2018-04-26  Filip Pizlo  <fpizlo@apple.com>

        Also run foldPathConstants before mussing up SSA
        https://bugs.webkit.org/show_bug.cgi?id=185069

        Reviewed by Saam Barati.
        
        This isn't needed now, but will be once I implement the phase in bug 185060.
        
        This could be a speed-up, or a slow-down, independent of that phase. Most likely it's neutral.
        Local testing seems to suggest that it's neutral. Anyway, whatever it ends up being, I want it to
        be landed separately and measured separately from that phase.
        
        It's probably nice for sanity to have this and reduceStrength run before tail duplication and
        another round of reduceStrength, since that make for something that is closer to a fixpoint. But
        it will increase FTL compile times. So, there's no way to guess if this change is good, bad, or
        neutral. It all depends on what programs typically look like.

        * b3/B3Generate.cpp:
        (JSC::B3::generateToAir):

2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r231086.

        Caused JSC test failures due to an unchecked exception.

        Reverted changeset:

        "[ESNext][BigInt] Implement support for "*" operation"
        https://bugs.webkit.org/show_bug.cgi?id=183721
        https://trac.webkit.org/changeset/231086

2018-04-26  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement support for "*" operation
        https://bugs.webkit.org/show_bug.cgi?id=183721

        Reviewed by Saam Barati.

        Added BigInt support into times binary operator into LLInt and on
        JITOperations profiledMul and unprofiledMul. We are also replacing all
        uses of int to unsigned when there is no negative values for
        variables.

        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * jit/JITOperations.cpp:
        * runtime/CommonSlowPaths.cpp:
        (JSC::SLOW_PATH_DECL):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::JSBigInt):
        (JSC::JSBigInt::allocationSize):
        (JSC::JSBigInt::createWithLength):
        (JSC::JSBigInt::toString):
        (JSC::JSBigInt::multiply):
        (JSC::JSBigInt::digitDiv):
        (JSC::JSBigInt::internalMultiplyAdd):
        (JSC::JSBigInt::multiplyAccumulate):
        (JSC::JSBigInt::equals):
        (JSC::JSBigInt::absoluteDivSmall):
        (JSC::JSBigInt::calculateMaximumCharactersRequired):
        (JSC::JSBigInt::toStringGeneric):
        (JSC::JSBigInt::rightTrim):
        (JSC::JSBigInt::allocateFor):
        (JSC::JSBigInt::parseInt):
        (JSC::JSBigInt::digit):
        (JSC::JSBigInt::setDigit):
        * runtime/JSBigInt.h:
        * runtime/Operations.h:
        (JSC::jsMul):

2018-04-26  Mark Lam  <mark.lam@apple.com>

        Gardening: Speculative build fix for Windows.
        https://bugs.webkit.org/show_bug.cgi?id=184976
        <rdar://problem/39723901>

        Not reviewed.

        * runtime/JSCPtrTag.h:

2018-04-26  Mark Lam  <mark.lam@apple.com>

        Gardening: Windows build fix.

        Not reviewed.

        * runtime/Options.cpp:

2018-04-26  Jer Noble  <jer.noble@apple.com>

        WK_COCOA_TOUCH all the things.
        https://bugs.webkit.org/show_bug.cgi?id=185006
        <rdar://problem/39736025>

        Reviewed by Tim Horton.

        * Configurations/Base.xcconfig:

2018-04-26  Per Arne Vollan  <pvollan@apple.com>

        Disable content filtering in minimal simulator mode
        https://bugs.webkit.org/show_bug.cgi?id=185027
        <rdar://problem/39736091>

        Reviewed by Jer Noble.

        * Configurations/FeatureDefines.xcconfig:

2018-04-26  Andy VanWagoner  <thetalecrafter@gmail.com>

        [INTL] Implement Intl.PluralRules
        https://bugs.webkit.org/show_bug.cgi?id=184312

        Reviewed by JF Bastien.

        Use UNumberFormat to enforce formatting, and then UPluralRules to find
        the correct plural rule for the given number. Relies on ICU v59+ for
        resolvedOptions().pluralCategories and trailing 0 detection.
        Behind the useIntlPluralRules option and INTL_PLURAL_RULES flag.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * builtins/BuiltinNames.h:
        * runtime/BigIntObject.cpp:
        (JSC::BigIntObject::create): Moved to ensure complete JSGlobalObject definition.
        * runtime/BigIntObject.h:
        * runtime/CommonIdentifiers.h:
        * runtime/IntlObject.cpp:
        (JSC::IntlObject::finishCreation):
        * runtime/IntlObject.h:
        * runtime/IntlPluralRules.cpp: Added.
        (JSC::IntlPluralRules::UPluralRulesDeleter::operator() const):
        (JSC::IntlPluralRules::UNumberFormatDeleter::operator() const):
        (JSC::UEnumerationDeleter::operator() const):
        (JSC::IntlPluralRules::create):
        (JSC::IntlPluralRules::createStructure):
        (JSC::IntlPluralRules::IntlPluralRules):
        (JSC::IntlPluralRules::finishCreation):
        (JSC::IntlPluralRules::destroy):
        (JSC::IntlPluralRules::visitChildren):
        (JSC::IntlPRInternal::localeData):
        (JSC::IntlPluralRules::initializePluralRules):
        (JSC::IntlPluralRules::resolvedOptions):
        (JSC::IntlPluralRules::select):
        * runtime/IntlPluralRules.h: Added.
        * runtime/IntlPluralRulesConstructor.cpp: Added.
        (JSC::IntlPluralRulesConstructor::create):
        (JSC::IntlPluralRulesConstructor::createStructure):
        (JSC::IntlPluralRulesConstructor::IntlPluralRulesConstructor):
        (JSC::IntlPluralRulesConstructor::finishCreation):
        (JSC::constructIntlPluralRules):
        (JSC::callIntlPluralRules):
        (JSC::IntlPluralRulesConstructorFuncSupportedLocalesOf):
        (JSC::IntlPluralRulesConstructor::visitChildren):
        * runtime/IntlPluralRulesConstructor.h: Added.
        * runtime/IntlPluralRulesPrototype.cpp: Added.
        (JSC::IntlPluralRulesPrototype::create):
        (JSC::IntlPluralRulesPrototype::createStructure):
        (JSC::IntlPluralRulesPrototype::IntlPluralRulesPrototype):
        (JSC::IntlPluralRulesPrototype::finishCreation):
        (JSC::IntlPluralRulesPrototypeFuncSelect):
        (JSC::IntlPluralRulesPrototypeFuncResolvedOptions):
        * runtime/IntlPluralRulesPrototype.h: Added.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::intlPluralRulesAvailableLocales):
        * runtime/JSGlobalObject.h:
        * runtime/Options.h:
        * runtime/RegExpPrototype.cpp: Added inlines header.
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2018-04-26  Dominik Infuehr  <dinfuehr@igalia.com>

        [MIPS] Fix branch offsets in branchNeg32
        https://bugs.webkit.org/show_bug.cgi?id=185025

        Reviewed by Yusuke Suzuki.

        Two nops were removed in branch(Not)Equal in #183130 but the offset wasn't adjusted.

        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchNeg32):

2018-04-25  Robin Morisset  <rmorisset@apple.com>

        In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
        https://bugs.webkit.org/show_bug.cgi?id=184773
        <rdar://problem/37773612>

        Reviewed by Filip Pizlo.

        We were calling restParameterStructure(), which returns arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous).
        arrayStructureForIndexingTypeDuringAllocation uses m_arrayStructureForIndexingShapeDuringAllocation, which is set to SlowPutArrayStorage when we are 'having a bad time'.
        This is problematic, because the structure is then passed to allocateUninitializedContiguousJSArray, which ASSERTs that the indexing type is contiguous (or int32).
        We solve the problem by using originalArrayStructureForIndexingType which always returns a structure with the right indexing type (contiguous), even if we are having a bad time.
        This is safe, as we are under isWatchingHavingABadTimeWatchpoint, so if we have a bad time, the code we generate will never be installed.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):

2018-04-25  Mark Lam  <mark.lam@apple.com>

        Push the definition of PtrTag down to the WTF layer.
        https://bugs.webkit.org/show_bug.cgi?id=184976
        <rdar://problem/39723901>

        Reviewed by Saam Barati.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/ARM64Assembler.h:
        * assembler/AbstractMacroAssembler.h:
        * assembler/MacroAssemblerCodeRef.cpp:
        * assembler/MacroAssemblerCodeRef.h:
        * b3/B3MathExtras.cpp:
        * bytecode/LLIntCallLinkInfo.h:
        * disassembler/Disassembler.h:
        * ftl/FTLJITCode.cpp:
        * interpreter/InterpreterInlines.h:
        * jit/ExecutableAllocator.h:
        * jit/JITOperations.cpp:
        * jit/ThunkGenerator.h:
        * jit/ThunkGenerators.h:
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/LLIntPCRanges.h:
        * runtime/JSCPtrTag.h: Added.
        * runtime/NativeFunction.h:
        * runtime/PtrTag.h: Removed.
        * runtime/VMTraps.cpp:

2018-04-25  Keith Miller  <keith_miller@apple.com>

        getUnlinkedGlobalFunctionExecutable should only save things to the code cache if the option is set
        https://bugs.webkit.org/show_bug.cgi?id=184998

        Reviewed by Saam Barati.

        * runtime/CodeCache.cpp:
        (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):

2018-04-25  Keith Miller  <keith_miller@apple.com>

        Add missing scope release to functionProtoFuncToString
        https://bugs.webkit.org/show_bug.cgi?id=184995

        Reviewed by Saam Barati.

        * runtime/FunctionPrototype.cpp:
        (JSC::functionProtoFuncToString):

2018-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>

        REGRESSION(r230748) [GTK][ARM] no matching function for call to 'JSC::CCallHelpers::swap(JSC::ARMRegisters::FPRegisterID&, JSC::ARMRegisters::FPRegisterID&)'
        https://bugs.webkit.org/show_bug.cgi?id=184730

        Reviewed by Mark Lam.

        Add swap(FPRegisterID, FPRegisterID) implementation using ARMRegisters::SD0 (temporary register in MacroAssemblerARM).
        And we now use dataTempRegister, addressTempRegister, and fpTempRegister instead of using S0, S1, and SD0.

        We also change swap(RegisterID, RegisterID) implementation to use moves and temporaries simply. This is aligned to
        ARMv7 implementation.

        * assembler/ARMAssembler.h:
        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::add32):
        (JSC::MacroAssemblerARM::and32):
        (JSC::MacroAssemblerARM::lshift32):
        (JSC::MacroAssemblerARM::mul32):
        (JSC::MacroAssemblerARM::or32):
        (JSC::MacroAssemblerARM::rshift32):
        (JSC::MacroAssemblerARM::urshift32):
        (JSC::MacroAssemblerARM::sub32):
        (JSC::MacroAssemblerARM::xor32):
        (JSC::MacroAssemblerARM::load8):
        (JSC::MacroAssemblerARM::abortWithReason):
        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM::store8):
        (JSC::MacroAssemblerARM::store32):
        (JSC::MacroAssemblerARM::push):
        (JSC::MacroAssemblerARM::swap):
        (JSC::MacroAssemblerARM::branch8):
        (JSC::MacroAssemblerARM::branchPtr):
        (JSC::MacroAssemblerARM::branch32):
        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
        (JSC::MacroAssemblerARM::branchTest8):
        (JSC::MacroAssemblerARM::branchTest32):
        (JSC::MacroAssemblerARM::jump):
        (JSC::MacroAssemblerARM::branchAdd32):
        (JSC::MacroAssemblerARM::mull32):
        (JSC::MacroAssemblerARM::branchMul32):
        (JSC::MacroAssemblerARM::patchableBranch32):
        (JSC::MacroAssemblerARM::nearCall):
        (JSC::MacroAssemblerARM::compare32):
        (JSC::MacroAssemblerARM::compare8):
        (JSC::MacroAssemblerARM::test32):
        (JSC::MacroAssemblerARM::test8):
        (JSC::MacroAssemblerARM::add64):
        (JSC::MacroAssemblerARM::load32):
        (JSC::MacroAssemblerARM::call):
        (JSC::MacroAssemblerARM::branchPtrWithPatch):
        (JSC::MacroAssemblerARM::branch32WithPatch):
        (JSC::MacroAssemblerARM::storePtrWithPatch):
        (JSC::MacroAssemblerARM::loadDouble):
        (JSC::MacroAssemblerARM::storeDouble):
        (JSC::MacroAssemblerARM::addDouble):
        (JSC::MacroAssemblerARM::divDouble):
        (JSC::MacroAssemblerARM::subDouble):
        (JSC::MacroAssemblerARM::mulDouble):
        (JSC::MacroAssemblerARM::convertInt32ToDouble):
        (JSC::MacroAssemblerARM::branchDouble):
        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
        (JSC::MacroAssemblerARM::truncateDoubleToInt32):
        (JSC::MacroAssemblerARM::truncateDoubleToUint32):
        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
        (JSC::MacroAssemblerARM::branchDoubleNonZero):
        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
        (JSC::MacroAssemblerARM::call32):
        (JSC::MacroAssemblerARM::internalCompare32):

2018-04-25  Ross Kirsling  <ross.kirsling@sony.com>

        [WinCairo] Fix js/regexp-unicode.html crash.
        https://bugs.webkit.org/show_bug.cgi?id=184891

        Reviewed by Yusuke Suzuki.

        On Win64, register RDI is "considered nonvolatile and must be saved and restored by a function that uses [it]".
        RDI is being used as a scratch register for JIT_UNICODE_EXPRESSIONS, not just YARR_JIT_ALL_PARENS_EXPRESSIONS.

        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generateEnter):
        (JSC::Yarr::YarrGenerator::generateReturn):
        Unconditionally save and restore RDI on 64-bit Windows.

2018-04-25  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Miscellaneous build cleanups
        https://bugs.webkit.org/show_bug.cgi?id=184399

        Reviewed by Žan Doberšek.

        * PlatformGTK.cmake:

2018-04-24  Keith Miller  <keith_miller@apple.com>

        fromCharCode is missing some exception checks
        https://bugs.webkit.org/show_bug.cgi?id=184952

        Reviewed by Saam Barati.

        I also removed the pointless slow path function and moved it into the
        main function.

        * runtime/StringConstructor.cpp:
        (JSC::stringFromCharCode):
        (JSC::stringFromCharCodeSlowCase): Deleted.

2018-04-24  Filip Pizlo  <fpizlo@apple.com>

        MultiByOffset should emit one fewer branches in the case that the set of structures is proved already
        https://bugs.webkit.org/show_bug.cgi?id=184923

        Reviewed by Saam Barati.
        
        If we have a MultiGetByOffset or MultiPutByOffset over a structure set that we've already proved
        (i.e. we know that the object has one of those structures), then previously we would still emit a
        switch with a case per structure along with a default case. That would mean one extra redundant
        branch to check that whatever structure we wound up with belongs to the set. In that case, we
        were already making the default case be an Oops.
        
        One possible solution would be to say that the default case being Oops means that B3 doesn't need
        to emit the extra branch. But that would require having B3 exploit the fact that Oops is known to
        be unreachable. Although B3 IR semantics (webkit.org/docs/b3/intermediate-representation.html)
        seem to allow this, I don't particularly like that style of optimization. I like Oops to mean
        trap.
        
        So, this patch makes FTL lowering turn one of the cases into the default, explicitly removing the
        extra branch.
        
        This is not a speed-up. But it makes the B3 IR for MultiByOffset a lot simpler, which should make
        it easier to implement B3-level optimizations for MultiByOffset. It also makes the IR easier to
        read.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::emitSwitchForMultiByOffset):

2018-04-24  Filip Pizlo  <fpizlo@apple.com>

        DFG CSE should know how to decay a MultiGetByOffset
        https://bugs.webkit.org/show_bug.cgi?id=159859

        Reviewed by Keith Miller.
        
        This teaches Node::remove() how to decay a MultiGetByOffset to a CheckStructure, so that
        clobberize() can report a def() for MultiGetByOffset.
        
        This is a slight improvement to codegen in splay because splay is a heavy user of
        MultiGetByOffset. It uses it redundantly in one of its hot functions (the function called
        "splay_"). I don't see a net speed-up in the benchmark. However, this is just a first step to
        removing MultiXByOffset-related redundancies, which by my estimates account for 16% of
        splay's time.

        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::remove):
        (JSC::DFG::Node::removeWithoutChecks):
        (JSC::DFG::Node::replaceWith):
        (JSC::DFG::Node::replaceWithWithoutChecks):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToMultiGetByOffset):
        (JSC::DFG::Node::replaceWith): Deleted.
        * dfg/DFGNodeType.h:
        * dfg/DFGObjectAllocationSinkingPhase.cpp:

2018-04-24  Keith Miller  <keith_miller@apple.com>

        Update API docs with information on which run loop the VM will use
        https://bugs.webkit.org/show_bug.cgi?id=184900
        <rdar://problem/39166054>

        Reviewed by Mark Lam.

        * API/JSContextRef.h:
        * API/JSVirtualMachine.h:

2018-04-24  Filip Pizlo  <fpizlo@apple.com>

        $vm.totalGCTime() should be a thing
        https://bugs.webkit.org/show_bug.cgi?id=184916

        Reviewed by Sam Weinig.
        
        When debugging regressions in tests that are GC heavy, it's nice to be able to query the total
        time spent in GC to determine if the regression is because the GC got slower.
        
        This adds $vm.totalGCTime(), which tells you the total time spent in GC, in seconds.

        * heap/Heap.cpp:
        (JSC::Heap::runEndPhase):
        * heap/Heap.h:
        (JSC::Heap::totalGCTime const):
        * tools/JSDollarVM.cpp:
        (JSC::functionTotalGCTime):
        (JSC::JSDollarVM::finishCreation):

2018-04-23  Zalan Bujtas  <zalan@apple.com>

        [LayoutFormattingContext] Initial commit.
        https://bugs.webkit.org/show_bug.cgi?id=184896

        Reviewed by Antti Koivisto.

        * Configurations/FeatureDefines.xcconfig:

2018-04-23  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, revert accidental change to verbose flag.

        * dfg/DFGByteCodeParser.cpp:

2018-04-23  Filip Pizlo  <fpizlo@apple.com>

        Roll out r226655 because it broke OSR entry when the pre-header is inadequately profiled.

        Rubber stamped by Saam Barati.
        
        This is a >2x speed-up in SunSpider/bitops-bitwise-and. We don't really care about SunSpider
        anymore, but r226655 didn't result in any benchmark wins and just regressed this test by a lot.
        Seems sensible to just roll it out.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::addToGraph):
        (JSC::DFG::ByteCodeParser::parse):

2018-04-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Remove ModuleLoaderPrototype
        https://bugs.webkit.org/show_bug.cgi?id=184784

        Reviewed by Mark Lam.

        When we introduce ModuleLoaderPrototype, ModuleLoader may be created by users and exposed to users.
        However, the loader spec is abandoned. So we do not need to have ModuleLoaderPrototype and JSModuleLoader.
        This patch merges ModuleLoaderPrototype's functionality into JSModuleLoader.

        * CMakeLists.txt:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * builtins/ModuleLoader.js: Renamed from Source/JavaScriptCore/builtins/ModuleLoaderPrototype.js.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildren):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::proxyRevokeStructure const):
        (JSC::JSGlobalObject::moduleLoaderStructure const): Deleted.
        * runtime/JSModuleLoader.cpp:
        (JSC::moduleLoaderParseModule):
        (JSC::moduleLoaderRequestedModules):
        (JSC::moduleLoaderModuleDeclarationInstantiation):
        (JSC::moduleLoaderResolve):
        (JSC::moduleLoaderResolveSync):
        (JSC::moduleLoaderFetch):
        (JSC::moduleLoaderGetModuleNamespaceObject):
        (JSC::moduleLoaderEvaluate):
        * runtime/JSModuleLoader.h:
        * runtime/ModuleLoaderPrototype.cpp: Removed.
        * runtime/ModuleLoaderPrototype.h: Removed.

2018-04-20  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] All API tests fail in debug builds
        https://bugs.webkit.org/show_bug.cgi?id=184813

        Reviewed by Mark Lam.

        This is because of a conflict of ExceptionHandler class used in tests and ExceptionHandler struct defined in
        JSCContext.cpp. This patch renames the ExceptionHandler struct as JSCContextExceptionHandler.

        * API/glib/JSCContext.cpp:
        (JSCContextExceptionHandler::JSCContextExceptionHandler):
        (JSCContextExceptionHandler::~JSCContextExceptionHandler):
        (jscContextConstructed):
        (ExceptionHandler::ExceptionHandler): Deleted.
        (ExceptionHandler::~ExceptionHandler): Deleted.

2018-04-20  Tim Horton  <timothy_horton@apple.com>

        Adjust geolocation feature flag
        https://bugs.webkit.org/show_bug.cgi?id=184856

        Reviewed by Wenson Hsieh.

        * Configurations/FeatureDefines.xcconfig:

2018-04-20  Brian Burg  <bburg@apple.com>

        Web Inspector: remove some dead code in IdentifiersFactory
        https://bugs.webkit.org/show_bug.cgi?id=184839

        Reviewed by Timothy Hatcher.

        This was never used on non-Chrome ports, so the identifier always has a
        prefix of '0.'. We may change this in the future, but for now remove this.
        Using a PID for this purpose is problematic anyway.

        * inspector/IdentifiersFactory.cpp:
        (Inspector::addPrefixToIdentifier):
        (Inspector::IdentifiersFactory::createIdentifier):
        (Inspector::IdentifiersFactory::requestId):
        (Inspector::IdentifiersFactory::addProcessIdPrefixTo): Deleted.
        * inspector/IdentifiersFactory.h:

2018-04-20  Mark Lam  <mark.lam@apple.com>

        Add the ability to use a hash for setting PtrTag enum values.
        https://bugs.webkit.org/show_bug.cgi?id=184852
        <rdar://problem/39613891>

        Reviewed by Saam Barati.

        * runtime/PtrTag.h:

2018-04-20  Mark Lam  <mark.lam@apple.com>

        Some JSEntryPtrTags should actually be JSInternalPtrTags.
        https://bugs.webkit.org/show_bug.cgi?id=184712
        <rdar://problem/39507381>

        Reviewed by Michael Saboff.

        1. Convert some uses of JSEntryPtrTag into JSInternalPtrTags.
        2. Tag all LLInt bytecodes consistently with BytecodePtrTag now and retag them
           only when needed.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/ByValInfo.h:
        (JSC::ByValInfo::ByValInfo):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::callReturnLocation):
        (JSC::CallLinkInfo::patchableJump):
        (JSC::CallLinkInfo::hotPathBegin):
        (JSC::CallLinkInfo::slowPathStart):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::setCallLocations):
        (JSC::CallLinkInfo::hotPathOther):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::doneLocation):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::link):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::reifyInlinedCallFrames):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::initialize):
        * ftl/FTLLazySlowPath.h:
        (JSC::FTL::LazySlowPath::done const):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
        (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JITExceptions.cpp:
        (JSC::genericUnwind):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        (JSC::LLInt::getCodePtr):
        (JSC::LLInt::getExecutableAddress): Deleted.
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::callToThrow):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):

2018-04-18  Jer Noble  <jer.noble@apple.com>

        Don't put build products into WK_ALTERNATE_WEBKIT_SDK_PATH for engineering builds
        https://bugs.webkit.org/show_bug.cgi?id=184762

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:
        * JavaScriptCore.xcodeproj/project.pbxproj:

2018-04-20  Daniel Bates  <dabates@apple.com>

        Remove code for compilers that did not support NSDMI for aggregates
        https://bugs.webkit.org/show_bug.cgi?id=184599

        Reviewed by Per Arne Vollan.

        Remove workaround for earlier Visual Studio versions that did not support non-static data
        member initializers (NSDMI) for aggregates. We have since updated all the build.webkit.org
        and EWS bots to a newer version that supports this feature.

        * domjit/DOMJITEffect.h:
        (JSC::DOMJIT::Effect::Effect): Deleted.
        * runtime/HasOwnPropertyCache.h:
        (JSC::HasOwnPropertyCache::Entry::Entry): Deleted.
        * wasm/WasmFormat.h:
        (JSC::Wasm::WasmToWasmImportableFunction::WasmToWasmImportableFunction): Deleted.

2018-04-20  Mark Lam  <mark.lam@apple.com>

        Build fix for internal builds after r230826.
        https://bugs.webkit.org/show_bug.cgi?id=184790
        <rdar://problem/39301369>

        Not reviewed.

        * runtime/Options.cpp:
        (JSC::overrideDefaults):
        * tools/SigillCrashAnalyzer.cpp:
        (JSC::SignalContext::dump):

2018-04-19  Tadeu Zagallo  <tzagallo@apple.com>

        REGRESSION(r227340): ArrayBuffers were not being serialized when sent via MessagePorts
        https://bugs.webkit.org/show_bug.cgi?id=184254
        <rdar://problem/39140200>

        Reviewed by Daniel Bates.

        Expose an extra constructor of ArrayBufferContents in order to be able to decode SerializedScriptValues.

        * runtime/ArrayBuffer.h:
        (JSC::ArrayBufferContents::ArrayBufferContents):

2018-04-19  Mark Lam  <mark.lam@apple.com>

        Apply pointer profiling to Signal pointers.
        https://bugs.webkit.org/show_bug.cgi?id=184790
        <rdar://problem/39301369>

        Reviewed by Michael Saboff.

        1. Change stackPointer, framePointer, and instructionPointer accessors to
           be a pair of getter/setter functions.
        2. Add support for USE(PLATFORM_REGISTERS_WITH_PROFILE) to allow use of a
           a pointer profiling variants of these accessors.
        3. Also add a linkRegister accessor only for ARM64 on OS(DARWIN).

        * JavaScriptCorePrefix.h:
        * runtime/MachineContext.h:
        (JSC::MachineContext::stackPointerImpl):
        (JSC::MachineContext::stackPointer):
        (JSC::MachineContext::setStackPointer):
        (JSC::MachineContext::framePointerImpl):
        (JSC::MachineContext::framePointer):
        (JSC::MachineContext::setFramePointer):
        (JSC::MachineContext::instructionPointerImpl):
        (JSC::MachineContext::instructionPointer):
        (JSC::MachineContext::setInstructionPointer):
        (JSC::MachineContext::linkRegisterImpl):
        (JSC::MachineContext::linkRegister):
        (JSC::MachineContext::setLinkRegister):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        * runtime/VMTraps.cpp:
        (JSC::SignalContext::SignalContext):
        (JSC::VMTraps::tryInstallTrapBreakpoints):
        * tools/CodeProfiling.cpp:
        (JSC::profilingTimer):
        * tools/SigillCrashAnalyzer.cpp:
        (JSC::SignalContext::dump):
        (JSC::installCrashHandler):
        (JSC::SigillCrashAnalyzer::analyze):
        * wasm/WasmFaultSignalHandler.cpp:
        (JSC::Wasm::trapHandler):

2018-04-19  David Kilzer  <ddkilzer@apple.com>

        Enable Objective-C weak references
        <https://webkit.org/b/184789>
        <rdar://problem/39571716>

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:
        (CLANG_ENABLE_OBJC_WEAK): Enable.
        * Configurations/ToolExecutable.xcconfig:
        (CLANG_ENABLE_OBJC_ARC): Simplify.

2018-04-17  Filip Pizlo  <fpizlo@apple.com>

        The InternalFunction hierarchy should be in IsoSubspaces
        https://bugs.webkit.org/show_bug.cgi?id=184721

        Reviewed by Saam Barati.
        
        This moves InternalFunction into a IsoSubspace. It also moves all subclasses into IsoSubspaces,
        but subclasses that are the same size as InternalFunction share its subspace. I did this
        because the subclasses appear to just override methods, which are called dynamically via the
        structure or class of the object. So, I don't see a type confusion risk if UAF is used to
        allocate one kind of InternalFunction over another.

        * API/JSBase.h:
        * API/JSCallbackFunction.h:
        * API/ObjCCallbackFunction.h:
        (JSC::ObjCCallbackFunction::subspaceFor):
        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/IsoSubspacePerVM.cpp: Added.
        (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::AutoremovingIsoSubspace):
        (JSC::IsoSubspacePerVM::AutoremovingIsoSubspace::~AutoremovingIsoSubspace):
        (JSC::IsoSubspacePerVM::IsoSubspacePerVM):
        (JSC::IsoSubspacePerVM::~IsoSubspacePerVM):
        (JSC::IsoSubspacePerVM::forVM):
        * heap/IsoSubspacePerVM.h: Added.
        (JSC::IsoSubspacePerVM::SubspaceParameters::SubspaceParameters):
        * runtime/Error.h:
        * runtime/ErrorConstructor.h:
        * runtime/InternalFunction.h:
        (JSC::InternalFunction::subspaceFor):
        * runtime/IntlCollatorConstructor.h:
        * runtime/IntlDateTimeFormatConstructor.h:
        * runtime/IntlNumberFormatConstructor.h:
        * runtime/JSArrayBufferConstructor.h:
        * runtime/NativeErrorConstructor.h:
        * runtime/ProxyRevoke.h:
        * runtime/RegExpConstructor.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2018-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, Fix jsc shell
        https://bugs.webkit.org/show_bug.cgi?id=184600

        WebAssembly module loading does not finish with drainMicrotasks().
        So JSNativeStdFunction's capturing variables become invalid.
        This patch fixes this issue.

        * jsc.cpp:
        (functionDollarAgentStart):
        (runWithOptions):
        (runJSC):
        (jscmain):

2018-04-18  Ross Kirsling  <ross.kirsling@sony.com>

        REGRESSION(r230748) [WinCairo] 'JSC::JIT::appendCallWithSlowPathReturnType': function does not take 1 arguments
        https://bugs.webkit.org/show_bug.cgi?id=184725

        Reviewed by Mark Lam.

        * jit/JIT.h:

2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WebAssembly][Modules] Import tables in wasm modules
        https://bugs.webkit.org/show_bug.cgi?id=184738

        Reviewed by JF Bastien.

        This patch simply allows wasm modules to import table from wasm modules / js re-exporting.
        Basically moving JSWebAssemblyInstance's table linking code to WebAssemblyModuleRecord::link
        just works.

        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):

2018-04-18  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Fix build error and crash after PtrTag change
        https://bugs.webkit.org/show_bug.cgi?id=184732

        Reviewed by Mark Lam.

        Do not pass NoPtrTag in callOperation and fix misspelled JSEntryPtrTag. Use
        MacroAssemblerCodePtr::createFromExecutableAddress to avoid tagging a pointer
        twice with ARM-Thumb2.

        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emitSlow_op_put_by_val):
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):

2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WebAssembly][Modules] Import globals from wasm modules
        https://bugs.webkit.org/show_bug.cgi?id=184736

        Reviewed by JF Bastien.

        This patch implements a feature importing globals to/from wasm modules.
        Since we are not supporting mutable globals now, we can just copy the
        global data when importing. Currently we do not support importing/exporting
        i64 globals. This will be supported once (1) mutable global bindings are
        specified and (2) BigInt based i64 importing/exporting is specified.

        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):

2018-04-18  Tomas Popela  <tpopela@redhat.com>

        Unreviewed, fix build on ARM

        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::readCallTarget):

2018-04-18  Tomas Popela  <tpopela@redhat.com>

        Unreviewed, fix build with GCC

        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::finalizeCodeWithDisassembly):

2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, reland r230697, r230720, and r230724.
        https://bugs.webkit.org/show_bug.cgi?id=184600

        With CatchScope check.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * builtins/ModuleLoaderPrototype.js:
        (globalPrivate.newRegistryEntry):
        (requestInstantiate):
        (link):
        * jsc.cpp:
        (convertShebangToJSComment):
        (fillBufferWithContentsOfFile):
        (fetchModuleFromLocalFileSystem):
        (GlobalObject::moduleLoaderFetch):
        (functionDollarAgentStart):
        (checkException):
        (runWithOptions):
        * parser/NodesAnalyzeModule.cpp:
        (JSC::ImportDeclarationNode::analyzeModule):
        * parser/SourceProvider.h:
        (JSC::WebAssemblySourceProvider::create):
        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::hostResolveImportedModule):
        (JSC::AbstractModuleRecord::resolveImport):
        (JSC::AbstractModuleRecord::link):
        (JSC::AbstractModuleRecord::evaluate):
        (JSC::identifierToJSValue): Deleted.
        * runtime/AbstractModuleRecord.h:
        (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
        (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
        * runtime/JSModuleEnvironment.cpp:
        (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
        * runtime/JSModuleLoader.cpp:
        (JSC::JSModuleLoader::evaluate):
        * runtime/JSModuleRecord.cpp:
        (JSC::JSModuleRecord::link):
        (JSC::JSModuleRecord::instantiateDeclarations):
        * runtime/JSModuleRecord.h:
        * runtime/ModuleLoaderPrototype.cpp:
        (JSC::moduleLoaderPrototypeParseModule):
        (JSC::moduleLoaderPrototypeRequestedModules):
        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
        * wasm/WasmCreationMode.h: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.h.
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::getWasmBufferFromValue):
        (JSC::createSourceBufferFromValue):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/WebAssemblyInstanceConstructor.cpp:
        (JSC::constructJSWebAssemblyInstance):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::prepareLink):
        (JSC::WebAssemblyModuleRecord::link):
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyPrototype.cpp:
        (JSC::resolve):
        (JSC::instantiate):
        (JSC::compileAndInstantiate):
        (JSC::WebAssemblyPrototype::instantiate):
        (JSC::webAssemblyInstantiateFunc):
        (JSC::webAssemblyValidateFunc):
        * wasm/js/WebAssemblyPrototype.h:

2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Make it possible to handle JSCClass external properties not added to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=184687

        Reviewed by Michael Catanzaro.

        Add JSCClassVTable that can be optionally passed to jsc_context_register_class() to provide implmentations for
        JSClassDefinition. This is required to implement dynamic properties that can't be added with
        jsc_class_add_property() for example to implement something like imports object in seed/gjs.

        * API/glib/JSCClass.cpp:
        (VTableExceptionHandler::VTableExceptionHandler): Helper class to handle the exceptions in vtable functions that
        can throw exceptions.
        (VTableExceptionHandler::~VTableExceptionHandler):
        (getProperty): Iterate the class chain to call get_property function.
        (setProperty): Iterate the class chain to call set_property function.
        (hasProperty): Iterate the class chain to call has_property function.
        (deleteProperty): Iterate the class chain to call delete_property function.
        (getPropertyNames): Iterate the class chain to call enumerate_properties function.
        (jsc_class_class_init): Remove constructed implementation, since we need to initialize the JSClassDefinition in
        jscClassCreate now.
        (jscClassCreate): Receive an optional JSCClassVTable that is used to initialize the JSClassDefinition.
        * API/glib/JSCClass.h:
        * API/glib/JSCClassPrivate.h:
        * API/glib/JSCContext.cpp:
        (jscContextGetRegisteredClass): Helper to get the JSCClass for a given JSClassRef.
        (jsc_context_register_class): Add JSCClassVTable parameter.
        * API/glib/JSCContext.h:
        * API/glib/JSCContextPrivate.h:
        * API/glib/JSCWrapperMap.cpp:
        (JSC::WrapperMap::registeredClass const): Get the JSCClass for a given JSClassRef.
        * API/glib/JSCWrapperMap.h:
        * API/glib/docs/jsc-glib-4.0-sections.txt: Add new symbols.

2018-04-17  Mark Lam  <mark.lam@apple.com>

        Templatize CodePtr/Refs/FunctionPtrs with PtrTags.
        https://bugs.webkit.org/show_bug.cgi?id=184702
        <rdar://problem/35391681>

        Reviewed by Filip Pizlo and Saam Barati.

