporalPlainTimePrototype):
        (JSC::TemporalPlainTimePrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/TemporalPlainTimePrototype.h: Copied from Source/JavaScriptCore/runtime/TemporalTimeZone.h.
        * runtime/TemporalTimeZone.cpp:
        (JSC::TemporalTimeZone::from):
        (JSC::TemporalTimeZone::idForTimeZoneName): Deleted.
        * runtime/TemporalTimeZone.h:
        * runtime/TemporalTimeZoneConstructor.cpp:
        (JSC::TemporalTimeZoneConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-09-07  Yusuke Suzuki  <ysuzuki@apple.com>

        Math.hypot checks for infinite values prematurely
        https://bugs.webkit.org/show_bug.cgi?id=229843

        Reviewed by Ross Kirsling.

        According to the spec[1], we should throw an error about non finite argument after coercing all arguments to doubles.

        [1]: https://tc39.es/ecma262/#sec-math.hypot

        * runtime/MathObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-09-07  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early September 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=229983

        Unreviewed non-unified build fixes.

        * runtime/TemporalTimeZone.cpp: Add missing JSObjectInlines.h header.

2021-09-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make EnumeratorNextUpdateIndexAndMode clobberizing rule precise
        https://bugs.webkit.org/show_bug.cgi?id=229898
        rdar://82714439

        Reviewed by Saam Barati.

        Clobberizing rule and AI does not match for EnumeratorNextUpdateIndexAndMode node.
        We fix both cases: isSaneChain is not related to this node. So we should use isInBounds
        as we are doing for HasIndexedProperty node.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):

2021-09-03  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed, non-unified JSC build fix following 241222@main.

        * b3/B3ReduceLoopStrength.h:
        * jit/JITOperations.h:
        * wasm/WasmOperations.h:

2021-09-03  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Yarr::ByteTerm sometimes leaves fields uninitialized
        https://bugs.webkit.org/show_bug.cgi?id=229891

        Reviewed by Yusuke Suzuki.

        * yarr/YarrInterpreter.h:
        (JSC::Yarr::ByteTerm::ByteTerm):
        Default initialize `frameLocation` and `inputPosition`.
        (Also, use initializer list where possible.)

2021-09-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement Temporal.TimeZone
        https://bugs.webkit.org/show_bug.cgi?id=229703

        Reviewed by Ross Kirsling.

        This patch implements Temporal.TimeZone. While this patch does not implement features which requires Temporal.Instant,
        we implement the core of Temporal.TimeZone, holding UTC offset or IANA TimeZone ID. This patch implements parsing TimeZoneNumericUTCOffset
        to populate TimeZone from that format.

        Since Temporal.TimeZone is implemented, we also support `Temporal.Now.timeZone()`, which returns current system TimeZone.

        We also fix Intl enumeration not including "UTC". Since it is included in IANA TimeZones, we should include that.

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/ISO8601.cpp:
        (JSC::ISO8601::parseDecimalInt32):
        (JSC::ISO8601::handleFraction):
        (JSC::ISO8601::parseTimeZoneNumericUTCOffset):
        (JSC::ISO8601::formatTimeZoneOffsetString):
        * runtime/ISO8601.h:
        * runtime/IntlObject.cpp:
        (JSC::isValidTimeZoneNameFromICUTimeZone):
        (JSC::canonicalizeTimeZoneNameFromICUTimeZone):
        (JSC::intlAvailableTimeZones):
        (JSC::availableTimeZones):
        * runtime/IntlObject.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::timeZoneStructure):
        * runtime/TemporalNow.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalNow.h:
        * runtime/TemporalObject.cpp:
        (JSC::createTimeZoneConstructor):
        * runtime/TemporalTimeZone.cpp: Added.
        (JSC::TemporalTimeZone::createFromID):
        (JSC::TemporalTimeZone::createFromUTCOffset):
        (JSC::TemporalTimeZone::createStructure):
        (JSC::TemporalTimeZone::TemporalTimeZone):
        (JSC::TemporalTimeZone::idForTimeZoneName):
        (JSC::parseTemporalTimeZoneString):
        (JSC::TemporalTimeZone::from):
        * runtime/TemporalTimeZone.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h.
        * runtime/TemporalTimeZoneConstructor.cpp: Added.
        (JSC::TemporalTimeZoneConstructor::create):
        (JSC::TemporalTimeZoneConstructor::createStructure):
        (JSC::TemporalTimeZoneConstructor::TemporalTimeZoneConstructor):
        (JSC::TemporalTimeZoneConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalTimeZoneConstructor.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h.
        * runtime/TemporalTimeZonePrototype.cpp: Added.
        (JSC::TemporalTimeZonePrototype::create):
        (JSC::TemporalTimeZonePrototype::createStructure):
        (JSC::TemporalTimeZonePrototype::TemporalTimeZonePrototype):
        (JSC::TemporalTimeZonePrototype::finishCreation):
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalTimeZonePrototype.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h.
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-09-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Validate JSPropertyNameEnumerator via watchpoints
        https://bugs.webkit.org/show_bug.cgi?id=229846

        Reviewed by Keith Miller.

        Looked into Elm-TodoMVC sampling profiler data and found that op_get_property_enumerator is taking enough amount of time.
        And Instruments say validating JSPropertyNameEnumerator via traversing StructureChain is costly.
        We are caching JSPropertyNameEnumerator only when we meet the condition: objects in prototype chain can ensure identity of
        property names if structure is not changed. So we can use watchpoint based approach to invalidate JSPropertyNameEnumerator.

        This patch injects structure transition watchpoints if possible. And when watchpoint is fired, we invalidate JSPropertyNameEnumerator
        cached in StructureRareData, as if we are ensuring prototype chain condition for the other property accesses.

        This offers 0.6% improvement in Speedometer2.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |121.971667   |117.725000   |0.965183  | 0.000000 (significant)                           |
        | VueJS-TodoMVC                        |26.246667    |26.035000    |0.991935  | 0.360614                                         |
        | EmberJS-TodoMVC                      |126.196667   |126.653333   |1.003619  | 0.103138                                         |
        | BackboneJS-TodoMVC                   |48.976667    |48.881667    |0.998060  | 0.474106                                         |
        | Preact-TodoMVC                       |20.118333    |20.115000    |0.999834  | 0.989038                                         |
        | AngularJS-TodoMVC                    |131.545000   |130.706667   |0.993627  | 0.015344 (significant)                           |
        | Vanilla-ES2015-TodoMVC               |63.725000    |63.773333    |1.000758  | 0.706560                                         |
        | Inferno-TodoMVC                      |64.231667    |62.653333    |0.975427  | 0.000000 (significant)                           |
        | Flight-TodoMVC                       |77.223333    |77.690000    |1.006043  | 0.268309                                         |
        | Angular2-TypeScript-TodoMVC          |39.686667    |39.500000    |0.995296  | 0.499678                                         |
        | VanillaJS-TodoMVC                    |52.321667    |51.973333    |0.993342  | 0.077777                                         |
        | jQuery-TodoMVC                       |224.908333   |225.761667   |1.003794  | 0.022136                                         |
        | EmberJS-Debug-TodoMVC                |339.858333   |339.886667   |1.000083  | 0.950320                                         |
        | React-TodoMVC                        |86.545000    |86.070000    |0.994512  | 0.001518 (significant)                           |
        | React-Redux-TodoMVC                  |146.010000   |142.855000   |0.978392  | 0.000000 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.411667    |61.456667    |1.000733  | 0.631499                                         |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 255.96543
        b mean = 257.53379
        pValue = 0.0000034394
        (Bigger means are better.)
        1.006 times better
        Results ARE significant

        * bytecode/Watchpoint.cpp:
        * bytecode/Watchpoint.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * runtime/JSPropertyNameEnumerator.h:
        (JSC::propertyNameEnumerator):
        * runtime/StructureRareData.h:
        * runtime/StructureRareDataInlines.h:
        (JSC::StructureRareData::setCachedPropertyNameEnumerator):
        (JSC::StructureChainInvalidationWatchpoint::install):
        (JSC::StructureChainInvalidationWatchpoint::fireInternal):
        (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint):
        (JSC::StructureRareData::invalidateWatchpointBasedValidation):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-09-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix WebKitAdditions directory traversal in offlineasm part 2
        https://bugs.webkit.org/show_bug.cgi?id=229853

        Reviewed by Mark Lam.

        When DEPLOYMENT_LOCATION is YES, WEBKITADDITIONS_HEADERS_FOLDER_PATH is /usr/local/include/WebKitAdditions.
        However, since Xcode implicitly changes it to ${SDKROOT}/usr/local/include/WebKitAdditions, we need to
        pass the path with ${SDKROOT} if this path is used by non-Xcode.

        In this patch, we replace --use-deployment-location with --webkit-additions-path=path and passing WebKitAdditions
        path directly from Xcode. We define WK_WEBKITADDITIONS_INSTALL_PATH and WK_WEBKITADDITIONS_HEADERS_FOLDER_PATH in
        JavaScriptCore/Configurations/Base.xcconfig to populate this variable and pass WK_WEBKITADDITIONS_HEADERS_FOLDER_PATH
        to the scripts.

        We also fix offlineasm's path concatenation. It was using +, but this does not work if directory doesn't end with '/'.
        We should use File.join when concatenating file paths.

        * Configurations/Base.xcconfig:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * offlineasm/asm.rb:
        * offlineasm/generate_offset_extractor.rb:
        * offlineasm/generate_settings_extractor.rb:
        * offlineasm/parser.rb:

2021-09-03  Michael Catanzaro  <mcatanzaro@gnome.org>

        Silence more -Wreturn-type warnings
        https://bugs.webkit.org/show_bug.cgi?id=229858

        Unreviewed.

        * runtime/TemporalDuration.cpp:
        (JSC::propertyName):
        * runtime/TemporalObject.cpp:
        (JSC::roundNumberToIncrement):

2021-09-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix WebKitAdditions directory traversal in offlineasm
        https://bugs.webkit.org/show_bug.cgi?id=229841

        Reviewed by Mark Lam.

        When DEPLOYMENT_LOCATION is YES, WebKitAdditions directory becomes /usr/local/include/WebKitAdditions.
        This patch adds --use-deployment-location option to generate_offset_extractor.rb, generate_settings_extractor.rb,
        and asm.rb. And they pass it to parser to change the include directory.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * offlineasm/asm.rb:
        * offlineasm/generate_offset_extractor.rb:
        * offlineasm/generate_settings_extractor.rb:
        * offlineasm/parser.rb:

2021-09-02  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] ScriptExecutable::newCodeBlockFor should handle exceptions more predictably
        https://bugs.webkit.org/show_bug.cgi?id=229787

        Reviewed by Mark Lam.

        ScriptExecutable::newCodeBlockFor has four codepaths -- one for each of EvalExecutable, ProgramExecutable,
        ModuleProgramExecutable, and FunctionExecutable. These all end up in bool CodeBlock::finishCreation(...),
        but the first three overwrite the current exception with an OOM error while the last does not.
        Furthermore, newCodeBlockFor handles exceptions via an out param, which is then returned by its single caller,
        prepareForExecutionImpl.

        Altogether, this results in some questionable checking of the returned exception against throwScope.exception()
        at prepareForExecution's callsites in Interpreter and elsewhere.

        This patch aims to make this exception handling clearer and more consistent by:
        1. not overwriting an existing exception with an OOM error
        2. doing away with the out param in favor of RETURN_IF_EXCEPTION

        * bytecode/CodeBlock.h:
        (JSC::ScriptExecutable::prepareForExecution):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):
        (JSC::Interpreter::executeCall):
        (JSC::Interpreter::executeConstruct):
        (JSC::Interpreter::prepareForRepeatCall):
        (JSC::Interpreter::execute):
        (JSC::Interpreter::executeModuleProgram):
        * interpreter/InterpreterInlines.h:
        (JSC::Interpreter::execute):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        (JSC::virtualForWithFunction):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setUpCall):
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::newCodeBlockFor):
        (JSC::ScriptExecutable::prepareForExecutionImpl):
        * runtime/ScriptExecutable.h:

2021-09-02  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix IndexedDoubleStore InlineAccess for 32 bits
        https://bugs.webkit.org/show_bug.cgi?id=229772

        Reviewed by Caio Araujo Neponoceno de Lima.

        In IndexedDoubleStore inline access, the path if the value is NaN
        is only being handled in 64 bits, thus introducing some wrong 
        results in 32 bits. This patch fixes:

        stress/double-add-sub-mul-can-produce-nan.js
        stress/pow-stable-results.js
        stress/math-pow-stable-results.js

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):

2021-09-02  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Fix invalid exception checks in Temporal classes
        https://bugs.webkit.org/show_bug.cgi?id=229793

        Reviewed by Yusuke Suzuki.

        * runtime/TemporalCalendarPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalDuration.cpp:
        (JSC::TemporalDuration::fromObject):
        (JSC::TemporalDuration::toDuration):
        (JSC::TemporalDuration::with const):
        * runtime/TemporalDurationPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-09-02  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, annotate executeJSCJITProbe with REFERENCED_FROM_ASM WTF_INTERNAL

        * assembler/ProbeContext.h:

2021-09-02  Mark Lam  <mark.lam@apple.com>

        Add more support for JIT operation validation testing.
        https://bugs.webkit.org/show_bug.cgi?id=229534
        rdar://81526335

        Reviewed by Saam Barati.

        1. Added a JITOperationValidation.h to tidy up the code for supporting JIT
           operation validation.

        2. Introduce a JITOperationAnnotation struct to record JIT operation function
           pointers, with an extra pointer field for a validation test function.

        3. Changed JSC_ANNOTATE_JIT_OPERATION to capture a JITOperationAnnotation struct
           instead of just a single operation pointer.

        4. Converted the static addPointers() function in JITOperationList.cpp into a
           member function of JITOperationList.  This allows for the code to be more
           terse, as well as enables the use of an inverse map mechanism on debug builds
           only.

        5. Added more macros to help differentiate between different types of JIT
           operation functions.

        6. Made all JIT operation functions use extern "C" linkage to make it possible to
           write validation tests in assembly so that we can run them on a release build
           as well without taking too much time.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/JITOperationList.cpp:
        (JSC::JITOperationList::addInverseMap):
        (JSC::JITOperationList::addPointers):
        (JSC::JITOperationList::populatePointersInJavaScriptCore):
        (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt):
        (JSC::JITOperationList::populatePointersInEmbedder):
        (JSC::addPointers): Deleted.
        * assembler/JITOperationList.h:
        (JSC::JITOperationList::map const):
        (JSC::JITOperationList::inverseMap const):
        (JSC::JITOperationList::assertIsJITOperation):
        (JSC::JITOperationList::assertIsJITOperationWithvalidation):
        * assembler/JITOperationValidation.h: Added.
        * assembler/MacroAssemblerARM64.cpp:
        * assembler/MacroAssemblerARM64.h:
        * assembler/MacroAssemblerARM64E.h:
        * assembler/MacroAssemblerARMv7.cpp:
        * assembler/MacroAssemblerMIPS.cpp:
        * assembler/MacroAssemblerX86Common.cpp:
        * b3/testb3.h:
        * b3/testb3_1.cpp:
        * b3/testb3_5.cpp:
        * b3/testb3_7.cpp:
        * dfg/DFGOSRExit.h:
        * ftl/FTLLowerDFGToB3.cpp:
        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):
        * jit/Repatch.cpp:
        (JSC::retagOperationWithValidation):
        (JSC::retagCallTargetWithValidation):
        (JSC::readPutICCallTarget):
        * jit/ThunkGenerators.cpp:
        * jsc.cpp:
        * llint/LLIntData.cpp:
        * llint/LLIntThunks.cpp:
        * runtime/CommonSlowPaths.h:
        * runtime/JSCPtrTag.h:
        (JSC::tagJSCCodePtrImpl):
        (JSC::untagJSCCodePtrImpl):
        (JSC::isTaggedJSCCodePtrImpl):
        * runtime/MathCommon.h:
        * runtime/Options.cpp:
        (JSC::canUseJITCage):
        * tools/JSDollarVM.cpp:
        * yarr/YarrJIT.cpp:

2021-09-01  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed exception scope verification fix for r241171.

        * runtime/TemporalDurationConstructor.cpp:
        Add missing RELEASE_AND_RETURN.

2021-09-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Fix the Xcode build after r281838

        Unreviewed.

        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:

2021-09-01  Zan Dobersek  <zdobersek@igalia.com>

        REGRESSION(r279256): Crash in JSC::FTL::saveAllRegisters
        https://bugs.webkit.org/show_bug.cgi?id=229235
        <rdar://problem/82337517>

        Reviewed by Mark Lam.

        Avoid out-of-bounds access into RegisterSet's underlying Bitmap that
        occurs in FTL::saveAllRegisters() and FTL::restoreAllRegisters(). Helper
        Regs::nextRegister() and Regs::nextFPRegister() methods can increase the
        register ID values beyond the valid values, at which point there's a
        possibility of misuse if these register ID values are used to index into
        the Bitmap.

        To avoid this, iterating over RegisterID and FPRegisterID ranges is
        simplified yet kept efficient, and access into the RegisterSet is now
        only done if the register ID values are valid.

        This enables removing Regs::nextFPRegister(). Regs::nextRegister() is
        still used but is not adjusted to also use a for-loop to iterate across
        the valid RegisterID values, and only for those values the access into
        the RegisterSet is possible.

        * ftl/FTLSaveRestore.cpp:
        (JSC::FTL::saveAllRegisters):
        (JSC::FTL::restoreAllRegisters):

2021-08-31  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Implement Temporal.Duration
        https://bugs.webkit.org/show_bug.cgi?id=228532

        Reviewed by Yusuke Suzuki.

        This patch implements the Duration class for the upcoming Temporal API (currently at stage 3 in TC39).
        Spec: https://tc39.es/proposal-temporal/#sec-temporal-duration-objects
        Docs: https://tc39.es/proposal-temporal/docs/duration.html

        A Duration is ultimately an array of doubles (years, months, weeks, days, hours, minutes, seconds, ms, μs, ns)
        which can be converted to and from an ISO string representation (e.g. "-P1Y2M3W4DT5H6M7.123456789S")
        and which supports various calculations.

        The spec is still in flux and certain issues were identified in the course of preparing this patch.
        This code aims to be "as correct as possible" for the moment; small corrections are expected in the near future.

        * CMakeLists.txt:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/CommonIdentifiers.h:
        * runtime/ISO8601.cpp: Added.
        * runtime/ISO8601.h: Added.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::durationStructure):
        * runtime/TemporalDuration.cpp: Added.
        * runtime/TemporalDuration.h: Added.
        * runtime/TemporalDurationConstructor.cpp: Added.
        * runtime/TemporalDurationConstructor.h: Added.
        * runtime/TemporalDurationPrototype.cpp: Added.
        * runtime/TemporalDurationPrototype.h: Added.
        * runtime/TemporalObject.cpp:
        (JSC::createDurationConstructor):
        (JSC::singularUnit):
        (JSC::temporalUnitType):
        (JSC::temporalLargestUnit):
        (JSC::temporalSmallestUnit):
        (JSC::temporalFractionalSecondDigits):
        (JSC::secondsStringPrecision):
        (JSC::maximumRoundingIncrement):
        (JSC::temporalRoundingIncrement):
        (JSC::roundNumberToIncrement):
        * runtime/TemporalObject.h:
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-08-31  Lauro Moura  <lmoura@igalia.com>

        Non-unified build partial fixes, late late August 2021
        https://bugs.webkit.org/show_bug.cgi?id=229741

        Unreviewed non-unified build fixes.

        * bytecode/PutByStatus.cpp: Add missing header.
        * bytecode/PutByVariant.h: Ditto.
        * runtime/TemporalCalendar.cpp: Ditto.
        * runtime/TemporalCalendarPrototype.cpp: Ditto.

2021-08-31  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable Object.hasOwn
        https://bugs.webkit.org/show_bug.cgi?id=229730

        Reviewed by Saam Barati.

        Enable Object.hasOwn implementation. And cleaning up feature flag list.

        * runtime/OptionsList.h:

2021-08-31  Saam Barati  <sbarati@apple.com>

        Baseline JIT's in_by_val and emitHasPrivate should load the property before branching on if the base is a cell
        https://bugs.webkit.org/show_bug.cgi?id=229725

        Reviewed by Keith Miller.

        If the base isn't a cell, we're calling the slow path with a random value
        in the property. This works, because the slow paths first branch on if
        the base is a cell or not, and throw an exception. But we fix this for our
        own sanity, since it's never a good idea to go to a slow path with a
        JSValue argument containing unknown bits.

        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitHasPrivate):

2021-08-31  Aditi Singh  <asingh@igalia.com>

        Implement Object.hasOwn()
        https://bugs.webkit.org/show_bug.cgi?id=226291

        Reviewed by Alexey Shvayka.
        
        This patch implements Object.hasOwn() method which is a stage 3 proposal. The method is disabled by default and can be enabled using the feature flag.
        The proposal details can be found here: https://github.com/tc39/proposal-accessible-object-hasownproperty.
        The patch also refines objectPrototypeHasOwnProperty() to accept JSObject* base rather than JSValue.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * runtime/CommonIdentifiers.h:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/ObjectConstructor.cpp:
        (JSC::ObjectConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectPrototype.cpp:
        (JSC::objectPrototypeHasOwnProperty):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectPrototype.h:
        * runtime/OptionsList.h:

2021-08-26  Darin Adler  <darin@apple.com>

        Cut down on use of CFGetTypeID, using dynamic_cf_cast instead; related streamlining
        https://bugs.webkit.org/show_bug.cgi?id=229414

        Reviewed by Tim Horton.

        * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:
        (Inspector::RemoteInspectorXPCConnection::deserializeMessage): Use
        dynamic_cf_cast to check type instead of CFGetTypeID. Also do the
        check at runtime rather than asserting. Not really sufficient to
        assert correct type for something that comes over an XPC connection.

2021-08-30  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Host functions and custom getters should be lowerCamelCase
        https://bugs.webkit.org/show_bug.cgi?id=229695

        Reviewed by Yusuke Suzuki.

        For some reason, the host functions and custom getters for Intl (and JSONObject) were written in UpperCamelCase.

        * runtime/IntlCollatorConstructor.cpp:
        * runtime/IntlCollatorPrototype.cpp:
        * runtime/IntlDateTimeFormatConstructor.cpp:
        * runtime/IntlDateTimeFormatPrototype.cpp:
        * runtime/IntlDisplayNamesConstructor.cpp:
        * runtime/IntlDisplayNamesPrototype.cpp:
        * runtime/IntlListFormatConstructor.cpp:
        * runtime/IntlListFormatPrototype.cpp:
        * runtime/IntlLocalePrototype.cpp:
        * runtime/IntlNumberFormatConstructor.cpp:
        * runtime/IntlNumberFormatPrototype.cpp:
        * runtime/IntlPluralRulesConstructor.cpp:
        * runtime/IntlPluralRulesPrototype.cpp:
        * runtime/IntlRelativeTimeFormatConstructor.cpp:
        * runtime/IntlRelativeTimeFormatPrototype.cpp:
        * runtime/IntlSegmentIteratorPrototype.cpp:
        * runtime/IntlSegmenterConstructor.cpp:
        * runtime/IntlSegmenterPrototype.cpp:
        * runtime/IntlSegmentsPrototype.cpp:
        * runtime/JSONObject.cpp:

2021-08-30  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC][Intl] Errors for .call({}) are too verbose
        https://bugs.webkit.org/show_bug.cgi?id=229694

        Reviewed by Yusuke Suzuki.

        * runtime/IntlCollatorPrototype.cpp:
        * runtime/IntlDateTimeFormatPrototype.cpp:
        * runtime/IntlDisplayNamesPrototype.cpp:
        * runtime/IntlListFormatPrototype.cpp:
        * runtime/IntlLocalePrototype.cpp:
        * runtime/IntlNumberFormatPrototype.cpp:
        * runtime/IntlPluralRulesPrototype.cpp:
        * runtime/IntlRelativeTimeFormatPrototype.cpp:
        * runtime/IntlSegmentIteratorPrototype.cpp:
        * runtime/IntlSegmenterPrototype.cpp:
        * runtime/IntlSegmentsPrototype.cpp:

2021-08-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Implement Temporal.Calendar
        https://bugs.webkit.org/show_bug.cgi?id=229651

        Reviewed by Ross Kirsling.

        This patch implements Temporal.Calendar's simple part. Currently, we do not implement many part of Temporal.Calendar since
        we do not have Temporal Date-like structures yet, but this patch implemented core part of Temporal.Calendar: keeping calendar
        identifier.

        We also defer implementing Temporal.Calendar.from's calendar ID parsing part since it requires full-fledged ISO 8601 parser,
        which will be implemented in a separate patch.

        We use `unsigned` for CalendarID, and this id corresponds to the array index of intlAvailableCalendars, which returns array
        of String from ICU.

        * CMakeLists.txt:
        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/CommonIdentifiers.h:
        * runtime/IntlObject.cpp:
        (JSC::intlAvailableCalendars):
        (JSC::iso8601CalendarIDSlow):
        (JSC::availableCalendars):
        (JSC::createArrayFromStringVector): Deleted.
        * runtime/IntlObject.h:
        (JSC::iso8601CalendarID):
        * runtime/IntlObjectInlines.h:
        (JSC::createArrayFromStringVector):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::calendarStructure):
        * runtime/TemporalCalendar.cpp: Added.
        (JSC::TemporalCalendar::create):
        (JSC::TemporalCalendar::createStructure):
        (JSC::TemporalCalendar::TemporalCalendar):
        (JSC::TemporalCalendar::isBuiltinCalendar):
        (JSC::parseTemporalCalendarString):
        (JSC::TemporalCalendar::from):
        * runtime/TemporalCalendar.h: Added.
        * runtime/TemporalCalendarConstructor.cpp: Added.
        (JSC::TemporalCalendarConstructor::create):
        (JSC::TemporalCalendarConstructor::createStructure):
        (JSC::TemporalCalendarConstructor::TemporalCalendarConstructor):
        (JSC::TemporalCalendarConstructor::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/TemporalCalendarConstructor.h: Added.
        * runtime/TemporalCalendarPrototype.cpp: Added.
        (JSC::TemporalCalendarPrototype::create):
        (JSC::TemporalCalendarPrototype::createStructure):
        (JSC::TemporalCalendarPrototype::TemporalCalendarPrototype):
        (JSC::TemporalCalendarPrototype::finishCreation):
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::defaultMergeFields):
        * runtime/TemporalCalendarPrototype.h: Added.
        * runtime/TemporalObject.cpp:
        (JSC::createCalendarConstructor):
        * runtime/VM.cpp:
        * runtime/VM.h:

2021-08-30  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed, add missing include to pre-empt unified source shift.

        * runtime/IntlObject.cpp:

2021-08-30  Angelos Oikonomopoulos  <angelos@igalia.com>

        resolve-asm-file-conflicts.rb build failure after upgrade to CMake 3.21.0; DWARF 5 incompatibility
        https://bugs.webkit.org/show_bug.cgi?id=228267

        Reviewed by Adrian Perez de Castro.

        Implement the fix suggested by Adrian Vovk: any .file 0 directive
        should pass through unchanged.

        While here
        - if the file path is an absolute path, don't concat it with the working directory
        - also accept 'md5 0xhash' in the .file directive.

        * Scripts/resolve-asm-file-conflicts.rb:

2021-08-30  Zan Dobersek  <zdobersek@igalia.com>

        RISCV64 support in LLInt
        https://bugs.webkit.org/show_bug.cgi?id=229035
        <rdar://problem/82120908>

        Reviewed by Yusuke Suzuki.

        Introduce RISCV64 support at the LLint level. Along with the necessary
        offlineasm backend, plenty of miscellaneous code around MacroAssembler
        infrastructure is also introduced.

        Of the existing supported architectures, RISCV64 is most similar to
        ARM64, with the same word size and similar register abundance. This is
        mirrored in most changes around the MacroAssembler infrastructure as
        well as using same or similar codepaths in LLint for the two ISAs.

        For the MacroAssembler infrastructure, it won't be used until proper JIT
        support is introduced, but the basic facilities are still necessary to
        keep things compiling without complicating the configuration matrix.
        MacroAssemblerRISCV64 class provides no-op methods through C++ templates
        while RISCV64Assembler is also added in a limited form.

        The riscv64 offlineasm backend covers assembly generation for
        instructions that are exhibited by LLInt in the current configuration.
        It doesn't cover instructions that e.g. are only used in the WebAssembly
        opcodes, and WebAssembly won't be enabled until the higher JIT tiers are
        supported anyway.

        The offlineasm backend's assembly generation for specific instructions
        uses pattern matching of operand types for better overview of how
        resulting assembly is constructed. There's still certain improvements
        possible, e.g. in how scratch registers for more expansive operations
        are allocated.

        * CMakeLists.txt:
        * Sources.txt:
        * assembler/AbstractMacroAssembler.h:
        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerRISCV64.cpp: Added.
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerRISCV64.h: Added.
        Distorted auto-generated method list removed. Necessary methods are
        introduced through no-op templates until actually needed for JIT
        generation.
        * assembler/MaxFrameExtentForSlowPathCall.h:
        * assembler/PerfLog.cpp:
        * assembler/ProbeContext.h:
        * assembler/RISCV64Assembler.h: Added.
        (JSC::RISCV64Assembler::firstRegister):
        (JSC::RISCV64Assembler::lastRegister):
        (JSC::RISCV64Assembler::numberOfRegisters):
        (JSC::RISCV64Assembler::firstSPRegister):
        (JSC::RISCV64Assembler::lastSPRegister):
        (JSC::RISCV64Assembler::numberOfSPRegisters):
        (JSC::RISCV64Assembler::firstFPRegister):
        (JSC::RISCV64Assembler::lastFPRegister):
        (JSC::RISCV64Assembler::numberOfFPRegisters):
        (JSC::RISCV64Assembler::gprName):
        (JSC::RISCV64Assembler::sprName):
        (JSC::RISCV64Assembler::fprName):
        (JSC::RISCV64Assembler::RISCV64Assembler):
        (JSC::RISCV64Assembler::buffer):
        (JSC::RISCV64Assembler::invert):
        (JSC::RISCV64Assembler::getRelocatedAddress):
        (JSC::RISCV64Assembler::codeSize const):
        (JSC::RISCV64Assembler::getCallReturnOffset):
        (JSC::RISCV64Assembler::labelIgnoringWatchpoints):
        (JSC::RISCV64Assembler::labelForWatchpoint):
        (JSC::RISCV64Assembler::label):
        (JSC::RISCV64Assembler::linkJump):
        (JSC::RISCV64Assembler::linkCall):
        (JSC::RISCV64Assembler::linkPointer):
        (JSC::RISCV64Assembler::maxJumpReplacementSize):
        (JSC::RISCV64Assembler::patchableJumpSize):
        (JSC::RISCV64Assembler::repatchPointer):
        (JSC::RISCV64Assembler::relinkJump):
        (JSC::RISCV64Assembler::relinkJumpToNop):
        (JSC::RISCV64Assembler::relinkCall):
        (JSC::RISCV64Assembler::debugOffset):
        (JSC::RISCV64Assembler::cacheFlush):
        (JSC::RISCV64Assembler::fillNops):
        * assembler/RISCV64Registers.h: Added.
        * jit/FPRInfo.h:
        (JSC::FPRInfo::toRegister):
        (JSC::FPRInfo::toArgumentRegister):
        (JSC::FPRInfo::toIndex):
        (JSC::FPRInfo::debugName):
        * jit/GPRInfo.h:
        (JSC::GPRInfo::toRegister):
        (JSC::GPRInfo::toArgumentRegister):
        (JSC::GPRInfo::toIndex):
        (JSC::GPRInfo::debugName):
        * jit/RegisterSet.cpp:
        (JSC::RegisterSet::vmCalleeSaveRegisters):
        (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
        * llint/LLIntData.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/backends.rb: Reference the riscv64 backend as required.
        * offlineasm/registers.rb: List additional possible registers.
        * offlineasm/riscv64.rb: Added.

2021-08-29  Keith Miller  <keith_miller@apple.com>

        Add openFile function to jsc.cpp that links to file backed memory
        https://bugs.webkit.org/show_bug.cgi?id=229621

        Reviewed by Saam Barati.

        This patch uses fopen directly rather than use WTF::MappedFileData so there were less changes to
        readline.

        * jsc.cpp:
        (computeFilePath):
        (JSC_DEFINE_HOST_FUNCTION):
        (JSFileDescriptor::subspaceFor):
        (JSFileDescriptor::createStructure):
        (JSFileDescriptor::create):
        (JSFileDescriptor::finishCreation):
        (JSFileDescriptor::destroy):
        (JSFileDescriptor::descriptor const):
        (JSFileDescriptor::JSFileDescriptor):
        (JSFileDescriptor::~JSFileDescriptor):

2021-08-29  Joonghun Park  <jh718.park@samsung.com>

        Unreviewed. Remove the build warning below since r281615.
        warning: control reaches end of non-void function [-Wreturn-type]

        * bytecode/PutByStatus.cpp:
        (JSC::PutByStatus::makesCalls const):

2021-08-28  Cameron McCormack  <heycam@apple.com>

        Miscellaneous typo fixes
        https://bugs.webkit.org/show_bug.cgi?id=229642

        Reviewed by Fujii Hironori.

        * API/JSValue.h:
        * runtime/RegExp.cpp:
        (JSC::RegExp::matchCompareWithInterpreter):

2021-08-27  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation][CMake] Add control over whether JavaScriptCore should be shared
        https://bugs.webkit.org/show_bug.cgi?id=229591

        Reviewed by Don Olmstead.

        Make LowLevelInterpreterLib objects get added via _PRIVATE_LIBRARIES when
        using JavaScriptCore as an object library in order to propogate them
        correctly.

        * CMakeLists.txt:

2021-08-27  Russell Epstein  <repstein@apple.com>

        Land Windows build fixes from safari-612.1.29.14-branch.
        https://bugs.webkit.org/show_bug.cgi?id=229627.

        Reviewed by Per Arne Vollan.

        * JavaScriptCore.vcxproj/JavaScriptCore.proj:

2021-08-27  Mark Lam  <mark.lam@apple.com>

        Changed ARM64 probe trampoline to do ptr auth the standard way.
        https://bugs.webkit.org/show_bug.cgi?id=229629
        rdar://problem/82453220

        Reviewed by Saam Barati.

        Also fix a comment, and add back 2 lines that I accidentally deleted in r281718.

        * assembler/MacroAssemblerARM64.cpp:

2021-08-27  Mark Lam  <mark.lam@apple.com>

        Make ARM64 and X86_64 probe code a little bit more efficient.
        https://bugs.webkit.org/show_bug.cgi?id=229618
        rdar://82445743

        Reviewed by Yusuke Suzuki.

        We were using an unnecessary indirect call to call Probe::executeProbe() when we
        can be using a direct call, which emits less JIT code.  This patch changes the
        ARM64 and X86_64 ports to use a direct call now.

        Also rename executeProbe to executeJSCJITProbe to make it more unique since we're
        switching to extern "C" linkage for this function now.

        For MacroAssemblerX86Common.cpp, we left the X86 and MSVC implementations unchanged.
        For X86, I don't know the stack alignment requirements (if any) plus we might want
        to delete this code eventually since we're not supporting the X86 JIT anymore.
        For MSVC, I don't know the way to express a direct call in MSVC assembly, and have
        no way to test it.  Will leave that as an exercise for folks working on the Windows
        ports if they are interested.

        Also remove JITProbeExecutorPtrTag since it's no longer needed.

        * assembler/MacroAssemblerARM64.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerARMv7.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerMIPS.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerX86Common.cpp:
        (JSC::ctiMasmProbeTrampoline):
        (JSC::MacroAssembler::probe):
        * assembler/ProbeContext.cpp:
        (JSC::Probe::executeJSCJITProbe):
        (JSC::Probe::executeProbe): Deleted.
        * assembler/ProbeContext.h:
        * runtime/JSCPtrTag.h:

2021-08-27  Saam Barati  <sbarati@apple.com>

        Update ARM64EHash
        https://bugs.webkit.org/show_bug.cgi?id=228962
        <rdar://79883337>

        Reviewed by Mark Lam.

        * assembler/AssemblerBuffer.h:
        (JSC::ARM64EHash::ARM64EHash):
        (JSC::ARM64EHash::update):
        (JSC::ARM64EHash::makeDiversifier):
        (JSC::ARM64EHash::nextValue):
        (JSC::ARM64EHash::bitsForDiversifier):
        (JSC::ARM64EHash::currentHash):
        (JSC::ARM64EHash::setUpdatedHash):
        (JSC::AssemblerBuffer::AssemblerBuffer):
        (JSC::AssemblerBuffer::putIntegralUnchecked):
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::copyCompactAndLinkCode):

2021-08-27  Mikhail R. Gadelha  <mikhail@igalia.com>

        Avoid increasing required alignment of target type warning on ARM 32 bits
        https://bugs.webkit.org/show_bug.cgi?id=229151

        Reviewed by Mark Lam.

        Same approach as https://bugs.webkit.org/show_bug.cgi?id=38045
        cast pointers to void* to bypass warning about increasing pointer
        alingment. reinterpret_cast_ptr has custom behaviour only on ARM and
        MIPS 32 bits, and doesn't change the behaviour in 64 bits archs
        (reinterpret_cast_ptr is preprocessed to reinterpret_cast in 64 bits
        archs)

        * bytecode/Instruction.h:
        (JSC::BaseInstruction::asKnownWidth const):
        * llint/LLIntCommon.h:

2021-08-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r281587.
        https://bugs.webkit.org/show_bug.cgi?id=229609

        stress test failed on ARM64

        Reverted changeset:

        "[ARM64] Fix pre-index address mode"
        https://bugs.webkit.org/show_bug.cgi?id=229175
        https://commits.webkit.org/r281587

2021-08-26  Yusuke Suzuki  <ysuzuki@apple.com>

        Intl.DateTimeFormat incorrectly parses patterns with 'h' literal
        https://bugs.webkit.org/show_bug.cgi?id=229313
        rdar://82414310

        Reviewed by Ross Kirsling.

        While DateTimeFormat pattern and skeleton can include single-quoted literal texts,
        we are not respecting that when parsing them to extract information. As a result,
        we are incorrectly extracting hour-cycle information for "fr" locale since it can
        include "HH 'h'" pattern text. This patch fixes that by skipping literal text
        correctly.

        * runtime/IntlDateTimeFormat.cpp:
        (JSC::skipLiteralText):
        (JSC::IntlDateTimeFormat::setFormatsFromPattern):
        (JSC::IntlDateTimeFormat::hourCycleFromPattern):
        (JSC::IntlDateTimeFormat::replaceHourCycleInSkeleton):
        (JSC::IntlDateTimeFormat::replaceHourCycleInPattern):
        * runtime/IntlDateTimeFormat.h:
        * runtime/IntlLocale.cpp:
        (JSC::IntlLocale::hourCycles):

2021-08-26  Yusuke Suzuki  <ysuzuki@apple.com>

        Float32Arrays.sort() return undefined when length < 2
        https://bugs.webkit.org/show_bug.cgi?id=229575

        Reviewed by Saam Barati.

        TypedArray#sort should return |this| even when we don't perform sorting.

        * builtins/TypedArrayPrototype.js:
        (sort):

2021-08-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] op_put_private_name should use modern IC and remove ByValInfo
        https://bugs.webkit.org/show_bug.cgi?id=229544

        Reviewed by Saam Barati.

        This patch makes op_put_private_name use new PutByVal IC. This allows op_put_private_name to support
        polymorphic properties, and we can finally remove Baseline's adhoc IC and ByValInfo completely.

        Added microbenchmark showed 3x improvement due to polymorphic PutPrivateName IC.

                                                    ToT                     Patched

        class-private-field-polymorphic        9.3666+-0.0332     ^      3.1199+-0.0182        ^ definitely 3.0022x faster


        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/ByValInfo.cpp: Removed.
        * bytecode/ByValInfo.h: Removed.
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::getICStatusMap):
        (JSC::CodeBlock::stronglyVisitStrongReferences):
        (JSC::CodeBlock::findByValInfo): Deleted.
        (JSC::CodeBlock::addByValInfo): Deleted.
        * bytecode/CodeBlock.h:
        * bytecode/ICStatusMap.h:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetPrivateName):
        (JSC::DFG::SpeculativeJIT::compilePutPrivateName):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStoreBarrierInsertionPhase.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        (JSC::ByValCompilationInfo::ByValCompilationInfo): Deleted.
        * jit/JITInlines.h:
        (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): Deleted.
        (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase): Deleted.
        * jit/JITOperations.cpp:
        (JSC::putPrivateNameOptimize):
        (JSC::putPrivateName):
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emitPutByValWithCachedId): Deleted.
        (JSC::JIT::emitPutPrivateNameWithCachedId): Deleted.
        (JSC::JIT::emitByValIdentifierCheck): Deleted.
        (JSC::JIT::privateCompilePutPrivateNameWithCachedId): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        * jit/Repatch.cpp:
        (JSC::appropriateGenericPutByFunction):
        (JSC::appropriateOptimizingPutByFunction):
        (JSC::resetPutBy):

2021-08-26  Saam Barati  <sbarati@apple.com>

        r281485 was not sufficient in where it called disablePeepholeOptimization
        https://bugs.webkit.org/show_bug.cgi?id=229582
        <rdar://82346980>

        Reviewed by Yusuke Suzuki.

        r281485 accidentally deleted a place where we called disablePeepholeOptimization
        that was necessary. Basically, after we seek where the current instruction
        in BytecodeGenerator is, we need to disablePeepholeOptimization.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::ForInContext::finalize):

2021-08-26  Per Arne Vollan  <pvollan@apple.com>

        [AppleWin] JSC build failure
        https://bugs.webkit.org/show_bug.cgi?id=229578

        Reviewed by Don Olmstead.

        Add new build dependency between LLIntOffsetsExtractor and JSCBuiltins targets.

        * CMakeLists.txt:

2021-08-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Segfault in stress/typedarray-every.js (32bit)
        https://bugs.webkit.org/show_bug.cgi?id=229546

        Reviewed by Saam Barati.

        ARMv7 does not have enough registers. Adding workaround by using getEffectiveAddress.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):

2021-08-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DataIC should not embed StructureStubInfo pointer
        https://bugs.webkit.org/show_bug.cgi?id=229541

        Reviewed by Mark Lam.

        We should not embed pointer to StructureStubInfo::countdown if DataIC is used.

        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::store8):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfCountdown):

2021-08-25  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Polymorphic PutByVal
        https://bugs.webkit.org/show_bug.cgi?id=229229

        Reviewed by Saam Barati.

        This patch changes PutByVal IC to modern style. This polymorphic PutByVal can handle multiple array types and multiple identifiers.
        Also, this removes adhoc IC code in Baseline so that it paves the way to unlinked Baseline JIT by cleaning up IC.

        Several interesting points of the design.

        1. We need to pass ArrayProfile* via GPRReg to IC since we need to profile mayStoreToHole, which is still important to avoid the slow path.
        2. Transition / Replace IC need to record propertyRegs if it exists not to clobber these registers. This is important in DFG / FTL since
           IC should not clobber these registers unless it is flushed. It also makes Baseline code smaller since we do not reload them in the slow path call.
        3. Added a path folding String/Symbol when emitting PutByVal in DFG / FTL. This edge-case is found via a microbenchmark. Let's consider the case: one
           put_by_val site has one identifier "foo", but it has so many different Structures. Previously, we emit JITPutByIdGenerator adhocly, and still we
           cache this "foo" identifier in cachedId. In DFG / FTL, while we cannot make it PutByOffset, we can emit PutById since we know that identifier is
           always "foo". But after this patch's change, such a site becomes slow-path. And then this identifier information is missed, and we were emitting
           PutByVal for that. For now, we attempt to fold to one identifier in DFGByteCodeParser so that we can still attempt to make it PutById, which
           can be PutByOffset in constant folding phase. We would like to handle this one identifier slow-path case in PutByStatus / GetByStatus in the future
           patch.
        4. Now, DFG OSR exit does not query to ByValInfo for setter calls since JITPutByValGenerator use StructureStubInfo in Baseline.

        Results of Microbenchmarks look good.

                                                             ToT                     Patched

        put-by-val-direct-large-index                  94.6265+-0.9076           93.4550+-0.7121          might be 1.0125x faster
        inlined-put-by-val-with-string-transition
                                                       23.7131+-0.3282     ^     22.7679+-0.1137        ^ definitely 1.0415x faster
        put-by-val-with-string-slightly-polymorphic
                                                        1.9852+-0.0284            1.9580+-0.0224          might be 1.0139x faster
        get-and-put-by-val-double-index-dont-fall-off-a-cliff
                                                      185.4762+-0.5737     ?    185.6325+-0.5819        ?
        polymorphic-put-by-val-with-string             30.9903+-0.1207           30.8097+-0.1285
        put-by-val-machine-int                          1.8803+-0.0384            1.8707+-0.0440
        fold-put-by-val-with-symbol-to-multi-put-by-offset
                                                        4.8463+-0.1148            4.7839+-0.0547          might be 1.0130x faster
        put-by-val-with-string-replace-and-transition
                                                        8.8730+-1.5934     ^      6.2276+-0.0585        ^ definitely 1.4248x faster
        fold-put-by-val-with-string-to-multi-put-by-offset
                                                        4.8183+-0.0841     ?      4.8233+-0.0892        ?
        put-by-val-direct                               0.2845+-0.0091     ?      0.2901+-0.0088        ? might be 1.0196x slower
        put-by-val-with-symbol-replace-and-transition
                                                        6.3527+-0.0686     ?      6.3933+-0.0961        ?
        put-by-val-with-symbol                          9.3556+-3.1421            7.1509+-0.1019          might be 1.3083x faster
        put-by-val-with-symbol-slightly-polymorphic
                                                        2.0052+-0.0309            1.9781+-0.0397          might be 1.0137x faster
        put-by-val-negative-array-index                14.9572+-0.1221     ^     14.5636+-0.1044        ^ definitely 1.0270x faster
        put-by-val-with-string                         11.6345+-4.3048     ^      7.0919+-0.0918        ^ definitely 1.6405x faster
        put-by-val-large-index-blank-indexing-type
                                                        3.1425+-0.1165            3.1236+-0.0378
        inlined-put-by-val-with-symbol-transition
                                                       23.4932+-0.3186     ^     22.8469+-0.0873        ^ definitely 1.0283x faster
        polymorphic-put-by-val-with-symbol             36.6046+-1.6519     ^     30.8597+-0.1474        ^ definitely 1.1862x faster

        Speedometer2 showed roughly 0.2-0.3% progression.

        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |121.916667   |121.958333   |1.000342  | 0.876802                                         |
        | VueJS-TodoMVC                        |26.263333    |26.006667    |0.990227  | 0.263868                                         |
        | EmberJS-TodoMVC                      |127.080000   |127.866667   |1.006190  | 0.011497 (significant)                           |
        | BackboneJS-TodoMVC                   |48.920000    |49.318333    |1.008143  | 0.003395 (significant)                           |
        | Preact-TodoMVC                       |19.828333    |19.828333    |1.000000  | 1.000000                                         |
        | AngularJS-TodoMVC                    |134.011667   |132.080000   |0.985586  | 0.000000 (significant)                           |
        | Vanilla-ES2015-TodoMVC               |63.726667    |63.838333    |1.001752  | 0.408404                                         |
        | Inferno-TodoMVC                      |65.153333    |63.753333    |0.978512  | 0.000000 (significant)                           |
        | Flight-TodoMVC                       |78.133333    |78.780000    |1.008276  | 0.097794                                         |
        | Angular2-TypeScript-TodoMVC          |40.415000    |40.100000    |0.992206  | 0.287630                                         |
        | VanillaJS-TodoMVC                    |51.931667    |52.500000    |1.010944  | 0.004149 (significant)                           |
        | jQuery-TodoMVC                       |226.056667   |225.073333   |0.995650  | 0.007796 (significant)                           |
        | EmberJS-Debug-TodoMVC                |341.210000   |340.978333   |0.999321  | 0.623386                                         |
        | React-TodoMVC                        |87.198333    |86.893333    |0.996502  | 0.042189                                         |
        | React-Redux-TodoMVC                  |146.506667   |145.958333   |0.996257  | 0.018801 (significant)                           |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.450000    |61.870000    |1.006835  | 0.000049 (significant)                           |
        ----------------------------------------------------------------------------------------------------------------------------------
        a mean = 254.85111
        b mean = 255.25735
        pValue = 0.1856561656
        (Bigger means are better.)
        1.002 times better
        Results ARE NOT significant

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::create):
        (JSC::AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck const):
        (JSC::AccessCase::requiresIdentifierNameMatch const):
        (JSC::AccessCase::requiresInt32PropertyCheck const):
        (JSC::AccessCase::needsScratchFPR const):
        (JSC::AccessCase::forEachDependentCell const):
        (JSC::AccessCase::doesCalls const):
        (JSC::AccessCase::canReplace const):
        (JSC::AccessCase::generateWithGuard):
        (JSC::AccessCase::generateImpl):
        (JSC::AccessCase::toTypedArrayType):
        (JSC::AccessCase::canBeShared):
        * bytecode/AccessCase.h:
        (JSC::SharedJITStubSet::Hash::Key::Key):
        (JSC::SharedJITStubSet::Hash::Key::operator==):
        (JSC::SharedJITStubSet::Searcher::Translator::equal):
        * bytecode/ArrayProfile.h:
        (JSC::ArrayProfile::offsetOfMayStoreToHole):
        (JSC::ArrayProfile::offsetOfLastSeenStructureID):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/ICStatusMap.h:
        * bytecode/InlineAccess.cpp:
        (JSC::getScratchRegister):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        (WTF::printInternal):
        * bytecode/PutByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/PutByIdStatus.cpp.
        (JSC::PutByStatus::appendVariant):
        (JSC::PutByStatus::shrinkToFit):
        (JSC::PutByStatus::computeFromLLInt):
        (JSC::PutByStatus::PutByStatus):
        (JSC::PutByStatus::computeFor):
        (JSC::PutByStatus::computeForStubInfo):
        (JSC::PutByStatus::makesCalls const):
        (JSC::PutByStatus::slowVersion const):
        (JSC::PutByStatus::singleIdentifier const):
        (JSC::PutByStatus::visitAggregateImpl):
        (JSC::PutByStatus::markIfCheap):
        (JSC::PutByStatus::finalize):
        (JSC::PutByStatus::merge):
        (JSC::PutByStatus::filter):
        (JSC::PutByStatus::dump const):
        * bytecode/PutByStatus.h: Renamed from Source/JavaScriptCore/bytecode/PutByIdStatus.h.
        * bytecode/PutByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/PutByIdVariant.cpp.
        (JSC::PutByVariant::PutByVariant):
        (JSC::PutByVariant::operator=):
        (JSC::PutByVariant::replace):
        (JSC::PutByVariant::transition):
        (JSC::PutByVariant::setter):
        (JSC::PutByVariant::oldStructureForTransition const):
        (JSC::PutByVariant::fixTransitionToReplaceIfNecessary):
        (JSC::PutByVariant::writesStructures const):
        (JSC::PutByVariant::reallocatesStorage const):
        (JSC::PutByVariant::makesCalls const):
        (JSC::PutByVariant::attemptToMerge):
        (JSC::PutByVariant::attemptToMergeTransitionWithReplace):
        (JSC::PutByVariant::visitAggregateImpl):
        (JSC::PutByVariant::markIfCheap):
        (JSC::PutByVariant::finalize):
        (JSC::PutByVariant::dump const):
        (JSC::PutByVariant::dumpInContext const):
        * bytecode/PutByVariant.h: Renamed from Source/JavaScriptCore/bytecode/PutByIdVariant.h.
        (JSC::PutByVariant::PutByVariant):
        (JSC::PutByVariant::identifier const):
        (JSC::PutByVariant::overlaps):
        * bytecode/RecordedStatuses.cpp:
        (JSC::RecordedStatuses::addPutByStatus):
        (JSC::RecordedStatuses::visitAggregateImpl):
        (JSC::RecordedStatuses::addPutByIdStatus): Deleted.
        * bytecode/RecordedStatuses.h:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::load):
        (JSC::DFG::ByteCodeParser::store):
        (JSC::DFG::ByteCodeParser::emitPutById):
        (JSC::DFG::ByteCodeParser::handlePutById):
        (JSC::DFG::ByteCodeParser::handlePutPrivateNameById):
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::handlePutByVal):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGClobbersExitState.cpp:
        (JSC::DFG::clobbersExitState):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
        (JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGGraph.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::addPutByVal):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasPutByStatus):
        (JSC::DFG::Node::putByStatus):
        (JSC::DFG::Node::hasPutByIdStatus): Deleted.
        (JSC::DFG::Node::putByIdStatus): Deleted.
        * dfg/DFGNodeType.h:
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::callerReturnPC):
        * dfg/DFGObjectAllocationSinkingPhase.cpp:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStoreBarrierInsertionPhase.cpp:
        * dfg/DFGValidate.cpp:
        * dfg/DFGVarargsForwardingPhase.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
        * generator/DSL.rb:
        * jit/ICStats.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
        (JSC::JITPutByValGenerator::JITPutByValGenerator):
        (JSC::JITPutByValGenerator::generateFastPath):
        (JSC::JITPutByValGenerator::finalize):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        (JSC::JIT::chooseArrayMode): Deleted.
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        (JSC::putByVal):
        (JSC::directPutByVal):
        (JSC::putByValOptimize):
        (JSC::directPutByValOptimize):
        (JSC::tryPutByValOptimize): Deleted.
        (JSC::tryDirectPutByValOptimize): Deleted.
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emitGenericContiguousPutByVal): Deleted.
        (JSC::JIT::emitArrayStoragePutByVal): Deleted.
        (JSC::JIT::privateCompilePutByVal): Deleted.
        (JSC::JIT::privateCompilePutByValWithCachedId): Deleted.
        (JSC::JIT::emitIntTypedArrayPutByVal): Deleted.
        (JSC::JIT::emitFloatTypedArrayPutByVal): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emitGenericContiguousPutByVal): Deleted.
        (JSC::JIT::emitArrayStoragePutByVal): Deleted.
        * jit/Repatch.cpp:
        (JSC::appropriateGenericPutByFunction):
        (JSC::appropriateOptimizingPutByFunction):
        (JSC::tryCachePutBy):
        (JSC::repatchPutBy):
        (JSC::tryCacheArrayPutByVal):
        (JSC::repatchArrayPutByVal):
        (JSC::tryCacheInBy):
        (JSC::resetPutBy):
        (JSC::appropriateGenericPutByIdFunction): Deleted.
        (JSC::appropriateOptimizingPutByIdFunction): Deleted.
        (JSC::tryCachePutByID): Deleted.
        (JSC::repatchPutByID): Deleted.
        (JSC::resetPutByID): Deleted.
        * jit/Repatch.h:
        * llint/LowLevelInterpreter.h:

2021-08-25  Yusuke Suzuki  <ysuzuki@apple.com>

        REGRESSION(r281513?): [ JSC Catalina+ Debug ] 16 stress/intl-enumeration.js (JSC Tests) are flaky failing
        https://bugs.webkit.org/show_bug.cgi?id=229526

        Reviewed by Mark Lam.

        Fix debug JSC test failures by using RELEASE_AND_RETURN.

        * runtime/IntlObject.cpp:
        (JSC::availableCalendars):
        (JSC::availableCollations):
        (JSC::availableCurrencies):
        (JSC::availableNumberingSystems):
        (JSC::availableTimeZones):

2021-08-25  Yijia Huang  <yijia_huang@apple.com>

        [ARM64] Fix pre-index address mode
        https://bugs.webkit.org/show_bug.cgi?id=229175

        Reviewed by Saam Barati.

        This patch fixes the canonicalization phase for pre/post-increment address mode
        due to the potential bugs commented on in the previous patch
        https://bugs.webkit.org/show_bug.cgi?id=228538. And this patch removed the 
        temporary fix in https://bugs.webkit.org/show_bug.cgi?id=229211.

        Previously, the pre-index address mode for Load instruction convert the pattern 
        to the canonical form like this:

            address = Add(base, offset)       address = Add(base, offset)
            ...                          -->  newMemory = Load(base, offset)
            ...                               ...
            memory = Load(base, offset)       memory = Identity(newMemory)

        which is wrong. Assume "..." contains a store to a memory location that aliases for address:

            address = Add(base, offset)       address = Add(base, offset)
            ...                          -->  newMemory = Load(base, offset)
            ...                               ...
            Store(value1, address)            Store(value1, address)
            memory = Load(base, offset)       memory = Identity(newMemory)

        The loaded value should always be value1 which is not true after the conversion.
        So, moving the load above the store is semantically incorrect because it's not identical to
        the behavior of the original program. In this case, maybe we should apply alias analysis to
        detect the violations of reference updating.

        To solve this problem, we moves the address value to just before the memory value instead of
        moving memory value upward.

        Convert Pre-Index Load Pattern to the Canonical Form:

            address = Add(base, offset)                    address = Nop
            ...                                            ...
            ...                                            newAddress = Add(base, offset)
            memory = Load(base, offset)            -->     memory = Load(base, offset)
            ...                                            ...
            parent = B3Opcode(address, ...)                parent = B3Opcode(newAddress, ...)

        Convert Pre-Index Store Pattern to the Canonical Form:

            address = Add(base, offset)                    address = Nop
            ...                                            ...
            ...                                            newAddress = Add(base, offset)
            memory = Store(value1, base, offset)   -->     memory = Store(value1, base, offset)
            ...                                            ...
            parent = B3Opcode(address, ...)                parent = B3Opcode(newAddress, ...)

        To move the address value downward, we need to make sure that no use reference of address between
        the address and memory values.

        * b3/B3CanonicalizePrePostIncrements.cpp:
        (JSC::B3::canonicalizePrePostIncrements):
        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):
        * b3/B3ValueKey.h:
        * b3/B3ValueKeyInlines.h:
        (JSC::B3::ValueKey::ValueKey):
        * b3/testb3.h:
        * b3/testb3_3.cpp:
        (testLoadWithStorePreIndex32):
        (testStorePreIndex32):
        (testStorePreIndex64):
        (testStorePostIndex32):
        (testStorePostIndex64):
        (addShrTests):
        * runtime/OptionsList.h:

2021-08-25  Xan Lopez  <xan@igalia.com>

        [JSC] Infinite loop in for...in after r280760
        https://bugs.webkit.org/show_bug.cgi?id=229493

        Reviewed by Yusuke Suzuki.

        A missing instruction in the 32bit branch can potentially cause
        infinite loops when using for-in. No new test, this is already
        covered by (among others) LayoutTests/js/reserved-words.html.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode):

2021-08-25  Keith Miller  <keith_miller@apple.com>

        Add for-in OwnStructureMode optimizations to LLInt
        https://bugs.webkit.org/show_bug.cgi?id=229038

        Reviewed by Saam Barati.

        This patch adds the optimizations we have for OwnStructureMode in
        the Baseline to the LLInt. The patch also adds redundant self move
        (i.e. move a, a) elimination to arm64. Finally, a bunch of the
        property offset functions are now marked constexpr and return
        intptr_t rather than size_t as the values can be negative.

        There's also a minor fix to disable MSVC's signed to unsigned
        cast warning for LLIntOffsetsExtractor as we don't care about
        signedness for extracting constants.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_enumerator_get_by_val):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/arm64.rb:
        * offlineasm/generate_offset_extractor.rb:
        * runtime/Butterfly.h:
        (JSC::Butterfly::indexOfPropertyStorage):
        * runtime/JSObject.h:
        (JSC::offsetInButterfly):
        * runtime/PropertyOffset.h:
        (JSC::checkOffset):
        (JSC::validateOffset):
        (JSC::isValidOffset):
        (JSC::isInlineOffset):
        (JSC::isOutOfLineOffset):
        (JSC::offsetInInlineStorage):
        (JSC::offsetInOutOfLineStorage):
        (JSC::offsetInRespectiveStorage):
        (JSC::numberOfOutOfLineSlotsForMaxOffset):
        (JSC::numberOfSlotsForMaxOffset):
        (JSC::offsetForPropertyNumber):

2021-08-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r281523.
        https://bugs.webkit.org/show_bug.cgi?id=229494

        broke cloop build

        Reverted changeset:

        "Add for-in OwnStructureMode optimizations to LLInt"
        https://bugs.webkit.org/show_bug.cgi?id=229038
        https://commits.webkit.org/r281523

2021-08-24  Mark Lam  <mark.lam@apple.com>

        Refactor ENABLE(JIT_OPERATION_VALIDATION) code to emit no code when disabled.
        https://bugs.webkit.org/show_bug.cgi?id=229482
        rdar://82318317

        Reviewed by Yusuke Suzuki.

        * assembler/JITOperationList.cpp:
        (JSC::addPointers):
        (JSC::JITOperationList::populatePointersInJavaScriptCore):
        (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt):
        (JSC::JITOperationList::populatePointersInEmbedder):
        * assembler/JITOperationList.h:
        (JSC::JITOperationList::map const):
        (JSC::JITOperationList::assertIsJITOperation):
        (JSC::JITOperationList::initialize):
        (JSC::JITOperationList::populatePointersInJavaScriptCore):
        (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt):
        * runtime/JSCPtrTag.h:
        (JSC::tagJSCCodePtrImpl):
        (JSC::untagJSCCodePtrImpl):

2021-08-24  Mark Lam  <mark.lam@apple.com>

        [Re-landing] Add some offlineasm enhancements.
        https://bugs.webkit.org/show_bug.cgi?id=229332
        rdar://82163923

        Reviewed by Keith Miller.

        1. Enhance "include" offlineasm Instruction to always attempt to include an asm
           file from <build-products>/usr/local/include/WebKitAdditions/ first.  If the
           specified file is not available there, then it will attempt to include the file
           from the same directory as the current source file (which in practice, means
           Source/JavaScriptCore/llint/).

        2. Enhance "include" offlineasm Instruction to allow an optional file to be
           included if it exists.  For example, the following offlineasm code:

                include? LowLevelInterpreterAdditions

           ... will attempt to include a file LowLevelInterpreterAdditions.asm.  If the
           file does not exist, this will be a no-op.  Note: the "?" after the "include"
           means the include is optional.

        3. Enhanced "emit" offlineasm Instruction to be able to take more than one operand.

           "emit" used to just copy the string operand that follows into the generated
           LLIntAssembly.h.  Now, "emit" can take multiple comma separated operands, and
           will concatenate all the operands.

           Additionally, "emit" can now take a LocalLabelReference as an operand.  For
           example, this offline asm code:

                   emit "b ", .done
                   ...
                .done:

           ... will generate this inline asm code in LLIntAssembly.h:

                "b " LOCAL_LABEL_STRING(_offlineasm_someLabel_done) "\n"

           This makes it easier to emit branches to local labels.

        4. Also fixed LLInt code alignment for ARM_THUMB2 and ARM64.

           Previously, it was aligned using ".align 4" which means aligned on a 4
           instruction boundary.  Note: the interpretation of .align varies for different
           target CPU architectures.

           Now, we do the alignment using ".balign 4" which means align on a 4 byte
           boundary.  This is the intended alignment because ARM64 instruction size is
           4 bytes, and ARM_THUMB2 instruction size is either 2 bytes or 4 bytes.
           Using .align before was potentially wasting some code space.

        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter.cpp:
        * offlineasm/ast.rb:
        * offlineasm/parser.rb:

2021-08-24  Mark Lam  <mark.lam@apple.com>

        testb3_6 should be using JSSwitchPtrTag instead of JITCompilationPtrTag.
        https://bugs.webkit.org/show_bug.cgi?id=229479
        rdar://82316967

        Reviewed by Yusuke Suzuki.

        This is in testInterpreter() which is emitting code for a jump table.
        JSSwitchPtrTag is the right tag to use here.

        * b3/testb3_6.cpp:
        (testInterpreter):

2021-08-24  Keith Miller  <keith_miller@apple.com>

        Add for-in OwnStructureMode optimizations to LLInt
        https://bugs.webkit.org/show_bug.cgi?id=229038

        Reviewed by Saam Barati.

        This patch adds the optimizations we have for OwnStructureMode in
        the Baseline to the LLInt. The patch also adds redundant self move
        (i.e. move a, a) elimination to arm64. Finally, a bunch of the
        property offset functions are now marked constexpr and return
        intptr_t rather than size_t as the values can be negative.

        There's also a minor fix to disable MSVC's signed to unsigned
        cast warning for LLIntOffsetsExtractor as we don't care about
        signedness for extracting constants.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_enumerator_get_by_val):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/arm64.rb:
        * offlineasm/generate_offset_extractor.rb:
        * runtime/Butterfly.h:
        (JSC::Butterfly::indexOfPropertyStorage):
        * runtime/JSObject.h:
        (JSC::offsetInButterfly):
        * runtime/PropertyOffset.h:
        (JSC::checkOffset):
        (JSC::validateOffset):
        (JSC::isValidOffset):
        (JSC::isInlineOffset):
        (JSC::isOutOfLineOffset):
        (JSC::offsetInInlineStorage):
        (JSC::offsetInOutOfLineStorage):
        (JSC::offsetInRespectiveStorage):
        (JSC::numberOfOutOfLineSlotsForMaxOffset):
        (JSC::numberOfSlotsForMaxOffset):
        (JSC::offsetForPropertyNumber):

2021-08-24  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add Intl Enumeration APIs
        https://bugs.webkit.org/show_bug.cgi?id=214795

        Reviewed by Ross Kirsling.

        This patch implements Intl enumeration API[1] which is in stage-3.
        Supported keys are, "calendar", "collation", "currency", "numberingSystem", "timeZone", and "unit".

        [1]: https://github.com/tc39/proposal-intl-enumeration

        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::localeData):
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
        * runtime/IntlLocale.cpp:
        (JSC::createArrayFromStringVector): Deleted.
        * runtime/IntlNumberFormat.cpp:
        (JSC::sanctionedSimpleUnitIdentifier):
        * runtime/IntlObject.cpp:
        (JSC::IntlObject::finishCreation):
        (JSC::mapICUCalendarKeywordToBCP47):
        (JSC::availableCalendars):
        (JSC::availableCollations):
        (JSC::availableCurrencies):
        (JSC::availableNumberingSystems):
        (JSC::canonicalizeTimeZoneNameFromICUTimeZone):
        (JSC::availableTimeZones):
        (JSC::availableUnits):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::createArrayFromStringVector):
        * runtime/IntlObject.h:
        * runtime/OptionsList.h:

2021-08-24  Keith Miller  <keith_miller@apple.com>

        (r281473) stress/for-in-has-own-property-shouldnt-flush-registers.js failing on Debug
        https://bugs.webkit.org/show_bug.cgi?id=229448

        Reviewed by Mark Lam.

        Add missing exception checks.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):

2021-08-24  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r281321.
        https://bugs.webkit.org/show_bug.cgi?id=229449

        causes crashes on ARM64

        Reverted changeset:

        "Add some offlineasm enhancements."
        https://bugs.webkit.org/show_bug.cgi?id=229332
        https://commits.webkit.org/r281321

2021-08-23  Saam Barati  <sbarati@apple.com>

        Disable peephole optimizations in the byte code generator after rewriting instructions for for-in
        https://bugs.webkit.org/show_bug.cgi?id=229420
        <rdar://82020528>

        Reviewed by Keith Miller.

        The final instruction in a for-in loop might be the get by val that
        we're rewriting because there was an escape. We won't ever actually
        do peephole optimizations on this get_by_val today, but it breaks
        some bookkeeping that the bytecode generator does. This patch makes
        sure the bookkeeping is up to date.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::ForInContext::finalize):

2021-08-23  Saam Barati  <sbarati@apple.com>

        compileEnumeratorHasProperty uses flushRegisters incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=229412
        <rdar://82020767>

        Reviewed by Keith Miller.

        We were calling flushRegisters() inside code that isn't always runs inside the
        EnumeratorInByVal/EnumeratorHasOwnProperty nodes. That is a violation of how
        flushRegisters() must be used, since flushRegisters() updates global register
        allocation state, and therefore must run each time a node is run. To fix, we
        move flushRegisters() before the code starts emitting branches.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):

2021-08-23  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] emitArrayProfilingSiteWithCell should not load indexingType unnecessarily
        https://bugs.webkit.org/show_bug.cgi?id=229396

        Reviewed by Saam Barati.

        emitArrayProfilingSiteWithCell is always loading indexingType after profiling a cell.
        But (possibly) this is old code, and there is no reason to do that. This patch removes it.

        * jit/JIT.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitArrayProfilingSiteWithCell):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_in_by_val):

2021-08-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove already-shipped wasm option flags
        https://bugs.webkit.org/show_bug.cgi?id=229386

        Reviewed by Ross Kirsling.

        This patch removes some wasm option flags which are already shipped.

        * runtime/OptionsList.h:
        * wasm/WasmFormat.h:
        (JSC::Wasm::isValueType):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmParser.h:
        (JSC::Wasm::Parser<SuccessType>::parseBlockSignature):
        * wasm/WasmSectionParser.cpp:
        (JSC::Wasm::SectionParser::parseType):
        (JSC::Wasm::SectionParser::parseElement):
        (JSC::Wasm::SectionParser::parseData):
        (JSC::Wasm::SectionParser::parseDataCount):
        * wasm/js/JSWebAssembly.cpp:
        (JSC::JSWebAssembly::finishCreation):
        * wasm/js/WebAssemblyGlobalConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyTableConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyTablePrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-08-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove already-shipped JS feature flags
        https://bugs.webkit.org/show_bug.cgi?id=229387

        Reviewed by Ross Kirsling.

        These features are already shipped. So removing these runtime flags to clean up source code and
        remove untested path.

        * API/JSObjectRef.cpp:
        (JSObjectMakeError):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        * bytecompiler/NodesCodegen.cpp:
        (JSC::FunctionCallValueNode::emitBytecode):
        * parser/Lexer.cpp:
        (JSC::Lexer<T>::lexWithoutClearingLineTerminator):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseForStatement):
        (JSC::Parser<LexerType>::parseClass):
        (JSC::Parser<LexerType>::parseBinaryExpression):
        (JSC::Parser<LexerType>::parseGetterSetter):
        (JSC::Parser<LexerType>::parsePrimaryExpression):
        (JSC::Parser<LexerType>::parseUnaryExpression):
        * runtime/AggregateErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSGlobalObject.h:
        * runtime/NativeErrorConstructor.cpp:
        (JSC::NativeErrorConstructor<errorType>::constructImpl):
        (JSC::NativeErrorConstructor<errorType>::callImpl):
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:
        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-08-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r280984 and r280996.
        https://bugs.webkit.org/show_bug.cgi?id=229384

        Speedometer2 0.3-0.5% regression

        Reverted changesets:

        "Update ARM64EHash"
        https://bugs.webkit.org/show_bug.cgi?id=228962
        https://commits.webkit.org/r280984

        "Refactor some ARM64EHash code."
        https://bugs.webkit.org/show_bug.cgi?id=229054
        https://commits.webkit.org/r280996

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove Intl runtime feature flags for already shipped ones
        https://bugs.webkit.org/show_bug.cgi?id=229371

        Reviewed by Ross Kirsling.

        Since they are already shipped, we should remove these runtime flags.

        * builtins/DatePrototype.js:
        (globalPrivate.toDateTimeOptionsAnyAll):
        (globalPrivate.toDateTimeOptionsTimeTime):
        * bytecode/BytecodeIntrinsicRegistry.cpp:
        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
        * bytecode/BytecodeIntrinsicRegistry.h:
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::toDateTimeOptionsAnyDate):
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
        (JSC::IntlDateTimeFormat::resolvedOptions const):
        * runtime/IntlDateTimeFormatPrototype.cpp:
        (JSC::IntlDateTimeFormatPrototype::finishCreation):
        * runtime/OptionsList.h:

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Intl.DisplayNames v2
        https://bugs.webkit.org/show_bug.cgi?id=227832

        Reviewed by Ross Kirsling.

        This patch implements Intl.DisplayNames v2[1].
        Newly added names are calendar names and date time field names.
        For the language name, language display option is added.

        [1]: https://github.com/tc39/intl-displaynames-v2

        * runtime/CommonIdentifiers.h:
        * runtime/IntlCache.cpp:
        (JSC::IntlCache::getFieldDisplayName):
        * runtime/IntlCache.h:
        * runtime/IntlDisplayNames.cpp:
        (JSC::IntlDisplayNames::initializeDisplayNames):
        (JSC::IntlDisplayNames::of const):
        (JSC::IntlDisplayNames::resolvedOptions const):
        (JSC::IntlDisplayNames::typeString):
        (JSC::IntlDisplayNames::languageDisplayString):
        * runtime/IntlDisplayNames.h:
        * runtime/IntlObject.cpp:
        (JSC::isUnicodeLocaleIdentifierType):
        (JSC::canonicalizeUnicodeLocaleID):
        (JSC::canonicalizeLocaleList):
        (JSC::defaultLocale):
        (JSC::mapBCP47ToICUCalendarKeyword):
        (JSC::mapICUCollationKeywordToBCP47):
        (JSC::canonicalizeLanguageTag): Deleted.
        * runtime/IntlObject.h:

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Intl Locale Info
        https://bugs.webkit.org/show_bug.cgi?id=227830

        Reviewed by Ross Kirsling.

        This patch implements Intl.Locale's extension (Intl Locale Info proposal)[1], which is already stage 3.
        Intl.Locale#{calendars,collations,hourCycles,numberingSystems,timeZones} can return array of preferred
        configuration for the given locale. And Intl.Locale#textInfo can return text layout direction and Intl.Locale#weekInfo
        can return weekday information (e.g. when weekend starts).

        [1]: https://github.com/tc39/proposal-intl-locale-info

        * runtime/IntlLocale.cpp:
        (JSC::createArrayFromStringVector):
        (JSC::IntlLocale::calendars):
        (JSC::IntlLocale::collations):
        (JSC::IntlLocale::hourCycles):
        (JSC::IntlLocale::numberingSystems):
        (JSC::IntlLocale::timeZones):
        (JSC::IntlLocale::textInfo):
        (JSC::IntlLocale::weekInfo):
        * runtime/IntlLocale.h:
        * runtime/IntlLocalePrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Extend Intl TimeZoneName Option
        https://bugs.webkit.org/show_bug.cgi?id=227831

        Reviewed by Ross Kirsling.

        https://github.com/tc39/proposal-intl-extend-timezonename

        This patch implements Extend Intl TimeZoneName proposal, which adds "shortOffset", "longOffset", "shortGeneric", "longGeneric"
        timeZoneName variants.

        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::setFormatsFromPattern):
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
        (JSC::IntlDateTimeFormat::timeZoneNameString):
        * runtime/IntlDateTimeFormat.h:

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable String,TypedArray#at
        https://bugs.webkit.org/show_bug.cgi?id=229354

        Reviewed by Saam Barati.

        Enable String and TypedArray's `at` method.

        * runtime/OptionsList.h:

2021-08-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Enable Array#findLast method
        https://bugs.webkit.org/show_bug.cgi?id=229355

        Reviewed by Saam Barati.

        This patch enables Array#findLast and Array#findLastIndex methods.

        * runtime/ArrayPrototype.cpp: Order of unscopables is alphabet ordering (https://tc39.es/ecma262/#sec-array.prototype-@@unscopables)
        (JSC::ArrayPrototype::finishCreation):
        * runtime/OptionsList.h:

2021-08-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Simplify moveIntsToDouble
        https://bugs.webkit.org/show_bug.cgi?id=229351

        Reviewed by Saam Barati.

        MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed.
        This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler.
        This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern
        IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR
        to AccessCase. But after this simplification, this is no longer necessary.

        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::moveIntsToDouble):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::moveIntsToDouble):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
        (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
        (JSC::DFG::SpeculativeJIT::compileValueAdd):
        (JSC::DFG::SpeculativeJIT::compileValueSub):
        (JSC::DFG::SpeculativeJIT::compileMathIC):
        (JSC::DFG::SpeculativeJIT::compileValueNegate):
        (JSC::DFG::SpeculativeJIT::compileValueMul):
        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
        (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::unboxDouble):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
        (JSC::AssemblyHelpers::branchIfValue):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
        (JSC::AssemblyHelpers::unboxDouble):
        * jit/JITAddGenerator.cpp:
        (JSC::JITAddGenerator::generateFastPath):
        * jit/JITAddGenerator.h:
        (JSC::JITAddGenerator::JITAddGenerator):
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emitRightShiftFastPath):
        (JSC::JIT::emitMathICFast):
        * jit/JITDivGenerator.cpp:
        (JSC::JITDivGenerator::loadOperand):
        * jit/JITMulGenerator.cpp:
        (JSC::JITMulGenerator::generateInline):
        (JSC::JITMulGenerator::generateFastPath):
        * jit/JITMulGenerator.h:
        (JSC::JITMulGenerator::JITMulGenerator):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitFloatTypedArrayPutByVal):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emitGenericContiguousPutByVal):
        * jit/JITRightShiftGenerator.cpp:
        (JSC::JITRightShiftGenerator::generateFastPath):
        * jit/JITRightShiftGenerator.h:
        (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
        * jit/JITSubGenerator.cpp:
        (JSC::JITSubGenerator::generateInline):
        (JSC::JITSubGenerator::generateFastPath):
        * jit/JITSubGenerator.h:
        (JSC::JITSubGenerator::JITSubGenerator):

2021-08-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove unnecessary moves in Yarr's sub32 / add32 related code
        https://bugs.webkit.org/show_bug.cgi?id=228813

        Reviewed by Mark Lam.

        This patch adds three operand sub32 to X64 masm so that we can use it in all masms.
        We use add32 and sub32 in YarrJIT to remove unnecessary mov instructions in ARM64.

        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::sub32):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::sub32):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::sub32):
        * assembler/testmasm.cpp:
        (JSC::testSub32ArgImm):
        * yarr/YarrJIT.cpp:

2021-08-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove MacroAssemblerX86
        https://bugs.webkit.org/show_bug.cgi?id=229331

        Reviewed by Mark Lam.

        This patch removes MacroAssemblerX86, which allows simplifying some 32bit MacroAssembler code
        in a subsequent patch.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerX86.h: Removed.

2021-08-20  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix DFG compilation of StringCharAt in 32 bits jsc debug build
        https://bugs.webkit.org/show_bug.cgi?id=229293

        Reviewed by Keith Miller.

        In SpeculativeJIT::compileGetByValOnString the format can be either DataFormatJS
        or DataFormatCell so assert either value when compiling it in 32 bits.
        It's the same assert already present in the DFG 64 bits counterpart

        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):

2021-08-20  Mark Lam  <mark.lam@apple.com>

        Add some offlineasm enhancements.
        https://bugs.webkit.org/show_bug.cgi?id=229332
        rdar://82163923

        Reviewed by Keith Miller.

        1. Enhance "include" offlineasm Instruction to always attempt to include an asm
           file from <build-products>/usr/local/include/WebKitAdditions/ first.  If the
           specified file is not available there, then it will attempt to include the file
           from the same directory as the current source file (which in practice, means
           Source/JavaScriptCore/llint/).

        2. Enhance "include" offlineasm Instruction to allow an optional file to be
           included if it exists.  For example, the following offlineasm code:

                include? LowLevelInterpreterAdditions

           ... will attempt to include a file LowLevelInterpreterAdditions.asm.  If the
           file does not exist, this will be a no-op.  Note: the "?" after the "include"
           means the include is optional.

        3. Enhanced "emit" offlineasm Instruction to be able to take more than one operand.

           "emit" used to just copy the string operand that follows into the generated
           LLIntAssembly.h.  Now, "emit" can take multiple comma separated operands, and
           will concatenate all the operands.

           Additionally, "emit" can now take a LocalLabelReference as an operand.  For
           example, this offline asm code:

                   emit "b ", .done
                   ...
                .done:

           ... will generate this inline asm code in LLIntAssembly.h:

                "b " LOCAL_LABEL_STRING(_offlineasm_someLabel_done) "\n"

           This makes it easier to emit branches to local labels.

        4. Also fixed LLInt code alignment for ARM_THUMB2 and ARM64.

           Previously, it was aligned using ".align 4" which means aligned on a 4
           instruction boundary.  Note: the interpretation of .align varies for different
           target CPU architectures.

           Now, we do the alignment using ".balign 4" which means align on a 4 byte
           boundary.  This is the intended alignment because ARM64 instruction size is
           4 bytes, and ARM_THUMB2 instruction size is either 2 bytes or 4 bytes.
           Using .align before was potentially wasting some code space.

        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter.cpp:
        * offlineasm/ast.rb:
        * offlineasm/parser.rb:

2021-08-20  Mark Lam  <mark.lam@apple.com>

        Reduce StructureID entropy bits to 5 to make room for more StructureIDs.
        https://bugs.webkit.org/show_bug.cgi?id=229326
        rdar://60141624

        Reviewed by Yusuke Suzuki.

        * runtime/StructureIDTable.h:

2021-08-19  Tim Nguyen  <ntim@apple.com>

        Implement ::backdrop pseudo element
        https://bugs.webkit.org/show_bug.cgi?id=227801

        Reviewed by Antti Koivisto.

        This adds UA styles, RenderTreeBuilder support and WebInspector support for ::backdrop.
        Some imported blink tests now start passing, some still need proper top layer support.

        * inspector/protocol/CSS.json:

2021-08-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove op_has_indexed_property related code
        https://bugs.webkit.org/show_bug.cgi?id=229271

        Reviewed by Saam Barati.

        After our new for-in protocol, op_has_indexed_property is removed.
        As a result, we can remove many ByValInfo code that is used only
        for op_has_indexed_property.

        * jit/JIT.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitLoadForArrayMode): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty): Deleted.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty): Deleted.
        * jit/JITOperations.cpp:
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitDoubleLoad): Deleted.
        (JSC::JIT::emitContiguousLoad): Deleted.
        (JSC::JIT::emitArrayStorageLoad): Deleted.

2021-08-18  Michael Catanzaro  <mcatanzaro@gnome.org>

        REGRESSION(r280382): [GTK] 2.33.3 does not build with gtk-doc enabled, installs broken pkg-config files
        https://bugs.webkit.org/show_bug.cgi?id=229152

        Reviewed by Philippe Normand.

        * PlatformGTK.cmake:
        * javascriptcoregtk.pc.in:

2021-08-17  Saam Barati  <sbarati@apple.com>

        Add an option for canonicalizePrePostIncrements
        https://bugs.webkit.org/show_bug.cgi?id=229211
        <rdar://problem/82050126>

        Reviewed by Mark Lam.

        The current phase has bugs. Let's disable it for now until the bugs
        are fixed. See discussion about the bugs I spotted in:
        https://bugs.webkit.org/show_bug.cgi?id=228538

        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):
        * b3/testb3_3.cpp:
        (addShrTests):
        * runtime/OptionsList.h:

2021-08-16  Mark Lam  <mark.lam@apple.com>

        Ensure that unused LLInt opcodes are not inadvertently used.
        https://bugs.webkit.org/show_bug.cgi?id=229161

        Reviewed by Robin Morisset.

        The op macro is used for generating LLInt asm code for some entry points to the
        LLInt, where we don't need 16 bits and 32 bit wide versions of the entry point.
        For example, we use it for llint_program_prologue.

        Note that llint_program_prologue is generated using:

            op(llint_program_prologue, macro () ...

        where op is:

            macro op(l, fn)
                commonOp(l, macro () end, macro (size)
                    size(fn, macro() end, macro() end, macro(gen) gen() end)
                    #        ^            ^----- wide32 generator
                    #        `------------------ wide16 generator
                end)
            end

        Note that the generators for the wide16 and wide32 versions of the entry point
        currently emit nothing.  As a result, if we ever have a bug that ends up
        dispatching to llint_program_prologue_wide16 or llint_program_prologue_wide32,
        we'll end up falling thru to llint_module_program_prologue, which just happens
        to be the entry point positioned after those labels.

        This patch adds breakpoints in those 2 unused generators so that we won't
        inadvertently execute code for something else.

        * llint/LowLevelInterpreter.asm:

2021-08-15  Yijia Huang  <yijia_huang@apple.com>

        [ARM64] Add Pre/Post-Indexed Address Mode to Air for ARM64 (Store Instruction)
        https://bugs.webkit.org/show_bug.cgi?id=228538

        Reviewed by Filip Pizlo.

        The previous patch has introduced the pre/post-index address mode for Load instruction,
        which benefits loop program. Here, this patch adds the corresponding mode for Store
        instruction. Store Register (immediate) stores a word or a doubleword from a register
        to memory. The address that is used for the store is calculated from a base register
        and an immediate offset.

        ######################################
        ## Pre-Index Address Mode For Store ##
        ######################################

        STR Wt, [Xn, #imm]!

        In B3 Reduction Strength, since we have this reduction rule:
            Turns this: Store(value, Add(address, offset1), offset = offset2)
            Into this: Store(value, address, offset = offset1 + offset2)

        The equivalent pattern is:
            address = Add(base, offset)
            ...
            memory = Store(value, base, offset)

        Here, we only consider the pattern:
            address = Add(base, offset)
            memory = Store(value, base, offset)

        And, this patch directly treats it as the canonical form. Ideally, we should move 
        memory to just after the address like what we did for PreIndex Load in the previous 
        patch. But, we cannot provide a better way to do that since the value may be 
        used between address and memory. To move value upward, we must move all descendants 
        of the value along with it to prevent B3 IR index violations, which is risky and expensive.

        Next, lower to Air:
            Move %base, %address
            Move %value, (%address, prefix(offset))

        ######################################
        ## Post-Index Address Mode For Load ##
        ######################################

        STR Wt, [Xn], #imm

        Then, the equivalent pattern is:
            memory = Store(value, base, 0)
            ...
            address = Add(base, offset)

        First, we convert it to the canonical form:
            newOffset = Constant
            newAddress = Add(base, offset)
            memory = Store(value, base, 0) // move the offset and address to just before the memory
            ...
            offset = Identity(newOffset)
            address = Identity(newAddress)

        Next, lower to Air:
            Move %base, %newAddress
            Move %value, (%newAddress, postfix(offset))

        ##############################################
        ## Test for Pre/Post-Increment Address Mode ##
        ##############################################

        B3 IR:
        ------------------------------------------------------
        Int64 b@0 = ArgumentReg(%x0)
        Int64 b@1 = ArgumentReg(%x1)
        Int64 b@2 = Const64(8)
        Int64 b@3 = Add(b@0, $8(b@2))
        Void  b@4 = Store(b@1, b@3, ControlDependent|Writes:Top)
        Void  b@5 = Return(b@3, Terminal)
        ------------------------------------------------------

        W/O Pre-Increment Address Mode:
        ------------------------------------------------------
        Move  %x0, %x2,      b@0
        Add64  $8, %x2, %x0, b@3
        Move  %x1, 8(%x2),   b@4
        Ret64 %x0,           b@5
        ------------------------------------------------------

        W/ Pre-Increment Address Mode:
        ------------------------------------------------------
        MoveWithIncrement64 %x1, (%x0,Pre($8)), b@4
        Ret64               %x0,                b@5
        ------------------------------------------------------


        B3 IR:
        ------------------------------------------------------
        Int64 b@0 = ArgumentReg(%x0)
        Int64 b@1 = ArgumentReg(%x1)
        Void  b@2 = Store(b@1, b@0, ControlDependent|Writes:Top)
        Int64 b@3 = Const64(8)
        Int64 b@4 = Add(b@0, $8(b@3))
        Void  b@5 = Return(b@4, Terminal)
        ------------------------------------------------------

        W/O Post-Increment Address Mode:
        ------------------------------------------------------
        Move  %x1, (%x0),      b@2
        Add64  $8,   %x0, %x0, b@4
        Ret64 %x0,             b@5
        ------------------------------------------------------

        W/ Post-Increment Address Mode:
        ------------------------------------------------------
        MoveWithIncrement64 %x1, (%x0,Post($8)), b@2
        Ret64               %x0,                 b@5
        ------------------------------------------------------

        * b3/B3CanonicalizePrePostIncrements.cpp:
        (JSC::B3::canonicalizePrePostIncrements):
        * b3/B3LowerToAir.cpp:
        * b3/testb3.h:
        * b3/testb3_3.cpp:
        (testStorePreIndex32):
        (testStorePreIndex64):
        (testStorePostIndex32):
        (testStorePostIndex64):
        (addShrTests):

2021-08-13  Keith Miller  <keith_miller@apple.com>

        EnumeratorNextUpdatePropertyName always needs to be able to handle IndexedMode
        https://bugs.webkit.org/show_bug.cgi?id=229087

        Reviewed by Filip Pizlo.

        Right now, this operation incorrectly assumes that EnumeratorNextUpdateIndexAndMode will guarantee
        the mode matches the seen mode set. But no speculation is guaranteed and adding such a guarantee
        would require adding checkpoints, which is likely not worth it. Instead, this patch just makes
        sure we always handle the allocation for IndexedMode.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-08-12  Mark Lam  <mark.lam@apple.com>

        Refactor some ARM64EHash code.
        https://bugs.webkit.org/show_bug.cgi?id=229054

        Reviewed by Keith Miller and Robin Morisset.

        This patch only refactors ARM64EHash code by moving some methods into the private
        section, and removing some unneeded static_casts.

        Verified with a diff of `otool -tv` dumps of the built JavaScriptCore binaries,
        that there are no diffs in the generated code from this change.

        * assembler/AssemblerBuffer.h:
        (JSC::ARM64EHash::ARM64EHash):
        (JSC::ARM64EHash::update):
        (JSC::ARM64EHash::makeDiversifier):
        (JSC::ARM64EHash::nextValue):
        (JSC::ARM64EHash::bitsForDiversifier):
        (JSC::ARM64EHash::currentHash):

2021-08-12  Saam Barati  <sbarati@apple.com>

        Update ARM64EHash
        https://bugs.webkit.org/show_bug.cgi?id=228962
        <rdar://79883337>

        Reviewed by Mark Lam.

        * assembler/AssemblerBuffer.h:
        (JSC::ARM64EHash::makeDiversifier):
        (JSC::ARM64EHash::nextValue):
        (JSC::ARM64EHash::bitsForDiversifier):
        (JSC::ARM64EHash::currentHash):
        (JSC::ARM64EHash::setUpdatedHash):
        (JSC::ARM64EHash::ARM64EHash):
        (JSC::ARM64EHash::update):
        (JSC::ARM64EHash::finalize):
        (JSC::AssemblerBuffer::AssemblerBuffer):
        (JSC::AssemblerBuffer::putIntegralUnchecked):
        (JSC::AssemblerBuffer::hash const):
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::copyCompactAndLinkCode):

2021-08-11  Yusuke Suzuki  <ysuzuki@apple.com>

        WTFCrash in JSC::Lexer<char16_t>::append8
        https://bugs.webkit.org/show_bug.cgi?id=228982

        Reviewed by Mark Lam.

        sourceURL / sourceMapURL directive should not assume Latin1 characters.

        * parser/Lexer.cpp:
        (JSC::Lexer<T>::parseCommentDirectiveValue):

2021-08-10  Keith Miller  <keith_miller@apple.com>

        CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr
        https://bugs.webkit.org/show_bug.cgi?id=228931

        Reviewed by Mark Lam.

        Right now current debugging code expects that the JS return PC on
        the stack is already unsigned. This is not true on arm64e.
        This patch now properly unsigns the return PC before passing it to
        the ReturnAddressPC constructor.

        * assembler/MacroAssemblerCodeRef.h:
        (JSC::ReturnAddressPtr::fromTaggedPC):
        * interpreter/AbstractPC.cpp:
        (JSC::AbstractPC::AbstractPC):
        * interpreter/AbstractPC.h:
        (JSC::AbstractPC::AbstractPC):
        (JSC::AbstractPC::jitReturnAddress const):
        * interpreter/CallFrame.h:
        (JSC::CallFrame::returnPC const):

2021-08-10  Kimmo Kinnunen  <kkinnunen@apple.com>

        Scripts/generate-derived-sources.sh: line 19: [: binary operator expected while building Source/WebKit
        https://bugs.webkit.org/show_bug.cgi?id=228908

        Reviewed by Per Arne Vollan.