        1. Templatized MacroAssemblerCodePtr/Ref, FunctionPtr, and CodeLocation variants
           to take a PtrTag template argument.
        2. Replaced some uses of raw pointers with the equivalent CodePtr / FunctionPtr.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
        (JSC::AbstractMacroAssembler::linkJump):
        (JSC::AbstractMacroAssembler::linkPointer):
        (JSC::AbstractMacroAssembler::getLinkerAddress):
        (JSC::AbstractMacroAssembler::repatchJump):
        (JSC::AbstractMacroAssembler::repatchJumpToNop):
        (JSC::AbstractMacroAssembler::repatchNearCall):
        (JSC::AbstractMacroAssembler::repatchCompact):
        (JSC::AbstractMacroAssembler::repatchInt32):
        (JSC::AbstractMacroAssembler::repatchPointer):
        (JSC::AbstractMacroAssembler::readPointer):
        (JSC::AbstractMacroAssembler::replaceWithLoad):
        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
        * assembler/CodeLocation.h:
        (JSC::CodeLocationCommon:: const):
        (JSC::CodeLocationCommon::CodeLocationCommon):
        (JSC::CodeLocationInstruction::CodeLocationInstruction):
        (JSC::CodeLocationLabel::CodeLocationLabel):
        (JSC::CodeLocationLabel::retagged):
        (JSC::CodeLocationLabel:: const):
        (JSC::CodeLocationJump::CodeLocationJump):
        (JSC::CodeLocationJump::retagged):
        (JSC::CodeLocationCall::CodeLocationCall):
        (JSC::CodeLocationCall::retagged):
        (JSC::CodeLocationNearCall::CodeLocationNearCall):
        (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
        (JSC::CodeLocationDataLabelCompact::CodeLocationDataLabelCompact):
        (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
        (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
        (JSC::CodeLocationCommon<tag>::instructionAtOffset):
        (JSC::CodeLocationCommon<tag>::labelAtOffset):
        (JSC::CodeLocationCommon<tag>::jumpAtOffset):
        (JSC::CodeLocationCommon<tag>::callAtOffset):
        (JSC::CodeLocationCommon<tag>::nearCallAtOffset):
        (JSC::CodeLocationCommon<tag>::dataLabelPtrAtOffset):
        (JSC::CodeLocationCommon<tag>::dataLabel32AtOffset):
        (JSC::CodeLocationCommon<tag>::dataLabelCompactAtOffset):
        (JSC::CodeLocationCommon<tag>::convertibleLoadAtOffset):
        (JSC::CodeLocationCommon::instructionAtOffset): Deleted.
        (JSC::CodeLocationCommon::labelAtOffset): Deleted.
        (JSC::CodeLocationCommon::jumpAtOffset): Deleted.
        (JSC::CodeLocationCommon::callAtOffset): Deleted.
        (JSC::CodeLocationCommon::nearCallAtOffset): Deleted.
        (JSC::CodeLocationCommon::dataLabelPtrAtOffset): Deleted.
        (JSC::CodeLocationCommon::dataLabel32AtOffset): Deleted.
        (JSC::CodeLocationCommon::dataLabelCompactAtOffset): Deleted.
        (JSC::CodeLocationCommon::convertibleLoadAtOffset): Deleted.
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::finalizeCodeWithoutDisassemblyImpl):
        (JSC::LinkBuffer::finalizeCodeWithDisassemblyImpl):
        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): Deleted.
        (JSC::LinkBuffer::finalizeCodeWithDisassembly): Deleted.
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::link):
        (JSC::LinkBuffer::patch):
        (JSC::LinkBuffer::entrypoint):
        (JSC::LinkBuffer::locationOf):
        (JSC::LinkBuffer::locationOfNearCall):
        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
        (JSC::LinkBuffer::trampolineAt):
        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::readCallTarget):
        (JSC::MacroAssemblerARM::replaceWithJump):
        (JSC::MacroAssemblerARM::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerARM::repatchCall):
        (JSC::MacroAssemblerARM::linkCall):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::readCallTarget):
        (JSC::MacroAssemblerARM64::replaceWithVMHalt):
        (JSC::MacroAssemblerARM64::replaceWithJump):
        (JSC::MacroAssemblerARM64::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerARM64::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerARM64::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerARM64::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerARM64::repatchCall):
        (JSC::MacroAssemblerARM64::linkCall):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::replaceWithJump):
        (JSC::MacroAssemblerARMv7::readCallTarget):
        (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerARMv7::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerARMv7::repatchCall):
        (JSC::MacroAssemblerARMv7::linkCall):
        * assembler/MacroAssemblerCodeRef.cpp:
        (JSC::MacroAssemblerCodePtrBase::dumpWithName):
        (JSC::MacroAssemblerCodeRefBase::tryToDisassemble):
        (JSC::MacroAssemblerCodeRefBase::disassembly):
        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): Deleted.
        (JSC::MacroAssemblerCodePtr::dumpWithName const): Deleted.
        (JSC::MacroAssemblerCodePtr::dump const): Deleted.
        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): Deleted.
        (JSC::MacroAssemblerCodeRef::tryToDisassemble const): Deleted.
        (JSC::MacroAssemblerCodeRef::disassembly const): Deleted.
        (JSC::MacroAssemblerCodeRef::dump const): Deleted.
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::FunctionPtr::FunctionPtr):
        (JSC::FunctionPtr::retagged const):
        (JSC::FunctionPtr::retaggedExecutableAddress const):
        (JSC::FunctionPtr::operator== const):
        (JSC::FunctionPtr::operator!= const):
        (JSC::ReturnAddressPtr::ReturnAddressPtr):
        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
        (JSC::MacroAssemblerCodePtr::retagged const):
        (JSC::MacroAssemblerCodePtr:: const):
        (JSC::MacroAssemblerCodePtr::dumpWithName const):
        (JSC::MacroAssemblerCodePtr::dump const):
        (JSC::MacroAssemblerCodePtrHash::hash):
        (JSC::MacroAssemblerCodePtrHash::equal):
        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
        (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
        (JSC::MacroAssemblerCodeRef::code const):
        (JSC::MacroAssemblerCodeRef::retaggedCode const):
        (JSC::MacroAssemblerCodeRef::retagged const):
        (JSC::MacroAssemblerCodeRef::tryToDisassemble const):
        (JSC::MacroAssemblerCodeRef::disassembly const):
        (JSC::MacroAssemblerCodeRef::dump const):
        (JSC::FunctionPtr<tag>::FunctionPtr):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::readCallTarget):
        (JSC::MacroAssemblerMIPS::replaceWithJump):
        (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerMIPS::repatchCall):
        (JSC::MacroAssemblerMIPS::linkCall):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::readCallTarget):
        (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerX86::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerX86::repatchCall):
        (JSC::MacroAssemblerX86::linkCall):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::repatchCompact):
        (JSC::MacroAssemblerX86Common::replaceWithVMHalt):
        (JSC::MacroAssemblerX86Common::replaceWithJump):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::readCallTarget):
        (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
        (JSC::MacroAssemblerX86_64::startOfBranch32WithPatchOnRegister):
        (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
        (JSC::MacroAssemblerX86_64::startOfPatchableBranch32WithPatchOnAddress):
        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
        (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
        (JSC::MacroAssemblerX86_64::repatchCall):
        (JSC::MacroAssemblerX86_64::linkCall):
        * assembler/testmasm.cpp:
        (JSC::compile):
        (JSC::invoke):
        (JSC::testProbeModifiesProgramCounter):
        * b3/B3Compilation.cpp:
        (JSC::B3::Compilation::Compilation):
        * b3/B3Compilation.h:
        (JSC::B3::Compilation::code const):
        (JSC::B3::Compilation::codeRef const):
        * b3/B3Compile.cpp:
        (JSC::B3::compile):
        * b3/B3LowerMacros.cpp:
        * b3/air/AirDisassembler.cpp:
        (JSC::B3::Air::Disassembler::dump):
        * b3/air/testair.cpp:
        * b3/testb3.cpp:
        (JSC::B3::invoke):
        (JSC::B3::testInterpreter):
        (JSC::B3::testEntrySwitchSimple):
        (JSC::B3::testEntrySwitchNoEntrySwitch):
        (JSC::B3::testEntrySwitchWithCommonPaths):
        (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
        (JSC::B3::testEntrySwitchLoop):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/AccessCaseSnippetParams.cpp:
        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
        * bytecode/ByValInfo.h:
        (JSC::ByValInfo::ByValInfo):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::callReturnLocation):
        (JSC::CallLinkInfo::patchableJump):
        (JSC::CallLinkInfo::hotPathBegin):
        (JSC::CallLinkInfo::slowPathStart):
        * bytecode/CallLinkInfo.h:
        (JSC::CallLinkInfo::setCallLocations):
        (JSC::CallLinkInfo::hotPathOther):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
        * bytecode/GetByIdVariant.cpp:
        (JSC::GetByIdVariant::GetByIdVariant):
        (JSC::GetByIdVariant::dumpInContext const):
        * bytecode/GetByIdVariant.h:
        (JSC::GetByIdVariant::customAccessorGetter const):
        * bytecode/GetterSetterAccessCase.cpp:
        (JSC::GetterSetterAccessCase::create):
        (JSC::GetterSetterAccessCase::GetterSetterAccessCase):
        (JSC::GetterSetterAccessCase::dumpImpl const):
        * bytecode/GetterSetterAccessCase.h:
        (JSC::GetterSetterAccessCase::customAccessor const):
        (): Deleted.
        * bytecode/HandlerInfo.h:
        (JSC::HandlerInfo::initialize):
        * bytecode/InlineAccess.cpp:
        (JSC::linkCodeInline):
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/InlineAccess.h:
        * bytecode/JumpTable.h:
        (JSC::StringJumpTable::ctiForValue):
        (JSC::SimpleJumpTable::ctiForValue):
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::unlink):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
        (JSC::PolymorphicAccess::regenerate):
        * bytecode/PolymorphicAccess.h:
        (JSC::AccessGenerationResult::AccessGenerationResult):
        (JSC::AccessGenerationResult::code const):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::slowPathCallLocation):
        (JSC::StructureStubInfo::doneLocation):
        (JSC::StructureStubInfo::slowPathStartLocation):
        (JSC::StructureStubInfo::patchableJumpForIn):
        * dfg/DFGCommonData.h:
        (JSC::DFG::CommonData::appendCatchEntrypoint):
        * dfg/DFGDisassembler.cpp:
        (JSC::DFG::Disassembler::dumpDisassembly):
        * dfg/DFGDriver.h:
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::linkOSRExits):
        (JSC::DFG::JITCompiler::compileExceptionHandlers):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::compileFunction):
        (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::CallLinkRecord::CallLinkRecord):
        (JSC::DFG::JITCompiler::appendCall):
        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
        (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
        (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::JITFinalizer):
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction):
        * dfg/DFGJITFinalizer.h:
        * dfg/DFGJumpReplacement.h:
        (JSC::DFG::JumpReplacement::JumpReplacement):
        * dfg/DFGNode.h:
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        (JSC::DFG::prepareCatchOSREntry):
        * dfg/DFGOSREntry.h:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::executeOSRExit):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        (JSC::DFG::OSRExit::codeLocationForRepatch const):
        (JSC::DFG::OSRExit::emitRestoreArguments):
        (JSC::DFG::OSRExit::compileOSRExit):
        * dfg/DFGOSRExit.h:
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::osrWriteBarrier):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        * dfg/DFGSlowPathGenerator.h:
        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
        (JSC::DFG::slowPathCall):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileMathIC):
        (JSC::DFG::SpeculativeJIT::compileCallDOM):
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
        (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
        (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        (JSC::DFG::SpeculativeJIT::appendCall):
        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitThunkGenerator):
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * dfg/DFGThunks.h:
        * disassembler/ARM64Disassembler.cpp:
        (JSC::tryToDisassemble):
        * disassembler/ARMv7Disassembler.cpp:
        (JSC::tryToDisassemble):
        * disassembler/Disassembler.cpp:
        (JSC::disassemble):
        (JSC::disassembleAsynchronously):
        * disassembler/Disassembler.h:
        (JSC::tryToDisassemble):
        * disassembler/UDis86Disassembler.cpp:
        (JSC::tryToDisassembleWithUDis86):
        * disassembler/UDis86Disassembler.h:
        (JSC::tryToDisassembleWithUDis86):
        * disassembler/X86Disassembler.cpp:
        (JSC::tryToDisassemble):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLExceptionTarget.cpp:
        (JSC::FTL::ExceptionTarget::label):
        (JSC::FTL::ExceptionTarget::jumps):
        * ftl/FTLExceptionTarget.h:
        * ftl/FTLGeneratedFunction.h:
        * ftl/FTLJITCode.cpp:
        (JSC::FTL::JITCode::initializeB3Code):
        (JSC::FTL::JITCode::initializeAddressForCall):
        (JSC::FTL::JITCode::initializeArityCheckEntrypoint):
        (JSC::FTL::JITCode::addressForCall):
        (JSC::FTL::JITCode::executableAddressAtOffset):
        * ftl/FTLJITCode.h:
        (JSC::FTL::JITCode::b3Code const):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalizeCommon):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::initialize):
        (JSC::FTL::LazySlowPath::generate):
        * ftl/FTLLazySlowPath.h:
        (JSC::FTL::LazySlowPath::patchableJump const):
        (JSC::FTL::LazySlowPath::done const):
        (JSC::FTL::LazySlowPath::stub const):
        * ftl/FTLLazySlowPathCall.h:
        (JSC::FTL::createLazyCallGenerator):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        (JSC::FTL::DFG::LowerDFGToB3::compileInvalidationPoint):
        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
        (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
        * ftl/FTLOSRExit.cpp:
        (JSC::FTL::OSRExit::codeLocationForRepatch const):
        * ftl/FTLOSRExit.h:
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        (JSC::FTL::compileFTLOSRExit):
        * ftl/FTLOSRExitHandle.cpp:
        (JSC::FTL::OSRExitHandle::emitExitThunk):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::compileFTLLazySlowPath):
        * ftl/FTLPatchpointExceptionHandle.cpp:
        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
        * ftl/FTLSlowPathCall.cpp:
        (JSC::FTL::SlowPathCallContext::keyWithTarget const):
        (JSC::FTL::SlowPathCallContext::makeCall):
        * ftl/FTLSlowPathCall.h:
        (JSC::FTL::callOperation):
        * ftl/FTLSlowPathCallKey.cpp:
        (JSC::FTL::SlowPathCallKey::dump const):
        * ftl/FTLSlowPathCallKey.h:
        (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
        (JSC::FTL::SlowPathCallKey::callTarget const):
        (JSC::FTL::SlowPathCallKey::withCallTarget):
        (JSC::FTL::SlowPathCallKey::hash const):
        (JSC::FTL::SlowPathCallKey::callPtrTag const): Deleted.
        * ftl/FTLState.cpp:
        (JSC::FTL::State::State):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::osrExitGenerationThunkGenerator):
        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * ftl/FTLThunks.h:
        (JSC::FTL::generateIfNecessary):
        (JSC::FTL::keyForThunk):
        (JSC::FTL::Thunks::getSlowPathCallThunk):
        (JSC::FTL::Thunks::keyForSlowPathCallThunk):
        * interpreter/InterpreterInlines.h:
        (JSC::Interpreter::getOpcodeID):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::callExceptionFuzz):
        (JSC::AssemblyHelpers::emitDumbVirtualCall):
        (JSC::AssemblyHelpers::debugCall):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::ensureShadowChickenPacket):
        * jit/ExecutableAllocator.cpp:
        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
        * jit/ExecutableAllocator.h:
        (JSC::performJITMemcpy):
        * jit/GCAwareJITStubRoutine.cpp:
        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
        (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
        (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
        (JSC::createJITStubRoutine):
        * jit/GCAwareJITStubRoutine.h:
        (JSC::createJITStubRoutine):
        * jit/JIT.cpp:
        (JSC::ctiPatchCallByReturnAddress):
        (JSC::JIT::compileWithoutLinking):
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        (JSC::CallRecord::CallRecord):
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITCode.cpp:
        (JSC::JITCodeWithCodeRef::JITCodeWithCodeRef):
        (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
        (JSC::DirectJITCode::DirectJITCode):
        (JSC::DirectJITCode::initializeCodeRef):
        (JSC::DirectJITCode::addressForCall):
        (JSC::NativeJITCode::NativeJITCode):
        (JSC::NativeJITCode::initializeCodeRef):
        (JSC::NativeJITCode::addressForCall):
        * jit/JITCode.h:
        * jit/JITCodeMap.h:
        (JSC::JITCodeMap::Entry::Entry):
        (JSC::JITCodeMap::Entry::codeLocation):
        (JSC::JITCodeMap::append):
        (JSC::JITCodeMap::find const):
        * jit/JITDisassembler.cpp:
        (JSC::JITDisassembler::dumpDisassembly):
        * jit/JITExceptions.cpp:
        (JSC::genericUnwind):
        * jit/JITInlineCacheGenerator.cpp:
        (JSC::JITByIdGenerator::finalize):
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedCall):
        (JSC::JIT::emitNakedTailCall):
        (JSC::JIT::appendCallWithExceptionCheck):
        (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
        (JSC::JIT::appendCallWithCallFrameRollbackOnException):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emitSlow_op_has_indexed_property):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOperations.cpp:
        (JSC::getByVal):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::emitGetByValWithCachedId):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emitPutByValWithCachedId):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        * jit/JITStubRoutine.h:
        (JSC::JITStubRoutine::JITStubRoutine):
        (JSC::JITStubRoutine::createSelfManagedRoutine):
        (JSC::JITStubRoutine::code const):
        (JSC::JITStubRoutine::asCodePtr):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiNativeCall):
        (JSC::JITThunks::ctiNativeConstruct):
        (JSC::JITThunks::ctiNativeTailCall):
        (JSC::JITThunks::ctiNativeTailCallWithoutSavedTags):
        (JSC::JITThunks::ctiInternalFunctionCall):
        (JSC::JITThunks::ctiInternalFunctionConstruct):
        (JSC::JITThunks::ctiStub):
        (JSC::JITThunks::existingCTIStub):
        (JSC::JITThunks::hostFunctionStub):
        * jit/JITThunks.h:
        * jit/PCToCodeOriginMap.cpp:
        (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
        * jit/PCToCodeOriginMap.h:
        * jit/PolymorphicCallStubRoutine.cpp:
        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
        * jit/PolymorphicCallStubRoutine.h:
        * jit/Repatch.cpp:
        (JSC::readPutICCallTarget):
        (JSC::ftlThunkAwareRepatchCall):
        (JSC::appropriateOptimizingGetByIdFunction):
        (JSC::appropriateGetByIdFunction):
        (JSC::tryCacheGetByID):
        (JSC::repatchGetByID):
        (JSC::tryCachePutByID):
        (JSC::repatchPutByID):
        (JSC::tryCacheIn):
        (JSC::repatchIn):
        (JSC::linkSlowFor):
        (JSC::linkFor):
        (JSC::linkDirectFor):
        (JSC::revertCall):
        (JSC::unlinkFor):
        (JSC::linkVirtualFor):
        (JSC::linkPolymorphicCall):
        (JSC::resetGetByID):
        (JSC::resetPutByID):
        * jit/Repatch.h:
        * jit/SlowPathCall.h:
        (JSC::JITSlowPathCall::call):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        (JSC::SpecializedThunkJIT::callDoubleToDouble):
        (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
        * jit/ThunkGenerator.h:
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::slowPathFor):
        (JSC::linkCallThunkGenerator):
        (JSC::linkPolymorphicCallThunkGenerator):
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::nativeCallGenerator):
        (JSC::nativeTailCallGenerator):
        (JSC::nativeTailCallWithoutSavedTagsGenerator):
        (JSC::nativeConstructGenerator):
        (JSC::internalFunctionCallGenerator):
        (JSC::internalFunctionConstructGenerator):
        (JSC::arityFixupGenerator):
        (JSC::unreachableGenerator):
        (JSC::charCodeAtThunkGenerator):
        (JSC::charAtThunkGenerator):
        (JSC::fromCharCodeThunkGenerator):
        (JSC::clz32ThunkGenerator):
        (JSC::sqrtThunkGenerator):
        (JSC::floorThunkGenerator):
        (JSC::ceilThunkGenerator):
        (JSC::truncThunkGenerator):
        (JSC::roundThunkGenerator):
        (JSC::expThunkGenerator):
        (JSC::logThunkGenerator):
        (JSC::absThunkGenerator):
        (JSC::imulThunkGenerator):
        (JSC::randomThunkGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * jit/ThunkGenerators.h:
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        (JSC::LLInt::getExecutableAddress):
        (JSC::LLInt::getCodePtr):
        (JSC::LLInt::getCodeRef):
        (JSC::LLInt::getCodeFunctionPtr):
        * llint/LLIntEntrypoint.cpp:
        (JSC::LLInt::setFunctionEntrypoint):
        (JSC::LLInt::setEvalEntrypoint):
        (JSC::LLInt::setProgramEntrypoint):
        (JSC::LLInt::setModuleProgramEntrypoint):
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::callToThrow):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::setUpCall):
        * llint/LLIntThunks.cpp:
        (JSC::vmEntryToWasm):
        (JSC::LLInt::generateThunkWithJumpTo):
        (JSC::LLInt::functionForCallEntryThunkGenerator):
        (JSC::LLInt::functionForConstructEntryThunkGenerator):
        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
        (JSC::LLInt::evalEntryThunkGenerator):
        (JSC::LLInt::programEntryThunkGenerator):
        (JSC::LLInt::moduleProgramEntryThunkGenerator):
        * llint/LLIntThunks.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * profiler/ProfilerCompilation.cpp:
        (JSC::Profiler::Compilation::addOSRExitSite):
        * profiler/ProfilerCompilation.h:
        * profiler/ProfilerOSRExitSite.cpp:
        (JSC::Profiler::OSRExitSite::toJS const):
        * profiler/ProfilerOSRExitSite.h:
        (JSC::Profiler::OSRExitSite::OSRExitSite):
        (JSC::Profiler::OSRExitSite::codeAddress const):
        (JSC::Profiler::OSRExitSite:: const): Deleted.
        * runtime/ExecutableBase.cpp:
        (JSC::ExecutableBase::clearCode):
        * runtime/ExecutableBase.h:
        (JSC::ExecutableBase::entrypointFor):
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::finishCreation):
        * runtime/NativeFunction.h:
        (JSC::TaggedNativeFunction::TaggedNativeFunction):
        (JSC::TaggedNativeFunction::operator NativeFunction):
        * runtime/PtrTag.h:
        (JSC::tagCodePtr):
        (JSC::untagCodePtr):
        (JSC::retagCodePtr):
        (JSC::tagCFunctionPtr):
        (JSC::untagCFunctionPtr):
        (JSC::nextPtrTagID): Deleted.
        * runtime/PutPropertySlot.h:
        (JSC::PutPropertySlot::PutPropertySlot):
        (JSC::PutPropertySlot::setCustomValue):
        (JSC::PutPropertySlot::setCustomAccessor):
        (JSC::PutPropertySlot::customSetter const):
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::installCode):
        * runtime/VM.cpp:
        (JSC::VM::getHostFunction):
        (JSC::VM::getCTIInternalFunctionTrampolineFor):
        * runtime/VM.h:
        (JSC::VM::getCTIStub):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
        (JSC::Wasm::B3IRGenerator::emitTierUpCheck):
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::prepare):
        (JSC::Wasm::BBQPlan::complete):
        * wasm/WasmBBQPlan.h:
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmBinding.h:
        * wasm/WasmCallee.h:
        (JSC::Wasm::Callee::entrypoint const):
        * wasm/WasmCallingConvention.h:
        (JSC::Wasm::CallingConvention::setupFrameInPrologue const):
        * wasm/WasmCodeBlock.h:
        (JSC::Wasm::CodeBlock::entrypointLoadLocationFromFunctionIndexSpace):
        * wasm/WasmFaultSignalHandler.cpp:
        (JSC::Wasm::trapHandler):
        * wasm/WasmFormat.h:
        * wasm/WasmInstance.h:
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
        (JSC::Wasm::Thunks::stub):
        (JSC::Wasm::Thunks::existingStub):
        * wasm/WasmThunks.h:
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * wasm/js/WasmToJS.h:
        * wasm/js/WebAssemblyFunction.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
        (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
        (JSC::Yarr::YarrGenerator::compile):
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrCodeBlock::set8BitCode):
        (JSC::Yarr::YarrCodeBlock::set16BitCode):
        (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
        (JSC::Yarr::YarrCodeBlock::execute):
        (JSC::Yarr::YarrCodeBlock::clear):

2018-04-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r230697, r230720, and r230724.
        https://bugs.webkit.org/show_bug.cgi?id=184717

        These caused multiple failures on the Test262 testers.
        (Requested by mlewis13 on #webkit).

        Reverted changesets:

        "[WebAssembly][Modules] Prototype wasm import"
        https://bugs.webkit.org/show_bug.cgi?id=184600
        https://trac.webkit.org/changeset/230697

        "[WebAssembly][Modules] Implement function import from wasm
        modules"
        https://bugs.webkit.org/show_bug.cgi?id=184689
        https://trac.webkit.org/changeset/230720

        "[JSC] Rename runWebAssembly to runWebAssemblySuite"
        https://bugs.webkit.org/show_bug.cgi?id=184703
        https://trac.webkit.org/changeset/230724

2018-04-17  JF Bastien  <jfbastien@apple.com>

        A put is not an ExistingProperty put when we transition a structure because of an attributes change
        https://bugs.webkit.org/show_bug.cgi?id=184706
        <rdar://problem/38871451>

        Reviewed by Saam Barati.

        When putting a property on a structure and the slot is a different
        type, the slot can't be said to have already been existing.

        * runtime/JSObjectInlines.h:
        (JSC::JSObject::putDirectInternal):

2018-04-17  Filip Pizlo  <fpizlo@apple.com>

        JSGenericTypedArrayView<>::visitChildren has a race condition reading m_mode and m_vector
        https://bugs.webkit.org/show_bug.cgi?id=184705

        Reviewed by Michael Saboff.
        
        My old multisocket Mac Pro is amazing at catching race conditions in the GC. Earlier today
        while testing an unrelated patch, a concurrent GC thread crashed inside
        JSGenericTypedArrayView<>::visitChildren() calling markAuxiliary(). I'm pretty sure it's
        because a typed array became wasteful concurrently to the GC. So, visitChildren() read one
        mode and another vector.
        
        The fix is to lock inside visitChildren and anyone who changes those fields.
        
        I'm not even going to try to write a test. I think it's super lucky that my Mac Pro caught
        this.

        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::neuter):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

2018-04-16  Filip Pizlo  <fpizlo@apple.com>

        PutStackSinkingPhase should know that KillStack means ConflictingFlush
        https://bugs.webkit.org/show_bug.cgi?id=184672

        Reviewed by Michael Saboff.

        We've had a long history of KillStack and PutStackSinkingPhase having problems. We kept changing the meaning of
        KillStack, and at some point we removed reasoning about KillStack from PutStackSinkingPhase. I tried doing some
        archeology - but I'm still not sure why that phase ignores KillStack entirely. Maybe it's an oversight or maybe it's
        intentional - I don't know.

        Whatever the history, it's clear from the attached test case that ignoring KillStack is not correct. The outcome of
        doing so is that we will sometimes sink a PutStack below a KillStack. That's wrong because then, OSR exit will use
        the value from the PutStack instead of using the value from the MovHint that is associated with the KillStack. So,
        KillStack must be seen as a special kind of clobber of the stack slot. OSRAvailabiity uses ConflictingFlush. I think
        that's correct here, too. If we used DeadFlush and that was merged with another control flow path that had a
        specific flush format, then we would think that we could sink the flush from that path. That's not right, since that
        could still lead to sinking a PutStack past the KillStack in the sense that a PutStack will appear after the
        KillStack along one path through the CFG. Also, the definition of DeadFlush and ConflictingFlush in the comment
        inside PutStackSinkingPhase seems to suggest that KillStack is a ConflictingFlush, since DeadFlush means that we
        have done some PutStack and their values are still valid. KillStack is not a PutStack and it means that previous
        values are not valid. The definition of ConflictingFlush is that "we know, via forward flow, that there isn't any
        value in the given local that anyone should have been relying on" - which exactly matches KillStack's definition.

        This also means that we cannot eliminate arguments allocations that are live over KillStacks, since if we eliminated
        them then we would have a GetStack after a KillStack. One easy way to fix this is to say that KillStack writes to
        its stack slot for the purpose of clobberize.

        * dfg/DFGClobberize.h: KillStack "writes" to its stack slot.
        * dfg/DFGPutStackSinkingPhase.cpp: Fix the bug.
        * ftl/FTLLowerDFGToB3.cpp: Add better assertion failure.
        (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments):

2018-04-17  Filip Pizlo  <fpizlo@apple.com>

        JSWebAssemblyCodeBlock should be in an IsoSubspace
        https://bugs.webkit.org/show_bug.cgi?id=184704

        Reviewed by Mark Lam.
        
        Previously it was in a CompleteSubspace, which is pretty good, but also quite wasteful.
        CompleteSubspace means about 4KB of data to track the size-allocator mapping. IsoSubspace
        shortcircuits this. Also, IsoSubspace uses the iso allocator, so it provides stronger UAF
        protection.

        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * wasm/js/JSWebAssemblyCodeBlock.h:

2018-04-17  Jer Noble  <jer.noble@apple.com>

        Only enable useSeparatedWXHeap on ARM64.
        https://bugs.webkit.org/show_bug.cgi?id=184697

        Reviewed by Saam Barati.

        * runtime/Options.cpp:
        (JSC::recomputeDependentOptions):

2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WebAssembly][Modules] Implement function import from wasm modules
        https://bugs.webkit.org/show_bug.cgi?id=184689

        Reviewed by JF Bastien.

        This patch implements function import from wasm modules. We move function importing part
        from JSWebAssemblyInstance's creation function to WebAssemblyModuleRecord::link. This
        is because linking these functions requires that all the dependent modules are created.
        While we want to move all the linking functionality from JSWebAssemblyInstance to
        WebAssemblyModuleRecord::link, we do not that in this patch.  In this patch, we move only
        function importing part because efficient compilation of WebAssembly needs to know
        the type of WebAssemblyMemory (signaling or bound checking). This needs to know imported
        or attached WebAssembly memory object. So we cannot defer this linking to
        WebAssemblyModuleRecord::link now.

        The largest difference from JS module linking is that WebAssembly module linking links
        function from the module by snapshotting. When you have a cyclic module graph like this,

        -> JS1 (export "fun") -> Wasm1 (import "fun from JS1) -+
            ^                                                  |
            +--------------------------------------------------+

        we fail to link this since "fun" is not instantiated when Wasm1 is first linked. This behavior
        is described in [1], and tested in this patch.

        [1]: https://github.com/WebAssembly/esm-integration/tree/master/proposals/esm-integration#js---wasm-cycle-where-js-is-higher-in-the-module-graph

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * jsc.cpp:
        (functionDollarAgentStart):
        (checkException):
        (runWithOptions):
        Small fixes for wasm module loading.

        * parser/NodesAnalyzeModule.cpp:
        (JSC::ImportDeclarationNode::analyzeModule):
        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::resolveImport):
        (JSC::AbstractModuleRecord::link):
        * runtime/AbstractModuleRecord.h:
        (JSC::AbstractModuleRecord::moduleEnvironmentMayBeNull):
        (JSC::AbstractModuleRecord::ImportEntry::isNamespace const): Deleted.
        Now, wasm modules can have import which is named "*". So this function does not work.
        Since wasm modules never have namespace importing, we check this in JS's module analyzer.

        * runtime/JSModuleEnvironment.cpp:
        (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
        * runtime/JSModuleRecord.cpp:
        (JSC::JSModuleRecord::instantiateDeclarations):
        * wasm/WasmCreationMode.h: Added.
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/WebAssemblyInstanceConstructor.cpp:
        (JSC::constructJSWebAssemblyInstance):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyPrototype.cpp:
        (JSC::resolve):
        (JSC::instantiate):
        (JSC::compileAndInstantiate):
        (JSC::WebAssemblyPrototype::instantiate):
        (JSC::webAssemblyInstantiateFunc):

2018-04-17  Dominik Infuehr  <dinfuehr@igalia.com>

        Implement setupArgumentsImpl for ARM and MIPS
        https://bugs.webkit.org/show_bug.cgi?id=183786

        Reviewed by Yusuke Suzuki.

        Implement setupArgumentsImpl for ARM (hardfp and softfp) and MIPS calling convention. Added
        numCrossSources and extraGPRArgs to ArgCollection to keep track of extra
        registers used for 64-bit values on 32-bit architectures. numCrossSources
        keeps track of assignments from FPR to GPR registers as happens e.g. on MIPS.

        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::moveDouble):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::moveDouble):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::setupStubCrossArgs):
        (JSC::CCallHelpers::ArgCollection::ArgCollection):
        (JSC::CCallHelpers::ArgCollection::pushRegArg):
        (JSC::CCallHelpers::ArgCollection::pushExtraRegArg):
        (JSC::CCallHelpers::ArgCollection::addGPRArg):
        (JSC::CCallHelpers::ArgCollection::addGPRExtraArg):
        (JSC::CCallHelpers::ArgCollection::addStackArg):
        (JSC::CCallHelpers::ArgCollection::addPoke):
        (JSC::CCallHelpers::ArgCollection::argCount):
        (JSC::CCallHelpers::calculatePokeOffset):
        (JSC::CCallHelpers::pokeForArgument):
        (JSC::CCallHelpers::stackAligned):
        (JSC::CCallHelpers::marshallArgumentRegister):
        (JSC::CCallHelpers::setupArgumentsImpl):
        (JSC::CCallHelpers::pokeArgumentsAligned):
        (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::setupArguments):
        * jit/FPRInfo.h:
        (JSC::FPRInfo::toArgumentRegister):

2018-04-17  Saam Barati  <sbarati@apple.com>

        Add system trace points for process launch and for initializeWebProcess
        https://bugs.webkit.org/show_bug.cgi?id=184669

        Reviewed by Simon Fraser.

        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::VMEntryScope):
        (JSC::VMEntryScope::~VMEntryScope):

2018-04-17  Jer Noble  <jer.noble@apple.com>

        Fix duplicate symbol errors when building JavaScriptCore with non-empty WK_ALTERNATE_WEBKIT_SDK_PATH
        https://bugs.webkit.org/show_bug.cgi?id=184602

        Reviewed by Beth Dakin.

        * JavaScriptCore.xcodeproj/project.pbxproj:

2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Add API to clear JSCContext uncaught exception
        https://bugs.webkit.org/show_bug.cgi?id=184685

        Reviewed by Žan Doberšek.

        Add jsc_context_clear_exception() to clear any possible uncaught exception in a JSCContext.

        * API/glib/JSCContext.cpp:
        (jsc_context_clear_exception):
        * API/glib/JSCContext.h:
        * API/glib/docs/jsc-glib-4.0-sections.txt:

2018-04-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Add API to query, delete and enumerate properties
        https://bugs.webkit.org/show_bug.cgi?id=184647

        Reviewed by Michael Catanzaro.

        Add jsc_value_object_has_property(), jsc_value_object_delete_property() and jsc_value_object_enumerate_properties().

        * API/glib/JSCValue.cpp:
        (jsc_value_object_has_property):
        (jsc_value_object_delete_property):
        (jsc_value_object_enumerate_properties):
        * API/glib/JSCValue.h:
        * API/glib/docs/jsc-glib-4.0-sections.txt:

2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WebAssembly][Modules] Prototype wasm import
        https://bugs.webkit.org/show_bug.cgi?id=184600

        Reviewed by JF Bastien.

        This patch is an initial attempt to implement Wasm loading in module pipeline.
        Currently,

        1. We only support Wasm loading in the JSC shell. Once loading mechanism is specified
           in whatwg HTML, we should integrate this into WebCore.

        2. We only support exporting values from Wasm. Wasm module cannot import anything from
           the other modules now.

        When loading a file, JSC shell checks wasm magic. If the wasm magic is found, JSC shell
        loads the file with WebAssemblySourceProvider. It is wrapped into JSSourceCode and
        module loader pipeline just handles it as the same to JS. When parsing a module, we
        checks the type of JSSourceCode. If the source code is Wasm source code, we create a
        WebAssemblyModuleRecord instead of JSModuleRecord. Our module pipeline handles
        AbstractModuleRecord and Wasm module is instantiated, linked, and evaluated.

        * builtins/ModuleLoaderPrototype.js:
        (globalPrivate.newRegistryEntry):
        (requestInstantiate):
        (link):
        * jsc.cpp:
        (convertShebangToJSComment):
        (fillBufferWithContentsOfFile):
        (fetchModuleFromLocalFileSystem):
        (GlobalObject::moduleLoaderFetch):
        * parser/SourceProvider.h:
        (JSC::WebAssemblySourceProvider::create):
        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
        * runtime/AbstractModuleRecord.cpp:
        (JSC::AbstractModuleRecord::hostResolveImportedModule):
        (JSC::AbstractModuleRecord::link):
        (JSC::AbstractModuleRecord::evaluate):
        (JSC::identifierToJSValue): Deleted.
        * runtime/AbstractModuleRecord.h:
        * runtime/JSModuleLoader.cpp:
        (JSC::JSModuleLoader::evaluate):
        * runtime/JSModuleRecord.cpp:
        (JSC::JSModuleRecord::link):
        (JSC::JSModuleRecord::instantiateDeclarations):
        * runtime/JSModuleRecord.h:
        * runtime/ModuleLoaderPrototype.cpp:
        (JSC::moduleLoaderPrototypeParseModule):
        (JSC::moduleLoaderPrototypeRequestedModules):
        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::getWasmBufferFromValue):
        (JSC::createSourceBufferFromValue):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::createPrivateModuleKey):
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/WebAssemblyInstanceConstructor.cpp:
        (JSC::constructJSWebAssemblyInstance):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::prepareLink):
        (JSC::WebAssemblyModuleRecord::link):
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyPrototype.cpp:
        (JSC::resolve):
        (JSC::instantiate):
        (JSC::compileAndInstantiate):
        (JSC::WebAssemblyPrototype::instantiate):
        (JSC::webAssemblyInstantiateFunc):
        (JSC::webAssemblyValidateFunc):
        * wasm/js/WebAssemblyPrototype.h:

2018-04-14  Filip Pizlo  <fpizlo@apple.com>

        Function.prototype.caller shouldn't return generator bodies
        https://bugs.webkit.org/show_bug.cgi?id=184630

        Reviewed by Yusuke Suzuki.
        
        Function.prototype.caller no longer returns generator bodies. Those are meant to be
        private.
        
        Also added some builtin debugging tools so that it's easier to do the investigation that I
        did.

        * builtins/BuiltinNames.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::callerGetter):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::globalFuncBuiltinDescribe):
        * runtime/JSGlobalObjectFunctions.h:

2018-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Remove duplicate 32bit ProfileType implementation
        https://bugs.webkit.org/show_bug.cgi?id=184536

        Reviewed by Saam Barati.

        This patch removes duplicate 32bit ProfileType implementation by unifying 32/64 implementations.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileProfileType):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfUndefined):
        (JSC::AssemblyHelpers::branchIfNull):

2018-04-12  Mark Lam  <mark.lam@apple.com>

        Consolidate some PtrTags.
        https://bugs.webkit.org/show_bug.cgi?id=184552
        <rdar://problem/39389404>

        Reviewed by Filip Pizlo.

        Consolidate CodeEntryPtrTag and CodeEntryWithArityCheckPtrTag into CodePtrTag.
        Consolidate NearCallPtrTag and NearJumpPtrTag into NearCodePtrTag.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::repatchNearCall):
        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::readCallTarget):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::readCallTarget):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::readCallTarget):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::readCallTarget):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::readCallTarget):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::linkOSRExits):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::compileFunction):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::executeOSRExit):
        (JSC::DFG::adjustAndJumpToTarget):
        (JSC::DFG::OSRExit::compileOSRExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        * ftl/FTLJITCode.cpp:
        (JSC::FTL::JITCode::executableAddressAtOffset):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalizeCommon):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::generate):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileFTLOSRExit):
        * ftl/FTLOSRExitHandle.cpp:
        (JSC::FTL::OSRExitHandle::emitExitThunk):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitDumbVirtualCall):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        (JSC::JIT::link):
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITCode.cpp:
        (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
        (JSC::NativeJITCode::addressForCall):
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedCall):
        (JSC::JIT::emitNakedTailCall):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOperations.cpp:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::hostFunctionStub):
        * jit/Repatch.cpp:
        (JSC::linkSlowFor):
        (JSC::linkFor):
        (JSC::linkPolymorphicCall):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntEntrypoint.cpp:
        (JSC::LLInt::setEvalEntrypoint):
        (JSC::LLInt::setProgramEntrypoint):
        (JSC::LLInt::setModuleProgramEntrypoint):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::setUpCall):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        (JSC::LLInt::functionForCallEntryThunkGenerator):
        (JSC::LLInt::functionForConstructEntryThunkGenerator):
        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
        (JSC::LLInt::evalEntryThunkGenerator):
        (JSC::LLInt::programEntryThunkGenerator):
        (JSC::LLInt::moduleProgramEntryThunkGenerator):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::finishCreation):
        * runtime/NativeFunction.h:
        (JSC::TaggedNativeFunction::TaggedNativeFunction):
        (JSC::TaggedNativeFunction::operator NativeFunction):
        * runtime/PtrTag.h:
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::complete):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::compile):

2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>

        [WPE] Move libWPEWebInspectorResources.so to pkglibdir
        https://bugs.webkit.org/show_bug.cgi?id=184379

        Reviewed by Žan Doberšek.

        Load the module from the new location.

        * PlatformWPE.cmake:
        * inspector/remote/glib/RemoteInspectorUtils.cpp:
        (Inspector::backendCommands):

2018-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Remove compileBigIntEquality in DFG 32bit
        https://bugs.webkit.org/show_bug.cgi?id=184535

        Reviewed by Saam Barati.

        We can have the unified implementation for compileBigIntEquality.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileBigIntEquality): Deleted.

2018-04-12  Michael Catanzaro  <mcatanzaro@igalia.com>

        [WPE] Improve include hierarchy
        https://bugs.webkit.org/show_bug.cgi?id=184376

        Reviewed by Žan Doberšek.

        Install JSC headers under /usr/include/wpe-webkit-0.1/jsc instead of
        /usr/include/wpe-0.1/WPE/jsc.

        * PlatformWPE.cmake:

2018-04-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Handle strings containing null characters
        https://bugs.webkit.org/show_bug.cgi?id=184450

        Reviewed by Michael Catanzaro.

        We should be able to evaluate scripts containing null characters and to handle strings that contains them
        too. In JavaScript strings are not null-terminated, they can contain null characters. This patch adds a length
        parameter to jsc_context_valuate() to pass the script length (or -1 if it's null terminated), and new functions
        jsc_value_new_string_from_bytes() and jsc_value_to_string_as_bytes() using GBytes to store strings that might
        contain null characters.

        * API/OpaqueJSString.cpp:
        (OpaqueJSString::create): Add a create constructor that takes the String.
        * API/OpaqueJSString.h:
        (OpaqueJSString::OpaqueJSString): Add a constructor that takes the String.
        * API/glib/JSCContext.cpp:
        (jsc_context_evaluate): Add length parameter.
        (jsc_context_evaluate_with_source_uri): Ditto.
        * API/glib/JSCContext.h:
        * API/glib/JSCValue.cpp:
        (jsc_value_new_string_from_bytes):
        (jsc_value_to_string):
        (jsc_value_to_string_as_bytes):
        (jsc_value_object_is_instance_of): Pass length to evaluate.
        * API/glib/JSCValue.h:
        * API/glib/docs/jsc-glib-4.0-sections.txt:

2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Add CCallHelpers::CellValue to wrap JSCell GPR to convert it to EncodedJSValue
        https://bugs.webkit.org/show_bug.cgi?id=184500

        Reviewed by Mark Lam.

        Instead of passing JSValue::JSCellTag to callOperation meta-program to convert
        JSCell GPR to EncodedJSValue in 32bit code, we add CallHelpers::CellValue.
        It is a wrapper for GPRReg, like TrustedImmPtr for pointer value. When poking
        CellValue, 32bit code emits JSValue::CellTag automatically. In 64bit, we just
        poke held GPR. The benefit from this CellValue is that we can use the same code
        for 32bit and 64bit. This patch removes several ifdefs.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
        (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::CellValue::CellValue):
        (JSC::CCallHelpers::CellValue::gpr const):
        (JSC::CCallHelpers::setupArgumentsImpl):

2018-04-11  Mark Lam  <mark.lam@apple.com>

        [Build fix] Replace CompactJITCodeMap with JITCodeMap.
        https://bugs.webkit.org/show_bug.cgi?id=184512
        <rdar://problem/35391728>

        Not reviewed.

        * bytecode/CodeBlock.h:
        * jit/JITCodeMap.h:

2018-04-11  Mark Lam  <mark.lam@apple.com>

        Replace CompactJITCodeMap with JITCodeMap.
        https://bugs.webkit.org/show_bug.cgi?id=184512
        <rdar://problem/35391728>

        Reviewed by Filip Pizlo.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::setJITCodeMap):
        (JSC::CodeBlock::jitCodeMap const):
        (JSC::CodeBlock::jitCodeMap): Deleted.
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::executeOSRExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::adjustAndJumpToTarget):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::decodedCodeMapFor): Deleted.
        * jit/AssemblyHelpers.h:
        * jit/CompactJITCodeMap.h: Removed.
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JITCodeMap.h: Added.
        (JSC::JITCodeMap::Entry::Entry):
        (JSC::JITCodeMap::Entry::bytecodeIndex const):
        (JSC::JITCodeMap::Entry::codeLocation):
        (JSC::JITCodeMap::append):
        (JSC::JITCodeMap::finish):
        (JSC::JITCodeMap::find const):
        (JSC::JITCodeMap::operator bool const):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):

2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Remove CompareSlowPathGenerator
        https://bugs.webkit.org/show_bug.cgi?id=184492

        Reviewed by Mark Lam.

        Now CompareSlowPathGenerator is just calling a specified function.
        This can be altered with slowPathCall. This patch removes CompareSlowPathGenerator.

        We also remove some of unnecessary USE(JSVALUE32_64) / USE(JSVALUE64) ifdefs by
        introducing a new constructor for GPRTemporary.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * dfg/DFGCompareSlowPathGenerator.h: Removed.
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::GPRTemporary::GPRTemporary):
        (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
        (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
        (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):
        (JSC::DFG::SpeculativeJIT::compileIsObject):
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::GPRTemporary::GPRTemporary):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):

2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, build fix for 32bit
        https://bugs.webkit.org/show_bug.cgi?id=184236

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetDirectPname):

2018-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Remove duplicate 32bit code more
        https://bugs.webkit.org/show_bug.cgi?id=184236

        Reviewed by Mark Lam.

        Remove duplicate 32bit code more aggressively part 2.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * dfg/DFGCompareSlowPathGenerator.h: Added.
        (JSC::DFG::CompareSlowPathGenerator::CompareSlowPathGenerator):
        Drop boxing part. Use unblessedBooleanResult in DFGSpeculativeJIT side instead.

        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance):
        (JSC::DFG::SpeculativeJIT::compileLoadVarargs):
        (JSC::DFG::SpeculativeJIT::compileIsObject):
        (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty):
        (JSC::DFG::SpeculativeJIT::compilePutByIdFlush):
        (JSC::DFG::SpeculativeJIT::compilePutById):
        (JSC::DFG::SpeculativeJIT::compilePutByIdDirect):
        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize):
        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
        (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
        (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
        (JSC::DFG::SpeculativeJIT::compileGetDirectPname):
        (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare): Deleted.
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::selectScratchGPR): Deleted.
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal): Deleted.
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
        (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted.
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch): Deleted.
        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator): Deleted.
        (): Deleted.
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare): Deleted.
        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted.
        (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted.
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted.
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
        operationHasIndexedPropertyByInt starts returning unblessed boolean with size_t.

        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::loadValue):
        (JSC::AssemblyHelpers::selectScratchGPR):
        (JSC::AssemblyHelpers::constructRegisterSet):
        * jit/RegisterSet.h:
        (JSC::RegisterSet::setAny):
        Clean up selectScratchGPR code to pass JSValueRegs.

2018-04-10  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Add support for BigInt in SpeculatedType
        https://bugs.webkit.org/show_bug.cgi?id=182470

        Reviewed by Saam Barati.

        This patch introduces the SpecBigInt type to DFG to enable BigInt
        speculation into DFG and FTL.

        With SpecBigInt introduction, we can then specialize "===" operations
        to BigInts. As we are doing for some cells, we first check if operands
        are pointing to the same JSCell, and if it is false, we
        fallback to "operationCompareStrictEqCell". The idea in further
        patches is to implement BigInt equality check directly in
        assembly.

        We are also adding support for BigInt constant folding into
        TypeOf operation.

        * bytecode/SpeculatedType.cpp:
        (JSC::dumpSpeculation):
        (JSC::speculationFromClassInfo):
        (JSC::speculationFromStructure):
        (JSC::speculationFromJSType):
        (JSC::speculationFromString):
        * bytecode/SpeculatedType.h:
        (JSC::isBigIntSpeculation):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGAbstractValue.cpp:
        (JSC::DFG::AbstractValue::set):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::fixupToThis):
        (JSC::DFG::FixupPhase::observeUseKindOnNode):
        * dfg/DFGInferredTypeCheck.cpp:
        (JSC::DFG::insertInferredTypeCheck):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::shouldSpeculateBigInt):
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::SafeToExecuteEdge::operator()):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStrictEq):
        (JSC::DFG::SpeculativeJIT::speculateBigInt):
        (JSC::DFG::SpeculativeJIT::speculate):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileBigIntEquality):
        * dfg/DFGUseKind.cpp:
        (WTF::printInternal):
        * dfg/DFGUseKind.h:
        (JSC::DFG::typeFilterFor):
        (JSC::DFG::isCell):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
        (JSC::FTL::DFG::LowerDFGToB3::speculate):
        (JSC::FTL::DFG::LowerDFGToB3::isNotBigInt):
        (JSC::FTL::DFG::LowerDFGToB3::speculateBigInt):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfNotType):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfBigInt):
        (JSC::AssemblyHelpers::branchIfNotBigInt):
        * runtime/InferredType.cpp:
        (JSC::InferredType::Descriptor::forValue):
        (JSC::InferredType::Descriptor::putByIdFlags const):
        (JSC::InferredType::Descriptor::merge):
        (WTF::printInternal):
        * runtime/InferredType.h:
        * runtime/JSBigInt.h:

2018-04-10  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, fix cloop build.

        * dfg/DFGAbstractInterpreterClobberState.cpp:

2018-04-10  Mark Lam  <mark.lam@apple.com>

        Make the ASSERT in MarkedSpace::sizeClassToIndex() a RELEASE_ASSERT.
        https://bugs.webkit.org/show_bug.cgi?id=184464
        <rdar://problem/39323947>

        Reviewed by Saam Barati.

        * heap/MarkedSpace.h:
        (JSC::MarkedSpace::sizeClassToIndex):

2018-04-09  Filip Pizlo  <fpizlo@apple.com>

        DFG AI and clobberize should agree with each other
        https://bugs.webkit.org/show_bug.cgi?id=184440

        Reviewed by Saam Barati.
        
        One way to fix bugs involving underapproximation in AI or clobberize is to assert that they
        agree with each other. That's what this patch does: it adds an assertion that AI's structure
        state tracking must be equivalent to JSCell_structureID being clobbered.
        
        One subtlety is that AI sometimes folds away structure clobbering using information that
        clobberize doesn't have. So, we track this wuth special kinds of AI states (FoldedClobber and
        ObservedTransitions).
        
        This fixes a bunch of cases of AI missing clobberStructures/clobberWorld and one case of
        clobberize missing a write(Heap).
        
        This also makes some cases more precise in order to appease the assertion. Making things more
        precise might make things faster, but I didn't measure it because that wasn't the goal.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * dfg/DFGAbstractInterpreter.h:
        * dfg/DFGAbstractInterpreterClobberState.cpp: Added.
        (WTF::printInternal):
        * dfg/DFGAbstractInterpreterClobberState.h: Added.
        (JSC::DFG::mergeClobberStates):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberWorld):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::didFoldClobberStructures):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): Deleted.
        * dfg/DFGAtTailAbstractState.h:
        (JSC::DFG::AtTailAbstractState::setClobberState):
        (JSC::DFG::AtTailAbstractState::mergeClobberState):
        (JSC::DFG::AtTailAbstractState::setDidClobber): Deleted.
        * dfg/DFGCFAPhase.cpp:
        (JSC::DFG::CFAPhase::performBlockCFA):
        * dfg/DFGClobberSet.cpp:
        (JSC::DFG::writeSet):
        * dfg/DFGClobberSet.h:
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGInPlaceAbstractState.h:
        (JSC::DFG::InPlaceAbstractState::clobberState const):
        (JSC::DFG::InPlaceAbstractState::didClobberOrFolded const):
        (JSC::DFG::InPlaceAbstractState::didClobber const):
        (JSC::DFG::InPlaceAbstractState::setClobberState):
        (JSC::DFG::InPlaceAbstractState::mergeClobberState):
        (JSC::DFG::InPlaceAbstractState::setDidClobber): Deleted.

2018-04-10  Filip Pizlo  <fpizlo@apple.com>

        ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
        https://bugs.webkit.org/show_bug.cgi?id=184460
        <rdar://problem/37610966>

        Reviewed by Mark Lam.

        * bytecode/ExecutableToCodeBlockEdge.cpp:
        (JSC::ExecutableToCodeBlockEdge::visitChildren):

2018-04-10  Filip Pizlo  <fpizlo@apple.com>

        REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
        https://bugs.webkit.org/show_bug.cgi?id=184455

        Reviewed by Michael Saboff.
        
        LICM is sort of an assertion that AI is as precise as clobberize about effects. If clobberize
        says that something is not effectful, then LICM will try to hoist it. But LICM's AI hack
        (AtTailAbstractState) cannot handle hoisting of things that have effects. So, if AI thinks that
        the thing being hoisted does have effects, then we get a crash.
        
        In r227341, we incorrectly told AI that CompareEq(Untyped:, _) is effectful. In fact, only
        ComapreEq(Untyped:, Untyped:) is effectful, and clobberize knew this already. As a result, LICM
        would blow up if we hoisted CompareEq(Untyped:, Other:), which clobberize knew wasn't
        effectful.
        
        Instead of fixing this by making AI precise, in r227742 we made matters worse by then breaking
        clobberize to also think that CompareEq(Untyped:, _) is effectful.
        
        This fixes the whole situation by teaching both clobberize and AI that the only effectful form
        of CompareEq is ComapreEq(Untyped:, Untyped:).

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):

2018-04-09  Filip Pizlo  <fpizlo@apple.com>

        Executing known edge types may reveal a contradiction causing us to emit an exit at a node that is not allowed to exit
        https://bugs.webkit.org/show_bug.cgi?id=184372

        Reviewed by Saam Barati.
        
        We do a pretty good job of not emitting checks for KnownBlah edges, since those mean that we
        have already proved, using techniques that are more precise than AI, that the edge has type
        Blah. Unfortunately, we do not handle this case gracefully when AI state becomes bottom,
        because we have a bad habit of treating terminate/terminateSpeculativeExecution as something
        other than a check - so we think we can call those just because we should have already
        bailed. It's better to think of them as the result of folding a check. Therefore, we should
        only do it if there had been a check to begin with.

        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
        (JSC::FTL::DFG::LowerDFGToB3::lowInt52):
        (JSC::FTL::DFG::LowerDFGToB3::lowCell):
        (JSC::FTL::DFG::LowerDFGToB3::lowBoolean):
        (JSC::FTL::DFG::LowerDFGToB3::lowDouble):
        (JSC::FTL::DFG::LowerDFGToB3::speculate):
        (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
        (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Introduce @putByIdDirectPrivate
        https://bugs.webkit.org/show_bug.cgi?id=184400

        Reviewed by Saam Barati.

        This patch adds @putByIdDirectPrivate() to use it for builtin JS.
        @getByIdDirectPrivate and @putByIdDirectPrivate are pair of intrinsics
        accessing to ECMAScript internal fields.

        This change removes accidental [[Put]] operation to an object whose [[Prototype]]
        has internal fields (not direct properties). By using @getByIdDirectPrivate() and
        @putByIdDirectPrivate(), we strongly keep the semantics of the ECMAScript internal
        fields that accessing to the internal fields does not traverse prototype chains.

        * builtins/ArrayIteratorPrototype.js:
        (globalPrivate.arrayIteratorValueNext):
        (globalPrivate.arrayIteratorKeyNext):
        (globalPrivate.arrayIteratorKeyValueNext):
        * builtins/ArrayPrototype.js:
        (globalPrivate.createArrayIterator):
        * builtins/AsyncFromSyncIteratorPrototype.js:
        (globalPrivate.AsyncFromSyncIteratorConstructor):
        * builtins/AsyncFunctionPrototype.js:
        (globalPrivate.asyncFunctionResume):
        * builtins/AsyncGeneratorPrototype.js:
        (globalPrivate.asyncGeneratorQueueEnqueue):
        (globalPrivate.asyncGeneratorQueueDequeue):
        (asyncGeneratorYieldAwaited):
        (globalPrivate.asyncGeneratorYield):
        (globalPrivate.doAsyncGeneratorBodyCall):
        (globalPrivate.asyncGeneratorResumeNext):
        * builtins/GeneratorPrototype.js:
        (globalPrivate.generatorResume):
        * builtins/MapIteratorPrototype.js:
        (globalPrivate.mapIteratorNext):
        * builtins/MapPrototype.js:
        (globalPrivate.createMapIterator):
        * builtins/ModuleLoaderPrototype.js:
        (forceFulfillPromise):
        * builtins/PromiseOperations.js:
        (globalPrivate.newHandledRejectedPromise):
        (globalPrivate.rejectPromise):
        (globalPrivate.fulfillPromise):
        (globalPrivate.initializePromise):
        * builtins/PromisePrototype.js:
        (then):
        * builtins/SetIteratorPrototype.js:
        (globalPrivate.setIteratorNext):
        * builtins/SetPrototype.js:
        (globalPrivate.createSetIterator):
        * builtins/StringIteratorPrototype.js:
        (next):
        * bytecode/BytecodeIntrinsicRegistry.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirect):
        (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByIdDirectPrivate):

2018-04-09  Mark Lam  <mark.lam@apple.com>

        Decorate method table entries to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=184430
        <rdar://problem/39296190>

        Reviewed by Saam Barati.

        * runtime/ClassInfo.h:

2018-04-09  Michael Catanzaro  <mcatanzaro@igalia.com>

        [WPE] Don't install JSC C API headers
        https://bugs.webkit.org/show_bug.cgi?id=184375

        Reviewed by Žan Doberšek.

        None of the functions declared in these headers are exported in WPE. Use the new jsc API
        instead.

        * PlatformWPE.cmake:

2018-04-08  Mark Lam  <mark.lam@apple.com>

        Add pointer profiling to the FTL and supporting code.
        https://bugs.webkit.org/show_bug.cgi?id=184395
        <rdar://problem/39264019>

        Reviewed by Michael Saboff and Filip Pizlo.

        * assembler/CodeLocation.h:
        (JSC::CodeLocationLabel::retagged):
        (JSC::CodeLocationJump::retagged):
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::locationOf):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::linkOSRExits):
        (JSC::DFG::JITCompiler::link):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLExceptionTarget.cpp:
        (JSC::FTL::ExceptionTarget::label):
        (JSC::FTL::ExceptionTarget::jumps):
        * ftl/FTLExceptionTarget.h:
        * ftl/FTLJITCode.cpp:
        (JSC::FTL::JITCode::executableAddressAtOffset):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::~LazySlowPath):
        (JSC::FTL::LazySlowPath::initialize):
        (JSC::FTL::LazySlowPath::generate):
        (JSC::FTL::LazySlowPath::LazySlowPath): Deleted.
        * ftl/FTLLazySlowPath.h:
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        (JSC::FTL::compileFTLOSRExit):
        * ftl/FTLOSRExitHandle.cpp:
        (JSC::FTL::OSRExitHandle::emitExitThunk):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::compileFTLLazySlowPath):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::callWithoutSideEffects):
        (JSC::FTL::Output::operation):
        * ftl/FTLPatchpointExceptionHandle.cpp:
        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
        * ftl/FTLSlowPathCall.cpp:
        (JSC::FTL::SlowPathCallContext::makeCall):
        * ftl/FTLSlowPathCallKey.h:
        (JSC::FTL::SlowPathCallKey::withCallTarget):
        (JSC::FTL::SlowPathCallKey::callPtrTag const):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::osrExitGenerationThunkGenerator):
        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/Repatch.cpp:
        (JSC::readPutICCallTarget):
        (JSC::ftlThunkAwareRepatchCall):
        (JSC::tryCacheGetByID):
        (JSC::repatchGetByID):
        (JSC::tryCachePutByID):
        (JSC::repatchPutByID):
        (JSC::repatchIn):
        (JSC::resetGetByID):
        (JSC::resetPutByID):
        (JSC::readCallTarget): Deleted.
        * jit/Repatch.h:
        * runtime/PtrTag.h:

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, attempt to fix Windows build
        https://bugs.webkit.org/show_bug.cgi?id=183508

        * jit/JIT.h:

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, build fix for Windows by suppressing padding warning for JIT
        https://bugs.webkit.org/show_bug.cgi?id=183508

        * jit/JIT.h:

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        Use alignas instead of compiler-specific attributes
        https://bugs.webkit.org/show_bug.cgi?id=183508

        Reviewed by Mark Lam.

        Use C++11 alignas specifier. It is portable compared to compiler-specific aligned attributes.

        * heap/RegisterState.h:
        * jit/JIT.h:
        (JSC::JIT::compile): Deleted.
        (JSC::JIT::compileGetByVal): Deleted.
        (JSC::JIT::compileGetByValWithCachedId): Deleted.
        (JSC::JIT::compilePutByVal): Deleted.
        (JSC::JIT::compileDirectPutByVal): Deleted.
        (JSC::JIT::compilePutByValWithCachedId): Deleted.
        (JSC::JIT::compileHasIndexedProperty): Deleted.
        (JSC::JIT::appendCall): Deleted.
        (JSC::JIT::appendCallWithSlowPathReturnType): Deleted.
        (JSC::JIT::exceptionCheck): Deleted.
        (JSC::JIT::exceptionCheckWithCallFrameRollback): Deleted.
        (JSC::JIT::emitInt32Load): Deleted.
        (JSC::JIT::emitInt32GetByVal): Deleted.
        (JSC::JIT::emitInt32PutByVal): Deleted.
        (JSC::JIT::emitDoublePutByVal): Deleted.
        (JSC::JIT::emitContiguousPutByVal): Deleted.
        (JSC::JIT::emitStoreCell): Deleted.
        (JSC::JIT::getSlowCase): Deleted.
        (JSC::JIT::linkSlowCase): Deleted.
        (JSC::JIT::linkDummySlowCase): Deleted.
        (JSC::JIT::linkAllSlowCases): Deleted.
        (JSC::JIT::callOperation): Deleted.
        (JSC::JIT::callOperationWithProfile): Deleted.
        (JSC::JIT::callOperationWithResult): Deleted.
        (JSC::JIT::callOperationNoExceptionCheck): Deleted.
        (JSC::JIT::callOperationWithCallFrameRollbackOnException): Deleted.
        (JSC::JIT::emitEnterOptimizationCheck): Deleted.
        (JSC::JIT::sampleCodeBlock): Deleted.
        (JSC::JIT::canBeOptimized): Deleted.
        (JSC::JIT::canBeOptimizedOrInlined): Deleted.
        (JSC::JIT::shouldEmitProfiling): Deleted.
        * runtime/VM.h:

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, follow-up patch for DFG 32bit
        https://bugs.webkit.org/show_bug.cgi?id=183970

        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Fix incorrect assertion for VM's regexp buffer lock
        https://bugs.webkit.org/show_bug.cgi?id=184398

        Reviewed by Mark Lam.

        isLocked check before taking a lock is incorrect.

        * runtime/VM.cpp:
        (JSC::VM::acquireRegExpPatternContexBuffer):

2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Introduce op_get_by_id_direct
        https://bugs.webkit.org/show_bug.cgi?id=183970

        Reviewed by Filip Pizlo.

        This patch introduces op_get_by_id_direct bytecode. This is super similar to op_get_by_id.
        But it just performs [[GetOwnProperty]] operation instead of [[Get]]. We support this
        in all the tiers, so using this opcode does not lead to inefficiency.

        Main purpose of this op_get_by_id_direct is using it for private properties. We are using
        properties indexed with private symbols to implement ECMAScript internal fields. Before this
        patch, we just use get and put operations. However, it is not the correct semantics: accessing
        to the internal fields should not traverse prototype chain, which is specified in the spec.
        We use op_get_by_id_direct to access to properties which are used internal fields, so that
        prototype chains are not traversed.

        To emit op_get_by_id_direct, we introduce a new bytecode intrinsic @getByIdDirectPrivate().
        When you write `@getByIdDirectPrivate(object, "name")`, the bytecode generator emits the
        bytecode `op_get_by_id_direct, object, @name`.

        * builtins/ArrayIteratorPrototype.js:
        (next):
        (globalPrivate.arrayIteratorValueNext):
        (globalPrivate.arrayIteratorKeyNext):
        (globalPrivate.arrayIteratorKeyValueNext):
        * builtins/AsyncFromSyncIteratorPrototype.js:
        * builtins/AsyncFunctionPrototype.js:
        (globalPrivate.asyncFunctionResume):
        * builtins/AsyncGeneratorPrototype.js:
        (globalPrivate.asyncGeneratorQueueIsEmpty):
        (globalPrivate.asyncGeneratorQueueEnqueue):
        (globalPrivate.asyncGeneratorQueueDequeue):
        (globalPrivate.asyncGeneratorDequeue):
        (globalPrivate.isExecutionState):
        (globalPrivate.isSuspendYieldState):
        (globalPrivate.asyncGeneratorReject):
        (globalPrivate.asyncGeneratorResolve):
        (globalPrivate.doAsyncGeneratorBodyCall):
        (globalPrivate.asyncGeneratorEnqueue):
        * builtins/GeneratorPrototype.js:
        (globalPrivate.generatorResume):
        (next):
        (return):
        (throw):
        * builtins/MapIteratorPrototype.js:
        (next):
        * builtins/PromiseOperations.js:
        (globalPrivate.isPromise):
        (globalPrivate.rejectPromise):
        (globalPrivate.fulfillPromise):
        * builtins/PromisePrototype.js:
        (then):
        * builtins/SetIteratorPrototype.js:
        (next):
        * builtins/StringIteratorPrototype.js:
        (next):
        * builtins/TypedArrayConstructor.js:
        (of):
        (from):
        * bytecode/BytecodeDumper.cpp:
        (JSC::BytecodeDumper<Block>::dumpBytecode):
        * bytecode/BytecodeIntrinsicRegistry.h:
        * bytecode/BytecodeList.json:
        * bytecode/BytecodeUseDef.h:
        (JSC::computeUsesForBytecodeOffset):
        (JSC::computeDefsForBytecodeOffset):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::computeFromLLInt):
        (JSC::GetByIdStatus::computeFor):
        * bytecode/StructureStubInfo.cpp:
        (JSC::StructureStubInfo::reset):
        * bytecode/StructureStubInfo.h:
        (JSC::appropriateOptimizingGetByIdFunction):
        (JSC::appropriateGenericGetByIdFunction):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitDirectGetById):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::BytecodeIntrinsicNode::emit_intrinsic_getByIdDirect):
        (JSC::BytecodeIntrinsicNode::emit_intrinsic_getByIdDirectPrivate):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleGetById):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToGetByOffset):
        (JSC::DFG::Node::convertToMultiGetByOffset):
        (JSC::DFG::Node::hasIdentifier):
        (JSC::DFG::Node::hasHeapPrediction):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetById):
        (JSC::DFG::SpeculativeJIT::compileGetByIdFlush):
        (JSC::DFG::SpeculativeJIT::compileTryGetById): Deleted.
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByIdWithThis):
        (JSC::FTL::DFG::LowerDFGToB3::getById):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITOperations.cpp:
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_by_id_direct):
        (JSC::JIT::emitSlow_op_get_by_id_direct):
        * jit/Repatch.cpp:
        (JSC::appropriateOptimizingGetByIdFunction):
        (JSC::appropriateGetByIdFunction):
        (JSC::tryCacheGetByID):
        (JSC::repatchGetByID):
        (JSC::appropriateGenericGetByIdFunction): Deleted.
        * jit/Repatch.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::getOwnPropertySlot const):
        * runtime/JSObject.h:
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getOwnPropertySlotInline):

2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Remove several asXXX functions
        https://bugs.webkit.org/show_bug.cgi?id=184355

        Reviewed by JF Bastien.

        Remove asActivation, asInternalFunction, and asGetterSetter.
        Use jsCast<> / jsDynamicCast<> consistently.

        * runtime/ArrayConstructor.cpp:
        (JSC::constructArrayWithSizeQuirk):
        * runtime/AsyncFunctionConstructor.cpp:
        (JSC::callAsyncFunctionConstructor):
        (JSC::constructAsyncFunctionConstructor):
        * runtime/AsyncGeneratorFunctionConstructor.cpp:
        (JSC::callAsyncGeneratorFunctionConstructor):
        (JSC::constructAsyncGeneratorFunctionConstructor):
        * runtime/BooleanConstructor.cpp:
        (JSC::constructWithBooleanConstructor):
        * runtime/DateConstructor.cpp:
        (JSC::constructWithDateConstructor):
        * runtime/ErrorConstructor.cpp:
        (JSC::Interpreter::constructWithErrorConstructor):
        (JSC::Interpreter::callErrorConstructor):
        * runtime/FunctionConstructor.cpp:
        (JSC::constructWithFunctionConstructor):
        (JSC::callFunctionConstructor):
        * runtime/FunctionPrototype.cpp:
        (JSC::functionProtoFuncToString):
        * runtime/GeneratorFunctionConstructor.cpp:
        (JSC::callGeneratorFunctionConstructor):
        (JSC::constructGeneratorFunctionConstructor):
        * runtime/GetterSetter.h:
        (JSC::asGetterSetter): Deleted.
        * runtime/InternalFunction.h:
        (JSC::asInternalFunction): Deleted.
        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
        (JSC::constructGenericTypedArrayView):
        * runtime/JSLexicalEnvironment.h:
        (JSC::asActivation): Deleted.
        * runtime/JSObject.cpp:
        (JSC::validateAndApplyPropertyDescriptor):
        * runtime/MapConstructor.cpp:
        (JSC::constructMap):
        * runtime/PropertyDescriptor.cpp:
        (JSC::PropertyDescriptor::setDescriptor):
        * runtime/RegExpConstructor.cpp:
        (JSC::constructWithRegExpConstructor):
        (JSC::callRegExpConstructor):
        * runtime/SetConstructor.cpp:
        (JSC::constructSet):
        * runtime/StringConstructor.cpp:
        (JSC::constructWithStringConstructor):
        * runtime/WeakMapConstructor.cpp:
        (JSC::constructWeakMap):
        * runtime/WeakSetConstructor.cpp:
        (JSC::constructWeakSet):
        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
        (JSC::constructJSWebAssemblyCompileError):
        (JSC::callJSWebAssemblyCompileError):
        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
        (JSC::constructJSWebAssemblyLinkError):
        (JSC::callJSWebAssemblyLinkError):
        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
        (JSC::constructJSWebAssemblyRuntimeError):
        (JSC::callJSWebAssemblyRuntimeError):

2018-04-05  Mark Lam  <mark.lam@apple.com>

        MacroAssemblerCodePtr::retagged() should not re-decorate the pointer on ARMv7.
        https://bugs.webkit.org/show_bug.cgi?id=184347
        <rdar://problem/39183165>

        Reviewed by Michael Saboff.

        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
        (JSC::MacroAssemblerCodePtr::retagged const):

2018-04-05  Stanislav Ocovaj  <stanislav.ocovaj@rt-rk.com>

        [MIPS] Optimize generated JIT code for branches
        https://bugs.webkit.org/show_bug.cgi?id=183130

        Reviewed by Yusuke Suzuki.

        The patch https://bugs.webkit.org/show_bug.cgi?id=101328 added two nop instructions to
        branchEqual() and branchNotEqual() in order to allow the code generated by branchPtrWithPatch()
        to be reverted back to branchPtrWithPatch after replacing it with a 4-instruction jump.
        However, this adds a significant overhead for all other types of branches. Since these nop's
        protect the code that is generated by branchPtrWithPatch, this function seems like a better
        place to add them.

        * assembler/MIPSAssembler.h:
        (JSC::MIPSAssembler::repatchInt32):
        (JSC::MIPSAssembler::revertJumpToMove):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchAdd32):
        (JSC::MacroAssemblerMIPS::branchMul32):
        (JSC::MacroAssemblerMIPS::branchSub32):
        (JSC::MacroAssemblerMIPS::branchNeg32):
        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
        (JSC::MacroAssemblerMIPS::branchEqual):
        (JSC::MacroAssemblerMIPS::branchNotEqual):

2018-04-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WTF] Remove StaticLock
        https://bugs.webkit.org/show_bug.cgi?id=184332

        Reviewed by Mark Lam.

        * API/JSValue.mm:
        (handerForStructTag):
        * API/JSVirtualMachine.mm:
        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
        * API/glib/JSCVirtualMachine.cpp:
        (addWrapper):
        (removeWrapper):
        * assembler/testmasm.cpp:
        * b3/air/testair.cpp:
        * b3/testb3.cpp:
        * bytecode/SuperSampler.cpp:
        * dfg/DFGCommon.cpp:
        * dfg/DFGCommonData.cpp:
        * dynbench.cpp:
        * heap/MachineStackMarker.cpp:
        (JSC::MachineThreads::tryCopyOtherThreadStacks):
        * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
        (Inspector::RemoteTargetHandleRunSourceGlobal):
        (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
        * interpreter/CLoopStack.cpp:
        * parser/SourceProvider.cpp:
        * profiler/ProfilerDatabase.cpp:
        * profiler/ProfilerUID.cpp:
        (JSC::Profiler::UID::create):
        * runtime/IntlObject.cpp:
        (JSC::numberingSystemsForLocale):
        * runtime/JSLock.cpp:
        * runtime/JSLock.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::registerForReportAtExit):
        * runtime/VM.cpp:
        * wasm/WasmFaultSignalHandler.cpp:

2018-04-04  Mark Lam  <mark.lam@apple.com>

        Add pointer profiling support to the DFG and supporting files.
        https://bugs.webkit.org/show_bug.cgi?id=184316
        <rdar://problem/39188524>

        Reviewed by Filip Pizlo.

        1. Profile lots of pointers with PtrTags.

        2. Remove PtrTag.cpp and make ptrTagName() into an inline function.  It's only
           used for debugging anyway, and not normally called in the code.  Making it
           an inline function prevents it from taking up code space in builds when not in
           use.

        3. Change the call to the the arityFixupThunk in DFG code to be a near call.
           It doesn't need to be a far call.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * assembler/testmasm.cpp:
        (JSC::testProbeModifiesProgramCounter):
        * b3/B3LowerMacros.cpp:
        * b3/air/AirCCallSpecial.cpp:
        (JSC::B3::Air::CCallSpecial::generate):
        * b3/air/AirCCallSpecial.h:
        * b3/testb3.cpp:
        (JSC::B3::testInterpreter):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/HandlerInfo.h:
        (JSC::HandlerInfo::initialize):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compileExceptionHandlers):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::compileFunction):
        (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::appendCall):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::adjustAndJumpToTarget):
        (JSC::DFG::OSRExit::emitRestoreArguments):
        (JSC::DFG::OSRExit::compileOSRExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::reifyInlinedCallFrames):
        (JSC::DFG::osrWriteBarrier):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGOperations.cpp:
        * dfg/DFGSlowPathGenerator.h:
        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
        (JSC::DFG::slowPathCall):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileMathIC):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        (JSC::DFG::SpeculativeJIT::appendCall):
        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitThunkGenerator):
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitDumbVirtualCall):
        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::compileWithoutLinking):
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCallSlowCase):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emitSlow_op_loop_hint):
        * jit/JITOperations.cpp:
        * jit/Repatch.cpp:
        (JSC::linkSlowFor):
        (JSC::linkFor):
        (JSC::revertCall):
        (JSC::unlinkFor):
        (JSC::linkVirtualFor):
        (JSC::linkPolymorphicCall):
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::linkCallThunkGenerator):
        (JSC::linkPolymorphicCallThunkGenerator):
        (JSC::virtualThunkFor):
        (JSC::arityFixupGenerator):
        (JSC::unreachableGenerator):
        * runtime/PtrTag.cpp: Removed.
        * runtime/PtrTag.h:
        (JSC::ptrTagName):
        * runtime/VMEntryScope.cpp:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):

2018-04-04  Filip Pizlo  <fpizlo@apple.com>

        REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
        https://bugs.webkit.org/show_bug.cgi?id=184319

        Reviewed by Saam Barati.

        In r222581, we replaced type checks about DoubleReal in ArrayPush in the DFG/FTL backends with
        assertions. That's correct because FixupPhase was emitting those checks as Check(DoubleRealRep:) before
        the ArrayPush.

        But this revealed a longstanding CSE bug: CSE will happily match a SaneChain GetByVal with a InBounds
        GetByVal. SaneChain can return NaN while InBounds cannot. This means that if we first use AI to
        eliminate the Check(DoubleRealRep:) based on the input being a GetByVal(InBounds) but then replace that
        with a GetByVal(SaneChain), then we will hit the assertion.

        This teaches CSE to not replace GetByVal(InBounds) with GetByVal(SaneChain) and vice versa. That gets
        tricky because PutByVal can match either. So, we use the fact that it's legal for a store to def() more
        than once: PutByVal now defs() a HeapLocation for InBounds and a HeapLocation for SaneChain.

        * dfg/DFGCSEPhase.cpp:
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileArrayPush):

2018-04-04  Filip Pizlo  <fpizlo@apple.com>

        Remove poisoning of typed array vector
        https://bugs.webkit.org/show_bug.cgi?id=184313

        Reviewed by Saam Barati.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::checkArray):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitIntTypedArrayGetByVal):
        (JSC::JIT::emitFloatTypedArrayGetByVal):
        (JSC::JIT::emitIntTypedArrayPutByVal):
        (JSC::JIT::emitFloatTypedArrayPutByVal):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/arm64.rb:
        * offlineasm/x86.rb:
        * runtime/CagedBarrierPtr.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::JSArrayBufferView):
        (JSC::JSArrayBufferView::finalize):
        (JSC::JSArrayBufferView::neuter):
        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::vector const):
        (JSC::JSArrayBufferView::offsetOfVector):
        (JSC::JSArrayBufferView::offsetOfPoisonedVector): Deleted.
        (JSC::JSArrayBufferView::poisonFor): Deleted.
        (JSC::JSArrayBufferView::Poison::key): Deleted.
        * runtime/JSCPoison.cpp:
        (JSC::initializePoison):
        * runtime/JSCPoison.h:
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
        * runtime/JSObject.h:

2018-04-03  Filip Pizlo  <fpizlo@apple.com>

        Don't do index masking or poisoning for DirectArguments
        https://bugs.webkit.org/show_bug.cgi?id=184280

        Reviewed by Saam Barati.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):
        * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
        (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
        * dfg/DFGCallCreateDirectArgumentsWithKnownLengthSlowPathGenerator.h: Removed.
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetFromArguments):
        (JSC::DFG::SpeculativeJIT::compilePutToArguments):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetFromArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutToArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoison):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnLoadedType):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnType):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedHeapCell): Deleted.
        * heap/SecurityKind.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_put_to_arguments):
        (JSC::JIT::emitDirectArgumentsGetByVal):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_put_to_arguments):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::DirectArguments):
        (JSC::DirectArguments::createUninitialized):
        (JSC::DirectArguments::create):
        (JSC::DirectArguments::createByCopying):
        (JSC::DirectArguments::estimatedSize):
        (JSC::DirectArguments::visitChildren):
        (JSC::DirectArguments::overrideThings):
        (JSC::DirectArguments::copyToArguments):
        (JSC::DirectArguments::mappedArgumentsSize):
        * runtime/DirectArguments.h:
        * runtime/JSCPoison.h:
        * runtime/JSLexicalEnvironment.h:
        * runtime/JSSymbolTableObject.h:

2018-04-03  Filip Pizlo  <fpizlo@apple.com>

        JSArray::appendMemcpy seems to be missing a barrier
        https://bugs.webkit.org/show_bug.cgi?id=184290

        Reviewed by Mark Lam.
        