        * Scripts/generate-derived-sources.sh:
        Quote the use of CC so that future copy-paste does not make the same mistake
        as this bug.

2021-08-09  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] super-Latin1 white space and line terminator after regular expression literal misinterpreted as flags
        https://bugs.webkit.org/show_bug.cgi?id=227944

        Reviewed by Alexey Shvayka.

        There are non-Latin1 white-spaces and line-terminators, but Lexer::scanRegExp's code did not assume that.
        As a result, if there is a non-Latin1 white-spaces or line-terminators after RegExp, we raise SyntaxError
        while this is valid. This patch fixes that.

        * parser/Lexer.cpp:
        (JSC::Lexer<T>::scanRegExp):

2021-08-09  Michael Catanzaro  <mcatanzaro@gnome.org>

        Fix yet another -Wreturn-type warning
        https://bugs.webkit.org/show_bug.cgi?id=228928

        Unreviewed.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):

2021-08-09  Yijia Huang  <yijia_huang@apple.com>

        [ARM64] Clean up and fix Pre/Post-Indexed Address Mode to Air for ARM64 (Load Instruction)
        https://bugs.webkit.org/show_bug.cgi?id=228890

        Reviewed by Keith Miller.

        This patch cleans up and does minor fix to the previous patch (https://bugs.webkit.org/show_bug.cgi?id=228047).

        For the modifications in b3/B3Generate.cpp and b3/B3CanonicalizePrePostIncrements.cpp, we
        need to convert post-index candidates to the canonical form. So, the address value needs to
        be moved immediately before the load. This is subject to the dominance constraints that add
        must be controlled equivalent to the load. So, similarly, if we need to move the offset to
        just before the load, the dominance constraints must be satisfied. Since it is a constant
        value, a better approach is to add a new constant value before the memory value. Then,
        eliminate the dead code.

        There is a bug in b3/B3CanonicalizePrePostIncrements.cpp. The insertionSet.execute(BasicBlock)
        will reorder value indexes in the basic block. So, we should re-search for the value index in
        the block every time after the execution.

        In b3/B3LowerToAir.cpp, we need m_locked checks on address and base values. If they are already
        locked, there is no need to convert the Load instruction to the pre/post-increment form.

        * b3/B3CanonicalizePrePostIncrements.cpp:
        (JSC::B3::canonicalizePrePostIncrements):
        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirArg.h:
        (JSC::B3::Air::Arg::isValidIncrementIndexForm):
        (JSC::B3::Air::Arg::isValidForm const):
        (JSC::B3::Air::Arg::isValidPreIndexForm): Deleted.
        (JSC::B3::Air::Arg::isValidPostIndexForm): Deleted.
        * b3/air/opcode_generator.rb:

2021-08-09  Keith Miller  <keith_miller@apple.com>

        Revert bad assert about the number of upsilons going into a phi
        https://bugs.webkit.org/show_bug.cgi?id=228922

        Reviewed by Yusuke Suzuki.

        This assert was invalid because we sometimes emit unreachable phis
        that don't have any incoming upsilons. Specifically for MultiGetByOffset.

        * ftl/FTLOutput.h:
        (JSC::FTL::Output::phi):

2021-08-09  Michael Catanzaro  <mcatanzaro@gnome.org>

        Adding missing REFERENCED_FROM_ASM annotations to facilitate LTO
        https://bugs.webkit.org/show_bug.cgi?id=228865

        Reviewed by Yusuke Suzuki.

        When investigating why WebKitGTK fails to build with LTO (link-time optimization) enabled,
        one of the GCC developers noticed that we are missing __attribute__ (("used")) on several
        C++ functions declared in LLIntSlowPaths.h and WasmSlowPaths.h that are called only from
        asm. Without this attribute, GCC assumes the functions are unused and drops them, then
        linking fails because they really are used.

        * llint/LLIntSlowPaths.h:
        * wasm/WasmSlowPaths.h:

2021-08-07  Michael Catanzaro  <mcatanzaro@gnome.org>

        Fix ODR violations in JSC
        https://bugs.webkit.org/show_bug.cgi?id=228876

        Reviewed by Yusuke Suzuki.

        When built with LTO enabled, GCC will warn about violations of C++'s one-definition rule.
        JSC currently has two violations. The first is JSC::SpeciesConstructResult, which has two
        different declarations, one in ArrayPrototype.cpp and the other in
        JSArrayBufferPrototype.cpp. I decided to change the version in ArrayPrototype.cpp to make
        the declarations match.

        The next problem is JSC::SignalContext. We have two different versions of this struct, one
        in VMTraps.cpp and the other in SigillCrashAnalyzer.cpp. In this case, I decided to change
        the one in VMTraps.cpp from JSC::SignalContext to JSC::VMTraps::SignalContext.

        * runtime/ArrayPrototype.cpp:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::tryInstallTrapBreakpoints):
        * runtime/VMTraps.h:

2021-08-07  Keith Miller  <keith_miller@apple.com>

        for-in should only emit one loop in bytecode
        https://bugs.webkit.org/show_bug.cgi?id=227989

        Reviewed by Yusuke Suzuki.

        This patch redesigns how we implement for-in loops. Before this patch we would emit three copies of the for-in loop body. One for the indexed properties, one for the named-own properties, and one for generic properties (anything else). This had a couple of problems. Firstly, it meant bytecode size grew exponentially to number of nested for-in loops. This in turn meant DFG/FTL compilation took much longer.

        Going off our experience with fast for-of, this patch turns for-in loops specializations into
        a "fused" opcode that internally switches on the enumeration mode it currently sees. For example, if we are enumerating an own-named property, the new enumerator_get_by_val bytecode will check the enumerator cell's cached structure matches the base's then load the property offset directly.

        There are four new opcodes this patch adds, which replace the various operations we had for the specialized loops previously. The new opcodes are EnumeratorGetByVal, EnumeratorInByVal, EnumeratorHasOwnProperty, and EnumeratorNext. The first three correspond to GetByVal, InByVal, and HasOwnProperty respectively. The EnumeratorNext opcode has three results in bytecode, the next enumeration value's mode, the index of the property name, and the property name string itself. When enumeration is done EnumeratorNext returns JS null as the property name string. Since the DFG doesn't support tuples yet this opcode is spilt into four new nodes. The first computes the updated index and mode for the next enumeration key, which is encoded into a single JS number. Then there are two nodes that extract the mode and index. Finally, the last new node produces the property name string or null based on the extracted mode and index.

        Since, in most benchmarks, any given enumeration opcode tends to profile exactly one enumeration mode. This patch focuses primarily on reimplementing all the optimizations we have for any one specific mode. This means there are still potential optimizations for the multi-mode flavors of each new opcode.

        The main optimizations implemented for each new opcode are:

        EnumeratorNext:
        1) IndexedMode loops are loaded and checked for presence inline (DFG/FTL).
        2) NamedMode is computed inline as long as the cached structure on the enumerator cell matches the base (Baseline+). This can only differ if there's a transition.
        3) property names are extracted from the cached buffer inline (Baseline+).

        EnumeratorGetByVal:
        EnumeratorInByVal:
        EnumeratorHasOwnProperty:
        1) IndexedMode has all the optimizations of a normal XByVal on indexed properties (DFG/FTL).
        2) NamedMode will extract the value directly from the inline/out-of-line offset if the structure matches the enumerator's (Baseline+).

        There are also a few interesting changes worth mentioning here:
        1) If a for-in loop would produce an empty enumerator we now always
        return the VMs empty enumerator. This has two benefits, most importantly, it distingishes between an unprofiled for-in loop and empty enumeration, which prevents OSR exit loops. Also, it means that the various Enumerator opcodes no longer need to handle undefined/null when `toObject`ing the base value.

        2) The enumerator now contains a bit set of all the modes it will produce. This removes a few extra branches when speculating on the modes we will see in EnumeratorNext.

        3) In the DFG, enumerator GetByVal relies on compileGetByVal to set the result it also passes a prefix callback which emits code after the various cases set up their operands but before code is emitting to help satisfy the branch over register allocation validation. Also, the array mode branch in compileGetByVal passes the data format that it would prefer, which for normal GetByVal is returned. For EnumeratorGetByVal, that preference is completely ignored and it always returns DataFormatJS.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::or8):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::or8):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::rshift64):
        (JSC::MacroAssemblerX86_64::or8): Deleted.
        * builtins/BuiltinNames.h:
        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeUseDef.cpp:
        (JSC::computeUsesForBytecodeIndexImpl):
        (JSC::computeDefsForBytecodeIndexImpl):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        * bytecode/LinkTimeConstant.h:
        * bytecode/Opcode.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::recordHasOwnPropertyInForInLoop):
        (JSC::BytecodeGenerator::emitInByVal):
        (JSC::BytecodeGenerator::emitGetByVal):
        (JSC::BytecodeGenerator::emitEnumeratorNext):
        (JSC::BytecodeGenerator::emitEnumeratorHasOwnProperty):
        (JSC::BytecodeGenerator::pushForInScope):
        (JSC::BytecodeGenerator::popForInScope):
        (JSC::rewriteOp):
        (JSC::ForInContext::finalize):
        (JSC::BytecodeGenerator::findForInContext):
        (JSC::BytecodeGenerator::recordHasOwnStructurePropertyInForInLoop): Deleted.
        (JSC::BytecodeGenerator::emitGetEnumerableLength): Deleted.
        (JSC::BytecodeGenerator::emitHasEnumerableIndexedProperty): Deleted.
        (JSC::BytecodeGenerator::emitHasEnumerableStructureProperty): Deleted.
        (JSC::BytecodeGenerator::emitHasEnumerableProperty): Deleted.
        (JSC::BytecodeGenerator::emitHasOwnStructureProperty): Deleted.
        (JSC::BytecodeGenerator::emitEnumeratorStructurePropertyName): Deleted.
        (JSC::BytecodeGenerator::emitEnumeratorGenericPropertyName): Deleted.
        (JSC::BytecodeGenerator::emitToIndexString): Deleted.
        (JSC::BytecodeGenerator::pushIndexedForInScope): Deleted.
        (JSC::BytecodeGenerator::popIndexedForInScope): Deleted.
        (JSC::BytecodeGenerator::pushStructureForInScope): Deleted.
        (JSC::BytecodeGenerator::popStructureForInScope): Deleted.
        (JSC::StructureForInContext::finalize): Deleted.
        (JSC::IndexedForInContext::finalize): Deleted.
        (JSC::BytecodeGenerator::findStructureForInContext): Deleted.
        * bytecompiler/BytecodeGenerator.h:
        (JSC::ForInContext::isValid const):
        (JSC::ForInContext::invalidate):
        (JSC::ForInContext::local const):
        (JSC::ForInContext::propertyName const):
        (JSC::ForInContext::propertyOffset const):
        (JSC::ForInContext::enumerator const):
        (JSC::ForInContext::mode const):
        (JSC::ForInContext::ForInContext):
        (JSC::ForInContext::bodyBytecodeStartOffset const):
        (JSC::ForInContext::type const): Deleted.
        (JSC::ForInContext::isIndexedForInContext const): Deleted.
        (JSC::ForInContext::isStructureForInContext const): Deleted.
        (JSC::ForInContext::asIndexedForInContext): Deleted.
        (JSC::ForInContext::asStructureForInContext): Deleted.
        (JSC::StructureForInContext::StructureForInContext): Deleted.
        (JSC::StructureForInContext::index const): Deleted.
        (JSC::StructureForInContext::property const): Deleted.
        (JSC::StructureForInContext::enumerator const): Deleted.
        (JSC::StructureForInContext::baseVariable const): Deleted.
        (JSC::StructureForInContext::addGetInst): Deleted.
        (JSC::StructureForInContext::addInInst): Deleted.
        (JSC::StructureForInContext::addHasOwnPropertyJump): Deleted.
        (JSC::IndexedForInContext::IndexedForInContext): Deleted.
        (JSC::IndexedForInContext::index const): Deleted.
        (JSC::IndexedForInContext::addGetInst): Deleted.
        * bytecompiler/NodesCodegen.cpp:
        (JSC::HasOwnPropertyFunctionCallDotNode::emitBytecode):
        (JSC::ForInNode::emitBytecode):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArrayMode.h:
        (JSC::DFG::ArrayMode::isSaneChain const):
        * dfg/DFGBackwardsPropagationPhase.cpp:
        (JSC::DFG::BackwardsPropagationPhase::propagate):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCFAPhase.cpp:
        (JSC::DFG::CFAPhase::injectOSR):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::setJSArraySaneChainIfPossible):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasHeapPrediction):
        (JSC::DFG::Node::hasStorageChild const):
        (JSC::DFG::Node::storageChildIndex):
        (JSC::DFG::Node::hasArrayMode):
        (JSC::DFG::Node::hasEnumeratorMetadata const):
        (JSC::DFG::Node::enumeratorMetadata):
        * dfg/DFGNodeType.h:
        * dfg/DFGOpInfo.h:
        (JSC::DFG::OpInfo::OpInfo):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        (JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractIndex):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractMode):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorInByVal):
        (JSC::DFG::SpeculativeJIT::compileEnumeratorHasOwnProperty):
        (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
        (JSC::DFG::SpeculativeJIT::compileGetEnumerableLength): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHasEnumerableProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileToIndexString): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHasEnumerableStructureProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHasOwnStructurePropertyImpl): Deleted.
        (JSC::DFG::SpeculativeJIT::compileHasOwnStructureProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileInStructureProperty): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetEnumeratorPname): Deleted.
        (JSC::DFG::SpeculativeJIT::compileGetDirectPname): Deleted.
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::allocate):
        (JSC::DFG::JSValueOperand::regs):
        (JSC::DFG::JSValueOperand::gpr):
        (JSC::DFG::StorageOperand::StorageOperand):
        (JSC::DFG::StorageOperand::~StorageOperand):
        (JSC::DFG::StorageOperand::emplace):
        (JSC::DFG::JSValueRegsTemporary::operator bool):
        (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGTypeCheckHoistingPhase.cpp:
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAtImpl):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::phi):
        * generator/DSL.rb:
        * interpreter/Register.h:
        * interpreter/RegisterInlines.h:
        (JSC::Register::operator=):
        * jit/AssemblyHelpers.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emit_op_has_structure_propertyImpl): Deleted.
        (JSC::JIT::emit_op_has_enumerable_structure_property): Deleted.
        (JSC::JIT::emit_op_has_own_structure_property): Deleted.
        (JSC::JIT::emit_op_in_structure_property): Deleted.
        (JSC::JIT::emit_op_has_enumerable_indexed_property): Deleted.
        (JSC::JIT::emitSlow_op_has_enumerable_indexed_property): Deleted.
        (JSC::JIT::emit_op_get_direct_pname): Deleted.
        (JSC::JIT::emit_op_enumerator_structure_pname): Deleted.
        (JSC::JIT::emit_op_enumerator_generic_pname): Deleted.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emit_op_has_structure_propertyImpl): Deleted.
        (JSC::JIT::emit_op_has_enumerable_structure_property): Deleted.
        (JSC::JIT::emit_op_has_own_structure_property): Deleted.
        (JSC::JIT::emit_op_in_structure_property): Deleted.
        (JSC::JIT::emit_op_has_enumerable_indexed_property): Deleted.
        (JSC::JIT::emitSlow_op_has_enumerable_indexed_property): Deleted.
        (JSC::JIT::emit_op_get_direct_pname): Deleted.
        (JSC::JIT::emit_op_enumerator_structure_pname): Deleted.
        (JSC::JIT::emit_op_enumerator_generic_pname): Deleted.
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::generateGetByValSlowCase):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emitSlow_op_enumerator_get_by_val):
        (JSC::JIT::emit_enumerator_has_propertyImpl):
        (JSC::JIT::emit_op_enumerator_in_by_val):
        (JSC::JIT::emit_op_enumerator_has_own_property):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_enumerator_next):
        (JSC::JIT::emit_op_enumerator_get_by_val):
        (JSC::JIT::emitSlow_op_enumerator_get_by_val):
        (JSC::JIT::emit_op_enumerator_in_by_val):
        (JSC::JIT::emit_op_enumerator_has_own_property):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/CommonSlowPaths.h:
        * runtime/FileBasedFuzzerAgent.cpp:
        (JSC::FileBasedFuzzerAgent::getPredictionInternal):
        * runtime/FileBasedFuzzerAgentBase.cpp:
        (JSC::FileBasedFuzzerAgentBase::opcodeAliasForLookupKey):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
        (JSC::JSPropertyNameEnumerator::computeNext):
        * runtime/JSPropertyNameEnumerator.h:
        (JSC::propertyNameEnumerator):
        * runtime/PredictionFileCreatingFuzzerAgent.cpp:
        (JSC::PredictionFileCreatingFuzzerAgent::getPredictionInternal):

2021-08-06  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, build fix on Debug build
        https://bugs.webkit.org/show_bug.cgi?id=228810

        * yarr/YarrJIT.h:
        (JSC::Yarr::BoyerMooreBitmap::addCharacters):
        (JSC::Yarr::BoyerMooreBitmap::addRanges):

2021-08-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Yarr's character tracking for BoyerMoore search should be more precise
        https://bugs.webkit.org/show_bug.cgi?id=228810

        Reviewed by Saam Barati.

        We should track up to 2 candidate characters without masking, so
        that we can search a character without masking. To track candidates,
        we introduce BoyerMooreCharacterCandidates.

        We also add support for m_table because m_table can be used
        for important CharacterClass like `\s`, and still that does not have
        many character candidates if the mode is Char8.

        To make `\s` work on Char8 case, we use Char8 / Char16 information
        to filter characters that never appears in BoyreMoore search bitmap
        construction.

        * yarr/YarrJIT.cpp:
        (JSC::Yarr::BoyerMooreInfo::BoyerMooreInfo):
        (JSC::Yarr::BoyerMooreInfo::set):
        (JSC::Yarr::BoyerMooreInfo::addCharacters):
        (JSC::Yarr::BoyerMooreInfo::addRanges):
        (JSC::Yarr::BoyerMooreInfo::create):
        (JSC::Yarr::BoyerMooreInfo::createCandidateBitmap const):
        * yarr/YarrJIT.h:
        (JSC::Yarr::BoyerMooreCharacterCandidates::isValid const):
        (JSC::Yarr::BoyerMooreCharacterCandidates::invalidate):
        (JSC::Yarr::BoyerMooreCharacterCandidates::isEmpty const):
        (JSC::Yarr::BoyerMooreCharacterCandidates::size const):
        (JSC::Yarr::BoyerMooreCharacterCandidates::at const):
        (JSC::Yarr::BoyerMooreCharacterCandidates::add):
        (JSC::Yarr::BoyerMooreCharacterCandidates::merge):
        (JSC::Yarr::BoyerMooreBitmap::characterCandidates const):
        (JSC::Yarr::BoyerMooreBitmap::add):
        (JSC::Yarr::BoyerMooreBitmap::addCharacters):
        (JSC::Yarr::BoyerMooreBitmap::addRanges):
        (JSC::Yarr::BoyerMooreBitmap::isMaskEffective const): Deleted.

2021-08-05  Mikhail R. Gadelha  <mikhail@igalia.com>

        Assertion failure when checking array in DFG (32 bits)
        https://bugs.webkit.org/show_bug.cgi?id=228839

        Reviewed by Yusuke Suzuki.

        Since empty values don't pass the cell check in 32 bits, we need to
        guard the SpecEmpty check to only happen in 64 bits archs

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::checkArray):

2021-08-05  Robin Morisset  <rmorisset@apple.com>

        REGRESSION (r280507): ASSERTION FAILED: !undominatedPhis.contains(value) in JSC::B3::(anonymous namespace)::Validater::validatePhisAreDominatedByUpsilons()
        https://bugs.webkit.org/show_bug.cgi?id=228838
        <rdar://problem/81579314>

        Reviewed by Geoffrey Garen.

        When I added validation of the dominance of Phis by their Upsilons, I checked two things:
        - There is no path from the entry point to a Phi without going through a corresponding Upsilon (the actual dominance check)
        - There is no way to execute a Phi twice without going through a corresponding Upsilon in between
        The second property is not actually true in B3 IR, I had misunderstood that part of the meaning of Phis/Upsilons.
        So this patch just removes this second check.

        It has no security/stability/performance implication: this is validation code, which runs automatically in debug mode, but should not run at all on customer machines.

        * b3/B3Validate.cpp:

2021-08-05  Michael Catanzaro  <mcatanzaro@gnome.org>

        GCC 11 builds should use -Wno-array-bounds, -Wno-nonnull
        https://bugs.webkit.org/show_bug.cgi?id=228601

        Reviewed by Carlos Garcia Campos.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):

2021-08-05  Zan Dobersek  <zdobersek@igalia.com>

        Use reinterpret_cast_ptr in KeywordLookupGenerator, PropertyMapHashTable
        https://bugs.webkit.org/show_bug.cgi?id=228819

        Reviewed by Adrian Perez de Castro.

        Switch to using reinterpret_cast_ptr in KeywordLookupGenerator (which
        generates the KeywordLookup.h header) and PropertyMapHashTable, reducing
        a bit the GCC warning spewage when compiling for targets benefitting
        from the reinterpret_cast_ptr workaround.

        * KeywordLookupGenerator.py:
        * runtime/PropertyMapHashTable.h:
        (JSC::PropertyTable::table):
        (JSC::PropertyTable::table const):

2021-08-04  Yijia Huang  <yijia_huang@apple.com>

        [ARM64] Fix Zoom black screen during video meeting on Safari
        https://bugs.webkit.org/show_bug.cgi?id=228776

        Reviewed by Saam Barati.

        The problem (rdar://81434487) reports that Zoom turns to a black screen during the video 
        meeting on Safari. The reproduction of this problem is verified and bisected to the previous patch
        (https://bugs.webkit.org/show_bug.cgi?id=228057). Previously, we introduce a pattern 
        matching for instruction EON-with-shift on ARM64, where the pattern is d = n ^ ((m ShiftType amount) ^ -1).

            x = m ShiftType amount
            y = x ^ -1
            z = n ^ y

        We check canBeInternal() on x but not on y based on the computing cost analysis in that patch, 
        which is totally wrong. If the pattern matching is triggered, then the compiler would not emit 
        the corresponding Air of x after lowering, leading to data corruption or system crash since y 
        depends on x.

        In the real world example (Zoom video meeting), we find the B3 IR:

            ...
            Int32 b@528 = SShr(b@526, $31(b@527), Wasm: {opcode: I32ShrS, location: 0x26b})
            Int32 b@529 = BitXor(b@528, $-1(b@144), Wasm: {opcode: I32Xor, location: 0x26e})
            ...
            Int32 b@551 = BitXor(b@446, b@529, Wasm: {opcode: I32Xor, location: 0x28e})
            ...


        After Lowering to Air:

            ...
            Not32 %fp, %x2, b@529
            ...
            XorNotRightShift32 %tmp199, %tmp211, $31, %tmp209, b@551
            ...

        Since the implementation of the previous patch does commitInternal() on b@528, the operand of 
        b@529 turns to a frame pointer. To resolve this problem, we should either check canBeInternal() 
        on both b@528 and b@529 or not at all.

        * b3/B3LowerToAir.cpp:

2021-08-04  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r280609.
        https://bugs.webkit.org/show_bug.cgi?id=228791

        Broke JSC tests on iOS.

        Reverted changeset:

        "[ARM64] Use link register instead of pinning a register for
        materializing big load constants"
        https://bugs.webkit.org/show_bug.cgi?id=228710
        https://commits.webkit.org/r280609

2021-08-03  Yijia Huang  <yijia_huang@apple.com>

        [ARM64] Use link register instead of pinning a register for materializing big load constants
        https://bugs.webkit.org/show_bug.cgi?id=228710

        Reviewed by Mark Lam.

        Previously, we pin a register as a temp for materializing a large constant that cannot fit in
        Load/Store imm form. This is not efficient since the register allocator has one less register
        to allocate from. To solve this problem, we should switch to using the link register as the temp
        on ARM64.

        * b3/B3Common.cpp:
        (JSC::B3::linkRegister):
        (JSC::B3::pinnedExtendedOffsetAddrRegister): Deleted.
        * b3/B3Common.h:
        * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp:
        (JSC::B3::Air::callFrameAddr):
        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::Code):
        * b3/air/AirLowerStackArgs.cpp:
        (JSC::B3::Air::lowerStackArgs):

2021-08-02  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize UMULL supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=228721

        Reviewed by Saam Barati.

        Unsigned Multiply Long (UMULL) multiplies two 32-bit register values, and writes the 
        result to the destination register. This instruction is an alias of the UMADDL instruction.

            umull xd wn wm

        The equivalent pattern is: d = ZExt32(n) * ZExt32(m)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = Trunc(@0)
        Int @2 = ArgumentReg(%x1)
        Int @3 = Trunc(@2)
        Int @4 = ZExt32(@1)
        Int @5 = ZExt32(@3)
        Int @6 = Mul(@4, @5)
        Void@7 = Return(@6, Terminal)

        // Old optimized AIR
        Move   %x0, %x0,      @4
        Move   %x1, %x1,      @5
        Mul    %x0, %x1, %x0, @6
        Ret    %x0,           @7

        // New optimized AIR
        MultiplyZeroExtend %x0, %x1, %x0, @6
        Ret                %x0,           @7

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::multiplyZeroExtend32):
        * assembler/testmasm.cpp:
        (JSC::testMultiplyZeroExtend32):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testMulArgs32SignExtend):
        (testMulArgs32ZeroExtend):
        * b3/testb3_3.cpp:
        (addArgTests):

2021-08-02  Yijia Huang  <yijia_huang@apple.com>

        Add new patterns to instruction selector to utilize AND/EOR/ORR-with-shift supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=228675

        Reviewed by Saam Barati.

        Bitwise AND (shifted register) performs a bitwise AND of a register value and an optionally-shifted 
        register value, and writes the result to the destination register.

            and wd wn wm ShiftType #amount

        The equivalent pattern is: n & (m ShiftType amount)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = Const32(63)
        Int @3 = Shl(@1, $63(@2))
        Int @4 = BitAnd(@0, @3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Lshift %x1, $63, %x1, @3
        And    %x0, %x1, %x0, @4
        Ret    %x0,           @5

        // New optimized AIR
        AndLeftShift %x0, %x1, $63, %x0, @4
        Ret          %x0,                @5

        Bitwise Exclusive OR (shifted register) performs a bitwise Exclusive OR of a register value and an 
        optionally-shifted register value, and writes the result to the destination register.

            eor wd wn wm ShiftType #amount

        The equivalent pattern is: n ^ (m ShiftType amount)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = Const32(63)
        Int @3 = Shl(@1, $63(@2))
        Int @4 = BitXor(@0, @3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Lshift %x1, $63, %x1, @3
        Xor    %x0, %x1, %x0, @4
        Ret    %x0,           @5

        // New optimized AIR
        XorLeftShift %x0, %x1, $63, %x0, @4
        Ret          %x0,                @5

        Bitwise OR (shifted register) performs a bitwise (inclusive) OR of a register value and an 
        optionally-shifted register value, and writes the result to the destination register.

            orr wd wn wm ShiftType #amount

        The equivalent pattern is: n | (m ShiftType amount)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = Const32(63)
        Int @3 = Shl(@1, $63(@2))
        Int @4 = BitOr(@0, @3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Lshift %x1, $63, %x1, @3
        Or     %x0, %x1, %x0, @4
        Ret    %x0,           @5

        // New optimized AIR
        OrLeftShift %x0, %x1, $63, %x0, @4
        Ret         %x0,                @5

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::andLeftShift32):
        (JSC::MacroAssemblerARM64::andRightShift32):
        (JSC::MacroAssemblerARM64::andUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::andLeftShift64):
        (JSC::MacroAssemblerARM64::andRightShift64):
        (JSC::MacroAssemblerARM64::andUnsignedRightShift64):
        (JSC::MacroAssemblerARM64::xorLeftShift32):
        (JSC::MacroAssemblerARM64::xorRightShift32):
        (JSC::MacroAssemblerARM64::xorUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::xorLeftShift64):
        (JSC::MacroAssemblerARM64::xorRightShift64):
        (JSC::MacroAssemblerARM64::xorUnsignedRightShift64):
        (JSC::MacroAssemblerARM64::orLeftShift32):
        (JSC::MacroAssemblerARM64::orRightShift32):
        (JSC::MacroAssemblerARM64::orUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::orLeftShift64):
        (JSC::MacroAssemblerARM64::orRightShift64):
        (JSC::MacroAssemblerARM64::orUnsignedRightShift64):
        * assembler/testmasm.cpp:
        (JSC::testAndLeftShift32):
        (JSC::testAndRightShift32):
        (JSC::testAndUnsignedRightShift32):
        (JSC::testAndLeftShift64):
        (JSC::testAndRightShift64):
        (JSC::testAndUnsignedRightShift64):
        (JSC::testXorLeftShift32):
        (JSC::testXorRightShift32):
        (JSC::testXorUnsignedRightShift32):
        (JSC::testXorLeftShift64):
        (JSC::testXorRightShift64):
        (JSC::testXorUnsignedRightShift64):
        (JSC::testOrLeftShift32):
        (JSC::testOrRightShift32):
        (JSC::testOrUnsignedRightShift32):
        (JSC::testOrLeftShift64):
        (JSC::testOrRightShift64):
        (JSC::testOrUnsignedRightShift64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testAndLeftShift32):
        (testAndRightShift32):
        (testAndUnsignedRightShift32):
        (testAndLeftShift64):
        (testAndRightShift64):
        (testAndUnsignedRightShift64):
        (testXorLeftShift32):
        (testXorRightShift32):
        (testXorUnsignedRightShift32):
        (testXorLeftShift64):
        (testXorRightShift64):
        (testXorUnsignedRightShift64):
        (testOrLeftShift32):
        (testOrRightShift32):
        (testOrUnsignedRightShift32):
        (testOrLeftShift64):
        (testOrRightShift64):
        (testOrUnsignedRightShift64):
        (addBitTests):

2021-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use loadPair / storePair in YarrJIT
        https://bugs.webkit.org/show_bug.cgi?id=228687

        Reviewed by Mark Lam.

        Use loadPair / storePair if possible in YarrJIT. Currently, we are not
        deploying Spooler in YarrJIT, but we should do that in the future too.

        In this patch, we also add appropriate fallback code in loadPair / storePair:
        the offset of these functions are small enough so that we should consider
        overflowing case. If it overflows, we use two loads or stores.

        This patch also adds loadPair32 and storePair32 to all macro assembler so that
        we can call it without CPU(ARM64). Internally, two loads or stores are combined.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::loadPair32):
        (JSC::MacroAssemblerARM64::loadPair64):
        (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess):
        (JSC::MacroAssemblerARM64::storePair32):
        (JSC::MacroAssemblerARM64::storePair64):
        (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::loadPair32):
        (JSC::MacroAssemblerARMv7::storePair32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::loadPair32):
        (JSC::MacroAssemblerMIPS::storePair32):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::loadPair32):
        (JSC::MacroAssemblerX86Common::storePair32):
        * assembler/testmasm.cpp:
        (JSC::testLoadStorePair32):
        (JSC::testLoadStorePair64Int64):
        * yarr/YarrJIT.cpp:

2021-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix accidental narrowing
        https://bugs.webkit.org/show_bug.cgi?id=228613

        Note that this narrowing does not matter semantically since we mask this value with 0x7f.

        * yarr/YarrJIT.h:
        (JSC::Yarr::BoyerMooreBitmap::addCharacters):

2021-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Yarr BoyerMoore search should support character-class
        https://bugs.webkit.org/show_bug.cgi?id=228613

        Reviewed by Saam Barati.

        This patch adds character-class support for BoyerMoore lookahead search in Yarr.
        Currently, we only support fixed-sized character-class. We can extend it for repeat cases in the future.

        To apply this character-class thing to jQuery's RegExp, we also allow non-fixed-sized disjunction.
        For example, /aaaa.*|bbbb/'s disjunction is not fixed-sized. But still we can use (aaaa|bbbb) prefix since
        this part is fixed-sized and we know minimum-size of this disjunction is 4.

        Plus, instead of giving up BoyerMoore search when we found non-supported terms, we shorten BoyerMoore search
        length not to include this term so that we can still have a chance to leverage BoyerMoore search. In the case
        of /aaaa|bbbb|ccc(d|e|f)/, we previously gave up since it finds `(d|e|f)`. But now, instead we shorten the length
        from 4 to 3, and construct search pattern with `aaa|bbb|ccc`.

        This patch improves jquery-todomvc-regexp by 20%.

                                              ToT                     Patched

            jquery-todomvc-regexp      545.3561+-0.6968     ^    451.6117+-0.4613        ^ definitely 1.2076x faster

        This improves Speedometer2/jQuery-TodoMVC by 2%.

            ----------------------------------------------------------------------------------------------------------------------------------
            |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
            ----------------------------------------------------------------------------------------------------------------------------------
            | Elm-TodoMVC                          |123.470833   |123.550000   |1.000641  | 0.841600                                         |
            | VueJS-TodoMVC                        |26.883333    |26.950000    |1.002480  | 0.846732                                         |
            | EmberJS-TodoMVC                      |127.708333   |127.754167   |1.000359  | 0.934206                                         |
            | BackboneJS-TodoMVC                   |50.545833    |50.445833    |0.998022  | 0.679610                                         |
            | Preact-TodoMVC                       |20.879167    |20.791667    |0.995809  | 0.796541                                         |
            | AngularJS-TodoMVC                    |137.479167   |137.275000   |0.998515  | 0.729817                                         |
            | Vanilla-ES2015-TodoMVC               |69.079167    |68.912500    |0.997587  | 0.524325                                         |
            | Inferno-TodoMVC                      |65.604167    |66.120833    |1.007876  | 0.145549                                         |
            | Flight-TodoMVC                       |77.029167    |76.708333    |0.995835  | 0.518562                                         |
            | Angular2-TypeScript-TodoMVC          |40.516667    |40.812500    |1.007302  | 0.513386                                         |
            | VanillaJS-TodoMVC                    |54.762500    |54.895833    |1.002435  | 0.647381                                         |
            | jQuery-TodoMVC                       |255.950000   |250.425000   |0.978414  | 0.000000 (significant)                           |
            | EmberJS-Debug-TodoMVC                |341.745833   |342.804167   |1.003097  | 0.219937                                         |
            | React-TodoMVC                        |88.854167    |88.700000    |0.998265  | 0.568405                                         |
            | React-Redux-TodoMVC                  |151.266667   |150.804167   |0.996942  | 0.256403                                         |
            | Vanilla-ES2015-Babel-Webpack-TodoMVC |65.783333    |65.645833    |0.997910  | 0.437464                                         |
            ----------------------------------------------------------------------------------------------------------------------------------
            a mean = 246.52898
            b mean = 246.85128
            pValue = 0.3927330278
            (Bigger means are better.)
            1.001 times better
            Results ARE NOT significant

        * yarr/YarrJIT.cpp:
        (JSC::Yarr::BoyerMooreInfo::shortenLength):
        (JSC::Yarr::BoyerMooreInfo::setAll):
        (JSC::Yarr::BoyerMooreInfo::addCharacters):
        (JSC::Yarr::BoyerMooreInfo::addRanges):
        * yarr/YarrJIT.h:
        (JSC::Yarr::BoyerMooreBitmap::add):
        (JSC::Yarr::BoyerMooreBitmap::addCharacters):
        (JSC::Yarr::BoyerMooreBitmap::addRanges):
        (JSC::Yarr::BoyerMooreBitmap::setAll):
        (JSC::Yarr::BoyerMooreBitmap::isAllSet const):

2021-08-02  Stephan Szabo  <stephan.szabo@sony.com>

        [PlayStation] Make C files in testapi compile with a C standard rather than C++ one
        https://bugs.webkit.org/show_bug.cgi?id=228701

        Reviewed by Ross Kirsling.

        * shell/PlatformPlayStation.cmake: Set standard for C files in testapi

2021-08-02  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Yarr should use Bitmap instead of ByteVector for BoyerMoore search
        https://bugs.webkit.org/show_bug.cgi?id=228676

        Reviewed by Saam Barati.

        We observed that using Bitmap instead of ByteVector does not pose performance
        issue. It was neutral in jquery-todomvc-regexp.js. In that case, we should use
        Bitmap since it is 8x smaller.

        We also search reusable Bitmap from Vector since comparing 128bit Bitmap is
        super fast so we do not need to bother about linear search here (# of Bitmap
        is currently up to 4).

        To make code simplified, we add regT2 to ARMv7 and MIPS backend of YarrJIT.

                                              ToT                     Patched

            jquery-todomvc-regexp      555.9566+-0.8856          555.0737+-0.9717

        * yarr/YarrJIT.cpp:
        (JSC::Yarr::BoyerMooreInfo::index const): Deleted.
        (JSC::Yarr::BoyerMooreInfo::setIndex): Deleted.
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrCodeBlock::set8BitCode):
        (JSC::Yarr::YarrCodeBlock::set16BitCode):
        (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreBitmap const):
        (JSC::Yarr::BoyerMooreByteVector::BoyerMooreByteVector): Deleted.
        (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreByteVector const): Deleted.

2021-07-31  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Move JIT_UNICODE_EXPRESSIONS to ENABLE(YARR_JIT_UNICODE_EXPRESSIONS) in PlatformEnable.h
        https://bugs.webkit.org/show_bug.cgi?id=228669

        Reviewed by Alexey Shvayka.

        Move JIT_UNICODE_EXPRESSIONS to PlatformEnable.h to align to the other YarrJIT flags.
        This makes it easy to read that this is enabled on ARM64 and X86_64.

        * yarr/YarrJIT.cpp:

2021-07-31  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Clean up Yarr by using `static constexpr`
        https://bugs.webkit.org/show_bug.cgi?id=228678

        Reviewed by Alexey Shvayka.

        Modernize Yarr code by using static constexpr.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
        * yarr/YarrCanonicalizeUCS2.cpp:
        * yarr/YarrCanonicalizeUCS2.js:
        (set characters.hex.set string_appeared_here):
        * yarr/YarrErrorCode.cpp:
        (JSC::Yarr::errorMessage):
        * yarr/YarrJIT.cpp:

2021-07-31  Joonghun Park  <jh718.park@samsung.com>

        Unreviewed. Remove the build warning below since r280493.
        warning: variable ‘block’ set but not used [-Wunused-but-set-variable]

        * b3/B3CanonicalizePrePostIncrements.cpp:
        (JSC::B3::canonicalizePrePostIncrements):

2021-07-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] branchTest8 should not emit tst for Zero/NonZero cases
        https://bugs.webkit.org/show_bug.cgi?id=228674

        Reviewed by Mark Lam.

        Previously, branchTest8(NonZero, BaseIndex) emits `tst` instruction
        unnecessarily. This is because the mask is truncated into 8bit, which
        makes branchTest32 (which is internally used in branchTest8) emits tst.
        We observed many unnecessary tst in YarrJIT.

        This patch removes this unnecessary truncation since Zero/NonZero does
        not care high bits of mask in branchTest8. This is ok because the
        ResultCondition version of mask8OnCondition() is always used to generate
        a mask that is only used against a value that is loaded with
        MacroAssemblerHelpers::load8OnCondition(). For Zero/NonZero conditions,
        load8OnCondition() will always zero fill the upper bytes. The 0 filled
        upper bytes will not affect the result of a branch on zero or branch on
        not zero.

        Before:
           0x10a8068b0:    ldrb     w16, [x7, x6]
           0x10a8068b4:    tst      w16, #0xff
           0x10a8068b8:    b.ne   0x10a8068cc

        After:
           0x1070068b0:    ldrb     w16, [x7, x6]
           0x1070068b4:    cbnz     w16, 0x1070068c8

        * assembler/MacroAssemblerHelpers.h:
        (JSC::MacroAssemblerHelpers::mask8OnCondition):

2021-07-30  Robin Morisset  <rmorisset@apple.com>

        Improve OSR entry into Wasm loops with arguments
        https://bugs.webkit.org/show_bug.cgi?id=228595

        Reviewed by Yusuke Suzuki.

        This patch has two parts:
        - improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
        - improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks.
          Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).

        * b3/B3Validate.cpp:
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::AirIRGenerator::addLoop):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
        (JSC::Wasm::B3IRGenerator::addLoop):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::addLoop):

2021-07-30  Philip Chimento  <pchimento@igalia.com>

        [JSC] Rename Temporal.now to Temporal.Now
        https://bugs.webkit.org/show_bug.cgi?id=228658

        Reviewed by Yusuke Suzuki.

        See https://github.com/tc39/proposal-temporal/pull/1645. In the July
        2021 meeting TC39 achieved consensus to rename Temporal.now to
        Temporal.Now since it is a namespace.

        * runtime/TemporalNow.cpp: Change Now[@@toStringTag] accordingly.
        * runtime/TemporalObject.cpp: Rename now property to Now.

2021-07-30  Tadeu Zagallo  <tzagallo@apple.com>

        putInlineFastReplacingStaticPropertyIfNeeded should handle custom values
        https://bugs.webkit.org/show_bug.cgi?id=227963

        Reviewed by Alexey Shvayka.

        Follow up after r280463: as it turns out, putInlineFastReplacingStaticPropertyIfNeeded also needs to handle
        custom values, similar to how definePropertyOnReceiverSlow was updated. This function will be called when the
        target property of the receiver is a custom value and isn't reified. The previous test case was expanded to
        test both the reified and non-reified cases.

        * runtime/JSObject.cpp:
        (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded):
        * tools/JSDollarVM.cpp:

2021-07-30  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, fix wrong access width
        https://bugs.webkit.org/show_bug.cgi?id=228301
        rdar://81341472

        * yarr/YarrJIT.cpp:

2021-07-30  Yijia Huang  <yijia_huang@apple.com>

        Add Pre/Post-Indexed Address Mode to Air for ARM64
        https://bugs.webkit.org/show_bug.cgi?id=228047

        Reviewed by Phil Pizlo.

        Pre-indexed addressing means that the address is the sum of the value in the 64-bit base register 
        and an offset, and the address is then written back to the base register. And post-indexed 
        addressing means that the address is the value in the 64-bit base register, and the sum of the 
        address and the offset is then written back to the base register. They are relatively common for 
        loops to iterate over an array by increasing/decreasing a pointer into the array at each iteration. 
        With such an addressing mode, the instruction selector can merge the increment and access the array.

        #####################################
        ## Pre-Index Address Mode For Load ##
        #####################################

        LDR Wt, [Xn, #imm]!

        In B3 Reduction Strength, since we have this reduction rule:
            Turn this: Load(Add(address, offset1), offset = offset2)
            Into this: Load(address, offset = offset1 + offset2)

        Then, the equivalent pattern is:
            address = Add(base, offset)
            ...
            memory = Load(base, offset)

        First, we convert it to the canonical form:
            address = Add(base, offset)
            newMemory = Load(base, offset) // move the memory to just after the address
            ...
            memory = Identity(newMemory)

        Next, lower to Air:
            Move %base, %address
            Move (%address, prefix(offset)), %newMemory

        ######################################
        ## Post-Index Address Mode For Load ##
        ######################################

        LDR Wt, [Xn], #imm

        Then, the equivalent pattern is:
            memory = Load(base, 0)
            ...
            address = Add(base, offset)

        First, we convert it to the canonical form:
            newOffset = Constant
            newAddress = Add(base, offset)
            memory = Load(base, 0) // move the offset and address to just before the memory
            ...
            offset = Identity(newOffset)
            address = Identity(newAddress)

        Next, lower to Air:
            Move %base, %newAddress
            Move (%newAddress, postfix(offset)), %memory

        #############################
        ## Pattern Match Algorithm ##
        #############################

        To detect the pattern for prefix/postfix increment address is tricky due to the structure in B3 IR. The 
        algorithm used in this patch is to collect the first valid values (add/load), then search for any 
        paired value (load/add) to match all of them. In worst case, the runtime complexity is O(n^2) 
        when n is the number of all values.

        After collecting two sets of candidates, we match the prefix incremental address first since it seems 
        more beneficial to the compiler (shown in the next section). And then, go for the postfix one.

        ##############################################
        ## Test for Pre/Post-Increment Address Mode ##
        ##############################################

        Given Loop with Pre-Increment:
        int64_t ldr_pre(int64_t *p) {
            int64_t res = 0;
            while (res < 10)
                res += *++p;
            return res;
        }

        B3 IR:
        ------------------------------------------------------
        BB#0: ; frequency = 1.000000
            Int64 b@0 = Const64(0)
            Int64 b@2 = ArgumentReg(%x0)
            Void b@20 = Upsilon($0(b@0), ^18, WritesLocalState)
            Void b@21 = Upsilon(b@2, ^19, WritesLocalState)
            Void b@4 = Jump(Terminal)
        Successors: #1
        BB#1: ; frequency = 1.000000
        Predecessors: #0, #2
            Int64 b@18 = Phi(ReadsLocalState)
            Int64 b@19 = Phi(ReadsLocalState)
            Int64 b@7 = Const64(10)
            Int32 b@8 = AboveEqual(b@18, $10(b@7))
            Void b@9 = Branch(b@8, Terminal)
        Successors: Then:#3, Else:#2
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            Int64 b@10 = Const64(8)
            Int64 b@11 = Add(b@19, $8(b@10))
            Int64 b@13 = Load(b@11, ControlDependent|Reads:Top)
            Int64 b@14 = Add(b@18, b@13)
            Void b@22 = Upsilon(b@14, ^18, WritesLocalState)
            Void b@23 = Upsilon(b@11, ^19, WritesLocalState)
            Void b@16 = Jump(Terminal)
        Successors: #1
        BB#3: ; frequency = 1.000000
        Predecessors: #1
            Void b@17 = Return(b@18, Terminal)
        Variables:
            Int64 var0
            Int64 var1
        ------------------------------------------------------

        W/O Pre-Increment Address Mode:
        ------------------------------------------------------
        ...
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            Move $8, %x3, $8(b@12)
            Add64 $8, %x0, %x1, b@11
            Move (%x0,%x3), %x0, b@13
            Add64 %x0, %x2, %x2, b@14
            Move %x1, %x0, b@23
            Jump b@16
        Successors: #1
        ...
        ------------------------------------------------------

        W/ Pre-Increment Address Mode:
        ------------------------------------------------------
        ...
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            MoveWithIncrement64 (%x0,Pre($8)), %x2, b@13
            Add64 %x2, %x1, %x1, b@14
            Jump b@16
        Successors: #1
        ...
        ------------------------------------------------------

        Given Loop with Post-Increment:
        int64_t ldr_pre(int64_t *p) {
            int64_t res = 0;
            while (res < 10)
                res += *p++;
            return res;
        }

        B3 IR:
        ------------------------------------------------------
        BB#0: ; frequency = 1.000000
            Int64 b@0 = Const64(0)
            Int64 b@2 = ArgumentReg(%x0)
            Void b@20 = Upsilon($0(b@0), ^18, WritesLocalState)
            Void b@21 = Upsilon(b@2, ^19, WritesLocalState)
            Void b@4 = Jump(Terminal)
        Successors: #1
        BB#1: ; frequency = 1.000000
        Predecessors: #0, #2
            Int64 b@18 = Phi(ReadsLocalState)
            Int64 b@19 = Phi(ReadsLocalState)
            Int64 b@7 = Const64(10)
            Int32 b@8 = AboveEqual(b@18, $10(b@7))
            Void b@9 = Branch(b@8, Terminal)
        Successors: Then:#3, Else:#2
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            Int64 b@10 = Load(b@19, ControlDependent|Reads:Top)
            Int64 b@11 = Add(b@18, b@10)
            Int64 b@12 = Const64(8)
            Int64 b@13 = Add(b@19, $8(b@12))
            Void b@22 = Upsilon(b@11, ^18, WritesLocalState)
            Void b@23 = Upsilon(b@13, ^19, WritesLocalState)
            Void b@16 = Jump(Terminal)
        Successors: #1
        BB#3: ; frequency = 1.000000
        Predecessors: #1
            Void b@17 = Return(b@18, Terminal)
        Variables:
            Int64 var0
            Int64 var1
        ------------------------------------------------------

        W/O Post-Increment Address Mode:
        ------------------------------------------------------
        ...
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            Move (%x0), %x2, b@10
            Add64 %x2, %x1, %x1, b@11
            Add64 $8, %x0, %x0, b@13
            Jump b@16
        Successors: #1
        ...
        ------------------------------------------------------

        W/ Post-Increment Address Mode:
        ------------------------------------------------------
        ...
        BB#2: ; frequency = 1.000000
        Predecessors: #1
            MoveWithIncrement64 (%x0,Post($8)), %x2, b@10
            Add64 %x2, %x1, %x1, b@11
            Jump b@16
        Successors: #1
        ...
        ------------------------------------------------------

        * Sources.txt:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::PreIndexAddress::PreIndexAddress):
        (JSC::AbstractMacroAssembler::PostIndexAddress::PostIndexAddress):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::load64):
        (JSC::MacroAssemblerARM64::load32):
        (JSC::MacroAssemblerARM64::store64):
        (JSC::MacroAssemblerARM64::store32):
        * assembler/testmasm.cpp:
        (JSC::testStorePrePostIndex32):
        (JSC::testStorePrePostIndex64):
        (JSC::testLoadPrePostIndex32):
        (JSC::testLoadPrePostIndex64):
        * b3/B3CanonicalizePrePostIncrements.cpp: Added.
        (JSC::B3::canonicalizePrePostIncrements):
        * b3/B3CanonicalizePrePostIncrements.h: Copied from Source/JavaScriptCore/b3/B3ValueKeyInlines.h.
        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):
        * b3/B3LowerToAir.cpp:
        * b3/B3ValueKey.h:
        * b3/B3ValueKeyInlines.h:
        (JSC::B3::ValueKey::ValueKey):
        * b3/air/AirArg.cpp:
        (JSC::B3::Air::Arg::jsHash const):
        (JSC::B3::Air::Arg::dump const):
        (WTF::printInternal):
        * b3/air/AirArg.h:
        (JSC::B3::Air::Arg::preIndex):
        (JSC::B3::Air::Arg::postIndex):
        (JSC::B3::Air::Arg::isPreIndex const):
        (JSC::B3::Air::Arg::isPostIndex const):
        (JSC::B3::Air::Arg::isMemory const):
        (JSC::B3::Air::Arg::base const):
        (JSC::B3::Air::Arg::offset const):
        (JSC::B3::Air::Arg::isGP const):
        (JSC::B3::Air::Arg::isFP const):
        (JSC::B3::Air::Arg::isValidPreIndexForm):
        (JSC::B3::Air::Arg::isValidPostIndexForm):
        (JSC::B3::Air::Arg::isValidForm const):
        (JSC::B3::Air::Arg::forEachTmpFast):
        (JSC::B3::Air::Arg::forEachTmp):
        (JSC::B3::Air::Arg::asPreIndexAddress const):
        (JSC::B3::Air::Arg::asPostIndexAddress const):
        * b3/air/AirOpcode.opcodes:
        * b3/air/opcode_generator.rb:
        * b3/testb3.h:
        * b3/testb3_3.cpp:
        (testLoadPreIndex32):
        (testLoadPreIndex64):
        (testLoadPostIndex32):
        (testLoadPostIndex64):
        (addShrTests):
        * jit/ExecutableAllocator.cpp:
        (JSC::jitWriteThunkGenerator):

2021-07-30  Alexey Shvayka  <shvaikalesh@gmail.com>

        REGRESSION (r280460): 42 JSC test failures on Debug arm64 with ASSERTION FAILED: !m_needExceptionCheck
        https://bugs.webkit.org/show_bug.cgi?id=228652

        Unreviewed unchecked exception fix.

        Release scope before calling RegExpGlobalData::getBackref().

        * runtime/RegExpConstructor.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):

2021-07-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use UCPURegister argument to remove zero extension in JIT code
        https://bugs.webkit.org/show_bug.cgi?id=228625

        Reviewed by Robin Morisset.

        Yarr JIT code emits zeroExtend32ToWord for some arguments, but this is not necessary if
        argument is defined as UCPURegister. In that case, caller guarantees that top 32bits are
        cleared.

        * yarr/YarrJIT.cpp:
        * yarr/YarrJIT.h:

2021-07-29  Myles C. Maxfield  <mmaxfield@apple.com>

        Stop building WebGPU and the WHLSL compiler to decrease binary size
        https://bugs.webkit.org/show_bug.cgi?id=228179

        Reviewed by Dean Jackson, Robin Morisset, and Devin Rousso.

        This patch deletes the existing implementation just to reduce binary size in releases of WebKit
        which don't enable WebGPU by default. It doesn't represent a change in direction or policy or
        anything regarding WebGPU. It's a (somewhat temporary) pragmatic change.

        Our current implementation of WebGPU:
        1. Is off by default on all platforms
        2. Is extremely outdated
        3. Has no notion of the GPU Process, and therefore needs to be redesigned and largely rewritten
        4. Only implements a fraction of what is in the spec

        Removing the code from the tree doesn't delete it from existence; it's still in source control.
        The benefit of reducing binary size seems to outweigh having this code in the tree.

        * inspector/protocol/Canvas.json:
        * inspector/scripts/codegen/generator.py:

2021-07-29  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        [WPE][GTK] build broken with python2 after r280382
        https://bugs.webkit.org/show_bug.cgi?id=228629

        Reviewed by Philippe Normand.

        Call {PYTHON_EXECUTABLE} instead of python3.

        * PlatformGTK.cmake:

2021-07-29  Tadeu Zagallo  <tzagallo@apple.com>

        definePropertyOnReceiver should check if receiver canPerformFastPutInline
        https://bugs.webkit.org/show_bug.cgi?id=227963
        <rdar://80259710>

        Reviewed by Alexey Shvayka.

        definePropertyOnReceiver has a fast path if the slot is not opaque and the receiver doesn't
        have a custom defineOwnProperty implementation, in which case it calls putInlineFast (and
        transitively putDirectInternal<PutModePut>). The issue is that putDirectInternal does not
        handle customValues correctly: it just overwrites the property without changing the attributes.
        To fix that, we should first check if the property might be a custom value, and if that's the case
        we now call `definePropertyOnReceiverSlow`, which has been updated to handle custom values correctly.
        I also added assertions to putInlineFastReplacingStaticPropertyIfNeeded and putDirectInternal
        to make sure we don't accidentally overwrite custom values in the future.

        * runtime/JSObject.cpp:
        (JSC::definePropertyOnReceiverSlow):
        (JSC::JSObject::definePropertyOnReceiver):
        (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::putDirectInternal):

2021-07-29  Yusuke Suzuki  <ysuzuki@apple.com> and Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Legacy RegExp fields should be accessors
        https://bugs.webkit.org/show_bug.cgi?id=220233

        Reviewed by Tadeu Zagallo.

        This patch implements a part of Legacy RegExp features proposal [1], replacing
        custom values with custom accessors that require |this| value to be RegExp
        constructor of the same realm.

        Apart from fixing property descriptors, this change brings legacy RegExpConstructor
        fields in compliance with invariants of internal methods [2] (described in #151348),
        aligning JSC with V8 and SpiderMonkey.

        It doesn't, however, implement [[LegacyFeaturesEnabled]] and RegExp.prototype.compile
        changes.

        [1]: https://github.com/tc39/proposal-regexp-legacy-features
        [2]: https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * runtime/RegExpConstructor.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_CUSTOM_SETTER):
        (JSC::regExpConstructorDollarImpl): Deleted.
        * tools/JSDollarVM.cpp:

2021-07-29  Myles C. Maxfield  <mmaxfield@apple.com>

        Add WebGPU to webkit.org/status
        https://bugs.webkit.org/show_bug.cgi?id=228623

        Reviewed by Robin Morisset.

        * features.json:

2021-07-28  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Yarr should perform BoyerMoore search
        https://bugs.webkit.org/show_bug.cgi?id=228301

        Reviewed by Saam Barati.

        This patch emits skipping fast-path at the beginning of body alternatives with a large stride. So we can quickly discard unrelated characters
        and attempt to find possibly related sequence in the long sequence. The method is derived from V8's implementation (with some extensions).

        If we have a searching pattern /abcdef/, then we can check the 6th character against a set of {a, b, c, d, e, f}.
        If it does not match, we can shift 6 characters. We use this strategy since this way can be extended easily to support
        disjunction, character-class, and ignore-cases. For example, in the case of /(?:abc|def)/, we can check 3rd character
        against {a, b, c, d, e, f} and shift 3 characters if it does not match.

        Then, the best way to perform the above shifting is that finding the longest character sequence which does not have
        many candidates. In the case of /[a-z]aaaaaaa[a-z]/, we can extract "aaaaaaa" sequence and check 8th character against {a}.
        If it does not match, then we can shift 7 characters (length of "aaaaaaa"). This shifting is better than using "[a-z]aaaaaaa[a-z]"
        sequence and {a-z} set since {a-z} set will almost always match.

        We first collect possible characters for each character position. Then, apply heuristics to extract good character sequence from
        that and construct fast searching with long stride.

        Microbenchmark which performs RegExp ops in Speedometer2/jQuery-TodoMVC shows 25% improvement.

                                              ToT                     Patched

            jquery-todomvc-regexp      723.9739+-1.3997     ^    579.1698+-1.2505        ^ definitely 1.2500x faster

        This improves Speedometer2/jQuery-TodoMVC by 3%.

            ----------------------------------------------------------------------------------------------------------------------------------
            |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
            ----------------------------------------------------------------------------------------------------------------------------------
            | Elm-TodoMVC                          |123.365625   |123.456250   |1.000735  | 0.804077                                         |
            | VueJS-TodoMVC                        |26.912500    |26.925000    |1.000464  | 0.969603                                         |
            | EmberJS-TodoMVC                      |127.540625   |127.562500   |1.000172  | 0.960474                                         |
            | BackboneJS-TodoMVC                   |50.606250    |50.518750    |0.998271  | 0.670313                                         |
            | Preact-TodoMVC                       |21.018750    |20.850000    |0.991971  | 0.563818                                         |
            | AngularJS-TodoMVC                    |136.943750   |137.271875   |1.002396  | 0.531513                                         |
            | Vanilla-ES2015-TodoMVC               |68.521875    |68.593750    |1.001049  | 0.701376                                         |
            | Inferno-TodoMVC                      |65.559375    |65.803125    |1.003718  | 0.414418                                         |
            | Flight-TodoMVC                       |77.284375    |76.715625    |0.992641  | 0.219870                                         |
            | Angular2-TypeScript-TodoMVC          |40.725000    |40.318750    |0.990025  | 0.281212                                         |
            | VanillaJS-TodoMVC                    |55.209375    |54.715625    |0.991057  | 0.056921                                         |
            | jQuery-TodoMVC                       |266.396875   |258.471875   |0.970251  | 0.000000 (significant)                           |
            | EmberJS-Debug-TodoMVC                |341.550000   |341.856250   |1.000897  | 0.618140                                         |
            | React-TodoMVC                        |88.731250    |88.871875    |1.001585  | 0.512407                                         |
            | React-Redux-TodoMVC                  |150.340625   |150.065625   |0.998171  | 0.412940                                         |
            | Vanilla-ES2015-Babel-Webpack-TodoMVC |65.390625    |65.362500    |0.999570  | 0.834760                                         |
            ----------------------------------------------------------------------------------------------------------------------------------
            a mean = 245.96997
            b mean = 246.86366
            pValue = 0.0061448402
            (Bigger means are better.)
            1.004 times better
            Results ARE significant

        * runtime/OptionsList.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::BoyerMooreInfo::BoyerMooreInfo):
        (JSC::Yarr::BoyerMooreInfo::length const):
        (JSC::Yarr::BoyerMooreInfo::set):
        (JSC::Yarr::BoyerMooreInfo::index const):
        (JSC::Yarr::BoyerMooreInfo::setIndex):
        (JSC::Yarr::BoyerMooreInfo::create):
        (JSC::Yarr::BoyerMooreInfo::findBestCharacterSequence const):
        (JSC::Yarr::BoyerMooreInfo::findWorthwhileCharacterSequenceForLookahead const):
        (JSC::Yarr::BoyerMooreInfo::createCandidateBitmap const):
        * yarr/YarrJIT.h:
        (JSC::Yarr::BoyerMooreBitmap::count const):
        (JSC::Yarr::BoyerMooreBitmap::map const):
        (JSC::Yarr::BoyerMooreBitmap::isMaskEffective const):
        (JSC::Yarr::BoyerMooreBitmap::add):
        (JSC::Yarr::BoyerMooreByteVector::BoyerMooreByteVector):
        (JSC::Yarr::YarrCodeBlock::set8BitCode):
        (JSC::Yarr::YarrCodeBlock::set16BitCode):
        (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::clear):
        (JSC::Yarr::YarrCodeBlock::findSameVector const):

2021-07-28  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] load/store with BaseIndex is inefficient in ARM64
        https://bugs.webkit.org/show_bug.cgi?id=228543

        Reviewed by Mark Lam.

        While we are frequently using load + BaseIndex (with offset) in RegExp code,
        we emit 3 instructions in ARM64. This can be represented in 2 instructions.
        This patch adds that path to make generated code tight in ARM64 RegExp.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::load64):
        (JSC::MacroAssemblerARM64::load32):
        (JSC::MacroAssemblerARM64::load16):
        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::load8):
        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
        (JSC::MacroAssemblerARM64::store64):
        (JSC::MacroAssemblerARM64::store32):
        (JSC::MacroAssemblerARM64::store16):
        (JSC::MacroAssemblerARM64::store8):
        (JSC::MacroAssemblerARM64::loadDouble):
        (JSC::MacroAssemblerARM64::loadFloat):
        (JSC::MacroAssemblerARM64::storeDouble):
        (JSC::MacroAssemblerARM64::storeFloat):
        (JSC::MacroAssemblerARM64::tryFoldBaseAndOffsetPart):
        * assembler/testmasm.cpp:
        (JSC::testLoadBaseIndex):
        (JSC::testStoreBaseIndex):

2021-07-28  Philippe Normand  <pnormand@igalia.com>

        [WPE][GTK] SVN_REVISION drifting away if bots don't re-run cmake
        https://bugs.webkit.org/show_bug.cgi?id=228290

        Reviewed by Michael Catanzaro.

        * PlatformGTK.cmake: Expand ${BUILD_REVISION} with apply-build-revision-to-files.py for
        non-tarball builds, or let CMake do it for tarball builds.
        * javascriptcoregtk.pc.in: Switch revision var to ${} format, so that we can choose to
        either let CMake expand it or do it ourselves.

2021-07-27  Patrick Angle  <pangle@apple.com>

        Web Inspector: [Cocoa] "RemoteInspector XPC connection to relay failed." messages are confusing in StdErr
        https://bugs.webkit.org/show_bug.cgi?id=228303

        Reviewed by Darin Adler.

        Remove overly verbose and confusing `WTFLogAlways` messages added in r278413, which can confuse applications
        listening to stderr of a process using JavaScriptCore.

        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
        (Inspector::RemoteInspector::xpcConnectionFailed):

2021-07-27  Alexey Shvayka  <shvaikalesh@gmail.com>

        ProxyObject callees should be skipped during Function.prototype.caller resolution
        https://bugs.webkit.org/show_bug.cgi?id=228341

        Reviewed by Yusuke Suzuki.

        Just like a bound function, a Proxy with nullish "apply" handler merely forwards
        [[Call]] to its target [1], without pushing onto the execution context stack.
        This fact is also noted in Function.prototype.{caller,arguments} reflection proposal [2].

        This patch aligns JSC with V8 and SpiderMonkey if Proxy's "apply" handler is userland
        or nullish. However, since JSC implements proper tail calls, `Function.prototype.caller`
        result is divergent from other engines if the handler is `Reflect.apply`, which performs
        a tail call that gets optimized away [2] (unless called by another Proxy).

        [1]: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-call-thisargument-argumentslist (step 8)
        [2]: https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (see notes)

        * runtime/FunctionPrototype.cpp:
        (JSC::RetrieveCallerFunctionFunctor::operator() const):

2021-07-26  Yusuke Suzuki  <ysuzuki@apple.com>

        Add Temporal to features.json
        https://bugs.webkit.org/show_bug.cgi?id=228292

        Reviewed by Myles C. Maxfield.

        * features.json:

2021-07-25  Alexey Shvayka  <shvaikalesh@gmail.com>

        Partly implement Function.prototype.{caller,arguments} reflection proposal
        https://bugs.webkit.org/show_bug.cgi?id=158116

        Reviewed by Yusuke Suzuki.

        To ensure web-compatibility, only the safe subset of Function.prototype.{caller,arguments}
        reflection proposal [1] is implemented, which is currently shipped in SpiderMonkey.

        Complete list of differences from the proposed spec:

          1. Cross-realm receiver function is allowed instead of throwing a TypeError.

             Throwing is likely safe to ship, but #225997 needs to be fixed first for
             custom properties to receive correct global object.

          2. Cross-realm caller function is returned instead of `null`.

             Hiding cross-realm caller may break things: we currently have a test for
             the opposite behavior.

          3. Defines "caller" and "arguments" setters that throw for disallowed receivers,
             instead failing silently in sloppy mode.

             This is actually more restrictive than the spec, which is preferable,
             and aligns with V8 and SM.

        Most importantly, this patch removes own "caller" and "arguments" properties from
        sloppy mode ES5 functions. They were non-configurable, making it harder to use
        their holder as a [[ProxyTarget]]. They were also non-writable, with a constantly
        changing [[Value]], which violated the invariants of internal methods [2].

        As a result, JSFunction methods are greatly simplified, especially defineOwnProperty()
        and getOwnSpecialPropertyNames(). The latter is now 2.1x faster according to the
        provided microbenchmark. Also, removes double "prototype" lookup from [[Get]],
        which is a 10% progression.

        [1]: https://github.com/claudepache/es-legacy-function-reflection
        [2]: https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods

        * runtime/ClonedArguments.cpp:
        (JSC::ClonedArguments::getOwnPropertySlot):
        (JSC::ClonedArguments::materializeSpecials):
        * runtime/FunctionExecutable.h:
        * runtime/FunctionPrototype.cpp:
        (JSC::FunctionPrototype::addFunctionProperties):
        (JSC::isAllowedReceiverFunctionForCallerAndArguments):
        (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor):
        (JSC::RetrieveArgumentsFunctor::result const):
        (JSC::RetrieveArgumentsFunctor::operator() const):
        (JSC::retrieveArguments):
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
        (JSC::RetrieveCallerFunctionFunctor::result const):
        (JSC::RetrieveCallerFunctionFunctor::operator() const):
        (JSC::retrieveCallerFunction):
        (JSC::JSC_DEFINE_CUSTOM_SETTER):
        (JSC::FunctionPrototype::initRestrictedProperties): Deleted.
        * runtime/FunctionPrototype.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::getOwnPropertySlot):
        (JSC::JSFunction::getOwnSpecialPropertyNames):
        (JSC::JSFunction::put):
        (JSC::JSFunction::deleteProperty):
        (JSC::JSFunction::defineOwnProperty):
        (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor): Deleted.
        (JSC::RetrieveArgumentsFunctor::result const): Deleted.
        (JSC::RetrieveArgumentsFunctor::operator() const): Deleted.
        (JSC::retrieveArguments): Deleted.
        (JSC::JSC_DEFINE_CUSTOM_GETTER): Deleted.
        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor): Deleted.
        (JSC::RetrieveCallerFunctionFunctor::result const): Deleted.
        (JSC::RetrieveCallerFunctionFunctor::operator() const): Deleted.
        (JSC::retrieveCallerFunction): Deleted.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildrenImpl):
        * runtime/JSGlobalObject.h:
        Remove unused m_throwTypeErrorGetterSetter and make [[ThrowTypeError]] lazily-created.

        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSGlobalObjectFunctions.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition):
        * runtime/JSObject.h:

2021-07-24  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Change most of enum in Yarr to enum-class
        https://bugs.webkit.org/show_bug.cgi?id=228264

        Reviewed by Mark Lam.

        This patch simply changes most of enum to enum-class in Yarr.
        We also remove YarrJIT YarrGenerator's template parameter since
        it is not worth doubling code. We can just hold Yarr::JITCompileMode as m_compileMode.

        * runtime/RegExp.cpp:
        (JSC::RegExp::compile):
        (JSC::RegExp::matchConcurrently):
        (JSC::RegExp::compileMatchOnly):
        * runtime/RegExp.h:
        * runtime/RegExpInlines.h:
        (JSC::RegExp::hasCodeFor):
        (JSC::RegExp::compileIfNecessary):
        (JSC::RegExp::matchInline):
        (JSC::RegExp::hasMatchOnlyCodeFor):
        (JSC::RegExp::compileIfNecessaryMatchOnly):
        * yarr/Yarr.h:
        (): Deleted.
        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
        (JSC::Yarr::Interpreter::matchCharacterClass):
        (JSC::Yarr::Interpreter::backtrackCharacterClass):
        (JSC::Yarr::Interpreter::matchBackReference):
        (JSC::Yarr::Interpreter::backtrackBackReference):
        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
        (JSC::Yarr::Interpreter::matchParentheses):
        (JSC::Yarr::Interpreter::backtrackParentheses):
        (JSC::Yarr::Interpreter::matchDisjunction):
        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
        (JSC::Yarr::ByteCompiler::closeAlternative):
        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
        (JSC::Yarr::ByteCompiler::emitDisjunction):
        (JSC::Yarr::ByteCompiler::dumpDisjunction):
        * yarr/YarrInterpreter.h:
        (JSC::Yarr::ByteTerm::ByteTerm):
        (JSC::Yarr::ByteTerm::BOL):
        (JSC::Yarr::ByteTerm::CheckInput):
        (JSC::Yarr::ByteTerm::UncheckInput):
        (JSC::Yarr::ByteTerm::EOL):
        (JSC::Yarr::ByteTerm::WordBoundary):
        (JSC::Yarr::ByteTerm::BackReference):
        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
        (JSC::Yarr::ByteTerm::AlternativeBegin):
        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
        (JSC::Yarr::ByteTerm::AlternativeEnd):
        (JSC::Yarr::ByteTerm::SubpatternBegin):
        (JSC::Yarr::ByteTerm::SubpatternEnd):
        (JSC::Yarr::ByteTerm::DotStarEnclosure):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::jitCompile):
        * yarr/YarrJIT.h:
        * yarr/YarrParser.h:
        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
        * yarr/YarrPattern.cpp:
        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
        (JSC::Yarr::YarrPatternConstructor::atomBackReference):
        (JSC::Yarr::YarrPatternConstructor::copyTerm):
        (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
        (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
        (JSC::Yarr::PatternTerm::dumpQuantifier):
        (JSC::Yarr::PatternTerm::dump):
        * yarr/YarrPattern.h:
        (JSC::Yarr::PatternTerm::PatternTerm):
        (JSC::Yarr::PatternTerm::ForwardReference):
        (JSC::Yarr::PatternTerm::BOL):
        (JSC::Yarr::PatternTerm::EOL):
        (JSC::Yarr::PatternTerm::WordBoundary):
        (JSC::Yarr::PatternTerm::isFixedWidthCharacterClass const):
        (JSC::Yarr::PatternTerm::containsAnyCaptures):
        (JSC::Yarr::PatternTerm::quantify):

2021-07-23  Alexey Shvayka  <shvaikalesh@gmail.com>

        [WebIDL] Properly validate and merge descriptors in [Replaceable] setter
        https://bugs.webkit.org/show_bug.cgi?id=227662

        Reviewed by Sam Weinig.

        Extracts createDataProperty() method to keep WebIDL code generator as simple as possible,
        and also to emphasize a subtle difference between
        { [[Value]]: X } and
        { [[Value]]: X, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true }.

        * runtime/JSONObject.cpp:
        (JSC::Walker::walk):
        * runtime/JSObject.cpp:
        (JSC::definePropertyOnReceiverSlow):
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::createDataProperty):
        * runtime/Lookup.h:
        (JSC::replaceStaticPropertySlot): Deleted.

2021-07-23  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Call custom accessors / values with their holder's global object
        https://bugs.webkit.org/show_bug.cgi?id=225997

        Reviewed by Yusuke Suzuki.

        Just like JS built-ins, getter / setter functions of WebIDL attributes are created in realm
        of their holder interface [1][2], which is their _current_ realm for throwing an error [3].

        With this patch, custom properties get correct global object instead of lexical, including
        when inline cached, aligning them with functions and regular accessors.

        The latter allowed switching JS built-ins to CustomAccessor (e.g. Symbol#description),
        which is slightly more efficient to call from C++, doesn't need reification on first access,
        and has nicer signature.

        Also, renames WASM accessors to drop "func" and removes unused function length parameter.

        [1]: https://heycam.github.io/webidl/#dfn-attribute-getter (step 2)
        [2]: https://heycam.github.io/webidl/#dfn-attribute-setter (step 5)
        [3]: https://heycam.github.io/webidl/#ecmascript-throw

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * create_hash_table:
        * interpreter/CallFrame.cpp:
        (JSC::CallFrame::globalObjectOfClosestCodeBlock):
        * interpreter/CallFrame.h:
        * runtime/IntlCollatorPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/IntlDateTimeFormatPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/IntlLocalePrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/IntlNumberFormatPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/JSDataViewPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * runtime/JSObject.cpp:
        (JSC::JSObject::putInlineSlow):
        * runtime/PropertySlot.cpp:
        (JSC::PropertySlot::customGetter const):
        * runtime/PropertySlot.h:
        (JSC::PropertySlot::getValue const):
        * runtime/SymbolPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * tools/JSDollarVM.cpp:
        * wasm/js/WebAssemblyInstancePrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        (JSC::JSC_DEFINE_HOST_FUNCTION): Deleted.
        * wasm/js/WebAssemblyMemoryPrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):
        * wasm/js/WebAssemblyTablePrototype.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):

2021-07-22  Saam Barati  <sbarati@apple.com>

        AirStackSlot's uint16_t byte size is too small
        https://bugs.webkit.org/show_bug.cgi?id=228193
        <rdar://80888059>

        Reviewed by Mark Lam.

        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::addStackSlot):
        * b3/B3Procedure.h:
        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::addStackSlot):
        * b3/air/AirCode.h:
        * b3/air/AirStackSlot.cpp:
        (JSC::B3::Air::StackSlot::StackSlot):
        * b3/air/AirStackSlot.h:
        (JSC::B3::Air::StackSlot::ensureSize):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        * ftl/FTLOutput.cpp:
        (JSC::FTL::Output::lockedStackSlot):
        * ftl/FTLOutput.h:

2021-07-22  Saam Barati  <sbarati@apple.com>

        Fix uses of Dependency::fence with respect to the compiler outsmarting us
        https://bugs.webkit.org/show_bug.cgi?id=227757
        <rdar://problem/80280931>

        Reviewed by Robin Morisset.

        We were running into issues on arm64 with respect to the memory model
        ordering of loads, and how the compiler optimized code around Dependency::fence.
        The issue manifested as calls to isMarked incorrectly returning true.
        
        To see the issue, let's consider a program like this:
        a = load(p1)
        b = load(p2)
        if (a != b) return;
        d = Dependency::fence(b)
        
        At the point of defining the dependency, the compiler has proven
        a == b. So, instead of building the dependency on the register used
        for b, we end up using the register for a. So the actual compiled
        code ends up with a dependency on load(p1), not load(p2).
        
        To fix this, we end up adding a new API, Dependency::loadEndFence(pointer,
        result), which is defined as:
        
        template<typename T>
        static Dependency loadAndFence(T* pointer, T& output)
        {
            T value = *opaque(pointer);
            Dependency dependency = Dependency::fence(value);
            output = opaque(value);
            return dependency;
        }
        
        The reason for this is that it split "b" in the above program into two values,
        and the "b" the program compares against is not known to the compiler to be
        the same value that we build a dependency on.

        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::aboutToMark):
        (JSC::MarkedBlock::isMarked):
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        * runtime/JSObject.h:
        (JSC::JSObject::fencedButterfly):
        * runtime/SparseArrayValueMap.cpp:
        (JSC::SparseArrayEntry::getConcurrently):
        (JSC::SparseArrayEntry::getConcurrently const): Deleted.
        * runtime/SparseArrayValueMap.h:
        * runtime/Structure.h:
        (JSC::Structure::fencedIndexingMode):
        * runtime/StructureIDBlob.h:
        (JSC::StructureIDBlob::fencedIndexingModeIncludingHistory):

2021-07-22  Keith Miller  <keith_miller@apple.com>

        useProfiler option should automatically disable concurrent JIT
        https://bugs.webkit.org/show_bug.cgi?id=228152

        Reviewed by Saam Barati.

        The bytecode profiler is not thread safe so we should have
        recomputeDependentOptions() disable concurrent JIT. Also, fix the
        jsc CLI to set the useProfiler option rather than have its own
        state. Note, we call Options::setOption() rather than setting the
        Options::useProfiler() option directly as setOption calls
        recomputeDependentOptions() for us.

        * jsc.cpp:
        (CommandLine::parseArguments):
        (runJSC):
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        (JSC::Options::ensureOptionsAreCoherent):

2021-07-21  Yijia Huang  <yijia_huang@apple.com>

        Fix type check error in testb3
        https://bugs.webkit.org/show_bug.cgi?id=228166

        Reviewed by Saam Barati.

        * b3/testb3_2.cpp:
        (testXorNotWithLeftShift32):
        (testXorNotWithRightShift32):
        (testXorNotWithUnsignedRightShift32):

2021-07-21  Keith Miller  <keith_miller@apple.com>

        speculateNeitherDoubleNorStringNorHeapBigInt should only have a single JSType branch
        https://bugs.webkit.org/show_bug.cgi?id=228146

        Reviewed by Robin Morisset.

        Since StringType and HeapBigIntType are adjacent JSTypes
        we can do an integer range check rather than two separate
        JSType checks.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

2021-07-20  Yijia Huang  <yijia_huang@apple.com>

        Add ARM64 EON opcode and select it in AIR
        https://bugs.webkit.org/show_bug.cgi?id=228057

        Reviewed by Saam Barati.

        EON Rd Rn Rm <shift> #amount

        Bitwise Exclusive OR NOT (shifted register) performs a bitwise Exclusive OR NOT 
        of a register value Rn and an optionally-shifted register value Rm, and writes the 
        result to the destination register. The instruction selector can utilize this to 
        lowering certain patterns in B3 IR before further Air optimization.

        The equivalent pattern of EON Rd Rn Rm is d = n ^ (m ^ -1)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = -1
        Int @3 = BitXor(@1, @2)
        Int @4 = BitXor(@0, b@3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Not   %x1, %x1,      @3
        Xor   %x0, %x1, %x0, @4
        Ret   %x0,           @5

        // New optimized AIR
        XorNot %x0, %x1, %x0, @4
        Ret    %x0,           @5

        The equivalent pattern of EON-with-shift is d = n ^ ((m ShiftType amount) ^ -1)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = amount
        Int @3 = -1
        Int @4 = Shl(@1, @2)
        Int @5 = BitXor(@4, @3)
        Int @6 = BitXor(@0, @5)
        Void b@7 = Return(b@6, Terminal)

        // Old optimized AIR
        Lshift   %x1, amount, %x1, @4
        Not      %x1,    %x1,      @5
        Xor      %x0,    %x1, %x0, @6
        Ret      %x0,              @7

        // New optimized AIR
        XorNotLeftShift %x0, %x1, $63, %x0, @6
        Ret             %x0,                @7

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::xorNot32):
        (JSC::MacroAssemblerARM64::xorNot64):
        (JSC::MacroAssemblerARM64::xorNotLeftShift32):
        (JSC::MacroAssemblerARM64::xorNotRightShift32):
        (JSC::MacroAssemblerARM64::xorNotUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::xorNotLeftShift64):
        (JSC::MacroAssemblerARM64::xorNotRightShift64):
        (JSC::MacroAssemblerARM64::xorNotUnsignedRightShift64):
        * assembler/testmasm.cpp:
        (JSC::testXorNot32):
        (JSC::testXorNot64):
        (JSC::testXorNotWithLeftShift32):
        (JSC::testXorNotWithRightShift32):
        (JSC::testXorNotWithUnsignedRightShift32):
        (JSC::testXorNotWithLeftShift64):
        (JSC::testXorNotWithRightShift64):
        (JSC::testXorNotWithUnsignedRightShift64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testXorNot32):
        (testXorNot64):
        (testXorNotWithLeftShift32):
        (testXorNotWithRightShift32):
        (testXorNotWithUnsignedRightShift32):
        (testXorNotWithLeftShift64):
        (testXorNotWithRightShift64):
        (testXorNotWithUnsignedRightShift64):
        (addBitTests):

2021-07-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] invalidParameterInstanceofSourceAppender should care direct call of Symbol.hasInstance
        https://bugs.webkit.org/show_bug.cgi?id=228075
        rdar://80762879

        Reviewed by Frédéric Wang.

        invalidParameterInstanceofSourceAppender can be invoked without `instanceof` expression since we can call
        `[Symbol.hasInstance]` function directly, but the implementation did not assume that. This patch fixes
        it to handle this direct call.

        * runtime/ExceptionHelpers.cpp:
        (JSC::invalidParameterInstanceofSourceAppender):

2021-07-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] StructureStubInfo's m_identifier should follow to the same protocol of inlineAccessBaseStructure
        https://bugs.webkit.org/show_bug.cgi?id=228092

        Reviewed by Saam Barati.

        In r279813, we fixed a race condition related to inlineAccessBaseStructure: while we clear inlineAccessBaseStructure,
        we still run code relying on this field's value until stub version of the code is generated. As a result,
        we run the code which relies on the cells that are already collected. And we have the same problem with
        m_identifier field too. This patch makes m_identifier follow to the same protocol of inlineAccessBaseStructure
        so that we fix this race issue too: both fields will be alive until we switch to the code that are not relying on these
        fields.

        We also make inlineAccessBaseStructure to m_inlineAccessBaseStructure to easily find that this is member field.
        And we also use setWithoutWriteBarrier for m_inlineAccessBaseStructure since we emit codeBlock->vm().heap.writeBarrier(codeBlock)
        immediately after that.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::fromStructureStubInfo):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::computeForStubInfo):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initArrayLength):
        (JSC::StructureStubInfo::initStringLength):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        (JSC::StructureStubInfo::setCacheType): Deleted.
        * bytecode/StructureStubInfo.h:

2021-07-19  Mark Lam  <mark.lam@apple.com>

        DFG's parseIntResult() should check for negative zero.
        https://bugs.webkit.org/show_bug.cgi?id=228068
        rdar://80788603

        Reviewed by Yusuke Suzuki.

        We have to check for negative zero explicitly because C++ evaluates 0.0 == -0.0
        as true.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::parseIntResult):

2021-07-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] InByStatus / InByVariant should visit CacheableIdentifier
        https://bugs.webkit.org/show_bug.cgi?id=228088
        rdar://80794604

        Reviewed by Mark Lam.

        After r278445, InByVariant holds CacheableIdentifier. And this can have
        String/Symbol cells if this variant is generated by in_by_val. In that
        case, we must visit this cell as GetByStatus / GetByVariant are doing.

        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::visitAggregateImpl):
        * bytecode/InByStatus.h:
        * bytecode/InByVariant.cpp:
        (JSC::InByVariant::visitAggregateImpl):
        * bytecode/InByVariant.h:
        * bytecode/RecordedStatuses.cpp:
        (JSC::RecordedStatuses::visitAggregateImpl):

2021-07-16  Yijia Huang  <yijia_huang@apple.com>

        Add ExtendType to Air::Arg Index to fully utilize address computation in memory instruction for ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227970

        Reviewed by Saam Barati.

        The pattern recognition of address computation in the instructions, e.g., Load 
        Resistor (LDR), Store Register (STR), etc., can benefit the instruction selector.
        Then, the Air operand BaseIndex containing base, index, and scale is introduced 
        to Air opcode. However, the <extend> option of index address is not fully leveraged 
        in the previous implementation. 

        To fill that gap, this patch adds a new member, MacroAssembler::Extend, to the current 
        design of BaseIndex to trigger zero/sign extension on the Index address. And this is 
        enabled for Store/Load with valid index address and shift amount.

        Maybe, the ideal approach is to introduce a decorator (Index@EXT) to the Air operand 
        to provide an extension opportunity for the specific form of the Air opcode.

        Load Register (LDR) calculates an address from a base register value and an 
        offset register value, loads a word from memory, and writes it to a register. 
        The offset register value can optionally be shifted and extended.

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = Z/SExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = scale
        Int @3 = Shl(@1, @2)
        Int @4 = Add(@0, @3)
        Int @5 = Load(@4, ControlDependent|Reads:Top)
        Void@6 = Return(@5, Terminal)

        // Old optimized AIR
        Move               %x1, %x1, @1
        Move (%x0,%x1,2^scale), %x0, @5
        Ret                %x0,      @6

        // New optimized AIR
        Move (%x0,%x1,2^scale), %x0, @5
        Ret                %x0,      @6

        Store Register (STR) calculates an address from a base register value and an 
        offset register value, and stores a 32-bit word or a 64-bit doubleword to the 
        calculated address, from a register.

        Given B3 IR:
        Int @0 = value
        Int @1 = ArgumentReg(%x0)
        Int @2 = Z/SExt32(Trunc(ArgumentReg(%x1))
        Int @3 = scale
        Int @4 = Shl(@2, @3)
        Int @5 = Add(@1, @4)
        Void@6 = Store(@0, @5, ControlDependent|Writes:Top)
        Void@7 = Return(@0, Terminal)

        // Old optimized AIR
        Move32    %x1,               %x1, @2
        Store32  %xzr, (%x0,%x1,2^scale), @6
        Move       $0,               %x0, @7
        Ret32     %x0,                    @7

        // New optimized AIR
        Store32  %xzr, (%x0,%x1,2^scale), @6
        Move       $0,               %x0, @7
        Ret32     %x0,                    @7

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::BaseIndex::BaseIndex):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::indexExtendType):
        (JSC::MacroAssemblerARM64::load64):
        (JSC::MacroAssemblerARM64::load32):
        (JSC::MacroAssemblerARM64::load16):
        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::load8):
        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
        (JSC::MacroAssemblerARM64::store64):
        (JSC::MacroAssemblerARM64::store32):
        (JSC::MacroAssemblerARM64::store16):
        (JSC::MacroAssemblerARM64::store8):
        (JSC::MacroAssemblerARM64::loadDouble):
        (JSC::MacroAssemblerARM64::loadFloat):
        (JSC::MacroAssemblerARM64::storeDouble):
        (JSC::MacroAssemblerARM64::storeFloat):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirArg.h:
        (JSC::B3::Air::Arg::index):
        (JSC::B3::Air::Arg::asBaseIndex const):
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testLoadZeroExtendIndexAddress):
        (testLoadSignExtendIndexAddress):
        (testStoreZeroExtendIndexAddress):
        (testStoreSignExtendIndexAddress):
        (addBitTests):

2021-07-16  Saam Barati  <sbarati@apple.com>

        Grab the lock in FTL::Thunks::keyForSlowPathCallThunk
        https://bugs.webkit.org/show_bug.cgi?id=227988
        <rdar://problem/80627901>

        Reviewed by Mark Lam.

        Both FTL::Thunks::keyForSlowPathCallThunk and FTL::Thunks::getSlowPathCallThunk
        both touch the thunks hash map. In r278030, when I added the lock, I grabbed it
        in getSlowPathCallThunk, but forgot to also grab it in keyForSlowPathCallThunk.

        * ftl/FTLThunks.h:
        (JSC::FTL::Thunks::keyForSlowPathCallThunk):

2021-07-16  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r279916.
        https://bugs.webkit.org/show_bug.cgi?id=228037

        some of tests are timing out

        Reverted changeset:

        "Convert small JIT pool tests into executable fuzzing"
        https://bugs.webkit.org/show_bug.cgi?id=226279
        https://commits.webkit.org/r279916

2021-07-16  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] RegExp::dumpToStream must not ref Strings since it is called concurrently
        https://bugs.webkit.org/show_bug.cgi?id=228031
        rdar://80686425

        Reviewed by Mark Lam.

        RegExp::dumpToStream's escapedPattern can return m_pattern. In that case, it is refed in the concurrent thread.
        This is wrong since StringImpl must not be ref-ed concurrently. This patch just revert this function to the old behavior.

        * runtime/RegExp.cpp:
        (JSC::RegExp::dumpToStream):

2021-07-15  Keith Miller  <keith_miller@apple.com>

        Alias JSC graph dumping options
        https://bugs.webkit.org/show_bug.cgi?id=228015

        Reviewed by Yusuke Suzuki.

        My brain seems to associate the phases with the tier we are compiling in
        rather than the type of graph we are processing. At this point it's
        probably easier to just add an alias rather than convince me otherwise.

        * runtime/OptionsList.h:

2021-07-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] SamplingProfiler should recognize RegExp execution
        https://bugs.webkit.org/show_bug.cgi?id=201702

        Reviewed by Saam Barati.

        This patch extends SamplingProfiler to recognize RegExp execution. We record
        executing RegExp in VM via MatchingContextHolder so that SamplingProfiler can detect it.
        We use MatchingContextHolder even if the RegExp is interpreter mode so that we can still
        catch non-JIT RegExp in SamplingProfiler.

        The example output is the following.