        If you write to an array that may contain pointers and you didn't just allocate it, then you need to
        barrier right after.
        
        I don't know if this is really a bug - it's possible that all callers of appendMemcpy do things that
        obviate the need for this barrier. But these barriers are cheap, so we should do them if in doubt.

        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):

2018-04-03  Filip Pizlo  <fpizlo@apple.com>

        GC shouldn't do object distancing
        https://bugs.webkit.org/show_bug.cgi?id=184195

        Reviewed by Saam Barati.
        
        This rolls out SecurityKind/SecurityOriginToken, but keeps the TLC infrastructure. It seems
        to be a small speed-up.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::findBlockForAllocation):
        (JSC::BlockDirectory::addBlock):
        * heap/BlockDirectory.h:
        * heap/CellAttributes.cpp:
        (JSC::CellAttributes::dump const):
        * heap/CellAttributes.h:
        (JSC::CellAttributes::CellAttributes):
        * heap/LocalAllocator.cpp:
        (JSC::LocalAllocator::allocateSlowCase):
        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::didAddToDirectory):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::Handle::securityOriginToken const): Deleted.
        * heap/SecurityKind.cpp: Removed.
        * heap/SecurityKind.h: Removed.
        * heap/SecurityOriginToken.cpp: Removed.
        * heap/SecurityOriginToken.h: Removed.
        * heap/ThreadLocalCache.cpp:
        (JSC::ThreadLocalCache::create):
        (JSC::ThreadLocalCache::ThreadLocalCache):
        * heap/ThreadLocalCache.h:
        (JSC::ThreadLocalCache::securityOriginToken const): Deleted.
        * runtime/JSDestructibleObjectHeapCellType.cpp:
        (JSC::JSDestructibleObjectHeapCellType::JSDestructibleObjectHeapCellType):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::threadLocalCache const): Deleted.
        * runtime/JSSegmentedVariableObjectHeapCellType.cpp:
        (JSC::JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType):
        * runtime/JSStringHeapCellType.cpp:
        (JSC::JSStringHeapCellType::JSStringHeapCellType):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::VMEntryScope):
        * wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp:
        (JSC::JSWebAssemblyCodeBlockHeapCellType::JSWebAssemblyCodeBlockHeapCellType):

2018-04-02  Saam Barati  <sbarati@apple.com>

        bmalloc should compute its own estimate of its footprint
        https://bugs.webkit.org/show_bug.cgi?id=184121

        Reviewed by Filip Pizlo.

        * heap/IsoAlignedMemoryAllocator.cpp:
        (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
        (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
        (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):

2018-04-02  Mark Lam  <mark.lam@apple.com>

        We should not trash the stack pointer on OSR entry.
        https://bugs.webkit.org/show_bug.cgi?id=184243
        <rdar://problem/39114319>

        Reviewed by Filip Pizlo.

        In the DFG OSR entry path, we momentarily over-write the stack pointer with
        returnValueGPR2.  returnValueGPR2 contains a pointer to a side buffer we malloc'ed.
        Hence, this assignment is wrong, and it turns out to be unnecessary as well.
        The stack pointer does get corrected later in the thunk (generated by
        osrEntryThunkGenerator()) that we jump to.  This is why we don't see ill-effects
        so far.

        This bug only poses an issue if interrupts use the user stack for their stack
        frame (e.g. linux), and when we do stack alignment tests during debugging.

        The fix is simply to remove the assignment.

        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrEntryThunkGenerator):
        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):

2018-04-02  Stanislav Ocovaj  <stanislav.ocovaj@rt-rk.com>

        [MIPS] Optimize JIT code generated by methods with TrustedImm32 operand
        https://bugs.webkit.org/show_bug.cgi?id=183740

        Reviewed by Yusuke Suzuki.

        In many macro assembler methods with TrustedImm32 operand a move imm, immTemp (pseudo)instruction is
        first generated and a register operand variant of the same method is called to generate the rest
        of the code. If the immediate value can fit in 16 bits then we can skip the move instruction and
        generate more efficient code using MIPS instructions with immediate operand.

        * assembler/MIPSAssembler.h:
        (JSC::MIPSAssembler::slti):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::lshift32):
        (JSC::MacroAssemblerMIPS::xor32):
        (JSC::MacroAssemblerMIPS::branch8):
        (JSC::MacroAssemblerMIPS::compare8):
        (JSC::MacroAssemblerMIPS::branch32):
        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
        (JSC::MacroAssemblerMIPS::branchTest32):
        (JSC::MacroAssemblerMIPS::mask8OnTest):
        (JSC::MacroAssemblerMIPS::branchTest8):
        (JSC::MacroAssemblerMIPS::branchAdd32):
        (JSC::MacroAssemblerMIPS::branchNeg32):
        (JSC::MacroAssemblerMIPS::compare32):
        (JSC::MacroAssemblerMIPS::test8):

2018-04-02  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] More aggressive removal of duplicate 32bit DFG code
        https://bugs.webkit.org/show_bug.cgi?id=184089

        Reviewed by Saam Barati.

        This patch more aggressively removes duplicate 32bit DFG code
        by leveraging JSValueRegs and meta-programmed callOperation.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValWithThis):
        (JSC::DFG::SpeculativeJIT::compileArithMinMax):
        (JSC::DFG::SpeculativeJIT::compileNewArray):
        (JSC::DFG::SpeculativeJIT::compileCheckCell):
        (JSC::DFG::SpeculativeJIT::compileGetGlobalVariable):
        (JSC::DFG::SpeculativeJIT::compilePutGlobalVariable):
        (JSC::DFG::SpeculativeJIT::compileGetClosureVar):
        (JSC::DFG::SpeculativeJIT::compilePutClosureVar):
        (JSC::DFG::SpeculativeJIT::compileGetByOffset):
        (JSC::DFG::SpeculativeJIT::compilePutByOffset):
        (JSC::DFG::SpeculativeJIT::compileGetExecutable):
        (JSC::DFG::SpeculativeJIT::compileNewArrayBuffer):
        (JSC::DFG::SpeculativeJIT::compileToThis):
        (JSC::DFG::SpeculativeJIT::compileIdentity):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):

2018-04-01  Filip Pizlo  <fpizlo@apple.com>

        Raise the for-call inlining threshold to 190 to fix JetStream/richards regression
        https://bugs.webkit.org/show_bug.cgi?id=184228

        Reviewed by Yusuke Suzuki.

        * runtime/Options.h:

2018-03-31  Filip Pizlo  <fpizlo@apple.com>

        JSObject shouldn't do index masking
        https://bugs.webkit.org/show_bug.cgi?id=184194

        Reviewed by Yusuke Suzuki.
        
        Remove index masking, because it's not the way we'll mitigate Spectre.

        * API/tests/JSObjectGetProxyTargetTest.cpp:
        (testJSObjectGetProxyTarget):
        * b3/B3LowerToAir.cpp:
        * b3/B3Validate.cpp:
        * b3/B3WasmBoundsCheckValue.cpp:
        (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue):
        (JSC::B3::WasmBoundsCheckValue::dumpMeta const):
        * b3/B3WasmBoundsCheckValue.h:
        (JSC::B3::WasmBoundsCheckValue::bounds const):
        (JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const): Deleted.
        * b3/testb3.cpp:
        (JSC::B3::testWasmBoundsCheck):
        (JSC::B3::run):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileArraySlice):
        (JSC::DFG::SpeculativeJIT::compileNewStringObject):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        (JSC::DFG::SpeculativeJIT::compileNewRegexp):
        (JSC::DFG::SpeculativeJIT::compileCreateThis):
        (JSC::DFG::SpeculativeJIT::compileNewObject):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
        (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayMask): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::maskedIndex): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::computeButterflyIndexingMask): Deleted.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitAllocateJSObject):
        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
        (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
        (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emit_op_create_this):
        * jit/JITOperations.cpp:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitDoubleLoad):
        (JSC::JIT::emitContiguousLoad):
        (JSC::JIT::emitArrayStorageLoad):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/Butterfly.h:
        (JSC::ContiguousData::at const):
        (JSC::ContiguousData::at):
        (JSC::Butterfly::computeIndexingMask const): Deleted.
        * runtime/ButterflyInlines.h:
        (JSC::ContiguousData<T>::at const): Deleted.
        (JSC::ContiguousData<T>::at): Deleted.
        * runtime/ClonedArguments.cpp:
        (JSC::ClonedArguments::createEmpty):
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::setLength):
        (JSC::JSArray::pop):
        (JSC::JSArray::shiftCountWithAnyIndexingType):
        (JSC::JSArray::unshiftCountWithAnyIndexingType):
        (JSC::JSArray::fillArgList):
        (JSC::JSArray::copyToArguments):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::JSArrayBufferView):
        * runtime/JSArrayInlines.h:
        (JSC::JSArray::pushInline):
        * runtime/JSFixedArray.h:
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertySlotByIndex):
        (JSC::JSObject::putByIndex):
        (JSC::JSObject::createInitialUndecided):
        (JSC::JSObject::createInitialInt32):
        (JSC::JSObject::createInitialDouble):
        (JSC::JSObject::createInitialContiguous):
        (JSC::JSObject::createArrayStorage):
        (JSC::JSObject::convertUndecidedToInt32):
        (JSC::JSObject::convertUndecidedToDouble):
        (JSC::JSObject::convertUndecidedToContiguous):
        (JSC::JSObject::convertUndecidedToArrayStorage):
        (JSC::JSObject::convertInt32ToDouble):
        (JSC::JSObject::convertInt32ToArrayStorage):
        (JSC::JSObject::convertDoubleToContiguous):
        (JSC::JSObject::convertDoubleToArrayStorage):
        (JSC::JSObject::convertContiguousToArrayStorage):
        (JSC::JSObject::createInitialForValueAndSet):
        (JSC::JSObject::deletePropertyByIndex):
        (JSC::JSObject::getOwnPropertyNames):
        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
        (JSC::JSObject::countElements):
        (JSC::JSObject::increaseVectorLength):
        (JSC::JSObject::ensureLengthSlow):
        (JSC::JSObject::reallocateAndShrinkButterfly):
        (JSC::JSObject::getEnumerableLength):
        * runtime/JSObject.h:
        (JSC::JSObject::canGetIndexQuickly):
        (JSC::JSObject::getIndexQuickly):
        (JSC::JSObject::tryGetIndexQuickly const):
        (JSC::JSObject::setIndexQuickly):
        (JSC::JSObject::initializeIndex):
        (JSC::JSObject::initializeIndexWithoutBarrier):
        (JSC::JSObject::butterflyOffset):
        (JSC::JSObject::setButterfly):
        (JSC::JSObject::nukeStructureAndSetButterfly):
        (JSC::JSObject::JSObject):
        (JSC::JSObject::butterflyIndexingMaskOffset): Deleted.
        (JSC::JSObject::butterflyIndexingMask const): Deleted.
        (JSC::JSObject::setButterflyWithIndexingMask): Deleted.
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::prepareToPutDirectWithoutTransition):
        (JSC::JSObject::putDirectInternal):
        * runtime/RegExpMatchesArray.h:
        (JSC::tryCreateUninitializedRegExpMatchesArray):
        * runtime/Structure.cpp:
        (JSC::Structure::flattenDictionaryStructure):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
        (JSC::Wasm::B3IRGenerator::load):
        (JSC::Wasm::B3IRGenerator::store):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::updateCachedMemory):
        (JSC::Wasm::Instance::offsetOfCachedMemorySize):
        (JSC::Wasm::Instance::offsetOfCachedIndexingMask): Deleted.
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::Memory):
        (JSC::Wasm::Memory::grow):
        * wasm/WasmMemory.h:
        (JSC::Wasm::Memory::size const):
        (JSC::Wasm::Memory::offsetOfSize):
        (JSC::Wasm::Memory::indexingMask): Deleted.
        (JSC::Wasm::Memory::offsetOfIndexingMask): Deleted.
        * wasm/WasmMemoryInformation.cpp:
        (JSC::Wasm::PinnedRegisterInfo::get):
        (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
        * wasm/WasmMemoryInformation.h:
        (JSC::Wasm::PinnedRegisterInfo::toSave const):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):

2018-03-31  Filip Pizlo  <fpizlo@apple.com>

        JSC crash in JIT code with for-of loop and Array/Set iterators
        https://bugs.webkit.org/show_bug.cgi?id=183174

        Reviewed by Saam Barati.

        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute): Fix the bug by making GetByOffset and friends verify that they are getting the type proof they want at the desired hoisting site.

2018-03-30  Filip Pizlo  <fpizlo@apple.com>

        Strings and Vectors shouldn't do index masking
        https://bugs.webkit.org/show_bug.cgi?id=184193

        Reviewed by Mark Lam.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
        * jit/ThunkGenerators.cpp:
        (JSC::stringCharLoad):

2018-03-30  Mark Lam  <mark.lam@apple.com>

        Add pointer profiling support in baseline JIT and supporting files.
        https://bugs.webkit.org/show_bug.cgi?id=184200
        <rdar://problem/39057300>

        Reviewed by Filip Pizlo.

        1. To simplify pointer profiling support, vmEntryToJavaScript() now always enters
           the code via the arity check entry.
        2. To accommodate (1), all JITCode must now populate their arity check entry code
           pointers as well.  For native code, programs, evals, and modules that don't
           do arity check, we set the normal entry as the arity check entry (though with
           the CodeEntryWithArityCheckPtrTag profile instead).

        * assembler/AbstractMacroAssembler.h:
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::locationOfNearCall):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::readCallTarget):
        (JSC::MacroAssemblerARM64::linkCall):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/AccessCaseSnippetParams.cpp:
        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::addJITAddIC):
        (JSC::CodeBlock::addJITMulIC):
        (JSC::CodeBlock::addJITSubIC):
        (JSC::CodeBlock::addJITNegIC):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::addMathIC):
        * bytecode/InlineAccess.cpp:
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::unlink):
        (): Deleted.
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileValueAdd):
        (JSC::DFG::SpeculativeJIT::compileArithSub):
        (JSC::DFG::SpeculativeJIT::compileArithNegate):
        (JSC::DFG::SpeculativeJIT::compileArithMul):
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
        * disassembler/ARM64Disassembler.cpp:
        (JSC::tryToDisassemble):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalizeCommon):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
        * heap/JITStubRoutineSet.h:
        (JSC::JITStubRoutineSet::mark):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::callExceptionFuzz):
        (JSC::AssemblyHelpers::debugCall):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitFunctionPrologue):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::ensureShadowChickenPacket):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::prepareForTailCallSlow):
        * jit/CallFrameShuffler.cpp:
        (JSC::CallFrameShuffler::prepareForTailCall):
        * jit/ExecutableAllocator.cpp:
        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
        * jit/ExecutableAllocator.h:
        (JSC::performJITMemcpy):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        (JSC::JIT::link):
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emit_op_negate):
        (JSC::JIT::emit_op_add):
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        (JSC::JIT::emit_op_mul):
        (JSC::JIT::emit_op_sub):
        * jit/JITCode.cpp:
        (JSC::JITCode::execute):
        (JSC::JITCodeWithCodeRef::executableAddressAtOffset):
        (JSC::DirectJITCode::DirectJITCode):
        (JSC::DirectJITCode::initializeCodeRef):
        (JSC::NativeJITCode::addressForCall):
        * jit/JITExceptions.cpp:
        (JSC::genericUnwind):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        (JSC::JITBinaryMathIC::JITBinaryMathIC):
        (JSC::JITUnaryMathIC::JITUnaryMathIC):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::privateCompileHasIndexedProperty):
        (JSC::JIT::emitSlow_op_has_indexed_property):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOperations.cpp:
        (JSC::getByVal):
        (JSC::tryGetByValOptimize):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::emitGetByValWithCachedId):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emitPutByValWithCachedId):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::hostFunctionStub):
        * jit/Repatch.cpp:
        (JSC::tryCacheGetByID):
        (JSC::repatchGetByID):
        (JSC::appropriateOptimizingPutByIdFunction):
        (JSC::tryCachePutByID):
        (JSC::repatchPutByID):
        (JSC::linkFor):
        (JSC::revertCall):
        (JSC::linkPolymorphicCall):
        (JSC::resetGetByID):
        (JSC::resetPutByID):
        * jit/Repatch.h:
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        (JSC::SpecializedThunkJIT::callDoubleToDouble):
        * jit/ThunkGenerators.cpp:
        (JSC::emitPointerValidation):
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::slowPathFor):
        (JSC::linkCallThunkGenerator): Deleted.
        (JSC::linkPolymorphicCallThunkGenerator): Deleted.
        (JSC::virtualThunkFor): Deleted.
        (JSC::nativeForGenerator): Deleted.
        (JSC::nativeCallGenerator): Deleted.
        (JSC::nativeTailCallGenerator): Deleted.
        (JSC::nativeTailCallWithoutSavedTagsGenerator): Deleted.
        (JSC::nativeConstructGenerator): Deleted.
        (JSC::internalFunctionCallGenerator): Deleted.
        (JSC::internalFunctionConstructGenerator): Deleted.
        (JSC::arityFixupGenerator): Deleted.
        (JSC::unreachableGenerator): Deleted.
        (JSC::stringCharLoad): Deleted.
        (JSC::charToString): Deleted.
        (JSC::charCodeAtThunkGenerator): Deleted.
        (JSC::charAtThunkGenerator): Deleted.
        (JSC::fromCharCodeThunkGenerator): Deleted.
        (JSC::clz32ThunkGenerator): Deleted.
        (JSC::sqrtThunkGenerator): Deleted.
        (JSC::floorThunkGenerator): Deleted.
        (JSC::ceilThunkGenerator): Deleted.
        (JSC::truncThunkGenerator): Deleted.
        (JSC::roundThunkGenerator): Deleted.
        (JSC::expThunkGenerator): Deleted.
        (JSC::logThunkGenerator): Deleted.
        (JSC::absThunkGenerator): Deleted.
        (JSC::imulThunkGenerator): Deleted.
        (JSC::randomThunkGenerator): Deleted.
        (JSC::boundThisNoArgsFunctionCallGenerator): Deleted.
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        (JSC::LLInt::getCodePtr):
        * llint/LLIntEntrypoint.cpp:
        (JSC::LLInt::setEvalEntrypoint):
        (JSC::LLInt::setProgramEntrypoint):
        (JSC::LLInt::setModuleProgramEntrypoint):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setUpCall):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/ExecutableBase.h:
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::finishCreation):
        * runtime/NativeFunction.h:
        (JSC::TaggedNativeFunction::TaggedNativeFunction):
        (JSC::TaggedNativeFunction::operator NativeFunction):
        * runtime/PropertySlot.h:
        (JSC::PropertySlot::setCustom):
        (JSC::PropertySlot::setCacheableCustom):
        * runtime/PtrTag.h:
        * runtime/PutPropertySlot.h:
        (JSC::PutPropertySlot::setCustomValue):
        (JSC::PutPropertySlot::setCustomAccessor):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        * runtime/VMTraps.cpp:
        (JSC::SignalContext::SignalContext):
        (JSC::VMTraps::tryInstallTrapBreakpoints):
        * tools/SigillCrashAnalyzer.cpp:
        (JSC::installCrashHandler):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generateTryReadUnicodeCharacterHelper):
        (JSC::Yarr::YarrGenerator::generateEnter):

2018-03-30  Devin Rousso  <webkit@devinrousso.com>

        Web Inspector: tint all pixels drawn by shader program when hovering ShaderProgramTreeElement
        https://bugs.webkit.org/show_bug.cgi?id=175223

        Reviewed by Matt Baker.

        * inspector/protocol/Canvas.json:
        Add `setShaderProgramHighlighted` command that will cause a blend to be applied to the
        canvas if the given shader program is active immediately before `drawArrays` or `drawElements`
        is called. The blend is removed and the previous value is applied once the draw is complete.

2018-03-30  JF Bastien  <jfbastien@apple.com>

        WebAssembly: support DataView compilation
        https://bugs.webkit.org/show_bug.cgi?id=183342

        Reviewed by Mark Lam.

        Compiling a module from a DataView was incorrectly dealing with
        DataView's offset.

        * wasm/WasmModuleParser.cpp:
        (JSC::Wasm::ModuleParser::parse):
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::getWasmBufferFromValue):
        (JSC::createSourceBufferFromValue):
        * wasm/js/WebAssemblyPrototype.cpp:
        (JSC::webAssemblyValidateFunc):

2018-03-30  Filip Pizlo  <fpizlo@apple.com>

        Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
        https://bugs.webkit.org/show_bug.cgi?id=184189

        Reviewed by JF Bastien.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ResolveNode::emitBytecode):

2018-03-30  Mark Lam  <mark.lam@apple.com>

        Add pointer profiling support to Wasm.
        https://bugs.webkit.org/show_bug.cgi?id=184175
        <rdar://problem/39027923>

        Reviewed by JF Bastien.

        * runtime/PtrTag.h:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addGrowMemory):
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::prepare):
        (JSC::Wasm::BBQPlan::complete):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmBinding.h:
        * wasm/WasmFaultSignalHandler.cpp:
        (JSC::Wasm::trapHandler):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::callWebAssemblyFunction):
        * wasm/js/WebAssemblyFunction.h:

2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r230102.

        Caused assertion failures on JSC bots.

        Reverted changeset:

        "A stack overflow in the parsing of a builtin (called by
        createExecutable) cause a crash instead of a catchable js
        exception"
        https://bugs.webkit.org/show_bug.cgi?id=184074
        https://trac.webkit.org/changeset/230102

2018-03-30  Robin Morisset  <rmorisset@apple.com>

        Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
        https://bugs.webkit.org/show_bug.cgi?id=183812

        Reviewed by Keith Miller.

        The fix I landed for https://bugs.webkit.org/show_bug.cgi?id=181027 was flawed: I tried setting the bytecodeIndex for the new block on line 1679 (at the end of inlineCall), but it is going to be reset on line 6612 (in parseCodeBlock).
        The fix is simply to make the block untargetable by default, and let parseCodeBlock make it targetable afterwards if it is a jump target.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::allocateTargetableBlock):
        (JSC::DFG::ByteCodeParser::inlineCall):

2018-03-30  Robin Morisset  <rmorisset@apple.com>

        A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
        https://bugs.webkit.org/show_bug.cgi?id=184074
        <rdar://problem/37165897>

        Reviewed by Keith Miller.

        Fixing this requires getting the ParserError (with information about the failure) and an ExecState* (to throw an exception) in the same place.
        It is surprisingly painful, with quite a long call stack between the last function with an access to an ExecState* and the first function with the ParserError.
        Even worse, many of these functions are generated by macros, themselves generated by a maze of python scripts.
        As a result, this patch is grotesquely large, while all it does is adding enough plumbing to throw a proper exception in this specific case.

        There are now bare calls to '.value()' on several paths that may crash. It is not a problem in my opinion, since we previously crashed in every case regardless of the path that took us to createExecutable when encountering a stack overflow.
        If we ever find an example that can cause these calls to fail, it should be doable to throw a proper exception there too.

        Two other minor changes:
        - I removed BuiltinExecutableCreator.{cpp, h} as it was nearly empty, and only used in one place. That place now includes BuiltinExecutables.h directly instead.
        - I moved code from ParserError.h into a newly created ParserError.cpp, as I see no need to inline functions that are only used when encountering a parser error, and ParserError.h is now included in quite a few places.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Scripts/builtins/builtins_generate_combined_header.py:
        (BuiltinsCombinedHeaderGenerator.generate_forward_declarations):
        (ParserError):
        (generate_section_for_object): Deleted.
        (generate_externs_for_object): Deleted.
        (generate_macros_for_object): Deleted.
        (generate_section_for_code_table_macro): Deleted.
        (generate_section_for_code_name_macro): Deleted.
        (generate_section_for_global_private_code_name_macro): Deleted.
        * Scripts/builtins/builtins_generate_separate_header.py:
        (generate_secondary_header_includes):
        * Scripts/builtins/builtins_templates.py:
        * Sources.txt:
        * builtins/BuiltinExecutableCreator.cpp: Removed.
        * builtins/BuiltinExecutableCreator.h: Removed.
        * builtins/BuiltinExecutables.cpp:
        (JSC::BuiltinExecutables::createDefaultConstructor):
        (JSC::BuiltinExecutables::createBuiltinExecutable):
        (JSC::createBuiltinExecutable):
        (JSC::BuiltinExecutables::createExecutableOrCrash):
        (JSC::BuiltinExecutables::createExecutable):
        * builtins/BuiltinExecutables.h:
        * bytecompiler/BytecodeGenerator.h:
        * parser/ParserError.cpp: Added.
        (JSC::ParserError::toErrorObject):
        (JSC::ParserError::throwStackOverflowOrOutOfMemory):
        (WTF::printInternal):
        * parser/ParserError.h:
        (JSC::ParserError::toErrorObject): Deleted.
        (WTF::printInternal): Deleted.
        * runtime/AsyncIteratorPrototype.cpp:
        (JSC::AsyncIteratorPrototype::finishCreation):
        * runtime/FunctionPrototype.cpp:
        (JSC::FunctionPrototype::addFunctionProperties):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnStaticPropertySlot):
        (JSC::JSObject::reifyAllStaticProperties):
        * runtime/JSObject.h:
        (JSC::JSObject::getOwnNonIndexPropertySlot):
        (JSC::JSObject::getOwnPropertySlot):
        (JSC::JSObject::getPropertySlot):
        * runtime/JSObjectInlines.h:
        (JSC::JSObject::getNonIndexPropertySlot):
        * runtime/JSTypedArrayViewPrototype.cpp:
        (JSC::JSTypedArrayViewPrototype::finishCreation):
        * runtime/Lookup.cpp:
        (JSC::reifyStaticAccessor):
        (JSC::setUpStaticFunctionSlot):
        * runtime/Lookup.h:
        (JSC::getStaticPropertySlotFromTable):
        (JSC::reifyStaticProperty):
        * runtime/MapPrototype.cpp:
        (JSC::MapPrototype::finishCreation):
        * runtime/SetPrototype.cpp:
        (JSC::SetPrototype::finishCreation):
        * tools/JSDollarVM.cpp:
        (JSC::functionCreateBuiltin):

2018-03-30  Robin Morisset  <rmorisset@apple.com>

        Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
        https://bugs.webkit.org/show_bug.cgi?id=183657
        <rdar://problem/38464399>

        Reviewed by Keith Miller.

        There was just a missing check in unshiftCountForIndexingType.
        I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path',
        and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp).
        Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk.

        * runtime/ArrayPrototype.cpp:
        (JSC::unshift):
        * runtime/JSArray.cpp:
        (JSC::JSArray::unshiftCountWithAnyIndexingType):
        * runtime/JSObject.h:
        (JSC::JSObject::ensureLength):

2018-03-29  Mark Lam  <mark.lam@apple.com>

        Add some pointer profiling support to B3 and Air.
        https://bugs.webkit.org/show_bug.cgi?id=184165
        <rdar://problem/39022125>

        Reviewed by JF Bastien.

        * b3/B3LowerMacros.cpp:
        * b3/B3LowerMacrosAfterOptimizations.cpp:
        * b3/B3MathExtras.cpp:
        * b3/B3ReduceStrength.cpp:
        * b3/air/AirCCallSpecial.cpp:
        (JSC::B3::Air::CCallSpecial::generate):
        * b3/air/AirCCallSpecial.h:
        * b3/testb3.cpp:
        (JSC::B3::testCallSimple):
        (JSC::B3::testCallRare):
        (JSC::B3::testCallRareLive):
        (JSC::B3::testCallSimplePure):
        (JSC::B3::testCallFunctionWithHellaArguments):
        (JSC::B3::testCallFunctionWithHellaArguments2):
        (JSC::B3::testCallFunctionWithHellaArguments3):
        (JSC::B3::testCallSimpleDouble):
        (JSC::B3::testCallSimpleFloat):
        (JSC::B3::testCallFunctionWithHellaDoubleArguments):
        (JSC::B3::testCallFunctionWithHellaFloatArguments):
        (JSC::B3::testLinearScanWithCalleeOnStack):
        (JSC::B3::testInterpreter):
        (JSC::B3::testLICMPure):
        (JSC::B3::testLICMPureSideExits):
        (JSC::B3::testLICMPureWritesPinned):
        (JSC::B3::testLICMPureWrites):
        (JSC::B3::testLICMReadsLocalState):
        (JSC::B3::testLICMReadsPinned):
        (JSC::B3::testLICMReads):
        (JSC::B3::testLICMPureNotBackwardsDominant):
        (JSC::B3::testLICMPureFoiledByChild):
        (JSC::B3::testLICMPureNotBackwardsDominantFoiledByChild):
        (JSC::B3::testLICMExitsSideways):
        (JSC::B3::testLICMWritesLocalState):
        (JSC::B3::testLICMWrites):
        (JSC::B3::testLICMFence):
        (JSC::B3::testLICMWritesPinned):
        (JSC::B3::testLICMControlDependent):
        (JSC::B3::testLICMControlDependentNotBackwardsDominant):
        (JSC::B3::testLICMControlDependentSideExits):
        (JSC::B3::testLICMReadsPinnedWritesPinned):
        (JSC::B3::testLICMReadsWritesDifferentHeaps):
        (JSC::B3::testLICMReadsWritesOverlappingHeaps):
        (JSC::B3::testLICMDefaultCall):
        (JSC::B3::testShuffleDoesntTrashCalleeSaves):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        * jit/GPRInfo.h:
        * runtime/PtrTag.h:
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):

2018-03-29  JF Bastien  <jfbastien@apple.com>

        Use Forward.h instead of forward-declaring WTF::String
        https://bugs.webkit.org/show_bug.cgi?id=184172
        <rdar://problem/39026146>

        Reviewed by Yusuke Suzuki.

        As part of #184164 I'm changing WTF::String, and the forward
        declarations are just wrong because I'm making it templated. We
        should use Forward.h anyways, so do that instead.

        * runtime/DateConversion.h:

2018-03-29  Mark Lam  <mark.lam@apple.com>

        Use MacroAssemblerCodePtr in Wasm code for code pointers instead of void*.
        https://bugs.webkit.org/show_bug.cgi?id=184163
        <rdar://problem/39020397>

        Reviewed by JF Bastien.

        With the use of MacroAssemblerCodePtr, we now get poisoning for Wasm code pointers.

        Also renamed some structs, methods, and variable names to be more accurate.
        Previously, there is some confusion between a code pointer and the address of a
        code pointer (sometimes referred to in the code as a "LoadLocation").  We now name
        the LoadLocation variables appropriately to distinguish them from code pointers.

        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmCodeBlock.cpp:
        (JSC::Wasm::CodeBlock::CodeBlock):
        * wasm/WasmCodeBlock.h:
        (JSC::Wasm::CodeBlock::entrypointLoadLocationFromFunctionIndexSpace):
        (JSC::Wasm::CodeBlock::wasmEntrypointLoadLocationFromFunctionIndexSpace): Deleted.
        * wasm/WasmFormat.h:
        (JSC::Wasm::WasmToWasmImportableFunction::WasmToWasmImportableFunction):
        (JSC::Wasm::WasmToWasmImportableFunction::offsetOfEntrypointLoadLocation):
        (JSC::Wasm::CallableFunction::CallableFunction): Deleted.
        (JSC::Wasm::CallableFunction::offsetOfWasmEntrypointLoadLocation): Deleted.
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::offsetOfWasmEntrypointLoadLocation):
        (JSC::Wasm::Instance::offsetOfWasmToEmbedderStub):
        (JSC::Wasm::Instance::offsetOfWasmEntrypoint): Deleted.
        (JSC::Wasm::Instance::offsetOfWasmToEmbedderStubExecutableAddress): Deleted.
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::Table):
        (JSC::Wasm::Table::grow):
        (JSC::Wasm::Table::clearFunction):
        (JSC::Wasm::Table::setFunction):
        * wasm/WasmTable.h:
        (JSC::Wasm::Table::offsetOfFunctions):
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::finalizeCreation):
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::setFunction):
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::create):
        (JSC::WebAssemblyFunction::WebAssemblyFunction):
        * wasm/js/WebAssemblyFunction.h:
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):
        (JSC::WebAssemblyModuleRecord::evaluate):
        * wasm/js/WebAssemblyWrapperFunction.cpp:
        (JSC::WebAssemblyWrapperFunction::WebAssemblyWrapperFunction):
        (JSC::WebAssemblyWrapperFunction::create):
        * wasm/js/WebAssemblyWrapperFunction.h:

2018-03-29  Yusuke Suzuki  <utatane.tea@gmail.com>

        Remove WTF_EXPORTDATA and JS_EXPORTDATA
        https://bugs.webkit.org/show_bug.cgi?id=184170

        Reviewed by JF Bastien.

        Replace WTF_EXPORTDATA and JS_EXPORTDATA with
        WTF_EXPORT_PRIVATE and JS_EXPORT_PRIVATE respectively.

        * heap/WriteBarrierSupport.h:
        * jit/ExecutableAllocator.cpp:
        * jit/ExecutableAllocator.h:
        * runtime/JSCPoison.h:
        * runtime/JSCell.h:
        * runtime/JSExportMacros.h:
        * runtime/JSGlobalObject.h:
        * runtime/JSObject.h:
        * runtime/Options.h:
        * runtime/PropertyDescriptor.h:
        * runtime/PropertyMapHashTable.h:
        * runtime/SamplingCounter.h:

2018-03-29  Ross Kirsling  <ross.kirsling@sony.com>

        MSVC __forceinline slows down JSC release build fivefold after r229391
        https://bugs.webkit.org/show_bug.cgi?id=184062

        Reviewed by Alex Christensen.

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::marshallArgumentRegister):
        Exempt MSVC from a single forced inline used within recursive templates.

2018-03-29  Keith Miller  <keith_miller@apple.com>

        ArrayMode should not try to get the DFG to think it can convert TypedArrays
        https://bugs.webkit.org/show_bug.cgi?id=184137

        Reviewed by Saam Barati.

        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::fromObserved):

2018-03-29  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r230062.
        https://bugs.webkit.org/show_bug.cgi?id=184128

        Broke mac port. web content process crashes while loading any
        web page (Requested by rniwa on #webkit).

        Reverted changeset:

        "MSVC __forceinline slows down JSC release build fivefold
        after r229391"
        https://bugs.webkit.org/show_bug.cgi?id=184062
        https://trac.webkit.org/changeset/230062

2018-03-28  Ross Kirsling  <ross.kirsling@sony.com>

        MSVC __forceinline slows down JSC release build fivefold after r229391
        https://bugs.webkit.org/show_bug.cgi?id=184062

        Reviewed by Alex Christensen.

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::marshallArgumentRegister):
        Exempt MSVC from a single forced inline used within recursive templates.

2018-03-28  Mark Lam  <mark.lam@apple.com>

        Enhance ARM64 probe to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=184069
        <rdar://problem/38939879>

        Reviewed by JF Bastien.

        * assembler/MacroAssemblerARM64.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::popPair):
        (JSC::MacroAssemblerX86Common::pushPair):
        * assembler/testmasm.cpp:
        (JSC::testProbeReadsArgumentRegisters):
        (JSC::testProbeWritesArgumentRegisters):
        * runtime/PtrTag.h:
        (JSC::tagForPtr):

2018-03-28  Robin Morisset  <rmorisset@apple.com>

        appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
        https://bugs.webkit.org/show_bug.cgi?id=183894

        Reviewed by Saam Barati.

        Use the return value of appendQuotedJSONString to fail more gracefully when given a string that is too large to handle.

        * runtime/JSONObject.cpp:
        (JSC::Stringifier::appendStringifiedValue):

2018-03-28  Carlos Garcia Campos  <cgarcia@igalia.com>

        [JSC] Move WeakValueRef class to its own file and use it from Objc and GLib
        https://bugs.webkit.org/show_bug.cgi?id=184073

        Reviewed by Yusuke Suzuki.

        We currently have duplicated code in Obj and GLib implementations.

        * API/JSManagedValue.mm:
        (managedValueHandleOwner):
        (-[JSManagedValue initWithValue:]):
        * API/JSWeakValue.cpp: Added.
        (JSC::JSWeakValue::~JSWeakValue):
        (JSC::JSWeakValue::clear):
        (JSC::JSWeakValue::isClear const):
        (JSC::JSWeakValue::setPrimitive):
        (JSC::JSWeakValue::setObject):
        (JSC::JSWeakValue::setString):
        * API/JSWeakValue.h: Added.
        (JSC::JSWeakValue::isSet const):
        (JSC::JSWeakValue::isPrimitive const):
        (JSC::JSWeakValue::isObject const):
        (JSC::JSWeakValue::isString const):
        (JSC::JSWeakValue::object const):
        (JSC::JSWeakValue::primitive const):
        (JSC::JSWeakValue::string const):
        * API/glib/JSCWeakValue.cpp:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:

2018-03-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Add JSCWeakValue to JavaScriptCore GLib API
        https://bugs.webkit.org/show_bug.cgi?id=184041

        Reviewed by Michael Catanzaro.

        This allows to keep a reference to a JavaSCript value without protecting it, and without having a strong
        reference of the context. When the value is cleared the JSCWeakValue::cleared signal is emitted and
        jsc_weak_value_get_value() will always return nullptr.

        * API/glib/JSCWeakValue.cpp: Added.
        (WeakValueRef::~WeakValueRef):
        (WeakValueRef::clear):
        (WeakValueRef::isClear const):
        (WeakValueRef::isSet const):
        (WeakValueRef::isPrimitive const):
        (WeakValueRef::isObject const):
        (WeakValueRef::isString const):
        (WeakValueRef::setPrimitive):
        (WeakValueRef::setObject):
        (WeakValueRef::setString):
        (WeakValueRef::object const):
        (WeakValueRef::primitive const):
        (WeakValueRef::string const):
        (weakValueHandleOwner):
        (jscWeakValueInitialize):
        (jscWeakValueSetProperty):
        (jscWeakValueDispose):
        (jsc_weak_value_class_init):
        (jsc_weak_value_new):
        (jsc_weak_value_get_value):
        * API/glib/JSCWeakValue.h: Added.
        * API/glib/docs/jsc-glib-4.0-sections.txt:
        * API/glib/docs/jsc-glib-docs.sgml:
        * API/glib/jsc.h:
        * GLib.cmake:

2018-03-27  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Remove unnecessary USE(JSVALUE32_64) / USE(JSVALUE64)
        https://bugs.webkit.org/show_bug.cgi?id=181292

        Reviewed by Saam Barati.

        By using JSValueRegs abstraction, we can simplify DFGSpeculativeJIT.cpp code.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
        (JSC::DFG::SpeculativeJIT::compileCreateRest):
        (JSC::DFG::SpeculativeJIT::compileArraySlice):
        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
        (JSC::DFG::SpeculativeJIT::compilePutDynamicVar):
        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):

2018-03-27  Yusuke Suzuki  <utatane.tea@gmail.com>

        Add Load16Z for B3 and use it in WebAssembly
        https://bugs.webkit.org/show_bug.cgi?id=165884

        Reviewed by JF Bastien.

        We already support Load16Z in B3. Use it for i32.load16_u / i64.load16_u in WebAssembly.
        spec-tests/memory.wast.js already covered this change.

        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitLoadOp):

2018-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Remove repeated iteration of ElementNode
        https://bugs.webkit.org/show_bug.cgi?id=183987

        Reviewed by Keith Miller.

        BytecodeGenerator repeatedly iterates ElementNode to emit the efficient code.
        While it is OK for small arrays, this repeated iteration takes much time
        if the array is very large. For example, Kraken's initialization code includes
        very large array with numeric literals. This makes bytecode compiling so long.

        This patch carefully removes unnecessary iteration when emitting arrays.
        This reduces one of Kraken/imaging-darkroom's bytecode compiling from 13.169856 ms
        to 9.988050 ms.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitNewArrayBuffer):
        (JSC::BytecodeGenerator::emitNewArray):
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ArrayNode::emitBytecode):
        (JSC::ArrayPatternNode::bindValue const):
        (JSC::ArrayPatternNode::emitDirectBinding):

2018-03-26  Ross Kirsling  <ross.kirsling@sony.com>

        JIT callOperation() needs to support operations that return SlowPathReturnType differently on Windows.
        https://bugs.webkit.org/show_bug.cgi?id=183655

        Reviewed by Keith Miller.

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::ArgCollection::argCount):
        (JSC::CCallHelpers::marshallArgumentRegister):
        (JSC::CCallHelpers::setupArgumentsImpl):
        On Win64, ensure that argCount always includes GPRs and FPRs and that counting starts from 1 for SlowPathReturnType.

        * jit/JIT.h:
        (JSC::JIT::callOperation):
        (JSC::JIT::is64BitType):
        (JSC::JIT::is64BitType<void>):
        On Win64, ensure special call is used for SlowPathReturnType.

        * jit/JITOperations.h:
        Update changed type.

2018-03-26  Yusuke Suzuki  <utatane.tea@gmail.com>

        We should have SSE4 detection in the X86 MacroAssembler.
        https://bugs.webkit.org/show_bug.cgi?id=165363

        Reviewed by JF Bastien.

        This patch adds popcnt support to WASM in x86_64 environment.
        To use it, we refactor our CPUID feature detection in MacroAssemblerX86Common.
        Our spec-tests already cover popcnt.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::supportsCountPopulation):
        * assembler/MacroAssemblerX86Common.cpp:
        (JSC::MacroAssemblerX86Common::getCPUID):
        (JSC::MacroAssemblerX86Common::getCPUIDEx):
        (JSC::MacroAssemblerX86Common::collectCPUFeatures):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::countPopulation32):
        (JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
        (JSC::MacroAssemblerX86Common::supportsCountPopulation):
        (JSC::MacroAssemblerX86Common::supportsAVX):
        (JSC::MacroAssemblerX86Common::supportsLZCNT):
        (JSC::MacroAssemblerX86Common::supportsBMI1):
        (JSC::MacroAssemblerX86Common::isSSE2Present):
        (JSC::MacroAssemblerX86Common::updateEax1EcxFlags): Deleted.
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::countPopulation64):
        * assembler/X86Assembler.h:
        (JSC::X86Assembler::popcnt_rr):
        (JSC::X86Assembler::popcnt_mr):
        (JSC::X86Assembler::popcntq_rr):
        (JSC::X86Assembler::popcntq_mr):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):

2018-03-26  Filip Pizlo  <fpizlo@apple.com>

        DFG should know that CreateThis can be effectful
        https://bugs.webkit.org/show_bug.cgi?id=184013

        Reviewed by Saam Barati.

        As shown in the tests added in JSTests, CreateThis can be effectful if the constructor this
        is a proxy.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):

2018-03-25  Saam Barati  <sbarati@apple.com>

        Fix typo in JSC option name
        https://bugs.webkit.org/show_bug.cgi?id=184001

        Reviewed by Mark Lam.

        enableJITDebugAssetions => enableJITDebugAssertions.

        * assembler/MacroAssembler.cpp:
        (JSC::MacroAssembler::jitAssert):
        * runtime/Options.h:

2018-03-25  Saam Barati  <sbarati@apple.com>

        r228149 accidentally removed code that resets m_emptyCursor at the end of a GC
        https://bugs.webkit.org/show_bug.cgi?id=183995

        Reviewed by Filip Pizlo.

        The removal of this line of code was unintended and happened during some
        refactoring Fil was doing. The consequence of removing this line of code
        is that the m_emptyCursor became a monotonically increasing integer, leading
        the cursor to usually being out of bounds of the block range (depending on
        what the program is doing). This made the functionality of finding an empty
        block to steal almost always fail.

        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::prepareForAllocation):

2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Introduces fused compare and jump
        https://bugs.webkit.org/show_bug.cgi?id=177100

        Reviewed by Mark Lam.

        This patch introduces op_jeq, op_jneq, op_jstricteq, and op_jnstricteq.
        It offers 3 benefit.

        1. They are introduced due to the similar purpose to op_jless etc. It aligns
        op_eq families to op_jless families.

        2. It reduces the size of bytecode to represent the typical code sequence.

        3. It offers the way to fuse check and jump in DFG code generation. Since
        we have MovHint between Branch and CompareEq/CompareStrictEq previously,
        we cannot do this optimization. It reduces the machine code size in DFG too.

        It slightly improves Octane/boyer.

            boyer  6.18038+-0.05002    ^     6.06990+-0.04176       ^ definitely 1.0182x faster

        * bytecode/BytecodeDumper.cpp:
        (JSC::BytecodeDumper<Block>::dumpBytecode):
        * bytecode/BytecodeList.json:
        * bytecode/BytecodeUseDef.h:
        (JSC::computeUsesForBytecodeOffset):
        (JSC::computeDefsForBytecodeOffset):
        * bytecode/Opcode.h:
        (JSC::isBranch):
        * bytecode/PreciseJumpTargetsInlines.h:
        (JSC::extractStoredJumpTargetsForBytecodeOffset):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitJumpIfTrue):
        (JSC::BytecodeGenerator::emitJumpIfFalse):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileStrictEq):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_jeq):
        (JSC::JIT::emit_op_neq):
        (JSC::JIT::emit_op_jneq):
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::emit_op_stricteq):
        (JSC::JIT::emit_op_nstricteq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emit_op_jstricteq):
        (JSC::JIT::emit_op_jnstricteq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emitSlow_op_jneq):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emit_op_jeq):
        (JSC::JIT::compileOpEqJumpSlow):
        (JSC::JIT::emitSlow_op_jeq):
        (JSC::JIT::emit_op_jneq):
        (JSC::JIT::emitSlow_op_jneq):
        (JSC::JIT::compileOpStrictEq):
        (JSC::JIT::emit_op_stricteq):
        (JSC::JIT::emit_op_nstricteq):
        (JSC::JIT::compileOpStrictEqJump):
        (JSC::JIT::emit_op_jstricteq):
        (JSC::JIT::emit_op_jnstricteq):
        (JSC::JIT::emitSlow_op_jstricteq):
        (JSC::JIT::emitSlow_op_jnstricteq):
        * jit/JITOperations.cpp:
        * jit/JITOperations.h:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2018-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Improve constants and add comments for CodeBlockHash
        https://bugs.webkit.org/show_bug.cgi?id=183982

        Rubber-stamped by Mark Lam.

        * bytecode/CodeBlockHash.cpp:
        (JSC::CodeBlockHash::CodeBlockHash):
        * bytecode/ParseHash.cpp:
        (JSC::ParseHash::ParseHash):

2018-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Add options to report parsing and bytecode compiling times
        https://bugs.webkit.org/show_bug.cgi?id=183982

        Reviewed by Mark Lam.

        This patch adds reportParseTimes and reportBytecodeCompileTimes options.
        When they are enabled, JSC reports times consumed for parsing and bytecode
        compiling.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/ParseHash.cpp: Added.
        (JSC::ParseHash::ParseHash):
        * bytecode/ParseHash.h: Added.
        (JSC::ParseHash::hashForCall const):
        (JSC::ParseHash::hashForConstruct const):
        * bytecode/UnlinkedFunctionExecutable.cpp:
        (JSC::generateUnlinkedFunctionCodeBlock):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::generate):
        * parser/Parser.h:
        (JSC::parse):
        * runtime/CodeCache.h:
        (JSC::generateUnlinkedCodeBlock):
        * runtime/Options.h:

2018-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JIT] Drop ENABLE_JIT_VERBOSE flag
        https://bugs.webkit.org/show_bug.cgi?id=183983

        Reviewed by Mark Lam.

        Just use JITInternal::verbose value.

        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        (JSC::JIT::privateCompileSlowCases):
        (JSC::JIT::link):

2018-03-23  Tim Horton  <timothy_horton@apple.com>

        Fix the build with no pasteboard
        https://bugs.webkit.org/show_bug.cgi?id=183973

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2018-03-23  Mark Lam  <mark.lam@apple.com>

        LLInt TypeArray pointer poisoning should not pick its poison dynamically.
        https://bugs.webkit.org/show_bug.cgi?id=183942
        <rdar://problem/38798018>

        Reviewed by JF Bastien.

        1. Move the LLInt TypedArray unpoisoning to just before the array access after
           all the branches.
        2. Renamed FirstArrayType to FirstTypedArrayType to match the symbol in C++ code.
        3. Remove a useless instruction in the implementation of emitX86Lea for a global
           label.

        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/x86.rb:

2018-03-23  Mark Lam  <mark.lam@apple.com>

        Add more support for pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=183943
        <rdar://problem/38799068>

        Reviewed by JF Bastien.

        * assembler/ARM64Assembler.h:
        (JSC::ARM64Assembler::linkJumpOrCall):
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::repatchNearCall):
        (JSC::AbstractMacroAssembler::tagReturnAddress):
        (JSC::AbstractMacroAssembler::untagReturnAddress):

2018-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WTF] Add standard containers with FastAllocator specialization
        https://bugs.webkit.org/show_bug.cgi?id=183789

        Reviewed by Darin Adler.

        * b3/air/testair.cpp:
        * b3/testb3.cpp:
        (JSC::B3::testDoubleLiteralComparison):
        (JSC::B3::testFloatEqualOrUnorderedFoldingNaN):
        * dfg/DFGGraph.h:
        * dfg/DFGIntegerCheckCombiningPhase.cpp:
        * dfg/DFGObjectAllocationSinkingPhase.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::switchStringSlow):
        * runtime/FunctionHasExecutedCache.h:
        * runtime/TypeLocationCache.h:

2018-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Fix ArrayPush(ArrayStorage)'s abstract heap
        https://bugs.webkit.org/show_bug.cgi?id=182960

        Reviewed by Saam Barati.

        This patch fixes ArrayPush(ArrayStorage)'s abstract heap.
        It should always touch ArrayStorage_vector. To unify
        vector setting code for the real ArrayStorage_vector and
        ScratchBuffer, we use ArrayStorage_vector.atAnyIndex() to
        annotate this.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):

2018-03-23  Zan Dobersek  <zdobersek@igalia.com>

        Unreviewed build fix for GCC 4.9 builds.

        * assembler/MacroAssemblerCodeRef.h: std::is_trivially_copyable<> isn't
        supported in 4.9 libstdc++, so wrap the static assert using it in a
        COMPILER_SUPPORTS() macro, and use __is_trivially_copyable() builtin,
        as is done in bitwise_cast() in StdLibExtras.h.

2018-03-22  Tim Horton  <timothy_horton@apple.com>

        Adopt WK_ALTERNATE_FRAMEWORKS_DIR in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=183930
        <rdar://problem/38782249>

        Reviewed by Dan Bernstein.

        * JavaScriptCore.xcodeproj/project.pbxproj:

2018-03-22  Mark Lam  <mark.lam@apple.com>

        Add placeholder call and jump MacroAssembler emitters that take PtrTag in a register.
        https://bugs.webkit.org/show_bug.cgi?id=183914
        <rdar://problem/38763536>

        Reviewed by Saam Barati and JF Bastien.

        This is in preparation for supporting pointer profiling work.

        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::jump):
        (JSC::MacroAssemblerARM::call):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::call):
        (JSC::MacroAssemblerARM64::jump):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::jump):
        (JSC::MacroAssemblerARMv7::call):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::jump):
        (JSC::MacroAssemblerMIPS::call):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::call):
        (JSC::MacroAssemblerX86::jump):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::jump):
        (JSC::MacroAssemblerX86Common::call):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::call):
        (JSC::MacroAssemblerX86_64::jump):

2018-03-22  Tim Horton  <timothy_horton@apple.com>

        Improve readability of WebCore's OTHER_LDFLAGS
        https://bugs.webkit.org/show_bug.cgi?id=183909
        <rdar://problem/38760992>

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:
        * Configurations/FeatureDefines.xcconfig:

2018-03-22  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Thumb: Do not decorate bottom bit twice
        https://bugs.webkit.org/show_bug.cgi?id=183906

        Reviewed by Mark Lam.

        Use MacroAssemblerCodePtr::createFromExecutableAddress instead of
        MacroAssemblerCodePtr(void*) to avoid decorating the pointer twice as
        a thumb pointer.

        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):

2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
        https://bugs.webkit.org/show_bug.cgi?id=183559

        Reviewed by Mark Lam.

        When converting NumberToStringWithRadix to ToString(Int52/Int32/Double), we forget
        to clear NodeMustGenerate for this ToString. It should be since it does not have
        any user-observable side effect. This patch clears NodeMustGenerate.

        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):

2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] List up all candidates in DFGCapabilities and FTLCapabilities
        https://bugs.webkit.org/show_bug.cgi?id=183897

        Reviewed by Mark Lam.

        We should not use `default:` clause here since it accidentally catches
        the opcode and DFG nodes which should be optimized. For example,
        op_super_sampler_begin and op_super_sampler_end are not listed while
        they have DFG and FTL backend.

        This patch lists up all candiates in DFGCapabilities and FTLCapabilities.
        And we also clean up unnecessary checks in FTLCapabilities. Since we
        already handles all the possible array types for these nodes (which can
        be checked in DFG's code), we do not need to check array types.

        We also fix FTLLowerDFGToB3' PutByVal code to use modeForPut.

        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::capabilityLevel):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Drop op_put_by_index
        https://bugs.webkit.org/show_bug.cgi?id=183899

        Reviewed by Mark Lam.

        This patch drops op_put_by_index.

        1. This functionality can be just covered by direct put_by_val.
        2. put_by_index is not well optimized. It is just calling a C
        function. And it does not have DFG handling.

        * bytecode/BytecodeDumper.cpp:
        (JSC::BytecodeDumper<Block>::dumpBytecode):
        * bytecode/BytecodeList.json:
        * bytecode/BytecodeUseDef.h:
        (JSC::computeUsesForBytecodeOffset):
        (JSC::computeDefsForBytecodeOffset):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitPutByIndex): Deleted.
        * bytecompiler/BytecodeGenerator.h:
        * bytecompiler/NodesCodegen.cpp:
        (JSC::ArrayNode::emitBytecode):
        (JSC::ArrayPatternNode::emitDirectBinding):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_put_by_index): Deleted.
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_by_index): Deleted.
        * llint/LLIntSlowPaths.cpp:
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:

2018-03-22  Michael Saboff  <msaboff@apple.com>

        Race Condition in arrayProtoFuncReverse() causes wrong results or crash
        https://bugs.webkit.org/show_bug.cgi?id=183901

        Reviewed by Keith Miller.

        Added write barriers to ensure the reversed contents are properly marked.

        * runtime/ArrayPrototype.cpp:
        (JSC::arrayProtoFuncReverse):

2018-03-21  Filip Pizlo  <fpizlo@apple.com>

        ScopedArguments should do poisoning and index masking
        https://bugs.webkit.org/show_bug.cgi?id=183863

        Reviewed by Mark Lam.
        
        This outlines the ScopedArguments overflow storage and adds poisoning.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitScopedArgumentsGetByVal):
        * runtime/JSCPoison.h:
        * runtime/ScopedArguments.cpp:
        (JSC::ScopedArguments::ScopedArguments):
        (JSC::ScopedArguments::createUninitialized):
        (JSC::ScopedArguments::visitChildren):
        * runtime/ScopedArguments.h:

2018-03-21  Mark Lam  <mark.lam@apple.com>

        Refactor the PtrTag list as a macro so that we can auto-generate code that enumerates each PtrTag.
        https://bugs.webkit.org/show_bug.cgi?id=183861
        <rdar://problem/38716822>

        Reviewed by Filip Pizlo.

        Also added ptrTagName() to aid debugging.  ptrTagName() is implemented using this
        new PtrTag macro list.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * runtime/PtrTag.cpp: Added.
        (JSC::ptrTagName):
        * runtime/PtrTag.h:

2018-03-21  Mark Lam  <mark.lam@apple.com>

        Use CodeBlock::instructions()[] and CodeBlock::bytecodeOffset() instead of doing own pointer math.
        https://bugs.webkit.org/show_bug.cgi?id=183857
        <rdar://problem/38712184>

        Reviewed by JF Bastien.

        We should avoid doing pointer math with CodeBlock::instructions().begin().
        Instead, we should use the operator[] that comes with CodeBlock::instructions()
        for computing an Instruction*, and use CodeBlock::bytecodeOffset() for computing
        the bytecode offset of a given Instruction*.  These methods will do assertions
        which helps catch bugs sooner, plus they are more descriptive of the operation
        we're trying to do.

        * bytecode/BytecodeKills.h:
        (JSC::BytecodeKills::operandIsKilled const):
        (JSC::BytecodeKills::forEachOperandKilledAt const):
        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFromLLInt):
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::dumpBytecode):
        (JSC::CodeBlock::arithProfileForBytecodeOffset):
        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::computeFromLLInt):
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::computeFromLLInt):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::reifyInlinedCallFrames):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::reifyInlinedCallFrames):
        * interpreter/CallFrame.cpp:
        (JSC::CallFrame::callSiteBitsAsBytecodeOffset const):
        (JSC::CallFrame::currentVPC const):
        (JSC::CallFrame::setCurrentVPC):
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):
        * jit/JITInlines.h:
        (JSC::JIT::updateTopCallFrame):
        (JSC::JIT::copiedInstruction):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/SlowPathCall.h:
        (JSC::JITSlowPathCall::call):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::llint_trace_operand):
        (JSC::LLInt::llint_trace_value):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::setupGetByIdPrototypeCache): Deleted.
        (JSC::LLInt::getByVal): Deleted.
        (JSC::LLInt::handleHostCall): Deleted.
        (JSC::LLInt::setUpCall): Deleted.
        (JSC::LLInt::genericCall): Deleted.
        (JSC::LLInt::varargsSetup): Deleted.
        (JSC::LLInt::llint_throw_stack_overflow_error): Deleted.
        (JSC::LLInt::llint_stack_check_at_vm_entry): Deleted.
        (JSC::LLInt::llint_write_barrier_slow): Deleted.
        (JSC::LLInt::llint_crash): Deleted.
        * runtime/SamplingProfiler.cpp:
        (JSC::tryGetBytecodeIndex):

2018-03-21  Keith Miller  <keith_miller@apple.com>

        btjs should print the bytecode offset in the stack trace for JS frames
        https://bugs.webkit.org/show_bug.cgi?id=183856

        Reviewed by Filip Pizlo.

        * interpreter/CallFrame.cpp:
        (JSC::CallFrame::bytecodeOffset):
        (JSC::CallFrame::dump):

2018-03-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK and WPE debug build after r229798.

        Fix a typo in an ASSERT. Also convert several RELEASE_ASSERT to ASSERT that I forgot to do before landing.

        * API/glib/JSCCallbackFunction.cpp:
        (JSC::JSCCallbackFunction::JSCCallbackFunction):
        * API/glib/JSCContext.cpp:
        (jscContextSetVirtualMachine):
        (jscContextGetJSContext):
        (wrapperMap):
        (jscContextHandleExceptionIfNeeded):
        * API/glib/JSCValue.cpp:
        (jscValueCallFunction):
        * API/glib/JSCVirtualMachine.cpp:
        (addWrapper):
        (removeWrapper):
        (jscVirtualMachineSetContextGroup):
        (jscVirtualMachineAddContext):
        (jscVirtualMachineRemoveContext):
        * API/glib/JSCWrapperMap.cpp:
        (JSC::WrapperMap::gobjectWrapper):
        (JSC::WrapperMap::unwrap):
        (JSC::WrapperMap::registerClass):
        (JSC::WrapperMap::createJSWrappper):
        (JSC::WrapperMap::wrappedObject const):

2018-03-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK][WPE] JSC bindings not introspectable
        https://bugs.webkit.org/show_bug.cgi?id=136989

        Reviewed by Michael Catanzaro.

        Make it possible to include individual headers when building WebKit layer.

        * API/glib/JSCAutocleanups.h:
        * API/glib/JSCClass.h:
        * API/glib/JSCContext.h:
        * API/glib/JSCException.h:
        * API/glib/JSCValue.h:
        * API/glib/JSCVersion.h.in:
        * API/glib/JSCVirtualMachine.h:

2018-03-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK][WPE] Initial implementation of JavaScriptCore glib bindings
        https://bugs.webkit.org/show_bug.cgi?id=164061

        Reviewed by Michael Catanzaro.

        Add initial GLib API for JavaScriptCore.

        * API/JSAPIWrapperObject.h:
        * API/glib/JSAPIWrapperObjectGLib.cpp: Added.
        (jsAPIWrapperObjectHandleOwner):
        (JSAPIWrapperObjectHandleOwner::finalize):
        (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
        (JSC::JSCallbackObject<JSAPIWrapperObject>::createStructure):
        (JSC::JSAPIWrapperObject::JSAPIWrapperObject):
        (JSC::JSAPIWrapperObject::finishCreation):
        (JSC::JSAPIWrapperObject::setWrappedObject):
        (JSC::JSAPIWrapperObject::visitChildren):
        * API/glib/JSCAutocleanups.h: Added.
        * API/glib/JSCCallbackFunction.cpp: Added.
        (JSC::callAsFunction):
        (JSC::callAsConstructor):
        (JSC::JSCCallbackFunction::create):
        (JSC::JSCCallbackFunction::JSCCallbackFunction):
        (JSC::JSCCallbackFunction::call):
        (JSC::JSCCallbackFunction::construct):
        (JSC::JSCCallbackFunction::destroy):
        * API/glib/JSCCallbackFunction.h: Added.
        (JSC::JSCCallbackFunction::createStructure):
        (JSC::JSCCallbackFunction::functionCallback):
        (JSC::JSCCallbackFunction::constructCallback):
        * API/glib/JSCClass.cpp: Added.
        (jscClassGetProperty):
        (jscClassSetProperty):
        (jscClassDispose):
        (jscClassConstructed):
        (jsc_class_class_init):
        (jscClassCreate):
        (jscClassGetJSClass):
        (jscClassGetOrCreateJSWrapper):
        (jscClassInvalidate):
        (jsc_class_get_name):
        (jsc_class_get_parent):
        (jsc_class_add_constructor):
        (jsc_class_add_method):
        (jsc_class_add_property):
        * API/glib/JSCClass.h: Added.
        * API/glib/JSCClassPrivate.h: Added.
        * API/glib/JSCContext.cpp: Added.
        (ExceptionHandler::ExceptionHandler):
        (ExceptionHandler::~ExceptionHandler):
        (jscContextSetVirtualMachine):
        (jscContextGetProperty):
        (jscContextSetProperty):
        (jscContextConstructed):
        (jscContextDispose):
        (jsc_context_class_init):
        (jscContextGetOrCreate):
        (jscContextGetJSContext):
        (wrapperMap):
        (jscContextGetOrCreateValue):
        (jscContextValueDestroyed):
        (jscContextGetJSWrapper):
        (jscContextGetOrCreateJSWrapper):
        (jscContextWrappedObject):
        (jscContextPushCallback):
        (jscContextPopCallback):
        (jscContextGArrayToJSArray):
        (jscContextJSArrayToGArray):
        (jscContextGValueToJSValue):
        (jscContextJSValueToGValue):
        (jsc_context_new):
        (jsc_context_new_with_virtual_machine):
        (jsc_context_get_virtual_machine):
        (jsc_context_get_exception):
        (jsc_context_throw):
        (jsc_context_throw_exception):
        (jsc_context_push_exception_handler):
        (jsc_context_pop_exception_handler):
        (jscContextHandleExceptionIfNeeded):
        (jsc_context_get_current):
        (jsc_context_evaluate):
        (jsc_context_evaluate_with_source_uri):
        (jsc_context_set_value):
        (jsc_context_get_value):
        (jsc_context_register_class):
        * API/glib/JSCContext.h: Added.
        * API/glib/JSCContextPrivate.h: Added.
        * API/glib/JSCDefines.h: Copied from Source/JavaScriptCore/API/JSAPIWrapperObject.h.
        * API/glib/JSCException.cpp: Added.
        (jscExceptionDispose):
        (jsc_exception_class_init):
        (jscExceptionCreate):
        (jscExceptionGetJSValue):
        (jscExceptionEnsureProperties):
        (jsc_exception_new):
        (jsc_exception_get_message):
        (jsc_exception_get_line_number):
        (jsc_exception_get_source_uri):
        * API/glib/JSCException.h: Added.
        * API/glib/JSCExceptionPrivate.h: Added.
        * API/glib/JSCGLibWrapperObject.h: Added.
        (JSC::JSCGLibWrapperObject::JSCGLibWrapperObject):
        (JSC::JSCGLibWrapperObject::~JSCGLibWrapperObject):
        (JSC::JSCGLibWrapperObject::object const):
        * API/glib/JSCValue.cpp: Added.
        (jscValueGetProperty):
        (jscValueSetProperty):
        (jscValueDispose):
        (jsc_value_class_init):
        (jscValueGetJSValue):
        (jscValueCreate):
        (jsc_value_get_context):
        (jsc_value_new_undefined):
        (jsc_value_is_undefined):
        (jsc_value_new_null):
        (jsc_value_is_null):
        (jsc_value_new_number):
        (jsc_value_is_number):
        (jsc_value_to_double):
        (jsc_value_to_int32):
        (jsc_value_new_boolean):
        (jsc_value_is_boolean):
        (jsc_value_to_boolean):
        (jsc_value_new_string):
        (jsc_value_is_string):
        (jsc_value_to_string):
        (jsc_value_new_array):
        (jsc_value_new_array_from_garray):
        (jsc_value_is_array):
        (jsc_value_new_object):
        (jsc_value_is_object):
        (jsc_value_object_is_instance_of):
        (jsc_value_object_set_property):
        (jsc_value_object_get_property):
        (jsc_value_object_set_property_at_index):
        (jsc_value_object_get_property_at_index):
        (jscValueCallFunction):
        (jsc_value_object_invoke_method):
        (jsc_value_object_define_property_data):
        (jsc_value_object_define_property_accessor):
        (jsc_value_new_function):
        (jsc_value_is_function):
        (jsc_value_function_call):
        (jsc_value_is_constructor):
        (jsc_value_constructor_call):
        * API/glib/JSCValue.h: Added.
        * API/glib/JSCValuePrivate.h: Added.
        * API/glib/JSCVersion.cpp: Added.
        (jsc_get_major_version):
        (jsc_get_minor_version):
        (jsc_get_micro_version):
        * API/glib/JSCVersion.h.in: Added.
        * API/glib/JSCVirtualMachine.cpp: Added.
        (addWrapper):
        (removeWrapper):
        (jscVirtualMachineSetContextGroup):
        (jscVirtualMachineEnsureContextGroup):
        (jscVirtualMachineDispose):
        (jsc_virtual_machine_class_init):
        (jscVirtualMachineGetOrCreate):
        (jscVirtualMachineGetContextGroup):
        (jscVirtualMachineAddContext):
        (jscVirtualMachineRemoveContext):
        (jscVirtualMachineGetContext):
        (jsc_virtual_machine_new):
        * API/glib/JSCVirtualMachine.h: Added.
        * API/glib/JSCVirtualMachinePrivate.h: Added.
        * API/glib/JSCWrapperMap.cpp: Added.
        (JSC::WrapperMap::WrapperMap):
        (JSC::WrapperMap::~WrapperMap):
        (JSC::WrapperMap::gobjectWrapper):
        (JSC::WrapperMap::unwrap):
        (JSC::WrapperMap::registerClass):
        (JSC::WrapperMap::createJSWrappper):
        (JSC::WrapperMap::jsWrapper const):
        (JSC::WrapperMap::wrappedObject const):
        * API/glib/JSCWrapperMap.h: Added.
        * API/glib/docs/jsc-glib-4.0-sections.txt: Added.
        * API/glib/docs/jsc-glib-4.0.types: Added.
        * API/glib/docs/jsc-glib-docs.sgml: Added.
        * API/glib/jsc.h: Added.
        * CMakeLists.txt:
        * GLib.cmake: Added.
        * JavaScriptCore.gir.in: Removed.
        * PlatformGTK.cmake:
        * PlatformWPE.cmake:
        * heap/Heap.cpp:
        (JSC::Heap::releaseDelayedReleasedObjects):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::releaseSoon):
        * javascriptcoregtk.pc.in:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildren):
        (JSC::JSGlobalObject::setWrapperMap):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::glibCallbackFunctionStructure const):
        (JSC::JSGlobalObject::glibWrapperObjectStructure const):
        (JSC::JSGlobalObject::wrapperMap const):

2018-03-21  Christopher Reid  <chris.reid@sony.com>

        Windows 64-bit build fix after r229767
        https://bugs.webkit.org/show_bug.cgi?id=183810

        Reviewed by Mark Lam.

        Removing an extra parameter in the call to m_assember::call.

        * assembler/MacroAssemblerX86_64.h:

2018-03-20  Dan Bernstein  <mitz@apple.com>

        [Xcode] JSVALUE_MODEL is unused
        https://bugs.webkit.org/show_bug.cgi?id=183809

        Reviewed by Tim Horton.

        * Configurations/JavaScriptCore.xcconfig: Removed the unused definition.

2018-03-20  Tim Horton  <timothy_horton@apple.com>

        Update the install name for JavaScriptCore when built with WK_ALTERNATE_FRAMEWORKS_DIR
        https://bugs.webkit.org/show_bug.cgi?id=183808
        <rdar://problem/38692079>

        Reviewed by Dan Bernstein.

        * Configurations/JavaScriptCore.xcconfig:

2018-03-20  Tim Horton  <timothy_horton@apple.com>

        Enable the minimal simulator feature flag when appropriate
        https://bugs.webkit.org/show_bug.cgi?id=183807

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2018-03-20  Saam Barati  <sbarati@apple.com>

        We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
        https://bugs.webkit.org/show_bug.cgi?id=183795
        <rdar://problem/38298694>

        Reviewed by JF Bastien.

        We were just assuming that the constants we were inserting were
        always exitOK=true. However, this breaks validation. The exitOK
        we emit for the constants in the NewArrayBuffer should respect
        the current exit state of the IR we've emitted. This is just IR
        bookkeeping since JSConstant is a non-exiting node.

        * dfg/DFGArgumentsEliminationPhase.cpp:

2018-03-20  Guillaume Emont  <guijemont@igalia.com>

        MIPS+Armv7 builds are broken since r229391
        https://bugs.webkit.org/show_bug.cgi?id=183474

        Reviewed by Yusuke Suzuki.

        Add missing armv7 and mips operations and fix arguments to a call to
        operationGetByValCell. This should fix compilation on MIPS and Armv7
        (though it does not implement the missing setupArguments stuff in
        CCallHelpers).

        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::swap):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::swap):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/FPRInfo.h:

2018-03-20  Tim Horton  <timothy_horton@apple.com>

        Add and adopt WK_PLATFORM_NAME and adjust default feature defines
        https://bugs.webkit.org/show_bug.cgi?id=183758
        <rdar://problem/38017644>

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2018-03-20  Mark Lam  <mark.lam@apple.com>

        Improve FunctionPtr and use it in the JIT CallRecord.
        https://bugs.webkit.org/show_bug.cgi?id=183756
        <rdar://problem/38641335>

        Reviewed by JF Bastien.

        1. FunctionPtr hold a C/C++ function pointer by default.  Change its default
           PtrTag to reflect that.

        2. Delete the FunctionPtr::value() method.  It is effectively a duplicate of
           executableAddress().

        3. Fix the FunctionPtr constructor that takes arbitrary pointers to be able to
           take "any" pointer.  "any" in this case means that the pointer may not be typed
           as a C/C++ function to the C++ compiler (due to upstream casting or usage of
           void* as a storage type), but it is still expected to be pointing to a C/C++
           function.

        4. Added a FunctionPtr constructor that takes another FunctionPtr.  This is a
           convenience constructor that lets us retag the underlying pointer.  The other
           FunctionPtr is still expected to point to a C/C++ function.

        5. Added PtrTag assertion placeholder functions to be implemented later.

        6. Change the JIT CallRecord to embed a FunctionPtr callee instead of a void* to
           pointer.  This improves type safety, and assists in getting pointer tagging
           right later.

        7. Added versions of JIT callOperations methods that will take a PtrTag.
           This is preparation for more more pointer tagging work later.

        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::linkCall):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::linkCall):
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::FunctionPtr::FunctionPtr):
        (JSC::FunctionPtr::operator bool const):
        (JSC::FunctionPtr::operator! const):
        (JSC::ReturnAddressPtr::ReturnAddressPtr):
        (JSC::MacroAssemblerCodePtr::retagged const):
        (JSC::MacroAssemblerCodeRef::retaggedCode const):
        (JSC::FunctionPtr::value const): Deleted.
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::linkCall):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::linkCall):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::callWithSlowPathReturnType):
        (JSC::MacroAssemblerX86_64::linkCall):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * ftl/FTLSlowPathCall.cpp:
        (JSC::FTL::SlowPathCallContext::makeCall):
        * ftl/FTLSlowPathCall.h:
        (JSC::FTL::callOperation):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::osrExitGenerationThunkGenerator):
        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/JIT.cpp:
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        (JSC::CallRecord::CallRecord):
        (JSC::JIT::appendCall):
        (JSC::JIT::appendCallWithSlowPathReturnType):
        (JSC::JIT::callOperation):
        (JSC::JIT::callOperationWithProfile):
        (JSC::JIT::callOperationWithResult):
        (JSC::JIT::callOperationNoExceptionCheck):
        (JSC::JIT::callOperationWithCallFrameRollbackOnException):
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        * jit/JITInlines.h:
        (JSC::JIT::emitNakedCall):
        (JSC::JIT::emitNakedTailCall):
        (JSC::JIT::appendCallWithExceptionCheck):
        (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
        (JSC::JIT::appendCallWithCallFrameRollbackOnException):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emitSlow_op_put_by_val):
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):
        * jit/SlowPathCall.h:
        (JSC::JITSlowPathCall::JITSlowPathCall):
        (JSC::JITSlowPathCall::call):
        * jit/ThunkGenerators.cpp:
        (JSC::nativeForGenerator):
        * runtime/PtrTag.h:
        (JSC::nextPtrTagID):
        (JSC::assertIsCFunctionPtr):
        (JSC::assertIsNullOrCFunctionPtr):
        (JSC::assertIsNotTagged):
        (JSC::assertIsTagged):
        (JSC::assertIsNullOrTagged):
        (JSC::assertIsTaggedWith):
        (JSC::assertIsNullOrTaggedWith):
        (JSC::uniquePtrTagID): Deleted.

2018-03-20  Stanislav Ocovaj  <stanislav.ocovaj@rt-rk.com>

        [MIPS] Optimize generated JIT code for loads/stores
        https://bugs.webkit.org/show_bug.cgi?id=183243

        Reviewed by Yusuke Suzuki.

        JIT generates three MIPS instructions for a load/store from/to an absolute address:

          lui adrTmpReg, address >> 16
          ori adrTmpReg, address & 0xffff
          lw dataReg, 0(adrTmpReg)

        Since load/store instructions on MIPS have a 16-bit offset, lower 16 bits of the address can
        be encoded into the load/store and ori instruction can be removed:

          lui adrTmpReg, (address + 0x8000) >> 16
          lw dataReg, (address & 0xffff)(adrTmpReg)

        Also, in loads/stores with BaseIndex address, the left shift can be omitted if address.scale is 0.

        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::add32):
        (JSC::MacroAssemblerMIPS::add64):
        (JSC::MacroAssemblerMIPS::or32):
        (JSC::MacroAssemblerMIPS::sub32):
        (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
        (JSC::MacroAssemblerMIPS::load8):
        (JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
        (JSC::MacroAssemblerMIPS::load32):
        (JSC::MacroAssemblerMIPS::store8):
        (JSC::MacroAssemblerMIPS::store32):
        (JSC::MacroAssemblerMIPS::branchTest8):
        (JSC::MacroAssemblerMIPS::branchAdd32):
        (JSC::MacroAssemblerMIPS::loadDouble):
        (JSC::MacroAssemblerMIPS::storeDouble):

2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG][FTL] Add vectorLengthHint for NewArray
        https://bugs.webkit.org/show_bug.cgi?id=183694

        Reviewed by Saam Barati.