            Sampling rate: 1000.000000 microseconds. Total samples: 1830
            Top functions as <numSamples  'functionName#hash:sourceID'>
               466    'Exec#<nil>:4'
               225    '/(^|[^\\])\"\\\/Qngr\((-?[0-9]+)\)\\\/\"/g#<nil>:-1'
               173    'runBlock1#<nil>:4'
                88    '/NQ_VQ/g#<nil>:-1'
                83    '/d2/g#<nil>:-1'
                78    '/d1/g#<nil>:-1'
                70    '/\s?;\s?/#<nil>:-1'
                68    'replace#<nil>:3'
                50    '/(((\w+):\/\/)([^\/:]*)(:(\d+))?)?([^#?]*)(\?([^#]*))?(#(.*))?/#<nil>:-1'
                49    'runBlock0#<nil>:4'
                46    '#<nil>:-1'
                24    '/^\s*|\s*$/g#<nil>:-1'


            Sampling rate: 1000.000000 microseconds. Total samples: 1830

            Tier breakdown:
            -----------------------------------
            LLInt:                    13  (0.710383%)
            Baseline:                 54  (2.950820%)
            DFG:                     187  (10.218579%)
            FTL:                     612  (33.442623%)
            js builtin:               73  (3.989071%)
            Wasm:                      0  (0.000000%)
            Host:                      0  (0.000000%)
            RegExp:                  907  (49.562842%)
            C/C++:                     0  (0.000000%)
            Unknown Executable:       57  (3.114754%)


            Hottest bytecodes as <numSamples   'functionName#hash:JITType:bytecodeIndex'>
               378    'Exec#<nil>:FTL:bc#27'
               225    '/(^|[^\\])\"\\\/Qngr\((-?[0-9]+)\)\\\/\"/g#<nil>:RegExp:<nil>'
                88    '/NQ_VQ/g#<nil>:RegExp:<nil>'
                83    '/d2/g#<nil>:RegExp:<nil>'
                78    '/d1/g#<nil>:RegExp:<nil>'
                70    '/\s?;\s?/#<nil>:RegExp:<nil>'
                62    'replace#<nil>:FTL:bc#63'
                53    'Exec#<nil>:DFG:bc#27'
                50    '/(((\w+):\/\/)([^\/:]*)(:(\d+))?)?([^#?]*)(\?([^#]*))?(#(.*))?/#<nil>:RegExp:<nil>'
                46    '#<nil>:None:<nil>'
                42    'runBlock1#<nil>:FTL:bc#1795'
                29    'runBlock1#<nil>:FTL:bc#1849'
                29    'runBlock1#<nil>:FTL:bc#1741'
                24    '/^\s*|\s*$/g#<nil>:RegExp:<nil>'
                17    'runBlock1#<nil>:DFG:bc#1741'
                17    'runBlock1#<nil>:DFG:bc#1795'
                16    '/\b\w+\b/g#<nil>:RegExp:<nil>'
                14    '/TNQP=([^;]*)/i#<nil>:RegExp:<nil>'
                13    '/%\w?$/#<nil>:RegExp:<nil>'
                12    '/^ba/#<nil>:RegExp:<nil>'
                11    '/^\s*(\S*(\s+\S+)*)\s*$/#<nil>:RegExp:<nil>'
                10    'runBlock0#<nil>:FTL:bc#400'
                10    'runBlock1#<nil>:DFG:bc#1849'
                10    'Exec#<nil>:DFG:bc#16'
                 9    '/(?:ZFVR.(\d+\.\d+))|(?:(?:Sversbk|TenaCnenqvfb|Vprjrnfry).(\d+\.\d+))|(?:Bcren.(\d+\.\d+))|(?:NccyrJroXvg.(\d+(?:\.\d+)?))/#<nil>:RegExp:<nil>'
                 8    '/##yv18##/gi#<nil>:RegExp:<nil>'
                 8    '/([a-zA-Z]|\s)+/#<nil>:RegExp:<nil>'
                 7    '/JroXvg\/(\S+)/#<nil>:RegExp:<nil>'
                 7    'runBlock0#<nil>:FTL:bc#2671'
                 7    '/^([#.]?)((?:[\w\u0128-\uffff*_-]|\\.)*)/#<nil>:RegExp:<nil>'
                 6    '/##oe##/gi#<nil>:RegExp:<nil>'
                 6    'runBlock1#<nil>:FTL:bc#124'
                 6    '/[+, ]/#<nil>:RegExp:<nil>'
                 6    'runBlock1#<nil>:FTL:bc#1903'
                 6    'replace#<nil>:DFG:bc#63'
                 5    'runBlock0#<nil>:FTL:bc#3378'
                 5    '/'/g#<nil>:RegExp:<nil>'
                 5    '/##yv20##/gi#<nil>:RegExp:<nil>'
                 4    '/\?[\w\W]*(sevraqvq|punaaryvq|tebhcvq)=([^\&\?#]*)/i#<nil>:RegExp:<nil>'
                 4    'load#<nil>:None:<nil>'

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * runtime/RegExp.cpp:
        (JSC::RegExp::matchCompareWithInterpreter):
        (JSC::RegExp::dumpToStream):
        (JSC::appendLineTerminatorEscape<LChar>):
        (JSC::appendLineTerminatorEscape<UChar>):
        (JSC::escapePattern):
        (JSC::RegExp::escapedPattern const): Moved from RegExpPrototype.cpp to implement RegExp::toSourceString and RegExp::escapedPattern.
        (JSC::RegExp::toSourceString const):
        (JSC::regexpToSourceString): Deleted.
        * runtime/RegExp.h:
        * runtime/RegExpInlines.h:
        (JSC::RegExp::matchInline):
        * runtime/RegExpPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::appendLineTerminatorEscape<LChar>): Deleted.
        (JSC::appendLineTerminatorEscape<UChar>): Deleted.
        (JSC::regExpProtoGetterSourceInternal): Deleted.
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        (JSC::SamplingProfiler::processUnverifiedStackTraces):
        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
        (JSC::SamplingProfiler::StackFrame::displayName):
        (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests):
        (JSC::SamplingProfiler::StackFrame::functionStartLine):
        (JSC::SamplingProfiler::StackFrame::functionStartColumn):
        (JSC::SamplingProfiler::StackFrame::sourceID):
        (JSC::SamplingProfiler::StackFrame::url):
        (JSC::SamplingProfiler::reportTopBytecodes):
        (WTF::printInternal):
        * runtime/SamplingProfiler.h:
        * runtime/VM.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): Deleted.
        (JSC::Yarr::MatchingContextHolder::~MatchingContextHolder): Deleted.
        * yarr/YarrJIT.h:
        (JSC::Yarr::MatchingContextHolder::offsetOfStackLimit): Deleted.
        (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBuffer): Deleted.
        (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBufferSize): Deleted.
        * yarr/YarrMatchingContextHolder.h: Added.
        (JSC::Yarr::MatchingContextHolder::offsetOfStackLimit):
        (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBuffer):
        (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBufferSize):
        (JSC::Yarr::MatchingContextHolder::MatchingContextHolder):
        (JSC::Yarr::MatchingContextHolder::~MatchingContextHolder):

2021-07-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Harden defaultTimeZone retrieval
        https://bugs.webkit.org/show_bug.cgi?id=227996
        rdar://80540300

        Reviewed by Mark Lam.

        We received the report that "UTC" can appear in Intl.DateTimeFormat's default timezone.
        While we cannot reproduce it, this patch attempts to avoid using TimeZone from UCalendar
        so that the code gets the same to the old defaultTimeZone implementation.

        * runtime/JSDateMath.cpp:
        (JSC::DateCache::defaultTimeZone):
        (JSC::DateCache::timeZoneCacheSlow):

2021-07-15  Mark Lam  <mark.lam@apple.com>

        JITWorklist::waitUntilAllPlansForVMAreReady() should also be notified when plans are cancelled.
        https://bugs.webkit.org/show_bug.cgi?id=228003
        rdar://78314543

        Reviewed by Yusuke Suzuki.

        Previously, it only gets notified when plans are done compiling.  As a result, if
        JITWorklist::waitUntilAllPlansForVMAreReady() found non-ready plans and started
        waiting, and those plans were canceled, then JITWorklist::waitUntilAllPlansForVMAreReady()
        can hang indefinitely.

        This patch renames JITWorklist::::m_planCompiled to m_planCompiledOrCancelled,
        and notifies it also when plans are cancelled.

        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::waitUntilAllPlansForVMAreReady):
        (JSC::JITWorklist::removeMatchingPlansForVM):
        * jit/JITWorklist.h:
        * jit/JITWorklistThread.cpp:
        (JSC::JITWorklistThread::work):

2021-07-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add samplingProfilerIgnoreExternalSourceID option
        https://bugs.webkit.org/show_bug.cgi?id=227985

        Reviewed by Mark Lam.

        We can ignore sourceID when aggregating samples. By doing so, we can open Speedometer2 style iframes
        and still aggregate all the functions even though each script in iframe has different source ID.

        * runtime/OptionsList.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::StackFrame::sourceID):
        (JSC::SamplingProfiler::reportTopFunctions):
        * runtime/SamplingProfiler.h:

2021-07-15  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, mid-July 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=227981

        Unreviewed non-unified build fixes.

        * ftl/FTLState.cpp: Add missing B3ValueInlines.h header.
        * runtime/TemporalNow.cpp: Add missing JSCJSValueInlines.h and JSObjectInlines.h headers.
        * runtime/TemporalObject.cpp: Ditto.

2021-07-14  Devin Rousso  <drousso@apple.com>

        Implement Array.prototype.findLast and Array.prototype.findLastIndex
        https://bugs.webkit.org/show_bug.cgi?id=227939

        Reviewed by Yusuke Suzuki.

        * builtins/ArrayPrototype.js:
        (findLast): Added.
        (findLastIndex): Added.
        (JSC::ArrayPrototype::finishCreation):
        * runtime/JSTypedArrayViewPrototype.cpp:

        * builtins/TypedArrayPrototype.js:
        (findLast): Added.
        (findLastIndex): Added.
        * runtime/ArrayPrototype.cpp:
        (JSC::JSTypedArrayViewPrototype::finishCreation):

        * runtime/OptionsList.h:

2021-07-14  Michael Saboff  <msaboff@apple.com>

        [macOS] Add new entitlement to limit process to a single JIT region
        https://bugs.webkit.org/show_bug.cgi?id=227956

        Reviewed by Mark Lam.

        This macOS entitlement limits a process to a single JIT region.
        This matches the behavior on iOS.

        * Scripts/process-entitlements.sh:
        * entitlements.plist:

2021-07-14  Mark Lam  <mark.lam@apple.com>

        Speculative fix for failed scope.releaseAssertNoException() after calls to JSMap::create().
        https://bugs.webkit.org/show_bug.cgi?id=227964
        rdar://78013960

        Reviewed by Yusuke Suzuki.

        There have been reports of flaky failures on the scope.releaseAssertNoException()
        after the call to JSMap::create() in JSModuleLoader::finishCreation().

        The scope.releaseAssertNoException() says that we don't expect the JSMap::create()
        to ever throw an exception.  If the assertion is true, the only way that we can
        see an exception there is if we're throwing an asynchronous TerminationException.

        Since JSModuleLoader::finishCreation() does not have any long running loops, we can
        just DeferTerminationForAWhile and let the next exception check site throw the
        asynchronous TerminationException.  We don't want to just use DeferTermination
        because it will throw the TerminationException right at the end of
        JSModuleLoader::finishCreation(), and the caller of JSModuleLoader::finishCreation()
        may be similarly not expecting an exception to be thrown there.

        Also apply the same treatment to AbstractModuleRecord::finishCreation(), and
        getBackingMap() in WebCore for the same reason.  Other than those, other sites that
        call JSMap::create() already check for exceptions.  So, those sites do not need to
        DeferTerminationForAWhile.

        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::finishCreation):
        * runtime/JSModuleLoader.cpp:
        (JSC::JSModuleLoader::finishCreation):

2021-07-14  Keith Miller  <keith_miller@apple.com>

        Convert small JIT pool tests into executable fuzzing
        https://bugs.webkit.org/show_bug.cgi?id=226279

        Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
        actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
        Instead of testing such a small pool we should just fuzz each executable allocation that says it
        can fail.

        The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
        fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
        by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
        flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.

        Reviewed by Michael Saboff.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::numberOfDFGCompiles):
        * jit/ExecutableAllocationFuzz.cpp:
        (JSC::doExecutableAllocationFuzzing):
        * jsc.cpp:
        (runJSC):

2021-07-14  Mark Lam  <mark.lam@apple.com>

        Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
        https://bugs.webkit.org/show_bug.cgi?id=227962
        rdar://78392251

        Reviewed by Yusuke Suzuki.

        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-07-14  Yusuke Suzuki  <ysuzuki@apple.com>

        libpas executable-allocator should reserve more than 256KB for non-fail region at least
        https://bugs.webkit.org/show_bug.cgi?id=227927

        Reviewed by Keith Miller.

        libpas jit_heap has mediam allocator which allocates 128KB pages at once. However, our JSC stress tests are setting 100KB
        for small executable memory tests. As a result, under this configuration, we fail immediately after using medium allocator.

        But this test's "total size of executable memory is 100KB" is unrealistic: it is possible that only 100KB memory remains,
        but it is impossible that we reserve only 25KB for non-fail reservation. In production, we are always reserving 128MB. So
        this configuration is not realistic actually.

        So, this patch changes,

            1. If non-fail region is less than 256KB, then we add 256KB and keep this 256KB as non-fail executable allocation. If not,
                use 0.25 ratio as we are doing. This means that Options::jitMemoryReservationSize configures failable region of
                executable memory.
            2. We also revive bytesReserved and bytesAllocated to make memoryPressureMultiplier and early-fail allocation (when there is
                not enough memory and allocation can fail, then we should fail).

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):
        (JSC::ExecutableAllocator::underMemoryPressure):
        (JSC::ExecutableAllocator::memoryPressureMultiplier):
        (JSC::ExecutableAllocator::allocate):
        (JSC::ExecutableMemoryHandle::createImpl):
        (JSC::ExecutableMemoryHandle::~ExecutableMemoryHandle):
        (JSC::ExecutableMemoryHandle::shrink):
        (JSC::ExecutableMemoryHandle::sizeInBytes const): Deleted.
        * jit/ExecutableMemoryHandle.h:
        (JSC::ExecutableMemoryHandle::sizeInBytes const):
        (JSC::ExecutableMemoryHandle::ExecutableMemoryHandle):

2021-07-14  Mark Lam  <mark.lam@apple.com>

        Placate exception checker validation in operationObjectAssignUntyped.
        https://bugs.webkit.org/show_bug.cgi?id=227955
        rdar://80503746

        Reviewed by Michael Saboff.

        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):

2021-07-13  Robin Morisset  <rmorisset@apple.com>

        Invalid machine code emitted by SpeculativeJIT::emitObjectOrOtherBranch
        https://bugs.webkit.org/show_bug.cgi?id=227869
        <rdar://problem/80457566>

        Reviewed by Mark Lam.

        SpeculativeJIT::emitObjectOrOtherBranch used to check the validity of the masqueradesAsUndefined watchpoint twice, and assumed that it could not change in between.
        That is clearly incorrect as the main thread is running concurrently with it, and so the watchpoint could fire at any time.
        The fix is trivial: just check the validity once, and store the result in a boolean.
        If the watchpoint triggers later that is fine: we'll notice and cancel the compilation (see WatchpointCollectionPhase, Plan::isStillValid() and Plan::finalize()).
        The change only protects us from rare and hard-to-reproduce crashes on debug builds caused by an ASSERT firing.

        I did not add a testcase, as I can only reproduce the bug by adding an extra wait in the middle of emitObjectOrOtherBranch.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):

2021-07-13  Yijia Huang  <yijia_huang@apple.com>

        Add a new Air::Arg kind ZeroReg to let AIR recognise the new instructions/forms accepting zero register in ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227510

        Reviewed by Saam Barati.

        B3 is designed to be portable to many kinds of CPUs. However, to effectively 
        compile code to different CPUs, the compiler must eventually make explicit 
        instruction set details. Then, Air is introduced, and it is designed to target 
        individual CPU architectures and generate instructions specific to those CPUs. 

        Previously, Air don't recognize the zero register. This problem has been pointed 
        out in #174821, which was trying to introduce the new opcodes to handle the zero 
        register. 

        To solve this problem in a modular reasoning approach, a new Air operand ZeroReg 
        should be introduced. Its goal is to closely match the CPU instructions 
        accepting the zero register in ARM64. Another reason is that the new overloads 
        of the instructions taking the zero register can benefit instruction selection 
        with this implementation. 

        Here, the ZeroReg is added as a new kind for Air::Arg, which acts as a "high 
        level" operand to be emitted with the associative opcodes. In ARM64, the ZeroReg 
        would be emitted as a zero register.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::storeZero64): Deleted.
        (JSC::MacroAssemblerARM64::storeZero32): Deleted.
        (JSC::MacroAssemblerARM64::storeZero16): Deleted.
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::storeZero32): Deleted.
        (JSC::MacroAssemblerX86Common::storeZero16): Deleted.
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::storeZero64): Deleted.
        * b3/B3LowerToAir.cpp:
        * b3/air/AirArg.cpp:
        (JSC::B3::Air::Arg::jsHash const):
        (JSC::B3::Air::Arg::dump const):
        (WTF::printInternal):
        * b3/air/AirArg.h:
        (JSC::B3::Air::Arg::zeroReg):
        (JSC::B3::Air::Arg::isZeroReg const):
        (JSC::B3::Air::Arg::isGP const):
        (JSC::B3::Air::Arg::isFP const):
        (JSC::B3::Air::Arg::isValidForm const):
        (JSC::B3::Air::Arg::asZeroReg const):
        * b3/air/AirLowerStackArgs.cpp:
        (JSC::B3::Air::lowerStackArgs):
        * b3/air/AirOpcode.opcodes:
        * b3/air/opcode_generator.rb:
        * b3/testb3.h:
        * b3/testb3_1.cpp:
        (run):
        * b3/testb3_3.cpp:
        (testStoreZeroReg):

2021-07-12  Filip Pizlo  <fpizlo@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>

        New malloc algorithm
        https://bugs.webkit.org/show_bug.cgi?id=226404

        Reviewed by Yusuke Suzuki.

        Switch the ExecutableAllocator to the libpas jit_heap. The libpas jit_heap uses two size
        categories of bitfit and a large heap, and is happy to do its approximate first-fit in any
        ranges of memory you give it. Jit_heap never allocates metadata inside the memory it manages.
        Allocations and deallocations take a constant-bounded amount of time except for unusual
        situations, and are protected by fine-grained locking in most cases. Decommit follows libpas
        scavenging policy. This alone is a speed-up on Speedometer (probably about 1% or more).

        Also expose some libpas introspection via $vm.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/MacroAssemblerCodeRef.h:
        * jit/ExecutableAllocator.cpp:
        (JSC::ExecutableAllocator::underMemoryPressure):
        (JSC::ExecutableAllocator::memoryPressureMultiplier):
        (JSC::ExecutableAllocator::allocate):
        (JSC::ExecutableAllocator::committedByteCount):
        (JSC::ExecutableMemoryHandle::createImpl):
        (JSC::ExecutableMemoryHandle::~ExecutableMemoryHandle):
        (JSC::ExecutableMemoryHandle::sizeInBytes const):
        (JSC::ExecutableMemoryHandle::shrink):
        * jit/ExecutableAllocator.h:
        * jit/ExecutableMemoryHandle.h: Added.
        (JSC::ExecutableMemoryHandle::start const):
        (JSC::ExecutableMemoryHandle::end const):
        (JSC::ExecutableMemoryHandle::startAsInteger const):
        (JSC::ExecutableMemoryHandle::endAsInteger const):
        (JSC::ExecutableMemoryHandle::containsIntegerAddress const):
        (JSC::ExecutableMemoryHandle::contains const):
        (JSC::ExecutableMemoryHandle::key const):
        (JSC::ExecutableMemoryHandle::dump const):
        (JSC::ExecutableMemoryHandle::ExecutableMemoryHandle):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-07-12  Mark Lam  <mark.lam@apple.com>

        Revert r277027: breaks GC.
        https://bugs.webkit.org/show_bug.cgi?id=227888

        Reviewed by Saam Barati.

        The patch in r277027 to make deletion of GCAwareJITStubRoutines incremental has a
        bug: the routine may not be deleted yet by the incremental sweeper before the next
        GC cycle, and the GC will not be happy visiting dead cell pointers in that routine.
        There is also another bug with the triggering of sweeping.

        For now, we're reverting the patch, and will revisit this at a later time.

        * CMakeLists.txt:
        * heap/Heap.cpp:
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepSynchronously):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::mayHaveJITStubRoutinesToDelete): Deleted.
        (JSC::Heap::deleteDeadJITStubRoutines): Deleted.
        * heap/IncrementalSweeper.cpp:
        (JSC::IncrementalSweeper::doSweep):
        * heap/JITStubRoutineSet.cpp:
        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
        * heap/JITStubRoutineSet.h:
        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
        (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
        (JSC::JITStubRoutineSet::mayHaveRoutinesToDelete): Deleted.
        (JSC::JITStubRoutineSet::notifyHaveRoutinesToDelete): Deleted.
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
        * jit/JITStubRoutine.h:
        (JSC::JITStubRoutine::createSelfManagedRoutine):

2021-07-12  Yijia Huang  <yijia_huang@apple.com>

        Add SMNEGL, UMNEGL, UMADDL, and UMSUBL for ARM64 and select this instruction in Air
        https://bugs.webkit.org/show_bug.cgi?id=227857

        Reviewed by Robin Morisset.

        The previous patches have already added MNEG, MADD, MSUB, SMADDL, and SMSUBL. 
        This patch completes the corresponding signed or unsigned variants (SMNEGL, 
        UMNEGL, UMADDL, and UMSUBL) of them. In addition, this patch refactors 
        the implementation and the associative test cases of MADD, MSUB, and MNEG 
        to be more readable and maintainable w.r.t their variants.

        ------------------------------
        ### SMNEGL/UMNEGL Xd Wn Wm ###
        ------------------------------
        Signed/Unsigned Multiply-Negate Long multiplies two 32-bit register values, 
        negates the product, and writes the result to the 64-bit destination register. 
        The equivalent patterns are 

        d = -(SExt32(n) * SExt32(m)) and d = -(ZExt32(n) * ZExt32(m)) respectively.

        Given B3 IR:
        Int @0 = S/ZExt32(Trunc(ArgumentReg(%x0)))
        Int @1 = S/ZExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = Mul(@0, @1)
        Int @3 = Neg(@2)
        Void@4 = Return(@3, Terminal)

        // Old optimized AIR
        Move32      %x0, %x0,      @0
        Move32      %x1, %x1,      @1
        MultiplyNeg %x0, %x1, %x0, @3
        Ret         %x0,           @4

        // New optimized AIR
        MultiplyNegSign/ZeroExtend  %x0, %x1, %x0, @3
        Ret                         %x0,           @4

        --------------------------
        ### UMADDL Xd Wn Wm Xa ###
        --------------------------
        Unsigned Multiply-Add Long multiplies two 32-bit register values, adds a 64-bit 
        register value, and writes the result to the 64-bit destination register. The 
        equivalent patterns are 

        d = ZExt32(n) * ZExt32(m) + a or d = a + ZExt32(n) * ZExt32(m)

        Given B3 IR:
        Int @0 = ZExt32(Trunc(ArgumentReg(%x0)))
        Int @1 = ZExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = ArgumentReg(%x2)
        Int @3 = Mul(@0, @1)
        Int @4 = Add(@3, @2)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Move32        %x0, %x0,           @1
        Move32        %x1, %x1,           @2
        MultiplyAdd   %x0, %x1, %x2, %x0, @4
        Ret64         %x0,                @5

        // New optimized AIR
        MultiplyAddZeroExtend %x0, %x1, %x2, %x0, @8
        Ret                   %x0,                @9

        --------------------------
        ### UMSUBL Xd Wn Wm Xa ###
        --------------------------
        Unsigned Multiply-Subtract Long multiplies two 32-bit register values, subtracts 
        the product from a 64-bit register value, and writes the result to the 64-bit 
        destination register. The equivalent patterns are 

        d = a - ZExt32(n) * ZExt32(m)

        Given B3 IR:
        Int @0 = ZExt32(Trunc(ArgumentReg(%x0)))
        Int @1 = ZExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = ArgumentReg(%x2)
        Int @3 = Mul(@0, @1)
        Int @4 = Sub(@2, @3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Move32        %x0, %x0,           @1
        Move32        %x1, %x1,           @2
        MultiplySub   %x0, %x1, %x2, %x0, @4
        Ret64         %x0,                @5

        // New optimized AIR
        MultiplySubZeroExtend %x0, %x1, %x2, %x0, @8
        Ret                   %x0,                @9

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::multiplyNeg32):
        (JSC::MacroAssemblerARM64::multiplyAddZeroExtend32):
        (JSC::MacroAssemblerARM64::multiplySubZeroExtend32):
        (JSC::MacroAssemblerARM64::multiplyNeg64):
        (JSC::MacroAssemblerARM64::multiplyNegSignExtend32):
        (JSC::MacroAssemblerARM64::multiplyNegZeroExtend32):
        * assembler/testmasm.cpp:
        (JSC::testMultiplyAddSignExtend32):
        (JSC::testMultiplyAddZeroExtend32):
        (JSC::testMultiplySubSignExtend32):
        (JSC::testMultiplySubZeroExtend32):
        (JSC::testMultiplyNegSignExtend32):
        (JSC::testMultiplyNegZeroExtend32):
        (JSC::testMultiplyAddSignExtend32Left): Deleted.
        (JSC::testMultiplyAddSignExtend32Right): Deleted.
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testMulAddArgsLeft):
        (testMulAddArgsRight):
        (testMulAddSignExtend32ArgsLeft):
        (testMulAddZeroExtend32ArgsLeft):
        (testMulAddZeroExtend32ArgsRight):
        (testMulSubArgsLeft):
        (testMulSubArgsRight):
        (testMulSubArgsRight32):
        (testMulSubSignExtend32):
        (testMulSubZeroExtend32):
        (testMulNegArgArg):
        (testMulNegArgs):
        (testMulNegArgs32):
        (testMulNegSignExtend32):
        (testMulNegZeroExtend32):
        (testMulSubSignExtend32Args): Deleted.
        * b3/testb3_3.cpp:
        (addArgTests):

2021-07-12  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] JITCage already includes guard pages
        https://bugs.webkit.org/show_bug.cgi?id=227867

        Reviewed by Mark Lam.

        Since JITCage already includes guard pages, we do not need to allocate that additionally.

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):

2021-07-10  Saam Barati  <sbarati@apple.com>

        Continue to consult InlineAccess's Structure even after switching to a stub IC
        https://bugs.webkit.org/show_bug.cgi?id=227785

        Reviewed by Yusuke Suzuki.

        This patch fixes a crash in: stress/class-subclassing-function.js
        
        The bug is this:
        1. We initialize a StructureStubInfo to be an inline self access doing a load based on structure S.
        2. We transition to being a PolymorphicAccess based StructureStubInfo. But, we haven't
        generated code yet. We're in the buffered state. So we are still running the inline access
        from (1).  But the StructureStubInfo thinks it's a "Stub".
        3. S is collected
        4. We continue to run code from (1), because when we finalize the IC during GC, it
        doesn't think it's an inline access.
        
        The fix is to always track the structure S that we used when generating the inline
        access, and to only stop tracking it once we've generated code for the Stub.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::fromStructureStubInfo):
        (JSC::AccessCase::propagateTransitions const):
        * bytecode/AccessCase.h:
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::propagateTransitions const):
        * bytecode/PolymorphicAccess.h:
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::computeForStubInfo):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initPutByIdReplace):
        (JSC::StructureStubInfo::initInByIdSelf):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        (JSC::StructureStubInfo::visitWeakReferences):
        (JSC::StructureStubInfo::propagateTransitions):
        * bytecode/StructureStubInfo.h:

2021-07-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Workaround test262.report bug by making $ properties enumerable
        https://bugs.webkit.org/show_bug.cgi?id=227855

        Reviewed by Alexey Shvayka.

        test262.report's harness has a bug and it reports incorrect results for JSC on tests using $262 properties.
        This patch introduces a workaround which makes properties of $ enumerable.

        * jsc.cpp:

2021-07-08  Yijia Huang  <yijia_huang@apple.com>

        Add Air opcode add/sub-and-shift for ARM64 and select this instruction in Air
        https://bugs.webkit.org/show_bug.cgi?id=227509

        Reviewed by Saam Barati.

        This patch includes two modifications:
            1. Add add/sub-with-shift to Air opcode and the corresponding pattern match for 
               instruction selection.
            2. Minor fix in disassembler.

        Given the operation:

            add/sub Rd, Rn, Rm, ShiftType, amount

        ADD/SUB (shifted register), adds/subs a register value Rn and an optionally-shifted register 
        value Rm, and writes the result to the destination register Rd. The instruction selector 
        can utilize this to lowering certain patterns in B3 IR before further Air optimization. 

        The equivalent pattern would be:

            d = n +/- (m ShiftType amount)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = amount
        Int @3 = ZShr(@1, @2)
        Int @4 = Add/Sub(@0, @3)
        Void@5 = Return(@4, Terminal)

        // Old optimized AIR
        Shift   %x1, amount, %x1, @3
        Add/Sub %x0,    %x1, %x0, @4
        Ret     %x0,              @5

        // New optimized AIR
        Add(Sub)Shift %x0, %x1, amount, %x0, @4
        Ret           %x0,                   @5

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::addLeftShift32):
        (JSC::MacroAssemblerARM64::addRightShift32):
        (JSC::MacroAssemblerARM64::addUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::addLeftShift64):
        (JSC::MacroAssemblerARM64::addRightShift64):
        (JSC::MacroAssemblerARM64::addUnsignedRightShift64):
        (JSC::MacroAssemblerARM64::subLeftShift32):
        (JSC::MacroAssemblerARM64::subRightShift32):
        (JSC::MacroAssemblerARM64::subUnsignedRightShift32):
        (JSC::MacroAssemblerARM64::subLeftShift64):
        (JSC::MacroAssemblerARM64::subRightShift64):
        (JSC::MacroAssemblerARM64::subUnsignedRightShift64):
        * assembler/testmasm.cpp:
        (JSC::testAddWithLeftShift32):
        (JSC::testAddWithRightShift32):
        (JSC::testAddWithUnsignedRightShift32):
        (JSC::testAddWithLeftShift64):
        (JSC::testAddWithRightShift64):
        (JSC::testAddWithUnsignedRightShift64):
        (JSC::testSubWithLeftShift32):
        (JSC::testSubWithRightShift32):
        (JSC::testSubWithUnsignedRightShift32):
        (JSC::testSubWithLeftShift64):
        (JSC::testSubWithRightShift64):
        (JSC::testSubWithUnsignedRightShift64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        (checkUsesInstruction):
        * b3/testb3_2.cpp:
        (testAddWithLeftShift32):
        (testAddWithRightShift32):
        (testAddWithUnsignedRightShift32):
        (testAddWithLeftShift64):
        (testAddWithRightShift64):
        (testAddWithUnsignedRightShift64):
        (testSubWithLeftShift32):
        (testSubWithRightShift32):
        (testSubWithUnsignedRightShift32):
        (testSubWithLeftShift64):
        (testSubWithRightShift64):
        (testSubWithUnsignedRightShift64):
        (addBitTests):
        * disassembler/ARM64/A64DOpcode.cpp:
        * disassembler/ARM64/A64DOpcode.h:
        (JSC::ARM64Disassembler::A64DOpcodeAddSubtractShiftedRegister::immediate6):
        (JSC::ARM64Disassembler::A64DOpcodeLogicalShiftedRegister::immediate6):

2021-07-08  Keith Miller  <keith_miller@apple.com>

        display-profiler-output should be able to print disassembly for the FTL
        https://bugs.webkit.org/show_bug.cgi?id=227798

        Reviewed by Saam Barati.

        Right now running JSC with the bytecode profiler will not print
        disassembly for FTL code. This patch adds this support. In order to get
        execution counts there is a callback at the transition between each
        DFG node in the Air disassembler. Since B3 code move parts of
        DFG nodes to different basic blocks we don't include execution
        counts in the dump. However, the DFG-only graph printed before
        the disassembly will still have the counts.

        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLState.cpp:
        (JSC::FTL::State::dumpDisassembly):
        * ftl/FTLState.h:
        (JSC::FTL::State::dumpDisassembly):

2021-07-08  Yusuke Suzuki  <ysuzuki@apple.com>

        Use JSC::Yarr::flagsString to get string representation of RegExp flags
        https://bugs.webkit.org/show_bug.cgi?id=227790

        Reviewed by Keith Miller.

        * yarr/YarrFlags.h:

2021-07-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Clean up RegExp flag code
        https://bugs.webkit.org/show_bug.cgi?id=227786

        Reviewed by Filip Pizlo.

        I found a bug in regexpToSourceString (used for RegExp's dump code), and it motivates me to clean up
        all RegExp flag handling code. We define RegExp flags as a macro and updating that macro updates all
        RegExp flag handling code too.

        * runtime/RegExp.cpp:
        (JSC::RegExpFunctionalTestCollector::outputOneTest):
        (JSC::regexpToSourceString):
        * runtime/RegExp.h:
        * runtime/RegExpPrototype.cpp:
        (JSC::flagsString):
        * yarr/YarrFlags.cpp:
        (JSC::Yarr::parseFlags):
        (JSC::Yarr::flagsString):
        * yarr/YarrFlags.h:

2021-07-07  Saam Barati  <sbarati@apple.com>

        JSArrayBufferView::byteOffsetConcurrently has a race when using PAC
        https://bugs.webkit.org/show_bug.cgi?id=227765

        Reviewed by Mark Lam.

        We were calling JSArrayBufferView::vector(), which does PAC validation
        using the length() of the array. However, this can race with JSArrayBufferView::detach,
        which sets the length to zero, leading to sadness on the compiler thread.

        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::vectorWithoutPACValidation const):
        * runtime/JSArrayBufferViewInlines.h:
        (JSC::JSArrayBufferView::byteOffsetImpl):

2021-07-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Fix Object.assign fast path to accept undefined/null
        https://bugs.webkit.org/show_bug.cgi?id=227769
        rdar://80264271

        Reviewed by Saam Barati.

        Object.assign can accept undefined or null as a second (or latter) parameters.
        If it is passed, the parameter is just ignored. Previous DFG / FTL optimization patch
        does not handle this case.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileObjectAssign):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign):
        * runtime/ObjectConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectConstructorInlines.h:
        (JSC::objectAssignFast):

2021-07-07  Mark Lam  <mark.lam@apple.com>

        Heap::waitForCollector() needs to set m_mutatorDidRun.
        https://bugs.webkit.org/show_bug.cgi?id=227782
        rdar://78326474

        Reviewed by Saam Barati.

        Heap::waitForCollector() is one of 2 clients of Heap::stopIfNecessarySlow(unsigned oldState).
        The other client, Heap::stopIfNecessarySlow() sets m_mutatorDidRun to true after
        calling Heap::stopIfNecessarySlow(unsigned oldState).  Heap::waitForCollector()
        needs to do the same.  Constraint solvers rely on this.

        Without this, one fall out we've seen is that DOMGCOutputConstraint fails to
        visitOutputConstraints, and as a result, opaqueRoots may not get updated.  This
        issue was caught by the GC verifier.

        * heap/Heap.cpp:
        (JSC::Heap::waitForCollector):

2021-07-07  Michael Saboff  <msaboff@apple.com>

        fitcored crashes at JavaScriptCore: JSC::Heap::releaseAccessSlow
        https://bugs.webkit.org/show_bug.cgi?id=227767

        Reviewed by Geoffrey Garen.

        Speculative fix for this crash.  We are crashing while destroying the VM as we are about to
        release the JSLock.  In JSLock::willReleaseLock(), we release heap access.  Therefore we don't
        need to release it again when undertaking the various shutdown steps in the VM destructor.

        Added a new scope class that will only release and then acquire heap access if the caller
        currently has heap access.

        * heap/ReleaseHeapAccessScope.h:
        (JSC::ReleaseHeapAccessIfNeededScope::ReleaseHeapAccessIfNeededScope):
        (JSC::ReleaseHeapAccessIfNeededScope::~ReleaseHeapAccessIfNeededScope):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::waitUntilAllPlansForVMAreReady):

2021-07-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not allocate JITWorklist if JIT is disabled
        https://bugs.webkit.org/show_bug.cgi?id=227734

        Reviewed by Mark Lam.

        Previously, this code was doing,

            if (Options::useJIT())
                DFG::iterateCodeBlocksForGC(visitor, m_vm, func);

        But r278082 changed it to

            JITWorklist::ensureGlobalWorklist().iterateCodeBlocksForGC(visitor, m_vm, func);

        As a result, we are always allocating JITWorklist even JIT is not enabled.
        This patch fixes the behavior not to allocate JITWorklist.

        * heap/Heap.cpp:
        (JSC::Heap::iterateExecutingAndCompilingCodeBlocks):

2021-07-06  Yusuke Suzuki  <ysuzuki@apple.com>

        r270214 broke testb3 on arm64e
        https://bugs.webkit.org/show_bug.cgi?id=227713

        Reviewed by Saam Barati.

        ARM64E CAS lacks isBranch case. This patch adds isBranch implementation.
        We also adjust disasm scanning test to support CAS in ARM64E.

        * assembler/testmasm.cpp:
        (JSC::testAtomicStrongCASFill8):
        (JSC::testAtomicStrongCASFill16):
        * b3/B3LowerToAir.cpp:
        * b3/testb3_8.cpp:
        (testAtomicWeakCAS):
        (testAtomicStrongCAS):
        (testAtomicXchg):

2021-07-06  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, build fix after r279630
        https://bugs.webkit.org/show_bug.cgi?id=223166

        * DerivedSources-input.xcfilelist:
        * DerivedSources-output.xcfilelist:

2021-07-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r279546, r279554, r279558 and r279567.
        https://bugs.webkit.org/show_bug.cgi?id=227732

        Speedometer/jQuery-TodoMVC 2-3% regression

        Reverted changesets:

        "[WebIDL] Rework runtime enabled properties leveraging
        PropertyCallback"
        https://bugs.webkit.org/show_bug.cgi?id=227275
        https://commits.webkit.org/r279546

        "[WebIDL] Generate constructor's hash table in
        GenerateConstructorHelperMethods"
        https://bugs.webkit.org/show_bug.cgi?id=227668
        https://commits.webkit.org/r279554

        "[WebIDL] Simplify generation of runtime conditionally read-
        write attributes"
        https://bugs.webkit.org/show_bug.cgi?id=227672
        https://commits.webkit.org/r279558

        "Use AbortSignal's [PrivateIdentifier] whenSignalAborted()
        static method"
        https://bugs.webkit.org/show_bug.cgi?id=227673
        https://commits.webkit.org/r279567

2021-07-06  Philip Chimento  <pchimento@igalia.com>

        [JSC] Implement Temporal
        https://bugs.webkit.org/show_bug.cgi?id=223166

        Reviewed by Yusuke Suzuki.

        Intended to be the first patch in a stack. Adds boilerplate for
        Temporal in order to unblock further parallelizable work on this bug.

        This patch adds a feature flag for Temporal, and a toplevel Temporal
        global containing only Temporal.now, which is itself an empty object.
        These objects will be further populated in later patches.

        * CMakeLists.txt: Add TemporalObject and TemporalNow. Property lookup
          table in TemporalObject.
        * DerivedSources.make: Add TemporalObject property lookup table header.
        * JavaScriptCore.xcodeproj/project.pbxproj: Add new files.
        * Sources.txt: Add TemporalObject and TemporalNow.
        * runtime/CommonIdentifiers.h: Add 'Temporal' property key.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init): Create the Temporal global if the feature
          flag is enabled.
        * runtime/OptionsList.h: Add useTemporal feature flag.
        * runtime/TemporalNow.cpp: Added.
        (JSC::TemporalNow::TemporalNow):
        (JSC::TemporalNow::create):
        (JSC::TemporalNow::createStructure):
        (JSC::TemporalNow::finishCreation):
        * runtime/TemporalNow.h: Added.
        * runtime/TemporalObject.cpp: Added.
        (JSC::createNowObject):
        (JSC::TemporalObject::TemporalObject):
        (JSC::TemporalObject::create):
        (JSC::TemporalObject::createStructure):
        (JSC::TemporalObject::finishCreation):
        * runtime/TemporalObject.h: Added.

2021-07-06  Yijia Huang  <yijia_huang@apple.com>

        Fix type error in testb3
        https://bugs.webkit.org/show_bug.cgi?id=227722

        Reviewed by Mark Lam.

        Fix type error in testb3. Shift amount should be 32-bit constant.

        * b3/testb3_3.cpp:
        (testInsertSignedBitfieldInZero64):
        (testExtractSignedBitfield64):

2021-07-05  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize Object.assign and putDirectInternal
        https://bugs.webkit.org/show_bug.cgi?id=227677

        Reviewed by Filip Pizlo.

        This patch improves Object.assign performance (and this requires putDirectInternal improvement).

        1. Object.assign is handled by DFG / FTL as ObjectAssign node
        2. We found that putDirectInternal is suboptimal. This patch removes several bottlenecks. They are super critical from the measurement of
           microbenchmarks.
            2.1. Creating and destroying DeferredStructureTransitionWatchpointFire is not free. We should do that only when we need it.
            2.2. Before r277620, we are checking m_replacementWatchpointSets's nullptr and that was fast. But after that, we are always
                 calling HashMap::get, and it is not inlined. This means that if we have StructureRareData, we are always calling HashMap::get
                 even though there is no m_replacementWatchpointSets set. This patch adds HashMap::isNullStorage to avoid this call by inlinely
                 check this via `LIKELY(m_replacementWatchpointSets.isNullStorage())`.
            2.3. Structure::addPropertyTransitionToExistingStructure has very cheap fast path and we must inline them to get performance benefit
                 for major single-transition case.

        Added microbenchmarks show significant performance improvements. And Speedometer2 shows 0.6 - 1.0% improvement.

                                                 ToT                     Patched

            object-assign-transition      105.2539+-0.2970     ^     88.8046+-0.2029        ^ definitely 1.1852x faster
            object-assign-replace         116.1568+-0.0905     ^     75.0673+-0.0658        ^ definitely 1.5474x faster

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/Watchpoint.cpp:
        (JSC::DeferredWatchpointFire::fireAllSlow):
        (JSC::DeferredWatchpointFire::DeferredWatchpointFire): Deleted.
        (JSC::DeferredWatchpointFire::~DeferredWatchpointFire): Deleted.
        (JSC::DeferredWatchpointFire::fireAll): Deleted.
        * bytecode/Watchpoint.h:
        (JSC::DeferredWatchpointFire::DeferredWatchpointFire):
        (JSC::DeferredWatchpointFire::fireAll):
        (JSC::FireDetail::FireDetail): Deleted.
        (JSC::FireDetail::~FireDetail): Deleted.
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileObjectAssign):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign):
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::deleteProperty):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::putDirectInternal):
        * runtime/ObjectConstructor.cpp:
        (JSC::objectAssignGeneric):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectConstructor.h:
        * runtime/ObjectConstructorInlines.h: Added.
        (JSC::canPerformFastPropertyEnumerationForObjectAssign):
        * runtime/Structure.cpp:
        (JSC::StructureTransitionTable::singleTransition const): Deleted.
        (JSC::StructureTransitionTable::get const): Deleted.
        (JSC::Structure::addPropertyTransitionToExistingStructureImpl): Deleted.
        (JSC::Structure::addPropertyTransitionToExistingStructure): Deleted.
        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently): Deleted.
        * runtime/Structure.h:
        * runtime/StructureInlines.h:
        (JSC::Structure::didReplaceProperty):
        (JSC::Structure::propertyReplacementWatchpointSet):
        (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
        (JSC::Structure::addPropertyTransitionToExistingStructure):
        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
        (JSC::StructureTransitionTable::singleTransition const):
        (JSC::StructureTransitionTable::get const):

2021-07-06  Yijia Huang  <yijia_huang@apple.com>

        Fix instruction check failure of UBFX and SBFIZ in testb3 due to the speculative fix in bug 227554
        https://bugs.webkit.org/show_bug.cgi?id=227563

        Reviewed by Filip Pizlo.

        This patch includes two modifications to resolve rdar://79978150:
            1. Fix the bug caused by the patch introducing BFI.
            2. Discard the corresponding speculative fix in https://bugs.webkit.org/show_bug.cgi?id=227554.

        The previous patch, added bit field insert (BFI) to AIR opcode, causes the Gmail page 
        hanging issue on Safari. The root cause is the incorrect definition of register role in 
        BFI's AIR opcode. Since BFI inserts a bit field at the low end of the destination register 
        while keeping the high bit unchanged, the destination register should have both roles of 
        use and define simultaneously, which is not (missing use) in the previous patch. 

        This will result in the loss of preserving the value of the destination register, 
        which does happen when browsing the Gmail page on Safari.

            // B3 IR snippets from Gmail
            Int32 b@23  = Add(b@104, b@111, D@100)
            ...
            Int32 b@55  = Const32(65535, D@50)
            Int32 b@137 = BitAnd(b@118, $65535(b@55), D@160)
            Int32 b@168 = Const32(16, D@40)
            Int32 b@141 = Shl(b@137, $16(b@168), D@163)
            Int32 b@143 = BitAnd(b@23, $65535(b@55), D@166)
            Int32 b@144 = BitOr(b@141, b@143, D@169)

        The pattern of BFI is d = ((n & mask1) << lsb) | (d & mask2). So, it is obvious that 
        BFI can be utilized in b@144 where the d is b@23.

            // Incorrect AIR opcode of BFI
            arm64: InsertBitField32 U:G:32, U:G:32, U:G:32, ZD:G:32
                Tmp, Imm, Imm, Tmp

            // Air w/o use role
            Add32            %x3, %x7, %x7,      b@23
            ...
            InsertBitField32 %x3, $16, $16, %x4, b@144

            // Generated code w/o use role
            add      w7, w3,  w7
            ...
            bfi      w4, w3, #16, #16

        In Air, the added value is stored in the w7. But the value is not preserved after 
        lowering with BFI. To fix this, the use role should be enabled for the destination 
        register.

            // Correnct AIR opcode of BFI
            arm64: InsertBitField32 U:G:32, U:G:32, U:G:32, UZD:G:32
                Tmp, Imm, Imm, Tmp

            // Air w/ use role
            Add32            %x3, %x7, %x7,      b@23
            ...
            Move32           %x7, %x4,           b@144
            InsertBitField32 %x3, $16, $16, %x4, b@144

            // Generated code w/ use role
            add      w7, w3, w7
            ...
            ubfx     x4, x7,  #0, #32
            bfi      w4, w3, #16, #16

        In addition, BFXIL, which has pattern d = ((n >> lsb) & mask1) | (d & mask2), also needs 
        the similar update.

        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3_2.cpp:
        (testInsertBitField32):
        (testInsertBitField64):
        (testExtractInsertBitfieldAtLowEnd32):
        (testExtractInsertBitfieldAtLowEnd64):
        * runtime/OptionsList.h:

2021-07-04  Robin Morisset  <rmorisset@apple.com>

        ActiveScratchBufferScope should take the buffer as argument
        https://bugs.webkit.org/show_bug.cgi?id=227670
        rdar://80011612

        Reviewed by Mark Lam.

        https://bugs.webkit.org/show_bug.cgi?id=227013 created ActiveScratchBufferScope.
        It is used by operations that can cause the GC to run, to mark as roots the contents of the scratch buffer that is live during that time (if any).
        The bug is that it simply asks the VM for a scratch buffer of the right size, but this will always return the last scratch buffer, and not necessarily the one that the operation is actually using.

        A fairly simple fix is to pass it directly the scratch buffer, since the operation normally can get it easily enough.
        In most cases the operation has access to the m_buffer field of the ScratchBuffer, but getting a pointer to the entire structure from that is fairly simple (I added ScratchBuffer::fromData() to do so).

        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOSRExit.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewArray):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::haveABadTime):
        * runtime/VM.h:
        (JSC::ScratchBuffer::fromData):
        * runtime/VMInlines.h:
        (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope):
        (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope):

2021-07-04  Alexey Shvayka  <shvaikalesh@gmail.com>

        [WebIDL] Simplify generation of runtime conditionally read-write attributes
        https://bugs.webkit.org/show_bug.cgi?id=227672

        Reviewed by Sam Weinig.

        * runtime/Lookup.h:
        (JSC::HashTableValue::makeReadOnlyCopy const):

2021-07-03  Alexey Shvayka  <shvaikalesh@gmail.com>

        [WebIDL] Rework runtime enabled properties leveraging PropertyCallback
        https://bugs.webkit.org/show_bug.cgi?id=227275

        Reviewed by Saam Barati.

        To make the implementation of WebIDL runtime enabled properties independent of eager
        property reification, this change:

        1. Introduces IsLazyPropertyEnabledCallback, which is needed separately from existing
           value callback to maintain the invariant that reifyStaticProperty() always puts a
           property, and to keep enumeration fast.

           Calling disableCaching() isn't enough to achieve correct [[Get]] inline caching,
           so isTaintedByOpaqueObject() is leveraged to prohibit caching of runtime disabled
           properties, just like in operationTryGetByIdOptimize().

           The only case that might seem weird is runtime disabled properties, which were
           enabled after all static properties were reified via [[Delete]], are not appearing.
           It's fixable, yet there is currently no demand for it.

        2. Adds support for LazyPropertyCallback returning GetterSetter / CustomGetterSetter,
           ensuring correct structure flags and slot initialization. Previously, the callback
           was used to init only objects and constructors, using putDirect() unconditionally.

           To avoid mixing other non-basic attributes with PropertyCallback, which would require
           hoisting of checks against PropertyCallback and complicating attribute validation in
           HashTableValue methods, this patch checks the type of callback's return value instead.

           In the future, sticking to this approach will make returning CustomValue impossible
           as it can't be distinguished from CustomAccessor. That's fine because all present
           CustomValue usages merely do lazy init, which PropertyCallback is better suited for.

        Also, this patch:

        3. Expands setUpStaticFunctionSlot() to handle constant integers so the code using
           `Node.ELEMENT_NODE` & friends doesn't regress (proven by attached microbenchmark).

        4. Removes extra checks from setUpStaticPropertySlot(), which is called only on
           non-reified properties.

        5. Removes invariant that DOMJITAttribute property is read-only, which was broken
           by `document.body` having a non-JIT custom setter. This aligns non-reified
           properties with structure ones.

        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setupGetByIdPrototypeCache):
        * runtime/HasOwnPropertyCache.h:
        (JSC::HasOwnPropertyCache::tryAdd):
        * runtime/JSObject.cpp:
        (JSC::lookupPropertyForPut):
        (JSC::JSObject::putInlineSlow):
        (JSC::JSObject::reifyAllStaticProperties):
        * runtime/JSObject.h:
        (JSC::JSObject::getOwnNonIndexPropertySlot):
        (JSC::JSObject::fillStructurePropertySlot):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getNonReifiedStaticPropertyNames):
        * runtime/Lookup.cpp:
        (JSC::setUpStaticPropertySlot):
        (JSC::setUpStaticFunctionSlot): Deleted.
        * runtime/Lookup.h:
        (JSC::HashTableValue::isLazyPropertyEnabled const):
        (JSC::getStaticPropertySlotFromTable):
        (JSC::reifyStaticProperty):
        (JSC::reifyStaticProperties):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-07-02  Keith Miller  <keith_miller@apple.com>

        Add 10 more unified source cpp files for JSC
        https://bugs.webkit.org/show_bug.cgi?id=227643

        Reviewed by Alex Christensen.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Scripts/generate-unified-sources.sh:
        * UnifiedSources-output.xcfilelist:

2021-07-02  Philippe Normand  <pnormand@igalia.com>

        [GTK] Add new revision variable in pkgconfig file
        https://bugs.webkit.org/show_bug.cgi?id=227629

        Reviewed by Michael Catanzaro.

        * javascriptcoregtk.pc.in: Include SVN_REVISION as revision variable, useful for apps to
        know on which upstream SVN revision their WebKitGTK-based app is built on.

2021-07-01  Yijia Huang  <yijia_huang@apple.com>

        Remove unnecessary canBeInternal invocations to mitigate the cost of potential unmatched patterns in B3LowerToAir
        https://bugs.webkit.org/show_bug.cgi?id=227508

        Reviewed by Filip Pizlo.

        The bit pattern doesn't cause worse code generation in the all-internals-are-captured 
        case. So, they don't need canBeInternal checks which might terminate potential matched 
        scenarios.

        The equivalent pattern of SBFIZ is ((src << amount) >> amount) << lsb. Given the code:

        a = x << C
        b = a >> C
        c = b << D

        print(a)
        print(b)
        print(c)

        The pattern won't match because of !canBeInternal for a and b (useCounts > 1). 
        So, this would emit three separate instructions. But if we removed canBeInternal, 
        it would still be just three separate instructions, and they wouldn't be any more 
        expensive. Suppose the print(b) is removed, above. Then, with the canBeInternal check, 
        it is emitting three instructions. Without the canBeInternal check, it would emit only 
        two (x << C and SBFIZ to compute c). And that would be less expensive.

        * b3/B3LowerToAir.cpp:

2021-07-01  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to use EXTR supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227171

        Reviewed by Robin Morisset.

        This patch includes two modifications:
            1. Introduce a strength reduction rule to zero extend bitfield.
            2. Add Extract Register (EXTR) to Air opcode to serve instruction selector.

        -------------------------------------------------------
        ### Part A zero extend bitfield ###
        -------------------------------------------------------
        A new strength reduction rule is added for the canonical form of the zero-extend 
        bitfield.

        Turn this: ZShr(Shl(value, amount)), amount)
        Into this: BitAnd(value, mask)

        with constraints:
        1. 0 <= amount < datasize
        2. width = datasize - amount
        3. mask is !(mask & (mask + 1)) where bitCount(mask) == width

        -------------------
        ### Part B EXTR ###
        -------------------

        Given instruction:
        extr Rd, Rn, Rm, lowWidth

        Extract register (EXTR) extracts a register from a pair of registers, where 
        concat = Rn:Rm and Rd = concat<lowWidth + datasize - 1:lowWidth>.

        The equivalent pattern of this instruction is:

        d = ((n & mask) << highWidth) | (m >> lowWidth)
        highWidth = datasize - lowWidth
        mask = (1 << lowWidth) - 1

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = mask
        Int @3 = BitAnd(@0, @2)
        Int @4 = highWidth
        Int @5 = Shl(@3, @4)
        Int @6 = lowWidth
        Int @7 = ZShr(@1, @6)
        Int @8 = BitOr(@7, @5)
        Void@9 = Return(@10, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        InsertUnsignedBitfieldInZero %x0, highWidth, lowWidth, %x0, @5
        Urshift                      %x1,  lowWidth,      %x1,      @7
        Or                           %x0,       %x1,      %x0,      @8
        Ret                          %x0,                           @9

        After Adding BIC:
        // New optimized AIR
        ExtractRegister   %x0, %x1, lowWidth, %x0, @8
        Ret               %x0,                     @9

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::extractRegister32):
        (JSC::MacroAssemblerARM64::extractRegister64):
        * assembler/testmasm.cpp:
        (JSC::testExtractRegister32):
        (JSC::testExtractRegister64):
        * b3/B3LowerToAir.cpp:
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testBitfieldZeroExtend32):
        (testBitfieldZeroExtend64):
        (testExtractRegister32):
        (testExtractRegister64):
        (addBitTests):

2021-06-30  Saam Barati  <sbarati@apple.com>

        Turn off data ICs by default
        https://bugs.webkit.org/show_bug.cgi?id=227334
        <rdar://problem/79802812>

        Reviewed by Yusuke Suzuki.

        There are GC crashes that are caused by access data IC sharing. This
        patch is both turning off data IC sharing by default, and turning off data
        ICs by default.
        
        We should re-enable this once we figure out the issue:
        https://bugs.webkit.org/show_bug.cgi?id=227551
        
        Some of our testing modes are still running with data ICs on, so the code doesn't
        bit rot. And a select few tests are running with data IC sharing on, for
        similar reasons, even though we know it has issues. If those tests start
        crashing, we'll just disable sharing completely until the issue is resolved.

        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * runtime/OptionsList.h:

2021-06-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Stop generating default parameter code if class constructor is called without 'new'
        https://bugs.webkit.org/show_bug.cgi?id=227547
        rdar://78821453

        Reviewed by Mark Lam.

        We already do not generate body bytecode when class constructor is called without 'new' because many features including "super()" assume
        that they generate bytecode only when it is called as a constructor. But we are not doing that for default parameters' bytecode generation.
        This patch stops generating bytecode for default parameters if class constructor is called without 'new'.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::generate):
        (JSC::BytecodeGenerator::BytecodeGenerator):
        * runtime/ConstructorKind.h:

2021-06-30  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Private names should be handled by usedVariables mechanism
        https://bugs.webkit.org/show_bug.cgi?id=227476
        rdar://76049469

        Reviewed by Saam Barati.

        Private name handling in the current parser has many problems.

            1. The parser backtracks when it sees destructuring assignment, arrow function etc. In that case, the discarded code
               must not have any effect on the outside of that code. However, private name handling is annotating "used" of the
               upper scopes, which is wrong.
            2. In class expression, private name lookup intentionally skips the class-scope when parsing class heritage. But this
               is not correct since CodeBlock will perform lookup on the normal scope chain and this will look into the class-scope
               inconsistently. This means that we could encounter different private name at runtime. (it is tested in the added test).
            3. We skip inner function parsing when it is parsed previously. At that case, we must preserve private name annotation,
               but restored function information does not preserve that.

        This patch changes how private name is handled.

            1. We were anyway defining #XXX variables which holds private symbols. So we track "use" information by the mechanism used
               for usual variables. We remove Used / Declared bits from PrivateNameEntry since they are not necessary at runtime, and
               these information is handled / tracked in Parser's Scope. For backtracking, we already have a mechanism to roll-back
               m_usedVariables, so using variable mechanism automatically fixes the problem.
            2. We define class-head-scope separately from class-scope. class-heritage expression can see class name, but it cannot use
               private names. Previously, our implementation attempted to achieve that by hacky way: skipping this class-scope for private
               names only while parsing class-heritage. But this was wrong since it does not consider CodeBlock's linking phase as described
               in the problem (2). Instead, we just define class-head-scope which holds class constructor name.
            3. We clean up popScopeInternal to populate lexical-variables and function-stack. Previously, we are stealing them before popping
               the scope when necessary, but this is a hack and a bit wrong since scope's popping operation needs to access these information
               in some cases. Instead, popScopeInternal populates them after popping the scope.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::pushClassHeadLexicalScope):
        (JSC::BytecodeGenerator::popClassHeadLexicalScope):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ClassExprNode::emitBytecode):
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createClassExpr):
        (JSC::ASTBuilder::createBlockStatement):
        (JSC::ASTBuilder::createForLoop):
        (JSC::ASTBuilder::createForInLoop):
        (JSC::ASTBuilder::createForOfLoop):
        (JSC::ASTBuilder::createTryStatement):
        (JSC::ASTBuilder::createSwitchStatement):
        * parser/NodeConstructors.h:
        (JSC::ForNode::ForNode):
        (JSC::TryNode::TryNode):
        (JSC::ClassExprNode::ClassExprNode):
        (JSC::SwitchNode::SwitchNode):
        (JSC::BlockNode::BlockNode):
        (JSC::EnumerationNode::EnumerationNode):
        (JSC::ForInNode::ForInNode):
        (JSC::ForOfNode::ForOfNode):
        * parser/Nodes.cpp:
        (JSC::ScopeNode::ScopeNode):
        (JSC::ProgramNode::ProgramNode):
        (JSC::ModuleProgramNode::ModuleProgramNode):
        (JSC::EvalNode::EvalNode):
        (JSC::FunctionNode::FunctionNode):
        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
        * parser/Nodes.h:
        (JSC::VariableEnvironmentNode::VariableEnvironmentNode): Deleted.
        * parser/Parser.cpp:
        (JSC::isPrivateFieldName):
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseForStatement):
        (JSC::Parser<LexerType>::parseSwitchStatement):
        (JSC::Parser<LexerType>::parseTryStatement):
        (JSC::Parser<LexerType>::parseBlockStatement):
        (JSC::Parser<LexerType>::parseFunctionDeclarationStatement):
        (JSC::Parser<LexerType>::parseFunctionInfo):
        (JSC::Parser<LexerType>::parseClass):
        (JSC::Parser<LexerType>::parseBinaryExpression):
        (JSC::Parser<LexerType>::parseMemberExpression):
        (JSC::Parser<LexerType>::usePrivateName): Deleted.
        * parser/Parser.h:
        (JSC::Scope::finalizeLexicalEnvironment):
        (JSC::Scope::takeLexicalEnvironment):
        (JSC::Scope::takeDeclaredVariables):
        (JSC::Scope::takeFunctionDeclarations):
        (JSC::Scope::forEachUsedVariable):
        (JSC::Scope::usePrivateName):
        (JSC::Scope::currentUsedVariablesSize):
        (JSC::Parser::popScopeInternal):
        (JSC::Parser::popScope):
        (JSC::Parser<LexerType>::parse):
        (JSC::Scope::copyUndeclaredPrivateNamesTo): Deleted.
        (JSC::Scope::hasUsedButUndeclaredPrivateNames const): Deleted.
        (JSC::Parser::privateNameScope): Deleted.
        (JSC::Parser::copyUndeclaredPrivateNamesToOuterScope): Deleted.
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createClassExpr):
        (JSC::SyntaxChecker::createBlockStatement):
        (JSC::SyntaxChecker::createForLoop):
        (JSC::SyntaxChecker::createForInLoop):
        (JSC::SyntaxChecker::createForOfLoop):
        (JSC::SyntaxChecker::createTryStatement):
        (JSC::SyntaxChecker::createSwitchStatement):
        * parser/VariableEnvironment.cpp:
        (JSC::VariableEnvironmentEntry::dump const):
        (JSC::VariableEnvironment::declarePrivateField):
        (JSC::VariableEnvironment::declarePrivateAccessor):
        (JSC::VariableEnvironment::declarePrivateMethod):
        (JSC::VariableEnvironment::dump const):
        * parser/VariableEnvironment.h:
        (JSC::VariableEnvironment::declarePrivateField):
        (JSC::VariableEnvironment::privateNameEnvironment):
        (JSC::VariableEnvironment::addPrivateNamesFrom):
        (JSC::PrivateNameEntry::isUsed const): Deleted.
        (JSC::PrivateNameEntry::isDeclared const): Deleted.
        (JSC::PrivateNameEntry::setIsUsed): Deleted.
        (JSC::PrivateNameEntry::setIsDeclared): Deleted.
        (JSC::VariableEnvironment::usePrivateName): Deleted.
        (JSC::VariableEnvironment::copyPrivateNamesTo const): Deleted.
        (JSC::VariableEnvironment::copyUndeclaredPrivateNamesTo const): Deleted.

2021-06-30  Mark Lam  <mark.lam@apple.com>

        ARM64: Disable selection of BFI instruction variants by default.
        https://bugs.webkit.org/show_bug.cgi?id=227554
        rdar://79978150

        Reviewed by Saam Barati.

        We suspect that this may have caused some hangs.  Disabling while we investigate.

        * b3/B3LowerToAir.cpp:
        * b3/testb3_2.cpp:
        (testInsertBitField32):
        (testInsertBitField64):
        * runtime/OptionsList.h:

2021-06-29  Joonghun Park  <jh718.park@samsung.com>

        Remove "function declared ‘static’ but never defined" build warnings since r278971.
        https://bugs.webkit.org/show_bug.cgi?id=227436

        This patch removes the build warnings below.
        warning: ‘bool JSC::cannotBeIdentPartOrEscapeStart(LChar)’ declared ‘static’ but never defined [-Wunused-function]

        Reviewed by Michael Catanzaro.

        * runtime/LiteralParser.cpp: Add definitions for cannotBeIdentPartOrEscapeStart.
        (JSC::cannotBeIdentPartOrEscapeStart):

2021-06-29  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to use SBX and SBFIZ supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227203

        Reviewed by Filip Pizlo.

        This patch includes two modifications:
            1. Introduce a strength reduction rule for sign extending bitfield.
            2. Add Signed Bitfield Extract (SBFX) and Signed Bitfield Insert 
               in Zero (SBFIZ) to Air opcode to serve instruction selector.

        -------------------------------------------------------
        ### Part A Sign extending from a variable bit-width ###
        -------------------------------------------------------
        According to Bit Twiddling Hacks, there are two ways to sign extend bitfield.
        (https://graphics.stanford.edu/~seander/bithacks.html#VariableSignExtend)

        int bf;    // sign extend this width-bit number to bfsx
        int width; // number of bits representing the number in bf
        int bfsx;  // resulting sign-extended number

        Approach 1
        mask1 = (1 << width) - 1
        mask2 = 1 << (width - 1)
        bf    = bf & mask1      // zero bits in bf above position width  
        bfsx  = (bf ^ mask2) - mask2

        Approach 2
        amount = CHAR_BIT * sizeof(bf) - width
        bfsx   = (bf << amount) >> amount

        Then, a new strength reduction rule is introduced:
            Turn this: ((bf & mask1) ^ mask2) - mask2 
            Into this: (bf << amount) >> amount

        -------------------
        ### Part B SBFX ###
        -------------------
        Given instruction:
        sbfx Rd, Rn, lsb, width

        Signed Bitfield Extract (SBFX) extracts width number of adjacent bits at lsb position 
        from a register Rn, sign-extends them to the size of the register, and writes the 
        result to the destination register Rd.

        The equivalent patterns of this instruction are:

        Pattern 1:
            bf    = src >> lsb
            dst   = ((bf & mask1) ^ mask2) - mask2
            mask1 = (1 << width) - 1
            mask2 = 1 << (width - 1) // (mask2 << 1) - 1 = mask1

        Pattern 2:
            bf     = src >> lsb
            amount = CHAR_BIT * sizeof(bf) - width
            dst    = (bf << amount) >> amount
        
        Then, (bf << amount) >> amount is selected as the canonical form with the strength reduction 
        rule introduced above.

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = lsb
        Int @2 = amount
        Int @3 = ZShr(@0, @1)
        Int @4 = Shl(@3, @2)
        Int @5 = SShr(@4, @2)
        Void@6 = Return(@5, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        Urshift %x0,    lsb, %x0, @3
        Lshift  %x0, amount, %x0, @4
        Rshift  %x0, amount, %x0, @5
        Ret     %x0,              @6

        After Adding BIC:
        // New optimized AIR
        ExtractSignedBitfield %x0, lsb, width, %x0, @5
        Ret                   %x0,                  @6
    
        --------------------
        ### Part B SBFIZ ###
        --------------------
        Given instruction:
        sbfiz Rd, Rn, lsb, width

        Signed Bitfield Insert in Zero (SBFIZ) zeroes the destination register Rd and copies 
        width number of contiguous bits from a source register Rn into lsb position in the 
        destination register, sign-extending the most significant bit of the transferred value.

        The equivalent patterns of this instruction are:

        Pattern 1:
            bfsx  = ((src & mask1) ^ mask2) - mask2
            dst   = bfsx << lsb
            mask1 = (1 << width) - 1
            mask2 = 1 << (width - 1) // (mask2 << 1) - 1 = mask1

        Pattern 2:
            amount = CHAR_BIT * sizeof(bf) - width
            bfsx   = (src << amount) >> amount
            dst    = bfsx << lsb
        
        Then, ((src << amount) >> amount) << lsb is selected as the canonical form with the 
        strength reduction rule introduced above.

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = lsb
        Int @2 = amount
        Int @3 = Shl(@0, @2)
        Int @4 = SShr(@3, @2)
        Int @5 = Shl(@4, @1)
        Void@6 = Return(@5, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        Lshift %x0, amount, %x0, @3
        Rshift %x0, amount, %x0, @4
        Lshift %x0,    lsb, %x0, @5
        Ret    %x0,              @6

        After Adding BIC:
        // New optimized AIR
        InsertSignedBitfieldInZero %x0, lsb, width, %x0, @5
        Ret                        %x0,                  @6

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::insertSignedBitfieldInZero32):
        (JSC::MacroAssemblerARM64::insertSignedBitfieldInZero64):
        (JSC::MacroAssemblerARM64::extractSignedBitfield32):
        (JSC::MacroAssemblerARM64::extractSignedBitfield64):
        * assembler/testmasm.cpp:
        (JSC::testInsertSignedBitfieldInZero32):
        (JSC::testInsertSignedBitfieldInZero64):
        (JSC::testExtractSignedBitfield32):
        (JSC::testExtractSignedBitfield64):
        * b3/B3LowerToAir.cpp:
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (addBitTests):
        * b3/testb3_3.cpp:
        (testInsertSignedBitfieldInZero32):
        (testInsertSignedBitfieldInZero64):
        (testExtractSignedBitfield32):
        (testExtractSignedBitfield64):

2021-06-28  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to use BIC supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227202

        Reviewed by Filip Pizlo.

        This patch includes three modifications:
            1. Add bit clear (BIC), or not (ORN), and extract and insert bitfield at the 
               lower end (BFXIL) to Air opcode to serve instruction selector.
            2. Add bitfield clear (BFC) to MacroAssembler.
            4. Do refactoring - rename Air opcodes added in the previous patches.

        ------------------
        ### Part A BIC ###
        ------------------
        Given the operation:

        bic Rd, Rn, Rm

        The BIC (Bit Clear) instruction performs an AND operation on the bits in Rn with the 
        complements of the corresponding bits in the value of Rm. The instruction selector can 
        utilize this to lowering certain patterns in B3 IR before further Air optimization. 
        The equivalent patterns of this instruction are:

        Pattern 1:
            d = n & (-m - 1)

        Pattern 2:
            d = n & (m ^ -1)

        In order to get benefits for complement operation, the current instruction selector uses 
        mvn instruction to lower the pattern value ^ -1. Then, a new strength reduction rule is 
        introduced:
            Turn this: -value - 1 
            Into this: value ^ -1

        So, d = n & (m ^ -1) is selected as the canonical form.

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = -1
        Int @3 = BitXor(@1, @2)
        Int @4 = BitAnd(@0, @3)
        Void@5 = Return(@4, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        Not %x1, %x1,      @3
        And %x0, %x1, %x0, @4
        Ret %x0,           @5

        After Adding BIC:
        // New optimized AIR
        Bic %x0, %x1, %x0, @4
        Ret %x0,           @5

        ------------------
        ### Part A ORN ###
        ------------------
        Given the operation:

        orn Rd, Rn, Rm

        Bitwise OR NOT (shifted register) performs a bitwise (inclusive) OR of a register value 
        Rn and the complement of an optionally-shifted register value Rm, and writes the result 
        to the destination register Rd.

        The equivalent patterns of this instruction are:

        Pattern 1:
            d = n | (-m - 1)

        Pattern 2:
            d = n | (m ^ -1)

        Then, d = n | (m ^ -1) is selected as the canonical form.

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = -1
        Int @3 = BitXor(@1, @2)
        Int @4 = BitOr(@0, @3)
        Void@5 = Return(@4, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        Not %x1, %x1,      @3
        Or  %x0, %x1, %x0, @4
        Ret %x0,           @5

        After Adding BIC:
        // New optimized AIR
        Orn %x0, %x1, %x0, @4
        Ret %x0,           @5

        --------------------
        ### Part A BFXIL ###
        --------------------
        Given the operation:

        bfxil Rd, Rn, lsb, width

        Bitfield extract and insert at low end(BFXIL) copies any number of low-order bits 
        from a source register into the same number of adjacent bits at the low end in 
        the destination register, leaving other bits unchanged.

        The equivalent patterns of this instruction are:

        Pattern 1:
        mask1 = (1 << width) - 1
        mask2 = ~mask1
        ((n >> lsb) & mask1) | (d & mask2)

        Pattern 2:
        mask1 = ((1 << width) - 1) << lsb
        mask2 = ~(mask1 >> lsb)
        ((n & mask1) >> lsb) | (d & mask2)

        Then, introduce a strength reduction rule for easier recognization.
        Turn this: (v & maskShift) >> shiftAmount
        Into this: (v >> shiftAmount) & mask

        with constraints:
        1. maskShift = mask << lsb
        2. mask = (1 << width) - 1
        3. 0 <= shiftAmount < datasize
        4. 0 < width < datasize
        5. shiftAmount + width <= datasize

        The canonical form to match BFXIL is d = ((n >> lsb) & mask1) | (d & mask2).
        
        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = lsb
        Int @3 = mask1
        Int @4 = mask2
        Int @5 = BitAnd(@1, @3)
        Int @6 = BitAnd(@0, @4))
        Int @7 = ZShr(@5, @2)
        Int @8 = BitOr(@7, @6)
        Void@9 = Return(@8, Terminal)

        Before Adding BIC:
        // Old optimized AIR
        And                      mask2, %x0,   %x0,      @6
        ExtractUnsignedBitfield    %x1, lsb, width, %x1, @7
        Or                         %x0, %x1,   %x0,      @8
        Ret                        %x0,                  @9

        After Adding BIC:
        // New optimized AIR
        ExtractInsertBitfieldAtLowEnd %x1, lsb, width, %x0, @8
        Ret64                         %x0,                  @9

        --------------
        ### Part B ###
        --------------
        The Bitfield Clear (BFC), leaving other bits unchanged, is similar to BFI which is an 
        alias of BFM. Given the operation:

        bfc Rd, lsb, width

        The equivalent pattern of this instruction is:

        mask = ((1 << width) - 1) << lsb
        d = d & ~mask

        Since mask is a constant and B3 performs constant fold in the optimization phase, this 
        pattern will directly lower to the BitAnd binary operation. So, no need to match this pattern.

        --------------
        ### Part C ###
        --------------
        At MacroAssembler level, the emitters are exepected to be expressed in english 
        (e.g. something like clearBitField for BFC). Do refactoring to rename Air opcode for 
        UBFX, UBFIZ, BFI, and BIC.

        * assembler/ARM64Assembler.h:
        (JSC::ARM64Assembler::bfc):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::extractUnsignedBitfield32):
        (JSC::MacroAssemblerARM64::extractUnsignedBitfield64):
        (JSC::MacroAssemblerARM64::insertUnsignedBitfieldInZero32):
        (JSC::MacroAssemblerARM64::insertUnsignedBitfieldInZero64):
        (JSC::MacroAssemblerARM64::insertBitField32):
        (JSC::MacroAssemblerARM64::insertBitField64):
        (JSC::MacroAssemblerARM64::clearBitField32):
        (JSC::MacroAssemblerARM64::clearBitField64):
        (JSC::MacroAssemblerARM64::clearBitsWithMask32):
        (JSC::MacroAssemblerARM64::clearBitsWithMask64):
        (JSC::MacroAssemblerARM64::orNot32):
        (JSC::MacroAssemblerARM64::orNot64):
        (JSC::MacroAssemblerARM64::ubfx32): Deleted.
        (JSC::MacroAssemblerARM64::ubfx64): Deleted.
        (JSC::MacroAssemblerARM64::ubfiz32): Deleted.
        (JSC::MacroAssemblerARM64::ubfiz64): Deleted.
        (JSC::MacroAssemblerARM64::bitFieldInsert32): Deleted.
        (JSC::MacroAssemblerARM64::bitFieldInsert64): Deleted.
        * assembler/testmasm.cpp:
        (JSC::testMultiplySignExtend32):
        (JSC::testMultiplySubSignExtend32):
        (JSC::testExtractUnsignedBitfield32):
        (JSC::testExtractUnsignedBitfield64):
        (JSC::testInsertUnsignedBitfieldInZero32):
        (JSC::testInsertUnsignedBitfieldInZero64):
        (JSC::testInsertBitField32):
        (JSC::testInsertBitField64):
        (JSC::testClearBitField32):
        (JSC::testClearBitField64):
        (JSC::testClearBitsWithMask32):
        (JSC::testClearBitsWithMask64):
        (JSC::testOrNot32):
        (JSC::testOrNot64):
        (JSC::testMul32SignExtend): Deleted.
        (JSC::testMulSubSignExtend32): Deleted.
        (JSC::testUbfx32): Deleted.
        (JSC::testUbfx64): Deleted.
        (JSC::testUbfiz32): Deleted.
        (JSC::testUbfiz64): Deleted.
        (JSC::testBitFieldInsert32): Deleted.
        (JSC::testBitFieldInsert64): Deleted.
        * b3/B3LowerToAir.cpp:
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testInsertBitField32):
        (testInsertBitField64):
        (testBIC32):
        (testBIC64):
        (testOrNot32):
        (testOrNot64):
        (addBitTests):
        (testBitFieldInsert32): Deleted.
        (testBitFieldInsert64): Deleted.
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::cageWithoutUntagging):
        (JSC::AssemblyHelpers::cageConditionallyAndUntag):

2021-06-28  Mikhail R. Gadelha  <mikhail@igalia.com>

        Add LLInt fast path for less, lesseq, greater and greatereq
        https://bugs.webkit.org/show_bug.cgi?id=226266

        Reviewed by Tadeu Zagallo.

        The motivation is to add fast path for integers and doubles
        in LLInt, so we don't need to go to slow path for those cases.

        This patch implements the less, lesseq, greater, greatereq 
        instruction for ARMv7, MIPS and CLoop.

        Microbenchmarking results:
        * x86_64: number-comparison-inline definitely 1.3520x faster
        * ARMv7: number-comparison-inline definitely 1.3520x faster

        JetStream2 results:
        * x86_64 jit: 1.015 times better
        * x86_64 no-jit: 1.018 times better
        * ARMv7 no-jit: 1.004 times worse

        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/arm.rb:
        * offlineasm/cloop.rb:
        * offlineasm/mips.rb:

2021-06-28  Mikhail R. Gadelha  <mikhail@igalia.com>

        Prevent sign-extended casts for 32 bits arch
        https://bugs.webkit.org/show_bug.cgi?id=227170

        Reviewed by Yusuke Suzuki.

        In a number of places, addresses are reinterpreted as uint64, which can
        lead to wrong addresses in 32 bits arch.

        * assembler/testmasm.cpp:
        (JSC::testBranchTruncateDoubleToInt32):
        * disassembler/ARM64/A64DOpcode.h:
        (JSC::ARM64Disassembler::A64DOpcode::appendPCRelativeOffset):
        * runtime/JSCell.cpp:
        (JSC::reportZappedCellAndCrash):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::emitEntryTierUpCheck):
        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitEntryTierUpCheck):
        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):

2021-06-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r279266.
        https://bugs.webkit.org/show_bug.cgi?id=227402

        Causes crash loop

        Reverted changeset:

        "Remove references to order files"
        https://bugs.webkit.org/show_bug.cgi?id=227377
        https://trac.webkit.org/changeset/279266

2021-06-24  Sihui Liu  <sihui_liu@apple.com>

        Remove references to order files
        https://bugs.webkit.org/show_bug.cgi?id=227377
        rdar://76070556

        Reviewed by Mark Lam.

        * Configurations/JavaScriptCore.xcconfig:

2021-06-24  Asumu Takikawa  <asumu@igalia.com>

        [WASM-Function-References] Add support for (ref null? $t) type constructor
        https://bugs.webkit.org/show_bug.cgi?id=226296

        Reviewed by Yusuke Suzuki.

        Adds the `ref` type constructor from the typed function references proposal:

          https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md

        It's also required for the type imports and GC proposals as well. Ref types represent
        references to any heap type (including existing funcref and externref) with a specified
        nullability.

        This requires a new isNullable flag in the type representation. This flag also enables
        non-null externref and funcrefs, and hence this commit also adds the necessary checks
        at Wasm/JS boundaries.

        Non-null reference types also generally cannot be used as function locals.

        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::gTypeIdx):
        (JSC::Wasm::AirIRGenerator::tmpForType):
        (JSC::Wasm::AirIRGenerator::emitCCall):
        (JSC::Wasm::AirIRGenerator::moveOpForValueType):
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::addLocal):
        (JSC::Wasm::AirIRGenerator::addConstant):
        (JSC::Wasm::AirIRGenerator::addRefFunc):
        * wasm/WasmCallingConvention.h:
        (JSC::Wasm::WasmCallingConvention::marshallLocation const):
        (JSC::Wasm::JSCallingConvention::marshallLocation const):
        * wasm/WasmFormat.h:
        (JSC::Wasm::isSubtype):
        (JSC::Wasm::isValidHeapTypeKind):
        (JSC::Wasm::isDefaultableType):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::FunctionParser<Context>::parse):
        (JSC::Wasm::FunctionParser<Context>::parseAnnotatedSelectImmediates):
        (JSC::Wasm::FunctionParser<Context>::checkBranchTarget):
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        * wasm/WasmGlobal.cpp:
        (JSC::Wasm::Global::get const):
        (JSC::Wasm::Global::set):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
        (JSC::Wasm::LLIntGenerator::callInformationForCallee):
        (JSC::Wasm::LLIntGenerator::addArguments):
        * wasm/WasmParser.h:
        (JSC::Wasm::Parser<SuccessType>::parseBlockSignature):
        (JSC::Wasm::Parser<SuccessType>::parseValueType):
        (JSC::Wasm::Parser<SuccessType>::parseRefType):
        * wasm/WasmSectionParser.cpp:
        (JSC::Wasm::SectionParser::parseType):
        (JSC::Wasm::SectionParser::parseElement):
        (JSC::Wasm::SectionParser::parseInitExpr):
        (JSC::Wasm::SectionParser::parseElementSegmentVectorOfExpressions):
        (JSC::Wasm::SectionParser::parseGlobalType):
        * wasm/WasmSignature.cpp:
        (JSC::Wasm::computeHash):
        * wasm/generateWasmOpsHeader.py:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * wasm/js/WebAssemblyFunctionBase.h:
        (JSC::WebAssemblyFunctionBase::offsetOfSignatureIndex):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::linkImpl):
        * wasm/wasm.json:

2021-06-24  Mark Lam  <mark.lam@apple.com>

        Use ldp and stp more for saving / restoring registers on ARM64.
        https://bugs.webkit.org/show_bug.cgi?id=227039
        rdar://79354736

        Reviewed by Saam Barati.

        This patch introduces a spooler abstraction in AssemblyHelpers.  The spooler
        basically batches up load / store operations and emit them as pair instructions
        if appropriate.

        There are 4 spooler classes:
        a. Spooler
           - template base class for LoadRegSpooler and StoreRegSpooler.
           - encapsulates the batching strategy for load / store pairs.

        b. LoadRegSpooler - specializes Spooler to handle load pairs.
        b. StoreRegSpooler - specializes Spooler to handle store pairs.

        d. CopySpooler
           - handles matching loads with stores.
           - tries to emit loads as load pairs if possible.
           - tries to emot stores as store pairs if possible.
           - ensures that pre-requisite loads are emitted before stores are emitted.
           - other than loads, also support constants and registers as sources of values
             to be stored.  This is useful in OSR exit ramps where we may materialize a
             stack value to store from constants or registers in addition to values we
             load from the old stack frame or from a scratch buffer.

        In this patch, we also do the following:

        1. Use spoolers in many places so that we can emit load / store pairs instead of
           single load / stores.  This helps shrink JIT code side, and also potentially
           improves performance.

        2. In DFG::OSRExit::compileExit(), we used to recover constants into a scratch
           buffer, and then later, load from that scratch buffer to store into the
           new stack frame(s).

           This patch changes it so that we defer constant recovery until the final
           loop where we store the recovered value directly into the new stack frame(s).
           This saves us the work (and JIT code space) for storing into a scratch buffer
           and then reloading from the scratch buffer.

           There is one exception: tmp values used by active checkpoints.  We need to call
           operationMaterializeOSRExitSideState() to materialize the active checkpoint
           side state before the final loop where we now recover constants.  Hence, we
           need these tmp values recovered before hand.

           So, we check upfront if we have active checkpoint side state to materialize.
           If so, we'll eagerly recover the constants for initializing those tmps.

           We also use the CopySpooler in the final loop to emit load / store pairs for
           filling in the new stack frame(s).

           One more thing: it turns out that the vast majority of constants to be recovered
           is simply the undefined value.  So, as an optimization, the final loop keeps
           the undefined value in a register, and has the spooler store directly from
           that register when appropriate.  This saves on JIT code to repeatedly materialize
           the undefined JSValue constant.

        3. In reifyInlinedCallFrames(), replace the use of GPRInfo::nonArgGPR0 with
           GPRInfo::regT4.  nonArgGPRs are sometimes map to certain regTXs on certain ports.
           Replacing with regT4 makes it easier to ensure that we're not trashing the
           register when we use more temp registers.

           reifyInlinedCallFrames() will be using emitSaveOrCopyLLIntBaselineCalleeSavesFor()
           later where we need more temp registers.

        4. Move the following functions to AssemblyHelpers.cpp.  They don't need to be
           inline functions.  Speedometer2 and JetStream2 shows that making these non
           inline does not hurt performance:

                AssemblyHelpers::emitSave(const RegisterAtOffsetList&);
                AssemblyHelpers::emitRestore(const RegisterAtOffsetList&);
                AssemblyHelpers::emitSaveCalleeSavesFor(const RegisterAtOffsetList*);
                AssemblyHelpers::emitSaveOrCopyCalleeSavesFor(...);
                AssemblyHelpers::emitRestoreCalleeSavesFor(const RegisterAtOffsetList*);
                AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer(...);

           Also renamed emitSaveOrCopyCalleeSavesFor() to emitSaveOrCopyLLIntBaselineCalleeSavesFor()
           because it is only used with baseline codeBlocks.

        Results:
        Cummulative LinkBuffer profile sizes shrunk by ~2M in aggregate:

                            base                           new
                            ====                           ===
               BaselineJIT: 83827048 (79.943703 MB)     => 83718736 (79.840408 MB)
                       DFG: 56594836 (53.973042 MB)     => 56603508 (53.981312 MB)
               InlineCache: 33923900 (32.352352 MB)     => 33183156 (31.645924 MB)
                       FTL: 6770956 (6.457287 MB)       => 6568964 (6.264652 MB)
                DFGOSRExit: 5212096 (4.970642 MB)       => 3728088 (3.555382 MB)
                    CSSJIT: 748428 (730.886719 KB)      => 748428 (730.886719 KB)
                FTLOSRExit: 692276 (676.050781 KB)      => 656884 (641.488281 KB)
                   YarrJIT: 445280 (434.843750 KB)      => 512988 (500.964844 KB)
                  FTLThunk: 22908 (22.371094 KB)        => 22556 (22.027344 KB)
        BoundFunctionThunk: 8400 (8.203125 KB)          => 10088 (9.851562 KB)
             ExtraCTIThunk: 6952 (6.789062 KB)          => 6824 (6.664062 KB)
          SpecializedThunk: 4508 (4.402344 KB)          => 4508 (4.402344 KB)
                     Thunk: 3912 (3.820312 KB)          => 3784 (3.695312 KB)
                LLIntThunk: 2908 (2.839844 KB)          => 2908 (2.839844 KB)
              VirtualThunk: 1248 (1.218750 KB)          => 1248 (1.218750 KB)
                  DFGThunk: 1084 (1.058594 KB)          => 444
               DFGOSREntry: 216                         => 184
                JumpIsland: 0
                 WasmThunk: 0
                      Wasm: 0
             Uncategorized: 0
                     Total: 188266956 (179.545361 MB)   => 185773296 (177.167221 MB)

        Speedometer2 and JetStream2 results shows that performance is neutral for this
        patch (as measured on an M1 Mac):

        Speedometer2:
        ----------------------------------------------------------------------------------------------------------------------------------
        |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
        ----------------------------------------------------------------------------------------------------------------------------------
        | Elm-TodoMVC                          |129.037500   |127.212500   |0.985857  | 0.012706                                         |
        | VueJS-TodoMVC                        |28.312500    |27.525000    |0.972185  | 0.240315                                         |
        | EmberJS-TodoMVC                      |132.550000   |132.025000   |0.996039  | 0.538034                                         |
        | Flight-TodoMVC                       |80.762500    |80.875000    |1.001393  | 0.914749                                         |
        | BackboneJS-TodoMVC                   |51.637500    |51.175000    |0.991043  | 0.285427                                         |
        | Preact-TodoMVC                       |21.025000    |22.075000    |1.049941  | 0.206140                                         |
        | AngularJS-TodoMVC                    |142.900000   |142.887500   |0.999913  | 0.990681                                         |
        | Inferno-TodoMVC                      |69.300000    |69.775000    |1.006854  | 0.505201                                         |
        | Vanilla-ES2015-TodoMVC               |71.500000    |71.225000    |0.996154  | 0.608650                                         |
        | Angular2-TypeScript-TodoMVC          |43.287500    |43.275000    |0.999711  | 0.987926                                         |
        | VanillaJS-TodoMVC                    |57.212500    |57.812500    |1.010487  | 0.333357                                         |
        | jQuery-TodoMVC                       |276.150000   |276.775000   |1.002263  | 0.614404                                         |
        | EmberJS-Debug-TodoMVC                |353.612500   |352.762500   |0.997596  | 0.518836                                         |
        | React-TodoMVC                        |93.637500    |92.637500    |0.989321  | 0.036277                                         |
        | React-Redux-TodoMVC                  |158.237500   |156.587500   |0.989573  | 0.042154                                         |
        | Vanilla-ES2015-Babel-Webpack-TodoMVC |68.050000    |68.087500    |1.000551  | 0.897149                                         |
        ----------------------------------------------------------------------------------------------------------------------------------

        a mean = 236.26950
        b mean = 236.57964
        pValue = 0.7830785938
        (Bigger means are better.)
        1.001 times better
        Results ARE NOT significant

        JetStream2:
        -------------------------------------------------------------------------------------------------------------------------
        |          subtest          |     pts      |     pts      |  b / a   | pValue (significance using False Discovery Rate) |
        -------------------------------------------------------------------------------------------------------------------------
        | gaussian-blur             |542.570057    |542.671885    |1.000188  | 0.982573                                         |
        | HashSet-wasm              |57.710498     |64.406371     |1.116025  | 0.401424                                         |
        | gcc-loops-wasm            |44.516009     |44.453535     |0.998597  | 0.973651                                         |
        | json-parse-inspector      |241.275085    |240.720491    |0.997701  | 0.704732                                         |
        | prepack-wtb               |62.640114     |63.754878     |1.017796  | 0.205840                                         |
        | date-format-xparb-SP      |416.976817    |448.921409    |1.076610  | 0.052977                                         |
        | WSL                       |1.555257      |1.570233      |1.009629  | 0.427924                                         |
        | OfflineAssembler          |177.052352    |179.746511    |1.015217  | 0.112114                                         |
        | cdjs                      |192.517586    |194.598906    |1.010811  | 0.025807                                         |
        | UniPoker                  |514.023694    |526.111500    |1.023516  | 0.269892                                         |
        | json-stringify-inspector  |227.584725    |223.619390    |0.982576  | 0.102714                                         |
        | crypto-sha1-SP            |980.728788    |984.192104    |1.003531  | 0.838618                                         |
        | Basic                     |685.148483    |711.590247    |1.038593  | 0.142952                                         |
        | chai-wtb                  |106.256376    |106.590318    |1.003143  | 0.865894                                         |
        | crypto-aes-SP             |722.308829    |728.702310    |1.008851  | 0.486766                                         |
        | Babylon                   |655.857561    |654.204901    |0.997480  | 0.931520                                         |
        | string-unpack-code-SP     |407.837271    |405.710752    |0.994786  | 0.729122                                         |
        | stanford-crypto-aes       |456.906021    |449.993856    |0.984872  | 0.272994                                         |
        | raytrace                  |883.911335    |902.887238    |1.021468  | 0.189785                                         |
        | multi-inspector-code-load |409.997347    |405.643639    |0.989381  | 0.644447                                         |
        | hash-map                  |593.590160    |601.576332    |1.013454  | 0.249414                                         |
        | stanford-crypto-pbkdf2    |722.178638    |728.283532    |1.008453  | 0.661195                                         |
        | coffeescript-wtb          |42.393544     |41.869545     |0.987640  | 0.197441                                         |
        | Box2D                     |452.034685    |454.104868    |1.004580  | 0.535342                                         |
        | richards-wasm             |140.873688    |148.394050    |1.053384  | 0.303651                                         |
        | lebab-wtb                 |61.671318     |62.119403     |1.007266  | 0.620998                                         |
        | tsf-wasm                  |108.592794    |119.498398    |1.100427  | 0.504710                                         |
        | base64-SP                 |629.744643    |603.425565    |0.958207  | 0.049997                                         |
        | navier-stokes             |740.588523    |739.951662    |0.999140  | 0.871445                                         |
        | jshint-wtb                |51.938359     |52.651104     |1.013723  | 0.217137                                         |
        | regex-dna-SP              |459.251148    |463.492489    |1.009235  | 0.371891                                         |
        | async-fs                  |235.853820    |236.031189    |1.000752  | 0.938459                                         |
        | first-inspector-code-load |275.298325    |274.172125    |0.995909  | 0.623403                                         |
        | segmentation              |44.002842     |43.445960     |0.987344  | 0.207134                                         |
        | typescript                |26.360161     |26.458820     |1.003743  | 0.609942                                         |
        | octane-code-load          |1126.749036   |1087.132024   |0.964840  | 0.524171                                         |
        | float-mm.c                |16.691935     |16.721354     |1.001762  | 0.194425                                         |
        | quicksort-wasm            |461.630091    |450.161127    |0.975156  | 0.371394                                         |
        | Air                       |392.442375    |412.201810    |1.050350  | 0.046887                                         |
        | splay                     |510.111886    |475.131657    |0.931426  | 0.024732                                         |
        | ai-astar                  |607.966974    |626.573181    |1.030604  | 0.468711                                         |
        | acorn-wtb                 |67.510766     |68.143956     |1.009379  | 0.481663                                         |
        | gbemu                     |144.133842    |145.620304    |1.010313  | 0.802154                                         |
        | richards                  |963.475078    |946.658879    |0.982546  | 0.231189                                         |
        | 3d-cube-SP                |549.426784    |550.479154    |1.001915  | 0.831307                                         |
        | espree-wtb                |68.707483     |73.762202     |1.073569  | 0.033603                                         |
        | bomb-workers              |96.882596     |96.116121     |0.992089  | 0.687952                                         |
        | tagcloud-SP               |309.888767    |303.538511    |0.979508  | 0.187768                                         |
        | mandreel                  |133.667031    |135.009929    |1.010047  | 0.075232                                         |
        | 3d-raytrace-SP            |491.967649    |492.528992    |1.001141  | 0.957842                                         |
        | delta-blue                |1066.718312   |1080.230772   |1.012667  | 0.549382                                         |
        | ML                        |139.617293    |140.088630    |1.003376  | 0.661651                                         |
        | regexp                    |351.773956    |351.075935    |0.998016  | 0.769250                                         |
        | crypto                    |1510.474663   |1519.218842   |1.005789  | 0.638420                                         |
        | crypto-md5-SP             |795.447899    |774.082493    |0.973140  | 0.079728                                         |
        | earley-boyer              |812.574545    |870.678372    |1.071506  | 0.044081                                         |
        | octane-zlib               |25.162470     |25.660261     |1.019783  | 0.554591                                         |
        | date-format-tofte-SP      |395.296135    |398.008992    |1.006863  | 0.650475                                         |
        | n-body-SP                 |1165.386611   |1150.525110   |0.987248  | 0.227908                                         |
        | pdfjs                     |189.060252    |191.015628    |1.010343  | 0.633777                                         |
        | FlightPlanner             |908.426192    |903.636642    |0.994728  | 0.838821                                         |
        | uglify-js-wtb             |34.029399     |34.164342     |1.003965  | 0.655652                                         |
        | babylon-wtb               |81.329869     |80.855680     |0.994170  | 0.854393                                         |
        | stanford-crypto-sha256    |826.850533    |838.494164    |1.014082  | 0.579636                                         |
        -------------------------------------------------------------------------------------------------------------------------

        a mean = 237.91084
        b mean = 239.92670
        pValue = 0.0657710897
        (Bigger means are better.)
        1.008 times better
        Results ARE NOT significant

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::pushToSaveByteOffset):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::pushToSaveByteOffset):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::reifyInlinedCallFrames):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        * ftl/FTLSaveRestore.cpp:
        (JSC::FTL::saveAllRegisters):
        (JSC::FTL::restoreAllRegisters):
        * ftl/FTLSaveRestore.h:
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBufferImpl):
        (JSC::AssemblyHelpers::emitSave):
        (JSC::AssemblyHelpers::emitRestore):
        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):
        (JSC::AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::emitSaveOrCopyLLIntBaselineCalleeSavesFor):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::emitSave): Deleted.
        (JSC::AssemblyHelpers::emitRestore): Deleted.
        (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor): Deleted.
        * jit/AssemblyHelpersSpoolers.h: Added.
        (JSC::AssemblyHelpers::Spooler::Spooler):
        (JSC::AssemblyHelpers::Spooler::handleGPR):
        (JSC::AssemblyHelpers::Spooler::finalizeGPR):
        (JSC::AssemblyHelpers::Spooler::handleFPR):
        (JSC::AssemblyHelpers::Spooler::finalizeFPR):
        (JSC::AssemblyHelpers::Spooler::op):
        (JSC::AssemblyHelpers::LoadRegSpooler::LoadRegSpooler):
        (JSC::AssemblyHelpers::LoadRegSpooler::loadGPR):
        (JSC::AssemblyHelpers::LoadRegSpooler::finalizeGPR):
        (JSC::AssemblyHelpers::LoadRegSpooler::loadFPR):
        (JSC::AssemblyHelpers::LoadRegSpooler::finalizeFPR):
        (JSC::AssemblyHelpers::LoadRegSpooler::handlePair):
        (JSC::AssemblyHelpers::LoadRegSpooler::handleSingle):
        (JSC::AssemblyHelpers::StoreRegSpooler::StoreRegSpooler):
        (JSC::AssemblyHelpers::StoreRegSpooler::storeGPR):
        (JSC::AssemblyHelpers::StoreRegSpooler::finalizeGPR):
        (JSC::AssemblyHelpers::StoreRegSpooler::storeFPR):
        (JSC::AssemblyHelpers::StoreRegSpooler::finalizeFPR):
        (JSC::AssemblyHelpers::StoreRegSpooler::handlePair):
        (JSC::AssemblyHelpers::StoreRegSpooler::handleSingle):
        (JSC::RegDispatch<GPRReg>::get):
        (JSC::RegDispatch<GPRReg>::temp1):
        (JSC::RegDispatch<GPRReg>::temp2):
        (JSC::RegDispatch<GPRReg>::regToStore):
        (JSC::RegDispatch<GPRReg>::invalid):
        (JSC::RegDispatch<GPRReg>::regSize):
        (JSC::RegDispatch<GPRReg>::isValidLoadPairImm):
        (JSC::RegDispatch<GPRReg>::isValidStorePairImm):
        (JSC::RegDispatch<FPRReg>::get):
        (JSC::RegDispatch<FPRReg>::temp1):
        (JSC::RegDispatch<FPRReg>::temp2):
        (JSC::RegDispatch<FPRReg>::regToStore):
        (JSC::RegDispatch<FPRReg>::invalid):
        (JSC::RegDispatch<FPRReg>::regSize):
        (JSC::RegDispatch<FPRReg>::isValidLoadPairImm):
        (JSC::RegDispatch<FPRReg>::isValidStorePairImm):
        (JSC::AssemblyHelpers::CopySpooler::Source::getReg):
        (JSC::AssemblyHelpers::CopySpooler::CopySpooler):
        (JSC::AssemblyHelpers::CopySpooler::temp1 const):
        (JSC::AssemblyHelpers::CopySpooler::temp2 const):
        (JSC::AssemblyHelpers::CopySpooler::regToStore):
        (JSC::AssemblyHelpers::CopySpooler::invalid):
        (JSC::AssemblyHelpers::CopySpooler::regSize):
        (JSC::AssemblyHelpers::CopySpooler::isValidLoadPairImm):
        (JSC::AssemblyHelpers::CopySpooler::isValidStorePairImm):
        (JSC::AssemblyHelpers::CopySpooler::load):
        (JSC::AssemblyHelpers::CopySpooler::move):
        (JSC::AssemblyHelpers::CopySpooler::copy):
        (JSC::AssemblyHelpers::CopySpooler::store):
        (JSC::AssemblyHelpers::CopySpooler::flush):
        (JSC::AssemblyHelpers::CopySpooler::loadGPR):
        (JSC::AssemblyHelpers::CopySpooler::copyGPR):
        (JSC::AssemblyHelpers::CopySpooler::moveConstant):
        (JSC::AssemblyHelpers::CopySpooler::storeGPR):
        (JSC::AssemblyHelpers::CopySpooler::finalizeGPR):
        (JSC::AssemblyHelpers::CopySpooler::loadFPR):
        (JSC::AssemblyHelpers::CopySpooler::copyFPR):
        (JSC::AssemblyHelpers::CopySpooler::storeFPR):
        (JSC::AssemblyHelpers::CopySpooler::finalizeFPR):
        (JSC::AssemblyHelpers::CopySpooler::loadPair):
        (JSC::AssemblyHelpers::CopySpooler::storePair):
        * jit/ScratchRegisterAllocator.cpp:
        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
        (JSC::ScratchRegisterAllocator::preserveRegistersToStackForCall):
        (JSC::ScratchRegisterAllocator::restoreRegistersFromStackForCall):
        * jit/ScratchRegisterAllocator.h:
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::addReturn):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addReturn):

2021-06-24  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, build fix for ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227201

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::cageWithoutUntagging):
        (JSC::AssemblyHelpers::cageConditionallyAndUntag):

2021-06-24  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize BFI supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227201

        Reviewed by Filip Pizlo.