        While the following code is a common, it is not so efficient.

        var array = [];
        for (...) {
            ...
            array.push(...);
        }

        The array is always allocated with 0 vector length. And it is eventually grown.

        We have ArrayAllocationProfile, and it tells us that the vector length hint for
        the allocated arrays. This hint is already used for NewArrayBuffer. This patch
        extends this support for NewArray DFG node.

        This patch improves Kraken/stanford-crypto-aes 4%.

                                      baseline                  patched

        stanford-crypto-aes        64.069+-1.352             61.589+-1.274           might be 1.0403x faster

        NewArray can be optimized.

                                                       baseline                  patched

        vector-length-hint-new-array               21.8157+-0.0882     ^     13.1764+-0.0942        ^ definitely 1.6557x faster
        vector-length-hint-array-constructor       21.9076+-0.0987     ?     22.1168+-0.4814        ?

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasVectorLengthHint):
        (JSC::DFG::Node::vectorLengthHint):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):

2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG][FTL] Make ArraySlice(0) code tight
        https://bugs.webkit.org/show_bug.cgi?id=183590

        Reviewed by Saam Barati.

        This patch tightens ArraySlice code, in particular, startIndex = 0 case.

        1. We support array.slice() call. This is a well-used way to clone array.
        For example, underscore.js uses this technique.

        2. We remove several checks if the given index value is a proven constant.

        * dfg/DFGBackwardsPropagationPhase.cpp:
        (JSC::DFG::BackwardsPropagationPhase::propagate):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitPopulateSliceIndex):
        (JSC::DFG::SpeculativeJIT::compileArraySlice):
        We can skip some of checks if the given value is a proven constant.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileArraySlice):
        Change below to belowOrEqual. It does not change meaning in the code. But it allows us
        to fold BelowEqual(0, x) to true.

2018-03-19  Yusuke Suzuki  <utatane.tea@gmail.com>

        Drop s_exceptionInstructions static initializer
        https://bugs.webkit.org/show_bug.cgi?id=183732

        Reviewed by Darin Adler.

        Make Instruction constructor constexpr to drop the static constructor
        of LLInt::Data::s_exceptionInstructions.

        * bytecode/Instruction.h:
        (JSC::Instruction::Instruction):

2018-03-19  Dan Bernstein  <mitz@apple.com>

        Investigate why __cpu_indicator_init is used
        https://bugs.webkit.org/show_bug.cgi?id=183736

        Reviewed by Tim Horton.

        __cpu_indicator_init, which is a global initializer, was included in JavaScriptCore because
        we were passing the -all_load option to the linker, causing it to bring in all members of
        every static library being linked in, including the compiler runtime library. We only need
        to load all members of WTF. The linker option for doing that is -force_load, and it requires
        a path to the library. To support building against libWTF.a built locally as well as against
        the copy that is in the SDK, we add a script build phase that palces a symbolic link to the
        appropriate libWTF.a under the DerivedSources directory, and pass the path to that symlink
        to the linker. Also, while cleaning up linker flags, make OTHER_LDFLAGS_HIDE_SYMBOLS less
        verbose by eliminating every other -Wl, remove redundant -lobjc (libobjc is already listed
        in the Link Binary With Libraries build phase), remove long-unsupported -Y,3, and stop
        reexporting libobjc.

        * Configurations/JavaScriptCore.xcconfig:
        * JavaScriptCore.xcodeproj/project.pbxproj:

2018-03-19  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, another quick fix for r229699

        Restricts ENABLE_WEB_AUTHN to only macOS and iOS.

        * Configurations/FeatureDefines.xcconfig:

2018-03-19  Mark Lam  <mark.lam@apple.com>

        FunctionPtr should be passed by value.
        https://bugs.webkit.org/show_bug.cgi?id=183746
        <rdar://problem/38625311>

        Reviewed by JF Bastien.

        It's meant to be an encapsulation of a C/C++ function pointer.  There are cases
        where we use it to pass JIT compiled code (e.g. the VM thunks/stubs), but they are
        treated as if they are C/C++ functions.

        Regardless, there's no need to pass it by reference.

        * assembler/MacroAssemblerCodeRef.h:
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::appendCall):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::appendCall):
        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
        * jit/JIT.h:
        (JSC::JIT::appendCall):
        (JSC::JIT::appendCallWithSlowPathReturnType):
        * jit/JITInlines.h:
        (JSC::JIT::appendCallWithExceptionCheck):
        (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType):
        (JSC::JIT::appendCallWithCallFrameRollbackOnException):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):

2018-03-15  Ross Kirsling  <ross.kirsling@sony.com>

        Fix MSVC run-time check after r229391. 
        https://bugs.webkit.org/show_bug.cgi?id=183673

        Reviewed by Keith Miller.

        Replaces attempted fix from r229424/r229432.
        Apparently MSVC doesn't like it when a zero-length std::array is defined without explicit braces.

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::clampArrayToSize):

2018-03-15  Tim Horton  <timothy_horton@apple.com>

        Add and adopt WK_ALTERNATE_FRAMEWORKS_DIR in ANGLE
        https://bugs.webkit.org/show_bug.cgi?id=183675
        <rdar://problem/38515281>

        Reviewed by Dan Bernstein.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        Don't install the JSC alias if we're installing to an alternate location.
        This should have been a part of r229637.

2018-03-15  Tim Horton  <timothy_horton@apple.com>

        Add and adopt WK_ALTERNATE_FRAMEWORKS_DIR in JavaScriptCore
        https://bugs.webkit.org/show_bug.cgi?id=183649
        <rdar://problem/38480526>

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:
        * JavaScriptCore.xcodeproj/project.pbxproj:

2018-03-14  Mark Lam  <mark.lam@apple.com>

        Enhance the MacroAssembler and LinkBuffer to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=183623
        <rdar://problem/38443314>

        Reviewed by Michael Saboff.

        1. Added a PtrTag argument to indirect call() and indirect jump() MacroAssembler
           emitters to support pointer profiling.

        2. Also added tagPtr(), untagPtr(), and removePtrTag() placeholder methods.

        3. Added a PtrTag to LinkBuffer finalizeCodeWithoutDisassembly() and clients.

        4. Updated clients to pass a PtrTag.  For the most part, I just apply NoPtrTag as
           a placeholder until we have time to analyze what pointer profile each client
           site has later.
    
        5. Apply PtrTags to the YarrJIT.

        * assembler/ARM64Assembler.h:
        (JSC::ARM64Assembler::linkJumpOrCall):
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::getLinkerAddress):
        (JSC::AbstractMacroAssembler::tagPtr):
        (JSC::AbstractMacroAssembler::untagPtr):
        (JSC::AbstractMacroAssembler::removePtrTag):
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
        * assembler/LinkBuffer.h:
        (JSC::LinkBuffer::link):
        (JSC::LinkBuffer::locationOfNearCall):
        (JSC::LinkBuffer::locationOf):
        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::jump):
        (JSC::MacroAssemblerARM::call):
        (JSC::MacroAssemblerARM::readCallTarget):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::call):
        (JSC::MacroAssemblerARM64::jump):
        (JSC::MacroAssemblerARM64::readCallTarget):
        (JSC::MacroAssemblerARM64::linkCall):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::jump):
        (JSC::MacroAssemblerARMv7::relativeTableJump):
        (JSC::MacroAssemblerARMv7::call):
        (JSC::MacroAssemblerARMv7::readCallTarget):
        * assembler/MacroAssemblerCodeRef.cpp:
        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::FunctionPtr::FunctionPtr):
        (JSC::FunctionPtr::value const):
        (JSC::MacroAssemblerCodePtr:: const):
        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
        (JSC::MacroAssemblerCodeRef::retaggedCode const):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::jump):
        (JSC::MacroAssemblerMIPS::call):
        (JSC::MacroAssemblerMIPS::readCallTarget):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::call):
        (JSC::MacroAssemblerX86::jump):
        (JSC::MacroAssemblerX86::readCallTarget):
        * assembler/MacroAssemblerX86Common.cpp:
        (JSC::MacroAssembler::probe):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::jump):
        (JSC::MacroAssemblerX86Common::call):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::call):
        (JSC::MacroAssemblerX86_64::jump):
        (JSC::MacroAssemblerX86_64::readCallTarget):
        * assembler/testmasm.cpp:
        (JSC::compile):
        (JSC::invoke):
        * b3/B3Compile.cpp:
        (JSC::B3::compile):
        * b3/B3LowerMacros.cpp:
        * b3/air/AirCCallSpecial.cpp:
        (JSC::B3::Air::CCallSpecial::generate):
        * b3/air/testair.cpp:
        * b3/testb3.cpp:
        (JSC::B3::invoke):
        (JSC::B3::testInterpreter):
        (JSC::B3::testEntrySwitchSimple):
        (JSC::B3::testEntrySwitchNoEntrySwitch):
        (JSC::B3::testEntrySwitchWithCommonPaths):
        (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
        (JSC::B3::testEntrySwitchLoop):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/AccessCaseSnippetParams.cpp:
        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
        * bytecode/InlineAccess.cpp:
        (JSC::linkCodeInline):
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compileExceptionHandlers):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::compileFunction):
        (JSC::DFG::JITCompiler::noticeCatchEntrypoint):
        * dfg/DFGJITCompiler.h:
        (JSC::DFG::JITCompiler::appendCall):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::emitRestoreArguments):
        (JSC::DFG::OSRExit::compileOSRExit):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::handleExitCounts):
        (JSC::DFG::osrWriteBarrier):
        (JSC::DFG::adjustAndJumpToTarget):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitThunkGenerator):
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * ftl/FTLCompile.cpp:
        (JSC::FTL::compile):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalizeCommon):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::generate):
        * ftl/FTLLink.cpp:
        (JSC::FTL::link):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        (JSC::FTL::compileFTLOSRExit):
        * ftl/FTLSlowPathCall.cpp:
        (JSC::FTL::SlowPathCallContext::makeCall):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::osrExitGenerationThunkGenerator):
        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::callExceptionFuzz):
        (JSC::AssemblyHelpers::debugCall):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::ensureShadowChickenPacket):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::jumpToExceptionHandler):
        * jit/ExecutableAllocator.cpp:
        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::link):
        (JSC::JIT::privateCompileExceptionHandlers):
        * jit/JIT.h:
        (JSC::JIT::appendCall):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        * jit/JITStubRoutine.h:
        * jit/Repatch.cpp:
        (JSC::readCallTarget):
        (JSC::appropriateOptimizingPutByIdFunction):
        (JSC::linkPolymorphicCall):
        (JSC::resetPutByID):
        * jit/SlowPathCall.h:
        (JSC::JITSlowPathCall::call):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        (JSC::SpecializedThunkJIT::callDoubleToDouble):
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::slowPathFor):
        (JSC::linkCallThunkGenerator):
        (JSC::linkPolymorphicCallThunkGenerator):
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::arityFixupGenerator):
        (JSC::unreachableGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        (JSC::LLInt::functionForCallEntryThunkGenerator):
        (JSC::LLInt::functionForConstructEntryThunkGenerator):
        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
        (JSC::LLInt::evalEntryThunkGenerator):
        (JSC::LLInt::programEntryThunkGenerator):
        (JSC::LLInt::moduleProgramEntryThunkGenerator):
        * runtime/PtrTag.h:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::addCall):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::complete):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
        (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
        (JSC::Yarr::YarrGenerator::generateTryReadUnicodeCharacterHelper):
        (JSC::Yarr::YarrGenerator::generateEnter):
        (JSC::Yarr::YarrGenerator::YarrGenerator):
        (JSC::Yarr::YarrGenerator::compile):
        (JSC::Yarr::jitCompile):
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrCodeBlock::execute):

2018-03-14  Caitlin Potter  <caitp@igalia.com>

        [JSC] fix order of evaluation for ClassDefinitionEvaluation
        https://bugs.webkit.org/show_bug.cgi?id=183523

        Reviewed by Keith Miller.

        Computed property names need to be evaluated in source order during class
        definition evaluation, as it's observable (and specified to work this way).

        This change improves compatibility with Chromium.

        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::emitDefineClassElements):
        * bytecompiler/NodesCodegen.cpp:
        (JSC::PropertyListNode::emitBytecode):
        (JSC::ClassExprNode::emitBytecode):
        * parser/ASTBuilder.h:
        (JSC::ASTBuilder::createClassExpr):
        (JSC::ASTBuilder::createGetterOrSetterProperty):
        (JSC::ASTBuilder::createProperty):
        * parser/NodeConstructors.h:
        (JSC::PropertyNode::PropertyNode):
        (JSC::ClassExprNode::ClassExprNode):
        * parser/Nodes.cpp:
        (JSC::PropertyListNode::hasStaticallyNamedProperty):
        * parser/Nodes.h:
        (JSC::PropertyNode::isClassProperty const):
        (JSC::PropertyNode::isStaticClassProperty const):
        (JSC::PropertyNode::isInstanceClassProperty const):
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseClass):
        (JSC::Parser<LexerType>::parseProperty):
        (JSC::Parser<LexerType>::parseGetterSetter):
        * parser/Parser.h:
        * parser/SyntaxChecker.h:
        (JSC::SyntaxChecker::createClassExpr):
        (JSC::SyntaxChecker::createProperty):
        (JSC::SyntaxChecker::createGetterOrSetterProperty):

2018-03-14  Keith Miller  <keith_miller@apple.com>

        Move jsc CLI breakpoint function to $vm
        https://bugs.webkit.org/show_bug.cgi?id=183512

        Reviewed by Yusuke Suzuki.

        * jsc.cpp:
        (GlobalObject::finishCreation):
        (functionBreakpoint): Deleted.
        * tools/JSDollarVM.cpp:
        (JSC::functionBreakpoint):
        (JSC::JSDollarVM::finishCreation):

2018-03-14  Tim Horton  <timothy_horton@apple.com>

        Fix the build after r229567

        * Configurations/FeatureDefines.xcconfig:

2018-03-12  Mark Lam  <mark.lam@apple.com>

        Gardening: speculative build fix for WinCairo.
        https://bugs.webkit.org/show_bug.cgi?id=183573

        Not reviewed.

        * runtime/NativeFunction.h:
        (JSC::TaggedNativeFunction::TaggedNativeFunction):

2018-03-12  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, fix obsolete ASSERT
        https://bugs.webkit.org/show_bug.cgi?id=183310

        Now NewObject can be conereted from CallObjectConstructor and CreateThis.

        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToNewObject):

2018-03-12  Tim Horton  <timothy_horton@apple.com>

        Stop using SDK conditionals to control feature definitions
        https://bugs.webkit.org/show_bug.cgi?id=183430
        <rdar://problem/38251619>

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:
        * Configurations/WebKitTargetConditionals.xcconfig: Renamed.

2018-03-12  Yoav Weiss  <yoav@yoav.ws>

        Runtime flag for link prefetch and remove link subresource.
        https://bugs.webkit.org/show_bug.cgi?id=183540

        Reviewed by Chris Dumez.

        Remove the LINK_PREFETCH build time flag.

        * Configurations/FeatureDefines.xcconfig:

2018-03-12  Mark Lam  <mark.lam@apple.com>

        Gardening: speculative build fix for Windows.
        https://bugs.webkit.org/show_bug.cgi?id=183573

        Not reviewed.

        * runtime/NativeFunction.h:
        (JSC::TaggedNativeFunction::TaggedNativeFunction):

2018-03-12  Mark Lam  <mark.lam@apple.com>

        Add another PtrTag.
        https://bugs.webkit.org/show_bug.cgi?id=183580
        <rdar://problem/38390584>

        Reviewed by Keith Miller.

        * runtime/PtrTag.h:

2018-03-12  Mark Lam  <mark.lam@apple.com>

        Make a NativeFunction into a class to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=183573
        <rdar://problem/38384697>

        Reviewed by Filip Pizlo.

        1. NativeFunction is now a class, and introducing RawNativeFunction and
           TaggedNativeFunction.

           RawNativeFunction is the raw pointer type (equivalent
           to the old definition of NativeFunction).  This is mainly used for underlying
           storage inside the NativeFunction class, and also for global data tables that
           cannot embed non-trivially constructed objects.

           NativeFunction's role is mainly to encapsulate a pointer to a C function that
           we pass into the VM.

           TaggedNativeFunction encapsulates the tagged version of a pointer to a C
           function that we track in the VM.

        2. Added a convenience constructor for TrustedImmPtr so that we don't have to
           cast function pointers to void* anymore when constructing a TrustedImmPtr.

        3. Removed the unused CALL_RETURN macro in CommonSlowPaths.cpp.

        4. Added more PtrTag utility functions.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        * create_hash_table:
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeCall):
        (JSC::Interpreter::executeConstruct):
        * interpreter/InterpreterInlines.h:
        (JSC::Interpreter::getOpcodeID):
        * jit/JITThunks.cpp:
        (JSC::JITThunks::hostFunctionStub):
        * jit/JITThunks.h:
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setUpCall):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter.cpp:
        (JSC::CLoop::execute):
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/ast.rb:
        * runtime/CallData.h:
        * runtime/CommonSlowPaths.cpp:
        * runtime/ConstructData.h:
        * runtime/InternalFunction.h:
        (JSC::InternalFunction::nativeFunctionFor):
        * runtime/JSCell.cpp:
        (JSC::JSCell::getCallData):
        (JSC::JSCell::getConstructData):
        * runtime/JSFunction.h:
        * runtime/JSFunctionInlines.h:
        (JSC::JSFunction::nativeFunction):
        (JSC::JSFunction::nativeConstructor):
        (JSC::isHostFunction):
        * runtime/Lookup.h:
        (JSC::HashTableValue::function const):
        (JSC::HashTableValue::accessorGetter const):
        (JSC::HashTableValue::accessorSetter const):
        (JSC::nonCachingStaticFunctionGetter):
        * runtime/NativeExecutable.cpp:
        (JSC::NativeExecutable::create):
        (JSC::NativeExecutable::NativeExecutable):
        * runtime/NativeExecutable.h:
        * runtime/NativeFunction.h: Added.
        (JSC::NativeFunction::NativeFunction):
        (JSC::NativeFunction::operator intptr_t const):
        (JSC::NativeFunction::operator bool const):
        (JSC::NativeFunction::operator! const):
        (JSC::NativeFunction::operator== const):
        (JSC::NativeFunction::operator!= const):
        (JSC::NativeFunction::operator()):
        (JSC::NativeFunction::rawPointer const):
        (JSC::NativeFunctionHash::hash):
        (JSC::NativeFunctionHash::equal):
        (JSC::TaggedNativeFunction::TaggedNativeFunction):
        (JSC::TaggedNativeFunction::operator bool const):
        (JSC::TaggedNativeFunction::operator! const):
        (JSC::TaggedNativeFunction::operator== const):
        (JSC::TaggedNativeFunction::operator!= const):
        (JSC::TaggedNativeFunction::operator()):
        (JSC::TaggedNativeFunction::operator NativeFunction):
        (JSC::TaggedNativeFunction::rawPointer const):
        (JSC::TaggedNativeFunctionHash::hash):
        (JSC::TaggedNativeFunctionHash::equal):
        * runtime/PtrTag.h:
        (JSC::tagCFunctionPtr):
        (JSC::untagCFunctionPtr):
        * runtime/VM.h:
        (JSC::VM::targetMachinePCForThrowOffset): Deleted.

2018-03-12  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, fix simple goof that was causing 32-bit DFG crashes.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
        https://bugs.webkit.org/show_bug.cgi?id=183310

        Reviewed by Filip Pizlo.

        This patch implements CreateThis -> NewObject conversion in AI if the given function is constant.
        This contributes to 6% win in Octane/raytrace.

                                        baseline                  patched

            raytrace       x2       1.19915+-0.01862    ^     1.13156+-0.01589       ^ definitely 1.0597x faster

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):

2018-03-11  Wenson Hsieh  <wenson_hsieh@apple.com>

        Disable Sigill crash analyzer on watchOS
        https://bugs.webkit.org/show_bug.cgi?id=183548
        <rdar://problem/38338032>

        Reviewed by Mark Lam.

        Sigill is not supported on watchOS.

        * runtime/Options.cpp:
        (JSC::overrideDefaults):

2018-03-09  Filip Pizlo  <fpizlo@apple.com>

        Split DirectArguments into JSValueOOB and JSValueStrict parts
        https://bugs.webkit.org/show_bug.cgi?id=183458

        Reviewed by Yusuke Suzuki.
        
        Our Spectre plan for JSValue objects is to allow inline JSValue stores and loads guarded by
        unmitigated structure checks. This works because objects reachable from JSValues (i.e. JSValue
        objects, like String, Symbol, and any descendant of JSObject) will only contain fields that it's OK
        to read and write within a Spectre mitigation window. Writes are important, because within the
        window, a write could appear to be made speculatively and rolled out later. This means that:
        
        - JSValue objects cannot have lengths, masks, or anything else inline.
        
        - JSValue objects cannot have an inline type that is used as part of a Spectre mitigation for a type
          check, unless that type is in the form of a poison key.
        
        This means that the dynamic poisoning that I previously landed for DirectArguments is wrong. It also
        means that it's wrong for DirectArguments to have an inline length.
        
        This changes DirectArguments to use poisoning according to the universal formula:
        
        - The random accessed portions are out-of-line, pointed to by a poisoned pointer.
        
        - No inline length.
        
        Surprisingly, this is perf-neutral. It's probably perf-neutral because our compiler optimizations
        amortize whatever cost there was.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateWithGuard):
        * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
        (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
        * dfg/DFGCallCreateDirectArgumentsWithKnownLengthSlowPathGenerator.h: Added.
        (JSC::DFG::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetFromArguments):
        (JSC::DFG::SpeculativeJIT::compilePutToArguments):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetFromArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutToArguments):
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedHeapCell):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoison): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnLoadedType): Deleted.
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnType): Deleted.
        * heap/SecurityKind.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_put_to_arguments):
        (JSC::JIT::emitDirectArgumentsGetByVal):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_get_from_arguments):
        (JSC::JIT::emit_op_put_to_arguments):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::DirectArguments):
        (JSC::DirectArguments::createUninitialized):
        (JSC::DirectArguments::create):
        (JSC::DirectArguments::createByCopying):
        (JSC::DirectArguments::estimatedSize):
        (JSC::DirectArguments::visitChildren):
        (JSC::DirectArguments::overrideThings):
        (JSC::DirectArguments::copyToArguments):
        (JSC::DirectArguments::mappedArgumentsSize):
        * runtime/DirectArguments.h:
        * runtime/JSCPoison.h:
        * runtime/JSLexicalEnvironment.h:
        * runtime/JSSymbolTableObject.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [B3] Above/Below should be strength-reduced for comparison with 0
        https://bugs.webkit.org/show_bug.cgi?id=183543

        Reviewed by Filip Pizlo.

        Above(0, x) and BelowEqual(0, x) can be converted to constants false and true respectively.
        This can be seen in ArraySlice(0) case: `Select(Above(0, length), length, 0)` this should
        be converted to `0`. This patch adds such a folding to comparisons.

        We also fix B3ReduceStrength issue creating an orphan value. If a flipped value is folded to
        a constant, we do not insert flipped value and make it an orphan. This issue causes JSC test
        failure with this B3Const32/64Value change. With this patch, we create a flipped value only
        when we fail to fold it to a constant.

        * b3/B3Const32Value.cpp:
        (JSC::B3::Const32Value::lessThanConstant const):
        (JSC::B3::Const32Value::greaterThanConstant const):
        (JSC::B3::Const32Value::lessEqualConstant const):
        (JSC::B3::Const32Value::greaterEqualConstant const):
        (JSC::B3::Const32Value::aboveConstant const):
        (JSC::B3::Const32Value::belowConstant const):
        (JSC::B3::Const32Value::aboveEqualConstant const):
        (JSC::B3::Const32Value::belowEqualConstant const):
        * b3/B3Const64Value.cpp:
        (JSC::B3::Const64Value::lessThanConstant const):
        (JSC::B3::Const64Value::greaterThanConstant const):
        (JSC::B3::Const64Value::lessEqualConstant const):
        (JSC::B3::Const64Value::greaterEqualConstant const):
        (JSC::B3::Const64Value::aboveConstant const):
        (JSC::B3::Const64Value::belowConstant const):
        (JSC::B3::Const64Value::aboveEqualConstant const):
        (JSC::B3::Const64Value::belowEqualConstant const):
        * b3/B3ReduceStrength.cpp:
        * b3/testb3.cpp:
        (JSC::B3::int64Operands):
        (JSC::B3::int32Operands):

2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
        https://bugs.webkit.org/show_bug.cgi?id=181848

        Reviewed by Sam Weinig.

        In r181535, we support `string.match(/nonglobal/)` code. However, `string.match(/global/g)` is not
        optimized since it sets `lastIndex` value before performing RegExp operation.

        This patch optimizes the above "with a global flag" case by emitting `SetRegExpObjectLastIndex` properly.
        RegExpMatchFast is converted to SetRegExpObjectLastIndex and RegExpMatchFastGlobal. The latter node
        just holds RegExp (not RegExpObject) cell so that it can offer a chance to make NewRegexp PhantomNewRegexp
        in object allocation sinking phase.

        Added microbenchmarks shows that this patch makes NewRegexp PhantomNewRegexp even if the given RegExp
        has a global flag. And it improves the performance.

                                      baseline                  patched

        regexp-u-global-es5       44.1298+-4.6128     ^     33.7920+-2.0110        ^ definitely 1.3059x faster
        regexp-u-global-es6      182.3272+-2.2861     ^    154.3414+-7.6769        ^ definitely 1.1813x faster

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::convertToRegExpMatchFastGlobal):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasHeapPrediction):
        (JSC::DFG::Node::hasCellOperand):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpMatchFastGlobal):
        * runtime/RegExpObject.cpp:
        (JSC::collectMatches): Deleted.
        * runtime/RegExpObject.h:
        * runtime/RegExpObjectInlines.h:
        (JSC::RegExpObject::execInline):
        (JSC::RegExpObject::matchInline):
        (JSC::advanceStringUnicode):
        (JSC::collectMatches):
        (JSC::RegExpObject::advanceStringUnicode): Deleted.
        * runtime/RegExpPrototype.cpp:
        (JSC::advanceStringIndex):

2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>

        B3::reduceStrength should canonicalize integer comparisons
        https://bugs.webkit.org/show_bug.cgi?id=150958

        Reviewed by Filip Pizlo.

        This patch sorts operands of comparisons by flipping opcode. For example, `Above(0, @2)` is
        converted to `Below(@2, 0)`. This sorting is the same to handleCommutativity rule. Since we
        canonicalize comparisons to have constant value at least on the right hand side, we can
        remove pattern matchings checking leftImm in B3LowerToAir.

        Since this flipping changes the opcode of the value, to achieve safely, we just create a
        new value which has flipped opcode and swapped operands. If we can fold it to a constant,
        we replace m_value with this constant. If we fail to fold it to constant, we replace
        m_value with the flipped one.

        These comparisons are already handled in testb3.

        * b3/B3LowerToAir.cpp:
        * b3/B3ReduceStrength.cpp:

2018-03-09  Mark Lam  <mark.lam@apple.com>

        offlineasm should reset the Assembler's working state before doing another pass for a new target.
        https://bugs.webkit.org/show_bug.cgi?id=183538
        <rdar://problem/38325955>

        Reviewed by Michael Saboff.

        * llint/LowLevelInterpreter.cpp:
        * offlineasm/asm.rb:
        * offlineasm/cloop.rb:

2018-03-09  Brian Burg  <bburg@apple.com>

        Web Inspector: there should only be one way for async backend commands to send failure
        https://bugs.webkit.org/show_bug.cgi?id=183524

        Reviewed by Timothy Hatcher.

        If this is an async command, errors should be reported with BackendDispatcher::CallbackBase::sendFailure.
        To avoid mixups, don't include the ErrorString out-parameter in generated async command signatures.
        This change only affects interfaces generated for C++ backend dispatchers.

        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
        (CppBackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
        * inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:

2018-03-09  Mark Lam  <mark.lam@apple.com>

        Build fix after r229476.
        https://bugs.webkit.org/show_bug.cgi?id=183488

        Not reviewed.

        * runtime/StackAlignment.h:

2018-03-09  Mark Lam  <mark.lam@apple.com>

        [Re-landing] Add support for ARM64E.
        https://bugs.webkit.org/show_bug.cgi?id=183398
        <rdar://problem/38212621>

        Reviewed by Michael Saboff.

        * assembler/MacroAssembler.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/backends.rb:

2018-03-09  Mark Lam  <mark.lam@apple.com>

        [Re-landing] Prepare LLInt code to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=183387
        <rdar://problem/38199678>

        Reviewed by JF Bastien.

        1. Introduced PtrTag enums for supporting pointer profiling later.

        2. Also introduced tagging, untagging, retagging, and tag removal placeholder
           template functions for the same purpose.

        3. Prepare the offlineasm for supporting pointer profiling later.

        4. Tagged some pointers in LLInt asm code.  Currently, these should have no
           effect on behavior.

        5. Removed returnToThrowForThrownException() because it is not used anywhere.

        6. Added the offlineasm folder to JavaScriptCore Xcode project so that it's
           easier to view and edit these files in Xcode.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::unlink):
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::returnToThrowForThrownException): Deleted.
        * llint/LLIntExceptions.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/LLIntPCRanges.h:
        (JSC::LLInt::isLLIntPC):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::handleHostCall):
        (JSC::LLInt::setUpCall):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/ast.rb:
        * offlineasm/instructions.rb:
        * offlineasm/risc.rb:
        * runtime/PtrTag.h: Added.
        (JSC::uniquePtrTagID):
        (JSC::ptrTag):
        (JSC::tagCodePtr):
        (JSC::untagCodePtr):
        (JSC::retagCodePtr):
        (JSC::removeCodePtrTag):

2018-03-09  Mark Lam  <mark.lam@apple.com>

        Remove unused LLINT_STATS feature.
        https://bugs.webkit.org/show_bug.cgi?id=183522
        <rdar://problem/38313139>

        Rubber-stamped by Keith Miller.

        We haven't used this in a while, and it is one more option that makes offlineasm
        build slower.  We can always re-introduce this later if we need it.

        * jsc.cpp:
        * llint/LLIntCommon.h:
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        (JSC::LLInt::Data::finalizeStats): Deleted.
        (JSC::LLInt::compareStats): Deleted.
        (JSC::LLInt::Data::dumpStats): Deleted.
        (JSC::LLInt::Data::ensureStats): Deleted.
        (JSC::LLInt::Data::loadStats): Deleted.
        (JSC::LLInt::Data::resetStats): Deleted.
        (JSC::LLInt::Data::saveStats): Deleted.
        * llint/LLIntData.h:
        (): Deleted.
        (JSC::LLInt::Data::opcodeStats): Deleted.
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntSlowPaths.cpp:
        * llint/LLIntSlowPaths.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/Options.cpp:
        (JSC::Options::isAvailable):
        (JSC::recomputeDependentOptions):
        * runtime/Options.h:
        * runtime/TestRunnerUtils.cpp:
        (JSC::finalizeStatsAtEndOfTesting):

2018-03-09  Michael Saboff  <msaboff@apple.com>

        Relanding "testmasm crashes in testBranchTruncateDoubleToInt32() on ARM64"
        https://bugs.webkit.org/show_bug.cgi?id=183488

        It applied and built just fine locally.

        * assembler/testmasm.cpp:
        (JSC::testBranchTruncateDoubleToInt32):

2018-03-09  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, remove WebAssemblyFunctionType
        https://bugs.webkit.org/show_bug.cgi?id=183429

        Drop WebAssemblyFunctionType since it is no longer used. This breaks
        JSCast assumption that all the derived classes of JSFunction use
        JSFunctionType. We also add ASSERT for JSFunction::finishCreation.

        * runtime/JSFunction.cpp:
        (JSC::JSFunction::finishCreation):
        * runtime/JSType.h:
        * wasm/js/WebAssemblyFunction.cpp:
        (JSC::WebAssemblyFunction::createStructure):
        * wasm/js/WebAssemblyFunction.h:

2018-03-09  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r229446.

        This change relies on changes that have been rolled out.

        Reverted changeset:

        "testmasm crashes in testBranchTruncateDoubleToInt32() on
        ARM64"
        https://bugs.webkit.org/show_bug.cgi?id=183488
        https://trac.webkit.org/changeset/229446

2018-03-08  Chris Dumez  <cdumez@apple.com>

        Safari not handling undefined global variables with same name as element Id correctly.
        https://bugs.webkit.org/show_bug.cgi?id=183087
        <rdar://problem/37927596>

        Reviewed by Ryosuke Niwa.

        global variables (var foo;) should not be hidden by:
        - Named properties
        - Properties on the prototype chain

        Therefore, we now have JSGlobalObject::addVar() call JSGlobalObject::addGlobalVar()
        if !hasOwnProperty() instead of !hasProperty.

        This aligns our behavior with Chrome and Firefox.

        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::addVar):

2018-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r229354 and r229364.
        https://bugs.webkit.org/show_bug.cgi?id=183492

        Breaks internal builds (Requested by ryanhaddad on #webkit).

        Reverted changesets:

        "Prepare LLInt code to support pointer profiling."
        https://bugs.webkit.org/show_bug.cgi?id=183387
        https://trac.webkit.org/changeset/229354

        "Add support for ARM64E."
        https://bugs.webkit.org/show_bug.cgi?id=183398
        https://trac.webkit.org/changeset/229364

2018-03-08  Michael Saboff  <msaboff@apple.com>

        testmasm crashes in testBranchTruncateDoubleToInt32() on ARM64
        https://bugs.webkit.org/show_bug.cgi?id=183488

        Reviewed by Mark Lam.

        Using stackAlignmentBytes() will keep the stack properly aligned.

        * assembler/testmasm.cpp:
        (JSC::testBranchTruncateDoubleToInt32):

2018-03-08  Michael Saboff  <msaboff@apple.com>

        Emit code to zero the stack frame on function entry
        Nhttps://bugs.webkit.org/show_bug.cgi?id=183391

        Reviewed by Mark Lam.

        Added code to zero incoming stack frame behind a new JSC option, zeroStackFrame.
        The default setting of the option is off.

        Did some minor refactoring of the YarrJIT stack alignment code.

        * b3/air/AirCode.cpp:
        (JSC::B3::Air::defaultPrologueGenerator):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::compile):
        (JSC::DFG::JITCompiler::compileFunction):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrEntryThunkGenerator):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::lower):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::clearStackFrame):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        * llint/LowLevelInterpreter.asm:
        * runtime/Options.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::ialignCallFrameSizeInBytesnitCallFrame):
        (JSC::Yarr::YarrGenerator::initCallFrame):
        (JSC::Yarr::YarrGenerator::removeCallFrame):

2018-03-08  Keith Miller  <keith_miller@apple.com>

        Unreviewed, another attempt at fixing the Windows build.
        I guess the pragma must be outside the function...

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::clampArrayToSize):

2018-03-08  Keith Miller  <keith_miller@apple.com>

        Unreviewed, one last try at fixing the windows build before rollout.

        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::clampArrayToSize):

2018-03-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Optimize inherits<T> if T is final type
        https://bugs.webkit.org/show_bug.cgi?id=183435

        Reviewed by Mark Lam.

        If the type T is a final type (`std::is_final<T>::value == true`), there is no
        classes which is derived from T. It means that `jsDynamicCast<T>` only needs
        to check the given cell's `classInfo(vm)` is `T::info()`.

        This patch adds a new specialization for jsDynamicCast<T> / inherits<T> for a
        final type. And we also add `final` annotations to JS cell types in JSC. This
        offers,

        1. Readability. If the given class is annotated with `final`, we do not need to
        consider about the derived classes of T.

        2. Static Checking. If your class is not intended to be used as a base class, attaching
        `final` can ensure this invariant.

        3. Performance. jsDynamicCast<T> and inherits<T> can be optimized and the code size should
        be smaller.

        * API/JSCallbackConstructor.h:
        (JSC::JSCallbackConstructor::create): Deleted.
        (JSC::JSCallbackConstructor::classRef const): Deleted.
        (JSC::JSCallbackConstructor::callback const): Deleted.
        (JSC::JSCallbackConstructor::createStructure): Deleted.
        (JSC::JSCallbackConstructor::constructCallback): Deleted.
        * API/JSCallbackFunction.h:
        (JSC::JSCallbackFunction::createStructure): Deleted.
        (JSC::JSCallbackFunction::functionCallback): Deleted.
        * API/JSCallbackObject.h:
        (JSC::JSCallbackObject::create): Deleted.
        (JSC::JSCallbackObject::destroy): Deleted.
        (JSC::JSCallbackObject::classRef const): Deleted.
        (JSC::JSCallbackObject::getPrivateProperty const): Deleted.
        (JSC::JSCallbackObject::setPrivateProperty): Deleted.
        (JSC::JSCallbackObject::deletePrivateProperty): Deleted.
        (JSC::JSCallbackObject::visitChildren): Deleted.
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setConstantRegisters):
        * bytecode/ExecutableToCodeBlockEdge.h:
        (JSC::ExecutableToCodeBlockEdge::subspaceFor): Deleted.
        (JSC::ExecutableToCodeBlockEdge::codeBlock const): Deleted.
        (JSC::ExecutableToCodeBlockEdge::unwrap): Deleted.
        * bytecode/FunctionCodeBlock.h:
        (JSC::FunctionCodeBlock::subspaceFor): Deleted.
        (JSC::FunctionCodeBlock::create): Deleted.
        (JSC::FunctionCodeBlock::createStructure): Deleted.
        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
        * debugger/DebuggerScope.h:
        (JSC::DebuggerScope::createStructure): Deleted.
        (JSC::DebuggerScope::iterator::iterator): Deleted.
        (JSC::DebuggerScope::iterator::get): Deleted.
        (JSC::DebuggerScope::iterator::operator++): Deleted.
        (JSC::DebuggerScope::iterator::operator== const): Deleted.
        (JSC::DebuggerScope::iterator::operator!= const): Deleted.
        (JSC::DebuggerScope::isValid const): Deleted.
        (JSC::DebuggerScope::jsScope const): Deleted.
        * inspector/JSInjectedScriptHost.h:
        (Inspector::JSInjectedScriptHost::createStructure): Deleted.
        (Inspector::JSInjectedScriptHost::create): Deleted.
        (Inspector::JSInjectedScriptHost::impl const): Deleted.
        * inspector/JSInjectedScriptHostPrototype.h:
        (Inspector::JSInjectedScriptHostPrototype::create): Deleted.
        (Inspector::JSInjectedScriptHostPrototype::createStructure): Deleted.
        (Inspector::JSInjectedScriptHostPrototype::JSInjectedScriptHostPrototype): Deleted.
        * inspector/JSJavaScriptCallFrame.h:
        (Inspector::JSJavaScriptCallFrame::createStructure): Deleted.
        (Inspector::JSJavaScriptCallFrame::create): Deleted.
        (Inspector::JSJavaScriptCallFrame::impl const): Deleted.
        * inspector/JSJavaScriptCallFramePrototype.h:
        (Inspector::JSJavaScriptCallFramePrototype::create): Deleted.
        (Inspector::JSJavaScriptCallFramePrototype::createStructure): Deleted.
        (Inspector::JSJavaScriptCallFramePrototype::JSJavaScriptCallFramePrototype): Deleted.
        * jit/Repatch.cpp:
        (JSC::tryCacheGetByID):
        * runtime/ArrayConstructor.h:
        (JSC::ArrayConstructor::create): Deleted.
        (JSC::ArrayConstructor::createStructure): Deleted.
        * runtime/ArrayIteratorPrototype.h:
        (JSC::ArrayIteratorPrototype::create): Deleted.
        (JSC::ArrayIteratorPrototype::createStructure): Deleted.
        (JSC::ArrayIteratorPrototype::ArrayIteratorPrototype): Deleted.
        * runtime/ArrayPrototype.h:
        (JSC::ArrayPrototype::createStructure): Deleted.
        * runtime/AsyncFromSyncIteratorPrototype.h:
        (JSC::AsyncFromSyncIteratorPrototype::createStructure): Deleted.
        * runtime/AsyncFunctionConstructor.h:
        (JSC::AsyncFunctionConstructor::create): Deleted.
        (JSC::AsyncFunctionConstructor::createStructure): Deleted.
        * runtime/AsyncFunctionPrototype.h:
        (JSC::AsyncFunctionPrototype::create): Deleted.
        (JSC::AsyncFunctionPrototype::createStructure): Deleted.
        * runtime/AsyncGeneratorFunctionConstructor.h:
        (JSC::AsyncGeneratorFunctionConstructor::create): Deleted.
        (JSC::AsyncGeneratorFunctionConstructor::createStructure): Deleted.
        * runtime/AsyncGeneratorFunctionPrototype.h:
        (JSC::AsyncGeneratorFunctionPrototype::create): Deleted.
        (JSC::AsyncGeneratorFunctionPrototype::createStructure): Deleted.
        * runtime/AsyncGeneratorPrototype.h:
        (JSC::AsyncGeneratorPrototype::create): Deleted.
        (JSC::AsyncGeneratorPrototype::createStructure): Deleted.
        (JSC::AsyncGeneratorPrototype::AsyncGeneratorPrototype): Deleted.
        * runtime/AsyncIteratorPrototype.h:
        (JSC::AsyncIteratorPrototype::create): Deleted.
        (JSC::AsyncIteratorPrototype::createStructure): Deleted.
        (JSC::AsyncIteratorPrototype::AsyncIteratorPrototype): Deleted.
        * runtime/AtomicsObject.h:
        * runtime/BigIntConstructor.h:
        (JSC::BigIntConstructor::create): Deleted.
        (JSC::BigIntConstructor::createStructure): Deleted.
        * runtime/BigIntObject.h:
        (JSC::BigIntObject::create): Deleted.
        (JSC::BigIntObject::internalValue const): Deleted.
        (JSC::BigIntObject::createStructure): Deleted.
        * runtime/BigIntPrototype.h:
        (JSC::BigIntPrototype::create): Deleted.
        (JSC::BigIntPrototype::createStructure): Deleted.
        * runtime/BooleanConstructor.h:
        (JSC::BooleanConstructor::create): Deleted.
        (JSC::BooleanConstructor::createStructure): Deleted.
        * runtime/BooleanPrototype.h:
        (JSC::BooleanPrototype::create): Deleted.
        (JSC::BooleanPrototype::createStructure): Deleted.
        * runtime/ConsoleObject.h:
        (JSC::ConsoleObject::create): Deleted.
        (JSC::ConsoleObject::createStructure): Deleted.
        * runtime/DOMAttributeGetterSetter.h:
        (JSC::isDOMAttributeGetterSetter): Deleted.
        * runtime/DateConstructor.h:
        (JSC::DateConstructor::create): Deleted.
        (JSC::DateConstructor::createStructure): Deleted.
        * runtime/DateInstance.h:
        (JSC::DateInstance::create): Deleted.
        (JSC::DateInstance::internalNumber const): Deleted.
        (JSC::DateInstance::gregorianDateTime const): Deleted.
        (JSC::DateInstance::gregorianDateTimeUTC const): Deleted.
        (JSC::DateInstance::createStructure): Deleted.
        * runtime/DatePrototype.h:
        (JSC::DatePrototype::create): Deleted.
        (JSC::DatePrototype::createStructure): Deleted.
        * runtime/Error.h:
        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction): Deleted.
        (JSC::StrictModeTypeErrorFunction::create): Deleted.
        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError): Deleted.
        (JSC::StrictModeTypeErrorFunction::callThrowTypeError): Deleted.
        (JSC::StrictModeTypeErrorFunction::createStructure): Deleted.
        * runtime/ErrorConstructor.h:
        (JSC::ErrorConstructor::create): Deleted.
        (JSC::ErrorConstructor::createStructure): Deleted.
        (JSC::ErrorConstructor::stackTraceLimit const): Deleted.
        * runtime/Exception.h:
        (JSC::Exception::valueOffset): Deleted.
        (JSC::Exception::value const): Deleted.
        (JSC::Exception::stack const): Deleted.
        (JSC::Exception::didNotifyInspectorOfThrow const): Deleted.
        (JSC::Exception::setDidNotifyInspectorOfThrow): Deleted.
        * runtime/FunctionConstructor.h:
        (JSC::FunctionConstructor::create): Deleted.
        (JSC::FunctionConstructor::createStructure): Deleted.
        * runtime/FunctionPrototype.h:
        (JSC::FunctionPrototype::create): Deleted.
        (JSC::FunctionPrototype::createStructure): Deleted.
        * runtime/FunctionRareData.h:
        (JSC::FunctionRareData::offsetOfObjectAllocationProfile): Deleted.
        (JSC::FunctionRareData::objectAllocationProfile): Deleted.
        (JSC::FunctionRareData::objectAllocationStructure): Deleted.
        (JSC::FunctionRareData::allocationProfileWatchpointSet): Deleted.
        (JSC::FunctionRareData::isObjectAllocationProfileInitialized): Deleted.
        (JSC::FunctionRareData::internalFunctionAllocationStructure): Deleted.
        (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase): Deleted.
        (JSC::FunctionRareData::clearInternalFunctionAllocationProfile): Deleted.
        (JSC::FunctionRareData::getBoundFunctionStructure): Deleted.
        (JSC::FunctionRareData::setBoundFunctionStructure): Deleted.
        (JSC::FunctionRareData::hasReifiedLength const): Deleted.
        (JSC::FunctionRareData::setHasReifiedLength): Deleted.
        (JSC::FunctionRareData::hasReifiedName const): Deleted.
        (JSC::FunctionRareData::setHasReifiedName): Deleted.
        (JSC::FunctionRareData::hasAllocationProfileClearingWatchpoint const): Deleted.
        (JSC::FunctionRareData::createAllocationProfileClearingWatchpoint): Deleted.
        (JSC::FunctionRareData::AllocationProfileClearingWatchpoint::AllocationProfileClearingWatchpoint): Deleted.
        * runtime/GeneratorFunctionConstructor.h:
        (JSC::GeneratorFunctionConstructor::create): Deleted.
        (JSC::GeneratorFunctionConstructor::createStructure): Deleted.
        * runtime/GeneratorFunctionPrototype.h:
        (JSC::GeneratorFunctionPrototype::create): Deleted.
        (JSC::GeneratorFunctionPrototype::createStructure): Deleted.
        * runtime/GeneratorPrototype.h:
        (JSC::GeneratorPrototype::create): Deleted.
        (JSC::GeneratorPrototype::createStructure): Deleted.
        (JSC::GeneratorPrototype::GeneratorPrototype): Deleted.
        * runtime/InferredValue.h:
        (JSC::InferredValue::subspaceFor): Deleted.
        (JSC::InferredValue::inferredValue): Deleted.
        (JSC::InferredValue::state const): Deleted.
        (JSC::InferredValue::isStillValid const): Deleted.
        (JSC::InferredValue::hasBeenInvalidated const): Deleted.
        (JSC::InferredValue::add): Deleted.
        (JSC::InferredValue::notifyWrite): Deleted.
        (JSC::InferredValue::invalidate): Deleted.
        * runtime/InspectorInstrumentationObject.h:
        (JSC::InspectorInstrumentationObject::create): Deleted.
        (JSC::InspectorInstrumentationObject::createStructure): Deleted.
        * runtime/IntlCollator.h:
        (JSC::IntlCollator::boundCompare const): Deleted.
        * runtime/IntlCollatorConstructor.h:
        (JSC::IntlCollatorConstructor::collatorStructure const): Deleted.
        * runtime/IntlCollatorPrototype.h:
        * runtime/IntlDateTimeFormat.h:
        (JSC::IntlDateTimeFormat::boundFormat const): Deleted.
        * runtime/IntlDateTimeFormatConstructor.h:
        (JSC::IntlDateTimeFormatConstructor::dateTimeFormatStructure const): Deleted.
        * runtime/IntlDateTimeFormatPrototype.h:
        * runtime/IntlNumberFormat.h:
        (JSC::IntlNumberFormat::boundFormat const): Deleted.
        * runtime/IntlNumberFormatConstructor.h:
        (JSC::IntlNumberFormatConstructor::numberFormatStructure const): Deleted.
        * runtime/IntlNumberFormatPrototype.h:
        * runtime/IntlObject.h:
        * runtime/IteratorPrototype.h:
        (JSC::IteratorPrototype::create): Deleted.
        (JSC::IteratorPrototype::createStructure): Deleted.
        (JSC::IteratorPrototype::IteratorPrototype): Deleted.
        * runtime/JSAPIValueWrapper.h:
        (JSC::JSAPIValueWrapper::value const): Deleted.
        (JSC::JSAPIValueWrapper::createStructure): Deleted.
        (JSC::JSAPIValueWrapper::create): Deleted.
        (JSC::JSAPIValueWrapper::finishCreation): Deleted.
        (JSC::JSAPIValueWrapper::JSAPIValueWrapper): Deleted.
        * runtime/JSArrayBufferConstructor.h:
        (JSC::JSArrayBufferConstructor::sharingMode const): Deleted.
        * runtime/JSArrayBufferPrototype.h:
        * runtime/JSAsyncFunction.h:
        (JSC::JSAsyncFunction::subspaceFor): Deleted.
        (JSC::JSAsyncFunction::allocationSize): Deleted.
        (JSC::JSAsyncFunction::createStructure): Deleted.
        * runtime/JSAsyncGeneratorFunction.h:
        (JSC::JSAsyncGeneratorFunction::subspaceFor): Deleted.
        (JSC::JSAsyncGeneratorFunction::allocationSize): Deleted.
        (JSC::JSAsyncGeneratorFunction::createStructure): Deleted.
        * runtime/JSBigInt.h:
        (JSC::JSBigInt::setSign): Deleted.
        (JSC::JSBigInt::sign const): Deleted.
        (JSC::JSBigInt::setLength): Deleted.
        (JSC::JSBigInt::length const): Deleted.
        * runtime/JSBoundFunction.h:
        (JSC::JSBoundFunction::subspaceFor): Deleted.
        (JSC::JSBoundFunction::targetFunction): Deleted.
        (JSC::JSBoundFunction::boundThis): Deleted.
        (JSC::JSBoundFunction::boundArgs): Deleted.
        (JSC::JSBoundFunction::createStructure): Deleted.
        (JSC::JSBoundFunction::offsetOfTargetFunction): Deleted.
        (JSC::JSBoundFunction::offsetOfBoundThis): Deleted.
        * runtime/JSCast.h:
        (JSC::JSCastingHelpers::FinalTypeDispatcher::inheritsGeneric):
        (JSC::JSCastingHelpers::inheritsJSTypeImpl):
        (JSC::JSCastingHelpers::InheritsTraits::inherits):
        (JSC::JSCastingHelpers::inheritsGenericImpl): Deleted.
        * runtime/JSCustomGetterSetterFunction.cpp:
        (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
        * runtime/JSCustomGetterSetterFunction.h:
        (JSC::JSCustomGetterSetterFunction::subspaceFor): Deleted.
        (JSC::JSCustomGetterSetterFunction::createStructure): Deleted.
        (JSC::JSCustomGetterSetterFunction::customGetterSetter const): Deleted.
        (JSC::JSCustomGetterSetterFunction::isSetter const): Deleted.
        (JSC::JSCustomGetterSetterFunction::propertyName const): Deleted.
        * runtime/JSDataView.h:
        (JSC::JSDataView::possiblySharedBuffer const): Deleted.
        (JSC::JSDataView::unsharedBuffer const): Deleted.
        * runtime/JSDataViewPrototype.h:
        * runtime/JSFixedArray.h:
        (JSC::JSFixedArray::createStructure): Deleted.
        (JSC::JSFixedArray::tryCreate): Deleted.
        (JSC::JSFixedArray::create): Deleted.
        (JSC::JSFixedArray::createFromArray): Deleted.
        (JSC::JSFixedArray::get const): Deleted.
        (JSC::JSFixedArray::set): Deleted.
        (JSC::JSFixedArray::buffer): Deleted.
        (JSC::JSFixedArray::buffer const): Deleted.
        (JSC::JSFixedArray::values const): Deleted.
        (JSC::JSFixedArray::size const): Deleted.
        (JSC::JSFixedArray::length const): Deleted.
        (JSC::JSFixedArray::offsetOfSize): Deleted.
        (JSC::JSFixedArray::offsetOfData): Deleted.
        (JSC::JSFixedArray::JSFixedArray): Deleted.
        (JSC::JSFixedArray::allocationSize): Deleted.
        * runtime/JSGeneratorFunction.h:
        (JSC::JSGeneratorFunction::subspaceFor): Deleted.
        (JSC::JSGeneratorFunction::allocationSize): Deleted.
        (JSC::JSGeneratorFunction::createStructure): Deleted.
        * runtime/JSGenericTypedArrayView.h:
        (JSC::JSGenericTypedArrayView::byteLength const): Deleted.
        (JSC::JSGenericTypedArrayView::byteSize const): Deleted.
        (JSC::JSGenericTypedArrayView::typedVector const): Deleted.
        (JSC::JSGenericTypedArrayView::typedVector): Deleted.
        (JSC::JSGenericTypedArrayView::canGetIndexQuickly): Deleted.
        (JSC::JSGenericTypedArrayView::canSetIndexQuickly): Deleted.
        (JSC::JSGenericTypedArrayView::getIndexQuicklyAsNativeValue): Deleted.
        (JSC::JSGenericTypedArrayView::getIndexQuicklyAsDouble): Deleted.
        (JSC::JSGenericTypedArrayView::getIndexQuickly): Deleted.
        (JSC::JSGenericTypedArrayView::setIndexQuicklyToNativeValue): Deleted.
        (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble): Deleted.
        (JSC::JSGenericTypedArrayView::setIndexQuickly): Deleted.
        (JSC::JSGenericTypedArrayView::setIndex): Deleted.
        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue): Deleted.
        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion): Deleted.
        (JSC::JSGenericTypedArrayView::sort): Deleted.
        (JSC::JSGenericTypedArrayView::canAccessRangeQuickly): Deleted.
        (JSC::JSGenericTypedArrayView::createStructure): Deleted.
        (JSC::JSGenericTypedArrayView::info): Deleted.
        (JSC::JSGenericTypedArrayView::purifyArray): Deleted.
        (JSC::JSGenericTypedArrayView::sortComparison): Deleted.
        (JSC::JSGenericTypedArrayView::sortFloat): Deleted.
        * runtime/JSGenericTypedArrayViewConstructor.h:
        * runtime/JSGenericTypedArrayViewPrototype.h:
        * runtime/JSInternalPromise.h:
        * runtime/JSInternalPromiseConstructor.h:
        * runtime/JSInternalPromisePrototype.h:
        * runtime/JSMapIterator.h:
        (JSC::JSMapIterator::createStructure): Deleted.
        (JSC::JSMapIterator::create): Deleted.
        (JSC::JSMapIterator::advanceIter): Deleted.
        (JSC::JSMapIterator::next): Deleted.
        (JSC::JSMapIterator::nextKeyValue): Deleted.
        (JSC::JSMapIterator::kind const): Deleted.
        (JSC::JSMapIterator::iteratedValue const): Deleted.
        (JSC::JSMapIterator::JSMapIterator): Deleted.
        (JSC::JSMapIterator::setIterator): Deleted.
        * runtime/JSModuleLoader.h:
        (JSC::JSModuleLoader::create): Deleted.
        (JSC::JSModuleLoader::createStructure): Deleted.
        * runtime/JSModuleNamespaceObject.h:
        (JSC::isJSModuleNamespaceObject): Deleted.
        * runtime/JSModuleRecord.h:
        (JSC::JSModuleRecord::sourceCode const): Deleted.
        (JSC::JSModuleRecord::declaredVariables const): Deleted.
        (JSC::JSModuleRecord::lexicalVariables const): Deleted.
        * runtime/JSNativeStdFunction.h:
        (JSC::JSNativeStdFunction::subspaceFor): Deleted.
        (JSC::JSNativeStdFunction::createStructure): Deleted.
        (JSC::JSNativeStdFunction::nativeStdFunctionCell): Deleted.
        * runtime/JSONObject.h:
        (JSC::JSONObject::create): Deleted.
        (JSC::JSONObject::createStructure): Deleted.
        * runtime/JSObject.h:
        (JSC::JSObject::fillCustomGetterPropertySlot):
        * runtime/JSScriptFetchParameters.h:
        (JSC::JSScriptFetchParameters::createStructure): Deleted.
        (JSC::JSScriptFetchParameters::create): Deleted.
        (JSC::JSScriptFetchParameters::parameters const): Deleted.
        (JSC::JSScriptFetchParameters::JSScriptFetchParameters): Deleted.
        * runtime/JSScriptFetcher.h:
        (JSC::JSScriptFetcher::createStructure): Deleted.
        (JSC::JSScriptFetcher::create): Deleted.
        (JSC::JSScriptFetcher::fetcher const): Deleted.
        (JSC::JSScriptFetcher::JSScriptFetcher): Deleted.
        * runtime/JSSetIterator.h:
        (JSC::JSSetIterator::createStructure): Deleted.
        (JSC::JSSetIterator::create): Deleted.
        (JSC::JSSetIterator::advanceIter): Deleted.
        (JSC::JSSetIterator::next): Deleted.
        (JSC::JSSetIterator::kind const): Deleted.
        (JSC::JSSetIterator::iteratedValue const): Deleted.
        (JSC::JSSetIterator::JSSetIterator): Deleted.
        (JSC::JSSetIterator::setIterator): Deleted.
        * runtime/JSSourceCode.h:
        (JSC::JSSourceCode::createStructure): Deleted.
        (JSC::JSSourceCode::create): Deleted.
        (JSC::JSSourceCode::sourceCode const): Deleted.
        (JSC::JSSourceCode::JSSourceCode): Deleted.
        * runtime/JSStringIterator.h:
        (JSC::JSStringIterator::createStructure): Deleted.
        (JSC::JSStringIterator::create): Deleted.
        (JSC::JSStringIterator::JSStringIterator): Deleted.
        * runtime/JSTemplateObjectDescriptor.h:
        (JSC::isTemplateObjectDescriptor): Deleted.
        * runtime/JSTypedArrayViewConstructor.h:
        (JSC::JSTypedArrayViewConstructor::create): Deleted.
        * runtime/JSTypedArrayViewPrototype.h:
        * runtime/MapConstructor.h:
        (JSC::MapConstructor::create): Deleted.
        (JSC::MapConstructor::createStructure): Deleted.
        * runtime/MapIteratorPrototype.h:
        (JSC::MapIteratorPrototype::create): Deleted.
        (JSC::MapIteratorPrototype::createStructure): Deleted.
        (JSC::MapIteratorPrototype::MapIteratorPrototype): Deleted.
        * runtime/MapPrototype.h:
        (JSC::MapPrototype::create): Deleted.
        (JSC::MapPrototype::createStructure): Deleted.
        (JSC::MapPrototype::MapPrototype): Deleted.
        * runtime/MathObject.h:
        (JSC::MathObject::create): Deleted.
        (JSC::MathObject::createStructure): Deleted.
        * runtime/ModuleLoaderPrototype.h:
        (JSC::ModuleLoaderPrototype::create): Deleted.
        (JSC::ModuleLoaderPrototype::createStructure): Deleted.
        * runtime/NativeErrorConstructor.h:
        (JSC::NativeErrorConstructor::create): Deleted.
        (JSC::NativeErrorConstructor::createStructure): Deleted.
        (JSC::NativeErrorConstructor::errorStructure): Deleted.
        * runtime/NativeErrorPrototype.h:
        (JSC::NativeErrorPrototype::create): Deleted.
        * runtime/NativeStdFunctionCell.h:
        (JSC::NativeStdFunctionCell::createStructure): Deleted.
        (JSC::NativeStdFunctionCell::function const): Deleted.
        * runtime/NullGetterFunction.h:
        (JSC::NullGetterFunction::create): Deleted.
        (JSC::NullGetterFunction::createStructure): Deleted.
        * runtime/NullSetterFunction.h:
        (JSC::NullSetterFunction::create): Deleted.
        (JSC::NullSetterFunction::createStructure): Deleted.
        * runtime/NumberConstructor.h:
        (JSC::NumberConstructor::create): Deleted.
        (JSC::NumberConstructor::createStructure): Deleted.
        (JSC::NumberConstructor::isIntegerImpl): Deleted.
        * runtime/NumberPrototype.h:
        (JSC::NumberPrototype::create): Deleted.
        (JSC::NumberPrototype::createStructure): Deleted.
        * runtime/ObjectConstructor.h:
        (JSC::ObjectConstructor::create): Deleted.
        (JSC::ObjectConstructor::createStructure): Deleted.
        * runtime/ObjectPrototype.h:
        (JSC::ObjectPrototype::createStructure): Deleted.
        * runtime/ProxyConstructor.h:
        (JSC::ProxyConstructor::createStructure): Deleted.
        * runtime/ProxyRevoke.h:
        (JSC::ProxyRevoke::createStructure): Deleted.
        (JSC::ProxyRevoke::proxy): Deleted.
        (JSC::ProxyRevoke::setProxyToNull): Deleted.
        * runtime/ReflectObject.h:
        (JSC::ReflectObject::create): Deleted.
        (JSC::ReflectObject::createStructure): Deleted.
        * runtime/RegExpConstructor.cpp:
        (JSC::regExpConstructorDollar):
        (JSC::regExpConstructorInput):
        (JSC::regExpConstructorMultiline):
        (JSC::regExpConstructorLastMatch):
        (JSC::regExpConstructorLastParen):
        (JSC::regExpConstructorLeftContext):
        (JSC::regExpConstructorRightContext):
        * runtime/RegExpConstructor.h:
        (JSC::RegExpConstructor::create): Deleted.
        (JSC::RegExpConstructor::createStructure): Deleted.
        (JSC::RegExpConstructor::setMultiline): Deleted.
        (JSC::RegExpConstructor::multiline const): Deleted.
        (JSC::RegExpConstructor::setInput): Deleted.
        (JSC::RegExpConstructor::input): Deleted.
        (JSC::RegExpConstructor::offsetOfCachedResult): Deleted.
        (JSC::asRegExpConstructor): Deleted.
        * runtime/RegExpPrototype.h:
        (JSC::RegExpPrototype::create): Deleted.
        (JSC::RegExpPrototype::createStructure): Deleted.
        (JSC::RegExpPrototype::emptyRegExp const): Deleted.
        * runtime/SetConstructor.h:
        (JSC::SetConstructor::create): Deleted.
        (JSC::SetConstructor::createStructure): Deleted.
        * runtime/SetIteratorPrototype.h:
        (JSC::SetIteratorPrototype::create): Deleted.
        (JSC::SetIteratorPrototype::createStructure): Deleted.
        (JSC::SetIteratorPrototype::SetIteratorPrototype): Deleted.
        * runtime/SetPrototype.h:
        (JSC::SetPrototype::create): Deleted.
        (JSC::SetPrototype::createStructure): Deleted.
        (JSC::SetPrototype::SetPrototype): Deleted.
        * runtime/StringConstructor.h:
        (JSC::StringConstructor::create): Deleted.
        (JSC::StringConstructor::createStructure): Deleted.
        * runtime/StringIteratorPrototype.h:
        (JSC::StringIteratorPrototype::create): Deleted.
        (JSC::StringIteratorPrototype::createStructure): Deleted.
        (JSC::StringIteratorPrototype::StringIteratorPrototype): Deleted.
        * runtime/StringPrototype.h:
        (JSC::StringPrototype::createStructure): Deleted.
        * runtime/SymbolConstructor.h:
        (JSC::SymbolConstructor::create): Deleted.
        (JSC::SymbolConstructor::createStructure): Deleted.
        * runtime/SymbolObject.h:
        (JSC::SymbolObject::create): Deleted.
        (JSC::SymbolObject::internalValue const): Deleted.
        (JSC::SymbolObject::createStructure): Deleted.
        * runtime/SymbolPrototype.h:
        (JSC::SymbolPrototype::create): Deleted.
        (JSC::SymbolPrototype::createStructure): Deleted.
        * runtime/WeakMapConstructor.h:
        (JSC::WeakMapConstructor::create): Deleted.
        (JSC::WeakMapConstructor::createStructure): Deleted.
        * runtime/WeakMapPrototype.h:
        (JSC::WeakMapPrototype::create): Deleted.
        (JSC::WeakMapPrototype::createStructure): Deleted.
        (JSC::WeakMapPrototype::WeakMapPrototype): Deleted.
        * runtime/WeakSetConstructor.h:
        (JSC::WeakSetConstructor::create): Deleted.
        (JSC::WeakSetConstructor::createStructure): Deleted.
        * runtime/WeakSetPrototype.h:
        (JSC::WeakSetPrototype::create): Deleted.
        (JSC::WeakSetPrototype::createStructure): Deleted.
        (JSC::WeakSetPrototype::WeakSetPrototype): Deleted.
        * tools/JSDollarVM.h:
        (JSC::JSDollarVM::createStructure): Deleted.
        (JSC::JSDollarVM::create): Deleted.
        (JSC::JSDollarVM::JSDollarVM): Deleted.
        * wasm/js/JSWebAssembly.h:
        * wasm/js/JSWebAssemblyCompileError.h:
        (JSC::JSWebAssemblyCompileError::create): Deleted.
        * wasm/js/JSWebAssemblyInstance.h:
        (JSC::JSWebAssemblyInstance::instance): Deleted.
        (JSC::JSWebAssemblyInstance::moduleNamespaceObject): Deleted.
        (JSC::JSWebAssemblyInstance::webAssemblyToJSCallee): Deleted.
        (JSC::JSWebAssemblyInstance::memory): Deleted.
        (JSC::JSWebAssemblyInstance::setMemory): Deleted.
        (JSC::JSWebAssemblyInstance::memoryMode): Deleted.
        (JSC::JSWebAssemblyInstance::table): Deleted.
        (JSC::JSWebAssemblyInstance::setTable): Deleted.
        (JSC::JSWebAssemblyInstance::offsetOfPoisonedInstance): Deleted.
        (JSC::JSWebAssemblyInstance::offsetOfPoisonedCallee): Deleted.
        (JSC::JSWebAssemblyInstance::module const): Deleted.
        * wasm/js/JSWebAssemblyLinkError.h:
        (JSC::JSWebAssemblyLinkError::create): Deleted.
        * wasm/js/JSWebAssemblyMemory.h:
        (JSC::JSWebAssemblyMemory::subspaceFor): Deleted.
        (JSC::JSWebAssemblyMemory::memory): Deleted.
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/JSWebAssemblyRuntimeError.h:
        (JSC::JSWebAssemblyRuntimeError::create): Deleted.
        * wasm/js/JSWebAssemblyTable.h:
        (JSC::JSWebAssemblyTable::isValidLength): Deleted.
        (JSC::JSWebAssemblyTable::maximum const): Deleted.
        (JSC::JSWebAssemblyTable::length const): Deleted.
        (JSC::JSWebAssemblyTable::allocatedLength const): Deleted.
        (JSC::JSWebAssemblyTable::table): Deleted.
        * wasm/js/WebAssemblyCompileErrorConstructor.h:
        * wasm/js/WebAssemblyCompileErrorPrototype.h:
        * wasm/js/WebAssemblyInstanceConstructor.h:
        * wasm/js/WebAssemblyInstancePrototype.h:
        * wasm/js/WebAssemblyLinkErrorConstructor.h:
        * wasm/js/WebAssemblyLinkErrorPrototype.h:
        * wasm/js/WebAssemblyMemoryConstructor.h:
        * wasm/js/WebAssemblyMemoryPrototype.h:
        * wasm/js/WebAssemblyModuleConstructor.h:
        * wasm/js/WebAssemblyModulePrototype.h:
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyPrototype.h:
        * wasm/js/WebAssemblyRuntimeErrorConstructor.h:
        * wasm/js/WebAssemblyRuntimeErrorPrototype.h:
        * wasm/js/WebAssemblyTableConstructor.h:
        * wasm/js/WebAssemblyTablePrototype.h:

2018-03-07  Filip Pizlo  <fpizlo@apple.com>

        Make it possible to randomize register allocation
        https://bugs.webkit.org/show_bug.cgi?id=183416

        Reviewed by Keith Miller.
        
        This is disabled by default for now, because it reveals a regalloc bug in wasm.

        * b3/air/AirCode.cpp:
        (JSC::B3::Air::Code::Code):
        * b3/air/AirCode.h:
        (JSC::B3::Air::Code::weakRandom):
        * runtime/Options.h:

2018-03-08  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Add inherits<T>(VM&) leveraging JSCast fast path
        https://bugs.webkit.org/show_bug.cgi?id=183429

        Reviewed by Mark Lam.

        Add new member function, JSCell::inherits<T>(VM&) and JSValue::inherits<T>(VM&).
        They depends on jsDynamicCast<T> implementation and leverage JSType-based fast
        paths defined in JSCast.h. We extract checking part as `JSCastingHelpers::inherit`
        and construct jsDynamicCast and JSCell::inherits based on this.

        And we remove several unnecessary casting functions (asRegExpObject, asDateInstance etc.).
        In addition, we add jsDynamicCast fast path for RegExpObject by using existing RegExpObjectType.

        We also fix the implementation of jsDynamicCast for JSObject since it uses LastJSCObjectType.
        The embedder can add their extended object types after that.

        * API/JSObjectRef.cpp:
        (JSObjectGetPrivateProperty):
        (JSObjectSetPrivateProperty):
        (JSObjectDeletePrivateProperty):
        * API/JSValue.mm:
        (isDate):
        (isArray):
        * API/JSValueRef.cpp:
        (JSValueIsArray):
        (JSValueIsDate):
        (JSValueIsObjectOfClass):
        * API/JSWeakObjectMapRefPrivate.cpp:
        * API/JSWrapperMap.mm:
        (tryUnwrapObjcObject):
        * API/ObjCCallbackFunction.mm:
        (tryUnwrapConstructor):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGOperations.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::operationMaterializeObjectInOSR):
        * inspector/JSInjectedScriptHost.cpp:
        (Inspector::JSInjectedScriptHost::subtype):
        (Inspector::JSInjectedScriptHost::functionDetails):
        * inspector/agents/InspectorHeapAgent.cpp:
        (Inspector::InspectorHeapAgent::getPreview):
        * interpreter/Interpreter.cpp:
        (JSC::notifyDebuggerOfUnwinding):
        * interpreter/ShadowChicken.cpp:
        (JSC::ShadowChicken::update):
        * jit/JIT.cpp:
        (JSC::JIT::privateCompileMainPass):
        * jit/JITOperations.cpp:
        (JSC::operationNewFunctionCommon):
        * jsc.cpp:
        (checkException):
        * runtime/BooleanObject.h:
        (JSC::asBooleanObject): Deleted.
        * runtime/BooleanPrototype.cpp:
        (JSC::booleanProtoFuncToString):
        (JSC::booleanProtoFuncValueOf):
        * runtime/DateConstructor.cpp:
        (JSC::constructDate):
        * runtime/DateInstance.h:
        (JSC::asDateInstance): Deleted.
        * runtime/DatePrototype.cpp:
        (JSC::formateDateInstance):
        (JSC::dateProtoFuncToISOString):
        (JSC::dateProtoFuncToLocaleString):
        (JSC::dateProtoFuncToLocaleDateString):
        (JSC::dateProtoFuncToLocaleTimeString):
        (JSC::dateProtoFuncGetTime):
        (JSC::dateProtoFuncGetFullYear):
        (JSC::dateProtoFuncGetUTCFullYear):
        (JSC::dateProtoFuncGetMonth):
        (JSC::dateProtoFuncGetUTCMonth):
        (JSC::dateProtoFuncGetDate):
        (JSC::dateProtoFuncGetUTCDate):
        (JSC::dateProtoFuncGetDay):
        (JSC::dateProtoFuncGetUTCDay):
        (JSC::dateProtoFuncGetHours):
        (JSC::dateProtoFuncGetUTCHours):
        (JSC::dateProtoFuncGetMinutes):
        (JSC::dateProtoFuncGetUTCMinutes):
        (JSC::dateProtoFuncGetSeconds):
        (JSC::dateProtoFuncGetUTCSeconds):
        (JSC::dateProtoFuncGetMilliSeconds):
        (JSC::dateProtoFuncGetUTCMilliseconds):
        (JSC::dateProtoFuncGetTimezoneOffset):
        (JSC::dateProtoFuncSetTime):
        (JSC::setNewValueFromTimeArgs):
        (JSC::setNewValueFromDateArgs):
        (JSC::dateProtoFuncSetYear):
        (JSC::dateProtoFuncGetYear):
        * runtime/ExceptionHelpers.cpp:
        (JSC::isTerminatedExecutionException):
        * runtime/FunctionPrototype.cpp:
        (JSC::functionProtoFuncToString):
        * runtime/InternalFunction.h:
        (JSC::asInternalFunction):
        * runtime/JSArray.h:
        (JSC::asArray):
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::dumpForBacktrace const):
        * runtime/JSCJSValue.h:
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::inherits const):
        * runtime/JSCast.h:
        (JSC::JSCastingHelpers::inheritsGenericImpl):
        (JSC::JSCastingHelpers::inheritsJSTypeImpl):
        (JSC::JSCastingHelpers::InheritsTraits::inherits):
        (JSC::JSCastingHelpers::inherits):
        (JSC::jsDynamicCast):
        (JSC::JSCastingHelpers::jsDynamicCastGenericImpl): Deleted.
        (JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl): Deleted.
        (JSC::JSCastingHelpers::JSDynamicCastTraits::cast): Deleted.
        * runtime/JSCell.h:
        * runtime/JSCellInlines.h:
        (JSC::JSCell::inherits const):
        * runtime/JSFunction.cpp:
        (JSC::RetrieveCallerFunctionFunctor::operator() const):
        (JSC::JSFunction::callerGetter):
        (JSC::JSFunction::getOwnNonIndexPropertyNames):
        (JSC::JSFunction::reifyLazyBoundNameIfNeeded):
        * runtime/JSGlobalObject.cpp:
        (JSC::enqueueJob):
        * runtime/JSGlobalObject.h:
        (JSC::asGlobalObject): Deleted.
        * runtime/JSInternalPromiseDeferred.cpp:
        (JSC::JSInternalPromiseDeferred::create):
        * runtime/JSLexicalEnvironment.h:
        (JSC::asActivation):
        * runtime/JSONObject.cpp:
        (JSC::unwrapBoxedPrimitive):
        (JSC::Stringifier::Stringifier):
        (JSC::Walker::walk):
        * runtime/JSPromise.cpp:
        (JSC::JSPromise::resolve):
        * runtime/JSPromiseDeferred.cpp:
        (JSC::JSPromiseDeferred::create):
        * runtime/JSType.h:
        * runtime/ProxyObject.h:
        (JSC::ProxyObject::create): Deleted.
        (JSC::ProxyObject::createStructure): Deleted.
        (JSC::ProxyObject::target const): Deleted.
        (JSC::ProxyObject::handler const): Deleted.
        * runtime/RegExpConstructor.cpp:
        (JSC::constructRegExp):
        * runtime/RegExpConstructor.h:
        (JSC::asRegExpConstructor):
        (JSC::isRegExp):
        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::finishCreation):
        (JSC::RegExpObject::getOwnPropertySlot):
        (JSC::RegExpObject::defineOwnProperty):
        (JSC::regExpObjectSetLastIndexStrict):
        (JSC::regExpObjectSetLastIndexNonStrict):
        (JSC::RegExpObject::put):
        * runtime/RegExpObject.h:
        (JSC::RegExpObject::create): Deleted.
        (JSC::RegExpObject::setRegExp): Deleted.
        (JSC::RegExpObject::regExp const): Deleted.
        (JSC::RegExpObject::setLastIndex): Deleted.
        (JSC::RegExpObject::getLastIndex const): Deleted.
        (JSC::RegExpObject::test): Deleted.
        (JSC::RegExpObject::testInline): Deleted.
        (JSC::RegExpObject::createStructure): Deleted.
        (JSC::RegExpObject::offsetOfRegExp): Deleted.
        (JSC::RegExpObject::offsetOfLastIndex): Deleted.
        (JSC::RegExpObject::offsetOfLastIndexIsWritable): Deleted.
        (JSC::RegExpObject::allocationSize): Deleted.
        (JSC::asRegExpObject): Deleted.
        * runtime/RegExpPrototype.cpp:
        (JSC::regExpProtoFuncTestFast):
        (JSC::regExpProtoFuncExec):
        (JSC::regExpProtoFuncMatchFast):
        (JSC::regExpProtoFuncCompile):
        (JSC::regExpProtoGetterGlobal):
        (JSC::regExpProtoGetterIgnoreCase):
        (JSC::regExpProtoGetterMultiline):
        (JSC::regExpProtoGetterDotAll):
        (JSC::regExpProtoGetterSticky):
        (JSC::regExpProtoGetterUnicode):
        (JSC::regExpProtoGetterSource):
        (JSC::regExpProtoFuncSearchFast):
        (JSC::regExpProtoFuncSplitFast):
        * runtime/StringObject.h:
        (JSC::asStringObject): Deleted.
        * runtime/StringPrototype.cpp:
        (JSC::replaceUsingRegExpSearch):
        (JSC::replace):
        (JSC::stringProtoFuncReplaceUsingRegExp):
        (JSC::stringProtoFuncToString):
        * runtime/SymbolPrototype.cpp:
        (JSC::symbolProtoFuncToString):
        (JSC::symbolProtoFuncValueOf):
        * tools/JSDollarVM.cpp:
        (WTF::customGetValue):
        (WTF::customSetValue):
        * wasm/js/JSWebAssemblyHelpers.h:
        (JSC::isWebAssemblyHostFunction):
        * wasm/js/WebAssemblyWrapperFunction.cpp:
        (JSC::WebAssemblyWrapperFunction::create):

2018-03-07  Tim Horton  <timothy_horton@apple.com>

        Sort and separate FeatureDefines.xcconfig
        https://bugs.webkit.org/show_bug.cgi?id=183427

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:
        Sort and split FeatureDefines into paragraphs
        (to make it easier to sort later).