        Bitfield insert(BFI), leaving other bits unchanged. The instruction selector 
        can utilize this to lowering certain patterns in B3 IR before further Air 
        optimization. Given the operation:

        bfi d, n, lsb, width

        The equivalent pattern would be:

        Pattern 1:
            mask1 = ((1 << width) - 1) << lsb
            mask2 = ~mask1
            d = ((n << lsb) & mask1) | (d & mask2);

        Pattern 2:
            mask1 = (1 << width) - 1
            mask2 = ~(mask1 << lsb)
            d = ((n & mask1) << lsb) | (d & mask2)

        Current optimizer already has the strength reduction rule:
            Turn This: (n << lsb) & mask1)
            Into This: (n & mask1) << lsb)

        Then, d = ((n & mask1) << lsb) | (d & mask2) is the canonical form.

        With constraints:
            1. 0 <= lsb < datasize
            2. 0 < width < datasize
            3. lsb + width <= dataszie

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = ArgumentReg(%x1)
        Int @2 = lsb
        Int @3 = mask
        Int @4 = BitAnd(@1, @3)
        Int @5 = Shl(@4, @2)
        Int @6 = BitOr(@0, @5)
        Int @7 = Return(@6, Terminal)

        Before Adding BFI:
        // Old optimized AIR
        And   mask, %x1, %x1, @4
        Lshift %x1, lsb, %x1, @5
        Or     %x1, %x0, %x0, @6
        Ret    %x0,           @7

        After Adding BFI:
        // New optimized AIR
        BitFieldInsert %x1, lsb, width, %x0, @6
        Ret            %x0,                  @7

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::bitFieldInsert32):
        (JSC::MacroAssemblerARM64::bitFieldInsert64):
        * assembler/testmasm.cpp:
        (JSC::testUbfx32):
        (JSC::testUbfx64):
        (JSC::testUbfiz32):
        (JSC::testUbfiz64):
        (JSC::testBitFieldInsert32):
        (JSC::testBitFieldInsert64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testBitFieldInsert32):
        (testBitFieldInsert64):
        (addBitTests):

2021-06-24  Xan López  <xan@igalia.com>

        [JSC] Implement returnEarlyFromInfiniteLoopsForFuzzing for 32bits
        https://bugs.webkit.org/show_bug.cgi?id=227290

        Reviewed by Mark Lam.

        Mostly a matter of changing the counter type to uintptr_t and
        making the baseline/dfg/ftl code generation work on both 32 and
        64bits, most of it can be shared with minor tweaks.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileLoopHint):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_loop_hint):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter32_64.asm:
        * runtime/VM.cpp:
        (JSC::VM::addLoopHintExecutionCounter):
        (JSC::VM::getLoopHintExecutionCounter):
        * runtime/VM.h:

2021-06-23  Mark Lam  <mark.lam@apple.com>

        Base Options::useWebAssemblyFastMemory's default value on Gigacage::hasCapacityToUseLargeGigacage.
        https://bugs.webkit.org/show_bug.cgi?id=227328

        Reviewed by Saam Barati.

        Gigacage::hasCapacityToUseLargeGigacage is determined based on EFFECTIVE_ADDRESS_WIDTH.
        If we have enough address range to potentially use a large gigacage, then we have
        enough address range to useWebAssemblyFastMemory.

        * runtime/Options.cpp:
        (JSC::canUseWebAssemblyFastMemory):
        * runtime/OptionsList.h:

2021-06-23  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize UBFIZ supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227204

        Reviewed by Filip Pizlo.

        This patch includes three parts:
            A) Add UBFIZ to instruction selector.
            B) Fix UBFX, introduced in https://bugs.webkit.org/show_bug.cgi?id=226984, 
               to match all patterns. 
            C) Fix error condition in one strength reduction rule introduced 
               in https://bugs.webkit.org/show_bug.cgi?id=227138.

        Part A
        Unsigned Bitfield Insert in Zero(UBFIZ), supported by ARM64, zeros the 
        destination register and copies any number of contiguous bits from a 
        source register into any position in the destination register. The 
        instruction selector can utilize this to lowering certain patterns in 
        B3 IR before further Air optimization. 

        Given the operation: ubfiz d, n, lsb, width

        This is equivalent to "d = (n << lsb) & (((1 << width) - 1) << lsb)". 
        Since wasm introduces constant folding, then the matched patterns would be:
        1.1 d = (n << lsb) & maskShift
        1.2 d = maskShift & (n << lsb)

        2.1 d = (n & mask) << lsb
        2.2 d = (mask & n) << lsb

        Where:
            maskShift = mask << lsb
            mask = (1 << width) - 1

        To make the pattern matching in instruction selection beneficial to JIT, these 
        constraints should be introduced:
            1. 0 <= lsb < datasize
            2. 0 < width < datasize
            3. lsb + width <= datasize

        Choose (n & mask) << lsb as the canonical form and introduce a strength reduction.
        Turn this: (n << lsb) & maskShift
        Into this: (n & mask) << lsb

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = lsb
        Int @2 = 0b0110
        Int @3 = Shl(@0, @1)
        Int @4 = BitAnd(@3, @2)  
        Void@5 = Return(@4, Terminal)      

        Before Adding UBFIZ Pattern:
        // Old optimized AIR
        Lshift  %x0, $62, %x0, @3
        And  0b0110, %x0, %x0, @4
        Ret     %x0,           @5

        After Adding UBFIZ Pattern:
        // New optimized AIR
        Ubfiz %x0, lsb, 2, %x0, @4
        Ret   %x0,              @5

        Part B
        Fix UBFX to match both patterns:
        dest = (src >> lsb) & mask
        dest = mask & (src >> lsb)

        Where:
        1. mask = (1 << width) - 1
        2. 0 <= lsb < datasize
        3. 0 < width < datasize
        4. lsb + width <= datasize       

        Part C
        Fix one B3 strength reduction.
        Turn this: (src >> shiftAmount) & mask
        Into this: src >> shiftAmount

        With updated constraints:
        1. mask = (1 << width) - 1
        2. 0 <= shiftAmount < datasize
        3. 0 < width < datasize
        4. shiftAmount + width >= datasize

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::ubfiz32):
        (JSC::MacroAssemblerARM64::ubfiz64):
        * assembler/testmasm.cpp:
        (JSC::testUbfiz32):
        (JSC::testUbfiz64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testUbfx32ArgLeft):
        (testUbfx32ArgRight):
        (testUbfx64ArgLeft):
        (testUbfx64ArgRight):
        (testUbfiz32ArgLeft):
        (testUbfiz32ArgRight):
        (testUbfiz64ArgLeft):
        (testUbfiz64ArgRight):
        (addBitTests):
        (testUbfx32): Deleted.
        (testUbfx32PatternMatch): Deleted.
        (testUbfx64): Deleted.
        (testUbfx64PatternMatch): Deleted.

2021-06-23  Keith Miller  <keith_miller@apple.com>

        add/removeManagedReference:withOwner: should have autoreleasepools
        https://bugs.webkit.org/show_bug.cgi?id=227308

        Reviewed by Darin Adler.

        Since these APIs create autoreleased objects as an implementation detail
        but don't return any to the caller there's no indication such autoreleased
        objects could be accumulating. Additionally, it's entirely reasonable to
        call these methods in a loop an a large set of objects, which further
        exacerbates the problem.

        * API/JSVirtualMachine.mm:
        (-[JSVirtualMachine addManagedReference:withOwner:]):
        (-[JSVirtualMachine removeManagedReference:withOwner:]):

2021-06-23  Saam Barati  <sbarati@apple.com>

        Run lazy properties initializers under a DeferTerminationForAWhile scope
        https://bugs.webkit.org/show_bug.cgi?id=227271

        Reviewed by Mark Lam.

        We don't expect that exceptions can be thrown when initializing 
        a lazy property. Termination exceptions were preventing this from
        being true. The latest example found is inside JSModuleLoader when
        it asserts that no exception is thrown when creating its JSMap field.
        This patch makes it so termination exceptions can't be thrown when
        running lazy property initializers.

        * runtime/LazyPropertyInlines.h:
        (JSC::ElementType>::initLater):
        (JSC::ElementType>::callFunc):

2021-06-22  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize SMADDL supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227188

        Reviewed by Saam Barati.

        Signed Multiply-Add Long(SMADDL), supported by ARM64, multiplies two 32-bit 
        register values, adds a 64-bit register value, and writes the result to the 
        64-bit destination register. The instruction selector can utilize this to 
        lowering certain patterns in B3 IR before further Air optimization. 

        Given the operation:

        smaddl d, n, m, a

        The equivalent patterns would be:

        d = a + SExt32(n) * SExt32(m)
        d = SExt32(n) * SExt32(m) + a

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = SExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = SExt32(Trunc(ArgumentReg(%x2)))
        Int @3 = Mul(@1, @2)
        Int @4 = Add(@0, @3)
        Void@5 = Return(@4, Terminal)

        Before Adding SMADDL:
        // Old optimized AIR
        SignExtend32ToPtr  %x1, %x1,           @1
        SignExtend32ToPtr  %x2, %x2,           @2
        MultiplyAdd64      %x1, %x2, %x0, %x0, @4
        Ret64              %x0,                @5

        After Adding SMADDL:
        // New optimized AIR
        MultiplyAddSignExtend32 %x1, %x2, %x0, %x0, @8
        Ret64                   %x0,                @9

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::multiplyAddSignExtend32):
        * assembler/testmasm.cpp:
        (JSC::testMultiplyAddSignExtend32Left):
        (JSC::testMultiplyAddSignExtend32Right):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testMulAddArg):
        (testMulAddArgsLeft):
        (testMulAddArgsRight):
        (testMulAddSignExtend32ArgsLeft):
        (testMulAddSignExtend32ArgsRight):
        (testMulAddArgsLeft32):
        (testMulAddArgsRight32):
        * b3/testb3_3.cpp:
        (addArgTests):

2021-06-22  Saam Barati  <sbarati@apple.com>

        jitCompileAndSetHeuristics shouldn't return true when we fail to compile
        https://bugs.webkit.org/show_bug.cgi?id=227155

        Reviewed by Tadeu Zagallo.

        jitCompileAndSetHeuristics should only return true when we've successfully
        compiled a baseline JIT CodeBlock. However, with the rewrite to using a
        unified JIT worklist, the code was changed to returning true when a
        compilation finished, regardless of it being successful or not. This patch
        fixes that error.
        
        This bug was found by our existing executable allocation fuzzer, but at a low
        hit rate. That fuzzer only ran a single test case. This patch also introduces
        a new form of the executable fuzzer where we fail to allocate JIT code
        randomly, and the crash manifests more reliably. And this patch also hooks
        the new fuzzer into more JSC stress tests.

        * dfg/DFGLICMPhase.cpp:
        (JSC::DFG::LICMPhase::run):
        * jit/ExecutableAllocationFuzz.cpp:
        (JSC::doExecutableAllocationFuzzing):
        * jsc.cpp:
        (runJSC):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * runtime/OptionsList.h:

2021-06-22  Angelos Oikonomopoulos  <angelos@igalia.com>

        Properly set numFPRs on ARM with NEON/VFP_V3_D32
        https://bugs.webkit.org/show_bug.cgi?id=227212

        Reviewed by Filip Pizlo.

        Don't hardcode the number of FP regs on ARMv7 to 16; when targetting a
        CPU with NEON or VFP_V3_d32, the number of FP regs is 32.

        This also reverts the recent change to add an extra word to RegisterSet
        which essentially covered up for this mismatch. The reason this bug only
        manifested on certain compiler versions was that GCC 8.4/8.5 where built using
        our buildroot infrastructure, whereas the other GCC versions we tested with
        were debian system toolchains, targetting a lowest common denominator.

        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::std::initializer_list<int>):
        * jit/RegisterSet.h:

2021-06-21  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Add JIT ICs for `#x in obj` feature
        https://bugs.webkit.org/show_bug.cgi?id=226146

        Reviewed by Saam Barati.

        This patch implements JIT ICs for the new `#x in obj` feature and turns the feature on by default.
        Implementation closely follows InByVal, though HasPrivateBrand has a few subtleties
        (namely, it cannot be viewed in terms of a PropertySlot and should not be converted to InById).

        Microbenchmarks:
            has-private-name        46.5777+-0.1374     ^      6.0589+-0.0296        ^ definitely 7.6875x faster
            has-private-brand       25.8823+-0.0561     ^     19.1509+-0.0447        ^ definitely 1.3515x faster

        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleInByAsMatchStructure):
        (JSC::DFG::ByteCodeParser::handleInById):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileInByVal):
        (JSC::DFG::SpeculativeJIT::compileHasPrivate):
        (JSC::DFG::SpeculativeJIT::compileHasPrivateName):
        (JSC::DFG::SpeculativeJIT::compileHasPrivateBrand):
        * dfg/DFGSpeculativeJIT.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInByValGenerator::JITInByValGenerator):
        * jit/JITInlineCacheGenerator.h:
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emit_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emit_op_has_private_brand):
        (JSC::JIT::emitSlow_op_has_private_brand):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitHasPrivate):
        (JSC::JIT::emitHasPrivateSlow):
        (JSC::JIT::emit_op_has_private_name):
        (JSC::JIT::emitSlow_op_has_private_name):
        (JSC::JIT::emit_op_has_private_brand):
        (JSC::JIT::emitSlow_op_has_private_brand):
        * jit/Repatch.cpp:
        (JSC::appropriateOptimizingInByFunction):
        (JSC::appropriateGenericInByFunction):
        (JSC::tryCacheInBy):
        (JSC::repatchInBy):
        (JSC::tryCacheHasPrivateBrand):
        (JSC::repatchHasPrivateBrand):
        (JSC::resetInBy):
        (JSC::resetHasPrivateBrand):
        * jit/Repatch.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * runtime/CommonSlowPaths.cpp:
        * runtime/CommonSlowPaths.h:
        * runtime/OptionsList.h:

2021-06-21  Don Olmstead  <don.olmstead@sony.com>

        Non-unified build fixes late June 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=227241

        Unreviewed non-unified build fixes.

        * dfg/DFGDriver.h:

2021-06-21  Xan Lopez  <xan@igalia.com>

        [JSC] Fix consistency check during stack splitting in Wasm::LLIntGenerator::addLoop
        https://bugs.webkit.org/show_bug.cgi?id=226012

        Reviewed by Tadeu Zagallo.

        It is possible for the wasm llint generator to call
        checkConsistency() on a stack that is only halfway through being
        properly setup. Specifically, when generating a loop block, we use
        splitStack() to pop the arguments for the loop into a new stack,
        and materializeConstantsAndLocals() to materialize the constants
        and aliases in the loop arguments, but the arguments won't be
        added back to the stack until the very end of the loop code
        generation. Since materializeConstantsAndLocals() will check the
        correctness of the expression stack, which isn't yet fully formed,
        we'll fail its ASSERT. To workaround this, we create a variant of
        materializeConstantsAndLocals() that does not check for
        correctness (similar to what we do in push()), and manually check
        the correctness of the new split stack in
        Wasm::LLIntGenerator::addLoop(), which is the place that knows the
        details of this intermediate state.

        For more details, see: https://bugs.webkit.org/show_bug.cgi?id=226012#c8

        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::checkConsistencyOfExpressionStack):
        (JSC::Wasm::LLIntGenerator::checkConsistency):
        (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
        (JSC::Wasm::LLIntGenerator::addLoop):

2021-06-21  Yusuke Suzuki  <ysuzuki@apple.com>

        Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)::<lambda()>
        https://bugs.webkit.org/show_bug.cgi?id=227180

        Reviewed by Keith Miller.

        When Wasm.Memory is shared, we should allocate bound growable memory even if initial size is 0 bytes,
        since this range can be later extended by mprotect. If maximum size is also 0 byte, we already have
        a path that does not allocate anything.

        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::tryCreate):

2021-06-21  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize SMSUBL supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=227195

        Reviewed by Keith Miller.

        Signed Multiply-Subtract Long(SMSUBL), supported by ARM64, multiplies two 
        32-bit register values, subtracts the product from a 64-bit register value, 
        and writes the result 64-bit destination register. The instruction selector 
        can utilize this to lowering certain patterns in B3 IR before further Air 
        optimization. Given the operation:

        smsubl d, n, m, a

        The equivalent pattern would be:

        d = a - SExt32(n) * SExt32(m)

        Given B3 IR:
        Int @0 = ArgumentReg(%x0)
        Int @1 = SExt32(Trunc(ArgumentReg(%x1)))
        Int @2 = SExt32(Trunc(ArgumentReg(%x2)))
        Int @3 = Mul(@1, @2)
        Int @4 = Sub(@0, @3)
        Void@5 = Return(@4, Terminal)

        Before Adding SMSUBL:
        // Old optimized AIR
        SignExtend32ToPtr  %x1, %x1,           @1
        SignExtend32ToPtr  %x2, %x2,           @2
        MultiplySub64      %x1, %x2, %x0, %x0, @4
        Ret64              %x0,                @5

        After Adding SMSUBL:
        // New optimized AIR
        MultiplySubSignExtend32 %x1, %x2, %x0, %x0, @4
        Ret64                   %x0,                @5

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::multiplySubSignExtend32):
        * assembler/testmasm.cpp:
        (JSC::testMulSubSignExtend32):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testMulSubArgsLeft):
        (testMulSubArgsRight):
        (testMulSubArgsLeft32):
        (testMulSubArgsRight32):
        (testMulSubSignExtend32Args):
        * b3/testb3_3.cpp:
        (addArgTests):

2021-06-21  Kimmo Kinnunen  <kkinnunen@apple.com>

        makeUnique cannot be used to instantiate function-local classes
        https://bugs.webkit.org/show_bug.cgi?id=227163

        Reviewed by Antti Koivisto.

        Make JSC_MAKE_PARSER_ARENA_DELETABLE_ALLOCATED
        consistent with WTF_MAKE_FAST_ALLOCATED behavior
        with respect to unused typedefs inside the macro.

        * parser/Nodes.h:

2021-06-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Add ValueOf fast path in toPrimitive
        https://bugs.webkit.org/show_bug.cgi?id=226948

        Reviewed by Ross Kirsling.

        Add fast path for Object.prototype.valueOf function call since we
        sometimes encounter this case in Speedometer2/EmberJS-Debug-TodoMVC.

                                       ToT                     Patched

            value-of-call        65.7169+-0.6192     ^     45.0986+-0.0830        ^ definitely 1.4572x faster

        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::toStringSlowCase const):
        * runtime/JSObject.cpp:
        (JSC::callToPrimitiveFunction):

2021-06-20  Robin Morisset  <rmorisset@apple.com>

        Fix speculated type in the one-argument overload of speculateNeitherDoubleNorHeapBigIntNorString
        https://bugs.webkit.org/show_bug.cgi?id=227119

        Reviewed by Yusuke Suzuki.

        Same problem as bug 226786: a missing check for HeapBigInt in the speculateNeitherDoubleNorHeapBigIntNorString function introduced in 226676.

        I also rewrote the SpeculatedType for NeitherDoubleNorHeapBigIntNorString in typeFilterFor for readability. The old and the new SpeculatedType are perfectly identical, it is just a different (and in my view more readable) way of writing it.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):

2021-06-19  Mark Lam  <mark.lam@apple.com>

        [Revert r278576] Put the Baseline JIT prologue and op_loop_hint code in JIT thunks.
        https://bugs.webkit.org/show_bug.cgi?id=226375

        Not reviewed.

        Suspect regresses Speedometer2.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::untagReturnAddress):
        (JSC::AbstractMacroAssembler::untagReturnAddressWithoutExtraValidation): Deleted.
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagReturnAddress):
        (JSC::MacroAssemblerARM64E::untagReturnAddressWithoutExtraValidation): Deleted.
        * assembler/MacroAssemblerARMv7.h:
        * assembler/MacroAssemblerMIPS.h:
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::addressOfNumParameters):
        (JSC::CodeBlock::offsetOfNumParameters):
        (JSC::CodeBlock::offsetOfInstructionsRawPointer):
        (JSC::CodeBlock::offsetOfNumCalleeLocals): Deleted.
        (JSC::CodeBlock::offsetOfNumVars): Deleted.
        (JSC::CodeBlock::offsetOfArgumentValueProfiles): Deleted.
        (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): Deleted.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
        (JSC::AssemblyHelpers::emitSaveCalleeSavesForBaselineJIT): Deleted.
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesForBaselineJIT): Deleted.
        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::privateCompileExceptionHandlers):
        (JSC::prologueGeneratorSelector): Deleted.
        (JSC::JIT::prologueGenerator): Deleted.
        (JSC::JIT::arityFixupPrologueGenerator): Deleted.
        * jit/JIT.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedNearCall):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::op_enter_Generator): Deleted.
        (JSC::JIT::op_enter_canBeOptimized_Generator): Deleted.
        (JSC::JIT::op_enter_cannotBeOptimized_Generator): Deleted.
        (JSC::JIT::op_loop_hint_Generator): Deleted.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_enter):
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):

2021-06-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r278699.
        https://bugs.webkit.org/show_bug.cgi?id=227174

        Regressed JetStream2/WSL

        Reverted changeset:

        "[JSC] Remove useDataICInOptimizingJIT option"
        https://bugs.webkit.org/show_bug.cgi?id=226862
        https://trac.webkit.org/changeset/278699

2021-06-18  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to B3ReduceStrength based on Bug 226984
        https://bugs.webkit.org/show_bug.cgi?id=227138

        Reviewed by Filip Pizlo.

        In the previous patch bug 226984, a new pattern could be introduced to 
        B3ReduceStrength.cpp for further optimization, which is that:

        dest = (src >> shiftAmount) & mask

        is equivalent to

        src >> shiftAmount

        under these constraints:

        1. shiftAmount >= 0 
        2. mask has a binary format in contiguous ones starting from the 
           least significant bit.
        3. shiftAmount + bitCount(mask) == maxBitWidth

        For instance (32-bit):

        (src >> 12) & 0x000fffff == src >> 12

        This reduction is more beneficial than UBFX in this case.  

        // B3 IR
        Int @0 = ArgumentReg(%0)
        Int @1 = 12
        Int @2 = ZShr(@0, @1)
        Int @3 = 0x000fffff
        Int @4 = BitAnd(@2, @3))
        Void@5 = Return(@4, Terminal)    

        w/o the pattern:
        // Old optimized AIR
        Ubfx %0, $12, $20, %0, @4
        Ret  %0,               @5

        w/ the pattern:
        // New optimized AIR
        Urshift %0, $12, %0, @3
        Ret32   %0,          @6

        * b3/B3ReduceStrength.cpp:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testBitAndZeroShiftRightImmMask32):
        (testBitAndZeroShiftRightImmMask64):
        (addBitTests):

2021-06-18  Robin Morisset  <rmorisset@apple.com>

        [DFG] Untyped branches should eliminate checks based on results from the AbstractInterpreter
        https://bugs.webkit.org/show_bug.cgi?id=227159

        Reviewed by Filip Pizlo.

        We currently emit a ton of code for Untyped branches, as we use branchIfTruthy which does not know anything about the abstract interpreter.
        Even worse: we call branchIfTruthy after emitting some fast paths, and branchIfTruthy replicates these fast paths (Int32 and Booleans).
        While I plan to reduce the number of Untyped branches in some separate patches, there is a very long tail of predicted types visible in benchmarks, so I expect some of them to remain no matter what, justifying making the code emitted in that case more reasonable.

        The implementation in this patch is fairly straightforward, as it follows very closely branchOnValue() from AssemblyHelpers (which was previously called through branchIfTruthy).

        It was tested on the JSC stress tests, as well as on JetStream2.

        On JetStream2, it reduced the average number of bytes emitted for Branch by the DFG from 30.1 to 27.5 (highly significant, it only changes by about 0.1 between runs).
        Since only about 1.5k branches are untyped out of 34k in that benchmark, it means that this patch reduces the amount of code emitted for untyped branches by about 50 bytes on average.

        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::branchDoubleZeroOrNaN):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitUntypedBranch):
        (JSC::DFG::SpeculativeJIT::emitBranch):

2021-06-17  Mark Lam  <mark.lam@apple.com>

        Rename numberOfPACBits to maxNumberOfAllowedPACBits.
        https://bugs.webkit.org/show_bug.cgi?id=227156

        Reviewed by Saam Barati.

        Just renaming the constant to better describe what it represents.  There are no
        behavior changes.

        * assembler/MacroAssemblerARM64E.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::cageWithoutUntagging):
        (JSC::AssemblyHelpers::cageConditionallyAndUntag):
        * llint/LowLevelInterpreter64.asm:

2021-06-17  Mark Lam  <mark.lam@apple.com>

        Define MacroAssemblerARM64E::numberOfPACBits based on OS_CONSTANT(EFFECTIVE_ADDRESS_WIDTH).
        https://bugs.webkit.org/show_bug.cgi?id=227147
        rdar://78785309

        Reviewed by Saam Barati.

        * assembler/MacroAssemblerARM64E.h:
        * bytecode/CodeOrigin.h:
        * runtime/JSString.h:
        * runtime/OptionsList.h:

2021-06-17  Fujii Hironori  <Hironori.Fujii@sony.com>

        Reimplement JSC::CachePayload without FileSystem::unmapViewOfFile and FileSystem::MappedFileData::leakHandle
        https://bugs.webkit.org/show_bug.cgi?id=227014

        Reviewed by Yusuke Suzuki.

        r247542 (Bug 199759) added FileSystem::unmapViewOfFile and
        FileSystem::MappedFileData::leakHandle for JSC::CachePayload to
        get the mapped address and to free the address.

        However, Bug 227011 is going to add a file mapping handle to
        FileSystem::MappedFileData for Windows port to create a
        SharedMemory from a MappedFileData. Destruction of MappedFileData
        should be done only by MappedFileData dtor.

        * runtime/CachePayload.cpp:
        (JSC::CachePayload::makeMappedPayload):
        (JSC::CachePayload::makeMallocPayload):
        (JSC::CachePayload::makeEmptyPayload):
        (JSC::CachePayload::CachePayload):
        (JSC::CachePayload::data const):
        (JSC::CachePayload::size const):
        (JSC::CachePayload::~CachePayload): Deleted.
        (JSC::CachePayload::operator=): Deleted.
        (JSC::CachePayload::freeData): Deleted.
        * runtime/CachePayload.h: Use Variant for data.
        (JSC::CachePayload::data const): Deleted.
        (JSC::CachePayload::size const): Deleted.
        (JSC::CachePayload::CachePayload): Deleted.

2021-06-17  Yijia Huang  <yijia_huang@apple.com>

        Add a new pattern to instruction selector to utilize UBFX supported by ARM64
        https://bugs.webkit.org/show_bug.cgi?id=226984

        Reviewed by Filip Pizlo.

        UBFX, supported by ARM64, copies adjacent bits from the source register into 
        the least significant bits of a destination register in zero extension. The 
        instruction selector can utilize this to lowering certain patterns in B3 IR 
        before further Air optimization.

        ubfx dest, src, lsb, width
           tmp, tmp, imm, imm

        This is equivalent to "dest = (src >> lsb) & ((1 << width) - 1)". Since wasm 
        introduces constant folding, then the pattern would be:

        dest = (src >> lsb) & mask

        where the mask should have a binary format in contiguous ones starting from 
        the least significant bit. For example:

        0b00111111

        To make the pattern matching in instruction selection beneficial to JIT, these 
        constraints should be introduced:

        1. lsb >= 0 
        2. width > 0
        3. lsb + width <= bit field limit (32 or 64)

        Given:
        // B3 IR
        Int @0 = ArgumentReg(%0)
        Int @1 = lsb
        Int @2 = 0b0011
        Int @3 = ZShr(@0, @1)
        Int @4 = BitAnd(@3, @2)  
        Void@5 = Return(@4, Terminal)      

        w/o UBFX Pattern:
        // Old optimized AIR
        Urshift %x0, lsb, %x0, @3
        And  0b0011, %x0, %x0, @4
        Ret     %x0,           @5

        w/ UBFX Pattern:
        // New optimized AIR
        Ubfx %x0, lsb, 2, %x0, @4
        Ret  %x0,              @5

        Note:
        Suppose a 32-bit version of (src >> 20) & 0x0FFF, it is equivalent to src >> 20. 
        In this case, Logical Shift Right should be utilized instead when:

        lsb + width == bit field limit (32 or 64)

        This case/pattern should be added and upadated in the future patch.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::ubfx32):
        (JSC::MacroAssemblerARM64::ubfx64):
        * assembler/testmasm.cpp:
        (JSC::testUbfx32):
        (JSC::testUbfx64):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testUbfx64PatternMatch):
        (testUbfx32PatternMatch):
        (addBitTests):

2021-06-17  Angelos Oikonomopoulos  <angelos@igalia.com>

        [JSC] Work around apparent miscompilation on ARM/GCC >=8.4
        https://bugs.webkit.org/show_bug.cgi?id=227125

        Reviewed by Filip Pizlo.

        This seems to be a GCC miscompilation, revealed by
        https://bugs.webkit.org/show_bug.cgi?id=227078.  Introduce a
        workaround for the GCC versions that seem to be affected.

        * jit/RegisterSet.h:

2021-06-16  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize JSON.parse with small data by changing Identifier pool mechanism
        https://bugs.webkit.org/show_bug.cgi?id=227101

        Reviewed by Mark Lam.

        Found that std::array<Identifier, 128> pool in LiteralParser is too costly for construction and destruction
        if JSON.parse is invoked for small data. This patch changes this pool mechanism so that we do not waste effort
        allocating null Identifiers to pre-populate the recent identifiers pool. Instead, we now use a m_recentIdentifiersIndex
        uint8_t array to indicate whether there's a cached recent identifier for each given first character.

        We also use KeywordLookup.h's COMPARE_XCHARS to perform "true" / "false" / "null" lexing in JSON parser.
        Roughly 20% improvement in microbenchmark. And roughly 2-3% improvement in Speedometer2/Flight-TodoMVC.

                                            ToT                     Patched

            flight-todomvc-json       67.8755+-1.1202     ^     56.7114+-0.5048        ^ definitely 1.1969x faster

        * runtime/Identifier.cpp:
        (JSC::Identifier::add):
        (JSC::Identifier::add8):
        * runtime/Identifier.h:
        (JSC::Identifier::Identifier):
        (JSC::Identifier::add):
        * runtime/IdentifierInlines.h:
        (JSC::Identifier::add):
        (JSC::Identifier::fromString):
        * runtime/LiteralParser.cpp:
        (JSC::compare3Chars):
        (JSC::compare4Chars):
        (JSC::LiteralParser<CharType>::makeIdentifier):
        (JSC::LiteralParser<CharType>::Lexer::lex):
        * runtime/LiteralParser.h:

2021-06-16  Mark Lam  <mark.lam@apple.com>

        Adopt com.apple.security.cs.jit-write-allowlist on internal builds.
        https://bugs.webkit.org/show_bug.cgi?id=222148
        rdar://74284026

        Reviewed by Per Arne Vollan.

        This will prevent various pthread permissions switching APIs from working.
        We only want to adopt this for internal builds where we use the fast permission
        switching macro instead.  We can't adopt it for open source builds, where we
        still rely on the pthread API.

        * Scripts/process-entitlements.sh:

2021-06-16  Robin Morisset  <rmorisset@apple.com>

        Don't look at the (non-existent) child2 of DelById
        https://bugs.webkit.org/show_bug.cgi?id=227095

        Reviewed by Mark Lam.

        Trivial fix to a broken rebase: while it is ok to share most code between DelById and DelByVal, only the latter has a child2(), so it should not be accessed if we are compiling the former.
        No new test, as it was caught by one of our existing tests.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):

2021-06-16  Yijia Huang  <yijia_huang@apple.com>

        Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and select this instruction in Air
        https://bugs.webkit.org/show_bug.cgi?id=226937

        Reviewed by Yusuke Suzuki.

        Previously, Air arm64 sub32/64 utilize sub(Imm, Tmp) at optlevel = 0 and 
        add(Tmp, -Imm) at optlevel > 0 to perform and optimize sub(Tmp, Imm, Tmp).
        The issue with this is that we were not eliding redundant operations. 

        For example:
        // B3 IR
        @0 = Trunc(ArgumentReg(0))
        @1 = Const
        @2 = Sub(@0, @1)
        @3 = Return(@2)

        // Old optimized Air IR
        // OptLevel = 0
        Move    %x0, %tmp1, @0
        Move $Const, %tmp2, @1
        Move  %tmp1, %tmp0, @2 // Redundant
        Sub  $Const, %tmp0, @2
        Move  %tmp0,   %x0, @3
        Ret32   %x0,        @3

        To remove those redundant instructions, Air arm64 sub32/64 opcode should 
        indicate a new form sub(Tmp, Imm, Tmp).

        // New optimized Air IR
        // OptLevel = 0
        Move    %x0,  %tmp1,        @0
        Move $Const,  %tmp2,        @1
        Sub   %tmp1, $Const, %tmp0, @2
        Move  %tmp0,    %x0,        @3
        Ret32   %x0,                @3

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::sub32):
        (JSC::MacroAssemblerARM64::sub64):
        * assembler/testmasm.cpp:
        (JSC::testSub32Args):
        (JSC::testSub32Imm):
        (JSC::testSub32ArgImm):
        (JSC::testSub64Imm32):
        (JSC::testSub64ArgImm32):
        (JSC::testSub64Imm64):
        (JSC::testSub64ArgImm64):
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testSubArgs32ZeroExtend):
        * b3/testb3_3.cpp:
        (addArgTests):

2021-06-16  Robin Morisset  <rmorisset@apple.com>

        Drop the FTL(DFG) graph after lowering to B3
        https://bugs.webkit.org/show_bug.cgi?id=226556

        Reviewed by Phil Pizlo.

        This patch originally landed as r278463, was reverted in r278463.
        I believe that the bug for which it was reverted actually comes from r278371, which was also reverted at the same time. So I am now relanding this.

        The challenge in this patch was dealing with all of the Patchpoints created by FTLLowerDFGToB3: they get a lambda at that time, which they execute at the end of Air, and many of these lambdas were capturing a pointer to some parts of the DFG graph and reading through it when being executed.
        In all cases but one it was easily fixed: they were only reading a few bits from a given node, so I just read these bits in FTLLowerDFGToB3, and captured them (by value) instead of the pointer to the node.
        The exception was compileCallOrConstructVarargsSpread(): its patchpoint generator was walking through the graph, flattening a tree of PhantomSpread/PhantomNewArrayWithSpread/PhantomNewArrayBuffer/PhantomCreateRest, emitting some code along the way.
        We now do this flattening of the tree in FTLLowerDFGToB3, store just enough information to later emit the required code in a vector, and capture that vector in the lambda (through a move capture, which is allowed since C++14). See `struct VarargsSpreadArgumentToEmit` for the information that we need to store in that vector.

        I tested this change by completing a full run of JetStream2 with ASAN.
        I also ran the stress tests with "spread" in their name in Debug mode.

        * b3/B3SparseCollection.h:
        (JSC::B3::SparseCollection::clearAll):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::freeDFGIRAfterLowering):
        * dfg/DFGGraph.h:
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
        (JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::VarargsSpreadArgumentToEmit::VarargsSpreadArgumentToEmit):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        (JSC::FTL::DFG::LowerDFGToB3::compileInById):
        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
        (JSC::FTL::DFG::LowerDFGToB3::getById):
        (JSC::FTL::DFG::LowerDFGToB3::getByIdWithThis):
        (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
        (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
        (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
        (JSC::FTL::DFG::LowerDFGToB3::crash):

2021-06-16  Filip Pizlo  <fpizlo@apple.com>

        RegisterSet should be smaller
        https://bugs.webkit.org/show_bug.cgi?id=227078

        Reviewed by Geoff Garen.

        Previously, every RegisterSet would have an extra 64-bit word in it just to hold state
        relevant to hashtable keys.

        But RegisterSet is almost never used as a hashtable key.

        This patch moves the hashtable key support into a subclass, HashableRegisterSet. That class
        ends up only being used in one place.

        On ARM64, this makes RegisterSet use 64 bits instead of 128 bits.

        On X86_64, this makes RegisterSet use 32 bits instead of 64 bits.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * ftl/FTLSlowPathCallKey.h:
        (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
        * jit/HashableRegisterSet.h: Added.
        (JSC::HashableRegisterSet::HashableRegisterSet):
        (JSC::HashableRegisterSet::isEmptyValue const):
        (JSC::HashableRegisterSet::isDeletedValue const):
        (JSC::RegisterSetHash::hash):
        (JSC::RegisterSetHash::equal):
        * jit/RegisterSet.h:
        (): Deleted.
        (JSC::RegisterSet::isEmptyValue const): Deleted.
        (JSC::RegisterSet::isDeletedValue const): Deleted.
        (JSC::RegisterSetHash::hash): Deleted.
        (JSC::RegisterSetHash::equal): Deleted.

2021-06-16  Tadeu Zagallo  <tzagallo@apple.com>

        AssemblyHelpers should save/restore callee save FPRs
        https://bugs.webkit.org/show_bug.cgi?id=227052
        <rdar://77080162>

        Reviewed by Mark Lam.

        We have 3 functions in AssemblyHelpers to save and restore callee save registers that were filtering
        out any FPRs. This is an issue since we do have callee save FPRs in arm64 and these functions can be
        called from the FTL, and FTL uses those callee saves. The test case shows how that's an issue with tail
        calls on FTL: the callee saves are correctly stored in the prologue and restored in the epilogue, but
        when emitting a tail call we use AssemblyHelpers::emitRestoreCalleeSaves to restore the callee saves,
        which doesn't restore FPRs. This results in the callee save FPRs being trashed. To fix this we just need
        to stop filtering out the FPRs, if they are listed as used by the code block they should be saved/restored
        accordingly. I also changed DFGOSREntry to stop filtering out the callee save FPRs and instead assert
        there aren't any, since they aren't currently used in the DFG, but it could help avoid the same issue in
        the future.

        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
        (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor):
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):

2021-06-16  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r278846.
        https://bugs.webkit.org/show_bug.cgi?id=227060

        Speculative revert based on failure history of Speedometer2

        Reverted changeset:

        "Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and
        select this instruction in Air"
        https://bugs.webkit.org/show_bug.cgi?id=226937
        https://trac.webkit.org/changeset/278846

2021-06-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Optimize JSON.parse with small content by dropping single character Identifier pool
        https://bugs.webkit.org/show_bug.cgi?id=227057

        Reviewed by Sam Weinig.

        Profiler results and investigation suggest interesting things.

            1. Sampling profiler says Flight-TodoMVC is mostly JSON.parse benchmark.
            2. Each JSON data of Flight-TodoMVC is small. And JSON.parse is super frequently called.
            3. In the case of JSON.parse with small data, LiteralParser's construction / destruction costs much since
               it has large Identifier pool with std::array<>.

        As a simple first step, this patch removes single character Identifier pool from LiteralParser since
        the exact same Identifier data can be retrieved from VM's SmallStrings.

        We created a microbenchmark from Flight-TodoMVC's data, and the result is roughly 20% better.
        And we observed 0.6% improvement in Speedometer2.

                                            ToT                     Patched

            flight-todomvc-json       81.0552+-0.8403     ^     67.5756+-0.6221        ^ definitely 1.1995x faster

            ----------------------------------------------------------------------------------------------------------------------------------
            |               subtest                |     ms      |     ms      |  b / a   | pValue (significance using False Discovery Rate) |
            ----------------------------------------------------------------------------------------------------------------------------------
            | Elm-TodoMVC                          |128.991667   |128.450000   |0.995801  | 0.278228                                         |
            | VueJS-TodoMVC                        |28.487500    |27.925000    |0.980254  | 0.139315                                         |
            | EmberJS-TodoMVC                      |133.950000   |134.175000   |1.001680  | 0.685021                                         |
            | BackboneJS-TodoMVC                   |51.670833    |51.537500    |0.997420  | 0.628993                                         |
            | Preact-TodoMVC                       |21.783333    |21.754167    |0.998661  | 0.944237                                         |
            | AngularJS-TodoMVC                    |143.820833   |143.770833   |0.999652  | 0.933953                                         |
            | Vanilla-ES2015-TodoMVC               |71.608333    |71.416667    |0.997323  | 0.500591                                         |
            | Inferno-TodoMVC                      |69.179167    |69.525000    |1.004999  | 0.412406                                         |
            | Flight-TodoMVC                       |81.354167    |79.020833    |0.971319  | 0.000053 (significant)                           |
            | Angular2-TypeScript-TodoMVC          |42.654167    |41.887500    |0.982026  | 0.086053                                         |
            | VanillaJS-TodoMVC                    |57.054167    |56.633333    |0.992624  | 0.176804                                         |
            | jQuery-TodoMVC                       |274.595833   |275.670833   |1.003915  | 0.148812                                         |
            | EmberJS-Debug-TodoMVC                |358.387500   |357.595833   |0.997791  | 0.323387                                         |
            | React-TodoMVC                        |93.804167    |93.329167    |0.994936  | 0.113410                                         |
            | React-Redux-TodoMVC                  |157.954167   |157.266667   |0.995647  | 0.131298                                         |
            | Vanilla-ES2015-Babel-Webpack-TodoMVC |68.687500    |68.054167    |0.990779  | 0.002155 (significant)                           |
            ----------------------------------------------------------------------------------------------------------------------------------
            a mean = 235.28964
            b mean = 236.72163
            pValue = 0.0121265559
            (Bigger means are better.)
            1.006 times better
            Results ARE significant

        * runtime/Identifier.h:
        (JSC::Identifier::canUseSingleCharacterString):
        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser<CharType>::makeIdentifier):
        * runtime/LiteralParser.h:
        * runtime/SmallStrings.cpp:
        (JSC::SmallStrings::singleCharacterStringRep):
        * runtime/SmallStrings.h:

2021-06-15  Keith Miller  <keith_miller@apple.com>

        Shouldn't drain the micro task queue when calling out to ObjC
        https://bugs.webkit.org/show_bug.cgi?id=161942

        Unreviewed, relanding r278734.

        * API/tests/testapi.cpp:
        (TestAPI::promiseDrainDoesNotEatExceptions):
        (testCAPIViaCpp):
        * API/tests/testapi.mm:
        (testMicrotaskWithFunction):
        (testObjectiveCAPI):
        * runtime/JSLock.cpp:
        (JSC::JSLock::willReleaseLock):
        * runtime/ObjectPrototype.cpp:
        (JSC::isPokerBros):
        * runtime/VM.cpp:
        (JSC::VM::didExhaustMicrotaskQueue):

2021-06-15  Michael Catanzaro  <mcatanzaro@gnome.org>

        -Warray-bounds warning in Packed.h
        https://bugs.webkit.org/show_bug.cgi?id=226557
        <rdar://problem/79103658>

        Reviewed by Darin Adler.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):

2021-06-15  Mark Lam  <mark.lam@apple.com>

        Move setting of scratch buffer active lengths to the runtime functions.
        https://bugs.webkit.org/show_bug.cgi?id=227013
        rdar://79325068

        Reviewed by Keith Miller.

        We previously emit JIT'ed code to set and unset the ScratchBuffer active length
        around calls into C++ runtime functions.  This was needed because the runtime
        functions may allow GC to run, and GC needs to be able to scan the values stored
        in the ScratchBuffer.

        In this patch, we change it so that the runtime functions that need it will
        declare an ActiveScratchBufferScope RAII object that will set the ScratchBuffer
        active length, and unset it on exit.  This allows us to:

        1. Emit less JIT code.  The runtime function can take care of it.
        2. Elide setting the ScratchBuffer active length if not needed.  The runtime
           functions know whether they can GC or not.  They only need to set the active
           length if they can GC.

        Note that scanning of the active ScratchBuffer is done synchronously on the
        mutator thread via Heap::gatherScratchBufferRoots(), which is called as part of
        the GC conservative root scan.  This means there is no urgency / sequencing that
        requires that the active length be set before calling into the runtime function.
        Setting it in the runtime function itself is fine as long as it is done before
        the function executes any operations that can GC.

        This patch also made the following changes:

        1. Introduce ActiveScratchBufferScope RAII object used to set/unset the
           ScratchBuffer length in the runtime functions.  ActiveScratchBufferScope takes
           the active length in units of number of stack slots / Registers / JSValues
           instead of bytes.

        2. Deleted ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall()
           and ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall().
           These functions are unused.

        The reasoning behind what values to pass to ActiveScratchBufferScope, is any:

        1. AssemblyHelpers::debugCall() in AssemblyHelpers.cpp:
           The ScratchBuffer is only used for operationDebugPrintSpeculationFailure(),
           which now declares an ActiveScratchBufferScope.

           The active length is GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters.
           See scratchSize in AssemblyHelpers::debugCall().

        2. genericGenerationThunkGenerator() in FTLThunks.cpp:
           The scratch buffer size for determining the active length is
           requiredScratchMemorySizeInBytes().  

           However, genericGenerationThunkGenerator() generates code to call either
           operationCompileFTLOSRExit() or operationCompileFTLLazySlowPath().  Both of
           these functions will DeferGCForAWhile.  Hence, GC cannot run, and we don't need
           to set the active length here.

        3. compileArrayPush() in FTLLowerDFGToB3.cpp:

           Cases Array::Int32, Array::Contiguous, or Array::Double calls
           operationArrayPushMultiple() or operationArrayPushDoubleMultiple().

           For operationArrayPushMultiple(), the active length is elementCount.  See
           computation of scratchSize.

           For operationArrayPushDoubleMultiple(), we don't need to set the active length
           because the ScratchBuffer only contains double values.  The GC does not need
           to scan those.

           Case Array::ArrayStorage calls operationArrayPushMultiple().
           The active length is elementCount.  See computation of scratchSize.

           compileNewArray() in FTLLowerDFGToB3.cpp:

           Calls operationNewArray().  Active length is m_node->numChildren(), which is
           passed to operationNewArray() as the size parameter.  See computation of
           scratchSize.

           compileNewArrayWithSpread() in FTLLowerDFGToB3.cpp:

           Calls operationNewArrayWithSpreadSlow().  Active length is m_node->numChildren(),
           which is passes to operationNewArrayWithSpreadSlow() as the numItems parameter.
           See computation of scratchSize.

        4. osrExitGenerationThunkGenerator() in DFGThunks.cpp:

           Calls operationCompileOSRExit().  Active length is GPRInfo::numberOfRegisters +
           FPRInfo::numberOfRegisters.  See computation of scratchSize.

        5. compileNewArray() in DFGSpeculativeJIT.cpp:

           Calls operationNewArray().  Active length is node->numChildren(), which is
           passed in as the size parameter.

           compileNewArrayWithSpread() in DFGSpeculativeJIT.cpp:

           Calls operationNewArrayWithSpreadSlow().  Active length is node->numChildren(),
           which is passed in as the numItems parameter.

           compileArrayPush() in DFGSpeculativeJIT.cpp:

           Calls operationArrayPushMultiple().  Active length is elementCount, which is
           passed in as the elementCount parameter.

           Calls operationArrayPushDoubleMultiple().  Active length is elementCount, but
           we don't need to set it because the ScratchBuffer only contains double values.


        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewArray):
        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
        (JSC::DFG::SpeculativeJIT::compileArrayPush):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::debugCall):
        * jit/ScratchRegisterAllocator.cpp:
        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall): Deleted.
        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall): Deleted.
        * jit/ScratchRegisterAllocator.h:
        * runtime/VM.h:
        * runtime/VMInlines.h:
        (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope):
        (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope):

2021-06-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Workaround ICU uloc_addLikelySubtags / uloc_minimizeSubtags bugs
        https://bugs.webkit.org/show_bug.cgi?id=226996
        rdar://79250513

        Reviewed by Ross Kirsling.

        ICU has bugs that uloc_addLikelySubtags / uloc_minimizeSubtags cannot handle very long locale ID that exceeds ULOC_FULLNAME_CAPACITY,
        while these functions can take arbitrary sized buffer for output. This can be achieved simply by (1) attaching many unicode extensions,
        or (2) having many variants.

        In this patch, we add a workaround: if uloc_addLikelySubtags / uloc_minimizeSubtags failed, we perform them without having locale ID
        keywords part. After performing the operations, we append these keywords back.

        This is workaround, and still this workaround is not complete since we could have many variants. In that case, uloc_addLikelySubtags / uloc_minimizeSubtags
        still fails, and in that case, for now, we give up performing uloc_addLikelySubtags / uloc_minimizeSubtags. Fixing this needs to be
        done in ICU side: https://unicode-org.atlassian.net/browse/ICU-21639

        * runtime/IntlLocale.cpp:
        (JSC::IntlLocale::keywordValue const):
        (JSC::IntlLocale::maximal):
        (JSC::IntlLocale::minimal):
        (JSC::IntlLocale::baseName):

2021-06-14  Mark Lam  <mark.lam@apple.com>

        Add ldp and stp support for FP registers, plus some bug fixes.
        https://bugs.webkit.org/show_bug.cgi?id=226998
        rdar://79313717

        Reviewed by Robin Morisset.

        This patch does the following:
        1. Add ldp and stp support for FP registers.
           This simply entails providing wrappers that take FPRegisterID and passing true
           for the V bit to the underlying loadStoreRegisterPairXXX encoding function.
           V is for vector (aka floating point).  This will cause bit 26 in the instruction
           to be set indicating that it's loading / storing floating point registers.

        2. Add ARM64 disassembler support ldp and stp for FP registers.
           This includes fixing A64DOpcodeLoadStoreRegisterPair::mask to not exclude the
           FP versions of the instructions.

        3. Add ARM64Assembler query methods for determining if an immediate is encodable
           as the signed 12 bit immediate of ldp and stp instructions.

        4. Fix ldp and stp offset form to take an int instead of an unsigned.  The
           immediate it takes is a 12-bit signed int, not unsigned.

        5. In loadStoreRegisterPairXXX encoding functions used by the forms of ldp and stp,
           RELEASE_ASSERT that the passed in immediate is encodable.  Unlike ldur / stur,
           there is no form of ldp / stp that takes the offset in a register that can be
           used as a fail over.  Hence, if the immediate is not encodable, this is a
           non-recoverable event.  The client is responsible for ensuring that the offset
           is encodable.

        6. Added some testmasm tests for testing the offset form (as opposed to PreIndex
           and PostIndex forms) of ldp and stp.  We currently only use the offset form
           in our JITs.

        * assembler/ARM64Assembler.h:
        (JSC::ARM64Assembler::isValidLDPImm):
        (JSC::ARM64Assembler::isValidLDPFPImm):
        (JSC::ARM64Assembler::ldp):
        (JSC::ARM64Assembler::ldnp):
        (JSC::ARM64Assembler::isValidSTPImm):
        (JSC::ARM64Assembler::isValidSTPFPImm):
        (JSC::ARM64Assembler::stp):
        (JSC::ARM64Assembler::stnp):
        (JSC::ARM64Assembler::loadStoreRegisterPairPostIndex):
        (JSC::ARM64Assembler::loadStoreRegisterPairPreIndex):
        (JSC::ARM64Assembler::loadStoreRegisterPairOffset):
        (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):
        * assembler/AssemblerCommon.h:
        (JSC::isValidSignedImm7):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::loadPair64):
        (JSC::MacroAssemblerARM64::storePair64):
        * assembler/testmasm.cpp:
        (JSC::testLoadStorePair64Int64):
        (JSC::testLoadStorePair64Double):
        * disassembler/ARM64/A64DOpcode.cpp:
        (JSC::ARM64Disassembler::A64DOpcodeLoadStoreRegisterPair::format):
        * disassembler/ARM64/A64DOpcode.h:

2021-06-14  Yijia Huang  <yijia_huang@apple.com>

        Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and select this instruction in Air
        https://bugs.webkit.org/show_bug.cgi?id=226937

        Reviewed by Saam Barati.

        Previously, Air arm64 sub32/64 utilize sub(Imm, Tmp) at optlevel = 0 and 
        add(Tmp, -Imm) at optlevel > 0 to perform and optimize sub(Tmp, Imm, Tmp).
        The issue with this is that we were not eliding redundant operations. 

        For example:
        // B3 IR
        @0 = Trunc(ArgumentReg(0))
        @1 = Const
        @2 = Sub(@0, @1)
        @3 = Return(@2)

        // Old optimized Air IR
        // OptLevel = 0
        Move    %x0, %tmp1, @0
        Move $Const, %tmp2, @1
        Move  %tmp1, %tmp0, @2 // Redundant
        Sub  $Const, %tmp0, @2
        Move  %tmp0,   %x0, @3
        Ret32   %x0,        @3

        To remove those redundant instructions, Air arm64 sub32/64 opcode should 
        indicate a new form sub(Tmp, Imm, Tmp).

        // New optimized Air IR
        // OptLevel = 0
        Move    %x0,  %tmp1,        @0
        Move $Const,  %tmp2,        @1
        Sub   %tmp1, $Const, %tmp0, @2
        Move  %tmp0,    %x0,        @3
        Ret32   %x0,                @3

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::sub32):
        (JSC::MacroAssemblerARM64::sub64):
        * assembler/testmasm.cpp:
        (JSC::testSub32Args):
        (JSC::testSub32Imm):
        (JSC::testSub32ArgImm):
        (JSC::testSub64Imm32):
        (JSC::testSub64ArgImm32):
        (JSC::testSub64Imm64):
        (JSC::testSub64ArgImm64):
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirOpcode.opcodes:
        * b3/testb3.h:
        * b3/testb3_2.cpp:
        (testSubArgs32ZeroExtend):
        * b3/testb3_3.cpp:
        (addArgTests):

2021-06-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r278734.
        https://bugs.webkit.org/show_bug.cgi?id=226973

        broke jsc testapi

        Reverted changeset:

        "Shouldn't drain the micro task queue when calling out to
        ObjC"
        https://bugs.webkit.org/show_bug.cgi?id=161942
        https://trac.webkit.org/changeset/278734

2021-06-13  Saam Barati  <sbarati@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=226576
        <rdar://problem/78810362>

        Reviewed by Yusuke Suzuki.

        ShortCircuitReadModifyResolveNode can't emit a value into
        its result until after it emits a TDZ check. We were temporarily
        storing the result of the get_from_scope into the dst. Then
        we'd emit the TDZ check. The TDZ check can throw, and it could
        lead to us returning TDZ from the eval itself. Instead, we need
        to use a temporary to emit a TDZ check on. Only after the TDZ check
        passes can we move the temporary into the result.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ShortCircuitReadModifyResolveNode::emitBytecode):

2021-06-12  Michael Catanzaro  <mcatanzaro@gnome.org>

        -Wnonnull warning in JITCall.cpp
        https://bugs.webkit.org/show_bug.cgi?id=226643
        <rdar://problem/79197261>

        Reviewed by Darin Adler.

        This is a false-positive, so suppress it using
        IGNORE_ERRONEOUS_GCC_NULL_CHECK_WARNINGS_BEGIN.

        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):

2021-06-12  Robin Morisset  <rmorisset@apple.com>

        We should drop B3 values while running Air
        https://bugs.webkit.org/show_bug.cgi?id=226187

        Reviewed by Saam Barati.

        NB: this patch first landed as r278371, then was reverted in r278587 as it broke --dumpDisassembly().
        I fixed the bug (a missing line setDisassembler()) and am now re-landing it. Below is a copy of the original Changelog.

        We must keep the following values:
        - WasmBoundsCheck, to know whether it is Pinned or Maximum, and if it is pinned find its argument.
        - CCall/Patch/Check/CheckAdd/CheckSub/CheckMul and all of their children, because all of these are lowered to Air::Patchpoint, which needs to know the type of its arguments, and does so by looking at the children of its        origin.
        I intend to fix these in later patches if possible.

        Finally we must preserve all B3 values in the following cases:
        - if we dump the disassembly or the Air graph: because otherwise we cannot print the origins
        - if we are using the sampling profiler, because it relies on PCToCodeOriginMap which we cannot accurately fill without these origins.

        We must also keep m_tuples alive, as it is used by Patchpoints in Air to understand the types of their arguments.
        We also don't touch StackSlots (in this patch), because one of them is captured by FTL::State.

        Also now PCToOriginMap has a Vector with no inline capacity, since it is either quite large (if needed) or empty (otherwise).

        The performance impact of this is a progression on various RAMification subtests on Mac, but is more mitigated on iPhone7, with various regressions.
        I suspect these to be noise, and will monitor the performance bots post-landing to make sure of it.

        * b3/B3LowerToAir.cpp:
        (JSC::B3::lowerToAir):
        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::freeUnneededB3ValuesAfterLowering):
        * b3/B3Procedure.h:
        (JSC::B3::Procedure::releasePCToOriginMap):
        (JSC::B3::Procedure::setNeedsPCToOriginMap):
        (JSC::B3::Procedure::needsPCToOriginMap):
        * b3/B3SparseCollection.h:
        (JSC::B3::SparseCollection::clearAll):
        (JSC::B3::SparseCollection::filterAndTransfer):
        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::Code):
        * b3/air/AirCode.h:
        (JSC::B3::Air::Code::shouldPreserveB3Origins const):
        * b3/air/AirGenerate.cpp:
        (JSC::B3::Air::generateWithAlreadyAllocatedRegisters):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLState.cpp:
        (JSC::FTL::State::State):

2021-06-11  Patrick Angle  <pangle@apple.com>

        Web Inspector: Add instrumentation to node destruction for InspectorDOMAgent
        https://bugs.webkit.org/show_bug.cgi?id=226624

        Reviewed by Devin Rousso.

        Add new `DOM.willDestroyDOMNode` event to inform the frontend of DOM nodes that no longer exist, even if they
        weren't in the DOM tree. This work serves as a prelude to <https://webkit.org/b/189687> (Web Inspector: preserve
        DOM.NodeId if a node is removed and re-added) to eventually only forget about nodes upon destruction, instead of
        removal from the DOM tree.

        * inspector/protocol/DOM.json:

2021-06-11  Yijia Huang  <yijia_huang@apple.com>

        Air ARM64 sub32 opcode should indicate that it zero-extends its result
        https://bugs.webkit.org/show_bug.cgi?id=226849

        Reviewed by Saam Barati.

        Sub32 was previously not saying that its result is zero defined. However,
        sub32 on arm64 architectures zero defines its result, so the top 32 bits
        are zeroed. The issue with this is what we were not eliding provably
        redundant zero extend operations.

        For example:
        // B3 IR
        @0 = Trunc(ArgumentReg(0))
        @1 = Trunc(ArgumentReg(1))
        @2 = Sub(@0, @1)
        @3 = ZExt32(@2) // i64
        @4 = Return(@3) or Store(@3, @x)

        // Old optimized Air IR
        Sub32 %x0, %x1, %x0, b@2
        Move32 %x0, %x0, b@3
        Ret64 %x0, b@4 or Move %x0, (%x), b@4

        To remove that redundant zero extend instruction (Move32), Air arm64 
        sub32 opcode should indicate that it zero-extends its result.

        // New optimized Air IR
        Sub32 %x0, %x1, %x0, b@2
        Ret64 %x0, b@6 or Move %x0, (%x), b@4

        * b3/air/AirOpcode.opcodes:

2021-06-10  Keith Miller  <keith_miller@apple.com>

        Shouldn't drain the micro task queue when calling out to ObjC
        https://bugs.webkit.org/show_bug.cgi?id=161942

        Reviewed by Saam Barati.

        It looks like the issue is that we aren't checking for the
        presence of dropped locks when deciding to drain microtasks during
        JSLock::unlock. This meant that when we drop all locks when
        calling out to API clients we would drain our microtasks at that
        point. An alternative would be to pass an extra parameter to the
        unlock function that says not to drain microtasks. I chose not to
        do that since it seemed a bit less robust.

        This patch is very likely to break existing API users. So I'm adding
        a linked on or after check to protect existing Apps.

        Lastly, change our Poker Bros check to use applicationSDKVersion too
        so others trying to add a linked on or after check don't use
        the dyld function directly too.

        * API/tests/testapi.cpp:
        (TestAPI::promiseDrainDoesNotEatExceptions):
        (testCAPIViaCpp):
        * API/tests/testapi.mm:
        (testMicrotaskWithFunction):
        (testObjectiveCAPI):
        * runtime/JSLock.cpp:
        (JSC::JSLock::willReleaseLock):
        * runtime/ObjectPrototype.cpp:
        (JSC::isPokerBros):
        * runtime/VM.cpp:
        (JSC::VM::didExhaustMicrotaskQueue):

2021-06-10  Mark Lam  <mark.lam@apple.com>

        Another speculative build fix for Win32.
        https://bugs.webkit.org/show_bug.cgi?id=226880
        rdar://79124858

        Reviewed by Keith Miller.

        We're getting reports of "warning C4206: nonstandard extension used: translation
        unit is empty" turning into a build error on Win32 ports.  By design, we rely on
        #define flags to make some translation units empty.  Hence, we don't want this
        warning to turn into an error.

        * config.h:

2021-06-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove useDataICInOptimizingJIT option
        https://bugs.webkit.org/show_bug.cgi?id=226862

        Reviewed by Mark Lam.

        Originally this option is added to fix performance problem when using DataIC in DFG / FTL.
        But it turned out that that performance regression was caused due to disablement of InlineAccess when
        using DataIC. With the configuration using DataIC and InlineAccess, we do not observe performance regression.
        So, let's just drop this option.

        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:

2021-06-10  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, early May 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=226763

        Unreviewed non-unified build fixes.

        * bytecode/InlineAccess.h: Add missing forward declaration for the CodeBlock type.
        * jit/JITInlineCacheGenerator.cpp: Add missing CCallHelpers.h header.
        * runtime/Intrinsic.h: Add missing <optional> header.
        * yarr/YarrUnicodeProperties.h: Ditto.

2021-06-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Ignore Intl.NumberFormat feature options when linked-ICU is old
        https://bugs.webkit.org/show_bug.cgi?id=226861
        rdar://77393100

        Reviewed by Ross Kirsling.

        Let's just ignore the option when Intl.NumberFormat features cannot be implemented since the linked ICU is old.
        There is no way not to expose these features since Intl.NumberFormat's these changes are additional ones and Intl.NumberFormat existed before.

        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat):

2021-06-09  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Rename *ByIdVariant to *ByVariant and *ByKind::Normal to *ByKind::ById
        https://bugs.webkit.org/show_bug.cgi?id=226750

        Reviewed by Yusuke Suzuki.

        Cleanup patch following r278445.

        1. {Get, Delete, In}ByStatus (but not `Put`) have had `Id` removed from their names; likewise, remove `Id`
           from the names of {Get, Delete, In}ByIdVariant. These are used *before* ByVal has been converted to ById.

        2. The {Get, Del, In}ByKind enum classes shouldn't really call ById `Normal` -- let's say `ById` explicitly.

        3. Bonus: In DFGBytecodeParser, move some *Status::computeFor calls inside the conditional that uses them.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::appendVariant):
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::DeleteByStatus::visitAggregateImpl):
        (JSC::DeleteByStatus::markIfCheap):
        * bytecode/DeleteByStatus.h:
        * bytecode/DeleteByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/DeleteByIdVariant.cpp.
        (JSC::DeleteByVariant::DeleteByVariant):
        (JSC::DeleteByVariant::~DeleteByVariant):
        (JSC::DeleteByVariant::operator=):
        (JSC::DeleteByVariant::attemptToMerge):
        (JSC::DeleteByVariant::writesStructures const):
        (JSC::DeleteByVariant::visitAggregateImpl):
        (JSC::DeleteByVariant::markIfCheap):
        (JSC::DeleteByVariant::dump const):
        (JSC::DeleteByVariant::finalize):
        (JSC::DeleteByVariant::dumpInContext const):
        * bytecode/DeleteByVariant.h: Renamed from Source/JavaScriptCore/bytecode/DeleteByIdVariant.h.
        (JSC::DeleteByVariant::overlaps):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::appendVariant):
        (JSC::GetByStatus::computeFromLLInt):
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::GetByStatus::computeFor):
        (JSC::GetByStatus::merge):
        (JSC::GetByStatus::visitAggregateImpl):
        (JSC::GetByStatus::markIfCheap):
        (JSC::GetByStatus::finalize):
        * bytecode/GetByStatus.h:
        * bytecode/GetByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/GetByIdVariant.cpp.
        (JSC::GetByVariant::GetByVariant):
        (JSC::GetByVariant::~GetByVariant):
        (JSC::GetByVariant::operator=):
        (JSC::GetByVariant::canMergeIntrinsicStructures const):
        (JSC::GetByVariant::attemptToMerge):
        (JSC::GetByVariant::visitAggregateImpl):
        (JSC::GetByVariant::markIfCheap):
        (JSC::GetByVariant::finalize):
        (JSC::GetByVariant::dump const):
        (JSC::GetByVariant::dumpInContext const):
        * bytecode/GetByVariant.h: Renamed from Source/JavaScriptCore/bytecode/GetByIdVariant.h.
        (JSC::GetByVariant::overlaps):
        * bytecode/InByStatus.cpp:
        (JSC::InByStatus::appendVariant):
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::InByStatus::merge):
        (JSC::InByStatus::markIfCheap):
        (JSC::InByStatus::finalize):
        * bytecode/InByStatus.h:
        * bytecode/InByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdVariant.cpp.
        (JSC::InByVariant::InByVariant):
        (JSC::InByVariant::attemptToMerge):
        (JSC::InByVariant::markIfCheap):
        (JSC::InByVariant::finalize):
        (JSC::InByVariant::dump const):
        (JSC::InByVariant::dumpInContext const):
        * bytecode/InByVariant.h: Renamed from Source/JavaScriptCore/bytecode/InByIdVariant.h.
        (JSC::InByVariant::overlaps):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::reset):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
        (JSC::DFG::ByteCodeParser::handleGetById):
        (JSC::DFG::ByteCodeParser::handleGetPrivateNameById):
        (JSC::DFG::ByteCodeParser::handleDeleteById):
        (JSC::DFG::ByteCodeParser::handleInById):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
        (JSC::DFG::ConstantFoldingPhase::emitDeleteByOffset):
        * dfg/DFGNode.h:
        * dfg/DFGValidate.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
        (JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiDeleteByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/Repatch.cpp:
        (JSC::appropriateOptimizingGetByFunction):
        (JSC::appropriateGetByFunction):
        (JSC::tryCacheGetBy):
        (JSC::repatchDeleteBy):
        (JSC::tryCacheInBy):
        (JSC::repatchInBy):
        (JSC::resetGetBy):
        (JSC::resetDelBy):
        (JSC::resetInBy):
        * jit/Repatch.h:

2021-06-09  Fujii Hironori  <Hironori.Fujii@sony.com>

        clang-cl: JIT.h(966,67): error: no viable conversion from 'JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address' to 'FunctionPtr<CFunctionPtrTag>'
        https://bugs.webkit.org/show_bug.cgi?id=226850

        Reviewed by Yusuke Suzuki.

        WinCairo clang-cl builds got broken since r278656 (Bug 226072).

        * jit/JIT.h: Use the common callOperation(Address, Args...) for
        x64 Windows. Added static_assert to check the return type.

2021-06-09  Mark Lam  <mark.lam@apple.com>

        Speculative build fix for Win32.
        https://bugs.webkit.org/show_bug.cgi?id=226793
        rdar://79032803

        Reviewed by Saam Barati.

        * API/JSCallbackObject.h:

2021-06-09  Xan Lopez  <xan@igalia.com>

        [JSC] Fix incorrect register reuse in 32bit after r278568
        https://bugs.webkit.org/show_bug.cgi?id=226817

        Reviewed by Caio Araujo Neponoceno de Lima.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
        The JSVALUE32_64 branch potentially needs both the tag and payload
        registers for both left/right nodes, so we cannot reuse any of
        them for the result since the first thing the code does is set it
        zero. Just remove the Reuse construction.

2021-06-09  Mikhail R. Gadelha  <mikhail@igalia.com>

        Fix inadvertent tag corruption in functionAddressOf
        https://bugs.webkit.org/show_bug.cgi?id=226503

        Reviewed by Darin Adler.

        Original patch by Angelos Oikonomopoulos.

        The cast was sign-extending the JSValue address in 32 bits, so that addresses
        that had the most significant set gave us a sign-extended result in
        asNumber which was then converted to an invalid NaN by the bitcast.

        Instead, cast the address to uintptr_t, and the result will be promoted
        uint64_t without sign-extending the address.

        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):

2021-06-08  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use DataIC for AccessCase
        https://bugs.webkit.org/show_bug.cgi?id=226072

        Reviewed by Saam Barati and Filip Pizlo.

        This patch adds non-repatching IC for Baseline JIT in ARM64.
        This does not work in non-ARM64 architectures (including X64) due to the use of link-register.

        1. We add non-repatching IC, which is enabled only in Baseline due to performance reason. We are using the
           existing IC in DFG and FTL. Non-repatching includes fast-path, and slow-path's operation function.
        2. We still keep InlineAccess in all tiers. Removing that causes 0.3 ~ 1.0% regression in Speedometer2. This
           means that we still need some repatching when we first introduce stubs.
        3. We add a mechanism to share generated code stubs in non-repatching IC. Currently, getter / setter / custom
           accessors are excluded since their code relies on JSGlobalObject, CodeBlock etc. which are not included in
           AccessCase's data structure.
        4. This patch still relies on that CodeBlock will be destroyed synchronously since we need to ensure that sharing-hash-table
           does not include already-dead JIT code stubs. We can fix it (e.g. annotating epoch to these stubs, bump them in
           finalizeUnconditionally), but we avoid doing that to prevent from further enlarging this patch. This patch is already
           significant in its size.
        5. Added callOperation(Address) support in CCallHelpers, which can save the target in nonArgGPR0, and call it so that we can use
           Address including GPR which is also used for arguments.

        Performance is neutral in JetStream2 and Speedometer2. But it offers the way to remove some code generation in Baseline.

        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::call):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::create):
        (JSC::AccessCase::createTransition):
        (JSC::AccessCase::createDelete):
        (JSC::AccessCase::createCheckPrivateBrand):
        (JSC::AccessCase::createSetPrivateBrand):
        (JSC::AccessCase::fromStructureStubInfo):
        (JSC::AccessCase::clone const):
        (JSC::AccessCase::generateWithGuard):
        (JSC::AccessCase::generateImpl):
        (JSC::AccessCase::canBeShared):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::hash const):
        (JSC::AccessCase::AccessCase):
        (JSC::SharedJITStubSet::Hash::Key::Key):
        (JSC::SharedJITStubSet::Hash::Key::isHashTableDeletedValue const):
        (JSC::SharedJITStubSet::Hash::Key::operator==):
        (JSC::SharedJITStubSet::Hash::hash):
        (JSC::SharedJITStubSet::Hash::equal):
        (JSC::SharedJITStubSet::Searcher::Translator::hash):
        (JSC::SharedJITStubSet::Searcher::Translator::equal):
        (JSC::SharedJITStubSet::PointerTranslator::hash):
        (JSC::SharedJITStubSet::PointerTranslator::equal):
        (JSC::SharedJITStubSet::add):
        (JSC::SharedJITStubSet::remove):
        (JSC::SharedJITStubSet::find):
        * bytecode/ByValInfo.h:
        (JSC::ByValInfo::setUp):
        (JSC::ByValInfo::offsetOfSlowOperation):
        (JSC::ByValInfo::offsetOfNotIndexJumpTarget):
        (JSC::ByValInfo::offsetOfBadTypeJumpTarget):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::initializeDirectCall):
        (JSC::CallLinkInfo::setDirectCallTarget):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::useDataIC const):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::create):
        (JSC::GetterSetterAccessCase::clone const):
        (JSC::GetterSetterAccessCase::emitDOMJITGetter):
        * bytecode/GetterSetterAccessCase.h:
        * bytecode/InlineAccess.cpp:
        (JSC::getScratchRegister):
        (JSC::InlineAccess::rewireStubAsJumpInAccessNotUsingInlineAccess):
        (JSC::InlineAccess::rewireStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccess):
        (JSC::InlineAccess::resetStubAsJumpInAccessNotUsingInlineAccess):
        (JSC::InlineAccess::rewireStubAsJump): Deleted.
        * bytecode/InlineAccess.h:
        * bytecode/InstanceOfAccessCase.cpp:
        (JSC::InstanceOfAccessCase::create):
        (JSC::InstanceOfAccessCase::clone const):
        * bytecode/InstanceOfAccessCase.h:
        * bytecode/IntrinsicGetterAccessCase.cpp:
        (JSC::IntrinsicGetterAccessCase::create):
        (JSC::IntrinsicGetterAccessCase::clone const):
        * bytecode/IntrinsicGetterAccessCase.h:
        * bytecode/ModuleNamespaceAccessCase.cpp:
        (JSC::ModuleNamespaceAccessCase::create):
        (JSC::ModuleNamespaceAccessCase::clone const):
        * bytecode/ModuleNamespaceAccessCase.h:
        * bytecode/ObjectPropertyConditionSet.h:
        (JSC::ObjectPropertyConditionSet::hash const):
        (JSC::ObjectPropertyConditionSet::operator==):
        (JSC::ObjectPropertyConditionSet::operator!=):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::installWatchpoint):
        (JSC::AccessGenerationState::succeed):
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
        (JSC::PolymorphicAccess::addCases):
        (JSC::PolymorphicAccess::addCase):
        (JSC::PolymorphicAccess::visitWeak const):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        (JSC::AccessGenerationState::AccessGenerationState):
        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
        * bytecode/ProxyableAccessCase.cpp:
        (JSC::ProxyableAccessCase::create):
        (JSC::ProxyableAccessCase::clone const):
        * bytecode/ProxyableAccessCase.h:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::StructureStubInfo):
        (JSC::StructureStubInfo::addAccessCase):
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::offsetOfCodePtr):
        (JSC::StructureStubInfo::offsetOfSlowPathStartLocation):
        (JSC::StructureStubInfo::offsetOfSlowOperation):
        (JSC::StructureStubInfo::patchableJump): Deleted.
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::appendCall):
        * dfg/DFGSlowPathGenerator.h:
        (JSC::DFG::slowPathICCall):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetById):
        (JSC::DFG::SpeculativeJIT::compileGetByIdFlush):
        (JSC::DFG::SpeculativeJIT::compileDeleteById):
        (JSC::DFG::SpeculativeJIT::compileDeleteByVal):
        (JSC::DFG::SpeculativeJIT::compileInById):
        (JSC::DFG::SpeculativeJIT::compileInByVal):
        (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal):
        (JSC::DFG::SpeculativeJIT::compileGetPrivateNameById):
        (JSC::DFG::SpeculativeJIT::compilePutPrivateNameById):
        (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand):
        (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand):
        (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells):
        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
        (JSC::DFG::SpeculativeJIT::compilePutByIdFlush):
        (JSC::DFG::SpeculativeJIT::compilePutById):
        (JSC::DFG::SpeculativeJIT::compilePutByIdDirect):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        (JSC::DFG::SpeculativeJIT::appendCall):
        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
        (JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        * ftl/FTLSlowPathCall.cpp:
        (JSC::FTL::SlowPathCallContext::SlowPathCallContext):
        (JSC::FTL::SlowPathCallContext::keyWithTarget const):
        (JSC::FTL::SlowPathCallContext::makeCall):
        * ftl/FTLSlowPathCall.h:
        (JSC::FTL::callOperation):
        * ftl/FTLSlowPathCallKey.cpp:
        (JSC::FTL::SlowPathCallKey::dump const):
        * ftl/FTLSlowPathCallKey.h:
        (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
        (JSC::FTL::SlowPathCallKey::indirectOffset const):
        (JSC::FTL::SlowPathCallKey::withCallTarget):
        (JSC::FTL::SlowPathCallKey::operator== const):
        (JSC::FTL::SlowPathCallKey::hash const):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitVirtualCall):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::emitJITCodeOver):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::ArgCollection::ArgCollection):
        (JSC::CCallHelpers::ArgCollection::pushRegArg):
        (JSC::CCallHelpers::ArgCollection::pushExtraRegArg):
        (JSC::CCallHelpers::ArgCollection::pushNonArg):
        (JSC::CCallHelpers::ArgCollection::addGPRArg):
        (JSC::CCallHelpers::ArgCollection::addGPRExtraArg):
        (JSC::CCallHelpers::ArgCollection::addStackArg):
        (JSC::CCallHelpers::ArgCollection::addPoke):
        (JSC::CCallHelpers::calculatePokeOffset):
        (JSC::CCallHelpers::pokeForArgument):
        (JSC::CCallHelpers::stackAligned):
        (JSC::CCallHelpers::marshallArgumentRegister):
        (JSC::CCallHelpers::setupArgumentsImpl):
        (JSC::CCallHelpers::pokeArgumentsAligned):
        (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::setupArgumentsEntryImpl):
        (JSC::CCallHelpers::setupArguments):
        (JSC::CCallHelpers::setupArgumentsForIndirectCall):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
        (JSC::GCAwareJITStubRoutine::makeGCAware):
        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
        (JSC::PolymorphicAccessJITStubRoutine::PolymorphicAccessJITStubRoutine):
        (JSC::PolymorphicAccessJITStubRoutine::observeZeroRefCount):
        (JSC::PolymorphicAccessJITStubRoutine::computeHash):
        (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
        (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
        (JSC::createICJITStubRoutine):
        (JSC::createJITStubRoutine): Deleted.
        * jit/GCAwareJITStubRoutine.h:
        (JSC::GCAwareJITStubRoutine::create):
        (JSC::PolymorphicAccessJITStubRoutine::cases const):
        (JSC::PolymorphicAccessJITStubRoutine::weakStructures const):
        (JSC::PolymorphicAccessJITStubRoutine::hash const):
        * jit/GPRInfo.h:
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emitSlow_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        (JSC::JIT::emitSlow_op_iterator_next):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::emit_op_iterator_open):
        (JSC::JIT::emit_op_iterator_next):
        * jit/JITCode.h:
        (JSC::JITCode::useDataIC):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
        (JSC::JITInlineCacheGenerator::finalize):
        (JSC::JITByIdGenerator::JITByIdGenerator):
        (JSC::JITByIdGenerator::finalize):
        (JSC::JITByIdGenerator::generateFastCommon):
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
        (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator):
        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
        (JSC::JITDelByValGenerator::JITDelByValGenerator):
        (JSC::JITDelByValGenerator::generateFastPath):
        (JSC::JITDelByValGenerator::finalize):
        (JSC::JITDelByIdGenerator::JITDelByIdGenerator):
        (JSC::JITDelByIdGenerator::generateFastPath):
        (JSC::JITDelByIdGenerator::finalize):
        (JSC::JITInByValGenerator::JITInByValGenerator):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByValGenerator::finalize):
        (JSC::JITInByIdGenerator::JITInByIdGenerator):
        (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator):
        (JSC::JITInstanceOfGenerator::generateFastPath):
        (JSC::JITInstanceOfGenerator::finalize):
        (JSC::JITGetByValGenerator::JITGetByValGenerator):
        (JSC::JITGetByValGenerator::generateFastPath):
        (JSC::JITGetByValGenerator::finalize):
        (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator):
        (JSC::JITPrivateBrandAccessGenerator::generateFastPath):
        (JSC::JITPrivateBrandAccessGenerator::finalize):
        * jit/JITInlineCacheGenerator.h:
        (JSC::JITGetByIdGenerator::JITGetByIdGenerator): Deleted.
        (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator): Deleted.
        (JSC::JITPutByIdGenerator::JITPutByIdGenerator): Deleted.
        (JSC::JITDelByValGenerator::JITDelByValGenerator): Deleted.
        (JSC::JITDelByValGenerator::slowPathJump const): Deleted.
        (JSC::JITDelByIdGenerator::JITDelByIdGenerator): Deleted.
        (JSC::JITDelByIdGenerator::slowPathJump const): Deleted.
        (JSC::JITInByIdGenerator::JITInByIdGenerator): Deleted.
        (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator): Deleted.
        (JSC::JITGetByValGenerator::JITGetByValGenerator): Deleted.
        (JSC::JITGetByValGenerator::slowPathJump const): Deleted.
        (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator): Deleted.
        (JSC::JITPrivateBrandAccessGenerator::slowPathJump const): Deleted.
        * jit/JITInlines.h:
        (JSC::JIT::emitLoadForArrayMode):
        (JSC::JIT::appendCallWithExceptionCheck):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emit_op_has_enumerable_indexed_property):
        (JSC::JIT::emitSlow_op_has_enumerable_indexed_property):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emit_op_has_enumerable_indexed_property):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitGenericContiguousPutByVal):
        (JSC::JIT::emitArrayStoragePutByVal):
        (JSC::JIT::emitPutByValWithCachedId):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_put_private_name):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutPrivateNameWithCachedId):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        (JSC::JIT::emitDoubleLoad):
        (JSC::JIT::emitContiguousLoad):
        (JSC::JIT::emitArrayStorageLoad):
        (JSC::JIT::emitIntTypedArrayPutByVal):
        (JSC::JIT::emitFloatTypedArrayPutByVal):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_get_private_name):
        (JSC::JIT::emit_op_set_private_brand):
        (JSC::JIT::emit_op_check_private_brand):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emitGenericContiguousPutByVal):
        (JSC::JIT::emitArrayStoragePutByVal):
        (JSC::JIT::emit_op_try_get_by_id):
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emit_op_get_by_id):
        (JSC::JIT::emit_op_get_by_id_with_this):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::emit_op_in_by_id):
        (JSC::JIT::emit_op_in_by_val):
        * jit/JITStubRoutine.h:
        * jit/PolymorphicCallStubRoutine.cpp:
        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
        * jit/Repatch.cpp:
        (JSC::readPutICCallTarget):
        (JSC::repatchSlowPathCall):
        (JSC::tryCacheGetBy):
        (JSC::repatchGetBy):
        (JSC::tryCacheArrayGetByVal):
        (JSC::repatchArrayGetByVal):
        (JSC::tryCachePutByID):
        (JSC::repatchPutByID):
        (JSC::tryCacheDeleteBy):
        (JSC::repatchDeleteBy):
        (JSC::tryCacheInBy):
        (JSC::repatchInBy):
        (JSC::tryCacheCheckPrivateBrand):
        (JSC::repatchCheckPrivateBrand):
        (JSC::tryCacheSetPrivateBrand):
        (JSC::repatchSetPrivateBrand):
        (JSC::tryCacheInstanceOf):
        (JSC::repatchInstanceOf):
        (JSC::linkSlowFor):
        (JSC::linkVirtualFor):
        (JSC::resetGetBy):
        (JSC::resetPutByID):
        (JSC::resetDelBy):
        (JSC::resetInBy):
        (JSC::resetInstanceOf):
        (JSC::resetCheckPrivateBrand):
        (JSC::resetSetPrivateBrand):
        (JSC::resetPatchableJump): Deleted.
        * jit/Repatch.h:
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:
        * runtime/StructureIDTable.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        (JSC::VM::~VM):
        * runtime/VM.h:

2021-06-08  Robin Morisset  <rmorisset@apple.com>

        Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString
        https://bugs.webkit.org/show_bug.cgi?id=226786

        Reviewed by Mark Lam.

        I had forgotten the HeapBigInt part.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):

2021-06-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use ResolvedClosureVar to get brand from scope
        https://bugs.webkit.org/show_bug.cgi?id=226677
        rdar://78802869

        Reviewed by Saam Barati.

        Private brand lookup is doing wrong way to get scope.

            1. op_resolve_scope with private name (e.g. #x)
            2. then, doing op_get_from_scope with (1)'s scope with different name (e.g. @privateBrand)

        This is wrong in JSC. We resolve scope at link-time in CodeBlock. So we need to ensure that both op_resolve_scope and op_get_from_scope
        starts with the current scope-register. As a result, private-brand lookup is broken right now. Let's see the buggy case.

            class D {
              #x() {}
              m() {
                class C {
                  #yy;
                  #z() { }
                  a() {
                    this.#x(); // <===== This point.
                  }
                }
                let c = new C();
                c.a();
              }
            }

        In the above point, we first lookup the scope with #x, and we get the D's class-scope. But our get_from_scope is using privateBrand, and
        privateBrand property exists too in C's class-scope too since C also has #yy and #z. As a result, CodeBlock linking configures the offset for
        C's class-scope in get_from_scope. And this offset is different from D's class-scope's privateBrand.

        Only allowed case for the above usage is ResolvedClosureVar. And generatorification uses it too. In this patch,

        1. We ensure that class-scope (with private name) must have @privateBrand and @privateClassBrand with offset 1 and 0.
        2. Use ResolvedClosureVar with the above pre-defined offset

        Since CodeBlock's linking does not resolve the scope for get_from_scope if it is ResolvedClosureVar, we can just perform the desired ResolvedClosureVar lookup
        with the given scope with the compiled offset.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        (JSC::BytecodeGenerator::instantiateLexicalVariables):
        (JSC::BytecodeGenerator::pushLexicalScope):
        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
        (JSC::BytecodeGenerator::emitCreatePrivateBrand):
        (JSC::BytecodeGenerator::emitGetPrivateBrand):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::BaseDotNode::emitGetPropertyValue):
        (JSC::BaseDotNode::emitPutProperty):
        (JSC::PostfixNode::emitDot):
        (JSC::PrefixNode::emitDot):
        (JSC::InNode::emitBytecode):
        (JSC::BlockNode::emitBytecode):
        (JSC::ForNode::emitBytecode):
        (JSC::ForInNode::emitBytecode):
        (JSC::ForOfNode::emitBytecode):
        (JSC::SwitchNode::emitBytecode):
        (JSC::ClassExprNode::emitBytecode):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseClass):
        * parser/VariableEnvironment.h:

2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy
        https://bugs.webkit.org/show_bug.cgi?id=226185

        The API test added in r278366 revealed a flaw in JSObject::definePropertyOnReceiver()
        that caused putDirectInternal() to be performed on a JSProxy instead of it's target.
        Remedies that via a type check, ensuring the test and iOS apps are functional.

        The issue was originally missed because the prototype chain of a global object is immutable
        and none of the global object's prototypes override put(). OpaqueJSClass::prototype() sets
        the [[Prototype]] directly, ignoring the IsImmutablePrototypeExoticObject type info flag.

        Also, excludes an invariant from the original patch that required put() to be overriden
        when implementing custom [[DefineOwnProperty]]. It is now broken by WindowProperties object.

        * API/JSCallbackObject.h:
        * API/JSCallbackObjectFunctions.h:
        (JSC::JSCallbackObject<Parent>::put):
        * API/tests/testapiScripts/testapi.js:
        * debugger/DebuggerScope.h:
        * runtime/ClassInfo.h:
        * runtime/ClonedArguments.h:
        * runtime/CustomGetterSetter.cpp:
        (JSC::callCustomSetter): Deleted.
        * runtime/CustomGetterSetter.h:
        * runtime/ErrorConstructor.h:
        * runtime/ErrorInstance.h:
        * runtime/GenericArguments.h:
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::put):
        * runtime/GetterSetter.h:
        * runtime/JSArray.cpp:
        (JSC::JSArray::put):
        * runtime/JSArray.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::put): Deleted.
        * runtime/JSArrayBufferView.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::putToPrimitive):
        * runtime/JSCell.cpp:
        (JSC::JSCell::doPutPropertySecurityCheck): Deleted.
        * runtime/JSCell.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::put):
        * runtime/JSFunction.h:
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGlobalLexicalEnvironment.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::put):
        * runtime/JSGlobalObject.h:
        * runtime/JSLexicalEnvironment.h:
        * runtime/JSModuleEnvironment.h:
        * runtime/JSModuleNamespaceObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertySlot):
        (JSC::JSObject::putInlineSlow):
        (JSC::definePropertyOnReceiverSlow):
        (JSC::JSObject::definePropertyOnReceiver):
        (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded):
        (JSC::JSObject::doPutPropertySecurityCheck): Deleted.
        (JSC::JSObject::prototypeChainMayInterceptStoreTo): Deleted.
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::hasNonReifiedStaticProperties):
        (JSC::JSObject::getOwnPropertySlot):
        (JSC::JSObject::putDirect):
        (JSC::JSObject::doPutPropertySecurityCheck): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::canPerformFastPutInlineExcludingProto):
        (JSC::JSObject::putInlineForJSObject):
        (JSC::JSObject::putInlineFast):
        (JSC::JSObject::putDirectInternal):
        * runtime/JSProxy.h:
        * runtime/JSTypeInfo.h:
        (JSC::TypeInfo::hasStaticPropertyTable const):
        (JSC::TypeInfo::overridesPut const):
        (JSC::TypeInfo::getOwnPropertySlotMayBeWrongAboutDontEnum const):
        (JSC::TypeInfo::hasPutPropertySecurityCheck const): Deleted.
        * runtime/Lookup.h:
        (JSC::putEntry): Deleted.
        (JSC::lookupPut): Deleted.
        * runtime/PropertySlot.h:
        * runtime/ProxyObject.cpp:
        (JSC::ProxyObject::put):
        * runtime/ProxyObject.h:
        * runtime/PutPropertySlot.h:
        (JSC::PutPropertySlot::PutPropertySlot):
        (JSC::PutPropertySlot::context const):
        (JSC::PutPropertySlot::isTaintedByOpaqueObject const):
        (JSC::PutPropertySlot::setIsTaintedByOpaqueObject):
        * runtime/ReflectObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::put):
        * runtime/RegExpObject.h:
        * runtime/StringObject.cpp:
        (JSC::StringObject::put):
        * runtime/StringObject.h:
        * runtime/StringPrototype.cpp:
        (JSC::StringPrototype::finishCreation):
        (JSC::StringPrototype::create):
        * runtime/StringPrototype.h:
        * runtime/Structure.cpp:
        (JSC::Structure::validateFlags):
        * runtime/Structure.h:
        (JSC::Structure::hasNonReifiedStaticProperties const):
        * tools/JSDollarVM.cpp:

2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        Introduce LexicalScopeFeatures to enable future bytecode optimizations
        https://bugs.webkit.org/show_bug.cgi?id=224072

        Reviewed by Keith Miller.

        Before this patch, BytecodeGenerator was capable of reasoning about the presence of `with`
        statements, direct `eval`, or any other code features only within the current executable:

            ```
            with (foo) {
                (function() {
                    // There was no way to detect WithScope during generation of this function.
                })();
            }
            ```

        This change is required for op_to_this rewrite (#225397): if FunctionCallResolveNode and
        friends knew there is no WithScope, op_call could be emitted with |this| value of
        `undefined` as per spec [1], instead of resolved scope. This would:
          - simplify op_to_this on all tiers, likely resulting in minor perf boost;
          - save 1 instruction per strict function by removing op_to_this;
          - remove toThis() from the method table and ~30 its call sites from built-ins;
          - fix built-in methods that were observably lacking toThis();
          - fix __proto__ getter / setter called on global scope;
          - fix WebIDL accessors called with |this| value of `undefined` and `null`.

        Also, if ResolveNode knew that unforgeable global properties are not shadowed and there
        is no `with` statement or sloppy mode direct `eval`, then `undefined` / `Infinity` / `NaN`
        lookups could be constant-folded. This would save up to 3 bytecode ops per each usage
        and allow emitting op_is_undefined_or_null for `x === undefined || x === null`.
        V8 performs this optimization [2].

        This patch introduces LexicalScopeFeatures to allow passing such information from Parser
        to BytecodeGenerator with a minimal code diff. These features are kept separate from
        CodeFeature to simplify reasoning about feature's scope and because we need to propagate
        lexical features from parent to child scope.

        Strict mode is the first use case of LexicalScopeFeatures, which this change carefully
        fits into existing abstractions without increasing their memory usage even by 1 byte.

        [1]: https://tc39.es/ecma262/#sec-evaluatecall (step 2)
        [2]: https://medium.com/@bmeurer/sometimes-undefined-is-defined-7701e1c9eff8

        * builtins/BuiltinExecutables.cpp:
        (JSC::BuiltinExecutables::createExecutable):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::recordParse):
        (JSC::UnlinkedCodeBlock::lexicalScopeFeatures const):
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::generateUnlinkedFunctionCodeBlock):
        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
        (JSC::UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets):
        * bytecode/UnlinkedFunctionExecutable.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        (JSC::BytecodeGenerator::emitNewClassFieldInitializerFunction):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::lexicalScopeFeatures const):
        (JSC::BytecodeGenerator::generate):
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createFunctionMetadata):
        * parser/Nodes.cpp:
        (JSC::ScopeNode::ScopeNode):
        (JSC::ProgramNode::ProgramNode):
        (JSC::ModuleProgramNode::ModuleProgramNode):
        (JSC::EvalNode::EvalNode):
        (JSC::FunctionMetadataNode::FunctionMetadataNode):
        (JSC::FunctionMetadataNode::operator== const):
        (JSC::FunctionMetadataNode::dump const):
        (JSC::FunctionNode::FunctionNode):
        * parser/Nodes.h:
        (JSC::ScopeNode::lexicalScopeFeatures):
        (JSC::ScopeNode::isStrictMode const):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
        (JSC::Parser<LexerType>::parseAsyncFunctionSourceElements):
        (JSC::Parser<LexerType>::parseAsyncGeneratorFunctionSourceElements):
        (JSC::Parser<LexerType>::parseFunctionBody):
        (JSC::Parser<LexerType>::parseFunctionInfo):
        * parser/Parser.h:
        (JSC::Scope::Scope):
        (JSC::Scope::lexicalScopeFeatures const):
        (JSC::Scope::setStrictMode):
        (JSC::Scope::strictMode const):
        (JSC::Scope::fillParametersForSourceProviderCache):
        (JSC::Scope::restoreFromSourceProviderCache):
        (JSC::Parser::pushScope):
        (JSC::Parser::lexicalScopeFeatures):
        (JSC::Parser<LexerType>::parse):
        * parser/ParserModes.h:
        * parser/SourceProviderCacheItem.h:
        (JSC::SourceProviderCacheItem::lexicalScopeFeatures const):
        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createFunctionMetadata):
        * runtime/CachedBytecode.cpp:
        (JSC::CachedBytecode::addFunctionUpdate):
        * runtime/CachedTypes.cpp:
        (JSC::CachedFunctionExecutable::lexicalScopeFeatures const):
        (JSC::CachedCodeBlock::lexicalScopeFeatures const):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::CachedFunctionExecutable::encode):
        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
        (JSC::CachedCodeBlock<CodeBlockType>::encode):
        (JSC::CachedFunctionExecutable::isInStrictContext const): Deleted.
        * runtime/CachedTypes.h:
        * runtime/CodeCache.cpp:
        (JSC::generateUnlinkedCodeBlockImpl):
        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
        * runtime/ECMAMode.h:
        (JSC::ECMAMode::fromBool):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::FunctionExecutable):
        * runtime/GlobalExecutable.h:
        (JSC::GlobalExecutable::recordParse):
        (JSC::GlobalExecutable::GlobalExecutable):
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::ScriptExecutable):
        (JSC::ScriptExecutable::newCodeBlockFor):
        (JSC::ScriptExecutable::recordParse):
        * runtime/ScriptExecutable.h:
        (JSC::ScriptExecutable::isInStrictContext const):
        (JSC::ScriptExecutable::recordParse):

2021-06-07  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r278371 and r278463.
        https://bugs.webkit.org/show_bug.cgi?id=226749

        Break dumpDisassembly in JetStream2

        Reverted changesets:

        "We should drop B3 values while running Air"
        https://bugs.webkit.org/show_bug.cgi?id=226187
        https://trac.webkit.org/changeset/278371

        "Drop the FTL(DFG) graph after lowering to B3"
        https://bugs.webkit.org/show_bug.cgi?id=226556
        https://trac.webkit.org/changeset/278463

2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        Window should behave like a legacy platform object without indexed setter
        https://bugs.webkit.org/show_bug.cgi?id=225894

        Reviewed by Darin Adler.

        * runtime/TypeError.h:
        (JSC::typeError):

2021-06-07  Saam Barati  <sbarati@apple.com>

        Short circuit read modify write nodes emit byte code that uses the wrong locals
        https://bugs.webkit.org/show_bug.cgi?id=226576
        <rdar://problem/78810362>

        Reviewed by Yusuke Suzuki.

        It's never a good idea to use the wrong local :-)
        
        This patch also adds support for dumping predecessors of basic blocks
        in the bytecode dump.

        * bytecode/BytecodeDumper.cpp:
        (JSC::CodeBlockBytecodeDumper<Block>::dumpGraph):
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
        (JSC::ShortCircuitReadModifyDotNode::emitBytecode):
        (JSC::ShortCircuitReadModifyBracketNode::emitBytecode):

2021-06-07  Mark Lam  <mark.lam@apple.com>

        Put the Baseline JIT prologue and op_loop_hint code in JIT thunks.
        https://bugs.webkit.org/show_bug.cgi?id=226375

        Reviewed by Keith Miller and Robin Morisset.

        Baseline JIT prologue code varies in behavior based on several variables.  These
        variables include (1) whether the prologue does any arguments value profiling,
        (2) whether the prologue is for a constructor, and (3) whether the compiled
        CodeBlock will have such a large frame that it is greater than the stack reserved
        zone (aka red zone) which would require additional stack check logic.

        The pre-existing code would generate specialized code based on these (and other
        variables).  In converting to using thunks for the prologue, we opt not to
        convert these specializations into runtime checks.  Instead, the implementation
        uses 1 of 8 possible specialized thunks to reduce the need to pass arguments for
        runtime checks.  The only needed argument passed to the prologue thunks is the
        codeBlock pointer.

        There are 8 possible thunks because we specialize based on 3 variables:
        1. doesProfiling
        2. isConstructor
        3. hasHugeFrame

        2**3 yields 8 permutations of prologue thunk specializations.

        Similarly, there are also 8 analogous arity fixup prologues that work similarly.

        The op_loop_hint thunk only takes 1 runtime argument: the bytecode offset.

        We've tried doing the loop_hint optimization check in the thunk (in order to move
        both the fast and slow path into the thunk for maximum space savings).  However,
        this seems to have some slight negative impact on benchmark performance.  We ended
        up just keeping the fast path and instead have the slow path call a thunk to do
        its work.  This realizes the bulk of the size savings without the perf impact.

        This patch also optimizes op_enter a bit more by eliminating the need to pass any
        arguments to the thunk.  The thunk previously took 2 arguments: localsToInit and
        canBeOptimized.  localsToInit is now computed in the thunk at runtime, and
        canBeOptimized is used as a specialization argument to generate 2 variants of the
        op_enter thunk: op_enter_canBeOptimized_Generator and op_enter_cannotBeOptimized_Generator,
        thereby removing the need to pass it as a runtime argument.

        LinkBuffer size results (from a single run of Speedometer2):

           BaselineJIT: 93319628 (88.996532 MB)   => 83851824 (79.967331 MB)   0.90x
         ExtraCTIThunk: 5992 (5.851562 KB)        => 6984 (6.820312 KB)        1.17x
                        ...
                 Total: 197530008 (188.379295 MB) => 188459444 (179.728931 MB) 0.95x

        Speedometer2 and JetStream2 results (as measured on an M1 Mac) are neutral.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::untagReturnAddressWithoutExtraValidation):
        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagReturnAddress):
        (JSC::MacroAssemblerARM64E::untagReturnAddressWithoutExtraValidation):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchAdd32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchAdd32):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetOfNumCalleeLocals):
        (JSC::CodeBlock::offsetOfNumVars):
        (JSC::CodeBlock::offsetOfArgumentValueProfiles):
        (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
        (JSC::AssemblyHelpers::emitSaveCalleeSavesForBaselineJIT):
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesForBaselineJIT):
        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::prologueGenerator):
        (JSC::JIT::arityFixupPrologueGenerator):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedNearCall):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_Generator):
        (JSC::JIT::op_enter_canBeOptimized_Generator):
        (JSC::JIT::op_enter_cannotBeOptimized_Generator):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::op_loop_hint_Generator):
        (JSC::JIT::op_enter_handlerGenerator): Deleted.
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_enter):
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):

2021-06-07  Robin Morisset  <rmorisset@apple.com>

        Optimize compareStrictEq when neither side is a double and at least one is neither a string nor a BigInt
        https://bugs.webkit.org/show_bug.cgi?id=226676

        Reviewed by Filip Pizlo.

        There is exactly one case where x === y must return false despite x and y being JSValues with the same bits:
            NaN === NaN
        There are a few cases where x === y must return true despite x and y being JSValues with potentially different bits:
            Double === Int32
            String === String
            HeapBigInt === HeapBigInt
            HeapBigInt === BigInt32 (if they are enabled)
        If we don't have a double on either side, at least one side has neither a String nor a HeapBigInt, and BigInt32 are disabled, we can clearly ignore all of these pathological cases.

        This optimization was decided based on looking at DFG graphs of Speedometer2; here is a sample of the compareStrictEq(Untyped, Untyped), courtesy of Phil:
            Final|Array|String|Bool, Final|Array|String|Bool
            Array|String|Bool, String|Bool (twice)
            Array|String|Bool, String|Int32 (once in DFG, once in FTL)
        !   Array|String|Bool, Array|Bool
        !   Final|Other, Final|Other
        !   Int32|Other, Int32
            Final|StringIdent, Final|StringIdent (3 times)
            Final|StringIdent|BoolInt32, StringIdent|BoolInt32 (twice)
            String|Bool, String|Bool (4 times)
            DoublePureNaN, String|Bool
        !   Other, Function|Other
        !   Final|Other, Final|Function|Other (twice)
            Final|String|Bool|Other, Final|String|Bool|Other (3 times, two in the FTL)
            Final|String|Int32, String|Int32 (four times)
            String|Int32|Bool, Function|String|Int32|Bool (twice)
            String|DoublePureNaN, String|Bool (twice)
        !   Final|Bool|Other, Final|Function|Other (four times, twice in FTL)
        I marked with a ! those for which this optimization should apply.

        The only slightly interesting part of this patch is DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString where I took care to skip every test whose result we can predict from the abstract interpreter.

        Results on microbenchmarks:
            poly-stricteq-not-double                  45.5793+-0.5304     ?     46.0306+-0.5621        ?
            poly-stricteq-not-double-nor-string       45.5829+-0.5750     ^     16.9089+-0.3070        ^ definitely 2.6958x faster
            poly-stricteq                             49.9719+-0.6450           48.9855+-0.5227          might be 1.0201x faster

        I also measured the amount of code that we generate in the DFG on JetStream2.
        The results here are disappointing but still measurable. Before:
            DFG_fast_CompareStrictEq totalBytes: 468425 count: 10951 avg: 42.774632
            DFG_fast_CompareStrictEq totalBytes: 468020 count: 10917 avg: 42.870752
            DFG_fast_CompareStrictEq totalBytes: 467424 count: 10888 avg: 42.930198
        After:
            DFG_fast_CompareStrictEq totalBytes: 463946 count: 10917 avg: 42.497573
            DFG_fast_CompareStrictEq totalBytes: 474492 count: 11138 avg: 42.601185
            DFG_fast_CompareStrictEq totalBytes: 467138 count: 10970 avg: 42.583227

        * bytecode/SpeculatedType.h:
        (JSC::isNeitherDoubleNorHeapBigIntNorStringSpeculation):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::shouldSpeculateNeitherDoubleNorHeapBigIntNorString):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::SafeToExecuteEdge::operator()):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStrictEq):
        (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
        (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):
        (JSC::DFG::SpeculativeJIT::speculateNotDouble):
        (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):
        (JSC::DFG::SpeculativeJIT::speculate):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGUseKind.cpp:
        (WTF::printInternal):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):
        (JSC::DFG::checkMayCrashIfInputIsEmpty):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        (JSC::FTL::DFG::LowerDFGToB3::speculate):
        (JSC::FTL::DFG::LowerDFGToB3::speculateNeitherDoubleNorHeapBigIntNorString):

2021-06-07  Tuomas Karkkainen  <tuomas.webkit@apple.com>

        $vm should have a function for checking if security assertions are enabled similar to $vm.assertEnabled
        https://bugs.webkit.org/show_bug.cgi?id=226020
        <rdar://problem/78567619>

        Reviewed by Mark Lam.

        Add method $vm.securityAssertEnabled() which parallels $vm.assertEnabled(), and allows
        checking at runtime whether the current JavaScriptCore build has security assertions enabled.

        * tools/JSDollarVM.cpp:

2021-06-04  Chris Dumez  <cdumez@apple.com>

        FileSystem::readFromFile() should return data as `void*`
        https://bugs.webkit.org/show_bug.cgi?id=226671

        Reviewed by Darin Adler.

        FileSystem::readFromFile() should return data as `void*` instead of `char*`. This is more flexible and
        consistent with FileSystem::writeToFile().

        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::backendCommands const):

2021-06-04  Devin Rousso  <drousso@apple.com>

        Web Inspector: mark recently added protocol commands/events as page-only
        https://bugs.webkit.org/show_bug.cgi?id=226661

        Reviewed by Joseph Pecoraro.

        * inspector/protocol/CSS.json:
        * inspector/protocol/Network.json:
        These commands are not implemented in ITML. By not specifying `"targetTypes": ["page"]` it's
        implicitly saying that the command/event is supported by ITML since the command/event will
        fall back to the domain's `"targetTypes"`, which includes ITML.

2021-06-04  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Private static method should define privateClassBrandIdentifier in class-scope
        https://bugs.webkit.org/show_bug.cgi?id=226656
        rdar://78313139

        Reviewed by Keith Miller.

        We accidentally made `declaresStaticPrivateMethod` always `false`.
        This patch fixes that so that we properly define privateClassBrandIdentifier field in the class-scope if static-private-method is defined.

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseClass):

2021-06-04  Filip Pizlo  <fpizlo@apple.com>

        Don't emit the NotDouble checks if we're already NotDouble.

        Rubber stamped by Saam Barati.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculateNotDouble):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble):

2021-06-04  Mark Lam  <mark.lam@apple.com>

        Placate exception checker validation in objectPrototypeHasOwnProperty.
        https://bugs.webkit.org/show_bug.cgi?id=226651
        rdar://78861296

        Reviewed by Keith Miller.

        * runtime/ObjectPrototype.cpp:
        (JSC::objectPrototypeHasOwnProperty):

2021-06-03  Filip Pizlo  <fpizlo@apple.com>

        DFG should speculate on CompareStrictEq(@x, @x)
        https://bugs.webkit.org/show_bug.cgi?id=226621

        Reviewed by Mark Lam.

        Introduces a NotDouble: speculation. We use it to speculate on CompareStrictEq(@x, @x).

        * bytecode/SpeculatedType.h:
        (JSC::isNotDoubleSpeculation):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::shouldSpeculateNotDouble):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::SafeToExecuteEdge::operator()):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculateNotDouble):
        (JSC::DFG::SpeculativeJIT::speculate):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGUseKind.cpp:
        (WTF::printInternal):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):
        (JSC::DFG::checkMayCrashIfInputIsEmpty):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::speculate):
        (JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble):

2021-06-04  Robin Morisset  <rmorisset@apple.com>

        Drop the FTL(DFG) graph after lowering to B3
        https://bugs.webkit.org/show_bug.cgi?id=226556

        Reviewed by Phil Pizlo.

        The challenge in this patch was dealing with all of the Patchpoints created by FTLLowerDFGToB3: they get a lambda at that time, which they execute at the end of Air, and many of these lambdas were capturing a pointer to some parts of the DFG graph and reading through it when being executed.
        In all cases but one it was easily fixed: they were only reading a few bits from a given node, so I just read these bits in FTLLowerDFGToB3, and captured them (by value) instead of the pointer to the node.
        The exception was compileCallOrConstructVarargsSpread(): its patchpoint generator was walking through the graph, flattening a tree of PhantomSpread/PhantomNewArrayWithSpread/PhantomNewArrayBuffer/PhantomCreateRest, emitting some code along the way.
        We now do this flattening of the tree in FTLLowerDFGToB3, store just enough information to later emit the required code in a vector, and capture that vector in the lambda (through a move capture, which is allowed since C++14). See `struct VarargsSpreadArgumentToEmit` for the information that we need to store in that vector.

        I tested this change by completing a full run of JetStream2 with ASAN.
        I also ran the stress tests with "spread" in their name in Debug mode.

        * b3/B3SparseCollection.h:
        (JSC::B3::SparseCollection::clearAll):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::freeDFGIRAfterLowering):
        * dfg/DFGGraph.h:
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
        (JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::VarargsSpreadArgumentToEmit::VarargsSpreadArgumentToEmit):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        (JSC::FTL::DFG::LowerDFGToB3::compileInById):
        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
        (JSC::FTL::DFG::LowerDFGToB3::getById):
        (JSC::FTL::DFG::LowerDFGToB3::getByIdWithThis):
        (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
        (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
        (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
        (JSC::FTL::DFG::LowerDFGToB3::crash):

2021-06-04  Tadeu Zagallo  <tzagallo@apple.com>

        Optimize Function.prototype.toString
        https://bugs.webkit.org/show_bug.cgi?id=226418
        <rdar://77861846>

        Reviewed by Saam Barati.

        Add caching to Function.prototype.toString. This is used heavily in Speedometer2, and repeatedly recomputing a
        string which is a constant is costly. We cache the results of toString in all cases except for bound functions.
        To make this work for bound functions, we'd need to add a new field they can use for this cache. For other
        functions, we cache it on the executable (either NativeExecutable or FunctionExecutable). The reason we can't
        do this on the executable for bound functions is that all bound functions share the same executable, but
        individual bound functions can have different names. The reason it's valid to cache the results in general is that a
        function's name field can't be changed from JS code -- it's non-writable.

        This patch also makes Function.prototype.toString an intrinsic in the DFG/FTL. We emit code on the fast path
        which reads the cached value if it's present. If not, we call into the slow path, which will compute
        the cached value for non bound functions, or compute the result for bound functions.

        I added a new microbenchmark that speeds up by >35x:

        function-to-string     2197.5952+-30.7118    ^     59.9861+-2.5550        ^ definitely 36.6350x faster

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::getExecutable):
        (JSC::DFG::SpeculativeJIT::compileFunctionToString):
        (JSC::DFG::SpeculativeJIT::compileGetExecutable):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::getExecutable):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable):
        (JSC::FTL::DFG::LowerDFGToB3::compileFunctionToString):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::visitChildrenImpl):
        (JSC::FunctionExecutable::toStringSlow):
        * runtime/FunctionExecutable.h:
        * runtime/FunctionExecutableInlines.h:
        (JSC::FunctionExecutable::toString):
        * runtime/FunctionPrototype.cpp:
        (JSC::FunctionPrototype::addFunctionProperties):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::toString):
        * runtime/JSFunction.h:
        * runtime/JSFunctionInlines.h:
        (JSC::JSFunction::asStringConcurrently const):
        * runtime/JSStringInlines.h:
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::toStringSlow):
        (JSC::NativeExecutable::visitChildrenImpl):
        * runtime/NativeExecutable.h:

2021-06-04  Michael Catanzaro  <mcatanzaro@gnome.org>

        Fix more GCC warnings
        https://bugs.webkit.org/show_bug.cgi?id=226193

        Reviewed by Adrian Perez de Castro.

        Fix -Wreturn-type warnings due to missing RELEASE_ASSERT_NOT_REACHED() where expected.

        * jit/JITPlan.cpp:
        (JSC::JITPlan::tier const):
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):

2021-06-03  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Implement JIT ICs for InByVal
        https://bugs.webkit.org/show_bug.cgi?id=226563

        Reviewed by Saam Barati.

        Until now, InByVal has had few optimizations implemented:
        DFG would attempt to convert string index lookups to InById and int32 lookups to HasIndexedProperty,
        but there has been no inline caching nor any special handling for symbol lookups.

        This has become a more urgent problem now, as `#x in obj` (i.e. HasPrivateName / HasPrivateBrand)
        will need to mimic InByVal's inline caching strategy in order to be deemed performant enough to ship.

        This patch thus implements inline caching for InByVal at all JIT tiers.
        The result is a night-and-day difference for symbols, a nice boost for string indices, and no change for int32s: 

        in-by-val-symbol                  203.5572+-2.7647     ^     19.1035+-0.7498        ^ definitely 10.6555x faster
        in-by-val-string-index             87.0368+-44.7766          45.9971+-32.0007         might be 1.8922x faster
        in-by-val-int32                   110.9904+-1.7109     ?    111.3431+-1.7558        ?

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::singleIdentifier const):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::singleIdentifier const):
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::singleIdentifier const):
        * bytecode/ICStatusMap.h:
        * bytecode/ICStatusUtils.h:
        (JSC::singleIdentifierForICStatus):
        * bytecode/InByIdVariant.cpp:
        (JSC::InByIdVariant::InByIdVariant):
        (JSC::InByIdVariant::attemptToMerge):
        (JSC::InByIdVariant::dumpInContext const):
        * bytecode/InByIdVariant.h:
        (JSC::InByIdVariant::identifier const):
        (JSC::InByIdVariant::overlaps):
        * bytecode/InByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.cpp.
        (JSC::InByStatus::appendVariant):
        (JSC::InByStatus::shrinkToFit):
        (JSC::InByStatus::computeFor):
        (JSC::InByStatus::computeForStubInfo):
        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::InByStatus::merge):
        (JSC::InByStatus::filter):
        (JSC::InByStatus::markIfCheap):
        (JSC::InByStatus::finalize):
        (JSC::InByStatus::singleIdentifier const):
        (JSC::InByStatus::dump const):
        * bytecode/InByStatus.h: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.h.
        * bytecode/RecordedStatuses.cpp:
        (JSC::RecordedStatuses::addInByStatus): Renamed from addInByIdStatus.
        * bytecode/RecordedStatuses.h:
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::singleIdentifier const):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterICStatus):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleInById):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGClobbersExitState.cpp:
        (JSC::DFG::clobbersExitState):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::addInByVal):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasInByStatus): Renamed from hasInByIdStatus.
        (JSC::DFG::Node::inByStatus): Renamed from inByIdStatus.
        * dfg/DFGNodeType.h:
        * dfg/DFGObjectAllocationSinkingPhase.cpp:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileInByVal):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGVarargsForwardingPhase.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileInBy):
        (JSC::FTL::DFG::LowerDFGToB3::compileInById):
        (JSC::FTL::DFG::LowerDFGToB3::compileInByVal):
        * jit/ICStats.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITInByValGenerator::JITInByValGenerator):
        (JSC::JITInByValGenerator::generateFastPath):
        (JSC::JITInByValGenerator::finalize):
        (JSC::JITInByIdGenerator::JITInByIdGenerator):
        * jit/JITInlineCacheGenerator.h:
        (JSC::JITDelByIdGenerator::slowPathJump const):
        (JSC::JITInByValGenerator::JITInByValGenerator):
        (JSC::JITInByValGenerator::slowPathJump const):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_in_by_val):
        (JSC::JIT::emitSlow_op_in_by_val):
        * jit/Repatch.cpp:
        (JSC::tryCacheInBy): Renamed from tryCacheInByID.
        (JSC::repatchInBy): Renamed from repatchInByID.
        (JSC::resetInBy): Renamed from resetInByID.
        * jit/Repatch.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * runtime/CommonSlowPaths.cpp:
        * runtime/CommonSlowPaths.h:

2021-06-03  Mark Lam  <mark.lam@apple.com>

        Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException.
        https://bugs.webkit.org/show_bug.cgi?id=226609
        rdar://78465046

        Reviewed by Robin Morisset.

        * runtime/ObjectPrototype.cpp:
        (JSC::objectPrototypeHasOwnProperty):

2021-06-03  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make $vm's accessor test functions robust against primitive |this|
        https://bugs.webkit.org/show_bug.cgi?id=226591

        Reviewed by Saam Barati.

        These functions are testing-purpose, and they are not robust against passing primitive as |this|.
        This patch makes them robust so that we throw an error instead of crash.

        * tools/JSDollarVM.cpp:

2021-06-03  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r278356.
        https://bugs.webkit.org/show_bug.cgi?id=226606

        "Breaks jsc tests".

        Reverted changeset:

        "Convert small JIT pool tests into executable fuzzing"
        https://bugs.webkit.org/show_bug.cgi?id=226279
        https://trac.webkit.org/changeset/278356

2021-06-03  Filip Pizlo  <fpizlo@apple.com>

        DFG should eliminate obvious store barriers
        https://bugs.webkit.org/show_bug.cgi?id=226604

        Reviewed by Mark Lam.

        This has a couple changes:
        
        - PutByOffset doesn't GC! So let's not say that it does.

        - The store barrier clustering phase is no longer called the store barrier fencing phase in
          dumps.

        Small Speedometer2 speed-up. Definite speed-up for Elm.

        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGStoreBarrierClusteringPhase.cpp:

2021-06-03  Patrick Angle  <pangle@apple.com>

        Web Inspector: [Cocoa] `RemoteInspector` won't connect to a new relay if it hasn't yet failed to communicate with a previously connected relay
        https://bugs.webkit.org/show_bug.cgi?id=226539

        Reviewed by Devin Rousso.

        `RemoteInspector` communicates with a relay daemon running on the same device in order to send updates like new
        or removed inspectable targets and receive changes to settings like automatic debugging. The relay daemon then
        communicates with a client that connects for debugging. Only one relay daemon should ever be running at a time,
        and its lifecycle is managed separately from JavaScriptCore.

        RemoteInspector holds a RefPtr to its connection to this relay, and only clears this pointer upon a failure to
        communicate over the XPC connection or a known disconnection. However, it is possible, and in some cases likely
        (for example the relay restarting from a brief client disconnection and reconnection), that we can be informed
        of a newly launched relay being available while still thinking we are connected to the old relay, as we have not 
        yet sent a message and triggered a failure in the interim period of time.

        To correct this we now send a simple message any time `setupXPCConnectionIfNeeded` is called if we have an
        existing RefPtr to a relay connection in order to verify the connection is still functional. We now also retry
        to connect to a relay upon failure in order to create a new connection to the current relay.

        In order to prevent entering a retry loop where every subsequent retry's failure results in another retry
        forever, a flag to retry connecting is set when a call to setupXPCConnectionIfNeeded is made while we already
        have a RefPtr to a relay connection. On failure if we are in this special state we will retry once to connect
        but subsequent failures will not automatically reattempt a connection.

        * inspector/remote/RemoteInspector.h:
        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
        (Inspector::RemoteInspector::stopInternal):
        - Clear the retry connection flag when stopping in an orderly fashion.
        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
        - Set the retry connection flag and send a simple message if we already have a relay connection in order to make
        sure the connection is either still valid or is torn down properly on failure.
        (Inspector::RemoteInspector::xpcConnectionFailed):
        - If the retry flag is set, schedule a retry and clear the retry flag.

2021-06-02  Robin Morisset  <rmorisset@apple.com>

        B3MoveConstants should filter directly on Values, and only create ValueKeys when useful
        https://bugs.webkit.org/show_bug.cgi?id=226420

        Reviewed by Phil Pizlo.

        I did a few runs of JetStream2 to measure results, the time spent in B3MoveConstants goes from 160-180ms to 100-110ms.
        The total time spent in B3+Air is in the 6 to 8s range, so this is approximately a 1% speedup.

        * b3/B3MoveConstants.cpp:

2021-06-02  Robin Morisset  <rmorisset@apple.com>

        Merge B3::StackSlot and Air::StackSlot
        https://bugs.webkit.org/show_bug.cgi?id=226362

        Reviewed by Filip Pizlo.

        This is a very simple and safe (although small) memory saving, since every B3StackSlot eventually becomes an AirStackSlot with an exact copy of all the same information.
        Simply dropping the B3StackSlot past that point is tricky, because one of them might be retained by FTLState (and modified by Air).
        It is much simpler to just use Air::StackSlot throughout. It saves us:
        - 16 bytes per B3StackSlot (for the structure itself)
        - another 8 bytes per B3StackSlot (for the pointer in the SparseCollection)
        - 8 bytes per AirStackSlot (for the pointer to the B3::StackSlot)
        I also took the opportunity to save an extra 8 bytes per AirStackSlot, by shrinking the bytesize field to a uint16_t (with a RELEASE_ASSERT that we never overflow it) and moving the StackSlotKind in the hole this creates.
        Total savings: 16 bytes per spill slot and 40 bytes per locked (by B3) slot.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * b3/B3LowerToAir.cpp:
        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::addStackSlot):
        (JSC::B3::Procedure::dump const):
        * b3/B3Procedure.h:
        * b3/B3ProcedureInlines.h:
        (JSC::B3::Procedure::stackSlots):
        (JSC::B3::Procedure::stackSlots const):
        * b3/B3SlotBaseValue.cpp:
        * b3/B3SlotBaseValue.h:
        * b3/B3StackSlot.cpp: Removed.
        * b3/B3StackSlot.h: Removed.
        * b3/B3Value.cpp:
        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::addStackSlot):
        * b3/air/AirCode.h:
        * b3/air/AirStackSlot.cpp:
        (JSC::B3::Air::StackSlot::setOffsetFromFP):
        (JSC::B3::Air::StackSlot::deepDump const):
        (JSC::B3::Air::StackSlot::StackSlot):
        * b3/air/AirStackSlot.h:
        (JSC::B3::Air::StackSlot::ensureSize):
        * b3/testb3.h:
        * ftl/FTLCompile.cpp:
        * ftl/FTLState.h:

2021-06-02  Pablo Saavedra  <psaavedra@igalia.com>

        Fix build error with ENABLE_DFG_JIT=OFF
        https://bugs.webkit.org/show_bug.cgi?id=226550

        Reviewed by Mark Lam.

        * jit/JITPlan.cpp:
        (JSC::JITPlan::compileInThread):

2021-06-02  Robin Morisset  <rmorisset@apple.com>

        We should drop B3 values while running Air
        https://bugs.webkit.org/show_bug.cgi?id=226187

        Reviewed by Saam Barati.

        We must keep the following values:
        - WasmBoundsCheck, to know whether it is Pinned or Maximum, and if it is pinned find its argument.
        - CCall/Patch/Check/CheckAdd/CheckSub/CheckMul and all of their children, because all of these are lowered to Air::Patchpoint, which needs to know the type of its arguments, and does so by looking at the children of its        origin.
        I intend to fix these in later patches if possible.

        Finally we must preserve all B3 values in the following cases:
        - if we dump the disassembly or the Air graph: because otherwise we cannot print the origins
        - if we are using the sampling profiler, because it relies on PCToCodeOriginMap which we cannot accurately fill without these origins.

        We must also keep m_tuples alive, as it is used by Patchpoints in Air to understand the types of their arguments.
        We also don't touch StackSlots (in this patch), because one of them is captured by FTL::State.

        Also now PCToOriginMap has a Vector with no inline capacity, since it is either quite large (if needed) or empty (otherwise).

        The performance impact of this is a progression on various RAMification subtests on Mac, but is more mitigated on iPhone7, with various regressions.
        I suspect these to be noise, and will monitor the performance bots post-landing to make sure of it.

        * b3/B3LowerToAir.cpp:
        (JSC::B3::lowerToAir):
        * b3/B3Procedure.cpp:
        (JSC::B3::Procedure::freeUnneededB3ValuesAfterLowering):
        * b3/B3Procedure.h:
        (JSC::B3::Procedure::releasePCToOriginMap):
        (JSC::B3::Procedure::setNeedsPCToOriginMap):
        (JSC::B3::Procedure::needsPCToOriginMap):
        * b3/B3SparseCollection.h:
        (JSC::B3::SparseCollection::clearAll):
        (JSC::B3::SparseCollection::filterAndTransfer):
        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::Code):
        * b3/air/AirCode.h:
        (JSC::B3::Air::Code::shouldPreserveB3Origins const):
        * b3/air/AirGenerate.cpp:
        (JSC::B3::Air::generateWithAlreadyAllocatedRegisters):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLState.cpp:
        (JSC::FTL::State::State):

2021-06-02  Chris Dumez  <cdumez@apple.com>

        Drop Checked::safeGet()
        https://bugs.webkit.org/show_bug.cgi?id=226537

        Reviewed by Geoffrey Garen.

        Drop Checked::safeGet() and replace with uses of Checked::operator T() or Checked::value().
        safeGet() is a bit akward, having both a return value and an out-parameter.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::unshiftCountWithAnyIndexingType):
        * runtime/JSStringJoiner.cpp:
        (JSC::JSStringJoiner::joinedLength const):
        * wasm/WasmFormat.cpp:
        (JSC::Wasm::Segment::create):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::grow):

2021-06-02  Keith Miller  <keith_miller@apple.com>

        Add globalObject API set property test
        https://bugs.webkit.org/show_bug.cgi?id=226542
        <rdar://78287979>

        Reviewed by Alexey Shvayka.

        * API/tests/testapi.cpp:
        (TestAPI::testJSObjectSetOnGlobalObjectSubclassDefinition):
        (testCAPIViaCpp):

2021-06-02  Keith Miller  <keith_miller@apple.com>

        Convert small JIT pool tests into executable fuzzing
        https://bugs.webkit.org/show_bug.cgi?id=226279

        Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any
        actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit.
        Instead of testing such a small pool we should just fuzz each executable allocation that says it
        can fail.

        The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations
        fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked
        by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see
        flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command.

        Reviewed by Michael Saboff.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::numberOfDFGCompiles):
        * jit/ExecutableAllocationFuzz.cpp:
        (JSC::doExecutableAllocationFuzzing):
        * jsc.cpp:
        (runJSC):

2021-06-02  Chris Dumez  <cdumez@apple.com>

        Use Checked aliases instead of Checked<T, RecordOverflow>
        https://bugs.webkit.org/show_bug.cgi?id=226535

        Reviewed by Keith Miller.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::unshiftCountWithAnyIndexingType):
        * runtime/JSStringJoiner.cpp:
        (JSC::JSStringJoiner::joinedLength const):
        * runtime/JSStringJoiner.h:
        * runtime/StringPrototype.cpp:
        (JSC::jsSpliceSubstringsWithSeparators):
        * wasm/WasmFormat.cpp:
        (JSC::Wasm::Segment::create):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::grow):
        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::ByteCompiler::emitDisjunction):
        * yarr/YarrParser.h:
        (JSC::Yarr::Parser::consumeNumber):
        * yarr/YarrPattern.cpp:

2021-06-01  Darin Adler  <darin@apple.com>

        Remove <wtf/Optional.h>
        https://bugs.webkit.org/show_bug.cgi?id=226437

        Reviewed by Chris Dumez.

        * <many files>: Remove include of <wtf/Optional.h>.

        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
        (CppBackendDispatcherHeaderGenerator._generate_secondary_header_includes): Don't generate
        an include of wtf/Optional.h; including WTFString.h takes care of this anyway.
        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
        (CppFrontendDispatcherHeaderGenerator._generate_secondary_header_includes): Ditto.
        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
        (CppProtocolTypesHeaderGenerator._generate_secondary_header_includes): Ditto.

        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
        (CppProtocolTypesImplementationGenerator.generate_output): Generate an include of <optional>
        instead of <wtf/Optional.h>.

        * inspector/scripts/tests/expected/*: Regenerate.

2021-06-01  Chris Dumez  <cdumez@apple.com>

        Rename Checked::unsafeGet() to Checked::value()
        https://bugs.webkit.org/show_bug.cgi?id=226514

        Reviewed by Darin Adler.

        Rename Checked::unsafeGet() to Checked::value(). The "unsafeGet" naming is confusing as this
        function isn't really unsafe since it will crash if the value has overflowed. Also add an
        `operator T()` to implicitly convert a Checked to its underlying type without needing to
        call value().

        * b3/B3Const32Value.cpp:
        (JSC::B3::Const32Value::checkAddConstant const):
        (JSC::B3::Const32Value::checkSubConstant const):
        (JSC::B3::Const32Value::checkMulConstant const):
        * b3/B3Const64Value.cpp:
        (JSC::B3::Const64Value::checkAddConstant const):
        (JSC::B3::Const64Value::checkSubConstant const):
        (JSC::B3::Const64Value::checkMulConstant const):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::FinallyContext::numberOfBreaksOrContinues const):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * heap/Heap.cpp:
        (JSC::Heap::deprecatedReportExtraMemorySlowCase):
        (JSC::Heap::extraMemorySize):
        (JSC::Heap::updateAllocationLimits):
        (JSC::Heap::reportExtraMemoryVisited):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::propagateExternalMemoryVisitedIfNecessary):
        * runtime/ArgList.cpp:
        (JSC::MarkedArgumentBuffer::slowEnsureCapacity):
        (JSC::MarkedArgumentBuffer::expandCapacity):
        * runtime/ArrayPrototype.cpp:
        (JSC::concatAppendOne):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/DirectArguments.h:
        * runtime/HashMapImpl.h:
        (JSC::HashMapBuffer::allocationSize):
        (JSC::HashMapImpl::HashMapImpl):
        * runtime/HashMapImplInlines.h:
        (JSC::nextCapacity):
        (JSC::HashMapImpl<HashMapBucketType>::finishCreation):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::parseInt):
        * runtime/JSImmutableButterfly.h:
        (JSC::JSImmutableButterfly::tryCreate):
        * runtime/JSLexicalEnvironment.h:
        (JSC::JSLexicalEnvironment::offsetOfVariable):
        (JSC::JSLexicalEnvironment::allocationSizeForScopeSize):
        * runtime/JSObject.h:
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::create):
        * runtime/JSString.h:
        * runtime/ScopedArguments.cpp:
        (JSC::ScopedArguments::createUninitialized):
        * runtime/StringPrototype.cpp:
        (JSC::jsSpliceSubstrings):
        (JSC::jsSpliceSubstringsWithSeparators):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::create):
        * runtime/VM.h:
        (JSC::ScratchBuffer::allocationSize):
        * runtime/WeakMapImpl.h:
        (JSC::WeakMapBuffer::allocationSize):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
        (JSC::Wasm::AirIRGenerator::emitCallPatchpoint):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        * wasm/WasmInstance.cpp:
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::allocationSize):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::push):
        (JSC::Wasm::LLIntGenerator::getDropKeepCount):
        (JSC::Wasm::LLIntGenerator::walkExpressionStack):
        (JSC::Wasm::LLIntGenerator::finalize):
        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
        (JSC::Wasm::LLIntGenerator::addLoop):
        (JSC::Wasm::LLIntGenerator::addTopLevel):
        (JSC::Wasm::LLIntGenerator::addBlock):
        (JSC::Wasm::LLIntGenerator::addIf):
        (JSC::Wasm::LLIntGenerator::addElseToUnreachable):
        * wasm/WasmSignature.h:
        (JSC::Wasm::Signature::allocatedSize):
        * wasm/WasmStreamingParser.cpp:
        (JSC::Wasm::StreamingParser::addBytes):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::Table):
        (JSC::Wasm::Table::grow):
        (JSC::Wasm::FuncRefTable::FuncRefTable):
        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::Interpreter::DisjunctionContext::allocationSize):
        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::allocationSize):
        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
        (JSC::Yarr::ByteCompiler::atomCharacterClass):
        (JSC::Yarr::ByteCompiler::atomBackReference):
        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
        (JSC::Yarr::ByteCompiler::emitDisjunction):
        * yarr/YarrInterpreter.h:
        (JSC::Yarr::ByteTerm::ByteTerm):
        (JSC::Yarr::ByteTerm::CheckInput):
        (JSC::Yarr::ByteTerm::UncheckInput):
        * yarr/YarrJIT.cpp:
        * yarr/YarrParser.h:
        (JSC::Yarr::Parser::consumeNumber):
        * yarr/YarrPattern.cpp:
        (JSC::Yarr::PatternTerm::dumpQuantifier):

2021-06-01  Adrian Perez de Castro  <aperez@igalia.com>

        [WPE][GTK] Support building against uClibc
        https://bugs.webkit.org/show_bug.cgi?id=226244

        Reviewed by Michael Catanzaro.

        * assembler/MacroAssemblerARM64.cpp:
        (getauxval): Provide a fallback implementation of getauxval() for
        systems which do not provide <sys/auxv.h>, like those using uClibc
        as their C library.

2021-05-30  Chris Dumez  <cdumez@apple.com>

        Drop UncheckedCondition / UncheckedLock
        https://bugs.webkit.org/show_bug.cgi?id=226432

        Reviewed by Darin Adler.

        Drop one remaining use of UncheckedLock in favor of Lock.

        * jit/JITSafepoint.cpp:
        * jit/JITWorklistThread.h:

2021-05-30  Darin Adler  <darin@apple.com>

        Remove WTF::Optional synonym for std::optional, using that class template directly instead
        https://bugs.webkit.org/show_bug.cgi?id=226433

        Reviewed by Chris Dumez.

        * <many files>: Let the do-webcore-rename script rename Optional<> to std::optional<>.

        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_payload): Use auto instead
        of Optional<>. Also use * instead of value() and nest the definition of the local inside an if
        statement in the case where it's an optional.

        * inspector/scripts/tests/expected/*: Regenerated these results.

2021-05-29  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::VMInspector
        https://bugs.webkit.org/show_bug.cgi?id=226427

        Reviewed by Mark Lam.

        Stop using UncheckedLock in JSC::VMInspector, as it is being phased out in favor
        of Lock, which supports Clang thread safety analysis.

        * tools/HeapVerifier.cpp:
        (JSC::HeapVerifier::checkIfRecorded):
        * tools/SigillCrashAnalyzer.cpp:
        (JSC::SigillCrashAnalyzer::analyze):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::isValidExecutableMemory):
        (JSC::VMInspector::codeBlockForMachinePC):
        (JSC::VMInspector::lock): Deleted.
        * tools/VMInspector.h:
        (JSC::VMInspector::WTF_RETURNS_LOCK):
        (JSC::VMInspector::WTF_REQUIRES_LOCK):
        (JSC::VMInspector::getLock): Deleted.
        (JSC::VMInspector::iterate): Deleted.

2021-05-29  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::ConcurrentJSLock
        https://bugs.webkit.org/show_bug.cgi?id=226428

        Reviewed by Darin Adler.

        Stop using UncheckedLock in JSC::ConcurrentJSLock as it is being phased out in
        favor of Lock, which supports Clang thread safety analysis.

        * runtime/ConcurrentJSLock.h:
        (JSC::ConcurrentJSLockerBase::ConcurrentJSLockerBase):
        * runtime/Structure.cpp:
        (JSC::Structure::findStructuresAndMapForMaterialization):
        (JSC::Structure::materializePropertyTable):
        * runtime/Structure.h:
        * runtime/StructureInlines.h:
        (JSC::Structure::forEachPropertyConcurrently):
        * yarr/YarrInterpreter.cpp:

2021-05-28  Darin Adler  <darin@apple.com>

        Clients of optional should use has_value instead of relying on hasValue macro
        https://bugs.webkit.org/show_bug.cgi?id=226395

        Reviewed by Chris Dumez.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::RegExpNode::emitBytecode): Don't use hasValue.

2021-05-29  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::SamplingProfiler
        https://bugs.webkit.org/show_bug.cgi?id=226414

        Reviewed by Darin Adler.

        Stop using UncheckedLock in JSC::SamplingProfiler as it is being phased out in favor of Lock,
        which supports clang thread safety analysis.

        * heap/Heap.cpp:
        (JSC::visitSamplingProfiler):
        * inspector/agents/InspectorScriptProfilerAgent.cpp:
        (Inspector::InspectorScriptProfilerAgent::startTracking):
        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
        (Inspector::InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::createThreadIfNecessary):
        (JSC::SamplingProfiler::timerLoop):
        (JSC::SamplingProfiler::takeSample):
        (JSC::SamplingProfiler::processUnverifiedStackTraces):
        (JSC::SamplingProfiler::start):
        (JSC::SamplingProfiler::startWithLock):
        (JSC::SamplingProfiler::pause):
        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThreadWithLock):
        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
        (JSC::SamplingProfiler::noticeJSLockAcquisition):
        (JSC::SamplingProfiler::noticeVMEntry):
        (JSC::SamplingProfiler::clearData):
        (JSC::SamplingProfiler::releaseStackTraces):
        (JSC::SamplingProfiler::stackTracesAsJSON):
        (JSC::SamplingProfiler::reportTopFunctions):
        (JSC::SamplingProfiler::reportTopBytecodes):
        * runtime/SamplingProfiler.h:
        (JSC::SamplingProfiler::WTF_RETURNS_LOCK):
        (JSC::SamplingProfiler::WTF_REQUIRES_LOCK):

2021-05-29  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::dumpJITMemory()
        https://bugs.webkit.org/show_bug.cgi?id=226413

        Reviewed by Darin Adler.

        Stop using UncheckedLock in JSC::dumpJITMemory() as it is being phased out in favor of Lock,
        which supports Clang thread safety analysis.

        * jit/ExecutableAllocator.cpp:
        (JSC::dumpJITMemory):

2021-05-29  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::WasmCalleeRegistry
        https://bugs.webkit.org/show_bug.cgi?id=226412

        Reviewed by Darin Adler.

        Stop using UncheckedLock in JSC::WasmCalleeRegistry, as it is being phased out in favor of
        Lock, which supports Clang thread safety analysis.

        * runtime/SamplingProfiler.cpp:
        (JSC::FrameWalker::FrameWalker):
        (JSC::FrameWalker::recordJITFrame):
        (JSC::CFrameWalker::CFrameWalker):
        (JSC::SamplingProfiler::takeSample):
        * wasm/WasmCalleeRegistry.h:
        (JSC::Wasm::CalleeRegistry::WTF_RETURNS_LOCK):
        (JSC::Wasm::CalleeRegistry::WTF_REQUIRES_LOCK):
        (JSC::Wasm::CalleeRegistry::getLock): Deleted.
        (JSC::Wasm::CalleeRegistry::isValidCallee): Deleted.
        * wasm/WasmFaultSignalHandler.cpp:
        (JSC::Wasm::trapHandler):

2021-05-29  Mark Lam  <mark.lam@apple.com>

        VM::isTerminationException() should only be run on a non-null exception value.
        https://bugs.webkit.org/show_bug.cgi?id=226417
        rdar://78646170

        Reviewed by Filip Pizlo.

        * jsc.cpp:
        (runInteractive):

2021-05-29  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, late-ish May 2021 edition redux
        https://bugs.webkit.org/show_bug.cgi?id=226401

        Unreviewed non-unified build fixes.

        * jit/JITSizeStatistics.cpp: Add missing LinkBuffer.h header.
        * jit/JITSizeStatistics.h: Add missing CCallHelpers.h and wtf/text/WTFString.h headers;
        remove unneeded CCallHelpers forward declaration.

2021-05-28  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in WTF::MetaAllocator
        https://bugs.webkit.org/show_bug.cgi?id=226396

        Reviewed by Darin Adler.

        Stop using UncheckedLock in WTF::MetaAllocator, as it is being phased out in favor on Lock,
        which supports Clang thread safety analysis.

        * jit/ExecutableAllocator.cpp:
        (JSC::ExecutableAllocator::getLock const):
        * jit/ExecutableAllocator.h:
        (JSC::ExecutableAllocatorBase::WTF_RETURNS_LOCK):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::isValidExecutableMemory):

2021-05-28  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSDOMGlobalObject
        https://bugs.webkit.org/show_bug.cgi?id=226281

        Reviewed by Darin Adler.

        Drop JSC::lockDuringMarking() and its now empty header given that it does conditional
        locking and it is not compatible with Clang thread safety analysis.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/UnlinkedCodeBlock.h:
        * heap/LockDuringMarking.h: Removed.

2021-05-28  Saam Barati  <sbarati@apple.com>

        Add the ability to dump statistics about cumulative counts and code sizes of Baseline JIT opcodes and DFG nodes
        https://bugs.webkit.org/show_bug.cgi?id=226200

        Reviewed by Robin Morisset.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * dfg/DFGSlowPathGenerator.h:
        (JSC::DFG::SlowPathGenerator::currentNode const):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        * jit/JITSizeStatistics.cpp: Added.
        (JSC::JITSizeStatistics::markStart):
        (JSC::JITSizeStatistics::markEnd):
        (JSC::JITSizeStatistics::dump const):
        * jit/JITSizeStatistics.h: Added.
        (JSC::JITSizeStatistics::reset):
        * jsc.cpp:
        (runJSC):
        * runtime/OptionsList.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):

2021-05-28  Saam Barati  <sbarati@apple.com>

        Don't sink arguments past the context of the inline call frame they were created in
        https://bugs.webkit.org/show_bug.cgi?id=226363
        <rdar://78392801>

        Reviewed by Filip Pizlo.

        DFG OSR exit isn't set up to allow materializing phantom arguments objects
        when the inline call frame is no longer present in the exit metadata. There
        may be multiple reasons for this, but there's at least one I discovered:
        We don't analyze any locals when reconstructing the variable event stream
        if that local is past the extent of the inline call frame.
        
        This patch makes it so we treat it as an escape if between the definition and
        the last use of a sink candidate (either via an IR use or bytecode liveness)
        there is an exit to a place in the graph where the inline call frame of the
        definition is no longer present.

        * dfg/DFGVarargsForwardingPhase.cpp:

2021-05-28  Stephan Szabo  <stephan.szabo@sony.com>

        Regenerate builtins generator expectations after optional changes
        https://bugs.webkit.org/show_bug.cgi?id=226381

        Reviewed by Chris Dumez.

        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:

2021-05-28  Mark Lam  <mark.lam@apple.com>

        The jsc shell should not continue executing after a termination has been received.
        https://bugs.webkit.org/show_bug.cgi?id=226368
        rdar://78013374

        Reviewed by Saam Barati.

        This patch makes the jsc shell forbid execution in all the places that it has
        caught and seen a TerminationException.

        * jsc.cpp:
        (JSC_DEFINE_HOST_FUNCTION):
        (checkException):
        (runWithOptions):
        (runInteractive):

2021-05-27  Robin Morisset  <rmorisset@apple.com>

        AirAllocateStackByGraphColoring should use the optimized interference graphs from AirAllocateRegistersByGraphColoring
        https://bugs.webkit.org/show_bug.cgi?id=226258

        Reviewed by Phil Pizlo.

        The main change in this patch is that AirAllocateStackByGraphColoring is now using the optimized datastructures in wtf/InterferenceGraph.h.
        This required templating most of it over the interference graph used (Small/Large/Huge), but I tried keeping some common parts out of the templated class to minimize the impact on compile times and binary size.

        A consequence of that change is that coalescableMoves and remappedStackSlots now store indices instead of direct pointers to StackSlots, resulting in a memory reduction of about 3x as well.

        Another consequence is that I had to slightly alter the way that coalescing works: instead of carefully removing the interference edges of the killed slot, we simply use mayClear() which is not guaranteed to remove anything.
        I believe that this is sound, because every subsequent access to m_interference checks whether a slot has been coalesced first, so dropping these edges is purely a memory saving, but has no logical effect.

        The new code was tested in a few ways:
        - running on JetStream2 with asan
        - running on JetStream2 with TEST_OPTIMIZED_INTERFERENCE_GRAPH
        - running on JetStream2 and logging the frame sizes at the end of this phase, and comparing to the results of doing the same on ToT (same average frame size)

        The two functions where this code had the largest memory footprint in JetStream2 were both in tsf-wasm.
        One has 751 stack slots, and had an interference graph of 2.1MB and a coalescableMoves vector of 440kB
        The other has 673 stack slots, and had an interference graph of 1.9MB and a coalescableMoves vector of 421kB.
        With this patch, they respectively use 79kB+146kB and 67kB+140kB
        The effect on the rest of JetStream2 is less likely to matter as few functions used more than a few dozens of kB in this phase, but in percentages are just as huge.

        More importantly (and the reason I wrote this patch in the first place), I checked mruby-wasm.aotoki.dev which with a few other pages forced us to lower Options::maximumTmpsForGraphColoring because of jetsams.
        It has two massive functions that reach this phase if I increase Options::maximumTmpsForGraphColoring:
        - about 6k stack slots -> 215MB + 6MB (interference graph + coalescableMoves)
        - about 9k stack slots -> 395MB + 4MB
        After this patch, they respectively use 4.5MB+2MB and 9MB+1.5MB, or roughly a 40x improvement.
        Combined with the recent improvements to the register allocator, I hope to be able to increase Options::maximumTmpsForGraphColoring soon (in a different patch for easier bisection if either cause a perf regression).
        This would be helpful, since its lowering cratered our performance on some other wasm application by 8x.

        In terms of compile times, this patch lowered the time spent in AllocateStackByGraphColoring over the course of a run of JetStream2 from roughly 350ms to roughly 270ms.
        This is almost certainly negligible, but at least it guarantees that it did not regress.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        * b3/air/AirAllocateStackByGraphColoring.cpp:
        (JSC::B3::Air::allocateStackByGraphColoring):

2021-05-27  Darin Adler  <darin@apple.com>

        Next step toward using std::optional directly instead of through WTF::Optional typedef
        https://bugs.webkit.org/show_bug.cgi?id=226280

        Reviewed by Chris Dumez.

        * <many files>: Accept the renaming done by do-webcore-rename.

        * yarr/YarrSyntaxChecker.cpp: Since the style checker complained about this file,
        tweaked style to make it happy after the renaming done by do-webcore-rename, and
        also hand-updated Optional to std::optional as long as we were touching it.

2021-05-27  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, late May 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=226322

        Unreviewed non-unified build fixes.

        * jit/JITPlan.cpp: Add missing HeapInlines.h and VMInlines.h headers.
        * jit/JITWorklist.cpp: Add missing HeapInlines.h and SlotVisitorInlines.h headers,
        remove SlotVisitor.h which is now unneeded.
        * jit/JITWorklistThread.cpp: Add missing HeapInlines.h header.

2021-05-27  Daniel Kolesa  <dkolesa@igalia.com>

        [JSC] Fix crash on 32-bit big endian systems.
        https://bugs.webkit.org/show_bug.cgi?id=226264

        Reviewed by Caio Araujo Neponoceno de Lima.

        This is an instance where properly offsetting was missed since
        the issue was not present in 2.30 series and therefore not fixed
        by r273104.

        * llint/LowLevelInterpreter32_64.asm:

2021-05-26  Chris Dumez  <cdumez@apple.com>

        Leverage the new Vector(const T*, size_t) constructor
        https://bugs.webkit.org/show_bug.cgi?id=226304

        Reviewed by Darin Adler.

        Leverage the new Vector(const T*, size_t) constructor in existing code.

        * wasm/WasmStreamingParser.cpp:
        (JSC::Wasm::StreamingParser::consume):

2021-05-26  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION: ASSERTION FAILED: !isCompilationThread() in JSC::Profiler::Database::addCompilation()
        https://bugs.webkit.org/show_bug.cgi?id=226302
        <rdar://78537378>

        Reviewed by Saam Barati.

        We started linking the JIT code in the compiler thread, which now triggers this assertion.
        The assertion was introduce before a lock was held to modify the data structures in the
        profiler database, but it's safe to remove it now.

        * profiler/ProfilerDatabase.cpp:
        (JSC::Profiler::Database::addCompilation):

2021-05-26  Chris Dumez  <cdumez@apple.com>

        Use UncheckedLock even less in JavaScriptCore
        https://bugs.webkit.org/show_bug.cgi?id=226278

        Reviewed by Darin Adler.

        Use UncheckedLock even less in JavaScriptCore as it is being phased out in
        favor of Lock, which supports Clang thread safety analysis.

        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::WTF_RETURNS_LOCK):
        * heap/CodeBlockSet.h:
        (JSC::CodeBlockSet::WTF_RETURNS_LOCK):
        * heap/Heap.h:
        * heap/MarkedSpace.h:
        (JSC::MarkedSpace::directoryLock):
        * heap/MarkingConstraintSolver.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::donateKnownParallel):
        * heap/SlotVisitor.h:
        * jit/JITWorklist.cpp:
        * jit/JITWorklist.h:
        * jsc.cpp:
        * profiler/ProfilerDatabase.h:
        * runtime/DeferredWorkTimer.h:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::invalidateCodeBlocksOnStack):
        * runtime/VMTraps.h:
        * tools/FunctionOverrides.cpp:
        (JSC::FunctionOverrides::FunctionOverrides):
        (JSC::FunctionOverrides::reinstallOverrides):
        (JSC::FunctionOverrides::parseOverridesInFile):
        * tools/FunctionOverrides.h:
        (JSC::FunctionOverrides::WTF_REQUIRES_LOCK):
        * tools/VMInspector.cpp:
        (JSC::ensureIsSafeToLock):
        (JSC::VMInspector::codeBlockForMachinePC):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::compileFunction):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        * wasm/WasmBBQPlan.h:
        * wasm/WasmEntryPlan.cpp:
        (JSC::Wasm::EntryPlan::parseAndValidateModule):
        (JSC::Wasm::EntryPlan::prepare):
        (JSC::Wasm::EntryPlan::ThreadCountHolder::~ThreadCountHolder):
        (JSC::Wasm::EntryPlan::complete):
        * wasm/WasmEntryPlan.h:
        (JSC::Wasm::EntryPlan::tryReserveCapacity):
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::compileFunction):
        (JSC::Wasm::LLIntPlan::didCompleteCompilation):
        (JSC::Wasm::LLIntPlan::completeInStreaming):
        (JSC::Wasm::LLIntPlan::didFailInStreaming):
        * wasm/WasmLLIntPlan.h:
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGForOSREntryPlan.h:
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOMGPlan.h:
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::runCompletionTasks):
        (JSC::Wasm::Plan::tryRemoveContextAndCancelIfLast):
        (JSC::Wasm::Plan::fail):
        * wasm/WasmPlan.h:
        * wasm/WasmStreamingCompiler.cpp:
        (JSC::Wasm::StreamingCompiler::didCompileFunction):
        (JSC::Wasm::StreamingCompiler::completeIfNecessary):
        (JSC::Wasm::StreamingCompiler::didComplete):
        (JSC::Wasm::StreamingCompiler::finalize):
        * wasm/WasmStreamingCompiler.h:
        * wasm/WasmStreamingPlan.cpp:
        (JSC::Wasm::StreamingPlan::work):
        * wasm/WasmStreamingPlan.h:
        * wasm/WasmThunks.h:

2021-05-26  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in WTF::AutomaticThread
        https://bugs.webkit.org/show_bug.cgi?id=226255

        Reviewed by Keith Miller.

        Some code in JSC had to be ported from UncheckedLock to Lock as a result of
        WTF::AutomaticThread using the Lock type.

        * dfg/DFGWorklist.cpp:
        (JSC::DFG::Worklist::Worklist):
        * dfg/DFGWorklist.h:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        * heap/Heap.h:
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::JITWorklist):
        * jit/JITWorklist.h:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::VMTraps):
        * runtime/VMTraps.h:
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::Worklist):
        * wasm/WasmWorklist.h:

2021-05-26  Tadeu Zagallo  <tzagallo@apple.com>

        Merge all the JIT worklists into a shared worklist
        https://bugs.webkit.org/show_bug.cgi?id=226207

        Reviewed by Saam Barati.

        Delete the DFG and FTL worklists and refactor JITWorklist to handle the compilation
        for all tiers. This reduces the total number of compiler threads while allowing each
        tier to use more threads whenever necessary. The default configuration is for the
        worklist to have 3 threads, baseline can use up to all 3 threads and DFG and FTL follow
        the previous limits set through JSC::Options. Right now, the worklist will only do work
        on upper tiers when all lower tiers have no pending tasks or have exceeded the maximum
        number of concurrent compilations. i.e. by default we only DFG compile when there are
        no baseline tasks in the queue and we only FTL compile when we either have no DFG tasks
        in the queue OR there are already 2 DFG compilations in progress.

        * API/JSVirtualMachine.mm:
        (+[JSVirtualMachine setNumberOfDFGCompilerThreads:]):
        (+[JSVirtualMachine setNumberOfFTLCompilerThreads:]):
        * API/tests/testapi.mm:
        (runJITThreadLimitTests):
        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCommon.h:
        (JSC::DFG::verboseCompilationEnabled):
        (JSC::DFG::logCompilationChanges):
        (JSC::DFG::shouldDumpGraphAtEachPhase):
        (JSC::DFG::shouldDumpDisassembly):
        * dfg/DFGDriver.cpp:
        (JSC::DFG::compileImpl):
        (JSC::DFG::compile):
        * dfg/DFGDriver.h:
        * dfg/DFGGraph.h:
        * dfg/DFGGraphSafepoint.h:
        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
        * dfg/DFGOSREntrypointCreationPhase.cpp:
        (JSC::DFG::OSREntrypointCreationPhase::run):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::triggerFTLReplacementCompile):
        (JSC::DFG::tierUpCommon):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::Plan):
        (JSC::DFG::Plan::codeSize const):
        (JSC::DFG::Plan::finalizeInGC):
        (JSC::DFG::Plan::notifyReady):
        (JSC::DFG::Plan::cancel):
        (JSC::DFG::Plan::compileInThreadImpl):
        (JSC::DFG::Plan::finalize):
        (JSC::DFG::Plan::iterateCodeBlocksForGC):
        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
        (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
        (JSC::DFG::Plan::isKnownToBeLiveAfterGC):
        * dfg/DFGPlan.h:
        * dfg/DFGPlanInlines.h: Removed.
        * dfg/DFGTierUpCheckInjectionPhase.cpp:
        (JSC::DFG::TierUpCheckInjectionPhase::run):
        * dfg/DFGWorklist.cpp: Removed.
        * dfg/DFGWorklist.h: Removed.
        * dfg/DFGWorklistInlines.h: Removed.
        * ftl/FTLCompile.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):
        * ftl/FTLState.cpp:
        (JSC::FTL::State::State):
        * ftl/FTLState.h:
        (JSC::FTL::verboseCompilationEnabled):
        (JSC::FTL::shouldDumpDisassembly):
        * heap/Heap.cpp:
        (JSC::Heap::completeAllJITPlans):
        (JSC::Heap::iterateExecutingAndCompilingCodeBlocks):
        (JSC::Heap::removeDeadCompilerWorklistEntries):
        (JSC::Heap::stopThePeriphery):
        (JSC::Heap::suspendCompilerThreads):
        (JSC::Heap::resumeCompilerThreads):
        (JSC::Heap::addCoreConstraints):
        * heap/Heap.h:
        * heap/RootMarkReason.h:
        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::codeSize const):
        (JSC::JIT::compileTimeStats):
        * jit/JIT.h:
        * jit/JITBaselinePlan.cpp: Copied from Source/JavaScriptCore/ftl/FTLState.cpp.
        (JSC::JITBaselinePlan::JITBaselinePlan):
        (JSC::JITBaselinePlan::compileInThreadImpl):
        (JSC::JITBaselinePlan::codeSize const):
        (JSC::JITBaselinePlan::finalize):
        * jit/JITBaselinePlan.h: Copied from Source/JavaScriptCore/dfg/DFGScannable.h.
        * jit/JITCompilationKey.cpp: Renamed from Source/JavaScriptCore/dfg/DFGCompilationKey.cpp.
        (JSC::JITCompilationKey::dump const):
        * jit/JITCompilationKey.h: Renamed from Source/JavaScriptCore/dfg/DFGCompilationKey.h.
        (JSC::JITCompilationKey::JITCompilationKey):
        (JSC::JITCompilationKey::operator! const):
        (JSC::JITCompilationKey::isHashTableDeletedValue const):
        (JSC::JITCompilationKey::mode const):
        (JSC::JITCompilationKey::operator== const):
        (JSC::JITCompilationKey::hash const):
        (JSC::JITCompilationKeyHash::hash):
        (JSC::JITCompilationKeyHash::equal):
        * jit/JITCompilationMode.cpp: Renamed from Source/JavaScriptCore/dfg/DFGCompilationMode.cpp.
        (WTF::printInternal):
        * jit/JITCompilationMode.h: Renamed from Source/JavaScriptCore/dfg/DFGCompilationMode.h.
        (JSC::isFTL):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITPlan.cpp: Added.
        (JSC::JITPlan::JITPlan):
        (JSC::JITPlan::cancel):
        (JSC::JITPlan::notifyCompiling):
        (JSC::JITPlan::notifyReady):
        (JSC::JITPlan::tier const):
        (JSC::JITPlan::key):
        (JSC::JITPlan::isKnownToBeLiveAfterGC):
        (JSC::JITPlan::isKnownToBeLiveDuringGC):
        (JSC::JITPlan::iterateCodeBlocksForGC):
        (JSC::JITPlan::checkLivenessAndVisitChildren):
        (JSC::JITPlan::computeCompileTimes const):
        (JSC::JITPlan::reportCompileTimes const):
        (JSC::JITPlan::compileInThread):
        * jit/JITPlan.h: Added.
        (JSC::JITPlan::~JITPlan):
        (JSC::JITPlan::vm const):
        (JSC::JITPlan::codeBlock const):
        (JSC::JITPlan::thread const):
        (JSC::JITPlan::mode const):
        (JSC::JITPlan::stage const):
        (JSC::JITPlan::isFTL const):
        (JSC::JITPlan::finalizeInGC):
        * jit/JITPlanStage.h: Renamed from Source/JavaScriptCore/dfg/DFGThreadData.cpp.
        * jit/JITSafepoint.cpp: Renamed from Source/JavaScriptCore/dfg/DFGSafepoint.cpp.
        (JSC::Safepoint::Safepoint):
        (JSC::Safepoint::~Safepoint):
        (JSC::Safepoint::begin):
        (JSC::Safepoint::cancel):
        * jit/JITSafepoint.h: Renamed from Source/JavaScriptCore/dfg/DFGSafepoint.h.
        * jit/JITScannable.h: Copied from Source/JavaScriptCore/dfg/DFGScannable.h.
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::JITWorklist):
        (JSC::JITWorklist::~JITWorklist):
        (JSC::JITWorklist::existingGlobalWorklistOrNull):
        (JSC::JITWorklist::ensureGlobalWorklist):
        (JSC::JITWorklist::enqueue):
        (JSC::JITWorklist::queueLength const):
        (JSC::JITWorklist::suspendAllThreads):
        (JSC::JITWorklist::resumeAllThreads):
        (JSC::JITWorklist::compilationState):
        (JSC::JITWorklist::completeAllReadyPlansForVM):
        (JSC::JITWorklist::waitUntilAllPlansForVMAreReady):
        (JSC::JITWorklist::completeAllPlansForVM):
        (JSC::JITWorklist::cancelAllPlansForVM):
        (JSC::JITWorklist::removeDeadPlans):
        (JSC::JITWorklist::setMaximumNumberOfConcurrentDFGCompilations):
        (JSC::JITWorklist::setMaximumNumberOfConcurrentFTLCompilations):
        (JSC::JITWorklist::visitWeakReferences):
        (JSC::JITWorklist::dump const):
        (JSC::JITWorklist::removeAllReadyPlansForVM):
        (JSC::JITWorklist::removeMatchingPlansForVM):
        * jit/JITWorklist.h:
        (JSC::JITWorklist::static_cast<size_t>):
        * jit/JITWorklistInlines.h: Renamed from Source/JavaScriptCore/dfg/DFGScannable.h.
        (JSC::JITWorklist::iterateCodeBlocksForGC):
        * jit/JITWorklistThread.cpp: Added.
        (JSC::JITWorklistThread::JITWorklistThread):
        (JSC::JITWorklistThread::name const):
        (JSC::JITWorklistThread::poll):
        (JSC::JITWorklistThread::work):
        (JSC::JITWorklistThread::threadDidStart):
        (JSC::JITWorklistThread::threadIsStopping):
        * jit/JITWorklistThread.h: Renamed from Source/JavaScriptCore/dfg/DFGThreadData.h.
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        * runtime/OptionsList.h:
        * runtime/VM.cpp:
        (JSC::VM::~VM):

2021-05-25  Fujii Hironori  <Hironori.Fujii@sony.com>

        Clang can't compile Optional<GPRTemporary> since r278035 because GPRTemporary has non-const copy constructor
        https://bugs.webkit.org/show_bug.cgi?id=226251

        Reviewed by Chris Dumez.

        WinCairo clang-cl builds reported a compilation error since r278035.
        > include\optional(95,5): error: the parameter for this explicitly-defaulted copy constructor is const, but a member or base requires it to be non-const

        * dfg/DFGSpeculativeJIT.h: Deleted the const copy ctor instead of the non-const copy ctor.

2021-05-25  Chris Dumez  <cdumez@apple.com>

        Use UncheckedLock less in JavaScriptCore
        https://bugs.webkit.org/show_bug.cgi?id=226212

        Reviewed by Saam Barati.

        Use UncheckedLock less in JavaScriptCore as it is being phased out in favor of Lock, which
        enables Clang thread safety analysis.

        * assembler/testmasm.cpp:
        * dfg/DFGCommon.cpp:
        * dynbench.cpp:
        * heap/Heap.cpp:
        * heap/Heap.h:
        * inspector/remote/socket/RemoteInspectorSocketEndpoint.h:
        * runtime/JSLock.cpp:
        * runtime/JSLock.h:
        * runtime/VM.h:

2021-05-25  Devin Rousso  <drousso@apple.com>

        [Modern Media Controls] REGRESSION(r254389) media controls needs the full list of language preferences for ordering tracks
        https://bugs.webkit.org/show_bug.cgi?id=226038

        Reviewed by Myles C. Maxfield and Eric Carlson.

        Media controls need access to the full list of language preferences in order to properly
        sort/order the list of tracks in the controls UI. For example, if a `<video>` has subtitles
        for English, Spanish, and French, and the user has English (default) and French (alternate)
        configured in the Language & Region view of System Preferences on macOS, WebKit should order
        the subtitles list English, French, and then Spanish.

        * shell/playstation/TestShell.cpp:
        (preTest):
        Instead of propagating the override, just clear it out.

2021-05-25  Chris Dumez  <cdumez@apple.com>

        Stop using UncheckedLock in JSC::PerfLog
        https://bugs.webkit.org/show_bug.cgi?id=226209

        Reviewed by Saam Barati.

        Stop using UncheckedLock in JSC::PerfLog and use Lock instead to benefit from Clang thread
        safety analysis.

        * assembler/PerfLog.cpp:
        (JSC::PerfLog::PerfLog):
        (JSC::PerfLog::write):
        (JSC::PerfLog::flush):
        (JSC::PerfLog::log):
        * assembler/PerfLog.h:

2021-05-24  Darin Adler  <darin@apple.com>

        Switch from WTF::Optional to std::optional
        https://bugs.webkit.org/show_bug.cgi?id=211674

        Reviewed by Chris Dumez.

        * runtime/IntlCollator.cpp:
        (JSC::IntlCollator::initializeCollator): Use JSObject* instead of
        Optional<JSObject&>.
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::toDateTimeOptionsAnyDate): Ditto.
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat): Ditto.
        * runtime/IntlDisplayNames.cpp:
        (JSC::IntlDisplayNames::initializeDisplayNames): Ditto.
        * runtime/IntlListFormat.cpp:
        (JSC::IntlListFormat::initializeListFormat): Ditto.
        * runtime/IntlLocale.cpp:
        (JSC::IntlLocale::initializeLocale): Ditto.
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat): Ditto.
        * runtime/IntlNumberFormat.h: Ditto.
        * runtime/IntlNumberFormatInlines.h:
        (JSC::setNumberFormatDigitOptions): Ditto.
        * runtime/IntlObject.cpp:
        (JSC::intlBooleanOption): Ditto.
        (JSC::intlStringOption): Ditto.
        (JSC::intlNumberOption): Ditto.
        (JSC::supportedLocales): Ditto.
        * runtime/IntlObject.h: Ditto.
        * runtime/IntlObjectInlines.h:
        (JSC::intlOption): Ditto.
        (JSC::intlGetOptionsObject): Ditto.
        (JSC::intlCoerceOptionsToObject): Ditto.
        * runtime/IntlPluralRules.cpp:
        (JSC::IntlPluralRules::initializePluralRules): Ditto.
        * runtime/IntlPluralRules.h: Ditto.
        * runtime/IntlRelativeTimeFormat.cpp:
        (JSC::IntlRelativeTimeFormat::initializeRelativeTimeFormat): Ditto.
        * runtime/IntlSegmenter.cpp:
        (JSC::IntlSegmenter::initializeSegmenter): Ditto.

2021-05-25  Saam Barati  <sbarati@apple.com>

        Finalize DFG/FTL code refs on the compiler threads
        https://bugs.webkit.org/show_bug.cgi?id=226096

        Reviewed by Mark Lam.

        Previously, link tasks that ran via the addLinkTask API were guaranteed to be
        called on the main thread. This is no longer the case. Most link tasks are
        happy running on a background thread, since all they're really doing is
        linking branches/calls or grabbing labels. However, a few users of addLinkTask were
        relying on it running on the main thread. For those users, there is a new
        addMainThreadFinalizationTask API, which is now used instead.

        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::~LinkBuffer):
        (JSC::LinkBuffer::runMainThreadFinalizationTasks):
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::cancel):
        (JSC::LinkBuffer::addMainThreadFinalizationTask):
        (JSC::LinkBuffer::~LinkBuffer): Deleted.
        * dfg/DFGFailedFinalizer.cpp:
        (JSC::DFG::FailedFinalizer::finalizeFunction): Deleted.
        * dfg/DFGFailedFinalizer.h:
        * dfg/DFGFinalizer.h:
        (JSC::DFG::Finalizer::cancel):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compile):
        (JSC::DFG::JITCompiler::compileFunction):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::cancel):
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction): Deleted.
        (JSC::DFG::JITFinalizer::finalizeCommon): Deleted.
        * dfg/DFGJITFinalizer.h:
        * dfg/DFGLazyJSValue.cpp:
        (JSC::DFG::LazyJSValue::emit const):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
        (JSC::DFG::Plan::cancel):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalize):
        (JSC::FTL::JITFinalizer::cancel):
        (JSC::FTL::JITFinalizer::finalizeFunction): Deleted.
        (JSC::FTL::JITFinalizer::finalizeCommon): Deleted.
        * ftl/FTLJITFinalizer.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLPatchpointExceptionHandle.cpp:
        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
        * ftl/FTLThunks.h:
        (JSC::FTL::Thunks::getSlowPathCallThunk):
        Add a lock to FTLThunks since we now may be calling into it from more than
        one thread at a time.

        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitVirtualCall):
        (JSC::AssemblyHelpers::emitUnlinkedVirtualCall): Deleted.
        * jit/AssemblyHelpers.h:
        * jit/JIT.cpp:
        (JSC::JIT::finalizeOnMainThread):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileCallEvalSlowCase):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileCallEvalSlowCase):

2021-05-25  Mark Lam  <mark.lam@apple.com>

        Reduce Baseline JIT emitted code size for op_jfalse, op_jtrue, op_get_from_scope, op_resolve_scope.
        https://bugs.webkit.org/show_bug.cgi?id=226107

        Reviewed by Saam Barati.

        Benchmarking with JetStream2 and Speedometer2 on M1 Mac shows that performance is
        neutral.

        This patch reduces Baseline JIT emitted code side on a run of JetStream2 CLI by
        another ~6.6M:
                        Base                     New                      Diff

           BaselineJIT: 64955116 (61.946026 MB)  57991704 (55.305199 MB)  0.89x (reduction)
                   DFG: 36382012 (34.696590 MB)  36540652 (34.847881 MB)  1.00x
                 Thunk: 23217692 (22.142117 MB)  23115852 (22.044994 MB)  1.00x
           InlineCache: 22228140 (21.198406 MB)  22262572 (21.231243 MB)  1.00x
                   FTL: 6025320 (5.746193 MB)    6164332 (5.878765 MB)    1.02x
                  Wasm: 2327604 (2.219776 MB)    2297036 (2.190624 MB)    0.99x
               YarrJIT: 1547172 (1.475498 MB)    1522584 (1.452049 MB)    0.98x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        Cumulative diff since the start of this effort to reduce Baseline JIT code size:

                        Base                     New                      Diff

           BaselineJIT: 89089964 (84.962811 MB)  57991704 (55.305199 MB)  0.65x (reduction)
                   DFG: 39117360 (37.305222 MB)  36540652 (34.847881 MB)  0.93x (reduction)
                 Thunk: 23230968 (22.154778 MB)  23115852 (22.044994 MB)  1.00x
           InlineCache: 22027416 (21.006981 MB)  22262572 (21.231243 MB)  1.01x
                   FTL: 6575772 (6.271145 MB)    6164332 (5.878765 MB)    0.94x (reduction)
                  Wasm: 2302724 (2.196049 MB)    2297036 (2.190624 MB)    1.00x
               YarrJIT: 1538956 (1.467663 MB)    1522584 (1.452049 MB)    0.99x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetInMetadataTable):
        (JSC::CodeBlock::offsetOfMetadataTable):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfValue):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfTruthy):
        (JSC::AssemblyHelpers::branchIfFalsey):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_jfalse):
        (JSC::JIT::valueIsFalseyGenerator):
        (JSC::JIT::emit_op_jtrue):
        (JSC::JIT::valueIsTruthyGenerator):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_resolve_scope):
        (JSC::JIT::generateOpResolveScopeThunk):
        (JSC::JIT::slow_op_resolve_scopeGenerator):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::generateOpGetFromScopeThunk):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        * runtime/GetPutInfo.h:
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::offsetOfGlobalLexicalEnvironment):
        (JSC::JSGlobalObject::offsetOfGlobalLexicalBindingEpoch):

2021-05-24  Robin Morisset  <rmorisset@apple.com>

        When running with --reportTotalPhaseTimes=1, we should also log the max time in a phase
        https://bugs.webkit.org/show_bug.cgi?id=226196

        Reviewed by Saam Barati.

        It is especially useful when looking at DFG phases, since the GC may have to wait for them to finish.

        * tools/CompilerTimingScope.cpp:

2021-05-24  Saam Barati  <sbarati@apple.com>

        Allow CTI stubs to be generated off the main thread
        https://bugs.webkit.org/show_bug.cgi?id=226180

        Reviewed by Mark Lam.

        We make this work by tracking if we're a compiler thread when generating
        the CTI stub. If so, it means that the main thread needs to issue a
        crossModifyingCodeFence when it's going to run the CTI stub for the first
        time.
        
        This patch also does away with pre-generating thunks. Thunks can now generate
        other thunks while they're running. To do this, we make JITThunks lock a
        recursive lock. The reason this is ok is that we don't have any recursive
        thunks in the thunk graph. It's a DAG.

        * dfg/DFGDriver.cpp:
        (JSC::DFG::compileImpl):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::op_check_traps_handlerGenerator):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiInternalFunctionCall):
        (JSC::JITThunks::ctiInternalFunctionConstruct):
        (JSC::JITThunks::ctiStubImpl):
        (JSC::JITThunks::ctiStub):
        (JSC::JITThunks::ctiSlowPathFunctionStub):
        (JSC::JITThunks::existingCTIStub): Deleted.
        (JSC::JITThunks::preinitializeCTIThunks): Deleted.
        * jit/JITThunks.h:
        * jit/SlowPathCall.cpp:
        (JSC::JITSlowPathCall::generateThunk):
        * jit/ThunkGenerators.cpp:
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        (JSC::checkExceptionGenerator):
        (JSC::virtualThunkFor):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        (JSC::VM::getCTIInternalFunctionTrampolineFor):
        * runtime/VM.h:

2021-05-24  Darin Adler  <darin@apple.com>

        Remove StringBuilder::appendLiteral
        https://bugs.webkit.org/show_bug.cgi?id=226137

        Reviewed by Chris Dumez.

        * API/tests/PingPongStackOverflowTest.cpp:
        (PingPongStackOverflowObject_hasInstance): Use append instead of appendLiteral.

        * bindings/ScriptFunctionCall.cpp:
        (Deprecated::ScriptCallArgumentHandler::appendArgument): Remove unnecessary cast
        from const char* to String, which defeats optimization and has no benefit.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ArrayPatternNode::toString const): Use append instead of appendLiteral.
        (JSC::RestParameterNode::toString const): Ditto.

        * heap/HeapSnapshotBuilder.cpp:
        (JSC::HeapSnapshotBuilder::json): Use append instead of appendLiteral.
        Removed unnecesary use of appendQuotedJSONString to append the result of
        snapshotTypeToString and edgeTypeToString, which return a const char* that
        never contains characters that require special quoting consideration, so
        can be appended efficiently with the normal append function.

        * inspector/agents/InspectorAuditAgent.cpp:
        (Inspector::InspectorAuditAgent::run): Use makeString instead of StringBuilder.

        * inspector/agents/InspectorConsoleAgent.cpp: Use auto for the result of makeString.

        * jsc.cpp: Use appned instead of appendLiteral.

        * parser/ParserArena.cpp:
        (JSC::IdentifierArena::makePrivateIdentifier): Use auto for the result of makeString.

        * runtime/ConsoleClient.cpp:
        (JSC::ConsoleClient::printConsoleMessage): Use append instead of appendLiteral.
        Also use variadic append when practical for better efficiency.
        (JSC::ConsoleClient::printConsoleMessageWithArguments): Ditto.
        * runtime/DateConversion.cpp:
        (JSC::formatDateTime): Ditto.

        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::sanitizedToString): Use makeString instead of StringBuilder.

        * runtime/ExceptionHelpers.cpp:
        (JSC::notAFunctionSourceAppender): Use append instead of appendLiteral.
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat): Ditto.
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat): Ditto.

        * runtime/JSCustomGetterFunction.cpp:
        (JSC::JSCustomGetterFunction::create): Use auto and cut down on reference count
        churn by using passing the StringImpl to makeString.
        * runtime/JSCustomSetterFunction.cpp:
        (JSC::JSCustomSetterFunction::create): Ditto.

        * runtime/JSGlobalObjectFunctions.cpp: Use more const and use variadic
        append for better efficiency.

        * runtime/JSONObject.cpp:
        (JSC::Stringifier::appendStringifiedValue): Use append instead of appendLiteral.
        (JSC::Stringifier::Holder::appendNextProperty): Ditto.

        * runtime/JSStringJoiner.h: Deleted unused appendLiteral function.
        Unrelated to StringBuilder::appendLiteral, but dead code.

        * runtime/Options.cpp:
        (JSC::Options::dumpOption): Use append instead of appendLiteral.
        * runtime/RegExpPrototype.cpp:
        (JSC::appendLineTerminatorEscape<UChar>): Ditto.

        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::reportTopFunctions): Use auto for the result of makeString.
        (JSC::SamplingProfiler::reportTopBytecodes): Ditto.

        * runtime/TypeProfiler.cpp:
        (JSC::TypeProfiler::typeInformationForExpressionAtOffset): Use append instead of
        appendLiteral.

        * runtime/TypeSet.cpp:
        (JSC::TypeSet::dumpTypes const): Use append instead of appendLiteral.
        (JSC::TypeSet::toJSONString const): Ditto.
        (JSC::StructureShape::propertyHash): Ditto.
        (JSC::StructureShape::toJSONString const): Ditto.

2021-05-24  Keith Miller  <keith_miller@apple.com>

        Unreviewed, revert r276610 because it causes a 1% PLT regression.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::JITData::size const): Deleted.
        * bytecode/CodeBlock.h:
        * jit/JITCodeMap.h:
        (JSC::JITCodeMap::memorySize const): Deleted.

2021-05-24  Chris Dumez  <cdumez@apple.com>

        Drop CheckedLock / CheckedCondition aliases
        https://bugs.webkit.org/show_bug.cgi?id=226176

        Reviewed by Kate Cheney.

        Drop CheckedLock / CheckedCondition aliases now that they are the default.

        * API/JSVirtualMachine.mm:
        * API/glib/JSCVirtualMachine.cpp:
        * assembler/PerfLog.h:
        * assembler/testmasm.cpp:
        * bytecode/StructureStubInfo.h:
        * bytecode/SuperSampler.cpp:
        * dfg/DFGCommon.cpp:
        * dfg/DFGCommonData.cpp:
        * dfg/DFGPlan.h:
        * dfg/DFGThreadData.h:
        * dfg/DFGWorklist.cpp:
        (JSC::DFG::Worklist::Worklist):
        * dfg/DFGWorklist.h:
        * disassembler/Disassembler.cpp:
        * dynbench.cpp:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::parallelNotEmptyBlockSource):
        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::bitvectorLock):
        * heap/CodeBlockSet.h:
        (JSC::CodeBlockSet::getLock):
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        * heap/Heap.h:
        * heap/IsoSubspacePerVM.h:
        * heap/MarkedSpace.h:
        (JSC::MarkedSpace::directoryLock):
        * heap/MarkingConstraintSolver.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::donateKnownParallel):
        * heap/SlotVisitor.h:
        * inspector/remote/socket/RemoteInspectorConnectionClient.h:
        * inspector/remote/socket/RemoteInspectorSocketEndpoint.h:
        * jit/ExecutableAllocator.cpp:
        (JSC::ExecutableAllocator::getLock const):
        (JSC::dumpJITMemory):
        * jit/ExecutableAllocator.h:
        (JSC::ExecutableAllocatorBase::getLock const):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::JITWorklist):
        * jit/JITWorklist.h:
        * jsc.cpp:
        * profiler/ProfilerDatabase.h:
        * runtime/ConcurrentJSLock.h:
        * runtime/DeferredWorkTimer.h:
        * runtime/JSLock.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::FrameWalker::FrameWalker):
        (JSC::CFrameWalker::CFrameWalker):
        (JSC::SamplingProfiler::takeSample):
        * runtime/SamplingProfiler.h:
        (JSC::SamplingProfiler::getLock):
        * runtime/VM.h:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::invalidateCodeBlocksOnStack):
        (JSC::VMTraps::VMTraps):
        * runtime/VMTraps.h:
        * tools/FunctionOverrides.h:
        * tools/VMInspector.cpp:
        (JSC::ensureIsSafeToLock):
        * tools/VMInspector.h:
        (JSC::VMInspector::getLock):
        * wasm/WasmCalleeRegistry.h:
        (JSC::Wasm::CalleeRegistry::getLock):
        * wasm/WasmPlan.h:
        * wasm/WasmStreamingCompiler.h:
        * wasm/WasmThunks.h:
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::Worklist):
        * wasm/WasmWorklist.h:

2021-05-23  Chris Dumez  <cdumez@apple.com>

        Make CheckedLock the default Lock
        https://bugs.webkit.org/show_bug.cgi?id=226157

        Reviewed by Darin Adler.

        Make CheckedLock the default Lock so that we get more benefits from Clang
        Thread Safety Analysis. Note that CheckedLock 100% relies on the existing
        Lock implementation and merely adds the clang anotations for thread 
        safety.

        That this patch does is:
        1. Rename the Lock class to UncheckedLock
        2. Rename the CheckedLock class to Lock
        3. Rename the Condition class to UncheckedCondition
        4. Rename the CheckedCondition class to Condition
        5. Update the types of certain variables from Lock / Condition to
           UncheckedLock / UncheckedCondition if I got a build failure. Build 
           failures are usually caused by the following facts:
           - Locker<CheckedLock> doesn't subclass AbstractLocker which a lot of
             JSC code passes as argument
           - Locker<CheckedLock> has no move constructor
           - Locker<CheckedLock> cannot be constructed from a lock pointer, only
             a reference

        For now, CheckedLock and CheckedCondition remain as aliases to Lock and 
        Condition, in their respective CheckedLock.h / CheckedCondition.h headers.
        I will drop them in a follow-up to reduce patch size.

        I will also follow-up to try and get rid of as much usage of UncheckedLock
        and UncheckedCondition as possible. I did not try very hard in this patch
        to reduce patch size. 

        * assembler/testmasm.cpp:
        * dfg/DFGCommon.cpp:
        * dfg/DFGThreadData.h:
        * dfg/DFGWorklist.cpp:
        (JSC::DFG::Worklist::Worklist):
        * dfg/DFGWorklist.h:
        * dynbench.cpp:
        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::bitvectorLock):
        * heap/CodeBlockSet.h:
        (JSC::CodeBlockSet::getLock):
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        * heap/Heap.h:
        * heap/MarkedSpace.h:
        (JSC::MarkedSpace::directoryLock):
        * heap/MarkingConstraintSolver.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::donateKnownParallel):
        * heap/SlotVisitor.h:
        * jit/ExecutableAllocator.cpp:
        (JSC::ExecutableAllocator::getLock const):
        (JSC::dumpJITMemory):
        * jit/ExecutableAllocator.h:
        (JSC::ExecutableAllocatorBase::getLock const):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::JITWorklist):
        * jit/JITWorklist.h:
        * jsc.cpp:
        * profiler/ProfilerDatabase.h:
        * runtime/ConcurrentJSLock.h:
        * runtime/DeferredWorkTimer.h:
        * runtime/JSLock.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::FrameWalker::FrameWalker):
        (JSC::CFrameWalker::CFrameWalker):
        (JSC::SamplingProfiler::takeSample):
        * runtime/SamplingProfiler.h:
        (JSC::SamplingProfiler::getLock):
        * runtime/VM.h:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::invalidateCodeBlocksOnStack):
        (JSC::VMTraps::VMTraps):
        * runtime/VMTraps.h:
        * tools/FunctionOverrides.h:
        * tools/VMInspector.cpp:
        (JSC::ensureIsSafeToLock):
        * tools/VMInspector.h:
        (JSC::VMInspector::getLock):
        * wasm/WasmCalleeRegistry.h:
        (JSC::Wasm::CalleeRegistry::getLock):
        * wasm/WasmPlan.h:
        * wasm/WasmStreamingCompiler.h:
        * wasm/WasmThunks.h:
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::Worklist):
        * wasm/WasmWorklist.h:

2021-05-23  Mark Lam  <mark.lam@apple.com>

        Remove some now invalid tests in testmasm.
        https://bugs.webkit.org/show_bug.cgi?id=226155

        Reviewed by Yusuke Suzuki.

        The ARM64E tests were checking that cageConditionallyAndUntag() would fail to
        produce a caged pointer if fed invalid values.  These tests are no longer feasible
        because on ARM64E, feeding cageConditionallyAndUntag() invalid values will now
        result in a crash.  This patch removes these tests.

        * assembler/testmasm.cpp:
        (JSC::testCagePreservesPACFailureBit):

2021-05-23  Mark Lam  <mark.lam@apple.com>

        Remove ENABLE(MASM_PROBE) flag.
        https://bugs.webkit.org/show_bug.cgi?id=226154

        Reviewed by Yusuke Suzuki.

        * assembler/MacroAssembler.cpp:
        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerARM64.cpp:
        * assembler/MacroAssemblerARMv7.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerMIPS.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerPrinter.cpp:
        * assembler/MacroAssemblerPrinter.h:
        * assembler/MacroAssemblerX86Common.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/ProbeContext.cpp:
        * assembler/ProbeContext.h:
        * assembler/ProbeFrame.h:
        * assembler/ProbeStack.cpp:
        * assembler/ProbeStack.h:
        * assembler/testmasm.cpp:
        (JSC::isSpecialGPR):
        (JSC::testClearBits64WithMask):
        (JSC::testClearBits64WithMaskTernary):
        (JSC::testShiftAndAdd):
        (JSC::testProbeModifiesStackValues):
        (JSC::run):
        * b3/B3LowerToAir.cpp:
        * b3/air/AirPrintSpecial.cpp:
        * b3/air/AirPrintSpecial.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION_WITH_ATTRIBUTES):

2021-05-23  Chris Dumez  <cdumez@apple.com>

        Use CheckedLock in even more places
        https://bugs.webkit.org/show_bug.cgi?id=226152

        Reviewed by Darin Adler.

        Use CheckedLock in even more places to benefit from Clang Thread Safety Analysis.

        * API/JSVirtualMachine.mm:
        (WTF_REQUIRES_LOCK):
        * API/glib/JSCVirtualMachine.cpp:
        * bytecode/StructureStubInfo.h:
        * bytecode/SuperSampler.cpp:
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::invalidate):
        (JSC::DFG::CommonData::~CommonData):
        (JSC::DFG::CommonData::installVMTrapBreakpoints):
        (JSC::DFG::codeBlockForVMTrapPC):
        * dfg/DFGPlan.h:
        (JSC::DFG::Plan::WTF_GUARDED_BY_LOCK):
        * disassembler/Disassembler.cpp:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::parallelNotEmptyBlockSource):
        * heap/Heap.h:
        * heap/IsoSubspacePerVM.h:
        * inspector/remote/socket/RemoteInspectorConnectionClient.h:

2021-05-23  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed. Fix JSC Debug tests for r277926. 

        * jit/JITThunks.cpp:
        (JSC::JITThunks::preinitializeCTIThunks):
        Address oversight, made visible by the assertion added in r277850.

2021-05-23  Chris Dumez  <cdumez@apple.com>

        Drop WTF::tryHoldLock() as it is incompatible with Clang Thread Safety Analysis
        https://bugs.webkit.org/show_bug.cgi?id=226145

        Reviewed by Darin Adler.

        Drop WTF::tryHoldLock() as it is incompatible with Clang Thread Safety Analysis.
        Instead, use the following pattern which is supported:
        ```
        if (lock.tryLock()) {
            Locker locker { AdoptLock, lock };
            // ...
        }
        ```

        * heap/Heap.cpp:
        (JSC::Heap::resumeThePeriphery):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::tryInstallTrapBreakpoints):

2021-05-22  Mark Lam  <mark.lam@apple.com>

        Use singleton thunks for virtual calls.
        https://bugs.webkit.org/show_bug.cgi?id=226149
        rdar://problem/78357604

        Reviewed by Yusuke Suzuki.

        Change virtualThunkFor() to return 1 of 6 possible singleton thunks.
        These thunks are cached via vm.jitStubs->ctiStubs().

        This change saves us ~16M of executable JIT memory (for the unique thunks) on a
        single run of Speedometer2.  On an M1 Mac, switching to singleton thunks here also
        appears to be a 1.012x speed up on Speedometer2.  Performance is neutral on
        JetStream2.

        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiInternalFunctionCall):
        (JSC::JITThunks::ctiInternalFunctionConstruct):
        * jit/JITThunks.h:
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::virtualThunkForRegularCall):
        (JSC::virtualThunkForRegularConstruct):
        (JSC::virtualThunkForTailCall):
        (JSC::virtualThunkForTailConstruct):
        (JSC::virtualThunkForConstructCall):
        (JSC::virtualThunkForConstructConstruct):
        * runtime/VM.cpp:
        (JSC::VM::getCTIInternalFunctionTrampolineFor):
        * runtime/VM.h:

2021-05-22  Mark Lam  <mark.lam@apple.com>

        Enhance Link Buffer stats to have more fine grain profiles, and to collect count information.
        https://bugs.webkit.org/show_bug.cgi?id=226151
        rdar://problem/78359436

        Reviewed by Yusuke Suzuki.

        And also add a total of the sizes.
        Also added $vm.clearLinkBufferStats() which resets all the stats to 0.

        Here's an example of that the new stats look like:

            Cummulative LinkBuffer profile sizes:
                       BaselineJIT: 61092032 (58.261902 MB) count 11621 avg size 5257
                               DFG: 35387904 (33.748535 MB) count 11143 avg size 3175
                       InlineCache: 19639155 (18.729358 MB) count 283890 avg size 69
                      VirtualThunk: 14256800 (13.596344 MB) count 43900 avg size 324
                        DFGOSRExit: 7636736 (7.282959 MB) count 5235 avg size 1458
                               FTL: 4927616 (4.699341 MB) count 5269 avg size 935
                              Wasm: 2134688 (2.035797 MB) count 847 avg size 2520
                           YarrJIT: 1320928 (1.259735 MB) count 2075 avg size 636
                        FTLOSRExit: 1084096 (1.033875 MB) count 417 avg size 2599
                         WasmThunk: 41408 (40.437500 KB) count 252 avg size 164
                          FTLThunk: 25088 (24.500000 KB) count 426 avg size 58
                     ExtraCTIThunk: 5984 (5.843750 KB) count 95 avg size 62
                  SpecializedThunk: 3456 (3.375000 KB) count 19 avg size 181
                             Thunk: 1760 (1.718750 KB) count 10 avg size 176
                BoundFunctionThunk: 864 count 3 avg size 288
                        LLIntThunk: 608 count 18 avg size 33
                          DFGThunk: 608 count 1 avg size 608
                       DFGOSREntry: 160 count 1 avg size 160
                        JumpIsland: 0
                            CSSJIT: 0
                     Uncategorized: 0
                             Total: 147559891 (140.724078 MB)

        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::performFinalization):
        (JSC::LinkBuffer::clearProfileStatistics):
        (JSC::LinkBuffer::dumpProfileStatistics):
        * assembler/LinkBuffer.h:
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/ExecutableAllocator.cpp:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::op_throw_handlerGenerator):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::op_check_traps_handlerGenerator):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        * jit/SlowPathCall.cpp:
        (JSC::JITSlowPathCall::generateThunk):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        * jit/ThunkGenerators.cpp:
        (JSC::handleExceptionGenerator):
        (JSC::handleExceptionWithCallFrameRollbackGenerator):
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        (JSC::checkExceptionGenerator):
        (JSC::virtualThunkFor):
        (JSC::boundFunctionCallGenerator):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        (JSC::LLInt::generateThunkWithJumpToPrologue):
        (JSC::LLInt::generateThunkWithJumpToLLIntReturnPoint):
        (JSC::LLInt::getHostCallReturnValueThunk):
        (JSC::LLInt::createJSGateThunk):
        (JSC::LLInt::createWasmGateThunk):
        (JSC::LLInt::createTailCallGate):
        (JSC::LLInt::loopOSREntryGateThunk):
        (JSC::LLInt::entryOSREntryGateThunk):
        (JSC::LLInt::wasmOSREntryGateThunk):
        (JSC::LLInt::exceptionHandlerGateThunk):
        (JSC::LLInt::returnFromLLIntGateThunk):
        (JSC::LLInt::tagGateThunk):
        (JSC::LLInt::untagGateThunk):
        (JSC::LLInt::jitCagePtrThunk):
        * tools/JSDollarVM.cpp:
        (JSC::JSDollarVM::finishCreation):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGEntryTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):

2021-05-22  Ross Kirsling  <ross.kirsling@sony.com>

        Support Ergonomic Brand Checks proposal (`#x in obj`)
        https://bugs.webkit.org/show_bug.cgi?id=221093

        Reviewed by Caio Araujo Neponoceno de Lima.

        This patch implements the following Stage 3 proposal (behind a runtime option):
        https://github.com/tc39/proposal-private-fields-in-in

        Specifically, it extends the `in` keyword to allow the LHS to be a private name,
        thereby allowing users to implement Array.isArray-esque brand checks for their own classes
        *without* having to wrap a private member get in a try-catch.

        For example:
        ```
        class C {
            #x;
            static isC(obj) { return #x in obj; }
        }
        ```

        This is done by adding two new bytecode ops, HasPrivateName and HasPrivateBrand. For the moment,
        these are implemented without fast paths, as we should do so for InByVal first and then have these follow suit.

        * bytecode/BytecodeList.rb:
        * bytecode/BytecodeUseDef.cpp:
        (JSC::computeUsesForBytecodeIndexImpl):
        (JSC::computeDefsForBytecodeIndexImpl):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitHasPrivateName):
        (JSC::BytecodeGenerator::emitHasPrivateBrand):
        (JSC::BytecodeGenerator::emitCheckPrivateBrand):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::InNode::emitBytecode):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileHasPrivateName):
        (JSC::DFG::SpeculativeJIT::compileHasPrivateBrand):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileHasPrivateName):
        (JSC::FTL::DFG::LowerDFGToB3::compileHasPrivateBrand):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * llint/LowLevelInterpreter.asm:
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createPrivateIdentifierNode):
        * parser/NodeConstructors.h:
        (JSC::PrivateIdentifierNode::PrivateIdentifierNode):
        * parser/Nodes.h:
        (JSC::ExpressionNode::isPrivateIdentifier const):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseBinaryExpression):
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createPrivateIdentifierNode):
        * parser/VariableEnvironment.h:
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/CommonSlowPaths.h:
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::hasPrivateField):
        (JSC::JSObject::hasPrivateBrand):
        (JSC::JSObject::checkPrivateBrand):
        * runtime/OptionsList.h:

2021-05-22  Chris Dumez  <cdumez@apple.com>

        Replace LockHolder with Locker in local variables
        https://bugs.webkit.org/show_bug.cgi?id=226133

        Reviewed by Darin Adler.

        Replace LockHolder with Locker in local variables. It is shorter and it allows switching the lock
        type more easily since the compiler with deduce the lock type T for Locker<T>.

        * API/JSCallbackObject.h:
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
        * API/JSValue.mm:
        (handerForStructTag):
        * API/tests/testapi.cpp:
        (testCAPIViaCpp):
        * assembler/testmasm.cpp:
        (JSC::run):
        * b3/air/testair.cpp:
        * b3/testb3_1.cpp:
        (run):
        * bytecode/DirectEvalCodeCache.cpp:
        (JSC::DirectEvalCodeCache::setSlow):
        (JSC::DirectEvalCodeCache::clear):
        (JSC::DirectEvalCodeCache::visitAggregateImpl):
        * bytecode/SuperSampler.cpp:
        (JSC::initializeSuperSampler):
        (JSC::resetSuperSamplerState):
        (JSC::printSuperSamplerState):
        (JSC::enableSuperSampler):
        (JSC::disableSuperSampler):
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::invalidate):
        (JSC::DFG::CommonData::~CommonData):
        (JSC::DFG::CommonData::installVMTrapBreakpoints):
        (JSC::DFG::codeBlockForVMTrapPC):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
        * dfg/DFGWorklist.cpp:
        (JSC::DFG::Worklist::~Worklist):
        (JSC::DFG::Worklist::finishCreation):
        (JSC::DFG::Worklist::isActiveForVM const):
        (JSC::DFG::Worklist::enqueue):
        (JSC::DFG::Worklist::compilationState):
        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
        (JSC::DFG::Worklist::visitWeakReferences):
        (JSC::DFG::Worklist::removeDeadPlans):
        (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
        (JSC::DFG::Worklist::queueLength):
        (JSC::DFG::Worklist::dump const):
        (JSC::DFG::Worklist::setNumberOfThreads):
        * dfg/DFGWorklistInlines.h:
        (JSC::DFG::Worklist::iterateCodeBlocksForGC):
        * disassembler/Disassembler.cpp:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::addBlock):
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterateCurrentlyExecuting):
        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::add):
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::collectAsync):
        (JSC::Heap::runBeginPhase):
        (JSC::Heap::waitForCollector):
        (JSC::Heap::requestCollection):
        (JSC::Heap::notifyIsSafeToCollect):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::didReachTermination):
        * inspector/agents/InspectorScriptProfilerAgent.cpp:
        (Inspector::InspectorScriptProfilerAgent::startTracking):
        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
        (Inspector::InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting):
        * inspector/remote/RemoteConnectionToTarget.cpp:
        (Inspector::RemoteConnectionToTarget::setup):
        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
        (Inspector::RemoteConnectionToTarget::close):
        (Inspector::RemoteConnectionToTarget::targetClosed):
        * inspector/remote/RemoteInspector.cpp:
        (Inspector::RemoteInspector::registerTarget):
        (Inspector::RemoteInspector::unregisterTarget):
        (Inspector::RemoteInspector::updateTarget):
        (Inspector::RemoteInspector::updateClientCapabilities):
        (Inspector::RemoteInspector::setClient):
        (Inspector::RemoteInspector::setupFailed):
        (Inspector::RemoteInspector::setupCompleted):
        (Inspector::RemoteInspector::stop):
        * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
        (Inspector::RemoteTargetHandleRunSourceGlobal):
        (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
        (Inspector::RemoteTargetHandleRunSourceWithInfo):
        (Inspector::RemoteConnectionToTarget::setup):
        (Inspector::RemoteConnectionToTarget::targetClosed):
        (Inspector::RemoteConnectionToTarget::close):
        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
        (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
        (Inspector::RemoteInspector::sendMessageToRemote):
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
        (Inspector::RemoteInspector::setParentProcessInformation):
        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
        (Inspector::RemoteInspector::xpcConnectionFailed):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::receivedIndicateMessage):
        (Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
        * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:
        (Inspector::RemoteInspectorXPCConnection::close):
        (Inspector::RemoteInspectorXPCConnection::closeFromMessage):
        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
        (Inspector::RemoteInspectorXPCConnection::handleEvent):
        * inspector/remote/glib/RemoteInspectorGlib.cpp:
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::setupConnection):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::sendMessageToRemote):
        (Inspector::RemoteInspector::receivedGetTargetListMessage):
        (Inspector::RemoteInspector::receivedDataMessage):
        (Inspector::RemoteInspector::receivedCloseMessage):
        (Inspector::RemoteInspector::setup):
        * inspector/remote/socket/RemoteInspectorConnectionClient.cpp:
        (Inspector::RemoteInspectorConnectionClient::didReceive):
        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::didClose):
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::setup):
        (Inspector::RemoteInspector::setupInspectorClient):
        (Inspector::RemoteInspector::frontendDidClose):
        (Inspector::RemoteInspector::sendMessageToBackend):
        (Inspector::RemoteInspector::startAutomationSession):
        * inspector/remote/socket/RemoteInspectorSocketEndpoint.cpp:
        (Inspector::RemoteInspectorSocketEndpoint::listenInet):
        (Inspector::RemoteInspectorSocketEndpoint::isListening):
        (Inspector::RemoteInspectorSocketEndpoint::workerThread):
        (Inspector::RemoteInspectorSocketEndpoint::createClient):
        (Inspector::RemoteInspectorSocketEndpoint::disconnect):
        (Inspector::RemoteInspectorSocketEndpoint::invalidateClient):
        (Inspector::RemoteInspectorSocketEndpoint::invalidateListener):
        (Inspector::RemoteInspectorSocketEndpoint::getPort const):
        (Inspector::RemoteInspectorSocketEndpoint::recvIfEnabled):
        (Inspector::RemoteInspectorSocketEndpoint::sendIfEnabled):
        (Inspector::RemoteInspectorSocketEndpoint::send):
        (Inspector::RemoteInspectorSocketEndpoint::acceptInetSocketIfEnabled):
        * interpreter/CLoopStack.cpp:
        (JSC::CLoopStack::addToCommittedByteCount):
        (JSC::CLoopStack::committedByteCount):
        * jit/ExecutableAllocator.cpp:
        (JSC::dumpJITMemory):
        * jit/ICStats.cpp:
        (JSC::ICStats::ICStats):
        (JSC::ICStats::~ICStats):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiStub):
        (JSC::JITThunks::existingCTIStub):
        (JSC::JITThunks::ctiSlowPathFunctionStub):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::Plan::compileInThread):
        (JSC::JITWorklist::Plan::isFinishedCompiling):
        (JSC::JITWorklist::JITWorklist):
        (JSC::JITWorklist::completeAllForVM):
        (JSC::JITWorklist::poll):
        (JSC::JITWorklist::compileLater):
        (JSC::JITWorklist::finalizePlans):
        * parser/SourceProvider.cpp:
        (JSC::SourceProvider::getID):
        * profiler/ProfilerDatabase.cpp:
        (JSC::Profiler::Database::ensureBytecodesFor):
        (JSC::Profiler::Database::notifyDestruction):
        (JSC::Profiler::Database::addCompilation):
        (JSC::Profiler::Database::logEvent):
        (JSC::Profiler::Database::addDatabaseToAtExit):
        (JSC::Profiler::Database::removeDatabaseFromAtExit):
        (JSC::Profiler::Database::removeFirstAtExitDatabase):
        * profiler/ProfilerUID.cpp:
        (JSC::Profiler::UID::create):
        * runtime/DeferredWorkTimer.cpp:
        (JSC::DeferredWorkTimer::scheduleWorkSoon):
        (JSC::DeferredWorkTimer::didResumeScriptExecutionOwner):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::timerLoop):
        (JSC::SamplingProfiler::shutdown):
        (JSC::SamplingProfiler::start):
        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
        (JSC::SamplingProfiler::noticeJSLockAcquisition):
        (JSC::SamplingProfiler::noticeVMEntry):
        (JSC::SamplingProfiler::registerForReportAtExit):
        * runtime/Watchdog.cpp:
        (JSC::Watchdog::startTimer):
        (JSC::Watchdog::willDestroyVM):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::isValidExecutableMemory):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        * wasm/WasmEntryPlan.cpp:
        (JSC::Wasm::EntryPlan::ThreadCountHolder::ThreadCountHolder):
        (JSC::Wasm::EntryPlan::ThreadCountHolder::~ThreadCountHolder):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::addCompletionTask):
        (JSC::Wasm::Plan::waitForCompletion):
        (JSC::Wasm::Plan::tryRemoveContextAndCancelIfLast):
        * wasm/WasmSignature.cpp:
        (JSC::Wasm::SignatureInformation::signatureFor):
        (JSC::Wasm::SignatureInformation::tryCleanup):
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::enqueue):
        (JSC::Wasm::Worklist::completePlanSynchronously):
        (JSC::Wasm::Worklist::stopAllPlansForContext):
        (JSC::Wasm::Worklist::Worklist):
        (JSC::Wasm::Worklist::~Worklist):

2021-05-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r277913.
        https://bugs.webkit.org/show_bug.cgi?id=226140

        Caused multiple layout-test crash on mac debug queues

        Reverted changeset:

        "Replace LockHolder with Locker in local variables"
        https://bugs.webkit.org/show_bug.cgi?id=226133
        https://trac.webkit.org/changeset/277913

2021-05-21  Chris Dumez  <cdumez@apple.com>

        Remove WTF::holdLock() / WTF::holdLockIf()
        https://bugs.webkit.org/show_bug.cgi?id=226135

        Reviewed by Darin Adler.

        Remove WTF::holdLock() / WTF::holdLockIf() because they are not compatible with
        Clang Thread Safety Analysis. All call sites have been converted to use the Locker
        constructor directly.

        * heap/LockDuringMarking.h:
        (JSC::lockDuringMarking):

2021-05-21  Chris Dumez  <cdumez@apple.com>

        Replace LockHolder with Locker in local variables
        https://bugs.webkit.org/show_bug.cgi?id=226133

        Reviewed by Darin Adler.

        Replace LockHolder with Locker in local variables. It is shorter and it allows switching the lock
        type more easily since the compiler with deduce the lock type T for Locker<T>.

        * API/JSCallbackObject.h:
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
        * API/JSValue.mm:
        (handerForStructTag):
        * API/tests/testapi.cpp:
        (testCAPIViaCpp):
        * assembler/testmasm.cpp:
        (JSC::run):
        * b3/air/testair.cpp:
        * b3/testb3_1.cpp:
        (run):
        * bytecode/DirectEvalCodeCache.cpp:
        (JSC::DirectEvalCodeCache::setSlow):
        (JSC::DirectEvalCodeCache::clear):
        (JSC::DirectEvalCodeCache::visitAggregateImpl):
        * bytecode/SuperSampler.cpp:
        (JSC::initializeSuperSampler):
        (JSC::resetSuperSamplerState):
        (JSC::printSuperSamplerState):
        (JSC::enableSuperSampler):
        (JSC::disableSuperSampler):
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::invalidate):
        (JSC::DFG::CommonData::~CommonData):
        (JSC::DFG::CommonData::installVMTrapBreakpoints):
        (JSC::DFG::codeBlockForVMTrapPC):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
        * dfg/DFGWorklist.cpp:
        (JSC::DFG::Worklist::~Worklist):
        (JSC::DFG::Worklist::finishCreation):
        (JSC::DFG::Worklist::isActiveForVM const):
        (JSC::DFG::Worklist::enqueue):
        (JSC::DFG::Worklist::compilationState):
        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
        (JSC::DFG::Worklist::visitWeakReferences):
        (JSC::DFG::Worklist::removeDeadPlans):
        (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
        (JSC::DFG::Worklist::queueLength):
        (JSC::DFG::Worklist::dump const):
        (JSC::DFG::Worklist::setNumberOfThreads):
        * dfg/DFGWorklistInlines.h:
        (JSC::DFG::Worklist::iterateCodeBlocksForGC):
        * disassembler/Disassembler.cpp:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::addBlock):
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterateCurrentlyExecuting):
        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::add):
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::collectAsync):
        (JSC::Heap::runBeginPhase):
        (JSC::Heap::waitForCollector):
        (JSC::Heap::requestCollection):
        (JSC::Heap::notifyIsSafeToCollect):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::didReachTermination):
        * inspector/agents/InspectorScriptProfilerAgent.cpp:
        (Inspector::InspectorScriptProfilerAgent::startTracking):
        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
        (Inspector::InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting):
        * inspector/remote/RemoteConnectionToTarget.cpp:
        (Inspector::RemoteConnectionToTarget::setup):
        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
        (Inspector::RemoteConnectionToTarget::close):
        (Inspector::RemoteConnectionToTarget::targetClosed):
        * inspector/remote/RemoteInspector.cpp:
        (Inspector::RemoteInspector::registerTarget):
        (Inspector::RemoteInspector::unregisterTarget):
        (Inspector::RemoteInspector::updateTarget):
        (Inspector::RemoteInspector::updateClientCapabilities):
        (Inspector::RemoteInspector::setClient):
        (Inspector::RemoteInspector::setupFailed):
        (Inspector::RemoteInspector::setupCompleted):
        (Inspector::RemoteInspector::stop):
        * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
        (Inspector::RemoteTargetHandleRunSourceGlobal):
        (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
        (Inspector::RemoteTargetHandleRunSourceWithInfo):
        (Inspector::RemoteConnectionToTarget::setup):
        (Inspector::RemoteConnectionToTarget::targetClosed):
        (Inspector::RemoteConnectionToTarget::close):
        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
        (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
        (Inspector::RemoteInspector::sendMessageToRemote):
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
        (Inspector::RemoteInspector::setParentProcessInformation):
        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
        (Inspector::RemoteInspector::xpcConnectionFailed):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::receivedIndicateMessage):
        (Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
        * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:
        (Inspector::RemoteInspectorXPCConnection::close):
        (Inspector::RemoteInspectorXPCConnection::closeFromMessage):
        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
        (Inspector::RemoteInspectorXPCConnection::handleEvent):
        * inspector/remote/glib/RemoteInspectorGlib.cpp:
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::setupConnection):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::sendMessageToRemote):
        (Inspector::RemoteInspector::receivedGetTargetListMessage):
        (Inspector::RemoteInspector::receivedDataMessage):
        (Inspector::RemoteInspector::receivedCloseMessage):
        (Inspector::RemoteInspector::setup):
        * inspector/remote/socket/RemoteInspectorConnectionClient.cpp:
        (Inspector::RemoteInspectorConnectionClient::didReceive):
        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::didClose):
        (Inspector::RemoteInspector::start):
        (Inspector::RemoteInspector::pushListingsSoon):
        (Inspector::RemoteInspector::setup):
        (Inspector::RemoteInspector::setupInspectorClient):
        (Inspector::RemoteInspector::frontendDidClose):
        (Inspector::RemoteInspector::sendMessageToBackend):
        (Inspector::RemoteInspector::startAutomationSession):
        * inspector/remote/socket/RemoteInspectorSocketEndpoint.cpp:
        (Inspector::RemoteInspectorSocketEndpoint::listenInet):
        (Inspector::RemoteInspectorSocketEndpoint::isListening):
        (Inspector::RemoteInspectorSocketEndpoint::workerThread):
        (Inspector::RemoteInspectorSocketEndpoint::createClient):
        (Inspector::RemoteInspectorSocketEndpoint::disconnect):
        (Inspector::RemoteInspectorSocketEndpoint::invalidateClient):
        (Inspector::RemoteInspectorSocketEndpoint::invalidateListener):
        (Inspector::RemoteInspectorSocketEndpoint::getPort const):
        (Inspector::RemoteInspectorSocketEndpoint::recvIfEnabled):
        (Inspector::RemoteInspectorSocketEndpoint::sendIfEnabled):
        (Inspector::RemoteInspectorSocketEndpoint::send):
        (Inspector::RemoteInspectorSocketEndpoint::acceptInetSocketIfEnabled):
        * interpreter/CLoopStack.cpp:
        (JSC::CLoopStack::addToCommittedByteCount):
        (JSC::CLoopStack::committedByteCount):
        * jit/ExecutableAllocator.cpp:
        (JSC::dumpJITMemory):
        * jit/ICStats.cpp:
        (JSC::ICStats::ICStats):
        (JSC::ICStats::~ICStats):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiStub):
        (JSC::JITThunks::existingCTIStub):
        (JSC::JITThunks::ctiSlowPathFunctionStub):
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::Plan::compileInThread):
        (JSC::JITWorklist::Plan::isFinishedCompiling):
        (JSC::JITWorklist::JITWorklist):
        (JSC::JITWorklist::completeAllForVM):
        (JSC::JITWorklist::poll):
        (JSC::JITWorklist::compileLater):
        (JSC::JITWorklist::finalizePlans):
        * parser/SourceProvider.cpp:
        (JSC::SourceProvider::getID):
        * profiler/ProfilerDatabase.cpp:
        (JSC::Profiler::Database::ensureBytecodesFor):
        (JSC::Profiler::Database::notifyDestruction):
        (JSC::Profiler::Database::addCompilation):
        (JSC::Profiler::Database::logEvent):
        (JSC::Profiler::Database::addDatabaseToAtExit):
        (JSC::Profiler::Database::removeDatabaseFromAtExit):
        (JSC::Profiler::Database::removeFirstAtExitDatabase):
        * profiler/ProfilerUID.cpp:
        (JSC::Profiler::UID::create):
        * runtime/DeferredWorkTimer.cpp:
        (JSC::DeferredWorkTimer::scheduleWorkSoon):
        (JSC::DeferredWorkTimer::didResumeScriptExecutionOwner):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::timerLoop):
        (JSC::SamplingProfiler::shutdown):
        (JSC::SamplingProfiler::start):
        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
        (JSC::SamplingProfiler::noticeJSLockAcquisition):
        (JSC::SamplingProfiler::noticeVMEntry):
        (JSC::SamplingProfiler::registerForReportAtExit):
        * runtime/Watchdog.cpp:
        (JSC::Watchdog::startTimer):
        (JSC::Watchdog::willDestroyVM):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::isValidExecutableMemory):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        * wasm/WasmEntryPlan.cpp:
        (JSC::Wasm::EntryPlan::ThreadCountHolder::ThreadCountHolder):
        (JSC::Wasm::EntryPlan::ThreadCountHolder::~ThreadCountHolder):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmPlan.cpp:
        (JSC::Wasm::Plan::addCompletionTask):
        (JSC::Wasm::Plan::waitForCompletion):
        (JSC::Wasm::Plan::tryRemoveContextAndCancelIfLast):
        * wasm/WasmSignature.cpp:
        (JSC::Wasm::SignatureInformation::signatureFor):
        (JSC::Wasm::SignatureInformation::tryCleanup):
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::enqueue):
        (JSC::Wasm::Worklist::completePlanSynchronously):
        (JSC::Wasm::Worklist::stopAllPlansForContext):
        (JSC::Wasm::Worklist::Worklist):
        (JSC::Wasm::Worklist::~Worklist):

2021-05-21  Chris Dumez  <cdumez@apple.com>

        Stop using holdLock() in JSC as it is not compatible with Clang thread safety analysis
        https://bugs.webkit.org/show_bug.cgi?id=226116

        Reviewed by Mark Lam.

        Stop using holdLock() in JSC as it is not compatible with Clang thread safety analysis
        (WTF::CheckedLock). Use the Locker constructor instead.

        I'll eventually get rid of the holdLock() definition once I have managed to get rid of
        all its usages.

        * API/JSVirtualMachine.mm:
        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
        (-[JSVirtualMachine addExternalRememberedObject:]):
        (-[JSVirtualMachine addManagedReference:withOwner:]):
        (-[JSVirtualMachine removeManagedReference:withOwner:]):
        (scanExternalObjectGraph):
        (scanExternalRememberedSet):
        * API/glib/JSCVirtualMachine.cpp:
        (addWrapper):
        (removeWrapper):
        * API/tests/ExecutionTimeLimitTest.cpp:
        (testExecutionTimeLimit):
        * assembler/PerfLog.cpp:
        (JSC::PerfLog::PerfLog):
        (JSC::PerfLog::log):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::visitAggregateImpl):
        (JSC::StructureStubInfo::visitWeakReferences):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::considerCaching):
        (JSC::StructureStubInfo::clearBufferedStructures):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        (JSC::UnlinkedCodeBlock::visitChildrenImpl):
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::~BlockDirectory):
        (JSC::BlockDirectory::removeBlock):
        (JSC::BlockDirectory::stopAllocatingForGood):
        (JSC::BlockDirectory::parallelNotEmptyBlockSource):
        * heap/CodeBlockSet.cpp:
        (JSC::CodeBlockSet::add):
        (JSC::CodeBlockSet::remove):
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterate):
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::allocatorForSlow):
        * heap/Heap.cpp:
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::runNotRunningPhase):
        (JSC::Heap::runEndPhase):
        (JSC::Heap::finishRelinquishingConn):
        (JSC::visitSamplingProfiler):
        (JSC::Heap::setBonusVisitorTask):
        (JSC::Heap::runTaskInParallel):
        * heap/HeapSnapshotBuilder.cpp:
        (JSC::HeapSnapshotBuilder::buildSnapshot):
        (JSC::HeapSnapshotBuilder::analyzeNode):
        (JSC::HeapSnapshotBuilder::analyzeEdge):
        (JSC::HeapSnapshotBuilder::analyzePropertyNameEdge):
        (JSC::HeapSnapshotBuilder::analyzeVariableNameEdge):
        (JSC::HeapSnapshotBuilder::analyzeIndexEdge):
        (JSC::HeapSnapshotBuilder::setOpaqueRootReachabilityReasonForCell):
        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):
        * heap/IsoCellSet.cpp:
        (JSC::IsoCellSet::parallelNotEmptyMarkedBlockSource):
        (JSC::IsoCellSet::addSlow):
        (JSC::IsoCellSet::didRemoveBlock):
        (JSC::IsoCellSet::sweepToFreeList):
        * heap/IsoCellSetInlines.h:
        (JSC::IsoCellSet::forEachMarkedCellInParallel):
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        * heap/IsoSubspacePerVM.cpp:
        (JSC::IsoSubspacePerVM::forVM):
        * heap/LocalAllocator.cpp:
        (JSC::LocalAllocator::LocalAllocator):
        (JSC::LocalAllocator::~LocalAllocator):
        * heap/MachineStackMarker.cpp:
        (JSC::MachineThreads::tryCopyOtherThreadStacks):
        (JSC::MachineThreads::gatherConservativeRoots):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::stopAllocating):
        (JSC::MarkedBlock::Handle::resumeAllocating):
        (JSC::MarkedBlock::aboutToMarkSlow):
        (JSC::MarkedBlock::Handle::didConsumeFreeList):
        (JSC::MarkedBlock::noteMarkedSlow):
        (JSC::MarkedBlock::Handle::dumpState):
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::Handle::isLive):
        * heap/MarkingConstraint.cpp:
        (JSC::MarkingConstraint::doParallelWork):
        * heap/MarkingConstraintSolver.cpp:
        (JSC::MarkingConstraintSolver::addParallelTask):
        (JSC::MarkingConstraintSolver::runExecutionThread):
        * heap/ParallelSourceAdapter.h:
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::updateMutatorIsStopped):
        (JSC::SlotVisitor::drain):
        (JSC::SlotVisitor::performIncrementOfDraining):
        (JSC::SlotVisitor::drainFromShared):
        (JSC::SlotVisitor::drainInParallelPassively):
        (JSC::SlotVisitor::waitForTermination):
        (JSC::SlotVisitor::donateAll):
        (JSC::SlotVisitor::didRace):
        * heap/Subspace.cpp:
        (JSC::Subspace::parallelDirectorySource):
        * heap/SubspaceInlines.h:
        (JSC::Subspace::forEachMarkedCellInParallel):
        * inspector/JSInjectedScriptHost.cpp:
        * jit/ExecutableAllocator.cpp:
        * jsc.cpp:
        (Worker::Worker):
        (Worker::~Worker):
        (Worker::dequeue):
        (Workers::broadcast):
        (Workers::report):
        (Workers::tryGetReport):
        (Workers::getReport):
        (JSC_DEFINE_HOST_FUNCTION):
        * runtime/DeferredWorkTimer.cpp:
        (JSC::DeferredWorkTimer::doWork):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::finishCreation):
        * runtime/EvalExecutable.cpp:
        (JSC::EvalExecutable::visitChildrenImpl):
        * runtime/FileBasedFuzzerAgentBase.cpp:
        (JSC::FileBasedFuzzerAgentBase::getPrediction):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::visitChildrenImpl):
        * runtime/JSArray.cpp:
        (JSC::JSArray::shiftCountWithArrayStorage):
        (JSC::JSArray::unshiftCountWithArrayStorage):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::detach):
        (JSC::JSArrayBufferView::slowDownAndWasteMemory):
        * runtime/JSCell.h:
        * runtime/JSFinalizationRegistry.cpp:
        (JSC::JSFinalizationRegistry::visitChildrenImpl):
        (JSC::JSFinalizationRegistry::finalizeUnconditionally):
        (JSC::JSFinalizationRegistry::takeDeadHoldingsValue):
        (JSC::JSFinalizationRegistry::registerTarget):
        (JSC::JSFinalizationRegistry::unregister):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildrenImpl):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSModuleNamespaceObject.cpp:
        (JSC::JSModuleNamespaceObject::finishCreation):
        (JSC::JSModuleNamespaceObject::visitChildrenImpl):
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        * runtime/JSRunLoopTimer.cpp:
        (JSC::JSRunLoopTimer::Manager::timerDidFire):
        (JSC::JSRunLoopTimer::Manager::registerVM):
        (JSC::JSRunLoopTimer::Manager::unregisterVM):
        (JSC::JSRunLoopTimer::Manager::scheduleTimer):
        (JSC::JSRunLoopTimer::Manager::cancelTimer):
        (JSC::JSRunLoopTimer::Manager::timeUntilFire):
        (JSC::JSRunLoopTimer::timerDidFire):
        (JSC::JSRunLoopTimer::setTimeUntilFire):
        (JSC::JSRunLoopTimer::cancelTimer):
        (JSC::JSRunLoopTimer::addTimerSetNotification):
        (JSC::JSRunLoopTimer::removeTimerSetNotification):
        * runtime/JSSegmentedVariableObject.cpp:
        (JSC::JSSegmentedVariableObject::findVariableIndex):
        (JSC::JSSegmentedVariableObject::addVariables):
        (JSC::JSSegmentedVariableObject::visitChildrenImpl):
        * runtime/ModuleProgramExecutable.cpp:
        (JSC::ModuleProgramExecutable::visitChildrenImpl):
        * runtime/NarrowingNumberPredictionFuzzerAgent.cpp:
        (JSC::NarrowingNumberPredictionFuzzerAgent::getPrediction):
        * runtime/ProgramExecutable.cpp:
        (JSC::ProgramExecutable::visitChildrenImpl):
        * runtime/RandomizingFuzzerAgent.cpp:
        (JSC::RandomizingFuzzerAgent::getPrediction):
        * runtime/RegExp.cpp:
        (JSC::RegExp::compile):
        (JSC::RegExp::matchConcurrently):
        (JSC::RegExp::compileMatchOnly):
        (JSC::RegExp::deleteCode):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        (JSC::SamplingProfiler::stackTracesAsJSON):
        (JSC::SamplingProfiler::reportTopFunctions):
        (JSC::SamplingProfiler::reportTopBytecodes):
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::createTemplateObject):
        * runtime/SparseArrayValueMap.cpp:
        (JSC::SparseArrayValueMap::add):
        (JSC::SparseArrayValueMap::remove):
        (JSC::SparseArrayValueMap::getConcurrently):
        (JSC::SparseArrayValueMap::visitChildrenImpl):
        * runtime/Structure.cpp:
        (JSC::Structure::changePrototypeTransition):
        (JSC::Structure::toDictionaryTransition):
        (JSC::Structure::nonPropertyTransitionSlow):
        (JSC::Structure::setBrandTransition):
        * runtime/StructureCache.cpp:
        (JSC::StructureCache::createEmptyStructure):
        (JSC::StructureCache::emptyObjectStructureConcurrently):
        * runtime/VM.cpp:
        (JSC::waitForVMDestruction):
        (JSC::VM::~VM):
        (JSC::VM::gatherScratchBufferRoots):
        (JSC::VM::scratchBufferForSize):
        (JSC::VM::clearScratchBuffers):
        (JSC::VM::addLoopHintExecutionCounter):
        (JSC::VM::getLoopHintExecutionCounter):
        (JSC::VM::removeLoopHintExecutionCounter):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::tryInstallTrapBreakpoints):
        (JSC::VMTraps::invalidateCodeBlocksOnStack):
        (JSC::VMTraps::willDestroyVM):
        (JSC::VMTraps::fireTrap):
        (JSC::VMTraps::handleTraps):
        (JSC::VMTraps::takeTopPriorityTrap):
        * runtime/WeakMapImpl.cpp:
        (JSC::WeakMapImpl<BucketType>::visitOutputConstraints):
        * runtime/WeakMapImpl.h:
        (JSC::WeakMapImpl::finishCreation):
        * runtime/WeakMapImplInlines.h:
        (JSC::WeakMapImpl<WeakMapBucket>::rehash):
        * runtime/WideningNumberPredictionFuzzerAgent.cpp:
        (JSC::WideningNumberPredictionFuzzerAgent::getPrediction):
        * tools/CompilerTimingScope.cpp:
        * tools/FunctionOverrides.cpp:
        (JSC::FunctionOverrides::FunctionOverrides):
        (JSC::FunctionOverrides::reinstallOverrides):
        (JSC::FunctionOverrides::initializeOverrideFor):
        * tools/Integrity.cpp:
        (JSC::Integrity::Random::reloadAndCheckShouldAuditSlow):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::add):
        (JSC::VMInspector::remove):
        (JSC::VMInspector::codeBlockForMachinePC):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::compileFunction):
        * wasm/WasmCalleeRegistry.h:
        (JSC::Wasm::CalleeRegistry::registerCallee):
        (JSC::Wasm::CalleeRegistry::unregisterCallee):
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::CodeBlock):
        (JSC::Wasm::CodeBlock::waitUntilFinished):
        (JSC::Wasm::CodeBlock::compileAsync):
        * wasm/WasmContext.cpp:
        (JSC::Wasm::Context::scratchBufferForSize):
        * wasm/WasmEntryPlan.cpp:
        (JSC::Wasm::EntryPlan::parseAndValidateModule):
        (JSC::Wasm::EntryPlan::prepare):
        (JSC::Wasm::EntryPlan::compileFunctions):
        * wasm/WasmEntryPlan.h:
        (JSC::Wasm::EntryPlan::tryReserveCapacity):
        * wasm/WasmFaultSignalHandler.cpp:
        (JSC::Wasm::trapHandler):
        * wasm/WasmInstance.cpp:
        (JSC::Wasm::Instance::setFunctionWrapper):
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::compileFunction):
        (JSC::Wasm::LLIntPlan::completeInStreaming):
        (JSC::Wasm::LLIntPlan::didCompileFunctionInStreaming):
        (JSC::Wasm::LLIntPlan::didFailInStreaming):
        * wasm/WasmMachineThreads.cpp:
        (JSC::Wasm::resetInstructionCacheOnAllThreads):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::growShared):
        * wasm/WasmModule.cpp:
        (JSC::Wasm::Module::getOrCreateCodeBlock):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmOperations.cpp:
        (JSC::Wasm::triggerOMGReplacementCompile):
        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
        * wasm/WasmSignatureInlines.h:
        (JSC::Wasm::SignatureInformation::get):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::jitCompileAndSetHeuristics):
        (JSC::LLInt::WASM_SLOW_PATH_DECL):
        * wasm/WasmStreamingCompiler.cpp:
        (JSC::Wasm::StreamingCompiler::didCompileFunction):
        (JSC::Wasm::StreamingCompiler::finalize):
        (JSC::Wasm::StreamingCompiler::fail):
        (JSC::Wasm::StreamingCompiler::cancel):
        * wasm/WasmStreamingPlan.cpp:
        (JSC::Wasm::StreamingPlan::work):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::grow):
        (JSC::Wasm::Table::visitAggregateImpl):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::Thunks::stub):
        (JSC::Wasm::Thunks::existingStub):
        * wasm/WasmWorklist.cpp:
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::visitChildrenImpl):

2021-05-21  Mark Lam  <mark.lam@apple.com>

        Remove the unnecessary use of CompileOpStrictEqType.
        https://bugs.webkit.org/show_bug.cgi?id=226121

        Reviewed by Saam Barati and Robin Morisset.

        We're already emitting template code.  Might as well make the relevant condition
        checks a build time check on the opcode type the template is specializing on
        instead of a runtime check on a passed in CompileOpStrictEqType.

        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::emit_op_stricteq):
        (JSC::JIT::emit_op_nstricteq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emit_op_jstricteq):
        (JSC::JIT::emit_op_jnstricteq):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::emit_op_stricteq):
        (JSC::JIT::emit_op_nstricteq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emit_op_jstricteq):
        (JSC::JIT::emit_op_jnstricteq):

2021-05-21  Mark Lam  <mark.lam@apple.com>

        Introducing JITThunks::preinitializeCTIThunks().
        https://bugs.webkit.org/show_bug.cgi?id=226105

        Reviewed by Geoffrey Garen.

        We're basically renaming JITThunks::preinitializeExtraCTIThunks() to
        JITThunks::preinitializeCTIThunks() and making it not conditional on
        #if ENABLE(EXTRA_CTI_THUNKS).  Some thunks need to be initialized independent of
        #if ENABLE(EXTRA_CTI_THUNKS).

        * jit/JITThunks.cpp:
        (JSC::JITThunks::preinitializeCTIThunks):
        (JSC::JITThunks::preinitializeExtraCTIThunks): Deleted.
        * jit/JITThunks.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):

2021-05-21  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, late-ish May 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=225990

        Unreviewed non-unified build fixes.

        * jit/CCallHelpers.cpp: Add missing LinkBuffer.h header.

2021-05-21  Sam Sneddon  <gsnedders@apple.com>

        Fix Python 3.6+ DeprecationWarnings about unknown escapes
        https://bugs.webkit.org/show_bug.cgi?id=226018

        Reviewed by Jonathan Bedard.

        Fix Python 3.6+ DeprecationWarnings about unknown escapes

        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:

2021-05-20  Saam Barati  <sbarati@apple.com>

        [ Catalina Release JSC] A large number of JSC test appear to be flaky failing
        https://bugs.webkit.org/show_bug.cgi?id=225998
        <rdar://problem/78235001>

        Reviewed by Yusuke Suzuki.

        This patch is fixing some fallout from moving JIT::link() to a background
        thread:
        1. We can't shrink the CodeBlock's constant pool on a background thread
        since we read from it without grabbing a lock on the main thread (when
        reading things off the stack in slow path calls).
        2. We can't create GCAwareJITStubRoutines on the compilation thread, since
        creating a GCAwareJITStubRoutines adds to a global hash table inside Heap. This
        means that we have to do that step of emitting virtual calls for eval when
        we're finalizing code on the main thread.
        
        This patch also makes it so that a baseline JIT compilation thread is
        correctly marked as such.

        * heap/JITStubRoutineSet.cpp:
        (JSC::JITStubRoutineSet::add):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitUnlinkedVirtualCall):
        (JSC::AssemblyHelpers::emitVirtualCall):
        * jit/AssemblyHelpers.h:
        * jit/JIT.cpp:
        (JSC::JIT::link):
        (JSC::JIT::finalizeOnMainThread):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileCallEvalSlowCase):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileCallEvalSlowCase):
        * jit/JITWorklist.cpp:

2021-05-20  Saam Barati  <sbarati@apple.com>

        Make polymorphic calls play nice with Data Call ICs
        https://bugs.webkit.org/show_bug.cgi?id=225793

        Reviewed by Robin Morisset.

        This patch makes it so that Polymorphic stubs don't repatch when using
        Data Call ICs. We add a branch to the Data IC fast path to see if we're
        polymorphic. If we are, then we either call or tail call the polymorphic
        stub, depending on the CallLinkInfo's call type. This patch also changes
        the polymorphic stub to handle being called instead of jumped to, since that
        will now happen for Data ICs of non tail calls.

        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::setMonomorphicCallee):
        (JSC::CallLinkInfo::callee):
        (JSC::CallLinkInfo::visitWeak):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::revertCallToStub):
        (JSC::CallLinkInfo::setStub):
        (JSC::CallLinkInfo::emitFirstInstructionForDataIC): Deleted.
        * bytecode/CallLinkInfo.h:
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):

2021-05-20  Tuomas Karkkainen  <tuomas.webkit@apple.com>

        $vm should have a function for checking if ASan is enabled similar to $vm.assertEnabled
        https://bugs.webkit.org/show_bug.cgi?id=226019

        Reviewed by Mark Lam.

        Add method $vm.asanEnabled(), which parallels $vm.assertEnabled(), and allows checking at
        runtime whether the current JavaScriptCore build is instrumented with AddressSanitizer.

        * tools/JSDollarVM.cpp:

2021-05-19  Mark Lam  <mark.lam@apple.com>

        AbstractSlotVisitor::containsOpaqueRoot() should only declare didFindOpaqueRoot if the root is actually found.
        https://bugs.webkit.org/show_bug.cgi?id=226000
        rdar://78208014

        Reviewed by Robin Morisset.

        It was erroneously calling didFindOpaqueRoot() all the time even when the root is
        not found.  This only affects the GC verifier tool.  It has no effect on production
        code.

        * heap/AbstractSlotVisitorInlines.h:
        (JSC::AbstractSlotVisitor::containsOpaqueRoot const):

2021-05-19  Mark Lam  <mark.lam@apple.com>

        Speed up debug validation in CacheableIdentifier::createFromIdentifierOwnedByCodeBlock().
        https://bugs.webkit.org/show_bug.cgi?id=225948

        Not reviewed.

        Build fix after r277727.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::hasIdentifier):

2021-05-19  Mark Lam  <mark.lam@apple.com>

        Ripping out broken Baseline JIT rare case profiling.
        https://bugs.webkit.org/show_bug.cgi?id=225983

        Reviewed by Saam Barati and Robin Morisset.

        The profiling has been broken in recent times.  Fixing it to work does not appear
        to improve performance.  Ripping out the profiling appears to not hurt performance.
        However, ripping out the profiling appears to save on code size generated for the
        Baseline JIT.

                        Base                     New                      Diff

           BaselineJIT: 73299112 (69.903481 MB)  65910128 (62.856796 MB)  0.90x (reduction)
                   DFG: 36850540 (35.143414 MB)  36374400 (34.689331 MB)  0.99x
                 Thunk: 23128652 (22.057201 MB)  22892292 (21.831791 MB)  0.99x
           InlineCache: 22210972 (21.182034 MB)  22083508 (21.060474 MB)  0.99x
                   FTL: 6065064 (5.784096 MB)    6128080 (5.844193 MB)    1.01x
                  Wasm: 2305124 (2.198338 MB)    2309732 (2.202732 MB)    1.00x
               YarrJIT: 1522712 (1.452171 MB)    1536104 (1.464943 MB)    1.01x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        Cumulative diff since the start of this effort to put more code in JIT thunks:

                        Base                     New                      Diff

           BaselineJIT: 89089964 (84.962811 MB)  65910128 (62.856796 MB)  0.74x (reduction)
                   DFG: 39117360 (37.305222 MB)  36374400 (34.689331 MB)  0.93x (reduction)
                 Thunk: 23230968 (22.154778 MB)  22892292 (21.831791 MB)  0.99x
           InlineCache: 22027416 (21.006981 MB)  22083508 (21.060474 MB)  1.00x
                   FTL: 6575772 (6.271145 MB)    6128080 (5.844193 MB)    0.93x (reduction)
                  Wasm: 2302724 (2.196049 MB)    2309732 (2.202732 MB)    1.00x
               YarrJIT: 1538956 (1.467663 MB)    1536104 (1.464943 MB)    1.00x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        Benchmarking was done with Speedometer2 and JetSteam2 on an M1 Mac.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::JITData::size const):
        (JSC::CodeBlock::dumpValueProfiles):
        (JSC::CodeBlock::setRareCaseProfiles): Deleted.
        (JSC::CodeBlock::rareCaseProfileForBytecodeIndex): Deleted.
        (JSC::CodeBlock::rareCaseProfileCountForBytecodeIndex): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
        * bytecode/ValueProfile.h:
        (JSC::RareCaseProfile::RareCaseProfile): Deleted.
        (JSC::getRareCaseProfileBytecodeIndex): Deleted.
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::makeSafe):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):

2021-05-19  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC} Remove exception checks from non-throwing function calls in Baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=224920

        Reviewed by Tadeu Zagallo.

        These functions are not taking JSGlobalObject and will not throw an error.
        Use callOperationNoExceptionCheck instead to avoid emitting unnecessary exception checks.

        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::emit_op_profile_type):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_profile_type):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitWriteBarrier):

2021-05-19  Robin Morisset  <rmorisset@apple.com>

        Fix typo in AirUseCounts
        https://bugs.webkit.org/show_bug.cgi?id=225977
        rdar://78210501

        Reviewed by Mark Lam.

        I had just messed up a copy-and-paste, using "gp" instead of "fp" in code that deals with floating point values.
        This did not show in my tests, probably because few functions have more floating point temporaries than non-floating-point.

        * b3/air/AirUseCounts.h:
        (JSC::B3::Air::UseCounts::UseCounts):

2021-05-18  Darin Adler  <darin@apple.com>

        Move CFStringRef and NSString support from StringBuilder into StringConcatenateCF
        https://bugs.webkit.org/show_bug.cgi?id=225839

        Reviewed by Sam Weinig.

        * inspector/ConsoleMessage.cpp:
        (Inspector::ConsoleMessage::ConsoleMessage): Use StringBuilder::clear instead of
        StringBuilder::resize; no advantage to the latter after calling StringBuilder::toString.

        * runtime/JSONObject.cpp:
        (JSC::Stringifier::Holder::appendNextProperty): Update for name change of
        StringBuilder::resize to StringBuilder::shrink.
        * runtime/TypeSet.cpp:
        (JSC::StructureShape::stringRepresentation): Ditto.

2021-05-19  Mark Lam  <mark.lam@apple.com>

        Speed up debug validation in CacheableIdentifier::createFromIdentifierOwnedByCodeBlock().
        https://bugs.webkit.org/show_bug.cgi?id=225948
        rdar://78175542

        Reviewed by Yusuke Suzuki.

        1. Introduce CodeBlock::hasIdentifier() so that we can encapsulate the identifier
           search better.  Change CacheableIdentifier::createFromIdentifierOwnedByCodeBlock()
           to call this method instead of rolling its own identifier search.

        2. If the CodeBlock is pathological and has a ridiculous number of identifiers
           to search, create a cached hash set of the identifiers, and use that for
           doing the search instead.

           Apparently, YouTube can have a single JS function with 2177689 bytecodes, where
           a large portion of those are put_by_ids.  The function also has some 17k+
           identifiers.  With that may bytecodes doing a validation search on 17k+
           identifiers in a Debug build, the site can become un-useable.  This optimization
           brings it back from un-useable to barely tolerable on the Debug build.

        3. Also fetch the UnlinkedCodeBlock from the WriteBarrier field just once in
           CodeBlock::identifier() and CodeBlock::hasIdentifier().  This may not matter
           on a Release build, but it can add up on a Debug build, which is already slow.
           We should try to avoid doing redundant validation via the WriteBarrier access.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::identifier const):
        (JSC::CodeBlock::hasIdentifier):
        * bytecode/CodeBlock.h:
        * runtime/CacheableIdentifierInlines.h:
        (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):

2021-05-19  Saam Barati  <sbarati@apple.com>

        Link Baseline JIT code off the main thread
        https://bugs.webkit.org/show_bug.cgi?id=225940

        Reviewed by Yusuke Suzuki.

        This patch makes JIT::link() able to run on compiler threads.
        Most of what the function was already doing happily remains the
        same. This patch moves a few operations to JIT::finalizeOnMainThread
        for things that can't happen on the compiler thread:
        - Adding data to some global hash tables which aren't synchronized.
        - Setting the JITCode.
        - Setting the code pointer for exception handlers.
        - Some other metadata the Sampling Profiler looks at.

        * jit/JIT.cpp:
        (JSC::JIT::compileAndLinkWithoutFinalizing):
        (JSC::JIT::link):
        (JSC::JIT::finalizeOnMainThread):
        (JSC::JIT::privateCompile):
        (JSC::JIT::compileWithoutLinking): Deleted.
        * jit/JIT.h:
        * jit/JITWorklist.cpp:
        (JSC::JITWorklist::Plan::compileInThread):
        (JSC::JITWorklist::Plan::finalize):
        (JSC::JITWorklist::Plan::compileOnMainThreadNow):
        (JSC::JITWorklist::compileLater):
        (JSC::JITWorklist::compileOnMainThreadNow):
        (JSC::JITWorklist::finalizePlans):
        (JSC::JITWorklist::Plan::compileNow): Deleted.
        (JSC::JITWorklist::compileNow): Deleted.
        * jit/JITWorklist.h:

2021-05-18  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Prune CommonSlowPaths of JITPropertyAccess functions
        https://bugs.webkit.org/show_bug.cgi?id=225953

        Reviewed by Mark Lam.

        A few bytecode operations with slow paths in JITPropertyAccess appear to have either redundant or unnecessary
        "common" slow paths; namely, get_private_name and del_by_val already have LLInt slow paths, while in_by_id
        and get_by_id_with_this can have their "common" slow path moved to be LLInt-specific.

        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * runtime/CommonSlowPaths.cpp:
        * runtime/CommonSlowPaths.h:

2021-05-18  Robin Morisset  <rmorisset@apple.com>

        Make AirAllocateRegistersByGraphColoring use less memory
        https://bugs.webkit.org/show_bug.cgi?id=225848

        Reviewed by Filip Pizlo.

        We've had some jetsam problems caused by the main Air register allocator, which caused us to lower Options::maximumTmpsForGraphColoring.
        Hence this patch tries to improve the memory usage of the allocator. It includes several changes:
        - Change the datastructure used for representing the interference graph. Before it was effectively a HashSet<std::pair<uint16_t, uint16_t>. Now, it is either a Bitvector (for n < 400 for now, can be tweaked easily), or a Vector<LikelyDenseUnsignedIntegerSet<uint16_t>> otherwise.
        LikelyDenseUnsignedIntegerSet is a new datastructure introduced by this patch, it is either a HashSet if very sparse, or a BitVector + an amount to shift it by.
        This is by far the largest memory reduction in this patch, it reduces the maximum memory used for an interference graph in tsf-wasm in JetStream2 from 16MB to 700kB, and in mruby-wasm.aotoki.dev from 262MB to 20MB (the later only happen when we increase Options::maximumTmpsForGraphColoring.. this is the exact function which caused us to lower it).
        Its effect on smaller functions in JetStream2 is rarely as dramatic but always an improvement, and improvements between 2x and 5x are extremely common (10x to 30x are significantly rarer but do occur).
        - In order to easily test this change and any further change to this datastructure, the old approach was preserved as InterferenceHashSet, and a template to run two such datastructures in parallel, checking their equivalence was added: InstrumentedInterferenceGraph. Running with it and reportInterferenceGraphMemoryUse set to true was used to compute the numbers given above.
        - There was already some template parameter to change the size of the tmp indices from unsigned to uint16_t but the code failed to compile unless it was unsigned. I fixed this, made more consistent use of it, and switched to uint16_t in the very common case that we have less than 65k Tmps (we can have more despite the option because of spilling). This halved the memory usage of various other datastructures in the register allocator
        - unspillableTmps was a HashSet<unsigned>. Since it is often quite dense (often around 20% on JetStream2), I replaced it by a Bitvector instead
        - m_biases was a HashMap<IndexType, HashSet<IndexType>>. Since it is extremely rare that the sets have more than 8 elements (from looking at some instrumented run of JetStream2), I replaced it by HashMap<IndexType, SmallSet<IndexType>>. This not only significantly reduces memory, but nearly halves the time spent in assignColors(around 80ms -> 40ms in JetStream 2)
        - UseCounts was needlessly general: it is only used by the register allocator (all other references to UseCounts refer to the completely different B3::UseCounts), so there is no point in it computing, and then storing lots of irrelevant data. A float is also more than enough precision (especially since it is pretty much always 1, 10, 100, or 1000 in practice…). Also, since we only need it indexed by Tmps, we can use a Vector with AbsoluteTmpMapper instead of its HashMap. These changes are not just memory savings, they also make selectSpill way faster (570ms -> 250ms on my machine on JetStream2)
        - While I was at it, I did a couple of other tweaks to the logic of selectSpill. In particular, instead of having to check for isFastTmp every time, I just put the fast tmps directly in unspillableTmps, which prevents them from getting added to m_spillWorklist in the first place. This + a bit of clean-up (for example putting an early exit instead of setting score to infinity in the case of dead tmps) resulted in a further perf win (to roughly 200ms spent in selectSpill() on JetStream2)

        All together, this patch reduces the time spent in the register allocator by roughly 15 to 20% in JetStream2 (tested both with the Briggs and the IRC allocators on my MBP 2019).

        I do not yet have precise performance numbers for this exact patch, but benchmarking a previous version of it (with a less optimized interference graph) resulted in significant RAMification improvements (around 1%), and more surprisingly some JetStream2 improvements on weaker machines (e.g. an iPhone 7 gained > 1%). I believe these gains come either from less trashing of the caches, or less contention caused by the memory traffic.
        I will try to update the bugzilla with more up-to-date thorough results when I get them.

        This patch does not increase Options::maximumTmpsForGraphColoring, I intend to do that in a separate patch to make it easier to revert in case of a problem.

        * b3/B3ReduceLoopStrength.cpp:
        (JSC::B3::ReduceLoopStrength::reduceByteCopyLoopsToMemcpy):
        * b3/air/AirAllocateRegistersAndStackByLinearScan.cpp:
        * b3/air/AirAllocateRegistersByGraphColoring.cpp:
        (JSC::B3::Air::allocateRegistersByGraphColoring):
        * b3/air/AirCode.h:
        (JSC::B3::Air::Code::forEachFastTmp const):
        * b3/air/AirUseCounts.h:
        (JSC::B3::Air::UseCounts::UseCounts):
        (JSC::B3::Air::UseCounts::isConstDef const):
        (JSC::B3::Air::UseCounts::numWarmUsesAndDefs const):
        (JSC::B3::Air::UseCounts::dump const):
        * parser/Nodes.h:

2021-05-18  Saam Barati  <sbarati@apple.com>

        Add Data Call ICs that don't repatch and use them in the baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=225321
        <rdar://problem/77773796>

        Reviewed by Michael Saboff.

        This patch adds Data ICs for calls. Data ICs for calls work by loading a code 
        pointer from CallLinkInfo, and indirect calling that pointer. This means that
        to repatch such an IC, all we need to do is replace a code pointer inside
        CallLinkInfo. No need to repatch the JIT code.
        
        The current implementation only does this for monomorphic calls. We still
        repatch the JIT code for polymorphic calls. In a followup, we will also
        opt polymorphic call ICs into data-based calls:
        https://bugs.webkit.org/show_bug.cgi?id=225793
        
        This patch only uses Data Call ICs for the Baseline JIT. Even with that, it
        reduces the number of calls to cacheFlush by ~45% on JetStream2.
        
        Performance is neutral on AS Macs, but it paves the way towards doing
        unlinked JITting in JSC.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::addLateLinkTask):
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::linkCode):
        (JSC::LinkBuffer::performFinalization):
        * assembler/LinkBuffer.h:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::CallLinkInfo):
        (JSC::CallLinkInfo::unlink):
        (JSC::CallLinkInfo::fastPathStart):
        (JSC::CallLinkInfo::slowPathStart):
        (JSC::CallLinkInfo::doneLocation):
        (JSC::CallLinkInfo::setMonomorphicCallee):
        (JSC::CallLinkInfo::clearCallee):
        (JSC::CallLinkInfo::emitFirstInstructionForDataIC):
        (JSC::CallLinkInfo::emitFastPathImpl):
        (JSC::CallLinkInfo::emitFastPath):
        (JSC::CallLinkInfo::emitTailCallFastPath):
        (JSC::CallLinkInfo::emitSlowPath):
        (JSC::CallLinkInfo::emitDirectFastPath):
        (JSC::CallLinkInfo::emitDirectTailCallFastPath):
        (JSC::CallLinkInfo::initializeDirectCall):
        (JSC::CallLinkInfo::setDirectCallTarget):
        (JSC::CallLinkInfo::setSlowPathCallDestination):
        (JSC::CallLinkInfo::revertCallToStub):
        (JSC::CallLinkInfo::setStub):
        (JSC::CallLinkInfo::callReturnLocation): Deleted.
        (JSC::CallLinkInfo::patchableJump): Deleted.
        (JSC::CallLinkInfo::hotPathBegin): Deleted.
        (JSC::CallLinkInfo::setCallee): Deleted.
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::calleeGPR const):
        (JSC::CallLinkInfo::isDataIC const):
        (JSC::CallLinkInfo::setUsesDataICs):
        (JSC::CallLinkInfo::setCodeLocations):
        (JSC::CallLinkInfo::offsetOfCallee):
        (JSC::CallLinkInfo::offsetOfMonomorphicCallDestination):
        (JSC::CallLinkInfo::offsetOfSlowPathCallDestination):
        (JSC::CallLinkInfo::setCallLocations): Deleted.
        (JSC::CallLinkInfo::hotPathOther): Deleted.
        (JSC::CallLinkInfo::setStub): Deleted.
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::addJSCall):
        (JSC::DFG::JITCompiler::addJSDirectCall):
        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
        (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
        (JSC::DFG::JITCompiler::addJSDirectTailCall): Deleted.
        (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord): Deleted.
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::callerReturnPC):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::emitJITCodeOver):
        * jit/CCallHelpers.h:
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileTailCall):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/PolymorphicCallStubRoutine.cpp:
        (JSC::PolymorphicCallNode::unlink):
        * jit/Repatch.cpp:
        (JSC::linkSlowPathTo):
        (JSC::linkSlowFor):
        (JSC::linkMonomorphicCall):
        (JSC::linkDirectCall):
        (JSC::revertCall):
        (JSC::unlinkCall):
        (JSC::linkPolymorphicCall):
        (JSC::linkFor): Deleted.
        (JSC::linkDirectFor): Deleted.
        (JSC::unlinkFor): Deleted.
        * jit/Repatch.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):

2021-05-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r276655.
        https://bugs.webkit.org/show_bug.cgi?id=225930

        caused a 2% PLT regression

        Reverted changeset:

        "StructureStubInfo and PolymorphicAccess should account for
        their non-GC memory"
        https://bugs.webkit.org/show_bug.cgi?id=225113
        https://trac.webkit.org/changeset/276655

2021-05-18  Keith Miller  <keith_miller@apple.com>

        Temporarily revert r276592 as it breaks some native apps
        https://bugs.webkit.org/show_bug.cgi?id=225917

        Unreviewed, revert.

        * API/JSCallbackObject.h:
        * API/JSCallbackObjectFunctions.h:
        (JSC::JSCallbackObject<Parent>::put):
        * debugger/DebuggerScope.h:
        * runtime/ClassInfo.h:
        * runtime/ClonedArguments.h:
        * runtime/CustomGetterSetter.cpp:
        (JSC::callCustomSetter):
        * runtime/CustomGetterSetter.h:
        * runtime/ErrorConstructor.h:
        * runtime/ErrorInstance.h:
        * runtime/GenericArguments.h:
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::put):
        * runtime/GetterSetter.h:
        * runtime/JSArray.cpp:
        (JSC::JSArray::put):
        * runtime/JSArray.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::put):
        * runtime/JSArrayBufferView.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::putToPrimitive):
        * runtime/JSCell.cpp:
        (JSC::JSCell::doPutPropertySecurityCheck):
        * runtime/JSCell.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::put):
        * runtime/JSFunction.h:
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGlobalLexicalEnvironment.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::put):
        * runtime/JSGlobalObject.h:
        * runtime/JSLexicalEnvironment.h:
        * runtime/JSModuleEnvironment.h:
        * runtime/JSModuleNamespaceObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::doPutPropertySecurityCheck):
        (JSC::JSObject::putInlineSlow):
        (JSC::JSObject::prototypeChainMayInterceptStoreTo):
        (JSC::definePropertyOnReceiverSlow): Deleted.
        (JSC::JSObject::definePropertyOnReceiver): Deleted.
        (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded): Deleted.
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::doPutPropertySecurityCheck):
        (JSC::JSObject::hasNonReifiedStaticProperties): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::canPerformFastPutInlineExcludingProto):
        (JSC::JSObject::putInlineForJSObject):
        (JSC::JSObject::putDirectInternal):
        (JSC::JSObject::putInlineFast): Deleted.
        * runtime/JSProxy.h:
        * runtime/JSTypeInfo.h:
        (JSC::TypeInfo::overridesGetOwnPropertySlot const):
        (JSC::TypeInfo::overridesAnyFormOfGetOwnPropertyNames const):
        (JSC::TypeInfo::hasPutPropertySecurityCheck const):
        (JSC::TypeInfo::hasStaticPropertyTable const): Deleted.
        (JSC::TypeInfo::overridesPut const): Deleted.
        * runtime/Lookup.h:
        (JSC::putEntry):
        (JSC::lookupPut):
        * runtime/PropertySlot.h:
        * runtime/ProxyObject.cpp:
        (JSC::ProxyObject::put):
        * runtime/ProxyObject.h:
        * runtime/PutPropertySlot.h:
        (JSC::PutPropertySlot::PutPropertySlot):
        (JSC::PutPropertySlot::context const):
        (JSC::PutPropertySlot::type const):
        (JSC::PutPropertySlot::isInitialization const):
        (JSC::PutPropertySlot::isTaintedByOpaqueObject const): Deleted.
        (JSC::PutPropertySlot::setIsTaintedByOpaqueObject): Deleted.
        * runtime/ReflectObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::put):
        * runtime/RegExpObject.h:
        * runtime/StringObject.cpp:
        (JSC::StringObject::put):
        * runtime/StringObject.h:
        * runtime/StringPrototype.cpp:
        (JSC::StringPrototype::finishCreation):
        (JSC::StringPrototype::create):
        * runtime/StringPrototype.h:
        * runtime/Structure.cpp:
        (JSC::Structure::validateFlags):
        * runtime/Structure.h:
        (JSC::Structure::takesSlowPathInDFGForImpureProperty):
        (JSC::Structure::hasNonReifiedStaticProperties const): Deleted.
        * tools/JSDollarVM.cpp:

2021-05-18  Yoshiaki Jitsukawa  <yoshiaki.jitsukawa@sony.com>

        [PlayStation] Fix PlayStation port
        https://bugs.webkit.org/show_bug.cgi?id=225913

        Reviewed by Don Olmstead.

        Fix PlayStation port

        * jsc.cpp: Include LinkBuffer.h.

2021-05-18  Adrian Perez de Castro  <aperez@igalia.com>

        [JSCOnly] Non unified build fixes
        https://bugs.webkit.org/show_bug.cgi?id=225872

        Unreviewed non-unified build fixes.

        * jit/JITPropertyAccess.cpp: Add missing ThunkGenerators.h header.
        * jit/SlowPathCall.cpp: Add missing JITInlines.h and ThunkGenerators.h headers.
        * wasm/js/WebAssemblyFunctionBase.h: Add missing WasmFormat.h header.

2021-05-17  Saam Barati  <sbarati@apple.com>

        Enable JS to emit sign posts and trace points under Options::exposeProfilersOnGlobalObject
        https://bugs.webkit.org/show_bug.cgi?id=225895

        Reviewed by Yusuke Suzuki.

        * runtime/JSGlobalObject.cpp:
        (JSC::asTracePointInt):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::asSignpostString):
        (JSC::JSGlobalObject::init):

2021-05-17  Geoffrey Garen  <ggaren@apple.com>

        StructureRareData::m_replacementWatchpointSets should not be a pointer to a pointer
        https://bugs.webkit.org/show_bug.cgi?id=225840

        Reviewed by Mark Lam.

        HashMap is already just one pointer. Making it a pointer to a pointer
        causes heap fragmentation. Worth about 1MB on GMail.

        * runtime/Structure.cpp:
        (JSC::Structure::ensurePropertyReplacementWatchpointSet):
        * runtime/StructureInlines.h:
        (JSC::Structure::didReplaceProperty):
        (JSC::Structure::propertyReplacementWatchpointSet):
        * runtime/StructureRareData.h:

2021-05-17  Alexey Shvayka  <shvaikalesh@gmail.com>

        REGRESSION (r271119): Object methods defined with shorthand notation cannot access "caller" in non-strict mode
        https://bugs.webkit.org/show_bug.cgi?id=225277

        Reviewed by Darin Adler.

        This patch loosens `function.caller` to allow non-strict getters, setters, arrow functions,
        and ES6 methods to be returned as callers, fixing web compatibility.

        The intent of r230662 is preserved: generator / async functions are never exposed. There is
        no good way to acquire wrapper function from the internal body one, nor from its arguments.
        Also, this behavior is on standards track [1] (seems to be considered desirable).

        [1]: https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (step 14)

        * runtime/JSFunction.cpp:
        (JSC::JSC_DEFINE_CUSTOM_GETTER):

2021-05-16  Mark Lam  <mark.lam@apple.com>

        Implement baseline op_enter, op_ret, op_check_traps, op_throw using JIT thunks.
        https://bugs.webkit.org/show_bug.cgi?id=225846

        Reviewed by Filip Pizlo.

        op_enter, op_ret, op_check_traps are 3 of the most common opcodes.  Throwing in
        op_throw because it's easy.

        In this patch, the following changes were also made:

        1. Renamed copyCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer() to
           copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer().

           It is only used by the baseline JIT.  Changed it to always operate on
           RegisterAtOffsetList::llintBaselineCalleeSaveRegisters().  This removes the
           dependency on a current codeBlock being compiled, and allows us to use it
           for a JIT thunk.

        2. Added JIT::emitNakedNearJump() to make it easy to emit direct jumps to JIT thunks.

           Currently, it is only used by op_ret and op_throw.

        3. Changed some thunks to use emitNonPatchableExceptionCheck() instead
           emitExceptionCheck() to make it explicit that these are not intended to be
           patchable.

        With this patch, --dumpLinkBufferStats shows the following changes in emitted
        JIT code size (using a single run of the CLI version of JetStream2 on AS Mac)
        comparing to current tip of tree:

                        Base                     New                      Diff

           BaselineJIT: 77429400 (73.842430 MB)  72407904 (69.053558 MB)  0.94x (reduction)
                   DFG: 36160880 (34.485703 MB)  36622176 (34.925629 MB)  1.01x
                 Thunk: 23159024 (22.086166 MB)  23295448 (22.216270 MB)  1.01x
           InlineCache: 22068348 (21.046017 MB)  22157236 (21.130787 MB)  1.00x
                   FTL: 6004736 (5.726562 MB)    6030536 (5.751167 MB)    1.00x
                  Wasm: 2429204 (2.316669 MB)    2300872 (2.194283 MB)    0.95x (probably noise)
               YarrJIT: 1522488 (1.451958 MB)    1522616 (1.452080 MB)    1.00x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        Cumulative diff since the start of this effort to put more code in JIT thunks:

                        Base                     New                      Diff

           BaselineJIT: 89089964 (84.962811 MB)  72407904 (69.053558 MB)  0.81x (reduction)
                   DFG: 39117360 (37.305222 MB)  36622176 (34.925629 MB)  0.94x (reduction)
                 Thunk: 23230968 (22.154778 MB)  23295448 (22.216270 MB)  1.00x
           InlineCache: 22027416 (21.006981 MB)  22157236 (21.130787 MB)  1.01x
                   FTL: 6575772 (6.271145 MB)    6030536 (5.751167 MB)    0.92x (reduction)
                  Wasm: 2302724 (2.196049 MB)    2300872 (2.194283 MB)    1.00x
               YarrJIT: 1538956 (1.467663 MB)    1522616 (1.452080 MB)    0.99x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::sub64):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):
        (JSC::AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer):
        (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer): Deleted.
        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::link):
        * jit/JIT.h:
        (JSC::NearJumpRecord::NearJumpRecord):
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedNearJump):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_ret):
        (JSC::JIT::op_ret_handlerGenerator):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::op_throw_handlerGenerator):
        (JSC::JIT::emit_op_enter):
        (JSC::JIT::op_enter_handlerGenerator):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::emitSlow_op_check_traps):
        (JSC::JIT::op_check_traps_handlerGenerator):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::preinitializeExtraCTIThunks):
        * jit/SlowPathCall.cpp:
        (JSC::JITSlowPathCall::generateThunk):

2021-05-16  Keith Miller  <keith_miller@apple.com>

        IsoAlignedMemoryAllocator should use BitVector
        https://bugs.webkit.org/show_bug.cgi?id=225852

        Reviewed by Mark Lam.

        Right now IsoAlignedMemoryAllocator uses FastBitVector, which does
        not have inline storage for small sizes. However, it's not
        uncommon for IsoAlignedMemoryAllocator to be holding onto only a
        few blocks. Those blocks may exist for a long time, which some
        data indicates causes IsoAlignedMemoryAllocator's FastBitVector to
        pin a full physical page for one 8 byte allocation. Since
        accessing the commited blocks list is not a particularly hot
        operation, we should just use a BitVector instead.

        This seems to be perf neutral on benchmarks.

        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):
        * heap/IsoAlignedMemoryAllocator.h:

2021-05-16  Saam Barati  <sbarati@apple.com>

        DFGVarargsForwardingPhase shouldn't consult Flush
        https://bugs.webkit.org/show_bug.cgi?id=225824

        Reviewed by Filip Pizlo and Yusuke Suzuki.

        In the Varargs Forwarding Phase, we were treating Flush as if it
        were any other form of node that interferes with an argument
        via clobbering a stack location.
        
        This isn't how Flush works though. It doesn't have execution
        semantics at the node's graph location. Instead, Flush means that
        any variable it's linked to in CPS should be flushed to the stack
        between it and the Flush.
        
        The semantics of arguments is that they're already flushed to the
        stack, and they've always been. Seeing a Flush node doesn't prevent
        arguments elimination, we already know the arguments are on the stack,
        and all we're searching for is if there is an interference operation
        that says it'll clobber that stack slot. Flush isn't an interference operation.
        
        This is a 0.5% Speedometer progression.

        * dfg/DFGVarargsForwardingPhase.cpp:

2021-05-15  Alexey Shvayka  <shvaikalesh@gmail.com>

        Turn callGetter() / callSetter() into instance methods
        https://bugs.webkit.org/show_bug.cgi?id=225831

        Reviewed by Ross Kirsling.

        1. Turn callGetter() / callSetter() into instance methods to simplify their signatures.
        2. Rename `base` parameter to `thisValue`, avoiding similarity with slotBase().
        3. Accept `bool shouldThrow` in callSetter() since ECMAMode is cumbersome to construct.
        4. Replace isSetterNull(), which does LIKELY(inherits), with direct JSType check.
        5. Introduce getCallData(VM&, JSCell*) overload to avoid extra checks / casts.
        6. Move isValidCallee() to JSCell and handle primitives gracefully.

        No behavior change. Advances provided callSetter() microbenchmark by 2%.

        * runtime/GetterSetter.cpp:
        (JSC::GetterSetter::callGetter):
        (JSC::GetterSetter::callSetter):
        (JSC::callGetter): Deleted.
        (JSC::callSetter): Deleted.
        * runtime/GetterSetter.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::isValidCallee): Deleted.
        * runtime/JSCJSValue.h:
        * runtime/JSCell.cpp:
        (JSC::JSCell::isValidCallee const):
        * runtime/JSCell.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::putInlineSlow):
        * runtime/JSObjectInlines.h:
        (JSC::getCallData):
        (JSC::getConstructData):
        * runtime/PropertySlot.cpp:
        (JSC::PropertySlot::functionGetter const):
        * runtime/SparseArrayValueMap.cpp:
        (JSC::SparseArrayEntry::put):

2021-05-14  Chris Dumez  <cdumez@apple.com>

        Drop FileSystem::fileMetadata() / fileMetadataFollowingSymlinks()
        https://bugs.webkit.org/show_bug.cgi?id=225820

        Reviewed by Darin Adler.

        Update our code base because of the FileSystem API changes.

        * API/JSScript.mm:
        (validateBytecodeCachePath):

2021-05-14  Ross Kirsling  <ross.kirsling@sony.com>

        REGRESSION (r277221): 2 test262 tests failing
        https://bugs.webkit.org/show_bug.cgi?id=225819

        Reviewed by Alexey Shvayka.

        Undo the other part of r277221's code consolidation --
        I'd forgotten that this exists to enforce a evaluation order on AggregateError's arguments.

        * runtime/AggregateError.cpp:
        (JSC::createAggregateError):

2021-05-14  Mark Lam  <mark.lam@apple.com>

        Implement Baseline JIT property access slow paths using JIT thunks.
        https://bugs.webkit.org/show_bug.cgi?id=225771

        Reviewed by Yusuke Suzuki and Saam Barati.

        This patch applies the following strategy to Baseline JIT property access slow paths:

        1. If the slow path operation call is not patchable, emit a near call to a JIT
           thunk to do the entire operation call.

        2. If the slow path operation call is patachable, emit a near call to a prepare
           call JIT thunk before the patchable operation call, and a near call to an exception
           check JIT thunk after.

        This strategy reduces the amount of instructions emitted for all the slow paths.
        Performance is expected to be neutral or slightly improved due to the reduced
        compile times and better cache locality.

        With this patch, --dumpLinkBufferStats shows the following changes in emitted
        JIT code size (using a single run of the CLI version of JetStream2 on AS Mac)
        comparing to current tip of tree:

                        Base                     New                      Diff

           BaselineJIT: 84624776 (80.704475 MB)  77429400 (73.842430 MB)  0.91x (reduction)
                   DFG: 36415264 (34.728302 MB)  36160880 (34.485703 MB)  0.99x
                 Thunk: 23130336 (22.058807 MB)  23159024 (22.086166 MB)  1.00x
           InlineCache: 21969728 (20.951965 MB)  22068348 (21.046017 MB)  1.00x
                   FTL: 6097336 (5.814873 MB)    6004736 (5.726562 MB)    0.98x
                  Wasm: 2301956 (2.195316 MB)    2429204 (2.316669 MB)    1.06x (probably noise)
               YarrJIT: 1522488 (1.451958 MB)    1522488 (1.451958 MB)    1.00x
                CSSJIT: 0
         Uncategorized: 0

        Comparing to tip of tree at the start of this effort to move put slow paths in
        JIT thunks:

                        Base                     New                      Diff

           BaselineJIT: 89089964 (84.962811 MB)  77429400 (73.842430 MB)  0.87x (reduction)
                   DFG: 39117360 (37.305222 MB)  36160880 (34.485703 MB)  0.92x (reduction)
                 Thunk: 23230968 (22.154778 MB)  23159024 (22.086166 MB)  1.00x
           InlineCache: 22027416 (21.006981 MB)  22068348 (21.046017 MB)  1.00x
                   FTL: 6575772 (6.271145 MB)    6004736 (5.726562 MB)    0.91x (reduction)
                  Wasm: 2302724 (2.196049 MB)    2429204 (2.316669 MB)    1.05x (probably noise)
               YarrJIT: 1538956 (1.467663 MB)    1522488 (1.451958 MB)    0.99x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        This patch has passed the JSC tests on AS Mac, and also a subset of the JSC tests
        (as a smoke test) on x86_64.

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetOfGlobalObject):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::callExceptionFuzz):
        (JSC::AssemblyHelpers::emitExceptionCheck):
        (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_private_name):
        (JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_set_private_brand):
        (JSC::JIT::emitSlow_op_check_private_brand):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_put_private_name):
        (JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_del_by_id):
        (JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_del_by_val):
        (JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
        (JSC::JIT::emitSlow_op_in_by_id):
        (JSC::JIT::emitSlow_op_get_from_scope):
        (JSC::JIT::slow_op_get_from_scopeGenerator):
        (JSC::JIT::emitSlow_op_put_to_scope):
        (JSC::JIT::slow_op_put_to_scopeGenerator):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::preinitializeExtraCTIThunks):
        * jit/SlowPathCall.cpp:
        (JSC::JITSlowPathCall::call):
        * jit/ThunkGenerators.cpp:
        (JSC::checkExceptionGenerator):
        * jit/ThunkGenerators.h:

2021-05-14  Chris Dumez  <cdumez@apple.com>

        Rename FileSystem::getFileSize() to FileSystem::fileSize()
        https://bugs.webkit.org/show_bug.cgi?id=225798

        Reviewed by Alex Christensen.

        Update code path to due to the API change.

        * inspector/remote/socket/RemoteInspectorSocket.cpp:
        (Inspector::RemoteInspector::backendCommands const):
        * jsc.cpp:

2021-05-13  Darin Adler  <darin@apple.com>

        Follow-up fix for: Remove StringBuilder::appendNumber
        https://bugs.webkit.org/show_bug.cgi?id=225732
        rdar://78000283

        * heap/HeapSnapshotBuilder.cpp:
        (JSC::HeapSnapshotBuilder::json): Removed a stray single quote mark that
        meant we produced a JSON file that could not be parsed.

2021-05-13  Patrick Angle  <pangle@apple.com>

        [REGRESSION: r271876] Web Inspector: [Cocoa] Remote inspection crashes when using WEB_THREAD
        https://bugs.webkit.org/show_bug.cgi?id=225794

        Reviewed by Devin Rousso.

        For WEB_THREAD, move `callback` in `dispatchAsyncOnTarget` to `block` scope to ensure it is available for the
        lifetime of the block.

        * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
        (Inspector::RemoteConnectionToTarget::dispatchAsyncOnTarget):

2021-05-13  Geoffrey Garen  <ggaren@apple.com>

        m_calleeSaveRegisters should not be a pointer to a pointer
        https://bugs.webkit.org/show_bug.cgi?id=225787

        Reviewed by Keith Miller.

        Ben found this through memory stress testing.

        RegisterAtOffsetList is effectively just a pointer. unique_ptr<RegisterAtOffsetList>
        is a pointer to a pointer. RegisterAtOffsetList is long-lived, so it
        creates heap page fragmentation.

        Worth 3MB on Ben's test.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setCalleeSaveRegisters):
        (JSC::CodeBlock::calleeSaveRegisters const): Use a fence before setting
        m_hasCalleeSaveRegisters to ensure that all writes have completed before
        the struct becomes visible.

        * bytecode/CodeBlock.h: Use RegisterAtOffsetList directly instead of 
        unique_ptr<RegisterAtOffsetList> to avoid a long-lived lonely 8 byte
        allocation.

        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile): Updated for type change.

2021-05-13  Chris Dumez  <cdumez@apple.com>

        Rename FileSystem::directoryName() to FileSystem::parentPath()
        https://bugs.webkit.org/show_bug.cgi?id=225768

        Reviewed by Darin Adler.

        Rename FileSystem::directoryName() to FileSystem::parentPath() for clarity and
        consistency with std::filesystem::parent_path() which is used internally.

        * API/JSScript.mm:
        (validateBytecodeCachePath):

2021-05-13  Chris Dumez  <cdumez@apple.com>

        Rename FileSystem::fileIsDirectory(path, followSymlinks) to isDirectory(path) / isDirectoryFollowingSymlinks(path)
        https://bugs.webkit.org/show_bug.cgi?id=225772

        Reviewed by Darin Adler.

        Update code base due to API naming change.

        * API/JSScript.mm:
        (validateBytecodeCachePath):

2021-05-13  Darin Adler  <darin@apple.com>

        Remove StringBuilder::appendNumber
        https://bugs.webkit.org/show_bug.cgi?id=225732

        Reviewed by Sam Weinig.

        * API/JSContextRef.cpp:
        (BacktraceFunctor::operator() const): Use append instead of appendNumber.
        * API/tests/PingPongStackOverflowTest.cpp:
        (PingPongStackOverflowObject_hasInstance): Ditto.
        * heap/HeapSnapshotBuilder.cpp:
        (JSC::HeapSnapshotBuilder::json): Ditto.

        * interpreter/StackVisitor.cpp:
        (JSC::StackVisitor::Frame::toString const): Use makeString instead of StringBuilder.

        * runtime/ConsoleClient.cpp:
        (JSC::appendURLAndPosition): Ditto.
        (JSC::ConsoleClient::printConsoleMessageWithArguments): Use append instead of appendNumber.
        * runtime/JSONObject.cpp:
        (JSC::Stringifier::appendStringifiedValue): Ditto.
        * runtime/Options.cpp:
        (JSC::OptionReader::Option::dump const): Ditto.

        * runtime/StackFrame.cpp:
        (JSC::StackFrame::toString const): Use makeString instead of StringBuilder.

2021-05-12  Geoffrey Garen  <ggaren@apple.com>

        ConservativeRoots triggers page demand on Speedometer
        https://bugs.webkit.org/show_bug.cgi?id=225676

        Reviewed by Filip Pizlo.

        Use a 2048 item / 16kB inline buffer. That's about 10% bigger than the
        max capacity observed on Speedometer, and small enough to reasonably fit
        on the stack.

        Removed the separate out of line capacity because it was smaller than
        the new inline capacity.

        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::grow):
        * heap/ConservativeRoots.h:

2021-05-12  Mark Lam  <mark.lam@apple.com>

        Implement some common Baseline JIT slow paths using JIT thunks.
        https://bugs.webkit.org/show_bug.cgi?id=225682

        Reviewed by Filip Pizlo.

        This patch implements the following changes:

        1. Implement exception handling thunks:
           a. handleExceptionGenerator, which calls operationLookupExceptionHandler().
           b. handleExceptionWithCallFrameRollbackGenerator, which calls
              operationLookupExceptionHandlerFromCallerFrame().

           All the JIT tiers were emitting their own copy of these routines to call these
           operation, one per CodeBlock.  We now emit 2 thunks for these and have all the
           tiers just jump to them.

           PolymorphicAccess also now uses the handleExceptionGenerator thunk.

           DFG::JITCompiler::compileExceptionHandlers() has one small behavior difference
           before it calls operationLookupExceptionHandlerFromCallerFrame(): it first
           re-sets the top of stack for the function where we are about to throw a
           StackOverflowError from.  This re-setting of top of stack is useless because
           we're imminently unwinding out of at least this frame for the StackOverflowError.
           Hence, it is ok to use the handleExceptionWithCallFrameRollbackGenerator thunk
           here as well.  Note that no other tiers does this re-setting of top of stack.

           FTLLowerDFGToB3 has one case using operationLookupExceptionHandlerFromCallerFrame()
           which cannot be refactored to use these thunks because it does additional
           work to throw a StackOverflowError.  A different thunk will be needed.  I left
           it alone for now.

        2. Introduce JITThunks::existingCTIStub(ThunkGenerator, NoLockingNecessaryTag) so
           that a thunk can get a pointer to another thunk without locking the JITThunks
           lock.  Otherwise, deadlock ensues.

        3. Change SlowPathCall to emit and use thunks instead of emitting a blob of code
           to call a slow path function for every bytecode in a CodeBlock.

        4. Introduce JITThunks::ctiSlowPathFunctionStub() to manage these SlowPathFunction
           thunks.

        5. Introduce JITThunks::preinitializeAggressiveCTIThunks() to initialize these
           thunks at VM initialization time.  Pre-initializing them has multiple benefits:
           a. the thunks are not scattered through out JIT memory, thereby reducing
              fragmentation.
           b. we don't spend time at runtime compiling them when the user is interacting
              with the VM.  Conceptually, these thunks can be VM independent and can be
              shared by VMs process-wide.  However, it will require some additional work.
              For now, the thunks remain bound to a specific VM instance.

        These changes are only enabled when ENABLE(EXTRA_CTI_THUNKS), which is currently
        only available for ARM64 and non-Windows x86_64.

        This patch has passed JSC tests on AS Mac.

        With this patch, --dumpLinkBufferStats shows the following changes in emitted
        JIT code size (using a single run of the CLI version of JetStream2 on AS Mac):

                        Base                     New                      Diff

           BaselineJIT: 89089964 (84.962811 MB)  84624776 (80.704475 MB)  0.95x (reduction)
                   DFG: 39117360 (37.305222 MB)  36415264 (34.728302 MB)  0.93x (reduction)
                 Thunk: 23230968 (22.154778 MB)  23130336 (22.058807 MB)  1.00x
           InlineCache: 22027416 (21.006981 MB)  21969728 (20.951965 MB)  1.00x
                   FTL: 6575772 (6.271145 MB)    6097336 (5.814873 MB)    0.93x (reduction)
                  Wasm: 2302724 (2.196049 MB)    2301956 (2.195316 MB)    1.00x
               YarrJIT: 1538956 (1.467663 MB)    1522488 (1.451958 MB)    0.99x
                CSSJIT: 0                        0
         Uncategorized: 0                        0

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::offsetOfInstructionsRawPointer):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compileExceptionHandlers):
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGJITCompiler.h:
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * jit/JIT.cpp:
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        * jit/JITThunks.cpp:
        (JSC::JITThunks::existingCTIStub):
        (JSC::JITThunks::ctiSlowPathFunctionStub):
        (JSC::JITThunks::preinitializeExtraCTIThunks):
        * jit/JITThunks.h:
        * jit/SlowPathCall.cpp: Added.
        (JSC::JITSlowPathCall::call):
        (JSC::JITSlowPathCall::generateThunk):
        * jit/SlowPathCall.h:
        * jit/ThunkGenerators.cpp:
        (JSC::handleExceptionGenerator):
        (JSC::handleExceptionWithCallFrameRollbackGenerator):
        (JSC::popThunkStackPreservesAndHandleExceptionGenerator):
        * jit/ThunkGenerators.h:
        * runtime/CommonSlowPaths.h:
        * runtime/SlowPathFunction.h: Added.
        * runtime/VM.cpp:
        (JSC::VM::VM):

2021-05-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r277346.
        https://bugs.webkit.org/show_bug.cgi?id=225705

        Introduced a (rare) deadlock

        Reverted changeset:

        "ConservativeRoots triggers page demand on Speedometer"
        https://bugs.webkit.org/show_bug.cgi?id=225676
        https://trac.webkit.org/changeset/277346

2021-05-12  Mark Lam  <mark.lam@apple.com>

        Remove dead code around ENABLE(OPCODE_SAMPLING) and ENABLE(CODEBLOCK_SAMPLING).
        https://bugs.webkit.org/show_bug.cgi?id=225699

        Reviewed by Tadeu Zagallo.

        This code revolves around an Interpreter::sampler() method which returns a
        SamplingTool*.  Neither the Interpreter method nor the SamplingTool class exists
        anymore.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::compileWithoutLinking):
        * jit/JIT.h:
        * jit/JITCall.cpp:
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileCallEval):
        (JSC::JIT::compileCallEvalSlowCase):
        (JSC::JIT::compileOpCall):
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITInlines.h:
        (JSC::JIT::sampleInstruction): Deleted.
        (JSC::JIT::sampleCodeBlock): Deleted.
        * jit/JITOperations.cpp:
        * jit/SlowPathCall.h:
        (JSC::JITSlowPathCall::call):
        * runtime/ScriptExecutable.h:
        (JSC::ScriptExecutable::finishCreation): Deleted.

2021-05-11  Geoffrey Garen  <ggaren@apple.com>

        ConservativeRoots triggers page demand on Speedometer
        https://bugs.webkit.org/show_bug.cgi?id=225676

        Reviewed by Saam Barati.

        Use a Vector instead of OSAllocator to avoid mmap() and page fault --
        and, like, come on.

        Bump default inlineCapacity up to 1024 because we seem to overflow
        frequently.

        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::ConservativeRoots):
        (JSC::ConservativeRoots::~ConservativeRoots):
        (JSC::ConservativeRoots::genericAddPointer):
        (JSC::ConservativeRoots::grow): Deleted.
        * heap/ConservativeRoots.h:
        (JSC::ConservativeRoots::roots const):
        (JSC::ConservativeRoots::size const): Deleted.
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::append):
        * heap/VerifierSlotVisitor.cpp:
        (JSC::VerifierSlotVisitor::append):

2021-05-10  Filip Pizlo  <fpizlo@apple.com>

        Tune number of threads for AS
        https://bugs.webkit.org/show_bug.cgi?id=225635

        Reviewed by Mark Lam.

        Using 4 GC markers (which really means 3 parallel GC worker threads -- the mutator thread is
        the 4th), 2 DFG threads, and 2 FTL threads seems to be more optimal than going off ncpu.

        ~1% JetStream2 speed-up, ~1% Speedometer2 speed-up.

        * runtime/Options.cpp:
        (JSC::overrideDefaults):

2021-05-10  Mark Lam  <mark.lam@apple.com>

        Removed unused CallRecord::bytecodeIndex field.
        https://bugs.webkit.org/show_bug.cgi?id=225627

        Reviewed by Yusuke Suzuki.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        (JSC::CallRecord::CallRecord):
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedNearCall):
        (JSC::JIT::emitNakedNearTailCall):

2021-05-10  Mark Lam  <mark.lam@apple.com>

        Add support to collect stats on cumulative LinkBuffer linked sizes based on profiles.
        https://bugs.webkit.org/show_bug.cgi?id=225617

        Reviewed by Saam Barati.

        There are 2 ways to dump the stats:
        1. Specify --dumpLinkBufferStats as an argument to the jsc shell.
        2. Call $vm.dumpLinkBufferStats() from your JS script to get the stats as a string.
           e.g.
                $vm.print($vm.dumpLinkBufferStats());

        Here's an example of what the dump looks like:

            Cummulative LinkBuffer profile sizes:
                       BaselineJIT: 79480320 (75.798340 MB)
                               DFG: 36108672 (34.435913 MB)
                             Thunk: 22495360 (21.453247 MB)
                       InlineCache: 19538521 (18.633386 MB)
                               FTL: 5186240 (4.945984 MB)
                              Wasm: 1998272 (1.905701 MB)
                           YarrJIT: 1331072 (1.269409 MB)
                            CSSJIT: 0
                     Uncategorized: 0

        The stats are currently grouped into some coarse profiles.  If needed, we can
        break these down into more fine grain profiles later.

        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::performFinalization):
        (JSC::LinkBuffer::dumpProfileStatistics):
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::LinkBuffer):
        * bytecode/InlineAccess.cpp:
        (JSC::linkCodeInline):
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compile):
        (JSC::DFG::JITCompiler::compileFunction):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::generate):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/ExecutableAllocator.cpp:
        (JSC::jitWriteThunkGenerator):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        * jit/JITMathIC.h:
        (JSC::JITMathIC::generateOutOfLine):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutPrivateNameWithCachedId):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::linkCallThunkGenerator):
        (JSC::linkPolymorphicCallThunkGenerator):
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::arityFixupGenerator):
        (JSC::unreachableGenerator):
        (JSC::stringGetByValGenerator):
        (JSC::boundFunctionCallGenerator):
        * jsc.cpp:
        (CommandLine::parseArguments):
        (jscmain):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        (JSC::LLInt::generateThunkWithJumpToPrologue):
        (JSC::LLInt::generateThunkWithJumpToLLIntReturnPoint):
        (JSC::LLInt::getHostCallReturnValueThunk):
        (JSC::LLInt::createJSGateThunk):
        (JSC::LLInt::createWasmGateThunk):
        (JSC::LLInt::createTailCallGate):
        (JSC::LLInt::loopOSREntryGateThunk):
        (JSC::LLInt::entryOSREntryGateThunk):
        (JSC::LLInt::wasmOSREntryGateThunk):
        (JSC::LLInt::exceptionHandlerGateThunk):
        (JSC::LLInt::returnFromLLIntGateThunk):
        (JSC::LLInt::tagGateThunk):
        (JSC::LLInt::untagGateThunk):
        (JSC::LLInt::jitCagePtrThunk):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSDollarVM::finishCreation):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::work):
        (JSC::Wasm::BBQPlan::didCompleteCompilation):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmLLIntPlan.cpp:
        (JSC::Wasm::LLIntPlan::didCompleteCompilation):
        * wasm/WasmOMGForOSREntryPlan.cpp:
        (JSC::Wasm::OMGForOSREntryPlan::work):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGEntryTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
        * yarr/YarrJIT.cpp:

2021-05-08  Darin Adler  <darin@apple.com>

        Remove calls to the String::toInt family of functions from JavaScriptCore
        https://bugs.webkit.org/show_bug.cgi?id=225571

        Reviewed by Sam Weinig.

        * inspector/agents/InspectorDebuggerAgent.cpp:
        (Inspector::parseLocation): Use parseIntegerAllowingTrailingJunk<JSC::SourceID>
        instead of String::toIntPtr. There was no reason to parse the source ID as a
        signed integer, and it's more elegant to parse the type we intend to store and
        process, not a different but similar type.
        (Inspector::InspectorDebuggerAgent::searchInContent): Ditto.
        (Inspector::InspectorDebuggerAgent::getScriptSource): Ditto.

        * inspector/agents/InspectorRuntimeAgent.cpp:
        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets): Use
        parseInteger<uintptr_t> instead of String::toIntPtrStrict.
        (Inspector::InspectorRuntimeAgent::getBasicBlocks): Use
        parseIntegerAllowingTrailingJunk<uintptr_t> instead of String::toIntPtr.

        * runtime/FuzzerPredictions.cpp:
        (JSC::FuzzerPredictions::FuzzerPredictions): Use parseInteger<uint64_t>
        instead of String::toUInt64Strict.

2021-05-08  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Fix invalid exception checks after recent ErrorInstance changes
        https://bugs.webkit.org/show_bug.cgi?id=225565

        Reviewed by Alexey Shvayka.

        r277221 and r277224 each introduced issues under validateExceptionChecks=1; this patch fixes them.

        Of particular note:
        The earlier patch sought to consolidate Error#cause logic under ErrorInstance::finishCreation.
        This part must be undone as it is crucial that non-user-thrown errors be able to bypass that logic
        (otherwise throwException itself would need to be exception-checked).

        * runtime/AggregateError.cpp:
        (JSC::createAggregateError):
        * runtime/ArrayPrototype.cpp:
        (JSC::getProperty):
        * runtime/Error.cpp:
        (JSC::createError):
        (JSC::createEvalError):
        (JSC::createRangeError):
        (JSC::createReferenceError):
        (JSC::createSyntaxError):
        (JSC::createTypeError):
        (JSC::createURIError):
        (JSC::createGetterTypeError):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::create):
        (JSC::ErrorInstance::finishCreation):
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::create):
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getIfPropertyExists):
        * runtime/NullSetterFunction.cpp:
        (JSC::NullSetterFunctionInternal::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/JSWebAssemblyCompileError.cpp:
        (JSC::createJSWebAssemblyCompileError):
        * wasm/js/JSWebAssemblyLinkError.cpp:
        (JSC::createJSWebAssemblyLinkError):
        * wasm/js/JSWebAssemblyRuntimeError.cpp:
        (JSC::createJSWebAssemblyRuntimeError):

2021-05-08  Chris Dumez  <cdumez@apple.com>

        Port Filesystem::pathByAppendingComponent() & Filesystem:: pathByAppendingComponents() to std::filesystem
        https://bugs.webkit.org/show_bug.cgi?id=225550

        Reviewed by Darin Adler.

        Build fix.

        * Configurations/JavaScriptCore.xcconfig:

2021-05-08  Ross Kirsling  <ross.kirsling@sony.com>

        Introduce JSObject::getIfPropertyExists helper
        https://bugs.webkit.org/show_bug.cgi?id=225553

        Reviewed by Alexey Shvayka.

        Suggested by Alexey during review of r277221.
        ArrayPrototype also has a "Has-guarded Get", so it's helpful for JSObject to house this functionality.

        * runtime/ArrayPrototype.cpp:
        (JSC::getProperty):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::finishCreation):
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getIfPropertyExists):

2021-05-07  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Error#cause must recognize explicit undefined
        https://bugs.webkit.org/show_bug.cgi?id=225535

        Reviewed by Alexey Shvayka.

        Error#cause is specified such that `new Error(message, {})` and `new Error(message, { cause: undefined })`
        are not the same -- namely, the latter should create a property descriptor with an undefined `value`.

        This would seem absurd, but the reason is because the `cause` field is meant to store a thrown object,
        and `throw undefined;` is valid code.

        In aligning our implementation with the spec, this patch also consolidates the relevant logic in one place
        (ErrorInstance::finishCreation) to minimize confusion.

        * runtime/AggregateError.cpp:
        (JSC::createAggregateError):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::create):
        (JSC::ErrorInstance::finishCreation):
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::create):

2021-05-06  Chris Dumez  <cdumez@apple.com>

        Port Filesystem::fileMetadata() & Filesystem::getFileModificationTime() to std::filesystem
        https://bugs.webkit.org/show_bug.cgi?id=225362

        Reviewed by Darin Adler.

        Build fix.

        * Configurations/JavaScriptCore.xcconfig:

2021-05-06  Eleni Maria Stea  <estea@igalia.com>

        Removed the assertion m_numParameters >= 0, it is always true as
        m_numParameters is unsigned.
        https://bugs.webkit.org/show_bug.cgi?id=225457

        Reviewed by Yusuke Suzuki.

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::numberOfArgumentValueProfiles):

2021-05-06  Filip Pizlo  <fpizlo@apple.com>

        Make some things easier to dataLog in wasm
        https://bugs.webkit.org/show_bug.cgi?id=225472

        Reviewed by Yusuke Suzuki.

        * wasm/WasmMemoryMode.cpp:
        (WTF::printInternal):
        * wasm/WasmMemoryMode.h:
        * wasm/WasmWorklist.cpp:
        (JSC::Wasm::Worklist::dump const):
        * wasm/WasmWorklist.h:

2021-05-06  Filip Pizlo  <fpizlo@apple.com>

        Reduce use of dmb ish on ARM64
        https://bugs.webkit.org/show_bug.cgi?id=225465

        Reviewed by Keith Miller.
        
        We use loadLoadFence a lot, often in situations like:
        
        Foo* ptr = loadStuff;
        loadLoadFence();
        use ptr
        
        On ARM64, we don't need a dmb ish here.  This introduces a dependentLoadLoadFence() for these
        cases; it's just a compiler fence on ARM64 and Intel.

        We also used loadLoadFence in some places where I couldn't think of any good reason for the
        fence other than paranoia. I got rid of those.

        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFromCallLinkInfo):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::jitType const):
        * bytecode/ObjectAllocationProfile.h:
        (JSC::ObjectAllocationProfileBase::structure):
        (JSC::ObjectAllocationProfileWithPrototype::prototype):
        * bytecode/Watchpoint.h:
        (JSC::WatchpointSet::state const):
        (JSC::InlineWatchpointSet::state const):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::handlePutByVal):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
        * runtime/GetterSetter.h:
        * runtime/InferredValue.h:
        (JSC::InferredValue::state const):
        * runtime/Structure.h:
        (JSC::Structure::tryRareData):
        * runtime/StructureInlines.h:
        (JSC::Structure::propertyReplacementWatchpointSet):

2021-05-06  Filip Pizlo  <fpizlo@apple.com>

        It should be possible to --logJIT=true
        https://bugs.webkit.org/show_bug.cgi?id=225464

        Reviewed by Mark Lam.

        This makes it easy to just log when JITing happens. It's like --dumpDisassembly=true but
        without the disassembly.

        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::finalizeCodeWithDisassemblyImpl):
        * assembler/LinkBuffer.h:
        * runtime/Options.cpp:
        (JSC::Options::recomputeDependentOptions):
        * runtime/OptionsList.h:

2021-05-06  Mark Lam  <mark.lam@apple.com>

        Forbid further execution in jsc shell if execution is terminated.
        https://bugs.webkit.org/show_bug.cgi?id=225410
        rdar://77548608

        Reviewed by Michael Saboff.

        1. Introduce a VM::m_executionForbidden flag.
        2. In the jsc shell, forbid further execution if termination was encountered.

        * jsc.cpp:
        (runWithOptions):
        * runtime/VM.cpp:
        (JSC::VM::drainMicrotasks):
        * runtime/VM.h:
        (JSC::VM::executionForbidden const):
        (JSC::VM::setExecutionForbidden):

2021-05-06  Mark Lam  <mark.lam@apple.com>

        Fix missing exception check in objectConstructorGetOwnPropertyDescriptors().
        https://bugs.webkit.org/show_bug.cgi?id=225413
        rdar://77551530

        Reviewed by Michael Saboff.

        Need to handle TerminationException.

        * runtime/ObjectConstructor.cpp:
        (JSC::objectConstructorGetOwnPropertyDescriptors):

2021-05-05  Mark Lam  <mark.lam@apple.com>

        Introduce VM::hasPendingTerminationException() to make code a little more terse.
        https://bugs.webkit.org/show_bug.cgi?id=225412

        Reviewed by Michael Saboff.

        This is purely a refactoring patch.  There is no behavior change.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):
        * jit/JITOperations.cpp:
        * runtime/ExceptionScope.h:
        (JSC::ExceptionScope::assertNoExceptionExceptTermination):
        (JSC::ExceptionScope::releaseAssertNoExceptionExceptTermination):
        * runtime/JSObject.h:
        (JSC::JSObject::get const):
        * runtime/LazyPropertyInlines.h:
        (JSC::ElementType>::callFunc):
        * runtime/VM.cpp:
        (JSC::VM::throwException):
        * runtime/VM.h:
        (JSC::VM::hasPendingTerminationException const):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::deferTerminationSlow):

2021-05-05  Mark Lam  <mark.lam@apple.com>

        Enable incremental sweeping of GCAwareJITStubRoutines.
        https://bugs.webkit.org/show_bug.cgi?id=225376

        Reviewed by Filip Pizlo.

        This patch makes the following changes:

        1. Enhance JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines() to be able to
           run in an incremental time slice.

        2. Added JITStubRoutineSet::notifyHaveRoutinesToDelete() so that
           GCAwareJITStubRoutine::observeZeroRefCount() can flag that the GC may have
           some dead GCAwareJITStubRoutines to delete.

        3. Added JITStubRoutineSet::mayHaveRoutinesToDelete() so that clients can do
           a cheap check ahead of time to determine if there's work to do, and avoid
           calling JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines() altogether
           if not needed.

        4. Added Heap::mayHaveJITStubRoutinesToDelete() and Heap::deleteDeadJITStubRoutines()
           as wrappers around JITStubRoutineSet::mayHaveRoutinesToDelete() and
           JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines() because the use of
           the JITStubRoutineSet is a heap internal implementation detail.

        5. Enhanced the IncrementalSweeper to also call Heap::deleteDeadJITStubRoutines()
           if needed.

        6. Enhanced Heap::sweepSynchronously() to also call Heap::deleteDeadJITStubRoutines()
           if needed.

        7. Time slices for Heap::deleteDeadJITStubRoutines() is currently set at the
           current values:
           a. max of 1 ms (1/10 of the IncreamentalSweeper's time slice) when invoked from
              the IncreamentalSweeper.
           b. max of 5 ms when invoked from Heap::deleteUnmarkedCompiledCode().
           c. unlimited time (with a sanity check) when called from Heap::sweepSynchronously().

           The choices of 1ms and 5ms were picked to not be too long, but would still delete
           the bulk of the dead GCAwareJITStubRoutines quickly enough based on data from my
           instrumented runs the CLI version of JetStream2.

           I think these hardcoded values will do for now.  If need be, we can try something
           more sophisticated later.

        * CMakeLists.txt:
        * heap/Heap.cpp:
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepSynchronously):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::mayHaveJITStubRoutinesToDelete):
        (JSC::Heap::deleteDeadJITStubRoutines):
        * heap/IncrementalSweeper.cpp:
        (JSC::IncrementalSweeper::doSweep):
        * heap/JITStubRoutineSet.cpp:
        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
        * heap/JITStubRoutineSet.h:
        (JSC::JITStubRoutineSet::mayHaveRoutinesToDelete):
        (JSC::JITStubRoutineSet::notifyHaveRoutinesToDelete):
        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
        * jit/JITStubRoutine.h:
        (JSC::JITStubRoutine::createSelfManagedRoutine): Deleted.

2021-05-03  Mark Lam  <mark.lam@apple.com>

        Fix syntax error message for AUTOPLUSPLUS token.
        https://bugs.webkit.org/show_bug.cgi?id=225308
        rdar://76830934

        Reviewed by Saam Barati.

        For the record, it's not easy to tell from the code why AUTOPLUSPLUS is needed.
        It's needed to distinguish this:
            ```
            statement ++ stuff  // ++ is a postfix operator applied to `statement`.
            ```
        from this:
            ```
            statement
            ++stuff    // The `\n` before the ++ makes it a prefix operator applied to `stuff``.
            ```

        If we merely tokenize the ++ as a PLUSPLUS token, then it's unclear whether it acts
        as a postfix or prefix token in the 2nd case above.

        This is why the correct fix is not to get rid of the AUTOPLUSPLUS token, but to
        teach the syntax error message to be aware of the AUTOPLUSPLUS token.

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseUnaryExpression):

2021-05-03  Chris Dumez  <cdumez@apple.com>

        Restore pre-r276879 behavior for FileSystem::deleteFile() and FileSystem::deleteEmptyDirectory()
        https://bugs.webkit.org/show_bug.cgi?id=225289

        Reviewed by Darin Adler.

        Fix build.

        * Configurations/JavaScriptCore.xcconfig:

2021-05-03  Mark Lam  <mark.lam@apple.com>

        Add some missing exception checks before some jsCasts.
        https://bugs.webkit.org/show_bug.cgi?id=225264
        rdar://77381608

        Reviewed by Saam Barati.

        Introducing JSObject::getAs() and JSValue::getAs() convenience methods that will
        check for an exception before doing a jsCast on the get result.  We only need this
        to placate the assertion in jsCast in the event a pending exception exists at the
        time of the jsCast.  If ASSERTs are not enabled, this will be a no-op.  All clients
        that use jsCast this way (and now use getAs instead) will already be doing an
        exception check immediately after.  Hence, they are already doing the right thing
        in terms of handling exceptions.  We're only placating the jsCast assertion here.

        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::hostResolveImportedModule):
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::getAs const):
        * runtime/JSInternalPromise.cpp:
        (JSC::JSInternalPromise::then):
        * runtime/JSModuleLoader.cpp:
        (JSC::JSModuleLoader::dependencyKeysIfEvaluated):
        (JSC::JSModuleLoader::provideFetch):
        (JSC::JSModuleLoader::loadAndEvaluateModule):
        (JSC::JSModuleLoader::loadModule):
        (JSC::JSModuleLoader::linkAndEvaluateModule):
        (JSC::JSModuleLoader::requestImportModule):
        * runtime/JSObject.h:
        (JSC::JSObject::getAs const):
        * runtime/JSPromise.cpp:
        (JSC::JSPromise::createDeferredData):
        * runtime/VM.h:

2021-05-03  Dmitry Bezhetskov  <dbezhetskov@igalia.com>

        [WASM-Function-References] Add call_ref instruction
        https://bugs.webkit.org/show_bug.cgi?id=222903

        Reviewed by Yusuke Suzuki.

        Add support for call_ref instruction from the typed function
        references proposal: https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md.
        call_ref calls the given function references from the stack 
        and it does almost the same stuff as call_indirect but
        it doesn't check signatures because wasm types system guaranties
        correctness.

        * bytecode/BytecodeList.rb:
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * llint/LowLevelInterpreter.asm:
        * llint/WebAssembly.asm:
        * runtime/Gate.h:
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::addCallIndirect):
        (JSC::Wasm::AirIRGenerator::addCallRef):
        (JSC::Wasm::AirIRGenerator::emitIndirectCall):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitIndirectCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        (JSC::Wasm::B3IRGenerator::addCallRef):
        * wasm/WasmFunctionParser.h:
        (JSC::Wasm::FunctionParser<Context>::parseExpression):
        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::addCallRef):
        * wasm/WasmSlowPaths.cpp:
        (JSC::LLInt::doWasmCallRef):
        (JSC::LLInt::WASM_SLOW_PATH_DECL):
        * wasm/WasmSlowPaths.h:
        * wasm/js/JSWebAssemblyTable.cpp:
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::WebAssemblyFunction):
        * wasm/js/WebAssemblyFunction.h:
        * wasm/js/WebAssemblyFunctionBase.cpp:
        (JSC::WebAssemblyFunctionBase::WebAssemblyFunctionBase):
        * wasm/js/WebAssemblyFunctionBase.h:
        (JSC::WebAssemblyFunctionBase::offsetOfEntrypointLoadLocation):
        * wasm/js/WebAssemblyWrapperFunction.cpp:
        (JSC::WebAssemblyWrapperFunction::WebAssemblyWrapperFunction):
        * wasm/js/WebAssemblyWrapperFunction.h:
        * wasm/wasm.json:

2021-05-01  Chris Dumez  <cdumez@apple.com>

        Start leveraging std::filesystem in WTF::FileSystem
        https://bugs.webkit.org/show_bug.cgi?id=225255

        Reviewed by Sam Weinig.

        Unexport some symbols to fix build.

        * Configurations/JavaScriptCore.xcconfig:

2021-04-30  Filip Pizlo  <fpizlo@apple.com>

        Make small JIT pool tests pass on AS
        https://bugs.webkit.org/show_bug.cgi?id=225256

        Reviewed by Mark Lam.

        If we ask for a JIT pool that is smaller than the smallest possible "region" (thing with jump
        island) that we can create -- i.e. smaller than a jump region, then assume that the user is
        asking us to create a pool that has that much usable space plus a jump region.

        I think that this makes the option easier to use when you're testing ridiculously small JIT
        pools, which we happen to do in our test suite.

        Also remove some dead options I didn't mean to commit.

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):
        * runtime/OptionsList.h:

2021-04-30  Filip Pizlo  <fpizlo@apple.com>

        Make the JIT pool smaller on AS
        https://bugs.webkit.org/show_bug.cgi?id=225249

        Reviewed by Saam Barati.

        This adds three related features:

        - Makes it easy to dump where the JIT pool was allocated.

        - Makes it possible to override the JIT pool size with Options even with jump islands.

        - Changes the default JIT pool size on AS to 512MB.

        Estimated 2% speed-up on JetStream2, 1.5% speed-up on Speedometer2.

        * jit/ExecutableAllocator.cpp:
        (JSC::initializeJITPageReservation):
        * runtime/OptionsList.h:

2021-04-29  Saam Barati  <sbarati@apple.com>

        Inlining property accesses inside constant folding should check Options::useAccessInlining
        https://bugs.webkit.org/show_bug.cgi?id=225194

        Reviewed by Mark Lam.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        (JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset):

2021-04-29  Saam Barati  <sbarati@apple.com>

        Sampling profiler should dump a tier breakdown, and add ability to see time spent in C code with sampleCCode=0, and fix bugs with frames having the wrong jitType if they're inlined
        https://bugs.webkit.org/show_bug.cgi?id=225116

        Reviewed by Yusuke Suzuki.

        This patch makes it so we also dump time spent in each tier when dumping top
        bytecodes. This can be helpful info when analyzing benchmarks.
        
        This patch also makes it so we know when we're in C/C++ code when we're not
        using the sampleCCode=true option. I found some weird performance pathologies
        with that option that cause us to not sample code at all. I was seeing ~50
        samples taken for ~7 seconds of code running time. It's worth figuring out
        what's going on there eventually. But for now, I've made it so that we
        recognize that the top frame is C/C++ when using the collectExtraSamplingProfilerData=1
        option.
        
        This patch also fixes a bug where we mis-attribute JITTypes for inline
        frames. We'd attribute it to whatever the CodeBlock was compiled as, instead
        of using the machine frame's JITType.

        * jsc.cpp:
        (CommandLine::parseArguments):
        * runtime/OptionsList.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        (JSC::SamplingProfiler::processUnverifiedStackTraces):
        (JSC::SamplingProfiler::StackFrame::displayName):
        (JSC::SamplingProfiler::reportTopBytecodes):

2021-04-28  Mark Lam  <mark.lam@apple.com>

        Fix exception assertions in light of the TerminationException.
        https://bugs.webkit.org/show_bug.cgi?id=225128
        rdar://76694909

        Reviewed by Robin Morisset.

        Some pre-existing functions assertNoException() or releaseAssertNoException().
        These assertion may not be valid anymore in light of the TerminationException, and
        require some fix up:

        1. If it makes sense to convert the assertion into an exception check, then do so.

           For example, see objectPrototypeToString(), slow_path_create_this().

        2. If the assertion is at the end of a function just before it returns, or if the
           remaining code in the function will not be affected by the pending exception,
           then we can replace the assertion as follows:

               assertNoException() => assertNoExceptionExceptTermination()
               releaseAssertNoException() => releaseAssertNoExceptionExceptTermination()

           For example, see objectPrototypeHasOwnProperty(), JSObject::getOwnNonIndexPropertyNames().

        3. If the assertion is in a function where perf is not absolutely critical, and the
           function isn't calling any other functions that will re-enter the VM or potentially
           get stuck in an infinite loop, then we can use a DeferTermination scope to defer
           termination.

           For example, see Debugger::pauseIfNeeded(), SamplingProfiler::StackFrame::nameFromCallee().

        4. If the assertion is in an initializer function is only run once and adding
           exception checks would complicate the code more than it's worth (an engineering
           judgement), then use a DeferTermination scope.

           For example, see ProgramExecutable::initializeGlobalProperties(), setupAdaptiveWatchpoint().

           Some leaf (or near-leaf) functions that currently DECLARE_CATCH_SCOPE() may also
           fall under this category.

           For example, see JSFunction::prototypeForConstruction().

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::addBigIntConstant):
        * debugger/Debugger.cpp:
        (JSC::Debugger::pauseIfNeeded):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * interpreter/Interpreter.cpp:
        (JSC::notifyDebuggerOfUnwinding):
        (JSC::Interpreter::executeProgram):
        (JSC::Interpreter::debug):
        * interpreter/ShadowChicken.cpp:
        (JSC::ShadowChicken::functionsOnStack):
        * jsc.cpp:
        (runWithOptions):
        * parser/ParserArena.cpp:
        (JSC::IdentifierArena::makeBigIntDecimalIdentifier):
        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::finishCreation):
        * runtime/CommonSlowPaths.cpp:
        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::sanitizedMessageString):
        (JSC::ErrorInstance::sanitizedNameString):
        * runtime/ExceptionScope.h:
        (JSC::ExceptionScope::assertNoExceptionExceptTermination):
        (JSC::ExceptionScope::releaseAssertNoExceptionExceptTermination):
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::prototypeForConstruction):
        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
        (JSC::genericTypedArrayViewProtoFuncIncludes):
        (JSC::genericTypedArrayViewProtoFuncIndexOf):
        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
        * runtime/JSGlobalObject.cpp:
        (JSC::setupAdaptiveWatchpoint):
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::defineOwnProperty):
        (JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
        * runtime/JSModuleLoader.cpp:
        (JSC::printableModuleKey):
        * runtime/JSModuleNamespaceObject.cpp:
        (JSC::JSModuleNamespaceObject::finishCreation):
        * runtime/JSObject.cpp:
        (JSC::JSObject::ordinaryToPrimitive const):
        (JSC::JSObject::getOwnNonIndexPropertyNames):
        * runtime/JSTemplateObjectDescriptor.cpp:
        (JSC::JSTemplateObjectDescriptor::createTemplateObject):
        * runtime/JSTypedArrayViewPrototype.cpp:
        * runtime/ObjectPrototype.cpp:
        (JSC::objectPrototypeHasOwnProperty):
        (JSC::objectPrototypeToString):
        * runtime/ProgramExecutable.cpp:
        (JSC::ProgramExecutable::initializeGlobalProperties):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
        * tools/JSDollarVM.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-04-28  Daniel Kolesa  <dkolesa@igalia.com>

        [WPE][GTK] More correct fixes for stack size issues on musl libc
        https://bugs.webkit.org/show_bug.cgi?id=225099

        Reviewed by Adrian Perez de Castro.

        Partial revert https://bugs.webkit.org/show_bug.cgi?id=210068

        After fixing the thread stack issues in WTF properly, we can revert
        the JSC options changes, which are actually harmful since they result
        in JSC being unstable. Previously, softReservedZoneSize was causing a
        crash when set to 128K because of the main thread stack bounds, and
        this is now fixed. We can keep the maxPerThreadStackUsage at 5M as
        well; there is no fundamental difference from how things are done on
        glibc anymore.

        * runtime/OptionsList.h:

2021-04-27  Filip Pizlo  <fpizlo@apple.com>

        Get the bytecode profiler working again
        https://bugs.webkit.org/show_bug.cgi?id=225129

        Reviewed by Saam Barati.

        The bytecode profiler was broken because it was trying to look at unset labels. This patch
        improves our label discipline a bit so we don't try to look at unset labels.

        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::linkOSRExits):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):

2021-04-27  Mark Lam  <mark.lam@apple.com>

        Move ExceptionExpectation into its own .h file.
        https://bugs.webkit.org/show_bug.cgi?id=225124

        Reviewed by Robin Morisset.

        Also fixed some compiler warnings.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * runtime/ExceptionExpectation.h: Added.
        * runtime/ExceptionHelpers.h:
        * runtime/HashMapImplInlines.h:
        (JSC::jsMapHashImpl):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):

2021-04-27  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Remove defaultValue() from the method table
        https://bugs.webkit.org/show_bug.cgi?id=225032

        Reviewed by Darin Adler.

        This patch not only removes the unnecessary method table entry, but also makes
        the presence of custom ToPrimitive behavior observable to userland code.

        To maintain object identity and (possibly) enable caching, Symbol.toPrimitive
        method is stored on a structure. To avoid any potential breakage, it's made
        replaceable and configurable, covering the case when its holder is a [[ProxyTarget]].

        For JSCallbackObject, Symbol.toPrimitive method is created only if ConvertToType
        callback is present, before initialization is performed.

        Also, this change adds additional ordinaryToPrimitive() cast to fix the invariant
        that toPrimitive() returns a primitive value, which was broken if ConvertToType
        callback returned an object. The invariant is enforced by the spec [1][2] and is
        validated via assertion in JSValue::toStringSlowCase().

        [1]: https://tc39.es/ecma262/#sec-toprimitive (step 2.b.vi)
        [2]: https://tc39.es/ecma262/#sec-ordinarytoprimitive (step 6)

        * API/JSCallbackObject.h:
        * API/JSCallbackObjectFunctions.h:
        (JSC::JSCallbackObject<Parent>::init):
        (JSC::JSCallbackObject<Parent>::customToPrimitive):
        (JSC::JSCallbackObject<Parent>::defaultValue): Deleted.
        * API/tests/testapiScripts/testapi.js:
        * runtime/ClassInfo.h:
        * runtime/JSCell.cpp:
        (JSC::JSCell::defaultValue): Deleted.
        * runtime/JSCell.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::toPrimitive const):
        (JSC::JSObject::defaultValue): Deleted.
        * runtime/JSObject.h:
        * runtime/Operations.cpp:
        (JSC::jsAddSlowCase):

2021-04-27  Keith Miller  <keith_miller@apple.com>

        StructureStubInfo and PolymorphicAccess should account for their non-GC memory
        https://bugs.webkit.org/show_bug.cgi?id=225113

        Reviewed by Mark Lam.

        We don't pass the ConcurrentJSLocker to the helper methods here since the
        DECLARE_VISIT_AGGREGATE macro does not allow for extra parameters to be passed.
        I filed https://bugs.webkit.org/show_bug.cgi?id=225114 to track that.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::JITData::size const):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::extraMemoryInBytes const):
        * bytecode/PolymorphicAccess.h:
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::extraMemoryInBytes):
        * bytecode/StructureStubInfo.h:

2021-04-26  Keith Miller  <keith_miller@apple.com>

        UnlinkedCodeBlock should have better accounting for extra memory
        https://bugs.webkit.org/show_bug.cgi?id=225080

        Reviewed by Mark Lam.

        Right now we aren't telling the JS GC about the extra memory
        attached to UnlinkedCodeBlocks. It looks like on at least some sites this
        can be a fairly large percentage of the total memory retained by
        the JS object graph. This is very similar to the change we made for
        CodeBlocks in r276610.

        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::visitChildrenImpl):
        (JSC::UnlinkedCodeBlock::RareData::sizeInBytes const):
        * bytecode/UnlinkedCodeBlock.h:

2021-04-26  Alex Christensen  <achristensen@webkit.org>

        Update Mac-specific CMake files
        https://bugs.webkit.org/show_bug.cgi?id=225064

        Rubber-stamped by Tim Horton.

        * PlatformMac.cmake:

2021-04-26  Mark Lam  <mark.lam@apple.com>

        %TypedArray%.prototype.sort() should not use a regular array as a temp buffer.
        https://bugs.webkit.org/show_bug.cgi?id=225062
        rdar://77021547

        Reviewed by Yusuke Suzuki.

        %TypedArray%.prototype.sort() should not be affected by property changes in
        Array.prototype.

        References:
        [1] https://tc39.es/ecma262/#sec-%typedarray%.prototype.sort
        [2] https://tc39.es/ecma262/#sec-array.prototype.sort
        [3] https://tc39.es/ecma262/#sec-sortcompare

        * builtins/TypedArrayPrototype.js:
        (globalPrivate.typedArrayMergeSort):

2021-04-26  Keith Miller  <keith_miller@apple.com>

        CodeBlock should do a better job accounting for extra memory it allocates.
        https://bugs.webkit.org/show_bug.cgi?id=225068

        Reviewed by Mark Lam.

        Right now we aren't telling the JS GC about the extra memory
        attached to CodeBlocks. It looks like on at least some sites this
        can be a fairly large percentage of the total memory retained by
        the JS object graph.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::JITData::size const):
        * bytecode/CodeBlock.h:
        * jit/JITCodeMap.h:
        (JSC::JITCodeMap::memorySize const):

2021-04-26  Keith Miller  <keith_miller@apple.com>

        numCalleeLocals, numParameters, and numVars should be unsigned
        https://bugs.webkit.org/show_bug.cgi?id=224995

        Reviewed by Mark Lam.

        All of the various CodeBlock classes currently have the
        numCalleeLocals and numVars marked as ints. I believe this is just
        a historical artifact or because VirtualRegister's offset is an
        int to make handling constants easier. Regardless, it's a bit
        strange to not handle the sign conversion at the point of
        comparison between a VirtualRegister offset and the local/var
        count. This doesn't completely fix every place we use ints for
        these values but starts on the right track. Lastly, I also added
        some Check<unsigned>s to the wasm parser for sanity checking.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setNumParameters):
        (JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::numParameters const):
        (JSC::CodeBlock::numberOfArgumentsToSkip const):
        (JSC::CodeBlock::numCalleeLocals const):
        (JSC::CodeBlock::numVars const):
        (JSC::CodeBlock::numTmps const):
        (JSC::CodeBlock::addressOfNumParameters):
        (JSC::CodeBlock::isTemporaryRegister):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::numCalleeLocals const):
        (JSC::UnlinkedCodeBlock::numVars const):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::numCalleeLocals const):
        (JSC::UnlinkedCodeBlockGenerator::numVars const):
        (JSC::UnlinkedCodeBlockGenerator::setNumCalleeLocals):
        (JSC::UnlinkedCodeBlockGenerator::setNumVars):
        (JSC::UnlinkedCodeBlockGenerator::setNumParameters):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::generate):
        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
        * bytecompiler/BytecodeGeneratorBaseInlines.h:
        (JSC::BytecodeGeneratorBase<Traits>::newRegister):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
        (JSC::DFG::ByteCodeParser::inliningCost):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGOSREntrypointCreationPhase.cpp:
        (JSC::DFG::OSREntrypointCreationPhase::run):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        * ftl/FTLOSREntry.cpp:
        (JSC::FTL::prepareOSREntry):
        * interpreter/CallFrameClosure.h:
        * interpreter/ProtoCallFrameInlines.h:
        (JSC::ProtoCallFrame::init):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        * runtime/CommonSlowPaths.h:
        (JSC::CommonSlowPaths::numberOfStackPaddingSlots):
        (JSC::CommonSlowPaths::numberOfStackPaddingSlotsWithExtraSlots):
        * wasm/WasmFunctionCodeBlock.h:
        (JSC::Wasm::FunctionCodeBlock::numVars const):
        (JSC::Wasm::FunctionCodeBlock::numCalleeLocals const):
        (JSC::Wasm::FunctionCodeBlock::setNumVars):
        (JSC::Wasm::FunctionCodeBlock::setNumCalleeLocals):
        * wasm/WasmLLIntGenerator.cpp:
        (JSC::Wasm::LLIntGenerator::push):
        (JSC::Wasm::LLIntGenerator::getDropKeepCount):
        (JSC::Wasm::LLIntGenerator::walkExpressionStack):
        (JSC::Wasm::LLIntGenerator::checkConsistency):
        (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
        (JSC::Wasm::LLIntGenerator::splitStack):
        (JSC::Wasm::LLIntGenerator::finalize):
        (JSC::Wasm::LLIntGenerator::callInformationForCaller):
        (JSC::Wasm::LLIntGenerator::addLoop):
        (JSC::Wasm::LLIntGenerator::addTopLevel):
        (JSC::Wasm::LLIntGenerator::addBlock):
        (JSC::Wasm::LLIntGenerator::addIf):
        (JSC::Wasm::LLIntGenerator::addElseToUnreachable):

2021-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] OrdinarySet should invoke custom [[Set]] methods
        https://bugs.webkit.org/show_bug.cgi?id=217916

        Reviewed by Yusuke Suzuki.

        This patch fixes putInlineSlow() to handle special properties (like JSFunction's "name"
        and JSArray's "length") in prototype chain. When such property is encountered, prototype
        chain traversal is stopped; if it's read-only, a TypeError is thrown in strict mode.

        This change adds OverridesPut out of line type info flag, and utilizes it in putInlineSlow()
        to invoke overriden methods. While this approach requires put() methods to be aware of
        altered receivers, it renders several benefits:
          1. put() method can be used for both "real" [[Set]] overrides and special properties,
             with its return value remaining `bool`;
          2. it is simpler, faster, and more predictable than calling [[GetOwnProperty]] in
             putInlineSlow() or adding defineOwnPropertyViaPut() to the method table.

        Removes ordinarySetSlow() for non-index properties, which didn't invoke some [[Set]]
        methods as well. Instead, definePropertyOnReceiver() is introduced for altered receivers,
        which performs correctly when reached because:
          1. all special properties were already handled (unless it's Reflect.set);
          2. performing putDirectInternal() is unobservable (unless ProxyObject was seen);
          3. putDirectInternal() now fully implements property definition of OrdinarySet [1];
          4. put() override is required if a spec defines custom [[DefineOwnProperty]].

        Since indexed puts handle overrides / altered receivers quite differently, they will
        be fixed in a follow-up, completely removing ordinarySetSlow().

        Also, by merging putEntry() / putToPrimitive() into putInlineSlow() and introducing
        putInlineFastReplacingStaticPropertyIfNeeded() helper, this patch fixes a few bugs:
          1. Direct [[Set]] to non-reified static property now preserves its attributes when replacing [[Value]].
          2. Prototype chain [[Set]] to non-reified static property now throws if receiver is non-extensible.
          3. Non-reified static writable property now shadows read-only one that is further in prototype chain.
          4. Non-reified static properties in prototype chain of a primitive are now considered.

        Fixes a few issues that were previously unobservable:
          1. PropertyAttribute::CustomValue is now unset when a setter-less property is reassigned.
          2. uint64_t putByIndexInline() now calls put() via method table like uint32_t counterpart.

        Other notable refactors:
          1. Inlines callCustomSetter(), dropping weird TriState return value.
          2. Simplifies initialization of StringPrototype.
          3. Simplifies isThisValueAltered() to pointer comparisons at non-JSProxy call sites.
          4. Removes doPutPropertySecurityCheck() methods as the same checks are performed by put() methods.
          5. Removes prototypeChainMayInterceptStoreTo(), which pretty much duplicated canPerformFastPutInline().
          6. Removes dummy JSArrayBufferView::put() method.
          7. Removes now unused lookupPut().

        Aligns JSC with V8 and SpiderMonkey.

        This patch carefully preserves the current behavior of Reflect.set with CustomValue
        and prototype chain [[Set]] to a JSCallbackObject / legacy platform object.

        This change is performance-neutral on /put/ microbenchmarks as it doesn't affect
        caching, only the slow path. Reflect.set with JSFinalObject receiver is 130% faster.
        putInlineSlow() microbenchmarks progress by 4-18%.

        [1]: https://tc39.es/ecma262/#sec-ordinarysetwithowndescriptor (step 3)

        * API/JSCallbackObject.h:
        * API/JSCallbackObjectFunctions.h:
        (JSC::JSCallbackObject<Parent>::put):
        * API/tests/testapiScripts/testapi.js:
        * debugger/DebuggerScope.h:
        * runtime/ClassInfo.h:
        * runtime/ClonedArguments.h:
        * runtime/CustomGetterSetter.cpp:
        (JSC::callCustomSetter): Deleted.
        * runtime/CustomGetterSetter.h:
        * runtime/ErrorConstructor.h:
        * runtime/ErrorInstance.h:
        * runtime/GenericArguments.h:
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::put):
        * runtime/GetterSetter.h:
        * runtime/JSArray.cpp:
        (JSC::JSArray::put):
        * runtime/JSArray.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::put): Deleted.
        * runtime/JSArrayBufferView.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::putToPrimitive):
        * runtime/JSCell.cpp:
        (JSC::JSCell::doPutPropertySecurityCheck): Deleted.
        * runtime/JSCell.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::put):
        * runtime/JSFunction.h:
        * runtime/JSGenericTypedArrayView.h:
        * runtime/JSGlobalLexicalEnvironment.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::put):
        * runtime/JSGlobalObject.h:
        * runtime/JSLexicalEnvironment.h:
        * runtime/JSModuleEnvironment.h:
        * runtime/JSModuleNamespaceObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertySlot):
        (JSC::JSObject::putInlineSlow):
        (JSC::definePropertyOnReceiverSlow):
        (JSC::JSObject::definePropertyOnReceiver):
        (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded):
        (JSC::JSObject::doPutPropertySecurityCheck): Deleted.
        (JSC::JSObject::prototypeChainMayInterceptStoreTo): Deleted.
        * runtime/JSObject.h:
        (JSC::JSObject::putByIndexInline):
        (JSC::JSObject::hasNonReifiedStaticProperties):
        (JSC::JSObject::getOwnPropertySlot):
        (JSC::JSObject::putDirect):
        (JSC::JSObject::doPutPropertySecurityCheck): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::canPerformFastPutInlineExcludingProto):
        (JSC::JSObject::putInlineForJSObject):
        (JSC::JSObject::putInlineFast):
        (JSC::JSObject::putDirectInternal):
        * runtime/JSProxy.h:
        * runtime/JSTypeInfo.h:
        (JSC::TypeInfo::hasStaticPropertyTable const):
        (JSC::TypeInfo::overridesPut const):
        (JSC::TypeInfo::getOwnPropertySlotMayBeWrongAboutDontEnum const):
        (JSC::TypeInfo::hasPutPropertySecurityCheck const): Deleted.
        * runtime/Lookup.h:
        (JSC::putEntry): Deleted.
        (JSC::lookupPut): Deleted.
        * runtime/PropertySlot.h:
        * runtime/ProxyObject.cpp:
        (JSC::ProxyObject::put):
        * runtime/ProxyObject.h:
        * runtime/PutPropertySlot.h:
        (JSC::PutPropertySlot::PutPropertySlot):
        (JSC::PutPropertySlot::context const):
        (JSC::PutPropertySlot::isTaintedByOpaqueObject const):
        (JSC::PutPropertySlot::setIsTaintedByOpaqueObject):
        * runtime/ReflectObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::put):
        * runtime/RegExpObject.h:
        * runtime/StringObject.cpp:
        (JSC::StringObject::put):
        * runtime/StringObject.h:
        * runtime/StringPrototype.cpp:
        (JSC::StringPrototype::finishCreation):
        (JSC::StringPrototype::create):
        * runtime/StringPrototype.h:
        * runtime/Structure.cpp:
        (JSC::Structure::validateFlags):
        * runtime/Structure.h:
        (JSC::Structure::hasNonReifiedStaticProperties const):
        * tools/JSDollarVM.cpp:

2021-04-23  Michael Saboff  <msaboff@apple.com>

        [YARR Interpreter] Improper backtrack of parentheses with non-zero based greedy quantifiers
        https://bugs.webkit.org/show_bug.cgi?id=224983

        Reviewed by Mark Lam.

        When we backtrack a parentheses with a greedy non zero based quantifier,
        we don't properly restore for the case where we hadn't reached the minimum count.
        We now save the input position on entry and restore it when we backtrack for
        this case.  We also properly release the allocated ParenthesesDisjunctionContext's.

        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::Interpreter::matchParentheses):
        (JSC::Yarr::Interpreter::backtrackParentheses):

2021-04-23  Mark Lam  <mark.lam@apple.com>

        Fix B3 strength reduction for shl.
        https://bugs.webkit.org/show_bug.cgi?id=224913
        rdar://76978874

        Reviewed by Michael Saboff.

        If the operation can potentially either underflow or overflow, then the result
        can be any value.

        * b3/B3ReduceStrength.cpp:

2021-04-23  Fujii Hironori  <Hironori.Fujii@sony.com>

        [JSC][Win] callOperationNoExceptionCheck() also needs to support operations that return SlowPathReturnType
        https://bugs.webkit.org/show_bug.cgi?id=224964

        Reviewed by Yusuke Suzuki.

        r229989 (Bug 183655) added the x64 Windows support only for
        callOperation(), but for callOperationNoExceptionCheck().
        callOperationNoExceptionCheck() also needs the x64 Windows
        support.

        This change is a preparation for Bug 224920 that is going to use
        callOperationNoExceptionCheck instead of callOperation.

        * jit/JIT.h:
        (callOperation): Rewrote by using 'if constexpr' instead of SFINAE.
        (callOperationNoExceptionCheck): Added a new implementation for
        x64 Windows based on callOperation.

2021-04-23  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r276486.
        https://bugs.webkit.org/show_bug.cgi?id=224973

        broke windows build

        Reverted changeset:

        "[JSC][Win] callOperationNoExceptionCheck() also needs to
        support operations that return SlowPathReturnType"
        https://bugs.webkit.org/show_bug.cgi?id=224964
        https://trac.webkit.org/changeset/276486

2021-04-22  Fujii Hironori  <Hironori.Fujii@sony.com>

        [JSC][Win] callOperationNoExceptionCheck() also needs to support operations that return SlowPathReturnType
        https://bugs.webkit.org/show_bug.cgi?id=224964

        Reviewed by Yusuke Suzuki.

        r229989 (Bug 183655) added the x64 Windows support only for
        callOperation(), but for callOperationNoExceptionCheck().
        callOperationNoExceptionCheck() also needs the x64 Windows
        support.

        This change is a preparation for Bug 224920 that is going to use
        callOperationNoExceptionCheck instead of callOperation.

        * jit/JIT.h:
        (callOperation): Rewrote by using 'if constexpr' instead of SFINAE.
        (callOperationNoExceptionCheck): Added a new implementation for
        x64 Windows based on callOperation.

2021-04-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r276456.
        https://bugs.webkit.org/show_bug.cgi?id=224952

        Windows specific crash

        Reverted changeset:

        "[JSC} Remove exception checks from non-throwing function
        calls in Baseline JIT"
        https://bugs.webkit.org/show_bug.cgi?id=224920
        https://trac.webkit.org/changeset/276456

2021-04-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC} Remove exception checks from non-throwing function calls in Baseline JIT
        https://bugs.webkit.org/show_bug.cgi?id=224920

        Reviewed by Tadeu Zagallo.

        These functions are not taking JSGlobalObject and will not throw an error.
        Use callOperationNoExceptionCheck instead to avoid emitting unnecessary exception checks.

        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::emit_op_profile_type):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emitSlow_op_new_object):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_profile_type):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitWriteBarrier):

2021-04-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Baseline should have fast path for switch_imm
        https://bugs.webkit.org/show_bug.cgi?id=224521

        Reviewed by Tadeu Zagallo.

        This patch implements op_switch_imm fast path in Baseline.
        We have this fast path in LLInt, DFG, and FTL. So only Baseline lacks this.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_switch_imm):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_switch_imm):

2021-04-21  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DFG / FTL should inline switch_string
        https://bugs.webkit.org/show_bug.cgi?id=224578

        Reviewed by Mark Lam.

        Because of r275840 change, we no longer copy StringJumpTable when compiling DFG / FTL code.
        Instead we are using a pointer to UnlinkedStringTable stored in UnlinkedCodeBlock.
        This allows DFG / FTL to inline CodeBlock which includes op_switch_string. We were previously not able
        to do that because we cannot copy StringImpl in DFG / FTL concurrent compiler thread.

        1. We handle StringJumpTable / UnlinkedStringJumpTable in the same way as SimpleJumpTable / UnlinkedSimpleJumpTable.
        2. We put m_ctiDefault of StringJumpTable in the last element of m_ctiOffsets vector of StringJumpTable to make
           sizeof(StringJumpTable) small.
        3. We use m_indexInTable instead of m_branchOffset in FTL switch generation to make switch table dense.

        The microbenchmark shows 30% improvement because of unlocking inlining feature.

                                        ToT                     Patched

            switch-inlining       27.1238+-0.2708     ^     20.2630+-0.1477        ^ definitely 1.3386x faster

            <geometric>           27.1238+-0.2708     ^     20.2630+-0.1477        ^ definitely 1.3386x faster

        * bytecode/JumpTable.h:
        (JSC::StringJumpTable::ensureCTITable):
        (JSC::StringJumpTable::ctiForValue const):
        (JSC::StringJumpTable::ctiDefault const):
        (JSC::StringJumpTable::isEmpty const):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedStringJumpTable::indexForValue const):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGGraph.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::switchStringSlow):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLOperations.h:
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_switch_string):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_switch_string):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):

2021-04-21  Adrian Perez de Castro  <aperez@igalia.com>

        Non-unified build fixes, mid April 2021 edition
        https://bugs.webkit.org/show_bug.cgi?id=222652
        <rdar://problem/75262285>

        Unreviewed non-unified build fixes.

        * bytecode/JumpTable.cpp: Remove inclusion of wtf/text/StringHash.h
        * bytecode/JumpTable.h: Add missing inclusions of wtf/FixedVector.h and
        wtf/text/StringHash.h
        * bytecode/SpeculatedType.cpp: Add missing includes JSCJSValueInlines.h and
        JSCellInlines.h
        * bytecompiler/BytecodeGenerator.cpp: Move template method to header, remove now uneeded
        LinkTimeConstant.h include.
        * bytecompiler/BytecodeGenerator.h: Add include for LinkTimeConstant.h
        (JSC::BytecodeGenerator::emitDirectSetPrototypeOf): Template method moved here from
        BytecodeGenerator.cpp to avoid compile errors due to usage of missing template body
        definition.
        * dfg/DFGDesiredGlobalProperties.cpp: Add missing DFGDesiredWatchpoints.h include.
        * ftl/FTLAbstractHeap.cpp: Add missing JSCJSValueInlines.h include.
        * runtime/JSCustomGetterFunction.cpp: Add missing IdentifierInlines.h include.
        * runtime/JSCustomSetterFunction.cpp: Ditto.
        * runtime/SetPrototype.cpp: Add missing HashMapImplInlines.h include.
        * runtime/VMTraps.cpp: Add missing VMEntryScope.h include.
        * runtime/WeakSetConstructor.cpp: Add missing WeakMapImplInlines.h include.
        * runtime/WeakSetPrototype.cpp: Add missing includes for HashMapImplInlines.h and
        WeakMapImplInlines.h
        * wasm/js/JSWebAssemblyTable.cpp: Add missing ObjectConstructor.h include.

2021-04-20  Michael Catanzaro  <mcatanzaro@gnome.org>

        Static asserts in WasmAirIRGenerator.cpp and WasmB3IRGenerator.cpp trigger -Wnonnull warnings with GCC 11
        https://bugs.webkit.org/show_bug.cgi?id=224826

        Reviewed by Yusuke Suzuki.

        Rewrite these static asserts to avoid warnings when built with GCC 11. Credit to Jonathan
        Wakely for providing this mind-bending solution.

        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::AirIRGenerator::addCurrentMemory):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addCurrentMemory):

2021-04-20  Michael Catanzaro  <mcatanzaro@gnome.org>

        -Warray-bounds warning in AirAllocateRegistersByGraphColoring.cpp with GCC 11
        https://bugs.webkit.org/show_bug.cgi?id=224782

        Reviewed by Darin Adler.

        These warnings don't make any sense to me. Suppress them.

        * b3/air/AirAllocateRegistersByGraphColoring.cpp:

2021-04-20  Keith Miller  <keith_miller@apple.com>

        FullGCActivityCallback should use the percentage of pages uncompressed in RAM to determine deferral.
        https://bugs.webkit.org/show_bug.cgi?id=224817

        Reviewed by Filip Pizlo.

        Right now we try to determine if too many pages are paged out by
        dereferencing them and bailing out of the GC if we go over a
        deadline. While this works if the only goal is to avoid causing
        extensive thrashing on spinny disks (HDD), it doesn't prevent
        thrashing when access to disk is fast (e.g. SSD). This is because
        on fast disks the proportional time to load the memory from disk
        is much lower. Additionally, on SSDs in particular we don't want
        to load the pages into RAM then bail as that will force a
        different page onto disk, increasing wear.

        This patch switches to asking the OS if each MarkedBlock is paged
        out. Then if we are over a threshold we wait until we would have
        GC'd anyway. This patch uses the (maxVMGrowthFactor - 1) as the
        percentage of "slow" pages (paged out or compressed) needed to
        defer the GC. The idea behind that threshold is that if we add
        that many pages then the same number of pages would be forced
        out of RAM for us to do a GC anyway (in the limit).

        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::updatePercentageOfPagedOutPages):
        (JSC::BlockDirectory::isPagedOut): Deleted.
        * heap/BlockDirectory.h:
        * heap/FullGCActivityCallback.cpp:
        (JSC::FullGCActivityCallback::doCollection):
        * heap/Heap.cpp:
        (JSC::Heap::isPagedOut):
        * heap/Heap.h:
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::isPagedOut):
        * heap/MarkedSpace.h:
        * runtime/OptionsList.h:

2021-04-20  Don Olmstead  <don.olmstead@sony.com>

        [CMake] Don't use FORWARDING_HEADERS_DIR for JSC GLib headers
        https://bugs.webkit.org/show_bug.cgi?id=224821

        Reviewed by Michael Catanzaro.

        Use JavaScriptCoreGLib_FRAMEWORK_HEADERS_DIR and JavaScriptCoreGLib_DERIVED_SOURCES_DIR
        for GLib JSC headers instead of FORWARDING_HEADERS_DIR and DERIVED_SOURCES_DIR.

        * GLib.cmake:
        * PlatformGTK.cmake:

2021-04-20  Ben Nham  <nham@apple.com>

        LinkBuffer fails to build when MALLOC_HEAP_BREAKDOWN is enabled
        https://bugs.webkit.org/show_bug.cgi?id=224722

        Reviewed by Yusuke Suzuki.

        When ENABLE_MALLOC_HEAP_BREAKDOWN is set, LinkBuffer causes a build failure at link time
        since it never defines its debugHeap. Fix that.

        * assembler/LinkBuffer.cpp:

2021-04-20  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector for LLIntPrototypeLoadAdaptiveStructureWatchpoint vector
        https://bugs.webkit.org/show_bug.cgi?id=224729

        Reviewed by Darin Adler.

        Replace Vector<LLIntPrototypeLoadAdaptiveStructureWatchpoint> with FixedVector.

        * bytecode/CodeBlock.h:
        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:
        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::LLIntPrototypeLoadAdaptiveStructureWatchpoint):
        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::initialize):
        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setupGetByIdPrototypeCache):

2021-04-19  Mark Lam  <mark.lam@apple.com>

        Build fix for Debug -O3 after r276162.
        https://bugs.webkit.org/show_bug.cgi?id=224681
        rdar://76698113

        Not reviewed.

        * runtime/JSObject.cpp:

2021-04-19  Kimmo Kinnunen  <kkinnunen@apple.com>

        Enable -Wthread-safety, add attributes to custom lock classes, and provide macros to declare guards
        https://bugs.webkit.org/show_bug.cgi?id=221614
        <rdar://problem/74396781>

        Reviewed by David Kilzer.

        Add -Wthread-safety to compile flags.

        * Configurations/Base.xcconfig:

2021-04-18  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, build fix
        https://bugs.webkit.org/show_bug.cgi?id=224715

        * dfg/DFGDesiredWatchpoints.h:

2021-04-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not use Bag<> for DFG / FTL watchpoints
        https://bugs.webkit.org/show_bug.cgi?id=224715

        Reviewed by Darin Adler.

        While Bag<> is useful since its allocated memory will not be moved,
        this is really memory-inefficient data structure. Each entry gets a
        tail pointer (so adding 8 bytes) and we allocate each entry separately.

        In DFG and FTL, we are using Bag<> for watchpoints. But this is not necessary actually: thanks to
        concurrent compilers, our watchpoint registration is batched at the end of compilation. This means
        that we have a way to know how many watchpoints we should register at that point.

        In this patch, we introduce WatchpointCollector. In DesiredGlobalProperties, we run reallyAdd twice
        with WatchpointCollector. First time, we just count # of watchpoints. Then we allocate FixedVector<XXXWatchpoint>
        and install them. Since we do not (cannot) grow this fixed vector, watchpoint's address will not be changed as required.

        We also move DesiredGlobalProperties under DesiredWatchpoints since this basically registers watchpoints.

        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
        (JSC::AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase):
        (JSC::AdaptiveInferredPropertyValueWatchpointBase::initialize):
        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.h:
        * bytecode/CodeBlockJettisoningWatchpoint.h:
        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::initialize):
        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
        * dfg/DFGAdaptiveStructureWatchpoint.cpp:
        (JSC::DFG::AdaptiveStructureWatchpoint::AdaptiveStructureWatchpoint):
        (JSC::DFG::AdaptiveStructureWatchpoint::initialize):
        * dfg/DFGAdaptiveStructureWatchpoint.h:
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::validateReferences):
        (JSC::DFG::CommonData::clearWatchpoints):
        * dfg/DFGCommonData.h:
        * dfg/DFGDesiredGlobalProperties.cpp:
        (JSC::DFG::DesiredGlobalProperties::reallyAdd):
        * dfg/DFGDesiredGlobalProperties.h:
        * dfg/DFGDesiredWatchpoints.cpp:
        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
        (JSC::DFG::SymbolTableAdaptor::add):
        (JSC::DFG::FunctionExecutableAdaptor::add):
        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
        (JSC::DFG::DesiredWatchpoints::addLazily):
        (JSC::DFG::DesiredWatchpoints::reallyAdd):
        (JSC::DFG::DesiredWatchpoints::areStillValidOnMainThread):
        (JSC::DFG::WatchpointCollector::finalize):
        * dfg/DFGDesiredWatchpoints.h:
        (JSC::DFG::SetPointerAdaptor::add):
        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::watchGlobalProperty):
        * dfg/DFGGraph.h:
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::reallyAdd):
        (JSC::DFG::Plan::isStillValidOnMainThread):
        (JSC::DFG::Plan::cancel):
        * dfg/DFGPlan.h:
        (JSC::DFG::Plan::transitions):
        (JSC::DFG::Plan::globalProperties): Deleted.

2021-04-18  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Make more DFG/FTL data FixedVector/Vector
        https://bugs.webkit.org/show_bug.cgi?id=224713

        Reviewed by Darin Adler.

        1. DFG::JITCode::m_osrEntry / DFG::JITCode::m_osrExit / DFG::JITCode::m_speculationRecovery are changed to FixedVector.
           They are added at compiling time, and after that, these vectors are not modified. So when finalizing, we can easily make it FixedVector.
           We also change OSREntry::{m_reshufflings,m_expectedValues} to FixedVector and FixedOperands.
        2. FTL::JITCode::m_osrExit is changed from SegmentedVector to Vector. We are still using Vector since it also involves osrExitDescriptor.
           But later, we should merge m_osrExit to osrExitDescriptor. Vector is still better than SegmentedVector since it wastes several entries
           per segment. SegmentedVector was used to use a direct pointer of OSRExit (this is not possible in Vector since this pointer can be invalidated
           after growing), but usage of that is fairly limited so that we can just replace them with m_index + osrExit vector.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::tallyFrequentExitSites):
        * bytecode/Operands.h:
        (JSC::Operands::Operands):
        * dfg/DFGJITCode.cpp:
        (JSC::DFG::JITCode::shrinkToFit):
        (JSC::DFG::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
        (JSC::DFG::JITCode::validateReferences):
        (JSC::DFG::JITCode::findPC):
        (JSC::DFG::JITCode::finalizeOSREntrypoints):
        * dfg/DFGJITCode.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::linkOSRExits):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::noticeOSREntry):
        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::appendOSRExit):
        (JSC::DFG::JITCompiler::appendSpeculationRecovery):
        * dfg/DFGOSREntry.h:
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::speculationCheck):
        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
        (JSC::DFG::SpeculativeJIT::linkOSREntries):
        * ftl/FTLJITCode.cpp:
        (JSC::FTL::JITCode::shrinkToFit):
        (JSC::FTL::JITCode::validateReferences):
        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
        (JSC::FTL::JITCode::findPC):
        * ftl/FTLJITCode.h:
        * ftl/FTLOSRExit.cpp:
        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
        (JSC::FTL::OSRExit::OSRExit):
        * ftl/FTLOSRExit.h:
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLOSRExitHandle.cpp:
        (JSC::FTL::OSRExitHandle::emitExitThunk):
        * ftl/FTLOSRExitHandle.h:
        (JSC::FTL::OSRExitHandle::OSRExitHandle):
        * ftl/FTLPatchpointExceptionHandle.cpp:
        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):

2021-04-17  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, suppress warnings
        https://bugs.webkit.org/show_bug.cgi?id=224616

        * runtime/HashMapImpl.h:
        * runtime/HashMapImplInlines.h:
        (JSC::areKeysEqual):
        (JSC::wangsInt64Hash):

2021-04-16  Mark Lam  <mark.lam@apple.com>

        More changes to support the TerminationException.
        https://bugs.webkit.org/show_bug.cgi?id=224681
        rdar://76698113

        Reviewed by Keith Miller.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):
        - ProgramExecutable::initializeGlobalProperties() can throw the TerminationException.
          Add handling for that.

        * runtime/JSObject.cpp:
        (JSC::JSObject::defineOwnIndexedProperty):
        - JSObject::defineOwnIndexedProperty() has a blob of assertion code that it verifying
          that getOwnPropertyDescriptor() should succeed without throwing any exceptions if
          the fast path is allowed.  However, this is assertion is only true if there isn't
          a termination being requested.  So, use the DeferTermination scope to allow this
          assertion to be tested without the complication of a TerminationException.

2021-04-16  Keith Miller  <keith_miller@apple.com>

        Before deleting a MarkedBlock we do not need to clear its m_directory pointer.
        https://bugs.webkit.org/show_bug.cgi?id=224677

        Reviewed by Yusuke Suzuki.

        Right now when we are about to free a MarkedBlock we clear the
        m_directory pointer in the MarkedBlock's Handle. This has the
        downside, however, of potentially paging in the footer from disk /
        the compressor, which some data we have seen shows is happening.
        This patch prevents this uncessary store to hopefully reduce the
        number of pageins/decompressions caused by Safari web content.

        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::removeBlock):
        (JSC::BlockDirectory::removeBlockForDeletion):
        * heap/BlockDirectory.h:
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::~Handle):
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::freeBlock):

2021-04-16  Mark Lam  <mark.lam@apple.com>

        Build fix for Debug -O3 after r276069.
        https://bugs.webkit.org/show_bug.cgi?id=224619

        Not reviewed.

        * runtime/HashMapImplInlines.h:

2021-04-15  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r276112.
        https://bugs.webkit.org/show_bug.cgi?id=224646

        .h files should not #include *Inlines.h files.

        Reverted changeset:

        "REGRESSION(r276039) [GTK] Build failures on Ubuntu 18.04"
        https://bugs.webkit.org/show_bug.cgi?id=224644
        https://trac.webkit.org/changeset/276112

2021-04-15  Lauro Moura  <lmoura@igalia.com>

        REGRESSION(r276039) [GTK] Build failures on Ubuntu 18.04
        https://bugs.webkit.org/show_bug.cgi?id=224644

        Unreviewed build fix.

        * runtime/JSSet.h: Use HashMapImplInlines to include the base
        finishCreation implementation. Somehow GCC 7.5 wasn't picking it up.

2021-04-15  Mark Lam  <mark.lam@apple.com>

        HashMapImpl::rehash() should use a version of jsMapHash that cannot throw.
        https://bugs.webkit.org/show_bug.cgi?id=224610
        rdar://76698910

        Reviewed by Yusuke Suzuki.

        For context, HashMapImpl::rehash()'s rehash operation relies on jsMapHash().
        jsMapHash() can be interrupted by a TerminationException, and as a result, may
        not return the string hash we are expecting.  This in turn can lead to the
        rehash operation hashing with wrong keys.

        However, all the keys should have already been hashed.  Hence, rehash() should
        never see an exception thrown there.  We can avoid this complication with the
        TerminationException by simply calling an alternate version of jsMapHash() that
        is guaranteed to never throw e.g. a jsMapHashForAlreadyHashedValue() function.

        * runtime/ExceptionHelpers.h:
        * runtime/HashMapImplInlines.h:
        (JSC::jsMapHashImpl):
        (JSC::jsMapHash):
        (JSC::jsMapHashForAlreadyHashedValue):
        (JSC::HashMapImpl<HashMapBucketType>::rehash):

2021-04-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove CodeBlock::RareData::m_catchProfiles
        https://bugs.webkit.org/show_bug.cgi?id=224593

        Reviewed by Mark Lam.

        We are having this Vector just because we would like to destroy them when destroying the owner Baseline / LLInt CodeBlock.
        But we are setting a pointer in OpCatch's metadata in Baseline / LLInt.
        So we should just iterate metadata for that and destroy them in the destructor. No need to keep them separately.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndex):
        (JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow):
        (JSC::CodeBlock::updateAllValueProfilePredictionsAndCountLiveness):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::createRareDataIfNecessary):
        * bytecode/ValueProfile.h:
        (JSC::ValueProfileAndVirtualRegisterBuffer::ValueProfileAndVirtualRegisterBuffer): Deleted.
        (JSC::ValueProfileAndVirtualRegisterBuffer::~ValueProfileAndVirtualRegisterBuffer): Deleted.
        (JSC::ValueProfileAndVirtualRegisterBuffer::forEach): Deleted.
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):

2021-04-15  Mark Lam  <mark.lam@apple.com>

        Optimize the DeferTermination scope to be more efficient.
        https://bugs.webkit.org/show_bug.cgi?id=224619

        Reviewed by Saam Barati.

        This can be beneficial since we may be using DeferTermination in more places in
        the code.

        1. Added a VMTrapsInlines.h to hold the inline functions.

        2. Split deferTermination() and undoDeferTermination() into fast and slow functions.
           The fast functions are inlineable.

        3. Remove the locking of VMTraps::m_lock in these functions.  These functions only
           modify the following:
           a. VMTraps::m_deferTerminationCount
           b. VMTraps::m_suspendedTerminationException
           c. VMTraps::m_trapBits for setting the NeedTermination bit if needed.
           d. VM::m_exception

           Except for VMTraps::m_trapBits, all of these are only written to from the mutator
           thread.  VMTraps::m_trapBits is always written to using Atomics.  There isn't
           anything that needs to be guarded by VMTraps::m_lock.

        4. Fix VMTraps::deferTermination() to only set m_suspendedTerminationException
           and clear an existing TerminationException if it's being called from the
           outermost DeferTermination (i.e. m_deferTerminationCount is 1 after incrementing).
           These conditional operations are not done in VMTraps::deferTerminationSlow().

           In practice, it wouldn't have mattered anyway because we would never throw a
           TerminationException while a DeferTermination scope is in effect.  The
           the vm.isTerminationException() in the original deferTermination() would
           always have prevented the slow path operations from being executed anyway.

           However, for the purpose of this patch, we want to avoid as much unnecessary
           work as possible in the fast path.  Hence, it is good to skip the slow path
           if deferTermination() isn't called from the outermost scope.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * jit/JITOperations.cpp:
        * jsc.cpp:
        * runtime/JSGlobalObject.cpp:
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::deferTerminationSlow):
        (JSC::VMTraps::undoDeferTerminationSlow):
        (JSC::VMTraps::vm const): Deleted.
        (JSC::VMTraps::deferTermination): Deleted.
        (JSC::VMTraps::undoDeferTermination): Deleted.
        * runtime/VMTraps.h:
        * runtime/VMTrapsInlines.h: Added.
        (JSC::VMTraps::vm const):
        (JSC::VMTraps::deferTermination):
        (JSC::VMTraps::undoDeferTermination):

2021-04-15  Mark Lam  <mark.lam@apple.com>

        Refactor inline functions out of HashMapImpl.h into HashMapImplInlines.h.
        https://bugs.webkit.org/show_bug.cgi?id=224616
        rdar://76713709

        Reviewed by Yusuke Suzuki.

        Also do the same for clients of HashMapImpl that require similar refactoring.
        This fixes the #include of JSCJSValueInlines.h in HashMapImpl.h, as well as makes
        it easier to use other inline functions from other classes in the implementation
        of HashMapImpl's inline functions in the future.

        This patch only moves inline functions out to their respective *Inlines.h.
        There are no behavior changes.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * dfg/DFGAbstractInterpreterInlines.h:
        * dfg/DFGOperations.cpp:
        * runtime/AbstractModuleRecord.cpp:
        * runtime/HashMapImpl.cpp:
        * runtime/HashMapImpl.h:
        (JSC::areKeysEqual): Deleted.
        (JSC::normalizeMapKey): Deleted.
        (JSC::wangsInt64Hash): Deleted.
        (JSC::jsMapHash): Deleted.
        (JSC::concurrentJSMapHash): Deleted.
        (JSC::shouldShrink): Deleted.
        (JSC::shouldRehashAfterAdd): Deleted.
        (JSC::nextCapacity): Deleted.
        (JSC::HashMapImpl::finishCreation): Deleted.
        (JSC::HashMapImpl::findBucket): Deleted.
        (JSC::HashMapImpl::get): Deleted.
        (JSC::HashMapImpl::has): Deleted.
        (JSC::HashMapImpl::add): Deleted.
        (JSC::HashMapImpl::addNormalized): Deleted.
        (JSC::HashMapImpl::remove): Deleted.
        (JSC::HashMapImpl::clear): Deleted.
        (JSC::HashMapImpl::setUpHeadAndTail): Deleted.
        (JSC::HashMapImpl::addNormalizedNonExistingForCloning): Deleted.
        (JSC::HashMapImpl::addNormalizedInternal): Deleted.
        (JSC::HashMapImpl::findBucketAlreadyHashedAndNormalized): Deleted.
        (JSC::HashMapImpl::rehash): Deleted.
        (JSC::HashMapImpl::checkConsistency const): Deleted.
        (JSC::HashMapImpl::makeAndSetNewBuffer): Deleted.
        (JSC::HashMapImpl::assertBufferIsEmpty const): Deleted.
        * runtime/HashMapImplInlines.h: Added.
        (JSC::areKeysEqual):
        (JSC::normalizeMapKey):
        (JSC::wangsInt64Hash):
        (JSC::jsMapHash):
        (JSC::concurrentJSMapHash):
        (JSC::shouldShrink):
        (JSC::shouldRehashAfterAdd):
        (JSC::nextCapacity):
        (JSC::HashMapImpl<HashMapBucketType>::finishCreation):
        (JSC::HashMapImpl<HashMapBucketType>::findBucket):
        (JSC::HashMapImpl<HashMapBucketType>::get):
        (JSC::HashMapImpl<HashMapBucketType>::has):
        (JSC::HashMapImpl<HashMapBucketType>::add):
        (JSC::HashMapImpl<HashMapBucketType>::addNormalized):
        (JSC::HashMapImpl<HashMapBucketType>::remove):
        (JSC::HashMapImpl<HashMapBucketType>::clear):
        (JSC::HashMapImpl<HashMapBucketType>::setUpHeadAndTail):
        (JSC::HashMapImpl<HashMapBucketType>::addNormalizedNonExistingForCloning):
        (JSC::HashMapImpl<HashMapBucketType>::addNormalizedInternal):
        (JSC::HashMapImpl<HashMapBucketType>::findBucketAlreadyHashedAndNormalized):
        (JSC::HashMapImpl<HashMapBucketType>::rehash):
        (JSC::HashMapImpl<HashMapBucketType>::checkConsistency const):
        (JSC::HashMapImpl<HashMapBucketType>::makeAndSetNewBuffer):
        (JSC::HashMapImpl<HashMapBucketType>::assertBufferIsEmpty const):
        * runtime/JSMap.h:
        * runtime/JSMapInlines.h: Added.
        (JSC::JSMap::set):
        * runtime/JSSetInlines.h: Added.
        * runtime/JSWeakMap.h:
        * runtime/JSWeakMapInlines.h: Added.
        (JSC::JSWeakMap::set):
        * runtime/MapConstructor.cpp:
        * runtime/MapPrototype.cpp:
        * runtime/SetConstructor.cpp:
        * runtime/WeakMapConstructor.cpp:
        * runtime/WeakMapImpl.h:
        (JSC::jsWeakMapHash): Deleted.
        (JSC::nextCapacityAfterBatchRemoval): Deleted.
        (JSC::WeakMapImpl::add): Deleted.
        (JSC::WeakMapImpl::shouldRehashAfterAdd const): Deleted.
        (JSC::WeakMapImpl::rehash): Deleted.
        * runtime/WeakMapImplInlines.h:
        (JSC::jsWeakMapHash):
        (JSC::nextCapacityAfterBatchRemoval):
        (JSC::WeakMapImpl<WeakMapBucket>::add):
        (JSC::WeakMapImpl<WeakMapBucket>::rehash):
        (JSC::WeakMapImpl<WeakMapBucket>::shouldRehashAfterAdd const):
        * runtime/WeakMapPrototype.cpp:

2021-04-15  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Change Vector<> to FixedVector<> in DFG::CommonData if possible
        https://bugs.webkit.org/show_bug.cgi?id=224588

        Reviewed by Mark Lam.

        DFG::CommonData is kept alive so long as DFG code exists. It includes a lot of Vectors while they are not mutable after the DFG code compilation.
        This patch changes Vector<> to FixedVector<> if possible to shrink sizeof(DFG::CommonData). And this also removes the need of calling shrinkToFit
        explicitly for them.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::stronglyVisitWeakReferences):
        (JSC::CodeBlock::jettison):
        (JSC::CodeBlock::numberOfDFGIdentifiers const):
        (JSC::CodeBlock::identifier const):
        * bytecode/CodeBlock.h:
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::shrinkToFit):
        (JSC::DFG::CommonData::invalidate):
        (JSC::DFG::CommonData::~CommonData):
        (JSC::DFG::CommonData::installVMTrapBreakpoints):
        (JSC::DFG::CommonData::isVMTrapBreakpoint):
        (JSC::DFG::CommonData::finalizeCatchEntrypoints):
        (JSC::DFG::CommonData::notifyCompilingStructureTransition): Deleted.
        * dfg/DFGCommonData.h:
        (JSC::DFG::CommonData::catchOSREntryDataForBytecodeIndex):
        (JSC::DFG::CommonData::appendCatchEntrypoint): Deleted.
        * dfg/DFGDesiredIdentifiers.cpp:
        (JSC::DFG::DesiredIdentifiers::reallyAdd):
        * dfg/DFGDesiredTransitions.cpp:
        (JSC::DFG::DesiredTransition::DesiredTransition):
        (JSC::DFG::DesiredTransitions::DesiredTransitions):
        (JSC::DFG::DesiredTransitions::addLazily):
        (JSC::DFG::DesiredTransitions::reallyAdd):
        (JSC::DFG::DesiredTransition::reallyAdd): Deleted.
        * dfg/DFGDesiredTransitions.h:
        * dfg/DFGDesiredWeakReferences.cpp:
        (JSC::DFG::DesiredWeakReferences::reallyAdd):
        * dfg/DFGGraph.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
        * dfg/DFGOSREntry.h:
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::Plan):
        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::linkOSREntries):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileInvalidationPoint):

2021-04-14  Mark Lam  <mark.lam@apple.com>

        Add missing exception check in operationGetPrivateNameOptimize().
        https://bugs.webkit.org/show_bug.cgi?id=224592
        rdar://76645873

        Reviewed by Yusuke Suzuki.

        Though the fieldNameValue.toPropertyKey() call in operationGetPrivateNameOptimize()
        would not normally throw an exception, it still can throw a TerminationException
        because it contains RETURN_IF_EXCEPTION checks.

        * jit/JITOperations.cpp:

2021-04-14  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not copy SimpleJumpTable
        https://bugs.webkit.org/show_bug.cgi?id=224472

        Reviewed by Mark Lam.

        This patch avoids copying UnlinkedSimpleJumpTable to SimpleJumpTable by decoupling CTI addresses from jump offset in SimpleJumpTable.
        SimpleJumpTable and UnlinkedSimpleJumpTable are almost identical. SimpleJumpTable adds JIT jump target for each branch.
        We should use data from UnlinkedSimpleJumpTable and jump via SimpleJumpTable. Do not need to have copy of branches from UnlinkedSimpleJumpTable.

        This way removes Vector<SimpleJumpTable> from CodeBlock::RareData. And this is moved to CodeBlock::JITData. And it only includes jump target addresses,
        and branch offset information is kept in UnlinkedSimpleJumpTable side. We no longer need to carefully copy these vectors in CodeBlock including DFG / FTL ones.

        In LLInt, we instead use UnlinkedSimpleJumpTable for jumping.

        In Baseline, we first allocate enough FixedVector<SimpleJumpTable> and fill content via SimpleJumpTable::ensureCTITable() call when compiling corresponding
        switch opcode. Finally we fill these data structures with actual code locations in JIT::link function.

        In DFG, we first collect UnlinkedSimpleJumpTable without copying. This is OK since it is kept by UnlinkedCodeBlock, and UnlinkedCodeBlock is kept by baseline CodeBlocks that
        are handled by this DFG compilation. We hold Vector<const UnlinkedSimpleJumpTable*> in DFG::Graph and we materialize Vector<SimpleJumpTable> in DFG::Graph.
        During DFG compilation, we touch this DFG::Graph's jump tables, and JIT compiler generates code via these tables. And when linking, we move the content to CodeBlock.

        In FTL, while we use UnlinkedSimpleJumpTable in FTL code generation, FTL do not use SimpleJumpTable and instead FTL uses Switch in B3.

        * bytecode/BytecodeDumper.cpp:
        (JSC::CodeBlockBytecodeDumper<Block>::dumpSwitchJumpTables):
        * bytecode/BytecodeDumper.h:
        * bytecode/BytecodeGeneratorification.cpp:
        (JSC::BytecodeGeneratorification::run):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::shrinkToFit):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::switchJumpTable):
        (JSC::CodeBlock::numberOfUnlinkedSwitchJumpTables const):
        (JSC::CodeBlock::unlinkedSwitchJumpTable):
        (JSC::CodeBlock::numberOfSwitchJumpTables const): Deleted.
        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
        (JSC::CodeBlock::addSwitchJumpTableFromProfiledCodeBlock): Deleted.
        * bytecode/JumpTable.cpp:
        (JSC::SimpleJumpTable::offsetForValue): Deleted.
        * bytecode/JumpTable.h:
        (JSC::SimpleJumpTable::ensureCTITable):
        (JSC::SimpleJumpTable::ctiForValue const):
        (JSC::SimpleJumpTable::isEmpty const):
        (): Deleted.
        (JSC::SimpleJumpTable::cloneNonJITPart const): Deleted.
        (JSC::SimpleJumpTable::ctiForValue): Deleted.
        (JSC::SimpleJumpTable::clear): Deleted.
        * bytecode/PreciseJumpTargetsInlines.h:
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedSimpleJumpTable::offsetForValue const):
        (JSC::UnlinkedSimpleJumpTable::add):
        (JSC::UnlinkedCodeBlock::numberOfUnlinkedSwitchJumpTables const):
        (JSC::UnlinkedCodeBlock::unlinkedSwitchJumpTable const):
        (JSC::UnlinkedCodeBlock::unlinkedStringSwitchJumpTable const):
        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables const): Deleted.
        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
        (JSC::UnlinkedCodeBlock::unlinkedStringSwitchJumpTable): Deleted.
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::numberOfUnlinkedSwitchJumpTables const):
        (JSC::UnlinkedCodeBlockGenerator::addUnlinkedSwitchJumpTable):
        (JSC::UnlinkedCodeBlockGenerator::unlinkedSwitchJumpTable):
        (JSC::UnlinkedCodeBlockGenerator::numberOfSwitchJumpTables const): Deleted.
        (JSC::UnlinkedCodeBlockGenerator::addSwitchJumpTable): Deleted.
        (JSC::UnlinkedCodeBlockGenerator::switchJumpTable): Deleted.
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::beginSwitch):
        (JSC::prepareJumpTableForSwitch):
        (JSC::BytecodeGenerator::endSwitch):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        * dfg/DFGGraph.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
        (JSC::DFG::SpeculativeJIT::emitSwitchString):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        (JSC::JIT::link):
        * jit/JIT.h:
        (JSC::SwitchRecord::SwitchRecord):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CachedTypes.cpp:
        (JSC::CachedSimpleJumpTable::encode):
        (JSC::CachedSimpleJumpTable::decode const):
        (JSC::CachedCodeBlockRareData::encode):
        (JSC::CachedCodeBlockRareData::decode const):

2021-04-14  Alex Christensen  <achristensen@webkit.org>

        Keep UniqueRef<MathICGenerationState> instead of MathICGenerationState in HashTables
        https://bugs.webkit.org/show_bug.cgi?id=224569

        Reviewed by Geoffrey Garen.

        sizeof(KeyValuePair<const Instruction*, MathICGenerationState>) is 136 on some platforms.
        That's on the big side for sparse HashTable entries.  I think using UniqueRef will help performance.

        * jit/JIT.h:
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        * jit/JITMathIC.h:

2021-04-14  Mark Lam  <mark.lam@apple.com>

        Apply DeferTermination in some utility functions in the jsc shell.
        https://bugs.webkit.org/show_bug.cgi?id=224572
        rdar://76646089

        Reviewed by Yusuke Suzuki.

        This is to make sure that these functions don't get in the way of testing with
        the watchdog.  Since these are only test utility functions, just doing the simple
        thing of using a DeferTermination scope is the right thing to do here.

        * jsc.cpp:

2021-04-14  Mark Lam  <mark.lam@apple.com>

        Defer TerminationExceptions when evaluating ASSERT in HashMapIml::addNormalized().
        https://bugs.webkit.org/show_bug.cgi?id=224565
        rdar://76645980

        Reviewed by Yusuke Suzuki.

        HashMapImpl::addNormalized() has an ASSERT that calls jsMapHash(), which can
        potentially throw exceptions.  As a result, it has a RETURN_IF_EXCEPTION which
        provides an opportunity to handle traps and throw a TerminationException.  This
        in turn causes the ASSERT to fail.

        To fix this, we do:

        1. Introduce VMTraps::DeferAction, which gives us DeferForAWhile and DeferUntilEndOfScope.

        2. Templatize the DeferTermination RAII object on VMTraps::DeferAction.
           Introduce DeferTerrminationForAWhile, which is DeferTermination<VMTraps::DeferAction::DeferForAWhile>.
           DeferForAWhile means that the deferScope will not throw the TerminationException
           on exit.  Instead, it will re-set the NeedTermination bit in the traps, and let
           the next trap check handle it.

        3. Introduce DEFER_TERMINATION_AND_ASSERT_WITH_MESSAGE (and friends) which creates
           a DeferTerrminationForAWhile scope before doing an ASSERT_WITH_MESSAGE.

        4. Use DEFER_TERMINATION_AND_ASSERT_WITH_MESSAGE instead in HashMapImpl::addNormalized().

        * runtime/DeferTermination.h:
        (JSC::DeferTermination::DeferTermination):
        (JSC::DeferTermination::~DeferTermination):
        * runtime/ExceptionHelpers.h:
        * runtime/HashMapImpl.h:
        (JSC::HashMapImpl::addNormalized):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::deferTermination):
        (JSC::VMTraps::undoDeferTermination):
        * runtime/VMTraps.h:

2021-04-13  Mark Lam  <mark.lam@apple.com>

        The watchdog should not fire when it's not active.
        https://bugs.webkit.org/show_bug.cgi?id=224494
        rdar://76581259

        Reviewed by Saam Barati and Yusuke Suzuki.

        The watchdog is only active when we have entered the VM.  If we haven't entered
        the VM, we postpone starting the watchdog.  For example, see Watchdog::enteredVM()
        and Watchdog::exitedVM().

        The underlying timer may still fire the NeedWatchdogCheck event after
        Watchdog::stopTimer() is called.  So, we need to just ignore the event if the
        watchdog isn't active.

        * runtime/VMTraps.cpp:
        (JSC::VMTraps::handleTraps):
        * runtime/Watchdog.h:
        (JSC::Watchdog::isActive const):

2021-04-13  Ross Kirsling  <ross.kirsling@sony.com>

        Move cloneUBreakIterator declaration to IntlWorkaround.h
        https://bugs.webkit.org/show_bug.cgi?id=224511

        Reviewed by Yusuke Suzuki.

        Follow up to r275856. There's ultimately no reason IntlWorkaround.cpp needs to be headerless;
        this was tied to some confusion about how to successfully include ubrk.h in two different ways.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * runtime/IntlSegmenter.cpp:
        * runtime/IntlSegmenter.h:
        * runtime/IntlSegments.cpp:
        * runtime/IntlWorkaround.cpp:
        * runtime/IntlWorkaround.h: Added.

2021-04-13  Mark Lam  <mark.lam@apple.com>

        Use a JSString for the TerminationException value instead of a Symbol.
        https://bugs.webkit.org/show_bug.cgi?id=224490

        Reviewed by Yusuke Suzuki.

        This makes it convertible to a String for clients that wish to report the exception.
        Clients, in this case, does not apply to JS code, only C++ code that catches the
        exception at the outermost point to handle the termination.  The TerminationException
        value is not visible to JS code because the TerminationException cannot be caught.
        So, this change is transparent to JS code.

        * runtime/VM.cpp:
        (JSC::VM::ensureTerminationException):

2021-04-13  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, reverting r275867.
        https://bugs.webkit.org/show_bug.cgi?id=224495

        Need alternate fix.

        Reverted changeset:

        "Reduce functionWithHellaArguments3()'s number of arguments
        from 5000 to 500."
        https://bugs.webkit.org/show_bug.cgi?id=224474
        https://trac.webkit.org/changeset/275867

2021-04-13  Yusuke Suzuki  <ysuzuki@apple.com>

        Unreviewed, casting to unsigned long long to suppress warning
        https://bugs.webkit.org/show_bug.cgi?id=224473

        * b3/B3ConstDoubleValue.cpp:
        (JSC::B3::ConstDoubleValue::dumpMeta const):

2021-04-13  Mark Lam  <mark.lam@apple.com>

        Reduce functionWithHellaArguments3()'s number of arguments from 5000 to 500.
        https://bugs.webkit.org/show_bug.cgi?id=224474
        rdar://73614896

        Reviewed by Yusuke Suzuki.

        Using 5000 arguments seems excessive, and may blow out the stack on more resource
        constrained devices.  500 should be high enough.

        * b3/testb3_5.cpp:
        (JSC_DEFINE_JIT_OPERATION):
        (testCallFunctionWithHellaArguments3):

2021-04-12  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Remove CodeBlock::m_constantsSourceCodeRepresentation
        https://bugs.webkit.org/show_bug.cgi?id=224473

        Reviewed by Mark Lam.

        CodeBlock::m_constantsSourceCodeRepresentation is identical to UnlinkedCodeBlock::m_constantsSourceCodeRepresentation.

        1. For all constants existing at bytecode compile time, elements of the above vectors are identical.
        2. For lazily added constants from DFG, it is always SourceCodeRepresentation::Other.

        And the array is effectively accessed only when compiling DFG code. So we should remove copy of that in CodeBlock, and
        get SourceCodeRepresentation from UnlinkedCodeBlock.

        * bytecode/BytecodeDumper.cpp:
        (JSC::CodeBlockBytecodeDumper<Block>::dumpConstants):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::shrinkToFit):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::constants):
        (JSC::CodeBlock::addConstant):
        (JSC::CodeBlock::addConstantLazily):
        (JSC::CodeBlock::constantSourceCodeRepresentation const):
        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::constantSourceCodeRepresentation const):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::constantSourceCodeRepresentation const):
        (JSC::UnlinkedCodeBlockGenerator::constantsSourceCodeRepresentation): Deleted.
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::registerFrozenValues):

2021-04-12  Mark Lam  <mark.lam@apple.com>

        Interpreter::executeProgram() should install its VMEntryScope at the top.
        https://bugs.webkit.org/show_bug.cgi?id=224450
        rdar://76530841

        Reviewed by Yusuke Suzuki.

        "top" includes before any VM code that can throw exceptions is run.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):

2021-04-12  Ross Kirsling  <ross.kirsling@sony.com>

        ICU 69 deprecates ubrk_safeClone in favor of ubrk_clone
        https://bugs.webkit.org/show_bug.cgi?id=224093

        Reviewed by Yusuke Suzuki.

        In a shining example of "disappointing library practices", ICU 69 deprecates ubrk_safeClone in favor of
        a new *draft* API ubrk_clone, meaning that no function with this functionality is exposed by default.

        This patch introduces a function cloneUBreakIterator to abstract over this change; however, since we need to:

          1. confine the effects of disabling U_HIDE_DRAFT_API to a non-unified implementation file
          2. still be able to include ubrk.h from IntlSegmenter.h to instantiate ICUDeleter<ubrk_close> (*not* `clone`!)

        ...the new helper function is introduced in a *headerless* implementation file, IntlWorkaround.cpp.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/IntlSegmenter.cpp:
        (JSC::IntlSegmenter::segment const):
        * runtime/IntlSegmenter.h:
        * runtime/IntlSegments.cpp:
        (JSC::IntlSegments::createSegmentIterator):
        * runtime/IntlWorkaround.cpp: Added.
        (JSC::cloneUBreakIterator):

2021-04-12  Don Olmstead  <don.olmstead@sony.com>

        Inspector code is wrongly including some private headers
        https://bugs.webkit.org/show_bug.cgi?id=224456

        Reviewed by Alex Christensen.

        These files were including some headers using #include <JavaScriptCore/Foo.h> style instead
        of "Foo.h" style. This caused a build error when attempting to revive the Mac CMake build
        since those headers were private and private headers are generated after the JavaScriptCore
        build. No other ports were have ENABLE_INSPECTOR_ALTERNATE_DISPATCHERS turned on so the
        issue hadn't manifested until now. 

        * API/JSContextRefInspectorSupport.h:
        * inspector/augmentable/AlternateDispatchableAgent.h:
        * inspector/augmentable/AugmentableInspectorController.h:

2021-04-12  BJ Burg  <bburg@apple.com>

        Modernize uses of ConsoleClient
        https://bugs.webkit.org/show_bug.cgi?id=224398

        Reviewed by David Kilzer.

        ConsoleClient acts like a delegate, so its callers
        should be using weak references to it.

        * inspector/JSGlobalObjectInspectorController.cpp:
        (Inspector::JSGlobalObjectInspectorController::consoleClient const):
        * inspector/JSGlobalObjectInspectorController.h:
        * runtime/ConsoleClient.h:
        * runtime/ConsoleObject.cpp:
        (JSC::consoleLogWithLevel):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::setConsoleClient):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::consoleClient const):
        (JSC::JSGlobalObject::setConsoleClient): Deleted.

2021-04-11  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Do not copy StringSwitchJumpTable
        https://bugs.webkit.org/show_bug.cgi?id=224414

        Reviewed by Keith Miller.

        Previously, we were copying UnlinkedStringJumpTable to CodeBlock's StringJumpTable because we embed CodeLocation pointer
        inside CodeBlock's StringJumpTable. This is copying a mostly identical hashtable to each CodeBlock even in DFG and FTL. This
        even prevents us from inlining op_switch_string in DFG and FTL because (1) we don't want to copy this string tables collected from
        each inlined CodeBlock into a new DFG / FTL CodeBlock and (2) we cannot ref/deref StringImpl inside DFG / FTL compilers so copying
        these tables in the compiler threads need additional "DesiredStringSwitchJumpTable" etc.

        In this patch, we stop copying StringSwitchJumpTable. We decouple CodeLocation pointers from the hashtable so that we can use
        UnlinkedStringJumpTable in UnlinkedCodeBlock. UnlinkedStringJumpTable's hashtable inclues m_indexInTable in each entry so that
        we can have array of CodeLocation pointers in CodeBlock's JITData to have JIT jump targets separately. This design prevents us
        from copying unnecessary hashtables, and even this paves the way to inlining switch_string in DFG and FTL.

        * bytecode/BytecodeDumper.cpp:
        (JSC::CodeBlockBytecodeDumper<Block>::dumpStringSwitchJumpTables):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::shrinkToFit):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::stringSwitchJumpTable):
        (JSC::CodeBlock::numberOfUnlinkedStringSwitchJumpTables const):
        (JSC::CodeBlock::unlinkedStringSwitchJumpTable):
        (JSC::CodeBlock::numberOfStringSwitchJumpTables const): Deleted.
        * bytecode/JumpTable.h:
        (JSC::StringJumpTable::ctiForValue const):
        (JSC::StringJumpTable::offsetForValue): Deleted.
        (JSC::StringJumpTable::ctiForValue): Deleted.
        (JSC::StringJumpTable::clear): Deleted.
        * bytecode/PreciseJumpTargetsInlines.h:
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedStringJumpTable::offsetForValue const):
        (JSC::UnlinkedCodeBlock::numberOfUnlinkedStringSwitchJumpTables const):
        (JSC::UnlinkedCodeBlock::unlinkedStringSwitchJumpTable):
        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables const): Deleted.
        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
        * bytecode/UnlinkedCodeBlockGenerator.cpp:
        (JSC::UnlinkedCodeBlockGenerator::finalize):
        * bytecode/UnlinkedCodeBlockGenerator.h:
        (JSC::UnlinkedCodeBlockGenerator::numberOfUnlinkedStringSwitchJumpTables const):
        (JSC::UnlinkedCodeBlockGenerator::addUnlinkedStringSwitchJumpTable):
        (JSC::UnlinkedCodeBlockGenerator::unlinkedStringSwitchJumpTable):
        (JSC::UnlinkedCodeBlockGenerator::numberOfStringSwitchJumpTables const): Deleted.
        (JSC::UnlinkedCodeBlockGenerator::addStringSwitchJumpTable): Deleted.
        (JSC::UnlinkedCodeBlockGenerator::stringSwitchJumpTable): Deleted.
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::beginSwitch):
        (JSC::prepareJumpTableForStringSwitch):
        (JSC::BytecodeGenerator::endSwitch):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::switchStringSlow):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::JSC_DEFINE_JIT_OPERATION):
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JIT.h:
        (JSC::SwitchRecord::SwitchRecord):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_switch_string):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_switch_string):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * runtime/CachedTypes.cpp:
        (JSC::CachedStringJumpTable::encode):
        (JSC::CachedStringJumpTable::decode const):
        (JSC::CachedCodeBlockRareData::encode):
        (JSC::CachedCodeBlockRareData::decode const):

2021-04-10  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] B3 reduce-double-to-float should reduce only when constant double is canonical one to reduced float value
        https://bugs.webkit.org/show_bug.cgi?id=224403
        <rdar://problem/76259599>

        Reviewed by Mark Lam.

        When reducing double-constant value to float in B3, we should check whether the double value is a canonical one
        which can be converted back from the reduced float value. For example, double 1.1 is not the one since it is truncated
        into float 1.1 by removing some bits.

            static_cast<double>(static_cast<float>(1.1)) != 1.1

        Reducing such a double to float changes the semantics.

        * b3/B3ConstDoubleValue.cpp:
        (JSC::B3::ConstDoubleValue::dumpMeta const):
        * b3/B3ConstFloatValue.cpp:
        (JSC::B3::ConstFloatValue::dumpMeta const):
        * b3/B3ReduceDoubleToFloat.cpp:
        * b3/B3ReduceStrength.cpp:
        * b3/testb3.h:
        (populateWithInterestingValues):
        * b3/testb3_1.cpp:
        (run):
        * b3/testb3_3.cpp:
        (testConvertDoubleToFloatToDouble):
        (testConvertDoubleToFloatEqual):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::JSC_DEFINE_JIT_OPERATION_WITH_ATTRIBUTES):
        (JSC::FTL::DFG::LowerDFGToB3::crash):
        (JSC::FTL::DFG::ftlUnreachable): Deleted.

2021-04-10  Mark Lam  <mark.lam@apple.com>

        Enable VMTraps checks in RETURN_IF_EXCEPTION.
        https://bugs.webkit.org/show_bug.cgi?id=224078
        rdar://75037057

        Reviewed by Keith Miller.

        In pre-existing code, termination of a VM's execution can already be requested
        asynchronously (with respect to the mutator thread).  For example, sources of such
        a request can be a watchdog timer firing, or a request to stop execution issued
        from a main web thread to a worker thread.

        This request is made by firing the VMTraps::NeedTermination event on VMTraps.
        Firing the event here only means setting a flag to indicate the presence of the
        request.  We still have to wait till the mutator thread reaches one of the
        pre-designated polling check points to call VMTraps::handleTraps() in order to
        service the request.  As a result of this need to wait for a polling check point,
        if the mutator is executing in a long running C++ loop, then a termination request
        may not be serviced for a long time.

        However, we observed that a lot of our C++ loops already have RETURN_IF_EXCEPTION
        checks.  Hence, if we can check VMTraps::needHandling() there, we can service the
        VMTraps events more frequently even in a lot of C++ loops, and get a better response.

        Full details of what this patch changes:

        1. Shorten some type and methods names in the VMTraps class to make code easier to
           read e.g. EventType => Event, needTrapHandling => needHandling.

        2. Remove the VMTraps::Mask class.  Mask was introduced so that we can express a
           concatenation of multiple VMTraps events to form a bit mask in a simple way.
           In the end, it isn't flexible enough but makes the code more complicated than
           necessary.  It is now replaced by the simpler solution of using macros to define
           the Events as bit fields.  Having Events as bit fields intrinsically make them
           easy to concatenate (bitwise or) or filter (bitwise and).

           Also removed the unused VMTraps::Error class.

        3. Make VMTraps::BitField a uint32_t.  There was always unused padding in VMTraps
           to allow for this.  So, we'll just extend it to a full 32-bit to make it easier
           to add more events in the future for other uses.

        4. Add NeedExceptionHandling as a VMTrap::Event.

        5. Make VMTraps::m_trapBits Atomic.  This makes it easier to set and clear the
           NeedExceptionHandling bit from the mutator without a lock.

        6. RETURN_IF_EXCEPTION now checks VMTraps::m_trapBits (via VMTraps::needHandling())
           instead of checking VM::m_exception.  If the VMTraps::m_trapBits is non-null,
           the macro will call VM:hasExceptionsAfterHandlingTraps() to service VMTraps
           events as appropriate before returning whether an exception is being thrown.
           The result of VM:hasExceptionsAfterHandlingTraps() will determine if
           RETURN_IF_EXCEPTION returns or not.

           VM:hasExceptionsAfterHandlingTraps() is intentionally designed to take a minimum
           of arguments (just the VM as this pointer).  This is because RETURN_IF_EXCEPTION
           is called from many places, and we would like to minimize code size bloating
           from this change.

        7. Simplify paramaters of VMTraps::handleTraps().

           NeedDebuggerBreak's callFrame argument was always vm.topCallFrame anyway.
           So, the patch makes it explicit, and removes the callFrame parameter.

           NeedWatchdogCheck's globalObject argument should have always been
           vm.entryScope->globalObject(), and we can remove the globalObject parameter.

           Before this, we pass in whichever globalObject was convenient to grab hold of.
           However, the idea of the watchdog is to time out the current script executing
           on the stack.  Hence, it makes sense to identify thay script by the globalObject
           in use at VM entry.

           So far, the only clients that uses the watchdog mechanism only operates in
           scenarios with only one globalObject anyway.  So this formalization to use
           VMEntryScope's globalObject does not change the expected behavior.

        8. Make the execution of termination more robust.  Before reading this, please
           read the description of the Events in VMTraps.h first, especially the section
           on NeedTermination.

           Here's the life cycle of a termination:

           a. a client requests termination of the current execution stack by calling
              VM::notifyNeedTermination().  notifyNeedTermination() does 2 things:

               i. fire the NeedTermination event on VMTraps.
              ii. set the VM::m_terminationInProgress flag.

           b. Firing the NeedTermination event on VMTraps means setting the NeedTermination
              bit on VMTraps::m_trapBits.  This bit will be polled by the mutator thread
              later at various designated points (including RETURN_IF_EXCEPTION, which we
              added in this patch).

              Once the mutator sees the NeedTermination bit is set, it will clear the bit
              and throw the TerminationException (see VMTraps::handleTraps()).  This is
              unless the mutator thread is currently in a DeferTermination scope (see (8)
              below).  If in a DeferTermination scope, then it will not throw the
              TerminationException.

              Since the NeedTermination bit is cleared, the VM will no longer call
              VMTraps::handleTraps() to service the event.  If the mutator thread is in
              a DeferTermination scope, then on exiting the scope (at scope destruction),
              the scope will see that VM::m_terminationInProgress is set, and throw the
              deferred TerminationException then.

           c. The TerminationException will trigger unwinding out of the current stack
              until we get to the outermost VMEntryScope.

           d. At the the outermost VMEntryScope, we will clear VM::m_terminationInProgress
              if the NeedTermination bit in VMtraps::m_trapBits is cleared.

              If the NeedTermination bit is set, then that means we haven't thrown the
              TerminationException yet.  Currently, clients expect that we must throw the
              TerminationException if NeedTermination was requested (again, read comments
              at the top of VMTraps.h).

              If the NeedTermination bit is set, we'll leave VM::m_terminationInProgress
              set until the next time we re-enter the VM and exit to the outermost
              VMEntryScope.

           e. The purpose of VM::m_terminationInProgress is to provide a summary of the
              fact that the VM is in a state of trying to terminate the current stack.

              Note that this state is first indicated by the NeedTermination bit being set
              in VMTraps::m_trapBits.  Then, in VMTraps::handleTraps(), the state is
              handed of with the NeedTermination bit being cleared, and the
              TerminationException being thrown.

              While the VM is in this termination state, we need to prevent new DFG/FTL
              JIT code from being compiled and run.  The reason is the firing of the
              NeedTermination event has invalidated DFG/FTL code on the stack, thereby
              allowing their baseline / LLInt versions which have VMTraps polling checks
              to run.  We don't want to compile new DFG / FTL code and possibly get stuck
              in loops in there before the termination is complete.

              In operationOptimize(), we check if VM::m_terminationInProgress is set, and
              prevent new DFG (and therefore FTL) code from being compiled if needed.
              Note: it is easier to check a single flag, VM::m_terminationInProgress,
              then to check both if the NeedTermination bit is set or if the
              TerminationException is being being thrown.

        9. One complication of being able to service VMTraps in RETURN_IF_EXCEPTION checks
           is that some of our code (usually for lengthier initializations and bootstrapping)
           currently does not handle exceptions well, e.g. JSGlobalObject::init().  They
           rely on the code crashing if an exception is thrown while still initializing.

           However, for a worker thread, a TerminationException (requested by the main
           thread) may arrive before the initialization is complete.  This can lead to
           crashes because part of the initialization may be aborted in the presence of
           an exception, while other parts still expect everything prior to have been
           initialized correctly.  For resource exhaustion cases (which is abnormal), it
           is OK to crash.  For the TerminationException (which can be part of normal
           operation), we should not be crashing.

           To work around this, we introduce a DeferTermination RAII scope object that we
           deploy in this type of initialization code.  With the scope in effect,

           a. if a TerminationException arrives but hasn't been thrown yet, it will be
              deferred till the scope ends before being thrown.
           b. if a TerminationException has already been thrown, the scope will stash
              the exception, clear it from the VM so that the initialization code can
              run to completion, and then re-throw the exception when the scope ends.

           Currently, we only need to use the DeferTermination scope in a few places
           where we know that initialization code will only run for a short period of time.

           DeferTermination should not be used for code that can block waiting on an
           external event for a long time.  Obviously, doing so will prevent the VM
           termination mechanism from working.

       10. Replaced llint_slow_path_check_if_exception_is_uncatchable_and_notify_profiler
           and operationCheckIfExceptionIsUncatchableAndNotifyProfiler with
           llint_slow_path_retrieve_and_clear_exception_if_catchable and
           operationRetrieveAndClearExceptionIfCatchable.

           The 2 runtime functions doesn't actually do anything to notify a profiler.
           So, we drop that part of the name.

           After returning from these runtime functions respectively, the previous LLInt
           and JIT code, which calls these runtimes functions, would go on to load
           VM::m_exception, and then store a nullptr there to clear it.  This is wasteful.

           This patch changes the runtime function to clear and return the Exception
           instead.  As a result, the calling LLInt and JIT code is simplified a bit.

           Note also that clearing an exception now also entails clearing the
           NeedExceptionHandling bit in VMTraps::m_trapBits in an atomic way.  The above
           change makes it easy to do this clearing with C++ code.

       11. Fix ScriptFunctionCall::call() to handle exceptions correctly.  Previously,
           it had one case where it propagates an exception, while another eats it.
           Change this function to eat the exception in both cases.  This is approproiate
           because ScriptFunctionCall is only used to execute some Inspector instrumentation
           calls.  It doesn't make sense to propagate the exception back to user code.

       12. Fix the lazy initialization of JSGlobalObject::m_defaultCollator to be able to
           handle the TerminationException.

       13. Not related to TerminationException, but this patch also fixes
           MarkedArgumentBuffer::expandCapacity() to use Gigacage::tryMalloc() instead of
           Gigacage::malloc().  This is needed as one of the fixes to make the
           accompanying test case work.

        This patch increases code size by 320K (144K for JSC, 176K for WebCore) measured
        on x86_64.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::branchTest32):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchTest32):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchTest32):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::branchTest32):
        * bindings/ScriptFunctionCall.cpp:
        (Deprecated::ScriptFunctionCall::call):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCheckTraps):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckTraps):
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):
        (JSC::Interpreter::executeCall):
        (JSC::Interpreter::executeConstruct):
        (JSC::Interpreter::execute):
        (JSC::Interpreter::executeModuleProgram):
        * interpreter/InterpreterInlines.h:
        (JSC::Interpreter::execute):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_check_traps):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_catch):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jit/JITOperations.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ArgList.cpp:
        (JSC::MarkedArgumentBuffer::expandCapacity):
        * runtime/DeferTermination.h: Added.
        (JSC::DeferTermination::DeferTermination):
        (JSC::DeferTermination::~DeferTermination):
        * runtime/ExceptionScope.h:
        (JSC::ExceptionScope::exception const):
        (JSC::ExceptionScope::exception): Deleted.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::finishCreation):
        * runtime/LazyPropertyInlines.h:
        (JSC::ElementType>::callFunc):
        * runtime/StringPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/VM.cpp:
        (JSC::VM::hasExceptionsAfterHandlingTraps):
        (JSC::VM::clearException):
        (JSC::VM::setException):
        (JSC::VM::throwTerminationException):
        (JSC::VM::throwException):
        * runtime/VM.h:
        (JSC::VM::terminationInProgress const):
        (JSC::VM::setTerminationInProgress):
        (JSC::VM::notifyNeedTermination):
        (JSC::VM::DeferExceptionScope::DeferExceptionScope):
        (JSC::VM::DeferExceptionScope::~DeferExceptionScope):
        (JSC::VM::handleTraps): Deleted.
        (JSC::VM::needTrapHandling): Deleted.
        (JSC::VM::needTrapHandlingAddress): Deleted.
        (JSC::VM::setException): Deleted.
        (JSC::VM::clearException): Deleted.
        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::~VMEntryScope):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::tryInstallTrapBreakpoints):
        (JSC::VMTraps::fireTrap):
        (JSC::VMTraps::handleTraps):
        (JSC::VMTraps::takeTopPriorityTrap):
        (JSC::VMTraps::deferTermination):
        (JSC::VMTraps::undoDeferTermination):
        * runtime/VMTraps.h:
        (JSC::VMTraps::onlyContainsAsyncEvents):
        (JSC::VMTraps::needHandling const):
        (JSC::VMTraps::trapBitsAddress):
        (JSC::VMTraps::isDeferringTermination const):
        (JSC::VMTraps::notifyGrabAllLocks):
        (JSC::VMTraps::hasTrapBit):
        (JSC::VMTraps::clearTrapBit):
        (JSC::VMTraps::setTrapBit):
        (JSC::VMTraps::Mask::Mask): Deleted.
        (JSC::VMTraps::Mask::allEventTypes): Deleted.
        (JSC::VMTraps::Mask::bits const): Deleted.
        (JSC::VMTraps::Mask::init): Deleted.
        (JSC::VMTraps::interruptingTraps): Deleted.
        (JSC::VMTraps::needTrapHandling): Deleted.
        (JSC::VMTraps::needTrapHandlingAddress): Deleted.
        (JSC::VMTraps::hasTrapForEvent): Deleted.
        (JSC::VMTraps::setTrapForEvent): Deleted.
        (JSC::VMTraps::clearTrapForEvent): Deleted.

2021-04-09  Alexey Shvayka  <shvaikalesh@gmail.com>

        Remove className() and toStringName() from the method table
        https://bugs.webkit.org/show_bug.cgi?id=224247

        Reviewed by Darin Adler.

        ES6 introduced Symbol.toStringTag to customize Object.prototype.toString return value.
        It was adopted by WebIDL spec, Chrome's DevTools, Node.js etc. There is no reason to
        keep 2 method table methods, each with only 1 call site, instead of using the symbol.

        Also, it's a bit confusing that for some objects, method table's className() returns
        different result than JSCell::className(VM&).

        This change:

        1. Removes JSProxy's className() / toStringName() methods because its target() is a
           global object that never has these overrides and uses Symbol.toStringTag instead.

        2. Removes DebuggerScope's className() / toStringName() overrides because its objectAtScope()
           has these methods extremely rarely (e.g. `with (new Date) {}`), and its not displayed
           by Web Inspector.

        3. Merges JSCallbackObject's className() / toStringName() methods into Symbol.toStringTag
           branch of getOwnPropertySlot(), with permissive property attributes. To avoid any possible
           breakage, we make sure that it will be shadowed by a structure property.

        4. Reworks JSObject::calculatedClassName() to rely on Symbol.toStringTag, matching Chrome's
           DevTools behavior. On its own, it's a nice change for Web Inspector. We make sure to
           lookup Symbol.toStringTag if `constructor.name` inference fails to avoid confusion when
           extending builtins.

        5. Removes now unused className() from the method table.

        6. Removes toStringName() override from JSFinalizationRegistry because its builtin tag [1]
           is already "Object".

        7. Introduces BooleanObjectType for Boolean wrapper object, and Boolean.prototype as it's
           also required to have a [[BooleanData]] internal slot [2].

        8. Reworks Object.prototype.toString to determine builtin tag [1] based on JSType rather than
           performing method table call. It's guaranteed that a) the set of types we are checking
           against won't be expanded, and b) objects with these types have correct `className`.

        9. Removes now unused toStringTag() from the method table.

        This patch is performance-neutral and carefully preserves current behavior for API objects,
        including isPokerBros() hack.

        [1]: https://tc39.es/ecma262/#sec-object.prototype.tostring (steps 5-14)
        [2]: https://tc39.es/ecma262/#sec-properties-of-the-boolean-prototype-object

        * API/JSCallbackObject.h:
        * API/JSCallbackObjectFunctions.h:
        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
        (JSC::JSCallbackObject<Parent>::className): Deleted.
        (JSC::JSCallbackObject<Parent>::toStringName): Deleted.
        * API/tests/testapiScripts/testapi.js:
        * debugger/DebuggerScope.cpp:
        (JSC::DebuggerScope::className): Deleted.
        (JSC::DebuggerScope::toStringName): Deleted.
        * debugger/DebuggerScope.h:
        * runtime/BooleanObject.cpp:
        (JSC::BooleanObject::toStringName): Deleted.
        * runtime/BooleanObject.h:
        (JSC::BooleanObject::createStructure):
        * runtime/BooleanPrototype.h:
        * runtime/ClassInfo.h:
        * runtime/DateInstance.cpp:
        (JSC::DateInstance::toStringName): Deleted.
        * runtime/DateInstance.h:
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::toStringName): Deleted.
        * runtime/ErrorInstance.h:
        * runtime/JSCell.cpp:
        (JSC::JSCell::className): Deleted.
        (JSC::JSCell::toStringName): Deleted.
        * runtime/JSCell.h:
        * runtime/JSFinalizationRegistry.cpp:
        (JSC::JSFinalizationRegistry::toStringName): Deleted.
        * runtime/JSFinalizationRegistry.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::calculatedClassName):
        (JSC::JSObject::className): Deleted.
        (JSC::isPokerBros): Deleted.
        (JSC::JSObject::toStringName): Deleted.
        * runtime/JSObject.h:
        * runtime/JSProxy.cpp:
        (JSC::JSProxy::className): Deleted.
        (JSC::JSProxy::toStringName): Deleted.
        * runtime/JSProxy.h:
        * runtime/JSType.cpp:
        (WTF::printInternal):
        * runtime/JSType.h:
        * runtime/NumberObject.cpp:
        (JSC::NumberObject::toStringName): Deleted.
        * runtime/NumberObject.h:
        (JSC::NumberObject::createStructure):
        * runtime/ObjectPrototype.cpp:
        (JSC::isPokerBros):
        (JSC::inferBuiltinTag):
        (JSC::objectPrototypeToString):
        1. Removes jsNontrivialString() because it's assertion may fail in case of iOS hack.
        2. Utilizes AtomStringImpl to avoid allocating StringImpl for a small fixed set of strings.

        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::toStringName): Deleted.
        * runtime/RegExpObject.h:
        * runtime/StringObject.cpp:
        (JSC::StringObject::toStringName): Deleted.
        * runtime/StringObject.h:

2021-04-08  Khem Raj  <raj.khem@gmail.com>

        [WPE] Build fixes for musl C library on Linux
        https://bugs.webkit.org/show_bug.cgi?id=210068

        Reviewed by Carlos Alberto Lopez Perez.

        Use OS(LINUX) to include musl in platform test
        for linux and consolidate all linux platfrom
        under same test. Use smaller limits for JSC
        stack size per thread and reserved zone size.

        * runtime/MachineContext.h:
        (JSC::MachineContext::stackPointerImpl):
        (JSC::MachineContext::framePointerImpl):
        (JSC::MachineContext::instructionPointerImpl):
        (JSC::MachineContext::argumentPointer<1>):
        (JSC::MachineContext::llintInstructionPointer):
        * runtime/OptionsList.h:

2021-04-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] DUCET level-1 weighs are equal if characters are alphabets
        https://bugs.webkit.org/show_bug.cgi?id=224047

        Reviewed by Saam Barati and Mark Lam.

        ASCII comparison optimization was based on that DUCET level-1 weights are all different (except for 0000 case), but this was wrong.
        If we have the same latin letters with different capitalization, then they have the same level-1 weight ('A' v.s. 'a').
        In this patch,

            1. If we found that the result of level-1 weight comparison is equal, and characters are not equal, then we do level-3 weight comparison.
               We do not perform level-2 since they are all the same weight in ASCII (excluding control characters) region.
            2. We do not perform level-4 weight comparison since level-1 and level-3 comparison must distinguish the strings. Level-1 weights are equal
               only when characters are the same latin letters. And level-3 weight puts different weights for capital latin letters. Since we already know
               that these strings are different while they are equal in level-1 weight comparison, the only case is that they have same latin letters in
               the same position. In that case, level-3 weight must say different results for these characters so that we never meet "equal" status in
               level-3 weight comparison if characters are different.

        * runtime/IntlObject.cpp:
        * runtime/IntlObject.h:
        * runtime/IntlObjectInlines.h:
        (JSC::canUseASCIIUCADUCETComparison):
        (JSC::compareASCIIWithUCADUCETLevel3):
        (JSC::compareASCIIWithUCADUCET):

2021-04-02  Darin Adler  <darin@apple.com>

        Use Hasher more, remove IntegerHasher, fix hashing-related mistakes
        https://bugs.webkit.org/show_bug.cgi?id=224138

        Reviewed by Chris Dumez.

        * bytecode/BytecodeIndex.h:
        (JSC::BytecodeIndex::hash const): Remove unneeded WTF prefix on call
        to intHash.

        * ftl/FTLAbstractHeap.h: Use HashTraits instead of WTF::GenericHashTraits.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::validateAIState): Remove unneeded WTF
        prefix on call to intHash.

        * wasm/WasmLLIntGenerator.cpp: Use HashTraits instead of WTF::GenericHashTraits.

2021-04-07  Mark Lam  <mark.lam@apple.com>

        Rename and make the TerminationException a singleton.
        https://bugs.webkit.org/show_bug.cgi?id=224295

        Reviewed by Keith Miller.

        We previously call it the TerminatedExecutionException, which is a mouthful but
        adds no meaningful information.  It's now renamed to TerminationException.

        We can make it a singleton because the TerminationException is just a VM internal
        mechanism for implementing the termination of the current execution stack.  It
        should never be exposed to user JS code, and therefore, there is no value in
        making it a JS object.  Making it a singleton simplifies the code.

        A TerminationException is now implemented as an Exception cell which holds a
        Symbol with the name "TerminationError".  The TerminationException is only created
        if needed e.g. if the JSC watchdog is created, or if the VM is for a Worker thread
        which needs to be able to handle termination requests.

        We'll also stop notifying the debugger when we throw the TerminationException.
        This is because the TerminationException is not like ordinary exceptions that
        should be reported to the debugger. The fact that the TerminationException uses
        the exception handling mechanism is just a VM internal implementation detail.
        It is not meaningful to report it to the debugger as an exception.

        * API/JSContext.mm:
        (-[JSContext evaluateJSScript:]):
        * API/tests/ExecutionTimeLimitTest.cpp:
        (testExecutionTimeLimit):
        * bindings/ScriptFunctionCall.cpp:
        (Deprecated::ScriptFunctionCall::call):
        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * inspector/InjectedScriptManager.cpp:
        (Inspector::InjectedScriptManager::injectedScriptFor):
        * inspector/JSGlobalObjectInspectorController.cpp:
        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::unwind):
        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
        * jit/JITOperations.cpp:
        (JSC::JSC_DEFINE_JIT_OPERATION):
        * jsc.cpp:
        (checkException):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * runtime/ExceptionHelpers.cpp:
        (JSC::TerminatedExecutionError::defaultValue): Deleted.
        (JSC::createTerminatedExecutionException): Deleted.
        (JSC::isTerminatedExecutionException): Deleted.
        (JSC::throwTerminatedExecutionException): Deleted.
        * runtime/ExceptionHelpers.h:
        (): Deleted.
        * runtime/JSObject.h:
        (JSC::JSObject::get const):
        * runtime/JSPromise.cpp:
        (JSC::JSPromise::rejectWithCaughtException):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        (JSC::VM::ensureWatchdog):
        (JSC::VM::ensureTerminationException):
        (JSC::VM::throwTerminationException):
        (JSC::VM::throwException):
        * runtime/VM.h:
        (JSC::VM::terminationException const):
        (JSC::VM::isTerminationException const):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::handleTraps):

2021-04-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector more in bytecode dir and JumpTable
        https://bugs.webkit.org/show_bug.cgi?id=224275

        Reviewed by Michael Saboff and Mark Lam.

        1. Use FixedVector more in bytecode/ directory's long-living data structures.
        2. Use FixedVector in SimpleJumpTable. This involves LLInt changes because we need to access FixedVector data from LLInt.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        * bytecode/InlineCallFrame.cpp:
        (JSC::InlineCallFrame::dumpInContext const):
        * bytecode/InlineCallFrame.h:
        * bytecode/JumpTable.h:
        (JSC::SimpleJumpTable::clear):
        * bytecode/ObjectPropertyConditionSet.cpp:
        (JSC::ObjectPropertyConditionSet::mergedWith const):
        (JSC::ObjectPropertyConditionSet::dumpInContext const):
        (JSC::ObjectPropertyConditionSet::isValidAndWatchable const):
        * bytecode/ObjectPropertyConditionSet.h:
        (JSC::ObjectPropertyConditionSet::create):
        (JSC::ObjectPropertyConditionSet::isValid const):
        (JSC::ObjectPropertyConditionSet::size const):
        (JSC::ObjectPropertyConditionSet::begin const):
        (JSC::ObjectPropertyConditionSet::end const):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
        (JSC::DFG::ByteCodeParser::flushImpl):
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        * dfg/DFGCommonData.cpp:
        (JSC::DFG::CommonData::validateReferences):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::isLiveInBytecode):
        * dfg/DFGGraph.h:
        * dfg/DFGPreciseLocalClobberize.h:
        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
        * dfg/DFGStackLayoutPhase.cpp:
        (JSC::DFG::StackLayoutPhase::run):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::argumentsStart):
        * jit/SetupVarargsFrame.cpp:
        (JSC::emitSetupVarargsFrameFastCase):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ClonedArguments.cpp:
        (JSC::ClonedArguments::createWithInlineFrame):

2021-04-07  Mark Lam  <mark.lam@apple.com>

        Fix a typo in JITUncoughtExceptionAfterCall.
        https://bugs.webkit.org/show_bug.cgi?id=224290

        Reviewed by Keith Miller.

        * assembler/AbortReason.h:
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::jitReleaseAssertNoException):

2021-04-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] WasmMemory caging should care about nullptr
        https://bugs.webkit.org/show_bug.cgi?id=224268
        <rdar://problem/74654838>

        Reviewed by Mark Lam.

        1. Fix Wasm::MemoryHandle::boundsCheckingSize. We should just return m_mappedCapacity here since UINT32_MAX is not 4GB.
           This checking size can include redzone for fast-memory, but this is OK: bounds-check pass in LLInt (in upper tiers, we
           do not use bounds-check for fast-memory), and access to redzone, then fault occurs and signal handler can make it error
           since signal handler is checking whether the access is within Memory::fastMappedBytes which includes redzone.
        2. Fix caging of wasm memory-base pointer in LLInt. We should use pointer sized length since it can be larger than 4GB.
           And we should handle nullptr case correctly: Wasm::MemoryHandle's memory can be nullptr when mapped size is zero.
           caging needs to handle this case as we do in CagedPtr::getMayBeNull.

        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagArrayPtrLength32):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
        * llint/LowLevelInterpreter64.asm:
        * llint/WebAssembly.asm:
        * offlineasm/arm64e.rb:
        * offlineasm/ast.rb:
        * offlineasm/instructions.rb:
        * runtime/CagedBarrierPtr.h:
        (JSC::CagedBarrierPtr::CagedBarrierPtr):
        (JSC::CagedBarrierPtr::set):
        (JSC::CagedBarrierPtr::get const):
        (JSC::CagedBarrierPtr::getMayBeNull const):
        (JSC::CagedBarrierPtr::at const):
        (JSC::CagedBarrierPtr::setWithoutBarrier):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::updateCachedMemory):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::MemoryHandle::MemoryHandle):
        * wasm/WasmMemory.h:

2021-04-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use FixedVector more in JSC
        https://bugs.webkit.org/show_bug.cgi?id=224255

        Reviewed by Mark Lam.

        Use FixedVector more aggressively. This reduces sizeof(Holder) since sizeof(FixedVector) is 8
        while sizeof(Vector) is 16. And since this allocates just-fit size, this does not waste memory.

        * bytecode/BytecodeLivenessAnalysis.cpp:
        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
        * bytecode/BytecodeLivenessAnalysis.h:
        * bytecode/FullBytecodeLiveness.h:
        (JSC::FullBytecodeLiveness::FullBytecodeLiveness):
        * bytecode/UnlinkedEvalCodeBlock.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::livenessFor):
        * ftl/FTLForOSREntryJITCode.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        * ftl/FTLOSRExit.cpp:
        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
        * ftl/FTLOSRExit.h:
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileRecovery):
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::sweepPreciseAllocations):
        * jit/RegisterAtOffsetList.cpp:
        (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
        * jit/RegisterAtOffsetList.h:
        (JSC::RegisterAtOffsetList::begin const):
        (JSC::RegisterAtOffsetList::end const):
        (JSC::RegisterAtOffsetList::clear): Deleted.
        * runtime/JSGlobalObject.h:
        * runtime/JSModuleNamespaceObject.cpp:
        (JSC::JSModuleNamespaceObject::finishCreation):
        * runtime/JSModuleNamespaceObject.h:
        * yarr/YarrPattern.h:
        (JSC::Yarr::YarrPattern::resetForReparsing):

2021-04-06  Alexey Shvayka  <shvaikalesh@gmail.com>

        Symbol and BigInt wrapper objects should perform OrdinaryToPrimitive
        https://bugs.webkit.org/show_bug.cgi?id=224208

        Reviewed by Yusuke Suzuki.

        ES6 introduced Symbol.toPrimitive as the only way to override ToPrimitive;
        if it's nullish, OrdinaryToPrimitive [1] is performed unconditionally.

        This patch removes two redundant defaultValue() overrides, fixing JSC to call
        (possibly userland) toString() / valueOf() methods of a) Symbol objects whose
        Symbol.toPrimitive was removed, and b) BigInt wrapper objects.

        Aligns JSC with V8 and SpiderMonkey. Coercion of primitives is unaffected.
        Also, removes dummy BigIntObject::internalValue() override.

        [1]: https://tc39.es/ecma262/#sec-toprimitive (step 2.d)

        * runtime/BigIntObject.cpp:
        (JSC::BigIntObject::defaultValue): Deleted.
        * runtime/BigIntObject.h:
        * runtime/SymbolObject.cpp:
        (JSC::SymbolObject::defaultValue): Deleted.
        * runtime/SymbolObject.h:

2021-04-06  Alexey Shvayka  <shvaikalesh@gmail.com>

        Array's toString() is incorrect if join() is non-callable
        https://bugs.webkit.org/show_bug.cgi?id=224215

        Reviewed by Yusuke Suzuki.

        This patch exposes objectPrototypeToString() to be used by Array.prototype.toString
        if "join" lookup doesn't return a callable value [1].

        Fixes Array's toString() to return the correct tag instead of internal `className`,
        perform Symbol.toStringTag lookup, and throw for revoked Proxy objects.
        Aligns JSC with V8 and SpiderMonkey.

        Also, a few objectPrototypeToString() tweaks: a bit nicer `undefined` / `null`
        checks and simpler toObject() exception handling.

        [1]: https://tc39.es/ecma262/#sec-array.prototype.tostring (step 3)

        * runtime/ArrayPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectPrototype.cpp:
        (JSC::objectPrototypeToString):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/ObjectPrototype.h:

2021-04-06  Yusuke Suzuki  <ysuzuki@apple.com>

        [WTF] Introduce FixedVector and use it for FixedOperands
        https://bugs.webkit.org/show_bug.cgi?id=224171

        Reviewed by Mark Lam.

        Define FixedOperands<T> which uses FixedVector for its storage. We use FixedOperands in FTL::OSRExitDescriptor.
        We also replace RefCountedArray<T> with FixedVector<T> if they are not requiring RefCountedArray<T>'s ref-counting
        semantics.

        * bytecode/BytecodeGeneratorification.cpp:
        (JSC::BytecodeGeneratorification::run):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::setNumParameters):
        (JSC::CodeBlock::setRareCaseProfiles):
        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
        * bytecode/CodeBlock.h:
        * bytecode/Operands.h:
        (JSC::Operands::Operands):
        * bytecode/OperandsInlines.h:
        (JSC::U>::dumpInContext const):
        (JSC::U>::dump const):
        (JSC::Operands<T>::dumpInContext const): Deleted.
        (JSC::Operands<T>::dump const): Deleted.
        * bytecode/PolyProtoAccessChain.h:
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo):
        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeIndex const):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::expressionInfo):
        (JSC::UnlinkedCodeBlock::identifiers const):
        (JSC::UnlinkedCodeBlock::constantRegisters):
        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation):
        (JSC::UnlinkedCodeBlock::constantIdentifierSets):
        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets const):
        * bytecode/UnlinkedFunctionExecutable.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::prepareJumpTableForSwitch):
        * dfg/DFGJITCode.h:
        * dfg/DFGPlan.h:
        (JSC::DFG::Plan::tierUpInLoopHierarchy):
        * ftl/FTLOSRExit.h:
        * jit/GCAwareJITStubRoutine.h:
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileSlowCases):
        * jit/PolymorphicCallStubRoutine.h:
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/LowLevelInterpreter.asm:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseClassFieldInitializerSourceElements):
        * parser/Parser.h:
        (JSC::Parser<LexerType>::parse):
        (JSC::parse):
        * runtime/CachedTypes.cpp:
        (JSC::CachedVector::encode):
        (JSC::CachedVector::decode const):
        * wasm/js/JSWebAssemblyInstance.h:

2021-04-05  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Shrink some of Vectors in JSC
        https://bugs.webkit.org/show_bug.cgi?id=224162

        Reviewed by Simon Fraser.

        1. Add XXXStatus::shrinkToFit to shrink underlying dynamic Vectors.
        2. Replace tierUpInLoopHierarchy's Vector with RefCountedArray since it is constructed-once-lookup-only data.
        3. Use MemoryCompactLookupOnlyRobinHoodHashSet for StringTables since this is constructed-once-lookup-only data. We also add
           MemoryCompactLookupOnlyRobinHoodHashSet support for CachedTypes.
        4. Use resizeToFit for StringSwitchJumpTables and SwitchJumpTables.
        5. JITStubRoutineSet's Vector should be shrunk.
        6. BlockDirectoryBits's Vector's initial size should be small.
        7. Make PolyProtoAccessChain RefCounted, and use RefCountedArray for its Vector<StructureID>. And remove PolyProtoAccessChain::clone.
           Just having Ref is enough since this is immutable data.
        8. Use RefCountedArray for UnlinkedFunctionExecutable's m_classFieldLocations.
        9. Use RefCountedArray for JSWebAssemblyInstance.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::AccessCase):
        (JSC::AccessCase::create):
        (JSC::AccessCase::createTransition):
        * bytecode/AccessCase.h:
        (JSC::AccessCase::AccessCase): Deleted.
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::setFrameShuffleData):
        * bytecode/CheckPrivateBrandStatus.cpp:
        (JSC::CheckPrivateBrandStatus::shrinkToFit):
        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::CheckPrivateBrandStatus::merge):
        * bytecode/CheckPrivateBrandStatus.h:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        * bytecode/DeleteByStatus.cpp:
        (JSC::DeleteByStatus::shrinkToFit):
        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::DeleteByStatus::merge):
        * bytecode/DeleteByStatus.h:
        * bytecode/GetByStatus.cpp:
        (JSC::GetByStatus::shrinkToFit):
        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::GetByStatus::computeFor):
        (JSC::GetByStatus::merge):
        * bytecode/GetByStatus.h:
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::GetterSetterAccessCase):
        (JSC::GetterSetterAccessCase::create):
        * bytecode/GetterSetterAccessCase.h:
        * bytecode/InByIdStatus.cpp:
        (JSC::InByIdStatus::shrinkToFit):
        (JSC::InByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::InByIdStatus::merge):
        * bytecode/InByIdStatus.h:
        * bytecode/InstanceOfStatus.cpp:
        (JSC::InstanceOfStatus::shrinkToFit):
        (JSC::InstanceOfStatus::computeForStubInfo):
        * bytecode/InstanceOfStatus.h:
        * bytecode/IntrinsicGetterAccessCase.cpp:
        (JSC::IntrinsicGetterAccessCase::IntrinsicGetterAccessCase):
        (JSC::IntrinsicGetterAccessCase::create):
        * bytecode/IntrinsicGetterAccessCase.h:
        * bytecode/JumpTable.h:
        * bytecode/PolyProtoAccessChain.cpp:
        (JSC::PolyProtoAccessChain::tryCreate):
        (JSC::PolyProtoAccessChain::create): Deleted.
        * bytecode/PolyProtoAccessChain.h:
        (JSC::PolyProtoAccessChain::clone): Deleted.
        (JSC::PolyProtoAccessChain::chain const): Deleted.
        (JSC::PolyProtoAccessChain::operator!= const): Deleted.
        (JSC::PolyProtoAccessChain::forEach const): Deleted.
        (JSC::PolyProtoAccessChain::slotBaseStructure const): Deleted.
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::visitWeak const):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        * bytecode/ProxyableAccessCase.cpp:
        (JSC::ProxyableAccessCase::ProxyableAccessCase):
        (JSC::ProxyableAccessCase::create):
        * bytecode/ProxyableAccessCase.h:
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::shrinkToFit):
        (JSC::PutByIdStatus::computeForStubInfo):
        (JSC::PutByIdStatus::computeFor):
        (JSC::PutByIdStatus::merge):
        * bytecode/PutByIdStatus.h:
        * bytecode/SetPrivateBrandStatus.cpp:
        (JSC::SetPrivateBrandStatus::shrinkToFit):
        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
        (JSC::SetPrivateBrandStatus::merge):
        * bytecode/SetPrivateBrandStatus.h:
        * bytecode/UnlinkedCodeBlock.h:
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::generateUnlinkedFunctionCodeBlock):
        * bytecode/UnlinkedFunctionExecutable.h:
        * dfg/DFGJITCode.h:
        * dfg/DFGPlan.h:
        (JSC::DFG::Plan::tierUpInLoopHierarchy):
        * dfg/DFGTierUpCheckInjectionPhase.cpp:
        (JSC::DFG::TierUpCheckInjectionPhase::run):
        * heap/BlockDirectoryBits.h:
        * heap/JITStubRoutineSet.cpp:
        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
        * jit/CallFrameShuffleData.h:
        (JSC::CallFrameShuffleData::shrinkToFit):
        * jit/GCAwareJITStubRoutine.h:
        * jit/PolymorphicCallStubRoutine.h:
        * jit/Repatch.cpp:
        (JSC::tryCacheGetBy):
        (JSC::tryCachePutByID):
        (JSC::tryCacheInByID):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseClassFieldInitializerSourceElements):
        * parser/Parser.h:
        (JSC::Parser<LexerType>::parse):
        (JSC::parse):
        * runtime/CachedTypes.cpp:
        (JSC::CachedFunctionExecutableRareData::encode):
        (JSC::CachedFunctionExecutableRareData::decode const):
        * runtime/VM.cpp:
        (JSC::VM::popAllCheckpointOSRSideStateUntil):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::visitChildrenImpl):
        * wasm/js/JSWebAssemblyInstance.h:

2021-04-05  Alex Christensen  <achristensen@webkit.org>

        Resurrect Mac CMake build
        https://bugs.webkit.org/show_bug.cgi?id=224084

        Reviewed by Tim Horton.

        * PlatformMac.cmake:

2021-04-05  Keith Miller  <keith_miller@apple.com>

        DFG arity fixup nodes should exit to the caller's call opcode
        https://bugs.webkit.org/show_bug.cgi?id=223278

        Reviewed by Saam Barati.

        Right now when we do arity fixup in the DFG we model it in the
        same way that it executes, which means all the nodes are part of
        the callee. Unfortunately, this causes PhantomInsertionPhase to
        think those nodes could be replacing previously defined
        VirtualRegisters as they are part of the callee's header (always
        alive). When PhantomInsertionPhase then inserts a Phantom it will
        put that node in the caller's frame as that's the first ExitOK
        node. The caller however may have no knowledge of that
        VirtualRegister though. For example:

        --> foo: loc10 is a local in foo.
            ...
            1: MovHint(loc10)
            2: SetLocal(loc10)
        <-- foo // loc10 ten is now out of scope for the InlineCallFrame of the caller.
        ...
        // Phantom will be inserted here refering to loc10, which doesn't make sense.
        --> bar // loc10 is an argument to bar and needs arity fixup.
            ... // All of these nodes are ExitInvalid
            3: MovHint(loc10, ExitInvalid)
            4: SetLocal(loc10, ExitInvalid)
            ...

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::currentNodeOrigin):
        (JSC::DFG::ByteCodeParser::inlineCall):

2021-04-02  Alexey Shvayka  <shvaikalesh@gmail.com>

        Reduce bytecode instruction count emitted for `class extends`
        https://bugs.webkit.org/show_bug.cgi?id=223884

        Reviewed by Yusuke Suzuki.

        This patch adds a variant of globalFuncSetPrototypeDirect() that throws on
        invalid [[Prototype]] values (instead of ignoring them) and utilizes it in
        ClassExprNode::emitBytecode(), removing equivalent checks.

        Throwing for invalid `superclass.prototype` value after setting the [[Prototype]]
        of `constructor` is unobservable because it's a newly created extensible object
        and `superclass` is a proven object.

        The fact that [[Prototype]] set can throw only in case of `superclass.prototype`
        allows keeping descriptive error message via custom appender. To find "extends"
        in a source code, ClassExprNode is made an instance of ThrowableExpressionData.

        This change reduces the number of emitted bytecodes by 4, and fixes IsConstructor's
        error [1] to point to correct source code location.

        [1]: https://tc39.es/ecma262/#sec-runtime-semantics-classdefinitionevaluation (step 5.f)

        * builtins/BuiltinNames.h:
        * bytecode/LinkTimeConstant.h:
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitDirectSetPrototypeOf):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::PropertyListNode::emitPutConstantProperty):
        (JSC::ClassExprNode::emitBytecode):
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createClassExpr):
        * parser/Nodes.h:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseClass):
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createClassExpr):
        * runtime/ExceptionHelpers.cpp:
        (JSC::invalidPrototypeSourceAppender):
        (JSC::createInvalidPrototypeError):
        * runtime/ExceptionHelpers.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSGlobalObjectFunctions.h:

2021-04-02  Jessica Tallon  <jtallon@igalia.com>

        Add type method to WebAssembly.Memory, WebAssembly.Table & WebAssembly.Global objects
        https://bugs.webkit.org/show_bug.cgi?id=222412

        Reviewed by Yusuke Suzuki.

        This adds a type method to several WASM objects as part of the work to add WASM
        type reflections to the JS-API. The methods return a JSON object which describes
        the type of the object and can be passed to the constructor to create a new wasm
        object of that type.

         * wasm/js/JSWebAssemblyGlobal.cpp:
        (JSC::JSWebAssemblyGlobal::type):
        * wasm/js/JSWebAssemblyGlobal.h:
        * wasm/js/JSWebAssemblyMemory.cpp:
        (JSC::JSWebAssemblyMemory::type):
        * wasm/js/JSWebAssemblyMemory.h:
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::type):
        * wasm/js/JSWebAssemblyTable.h:
        * wasm/js/WebAssemblyGlobalPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyGlobalPrototype.h:
        * wasm/js/WebAssemblyMemoryPrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * wasm/js/WebAssemblyTablePrototype.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-04-01  Yusuke Suzuki  <ysuzuki@apple.com>

        [WTF] Introduce RobinHoodHashTable
        https://bugs.webkit.org/show_bug.cgi?id=223895

        Reviewed by Fil Pizlo.

        * builtins/BuiltinNames.cpp:
        (JSC::lookUpPrivateNameImpl):
        (JSC::lookUpWellKnownSymbolImpl):
        * builtins/BuiltinNames.h:
        * bytecode/BytecodeIntrinsicRegistry.h:
        * runtime/Identifier.h:
        * runtime/IntlCollator.cpp:
        (JSC::IntlCollator::initializeCollator):
        (JSC::IntlCollator::checkICULocaleInvariants):
        * runtime/IntlCollator.h:
        * runtime/IntlDateTimeFormat.cpp:
        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
        * runtime/IntlDateTimeFormatConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlDisplayNames.cpp:
        (JSC::IntlDisplayNames::initializeDisplayNames):
        * runtime/IntlDisplayNamesConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlListFormat.cpp:
        (JSC::IntlListFormat::initializeListFormat):
        * runtime/IntlListFormatConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat):
        * runtime/IntlNumberFormatConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlObject.cpp:
        (JSC::addScriptlessLocaleIfNeeded):
        (JSC::intlAvailableLocales):
        (JSC::intlCollatorAvailableLocales):
        (JSC::intlSegmenterAvailableLocales):
        (JSC::bestAvailableLocale):
        (JSC::lookupMatcher):
        (JSC::bestFitMatcher):
        (JSC::resolveLocale):
        (JSC::lookupSupportedLocales):
        (JSC::bestFitSupportedLocales):
        (JSC::supportedLocales):
        * runtime/IntlObject.h:
        (JSC::intlDateTimeFormatAvailableLocales):
        (JSC::intlDisplayNamesAvailableLocales):
        (JSC::intlNumberFormatAvailableLocales):
        (JSC::intlPluralRulesAvailableLocales):
        (JSC::intlRelativeTimeFormatAvailableLocales):
        (JSC::intlListFormatAvailableLocales):
        * runtime/IntlPluralRules.cpp:
        (JSC::IntlPluralRules::initializePluralRules):
        * runtime/IntlPluralRulesConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlRelativeTimeFormat.cpp:
        (JSC::IntlRelativeTimeFormat::initializeRelativeTimeFormat):
        * runtime/IntlRelativeTimeFormatConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/IntlSegmenter.cpp:
        (JSC::IntlSegmenter::initializeSegmenter):
        * runtime/IntlSegmenterConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/RegExpCache.h:
        * runtime/RegExpKey.h:

2021-04-01  Yusuke Suzuki  <ysuzuki@apple.com>

        REGRESSION(r274724): JITCage trampoline needs to be adjusted
        https://bugs.webkit.org/show_bug.cgi?id=224065

        Reviewed by Saam Barati.

        r274724 introduced a new parameter to custom setters, but it didn't change the parameter recognization of JITCage trampolines for custom accessors.
        As a result, we are jumping with the wrong pointer, and crash when custom setter is called with JITCage.

        This patch fixes the above bug.

        1. Now, custom getter and custom setter have different number of parameters. We should have two different trampolines to invoke it. We remove vmEntryCustomAccessor, and
           add vmEntryCustomGetter/vmEntryCustomSetter.
        2. vmEntryCustomSetter should use a4 parameter as a executable address for trampoline.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
        * llint/LLIntThunks.cpp:
        * llint/LLIntThunks.h:
        * llint/LowLevelInterpreter.asm:
        * offlineasm/arm64.rb:
        * offlineasm/registers.rb:
        * runtime/PropertySlot.h:

2021-04-01  Ross Kirsling  <ross.kirsling@sony.com>

        [JSC] Use ucal_getTimeZoneOffsetFromLocal if ICU 69 is present
        https://bugs.webkit.org/show_bug.cgi?id=224075

        Reviewed by Yusuke Suzuki.

        Apple ICU 68 cherry picked ucal_getTimeZoneOffsetFromLocal (see r223783),
        but now that ICU 69 is in RC, we can go ahead and update the #if for non-Apple platforms.

        * runtime/JSDateMath.cpp:

2021-04-01  Tadeu Zagallo  <tzagallo@apple.com>

        Remove use of ENABLE from API header
        https://bugs.webkit.org/show_bug.cgi?id=224060
        <rdar://76111678>

        Reviewed by Mark Lam.

        The use of the ENABLE macro in these API headers has caused build failures. Instead of
        conditionally exposing these API methods we make them into no-ops if DFG is disabled.

        * API/JSVirtualMachine.mm:
        (+[JSVirtualMachine setNumberOfDFGCompilerThreads:]):
        (+[JSVirtualMachine setNumberOfFTLCompilerThreads:]):
        * API/JSVirtualMachinePrivate.h:

2021-04-01  Alexey Shvayka  <shvaikalesh@gmail.com>

        Optimize createListFromArrayLike() and Proxy's [[OwnPropertyKeys]] method
        https://bugs.webkit.org/show_bug.cgi?id=223928

        Reviewed by Yusuke Suzuki.

        createListFromArrayLike() changes:

          1. Use toLength() / getIndex() methods that have fast paths.
          2. Remove RuntimeTypeMask and error messages from its signature: type checks are better
             performed in advance / inside a functor to keep the helper more versatile.
          3. Invert functor's return value to align with Structure::forEachProperty() and friends.
          4. Rename it to forEachInArrayLike() as no list is actually returned.

        ProxyObject::performGetOwnPropertyNames() changes:

          1. Remove RuntimeTypeMask filtering as it's already performed by PropertyNameArray::add().
          2. Store target's keys in a HashSet for faster insertion / search.
          3. Don't populate `targetConfigurableKeys` for extensible target as it won't be used [1].
          4. Leverage return value of HashSet::remove() instead of using a helper.

        This patch advances Proxy's [[OwnPropertyKeys]] microbenchmarks by 20-30%,
        mainly due to createListFromArrayLike() changes. No behavior changes.

        Also, utilizes forEachInArrayLike() for allow list of JSON.stringify().

        [1]: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys (step 20)

        * runtime/JSONObject.cpp:
        (JSC::Stringifier::Stringifier):
        * runtime/JSObject.h:
        (JSC::JSObject::getIndex const):
        * runtime/JSObjectInlines.h:
        (JSC::forEachInArrayLike):
        (JSC::createListFromArrayLike): Deleted.
        * runtime/ProxyObject.cpp:
        (JSC::ProxyObject::performGetOwnPropertyNames):
        * runtime/ReflectObject.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):

2021-03-31  David Kilzer  <ddkilzer@apple.com>

        UBSan: JSC::Parser<LexerType>::parseProperty(): runtime error: load of value nnn, which is not a valid value for type 'bool'
        <https://webkit.org/b/223896>
        <rdar://problem/75970132>

        Reviewed by Darin Adler.

        Based on a suggestion by Darin Adler.

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseProperty):
        - Change 'escaped' to 'wasUnescapedIdent' to avoid the undefined
          behavior since m_token.m_data.escaped is only set in the case
          when an identifer is parsed (in Lexer<>::parseIdentifer()),
          not a string (in Lexer<>::parseString()). This simplifies the
          logic later in the method.

2021-03-31  Mark Lam  <mark.lam@apple.com>

        Missing exception check in HashMapImpl::add().
        https://bugs.webkit.org/show_bug.cgi?id=224007
        rdar://76053163

        Reviewed by Saam Barati.

        * runtime/HashMapImpl.h:
        (JSC::HashMapImpl::add):

2021-03-31  Xan Lopez  <xan@igalia.com>

        [JSC] Remove warnings about unnecessary operator= for ARMv7Assembler LinkRecord
        https://bugs.webkit.org/show_bug.cgi?id=223916

        Reviewed by Darin Adler.

        Many years ago we defined an assignment operator for LinkRecord in
        order to speed up build times (see #90930). Recent GCC versions
        tell us that if we do that we almost certainly want to define a
        copy constructor too. The ARM64Assembler file already does it, so
        do it too for ARMv7 to remove the warnings.

        * assembler/ARM64Assembler.h:
        * assembler/ARMv7Assembler.h:
        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
        (JSC::ARMv7Assembler::LinkRecord::operator=):

2021-03-31  Alexey Shvayka  <shvaikalesh@gmail.com>

        Optimize constructors of ES6 collections
        https://bugs.webkit.org/show_bug.cgi?id=223953

        Reviewed by Yusuke Suzuki.

        This patch speeds up the constructors by avoiding call() for non-observable
        "set" / "add" methods and using getIndex() for Map / WeakMap collections.

        For Map / Set, this change leverages existing cloning helpers, which rely on
        watchpoints, to avoid even a method lookup. However, slower path is used for
        subclasses. Results in 1.9x speed-up for common case.

        For WeakMap / WeakSet, adder function is checked by C++ pointer, which enables
        fast path even for cross-realm subclasses. Results in 2.3x progression.

        Both approaches require special handling of a cross-realm NewTarget to ensure
        that raised exceptions (OOM / TypeError) belong to realm of the adder function,
        and not to constructor's or NewTarget's.

        Also, adds descriptve error messages for non-callable "set" / "add" properties.

        * runtime/JSMap.cpp:
        (JSC::JSMap::isSetFastAndNonObservable):
        (JSC::JSMap::canCloneFastAndNonObservable): Deleted.
        * runtime/JSMap.h:
        * runtime/JSSet.cpp:
        (JSC::JSSet::isAddFastAndNonObservable):
        (JSC::JSSet::canCloneFastAndNonObservable): Deleted.
        * runtime/JSSet.h:
        * runtime/MapConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/SetConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/WeakMapConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/WeakMapPrototype.cpp:
        (JSC::WeakMapPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/WeakMapPrototype.h:
        * runtime/WeakSetConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/WeakSetPrototype.cpp:
        (JSC::WeakSetPrototype::finishCreation):
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/WeakSetPrototype.h:

2021-03-30  Devin Rousso  <drousso@apple.com>

        REGRESSION(r274607): media controls script is visible in Web Inspector even without the engineering "Show WebKit-internal scripts" enabled
        https://bugs.webkit.org/show_bug.cgi?id=223961

        Reviewed by Yusuke Suzuki.

        It turns out that Web Inspector will only ignore scripts that have a source URL directive
        that matches `__InjectedScript_*.js`, not those that have a (source) URL matching that.

        In addition to Web Inspector ignoring these scripts in the UI, it will also cause the
        `Debugger` to not pause in scripts with a matching source URL directive (unless the
        local build engineering only "Pause in WebKit-internal scripts" is enabled).

        * Scripts/make-js-file-arrays.py:
        (main):
        Add a `//# sourceURL=__InjectedScript_*.js` to the contents before it's encoded.

2021-03-30  Sam Weinig  <weinig@apple.com>

        JSGlobalObject's m_customGetterFunctionMap and m_customSetterFunctionMap should be sets, not maps, and should use both the identifier and function pointer as the key
        https://bugs.webkit.org/show_bug.cgi?id=223613

        Reviewed by Saam Barati.

        - Adds a generic WeakGCSet class to go with the existing WeakGCMap.
        - Renames WeakGCMapBase to WeakGCHashTable, moves it to its own file
          and now uses it as the base class of both WeakGCSet and WeakGCMap.
        - Replaces JSGlobalObject's customGetterFunctionMap/customSetterFunctionMap
          with customGetterFunctionSet/customSetterFunctionSet, using the new
          WeakGCSet, and updates them to use both the function pointer and 
          property name for the key, rather than just the function pointer which
          is what the previous code did. This allows multiple custom functions
          to use the same underlying function pointer as long as they have distinct
          property names, which is going to be used to optimize the bindings for
          CSSStyleDeclaration.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        Add new files.

        * heap/Heap.cpp:
        (JSC::Heap::runEndPhase):
        (JSC::Heap::pruneStaleEntriesFromWeakGCHashTables):
        (JSC::Heap::registerWeakGCHashTable):
        (JSC::Heap::unregisterWeakGCHashTable):
        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps): Deleted.
        (JSC::Heap::registerWeakGCMap): Deleted.
        (JSC::Heap::unregisterWeakGCMap): Deleted.
        * heap/Heap.h:
        Update for new name. WeakGCMapBase -> WeakGCHashTable.

        * runtime/JSCInlines.h:
        Add WeakGCSetInlines.h

        * runtime/JSCustomGetterFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSCustomGetterFunction::JSCustomGetterFunction):
        (JSC::JSCustomGetterFunction::create):
        * runtime/JSCustomGetterFunction.h:
        * runtime/JSCustomSetterFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSCustomSetterFunction::JSCustomSetterFunction):
        (JSC::JSCustomSetterFunction::create):
        * runtime/JSCustomSetterFunction.h:
        Add helper type CustomFunctionPointer and helper function customFunctionPointer()
        to allow some generic hashing code to run on either JSCustomGetterFunction
        or JSCustomSetterFunction.

        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::WeakCustomGetterOrSetterHash::hash):
        (JSC::JSGlobalObject::WeakCustomGetterOrSetterHash::equal):
        (JSC::JSGlobalObject::customGetterFunctionSet):
        (JSC::JSGlobalObject::customSetterFunctionSet):
        (JSC::JSGlobalObject::customGetterFunctionMap): Deleted.
        (JSC::JSGlobalObject::customSetterFunctionMap): Deleted.
        Replace m_customGetterFunctionMap/m_customSetterFunctionMap with 
        m_customGetterFunctionSet/m_customSetterFunctionSet. As the key is included
        in the value, it saves space to use a set rather than a map. We now also
        hash and compare both the function pointer and the property name to allow
        sharing implementations.

        * runtime/JSObject.cpp:
        (JSC::WeakCustomGetterOrSetterHashTranslator::hash):
        (JSC::WeakCustomGetterOrSetterHashTranslator::equal):
        (JSC::createCustomGetterFunction):
        (JSC::createCustomSetterFunction):
        Update creation functions to use the new sets, making use of the
        ensureValue function and a HashTranslator allowing the use of a
        std::pair<PropertyName, FunctionPointer> as an alternative lookup
        key. This allows us to avoid creating the JSCustomGetterFunction/JSCustomSetterFunction
        pointer if one with the same property name and function pointer are
        already in the set.

        * runtime/WeakGCHashTable.h: Added.
        (JSC::WeakGCHashTable::~WeakGCHashTable):
        Moved from WeakGCMap and renamed as it is now the base of both
        WeakGCMap and WeakGCSet.
 
        * runtime/WeakGCMap.h:
        Update to use new WeakGCHashTable base class.

        * runtime/WeakGCMapInlines.h:
        (JSC::KeyTraitsArg>::WeakGCMap):
        (JSC::KeyTraitsArg>::~WeakGCMap):
        Update for new Heap function names for WeakGCHashTable.

        * runtime/WeakGCSet.h: Added.
        * runtime/WeakGCSetInlines.h: Added.
        (JSC::TraitsArg>::WeakGCSet):
        (JSC::TraitsArg>::~WeakGCSet):
        (JSC::TraitsArg>::find):
        (JSC::TraitsArg>::find const):
        (JSC::TraitsArg>::contains const):
        (JSC::TraitsArg>::pruneStaleEntries):
        Added a minimal WeakGCSet based on WeakGCMap. 

2021-03-30  Mark Lam  <mark.lam@apple.com>

        Add disableForwardingVPrintfStdErrToOSLog() and use it in the jsc shell.
        https://bugs.webkit.org/show_bug.cgi?id=223963

        Reviewed by Saam Barati.

        This prevents automatic forwarding of vprintf_stderr_common() to os_log_with_args(),
        which results in duplicate output when using the jsc shell.  As a result, ASSERT
        fail messages and crash stack traces will be more readable.

        * jsc.cpp:
        (main):

2021-03-30  Mark Lam  <mark.lam@apple.com>

        Add Options::exitOnResourceExhaustion() to enable exiting instead of crashing on resource exhaustion.
        https://bugs.webkit.org/show_bug.cgi?id=223959
        rdar://63934158

        Reviewed by Tadeu Zagallo.

        This is useful to unblock fuzzers from false positive crashes due to resource
        exhaustion.  Currently, this is only applied to StructureID exhaustion.

        Since we're adding this facility, we might as well implement it in such a way that
        it can be easily deployed for other types of resource exhaustion as well.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/OptionsList.h:
        * runtime/ResourceExhaustion.cpp: Added.
        (JSC::handleResourceExhaustion):
        * runtime/ResourceExhaustion.h: Added.
        * runtime/StructureIDTable.cpp:
        (JSC::StructureIDTable::resize):

2021-03-30  Ryan Haddad  <ryanhaddad@apple.com>

        Ensure that GlobalPropertyInfo is allocated on the stack.
        https://bugs.webkit.org/show_bug.cgi?id=223911

        Unreviewed test gardening.

        Rebaseline builtins generator tests after r275212.

        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:

2021-03-30  Mark Lam  <mark.lam@apple.com>

        Add more information to GC verifier verbose dumps.
        https://bugs.webkit.org/show_bug.cgi?id=223951

        Reviewed by Yusuke Suzuki.

        * heap/VerifierSlotVisitor.cpp:
        (JSC::VerifierSlotVisitor::dumpMarkerData):

2021-03-30  Mark Lam  <mark.lam@apple.com>

        Ensure that GlobalPropertyInfo is allocated on the stack.
        https://bugs.webkit.org/show_bug.cgi?id=223911
        rdar://75865742

        Reviewed by Yusuke Suzuki.

        We rely on GlobalPropertyInfo being allocated on the stack to allow its JSValue
        value to be scanned by the GC.  Unfortunately, an ASAN compilation would choose
        to allocate the GlobalPropertyInfo on a side buffer instead of directly on the
        stack.  This prevents the GC from doing the needed scan.

        We'll fix this by suppressing ASAN on the functions that allocated GlobalPropertyInfo
        arrays.  Also added an ASSERT in the GlobalPropertyInfo constructor to assert that
        it is allocated on the stack.

        * Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:
        (BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::initStaticGlobals):
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::exposeDollarVM):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):

2021-03-29  Xan López  <xan@igalia.com>

        [JSC] Use helper method when possible to store data in the callframe header
        https://bugs.webkit.org/show_bug.cgi?id=223432

        Reviewed by Yusuke Suzuki.

        A bunch of the direct stores to the callframe header are zeroing
        out the codeblock slot. Create a helper method to do that and use
        it accordingly. For the rest, use emitPutToCallFrameHeader, which
        already does the right thing. Also, remove a lot of unused helper
        methods in AssemblyHelpers (which have been updated for no reason
        throughout the years).

        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitPutToCallFrameHeaderBeforePrologue): Deleted.
        (JSC::AssemblyHelpers::emitPutPayloadToCallFrameHeaderBeforePrologue): Deleted.
        (JSC::AssemblyHelpers::emitPutTagToCallFrameHeaderBeforePrologue): Deleted.
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):

2021-03-28  Sam Weinig  <weinig@apple.com>

        Remove ENABLE_INDEXED_DATABASE & ENABLE_INDEXED_DATABASE_IN_WORKERS, it seems like it is on for all ports
        https://bugs.webkit.org/show_bug.cgi?id=223810

        Reviewed by Simon Fraser.

        * inspector/protocol/IndexedDB.json:
        Update for remove ENABLE_INDEXED_DATABASE conditional.

2021-03-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use AppleICU SPI for canonicalization
        https://bugs.webkit.org/show_bug.cgi?id=223552

        Reviewed by Ryosuke Niwa.

        uloc_canonicalize does not perform alias mapping. This is different from ECMA402's canonicalization requirement.
        ICU C++ icu::Locale can canonicalize locale ID with alias mapping, but this is not exposed to C API.

        In this patch, we adopt AppleICU SPI "ualoc_canonicalForm" added in rdar://74314220. This canonicalization can perform
        alias mapping too. We do not extend uloc_canonicalize since this API explicitly says "It does NOT map aliased names in any way."[1].
        In [2], we are tracking upstreaming of this new SPI. Once it is upstreamed to the mainline ICU, we will switch to that.

        [1]: https://unicode-org.github.io/icu-docs/apidoc/dev/icu4c/uloc_8h.html#a69b148194cf57ac40d4bb15c5b905260
        [2]: https://unicode-org.atlassian.net/browse/ICU-21506

        * runtime/IntlLocale.cpp:
        (JSC::LocaleIDBuilder::initialize):
        (JSC::LocaleIDBuilder::toCanonical):
        * runtime/IntlObject.cpp:
        (JSC::localeIDBufferForLanguageTagWithNullTerminator):
        (JSC::canonicalizeLanguageTag):
        (JSC::canonicalizeLocaleIDWithoutNullTerminator):
        (JSC::localeIDBufferForLanguageTag): Deleted.
        * runtime/IntlObject.h:

2021-03-26  Don Olmstead  <don.olmstead@sony.com>

        [CMake] Deprecate using DERIVED_SOURCES_DIR/FOWARDING_HEADERS_DIR directly
        https://bugs.webkit.org/show_bug.cgi?id=223763

        Reviewed by Michael Catanzaro.

        Remove any usages of DERIVED_SOURCES_DIR and FOWARDING_HEADERS_DIR.

        * CMakeLists.txt:
        * PlatformMac.cmake:

2021-03-26  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use new Apple ICU APIs to avoid C++ ICU API usage
        https://bugs.webkit.org/show_bug.cgi?id=223783
        <rdar://problem/75060240>

        Reviewed by Mark Lam.

        This patch adopts ICU 69's draft APIs to avoid using ICU C++ APIs in newer macOS build.
        AppleICU adopts these draft APIs so that we can use it even in ICU 68 if ICU is AppleICU.
        The API is ucal_getTimeZoneOffsetFromLocal, which is back-ported from ICU 69[1].
        The purpose of this API is that calculating timezone offset and dst offset from *local* time.

        [1]: https://github.com/unicode-org/icu/commit/53aa0505c5f95a8cebbd7b4421d474fd2a790b80

        * runtime/IntlDateTimeFormat.cpp:
        * runtime/JSDateMath.cpp:
        (JSC::OpaqueICUTimeZoneDeleter::operator()):
        (JSC::DateCache::calculateLocalTimeOffset):
        (JSC::DateCache::defaultTimeZone):
        (JSC::DateCache::timeZoneCacheSlow):
        * runtime/JSDateMath.h:

2021-03-26  Jessie Berlin  <jberlin@webkit.org>

        Update the BEFORE/SINCE, SYSTEM_VERSION_PREFIX, and MACOSX_DEPLOYMENT_TARGET flags
        https://bugs.webkit.org/show_bug.cgi?id=223779

        Reviewed by Tim Horton.

        * Configurations/DebugRelease.xcconfig:
        * Configurations/Version.xcconfig:
        * Configurations/WebKitTargetConditionals.xcconfig:

2021-03-25  Saam Barati  <sbarati@apple.com>

        validate untagArrayPtr
        https://bugs.webkit.org/show_bug.cgi?id=214953
        <rdar://problem/66391434>

        Reviewed by Mark Lam.

        This patch adds validation to untagArrayPtr along paths where we don't
        immediately store/load from the result.
        
        This patch also changes the removeArrayPtrTag macro assembler function to
        use a bitwise and instead of xpacd to strip the tag, because it's faster.

        * assembler/MacroAssemblerARM64E.h:
        (JSC::MacroAssemblerARM64E::untagArrayPtr):
        (JSC::MacroAssemblerARM64E::removeArrayPtrTag):
        * assembler/testmasm.cpp:
        (JSC::testCagePreservesPACFailureBit):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::untagArrayPtr):
        (JSC::FTL::DFG::LowerDFGToB3::caged):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::cageWithoutUntagging):
        (JSC::AssemblyHelpers::cageConditionallyAndUntag):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::cageWithoutUntagging): Deleted.
        (JSC::AssemblyHelpers::cageConditionally): Deleted.
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitIntTypedArrayPutByVal):
        (JSC::JIT::emitFloatTypedArrayPutByVal):
        * wasm/WasmAirIRGenerator.cpp:
        (JSC::Wasm::AirIRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::AirIRGenerator::addCallIndirect):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):

2021-03-25  Jessie Berlin  <jberlin@webkit.org>

        Remove 10.13 DEPLOYMENT_TARGETs and SYSTEM_VERSION_PREFIXs
        https://bugs.webkit.org/show_bug.cgi?id=223765

        Reviewed by Tim Horton.

        * Configurations/Base.xcconfig:
        * Configurations/DebugRelease.xcconfig:
        * Configurations/Version.xcconfig:

2021-03-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK][WPE] JSC crashes if a function expects a parameter but doesn't receive any
        https://bugs.webkit.org/show_bug.cgi?id=223646

        Reviewed by Adrian Perez de Castro.

        Handle the case of receiving fewer argumens than expected in function calls and constructors. We pass undefined
        for the expected arguments that are missing. We were not correctly handling the case of converting undefined and
        null values to JSCValue, so this patch fixes that case too.

        * API/glib/JSCCallbackFunction.cpp:
        (JSC::JSCCallbackFunction::call):
        (JSC::JSCCallbackFunction::construct):
        * API/glib/JSCContext.cpp:
        (jscContextJSValueToWrappedObject):
        (jscContextJSValueToGValue):

2021-03-24  Michael Saboff  <msaboff@apple.com>

        [YARR] Interpreter incorrectly matches non-BMP characters with multiple . w/dotAll flag
        https://bugs.webkit.org/show_bug.cgi?id=223666

        Reviewed by Mark Lam.

        In checkCharacterClassDontAdvanceInputForNonBMP(), we need to check for input.readChecked() returning -1
        and return that the character class didn't match.

        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::Interpreter::checkCharacterClassDontAdvanceInputForNonBMP):

2021-03-24  Saam Barati  <sbarati@apple.com>

        r271034 added code in constant folding phase that's unreachable given current invariants of our ICs and PutByIdStatus
        https://bugs.webkit.org/show_bug.cgi?id=223625

        Reviewed by Yusuke Suzuki.

        The code was doing a lot of wrong things by making bad assumptions about the
        invariants of PutByIdVariants. Replace PutByIdVariants never have object
        property condition sets, since we always replace on the self object (and don't
        look at the prototype chain). This patch clears up the code to make it
        clearer what the invariants are.
        
        With respect to the original fix about not emitting a PutByOffset for a
        Replace on a Structure that has an unfired replacement watchpoint set,
        that was already handled by the PutByIdStatus::computeFor variant we're
        calling inside of constant folding. It will return TakesSlowPathif it
        encounters a Replace where the Structure still has an unfired watchpoint.

        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset):

2021-03-24  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Rope string equal operation should first check length
        https://bugs.webkit.org/show_bug.cgi?id=223678

        Reviewed by Mark Lam.

        This can avoid eagerly resolving rope strings if it is not necessary.

        * runtime/JSString.cpp:
        (JSC::JSString::equalSlowCase const):

2021-03-23  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Functor for WeakGCMap::ensureValue must not invoke GC
        https://bugs.webkit.org/show_bug.cgi?id=223629
        <rdar://problem/75619217>

        Reviewed by Mark Lam.

        The functor for WeakGCMap::ensureValue must not invoke GC. GC can prune entries in WeakGCMap.
        So we can modify underlying HashMap while we are just touching it for HashMap::ensure. This
        can corrupt HashMap. To ensure this invariant, we put DisallowGC for WeakGCMap::ensureValue.
        So we cannot invoke GC in the functor of that function (otherwise, assertion hits).

        And we use DeferGC in createCustomGetterFunction / createCustomSetterFunction to avoid invoking
        GC in WeakGCMap::ensureValue. This defers GC invocation until this DeferGC scope is destroyed,
        and ensures that functor invoked by WeakGCMap::ensureValue will not cause GC.

        * runtime/JSObject.cpp:
        (JSC::createCustomGetterFunction):
        (JSC::createCustomSetterFunction):
        (JSC::JSObject::getOwnPropertyDescriptor):
        * runtime/WeakGCMap.h:

2021-03-23  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Use ErrorInstance for AggregateError
        https://bugs.webkit.org/show_bug.cgi?id=223626

        Reviewed by Darin Adler.

        From r274609, WebAssembly errors start using normal ErrorInstance. We apply the same thing to AggregateError too.
        This patch removes AggregateError class, and just generating ErrorInstance.

        * runtime/AggregateError.cpp:
        (JSC::createAggregateError):
        (JSC::AggregateError::AggregateError): Deleted.
        (JSC::AggregateError::finishCreation): Deleted.
        (JSC::AggregateError::create): Deleted.
        * runtime/AggregateError.h:
        (): Deleted.
        * runtime/AggregateErrorConstructor.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::initializeAggregateErrorConstructor):

2021-03-23  Robin Morisset  <rmorisset@apple.com>

        Object.freeze(this) at the global scope can lose a reference to a WatchpointSet
        https://bugs.webkit.org/show_bug.cgi?id=223608

        Reviewed by Yusuke Suzuki.

        When freezing the global object, we should make a proper copy of symbol table entries, to keep any outstanding reference to the WatchpointSet.
        We cannot use pack(), because it does not support FatEntries.

        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::defineOwnProperty):
        * runtime/JSSymbolTableObject.h:
        (JSC::symbolTableGet):
        * runtime/SymbolTable.h:
        (JSC::SymbolTableEntry::setReadOnly):

2021-03-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] JSCustomGetterFunction/JSCustomSetterFunction should use Identifier for their field
        https://bugs.webkit.org/show_bug.cgi?id=223588

        Reviewed by Mark Lam and Saam Barati.

        PropertyName is the holder for passing it as an argument, and it does not ref/deref underlying UniqueStringImpl.
        We should use Identifier to keep it strongly ref-ed in JSCustomGetterFunction/JSCustomSetterFunction.
        And we should make JSCustomGetterFunction/JSCustomSetterFunction destructible objects since Identifier needs to
        deref underlying UniqueStringImpl when destroying these functions.

        * runtime/JSCustomGetterFunction.cpp:
        (JSC::JSCustomGetterFunction::JSCustomGetterFunction):
        (JSC::JSCustomGetterFunction::destroy):
        * runtime/JSCustomGetterFunction.h:
        * runtime/JSCustomSetterFunction.cpp:
        (JSC::JSCustomSetterFunction::JSCustomSetterFunction):
        (JSC::JSCustomSetterFunction::destroy):
        * runtime/JSCustomSetterFunction.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2021-03-22  Saam Barati  <sbarati@apple.com>

        LiteralParser shouldn't make error messages of length ~2^31
        https://bugs.webkit.org/show_bug.cgi?id=223483
        <rdar://75572255>

        Reviewed by Robin Morisset.

        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser<CharType>::parse):

2021-03-22  Michael Saboff  <msaboff@apple.com>

        [YARR] Interpreter incorrectly matches non-BMP characters with multiple .
        https://bugs.webkit.org/show_bug.cgi?id=223498

        Reviewed by Yusuke Suzuki.

        We need to check that we read an actual character before seeing if it is part of a character class.
        In the case where we are checking that a character is not in a character class, like .,
        the failed to read result from input.readChecked(), -1, is not part of the newline character class.
        This will allow regular expressions that require more than the number of characters in a string
        to match.

        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::Interpreter::checkCharacterClass):

2021-03-22  Ross Kirsling  <ross.kirsling@sony.com>

        Unreviewed, fix Mac and non-unified JSCOnly builds
        https://bugs.webkit.org/show_bug.cgi?id=223546

        * wasm/WasmGlobal.h:
        * wasm/WasmTable.h:
        * wasm/js/JSWebAssemblyCompileError.cpp:
        * wasm/js/JSWebAssemblyLinkError.cpp:
        * wasm/js/JSWebAssemblyRuntimeError.cpp:
        Add missing includes for non-unified JSC build.

2021-03-22  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Intl.Locale should not assume is8Bit
        https://bugs.webkit.org/show_bug.cgi?id=223553

        Reviewed by Ross Kirsling.

        is8Bit or not is not guaranteed if it is an user-input. For example, "test日本語".substring(0, 3) should be non 8Bit string.
        Intl.Locale has several places that assumed that input should be 8Bit if they are ASCII. This patch fixes it.

        * runtime/IntlLocale.cpp:
        (JSC::LocaleIDBuilder::overrideLanguageScriptRegion):
        (JSC::LocaleIDBuilder::setKeywordValue):

2021-03-22  Sam Weinig  <weinig@apple.com>

        Use the PropertyName parameter passed to custom getters/setters rather than a redundant const char* in DOM attribute prologues
        https://bugs.webkit.org/show_bug.cgi?id=223542

        Reviewed by Alexey Shvayka.

        Add throwVMDOMAttributeSetterTypeError to match existing throwVMDOMAttributeGetterTypeError and move
        additional helpers used by WebCore here to avoid redundant work.

        Removes some now unused functions.

        * runtime/Error.cpp:
        (JSC::createGetterTypeError):
        (JSC::makeDOMAttributeGetterTypeErrorMessage):
        (JSC::makeDOMAttributeSetterTypeErrorMessage):
        (JSC::throwDOMAttributeGetterTypeError):
        (JSC::throwDOMAttributeSetterTypeError):
        (JSC::throwGetterTypeError): Deleted.
        * runtime/Error.h:
        (JSC::throwVMRangeError):
        (JSC::throwVMDOMAttributeSetterTypeError):
        (JSC::throwVMGetterTypeError): Deleted.

2021-03-22  Tyler Wilcock  <twilco.o@protonmail.com>

        AppleWin can't start due to "Failed to determine path to AAS directory." because iTunes changed the registry key
        https://bugs.webkit.org/show_bug.cgi?id=219015

        Reviewed by Alex Christensen.

        It appears that iTunes no longer sets the Apple Application Support
        registry entry.  Fall back to trying to find the iTunes installation
        directory if the AAS directory is not present.

        * shell/DLLLauncherMain.cpp:
        (iTunesDirectory): Added.
        (modifyPath):

2021-03-19  Darin Adler  <darin@apple.com>

        [Cocoa] Make it possible to release a WKWebView on a non-main thread without a crash due to WKScriptMessage race
        https://bugs.webkit.org/show_bug.cgi?id=222336

        Reviewed by Chris Dumez.

        * API/ObjcRuntimeExtras.h: Removed declarations of objc_initWeak and objc_destroyWeak, since
        these are already in <wtf/spi/cocoa/objcSPI.h>.

2021-03-19  Mark Lam  <mark.lam@apple.com>

        BrandedStructure should keep its members alive.
        https://bugs.webkit.org/show_bug.cgi?id=223495
        rdar://75565765

        Reviewed by Saam Barati.

        Normally, each type of JSCell would have its own structure (and therefore, its own
        ClassInfo, MethodTable, etc), which would have handled visiting m_parentBrand.
        Similarly, it would have its own destructor, which would deref m_brand.

        However, the design of BrandedStructure is not like other JSCells.  As present,
        we have chosen to go with having BrandedStructure look exactly like a regular
        Structure, except that its isBrandedStructure flag is set to true.

        This design has advantages because we do checks all over the system for whether
        a cell is a Structure by simply comparing its structureID to structureStructure's
        structureID.  By virtue of BrandedStructure having the same structure as Structure,
        none of this code need to change.

        The downside is that we need to enhance Structure's methods to check if it is
        actually working on an instance of BrandedStructure, and do some additional work.

        This patch fixes 2 bugs:

        1. m_parentBrand was not visited by visitChildren().

           Structure::visitChildrenImpl() now calls BrandedStructure::visitAdditionalChildren()
           to handle this.

        2. m_brand needs to be ref'ed.

           In Structure::setBrandTransition(), if the BrandedStructure is a dictionary,
           then its m_transitionPropertyName will be cleared.  m_transitionPropertyName
           was the only means by which the UniqueStringImpl pointed to by m_brand was
           ref'ed.  The fix is to make m_brand a RefPtr.

           Hence, it follows that we also need to deref m_brand on destruction.
           Structure's destructor now calls BrandedStructure::destruct() to handle this.

        * runtime/BrandedStructure.h:
        * runtime/Structure.cpp:
        (JSC::Structure::~Structure):
        (JSC::Structure::visitChildrenImpl):

2021-03-19  Sam Weinig  <weinig@apple.com>

        Add PropertyName parameter to custom setters to allow shared implementations to do late name lookup
        https://bugs.webkit.org/show_bug.cgi?id=223413

        Reviewed by Alexey Shvayka.

        Make custom setters match custom getters by adding a PropertyName parameter.
        
        This will be used by the CSSStyleDeclaration bindings to avoid > 1000 copies
        of the same getter/setter code, which will instead be able to differentiate
        using the name.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * jsc.cpp:
        (JSC_DEFINE_CUSTOM_SETTER):
        * runtime/CustomGetterSetter.cpp:
        (JSC::callCustomSetter):
        * runtime/CustomGetterSetter.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::putToPrimitive):
        * runtime/JSCustomSetterFunction.cpp:
        (JSC::JSC_DEFINE_HOST_FUNCTION):
        (JSC::JSCustomSetterFunction::JSCustomSetterFunction):
        (JSC::JSCustomSetterFunction::create):
        * runtime/JSCustomSetterFunction.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::putInlineSlow):
        * runtime/Lookup.h:
        (JSC::putEntry):
        * runtime/PropertySlot.h:
        * runtime/RegExpConstructor.cpp:
        (JSC::JSC_DEFINE_CUSTOM_SETTER):
        * runtime/RegExpObject.cpp:
        (JSC::JSC_DEFINE_CUSTOM_SETTER):
        * tools/JSDollarVM.cpp:

== Rolled over to ChangeLog-2021-03-18 ==