2018-03-07  Keith Miller  <keith_miller@apple.com>

        Unreviewed, fix 32-bit build.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

2018-03-07  Keith Miller  <keith_miller@apple.com>

        Meta-program setupArguments and callOperation
        https://bugs.webkit.org/show_bug.cgi?id=183263

        Rubber-stamped by Filip Pizlo.

        This patch removes all the custom overrides of callOperation and setupArguments
        throughout the JITs. In their place there is a new setupArguments that marshalls
        the arguments into place based on the type of the operation's function pointer.
        There were a couple of design choices in the implementation of setupArguments:

        1) We assume that no TrustedImm floating point values are passed.
        2) If ExecState* is the first argument the callFrameRegister should be marshalled implicitly.
        3) Types should not be implicitly converted (with the exception of DFG::RegisteredStructure -> Structure*)

        The new callOperation/setupArguments do their best to make sure
        it's hard to call a function with the wrong parameters. They will
        only try to pattern match if the types match up with the next
        passed argument. Additionally, the base case should static_assert
        of the number of inferred arguments does not match the arity of
        the operation's function pointer.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::poke):
        (JSC::MacroAssembler::move):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::swap):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::storeDouble):
        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::loadDouble):
        (JSC::MacroAssemblerX86Common::swap):
        (JSC::MacroAssemblerX86Common::move):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/AccessCaseSnippetParams.cpp:
        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
        * dfg/DFGNode.h:
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::emitRestoreArguments):
        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::osrWriteBarrier):
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGSlowPathGenerator.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp):
        (JSC::DFG::SpeculativeJIT::compileArithMod):
        (JSC::DFG::SpeculativeJIT::compileArithRounding):
        (JSC::DFG::SpeculativeJIT::compileArithSqrt):
        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::operator MacroAssembler::TrustedImm const):
        (JSC::DFG::SpeculativeJIT::initConstantInfo):
        (JSC::DFG::SpeculativeJIT::callOperation):
        (JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
        (JSC::DFG::SpeculativeJIT::callCustomGetter): Deleted.
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::cachedGetById):
        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
        (JSC::DFG::SpeculativeJIT::cachedPutById):
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * ftl/FTLSlowPathCall.h:
        (JSC::FTL::callOperation):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
        * jit/CCallHelpers.cpp:
        (JSC::CCallHelpers::ensureShadowChickenPacket):
        * jit/CCallHelpers.h:
        (JSC::CCallHelpers::setupArgument):
        (JSC::CCallHelpers::setupStubArgs):
        (JSC::CCallHelpers::ArgCollection::ArgCollection):
        (JSC::CCallHelpers::ArgCollection::pushRegArg):
        (JSC::CCallHelpers::ArgCollection::addGPRArg):
        (JSC::CCallHelpers::ArgCollection::addStackArg):
        (JSC::CCallHelpers::ArgCollection::addPoke):
        (JSC::CCallHelpers::ArgCollection::argCount):
        (JSC::CCallHelpers::clampArrayToSize):
        (JSC::CCallHelpers::pokeForArgument):
        (JSC::CCallHelpers::marshallArgumentRegister):
        (JSC::CCallHelpers::setupArgumentsImpl):
        (JSC::CCallHelpers::std::is_integral<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value):
        (JSC::CCallHelpers::setupArguments):
        (JSC::CCallHelpers::prepareForTailCallSlow):
        (JSC::CCallHelpers::setupArgumentsWithExecState): Deleted.
        (JSC::CCallHelpers::resetCallArguments): Deleted.
        (JSC::CCallHelpers::addCallArgument): Deleted.
        (JSC::CCallHelpers::setupArgumentsExecState): Deleted.
        (JSC::CCallHelpers::setupTwoStubArgsGPR): Deleted.
        (JSC::CCallHelpers::setupThreeStubArgsGPR): Deleted.
        (JSC::CCallHelpers::setupFourStubArgsGPR): Deleted.
        (JSC::CCallHelpers::setupFiveStubArgsGPR): Deleted.
        (JSC::CCallHelpers::setupTwoStubArgsFPR): Deleted.
        (JSC::CCallHelpers::setupStubArguments): Deleted.
        (JSC::CCallHelpers::setupArgumentsWithExecStateForCallWithSlowPathReturnType): Deleted.
        (JSC::CCallHelpers::setupStubArguments134): Deleted.
        (JSC::CCallHelpers::setupStubArgsGPR): Deleted.
        * jit/FPRInfo.h:
        (JSC::toInfoFromReg):
        * jit/GPRInfo.h:
        (JSC::JSValueRegs::JSValueRegs):
        (JSC::toInfoFromReg):
        * jit/JIT.h:
        (JSC::JIT::callOperation):
        (JSC::JIT::callOperationWithProfile):
        (JSC::JIT::callOperationWithResult):
        (JSC::JIT::callOperationNoExceptionCheck):
        (JSC::JIT::callOperationWithCallFrameRollbackOnException):
        * jit/JITArithmetic.cpp:
        (JSC::JIT::emitMathICFast):
        (JSC::JIT::emitMathICSlow):
        * jit/JITArithmetic32_64.cpp:
        (JSC::JIT::emit_compareAndJumpSlow):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileSetupVarargsFrame):
        * jit/JITInlines.h:
        (JSC::JIT::callOperation): Deleted.
        (JSC::JIT::callOperationNoExceptionCheck): Deleted.
        (JSC::JIT::callOperationWithCallFrameRollbackOnException): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_new_array_with_size):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emitSlow_op_instanceof):
        (JSC::JIT::emitSlow_op_instanceof_custom):
        (JSC::JIT::emit_op_set_function_name):
        (JSC::JIT::emitSlow_op_eq):
        (JSC::JIT::emitSlow_op_neq):
        (JSC::JIT::emit_op_throw):
        (JSC::JIT::emit_op_switch_imm):
        (JSC::JIT::emit_op_switch_char):
        (JSC::JIT::emit_op_switch_string):
        (JSC::JIT::emitSlow_op_has_indexed_property):
        * jit/JITOperations.cpp:
        * jit/JITOperations.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitGetByValWithCachedId):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_get_from_scope):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::emit_op_put_by_index):
        (JSC::JIT::emit_op_put_setter_by_id):
        (JSC::JIT::emit_op_put_getter_setter_by_id):
        (JSC::JIT::emit_op_put_getter_by_val):
        (JSC::JIT::emit_op_put_setter_by_val):
        (JSC::JIT::emit_op_del_by_id):
        (JSC::JIT::emit_op_del_by_val):
        (JSC::JIT::emitGetByValWithCachedId):
        (JSC::JIT::emitSlow_op_get_by_val):
        (JSC::JIT::emitPutByValWithCachedId):
        (JSC::JIT::emitSlow_op_put_by_val):
        (JSC::JIT::emitSlow_op_try_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id):
        (JSC::JIT::emitSlow_op_get_by_id_with_this):
        (JSC::JIT::emitSlow_op_put_by_id):
        (JSC::JIT::emitSlow_op_get_from_scope):
        * jit/RegisterSet.h:
        (JSC::RegisterSet::RegisterSet):
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::slowPathFor):
        * jsc.cpp:
        (GlobalObject::finishCreation):
        (functionBreakpoint):
        * runtime/JSCJSValue.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):

2018-03-07  Mark Lam  <mark.lam@apple.com>

        Rename ProtoCallFrame::arityMissMatch to hasArityMismatch.
        https://bugs.webkit.org/show_bug.cgi?id=183414
        <rdar://problem/38231678>

        Reviewed by Michael Saboff.

        * interpreter/ProtoCallFrame.cpp:
        (JSC::ProtoCallFrame::init):
        * interpreter/ProtoCallFrame.h:

2018-03-07  Mark Lam  <mark.lam@apple.com>

        Simplify the variants of FunctionPtr constructors.
        https://bugs.webkit.org/show_bug.cgi?id=183399
        <rdar://problem/38212980>

        Reviewed by Yusuke Suzuki.

        * assembler/MacroAssemblerCodeRef.h:
        (JSC::FunctionPtr::FunctionPtr):

2018-03-06  Filip Pizlo  <fpizlo@apple.com>

        MarkedArgumentsBuffer should allocate from the JSValue Gigacage
        https://bugs.webkit.org/show_bug.cgi?id=183377

        Reviewed by Michael Saboff.
        
        That prevents it from being used to pivot UAF on malloc memory into corruption in the JS heap.

        * runtime/ArgList.cpp:
        (JSC::MarkedArgumentBuffer::expandCapacity):

2018-03-07  Mark Lam  <mark.lam@apple.com>

        Add support for ARM64E.
        https://bugs.webkit.org/show_bug.cgi?id=183398
        <rdar://problem/38212621>

        Reviewed by Michael Saboff.

        * assembler/MacroAssembler.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/backends.rb:

2018-03-07  Yusuke Suzuki  <utatane.tea@gmail.com>

        HTML `pattern` attribute should set `u` flag for regular expressions
        https://bugs.webkit.org/show_bug.cgi?id=151598

        Reviewed by Chris Dumez.

        Add UnicodeMode for JSC::Yarr::RegularExpression.

        * yarr/RegularExpression.cpp:
        (JSC::Yarr::RegularExpression::Private::create):
        (JSC::Yarr::RegularExpression::Private::Private):
        (JSC::Yarr::RegularExpression::Private::compile):
        (JSC::Yarr::RegularExpression::RegularExpression):
        * yarr/RegularExpression.h:

2018-03-07  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Add more JSType based fast path for jsDynamicCast
        https://bugs.webkit.org/show_bug.cgi?id=183403

        Reviewed by Mark Lam.

        We add more JSType based fast path for jsDynamicCast. Basically, we add miscellaneous JSTypes which
        are used for jsDynamicCast in JSC, arguments types, and scope types.

        We also add ClassInfo to JSScope and JSSegmentedVariableObject since they are used with jsDynamicCast.

        * jit/JITOperations.cpp:
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::setUpCall):
        * runtime/ClonedArguments.h:
        (JSC::ClonedArguments::specialsMaterialized const): Deleted.
        * runtime/DirectArguments.h:
        (JSC::DirectArguments::subspaceFor): Deleted.
        (JSC::DirectArguments::internalLength const): Deleted.
        (JSC::DirectArguments::length const): Deleted.
        (JSC::DirectArguments::isMappedArgument const): Deleted.
        (JSC::DirectArguments::isMappedArgumentInDFG const): Deleted.
        (JSC::DirectArguments::getIndexQuickly const): Deleted.
        (JSC::DirectArguments::setIndexQuickly): Deleted.
        (JSC::DirectArguments::callee): Deleted.
        (JSC::DirectArguments::argument): Deleted.
        (JSC::DirectArguments::overrodeThings const): Deleted.
        (JSC::DirectArguments::initModifiedArgumentsDescriptorIfNecessary): Deleted.
        (JSC::DirectArguments::setModifiedArgumentDescriptor): Deleted.
        (JSC::DirectArguments::isModifiedArgumentDescriptor): Deleted.
        (JSC::DirectArguments::offsetOfCallee): Deleted.
        (JSC::DirectArguments::offsetOfLength): Deleted.
        (JSC::DirectArguments::offsetOfMinCapacity): Deleted.
        (JSC::DirectArguments::offsetOfMappedArguments): Deleted.
        (JSC::DirectArguments::offsetOfModifiedArgumentsDescriptor): Deleted.
        (JSC::DirectArguments::storageOffset): Deleted.
        (JSC::DirectArguments::offsetOfSlot): Deleted.
        (JSC::DirectArguments::allocationSize): Deleted.
        (JSC::DirectArguments::storage): Deleted.
        * runtime/JSCast.h:
        * runtime/JSGlobalLexicalEnvironment.h:
        (JSC::JSGlobalLexicalEnvironment::create): Deleted.
        (JSC::JSGlobalLexicalEnvironment::isEmpty const): Deleted.
        (JSC::JSGlobalLexicalEnvironment::createStructure): Deleted.
        (JSC::JSGlobalLexicalEnvironment::JSGlobalLexicalEnvironment): Deleted.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::finishCreation):
        * runtime/JSMap.h:
        (JSC::isJSMap): Deleted.
        * runtime/JSModuleEnvironment.h:
        (JSC::JSModuleEnvironment::create): Deleted.
        (JSC::JSModuleEnvironment::createStructure): Deleted.
        (JSC::JSModuleEnvironment::offsetOfModuleRecord): Deleted.
        (JSC::JSModuleEnvironment::allocationSize): Deleted.
        (JSC::JSModuleEnvironment::moduleRecord): Deleted.
        (JSC::JSModuleEnvironment::moduleRecordSlot): Deleted.
        * runtime/JSObject.cpp:
        (JSC::canDoFastPutDirectIndex):
        (JSC::JSObject::defineOwnIndexedProperty):
        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
        * runtime/JSObject.h:
        (JSC::JSFinalObject::allocationSize): Deleted.
        (JSC::JSFinalObject::typeInfo): Deleted.
        (JSC::JSFinalObject::defaultInlineCapacity): Deleted.
        (JSC::JSFinalObject::maxInlineCapacity): Deleted.
        (JSC::JSFinalObject::createStructure): Deleted.
        (JSC::JSFinalObject::finishCreation): Deleted.
        (JSC::JSFinalObject::JSFinalObject): Deleted.
        (JSC::isJSFinalObject): Deleted.
        * runtime/JSScope.cpp:
        * runtime/JSScope.h:
        * runtime/JSSegmentedVariableObject.cpp:
        * runtime/JSSegmentedVariableObject.h:
        * runtime/JSSet.h:
        (JSC::isJSSet): Deleted.
        * runtime/JSType.h:
        * runtime/JSWeakMap.h:
        (JSC::isJSWeakMap): Deleted.
        * runtime/JSWeakSet.h:
        (JSC::isJSWeakSet): Deleted.
        * runtime/JSWithScope.h:
        (JSC::JSWithScope::object): Deleted.
        * runtime/MapConstructor.cpp:
        (JSC::constructMap):
        (JSC::mapPrivateFuncMapBucketHead):
        * runtime/MapPrototype.cpp:
        (JSC::getMap):
        * runtime/NumberObject.cpp:
        (JSC::NumberObject::finishCreation):
        * runtime/NumberPrototype.cpp:
        (JSC::toThisNumber):
        (JSC::numberProtoFuncToExponential):
        (JSC::numberProtoFuncToFixed):
        (JSC::numberProtoFuncToPrecision):
        (JSC::numberProtoFuncToString):
        (JSC::numberProtoFuncToLocaleString):
        (JSC::numberProtoFuncValueOf):
        * runtime/ObjectConstructor.cpp:
        (JSC::objectConstructorSeal):
        (JSC::objectConstructorFreeze):
        (JSC::objectConstructorIsSealed):
        (JSC::objectConstructorIsFrozen):
        * runtime/ProxyObject.cpp:
        (JSC::ProxyObject::finishCreation):
        * runtime/ScopedArguments.h:
        (JSC::ScopedArguments::subspaceFor): Deleted.
        (JSC::ScopedArguments::internalLength const): Deleted.
        (JSC::ScopedArguments::length const): Deleted.
        (JSC::ScopedArguments::isMappedArgument const): Deleted.
        (JSC::ScopedArguments::isMappedArgumentInDFG const): Deleted.
        (JSC::ScopedArguments::getIndexQuickly const): Deleted.
        (JSC::ScopedArguments::setIndexQuickly): Deleted.
        (JSC::ScopedArguments::callee): Deleted.
        (JSC::ScopedArguments::overrodeThings const): Deleted.
        (JSC::ScopedArguments::initModifiedArgumentsDescriptorIfNecessary): Deleted.
        (JSC::ScopedArguments::setModifiedArgumentDescriptor): Deleted.
        (JSC::ScopedArguments::isModifiedArgumentDescriptor): Deleted.
        (JSC::ScopedArguments::offsetOfOverrodeThings): Deleted.
        (JSC::ScopedArguments::offsetOfTotalLength): Deleted.
        (JSC::ScopedArguments::offsetOfTable): Deleted.
        (JSC::ScopedArguments::offsetOfScope): Deleted.
        (JSC::ScopedArguments::overflowStorageOffset): Deleted.
        (JSC::ScopedArguments::allocationSize): Deleted.
        (JSC::ScopedArguments::overflowStorage const): Deleted.
        * runtime/SetConstructor.cpp:
        (JSC::constructSet):
        (JSC::setPrivateFuncSetBucketHead):
        * runtime/SetPrototype.cpp:
        (JSC::getSet):
        * runtime/StrictEvalActivation.h:
        (JSC::StrictEvalActivation::create): Deleted.
        (JSC::StrictEvalActivation::createStructure): Deleted.
        * runtime/WeakMapPrototype.cpp:
        (JSC::getWeakMap):
        * runtime/WeakSetPrototype.cpp:
        (JSC::getWeakSet):

2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] offlineasm: fix indentation in armOpcodeReversedOperands
        https://bugs.webkit.org/show_bug.cgi?id=183400

        Reviewed by Mark Lam.

        * offlineasm/arm.rb:

2018-03-06  Mark Lam  <mark.lam@apple.com>

        Prepare LLInt code to support pointer profiling.
        https://bugs.webkit.org/show_bug.cgi?id=183387
        <rdar://problem/38199678>

        Reviewed by JF Bastien.

        1. Introduced PtrTag enums for supporting pointer profiling later.

        2. Also introduced tagging, untagging, retagging, and tag removal placeholder
           template functions for the same purpose.

        3. Prepare the offlineasm for supporting pointer profiling later.

        4. Tagged some pointers in LLInt asm code.  Currently, these should have no
           effect on behavior.

        5. Removed returnToThrowForThrownException() because it is not used anywhere.

        6. Added the offlineasm folder to JavaScriptCore Xcode project so that it's
           easier to view and edit these files in Xcode.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/LLIntCallLinkInfo.h:
        (JSC::LLIntCallLinkInfo::unlink):
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        * llint/LLIntExceptions.cpp:
        (JSC::LLInt::returnToThrowForThrownException): Deleted.
        * llint/LLIntExceptions.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LLIntOffsetsExtractor.cpp:
        * llint/LLIntPCRanges.h:
        (JSC::LLInt::isLLIntPC):
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        (JSC::LLInt::handleHostCall):
        (JSC::LLInt::setUpCall):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/ast.rb:
        * offlineasm/instructions.rb:
        * offlineasm/risc.rb:
        * runtime/PtrTag.h: Added.
        (JSC::uniquePtrTagID):
        (JSC::ptrTag):
        (JSC::tagCodePtr):
        (JSC::untagCodePtr):
        (JSC::retagCodePtr):
        (JSC::removeCodePtrTag):

2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Assembler warnings: "use of r13 is deprecated"
        https://bugs.webkit.org/show_bug.cgi?id=183286

        Reviewed by Mark Lam.

        Usage of sp/r13 as operand Rm is deprecated on ARM. offlineasm
        sometimes generates assembly code that triggers this warning. Prevent
        this by simply switching operands.

        * offlineasm/arm.rb:

2018-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, fix incorrect assertion after r229309
        https://bugs.webkit.org/show_bug.cgi?id=182975

        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::TypeProfilerLog):

2018-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        Fix std::make_unique / new[] using system malloc
        https://bugs.webkit.org/show_bug.cgi?id=182975

        Reviewed by JF Bastien.

        Use Vector, FAST_ALLOCATED, or UniqueArray instead.

        * API/JSStringRefCF.cpp:
        (JSStringCreateWithCFString):
        * bytecode/BytecodeKills.h:
        * bytecode/BytecodeLivenessAnalysis.cpp:
        (JSC::BytecodeLivenessAnalysis::computeKills):
        * dfg/DFGDisassembler.cpp:
        (JSC::DFG::Disassembler::dumpDisassembly):
        * jit/PolymorphicCallStubRoutine.cpp:
        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
        * jit/PolymorphicCallStubRoutine.h:
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):
        * jsc.cpp:
        (currentWorkingDirectory):
        * llint/LLIntData.cpp:
        (JSC::LLInt::initialize):
        * llint/LLIntData.h:
        * runtime/ArgList.h:
        * runtime/StructureChain.h:
        * runtime/StructureIDTable.cpp:
        (JSC::StructureIDTable::StructureIDTable):
        (JSC::StructureIDTable::resize):
        * runtime/StructureIDTable.h:
        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::TypeProfilerLog):
        (JSC::TypeProfilerLog::initializeLog): Deleted.
        * runtime/TypeProfilerLog.h:
        (JSC::TypeProfilerLog::TypeProfilerLog): Deleted.
        * runtime/VM.cpp:
        (JSC::VM::~VM):
        (JSC::VM::acquireRegExpPatternContexBuffer):
        * runtime/VM.h:
        * testRegExp.cpp:
        (runFromFiles):
        * tools/HeapVerifier.cpp:
        (JSC::HeapVerifier::HeapVerifier):
        * tools/HeapVerifier.h:

2018-03-05  Mark Lam  <mark.lam@apple.com>

        JITThunk functions should only be called when the JIT is enabled.
        https://bugs.webkit.org/show_bug.cgi?id=183351
        <rdar://problem/38160091>

        Reviewed by Keith Miller.

        * jit/JITThunks.cpp:
        (JSC::JITThunks::ctiNativeCall):
        (JSC::JITThunks::ctiNativeConstruct):
        (JSC::JITThunks::ctiInternalFunctionCall):
        (JSC::JITThunks::ctiInternalFunctionConstruct):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        (JSC::VM::getCTIInternalFunctionTrampolineFor):

2018-03-05  Mark Lam  <mark.lam@apple.com>

        Gardening: build fix.

        Not reviewed.

        * interpreter/AbstractPC.h:
        (JSC::AbstractPC::AbstractPC):

2018-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Use WTF::ArithmeticOperations for CLoop overflow operations
        https://bugs.webkit.org/show_bug.cgi?id=183324

        Reviewed by JF Bastien.

        We have WTF::ArithmeticOperations which has operations with overflow checking.
        This is suitable for CLoop's overflow checking operations. This patch emits
        WTF::ArithmeticOperations for CLoop's overflow checking operations. And it is
        lowered to optimized code using CPU's overflow flag.

        * offlineasm/cloop.rb:

2018-03-05  Don Olmstead  <don.olmstead@sony.com>

        [CMake] Split JSC header copying into public and private targets
        https://bugs.webkit.org/show_bug.cgi?id=183251

        Reviewed by Konstantin Tokarev.

        * CMakeLists.txt:

2018-03-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [WTF] Move currentCPUTime and sleep(Seconds) to CPUTime.h and Seconds.h respectively
        https://bugs.webkit.org/show_bug.cgi?id=183312

        Reviewed by Mark Lam.

        Remove wtf/CurrentTime.h include pragma.

        * API/tests/ExecutionTimeLimitTest.cpp:
        (currentCPUTimeAsJSFunctionCallback):
        (testExecutionTimeLimit):
        * bytecode/SuperSampler.cpp:
        * dfg/DFGPlan.cpp:
        * heap/BlockDirectory.cpp:
        * heap/Heap.cpp:
        * heap/IncrementalSweeper.cpp:
        * inspector/agents/InspectorConsoleAgent.cpp:
        * inspector/agents/InspectorRuntimeAgent.cpp:
        * profiler/ProfilerDatabase.cpp:
        * runtime/CodeCache.h:
        * runtime/JSDateMath.cpp:
        * runtime/TypeProfilerLog.cpp:
        * runtime/VM.cpp:
        * runtime/Watchdog.cpp:
        (JSC::Watchdog::shouldTerminate):
        (JSC::Watchdog::startTimer):
        * testRegExp.cpp:
        * wasm/js/JSWebAssemblyCodeBlock.cpp:

2018-03-04  Tim Horton  <timothy_horton@apple.com>

        Make !ENABLE(DATA_DETECTION) iOS build actually succeed
        https://bugs.webkit.org/show_bug.cgi?id=183283
        <rdar://problem/38062148>

        Reviewed by Sam Weinig.

        * Configurations/FeatureDefines.xcconfig:

2018-03-02  Mark Lam  <mark.lam@apple.com>

        Make the LLInt probe work for ARM64.
        https://bugs.webkit.org/show_bug.cgi?id=183298
        <rdar://problem/38077413>

        Reviewed by Filip Pizlo.

        * llint/LowLevelInterpreter.asm:

2018-03-02  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Annotate more classes with WTF_MAKE_FAST_ALLOCATED
        https://bugs.webkit.org/show_bug.cgi?id=183279

        Reviewed by JF Bastien.

        * bytecode/BytecodeIntrinsicRegistry.h:
        * ftl/FTLThunks.h:
        * heap/CodeBlockSet.h:
        * heap/GCSegmentedArray.h:
        * heap/MachineStackMarker.h:
        * heap/MarkingConstraintSet.h:

2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>

        Remove monotonicallyIncreasingTime
        https://bugs.webkit.org/show_bug.cgi?id=182911

        Reviewed by Michael Catanzaro.

        * debugger/Debugger.cpp:
        (JSC::Debugger::willEvaluateScript):
        (JSC::Debugger::didEvaluateScript):
        * debugger/Debugger.h:
        * debugger/ScriptProfilingScope.h:
        * inspector/agents/InspectorDebuggerAgent.cpp:
        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
        * inspector/agents/InspectorHeapAgent.cpp:
        (Inspector::InspectorHeapAgent::snapshot):
        (Inspector::InspectorHeapAgent::didGarbageCollect):
        (Inspector::InspectorHeapAgent::dispatchGarbageCollectedEvent):
        * inspector/agents/InspectorHeapAgent.h:
        * inspector/agents/InspectorScriptProfilerAgent.cpp:
        (Inspector::InspectorScriptProfilerAgent::startTracking):
        (Inspector::InspectorScriptProfilerAgent::willEvaluateScript):
        (Inspector::InspectorScriptProfilerAgent::didEvaluateScript):
        (Inspector::InspectorScriptProfilerAgent::addEvent):
        (Inspector::buildSamples):
        * inspector/agents/InspectorScriptProfilerAgent.h:
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::takeSample):
        * runtime/SamplingProfiler.h:

2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>

        ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
        https://bugs.webkit.org/show_bug.cgi?id=183173

        Reviewed by Saam Barati.

        Classifier could propagate an error which does not occur at the first token
        of the given expression. We should check whether the given token is "async"
        instead of assertion.

        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseAssignmentExpression):

2018-03-01  Saam Barati  <sbarati@apple.com>

        We need to clear cached structures when having a bad time
        https://bugs.webkit.org/show_bug.cgi?id=183256
        <rdar://problem/36245022>

        Reviewed by Mark Lam.

        This patch makes both InternalFunctionAllocationProfile and the VM's
        structure cache having-a-bad-time aware. For InternalFunctionAllocationProfile,
        we clear them when they'd produce an object with a bad indexing type.
        For the VM's Structure cache, we conservatively clear the entire cache 
        since it may be housing Structures with bad indexing types.

        * runtime/FunctionRareData.h:
        (JSC::FunctionRareData::clearInternalFunctionAllocationProfile):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::haveABadTime):
        * runtime/StructureCache.h:
        (JSC::StructureCache::clear):

2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, fix exception check for ExceptionScope
        https://bugs.webkit.org/show_bug.cgi?id=183175

        * jsc.cpp:
        (GlobalObject::moduleLoaderFetch):

2018-02-28  Dominik Infuehr  <dinfuehr@igalia.com>

        [ARM] Fix compile error in debug builds by invoking unpoisoned().

        Reviewed by Mark Lam.

        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): Fix compile error.
        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress()): Ditto.
        (JSC::MacroAssemblerCodePtr::dataLocation()): Ditto.
        * yarr/YarrInterpreter.cpp:
        (JSC::Yarr::ByteCompiler::dumpDisjunction): use %zu for printf'ing size_t.

2018-02-28  JF Bastien  <jfbastien@apple.com>

        GC should sweep code block before deleting
        https://bugs.webkit.org/show_bug.cgi?id=183229
        <rdar://problem/32767615>

        Reviewed by Saam Barati, Fil Pizlo.

        Stub routines shouldn't get deleted before codeblocks have been
        swept, otherwise there's a small race window where the codeblock
        thinks it's still reachable.

        * heap/Heap.cpp:
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepInFinalize):

2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>

        JSC crash with `import("")`
        https://bugs.webkit.org/show_bug.cgi?id=183175

        Reviewed by Saam Barati.

        Add file existence and file type check for module loader implementation in jsc.cpp.
        This is not safe for TOCTOU, but it is OK since this functionality is used for the
        JSC shell (jsc.cpp): testing purpose.

        * jsc.cpp:
        (fillBufferWithContentsOfFile):
        (fetchModuleFromLocalFileSystem):

2018-02-27  Keith Miller  <keith_miller@apple.com>

        Replace TrustedImmPtr(0) with TrustedImmPtr(nullptr)
        https://bugs.webkit.org/show_bug.cgi?id=183195

        Reviewed by Mark Lam.

        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::patchableBranchPtr):
        (JSC::MacroAssembler::patchableBranchPtrWithPatch):
        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::branchPtrWithPatch):
        (JSC::MacroAssemblerARM::storePtrWithPatch):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::call):
        (JSC::MacroAssemblerARM64::tailRecursiveCall):
        (JSC::MacroAssemblerARM64::branchPtrWithPatch):
        (JSC::MacroAssemblerARM64::patchableBranchPtrWithPatch):
        (JSC::MacroAssemblerARM64::storePtrWithPatch):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
        (JSC::MacroAssemblerARMv7::patchableBranchPtr):
        (JSC::MacroAssemblerARMv7::patchableBranchPtrWithPatch):
        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
        * assembler/MacroAssemblerX86.h:
        (JSC::MacroAssemblerX86::branchPtrWithPatch):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::callWithSlowPathReturnType):
        (JSC::MacroAssemblerX86_64::call):
        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::compileToLowerCase):
        (JSC::DFG::SpeculativeJIT::compileMakeRope):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
        (JSC::DFG::SpeculativeJIT::compileArraySlice):
        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::emitCall):
        (JSC::DFG::SpeculativeJIT::compile):
        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::debugCall):
        (JSC::AssemblyHelpers::sanitizeStackInline):
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITCall.cpp:
        (JSC::JIT::compileOpCall):
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileOpCall):
        * jit/ScratchRegisterAllocator.cpp:
        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::wasmToJS):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::initParenContextFreeList):
        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
        (JSC::Yarr::YarrGenerator::generate):

2018-02-26  Mark Lam  <mark.lam@apple.com>

        Modernize FINALIZE_CODE and peer macros to use __VA_ARGS__ arguments.
        https://bugs.webkit.org/show_bug.cgi?id=183159
        <rdar://problem/37930837>

        Reviewed by Keith Miller.

        * assembler/LinkBuffer.h:
        * assembler/testmasm.cpp:
        (JSC::compile):
        * b3/B3Compile.cpp:
        (JSC::B3::compile):
        * b3/air/testair.cpp:
        * b3/testb3.cpp:
        (JSC::B3::testEntrySwitchSimple):
        (JSC::B3::testEntrySwitchNoEntrySwitch):
        (JSC::B3::testEntrySwitchWithCommonPaths):
        (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
        (JSC::B3::testEntrySwitchLoop):
        * bytecode/InlineAccess.cpp:
        (JSC::linkCodeInline):
        (JSC::InlineAccess::rewireStubAsJump):
        * bytecode/PolymorphicAccess.cpp:
        (JSC::PolymorphicAccess::regenerate):
        * dfg/DFGJITFinalizer.cpp:
        (JSC::DFG::JITFinalizer::finalize):
        (JSC::DFG::JITFinalizer::finalizeFunction):
        * dfg/DFGOSRExit.cpp:
        (JSC::DFG::OSRExit::compileOSRExit):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitThunkGenerator):
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::osrEntryThunkGenerator):
        * ftl/FTLJITFinalizer.cpp:
        (JSC::FTL::JITFinalizer::finalizeCommon):
        * ftl/FTLLazySlowPath.cpp:
        (JSC::FTL::LazySlowPath::generate):
        * ftl/FTLOSRExitCompiler.cpp:
        (JSC::FTL::compileStub):
        * ftl/FTLThunks.cpp:
        (JSC::FTL::genericGenerationThunkGenerator):
        (JSC::FTL::slowPathCallThunkGenerator):
        * jit/ExecutableAllocator.cpp:
        * jit/JIT.cpp:
        (JSC::JIT::link):
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::privateCompileHasIndexedProperty):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        (JSC::JIT::privateCompileGetByVal):
        (JSC::JIT::privateCompileGetByValWithCachedId):
        (JSC::JIT::privateCompilePutByVal):
        (JSC::JIT::privateCompilePutByValWithCachedId):
        * jit/JITPropertyAccess32_64.cpp:
        (JSC::JIT::stringGetByValStubGenerator):
        * jit/JITStubRoutine.h:
        * jit/Repatch.cpp:
        (JSC::linkPolymorphicCall):
        * jit/SpecializedThunkJIT.h:
        (JSC::SpecializedThunkJIT::finalize):
        * jit/ThunkGenerators.cpp:
        (JSC::throwExceptionFromCallSlowPathGenerator):
        (JSC::linkCallThunkGenerator):
        (JSC::linkPolymorphicCallThunkGenerator):
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::arityFixupGenerator):
        (JSC::unreachableGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * llint/LLIntThunks.cpp:
        (JSC::LLInt::generateThunkWithJumpTo):
        * wasm/WasmBBQPlan.cpp:
        (JSC::Wasm::BBQPlan::complete):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmOMGPlan.cpp:
        (JSC::Wasm::OMGPlan::work):
        * wasm/WasmThunks.cpp:
        (JSC::Wasm::throwExceptionFromWasmThunkGenerator):
        (JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::compile):

2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
        https://bugs.webkit.org/show_bug.cgi?id=182965

        Reviewed by Saam Barati.

        This patch extends FTL coverage for PutByVal by adding ArrayStorage and SlwoPutArrayStorage support.
        Basically large part of the patch is porting from DFG code. Since PutByVal already emits CheckInBounds
        for InBounds case, we do not have OutOfBounds check for that case.
        This is the last change for FTL to support all the types of DFG nodes except for CreateThis.

        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
        (JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
        For consistency, we use operationPutByValXXX and operationPutByValDirectXXX.
        But except for SlowPutArrayStorage case, basically it is meaningless since
        we do not have indexed accessors.

2018-02-26  Saam Barati  <sbarati@apple.com>

        validateStackAccess should not validate if the offset is within the stack bounds
        https://bugs.webkit.org/show_bug.cgi?id=183067
        <rdar://problem/37749988>

        Reviewed by Mark Lam.

        The validation rule was saying that any load from the stack must be
        within the stack bounds of the frame. However, it's natural for a user
        of B3 to emit code that may be outside of B3's stack bounds, but guard
        such a load with a branch. The FTL does exactly this with GetMyArgumentByVal.
        B3 is wrong to assert that this is a static property about all stack loads.

        * b3/B3Validate.cpp:

2018-02-23  Saam Barati  <sbarati@apple.com>

        Make Number.isInteger an intrinsic
        https://bugs.webkit.org/show_bug.cgi?id=183088

        Reviewed by JF Bastien.

        When profiling the ML subtest in ARES, I noticed it was spending some
        time in Number.isInteger. This patch makes that operation an intrinsic
        in the DFG/FTL. It might be a speedup by 1% or so on that subtest, but
        it's likely not an aggregate speedup on ARES. However, it is definitely
        faster than calling into a builtin function, so we might as well have
        it as an intrinsic.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileNumberIsInteger):
        (JSC::FTL::DFG::LowerDFGToB3::unboxDouble):
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * runtime/NumberConstructor.cpp:
        (JSC::NumberConstructor::finishCreation):
        (JSC::numberConstructorFuncIsInteger):
        * runtime/NumberConstructor.h:
        (JSC::NumberConstructor::isIntegerImpl):

2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>

        WebAssembly: cache memory address / size on instance
        https://bugs.webkit.org/show_bug.cgi?id=177305

        Reviewed by JF Bastien.

        Cache memory address/size in wasm:Instance to avoid load wasm:Memory 
        object during access to memory and memory size property in JiT

        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::B3IRGenerator::addCurrentMemory):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmInstance.h:
        (JSC::Wasm::Instance::cachedMemory const):
        (JSC::Wasm::Instance::cachedMemorySize const):
        (JSC::Wasm::Instance::createWeakPtr):
        (JSC::Wasm::Instance::setMemory):
        (JSC::Wasm::Instance::updateCachedMemory):
        (JSC::Wasm::Instance::offsetOfCachedMemory):
        (JSC::Wasm::Instance::offsetOfCachedMemorySize):
        (JSC::Wasm::Instance::offsetOfCachedIndexingMask):
        (JSC::Wasm::Instance::allocationSize):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::grow):
        (JSC::Wasm::Memory::registerInstance):
        * wasm/WasmMemory.h:
        (JSC::Wasm::Memory::indexingMask):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::evaluate):

2018-02-23  Saam Barati  <sbarati@apple.com>

        ArgumentsEliminationPhase has a branch on GetByOffset that should be an assert
        https://bugs.webkit.org/show_bug.cgi?id=182982

        Reviewed by Yusuke Suzuki.

        I don't know why this check was not always an assert. When we see
        a GetByOffset on an eliminated allocation, that allocation *must*
        be a PhantomClonedArguments. If it weren't, the GetByOffset would
        have escaped it. Because this transformation happens by visiting
        blocks in pre-order, and by visiting nodes in a block starting from
        index zero to index block->size() - 1, we're guaranteed that eliminated
        allocations get transformed before users of it, since we visit nodes
        in dominator order.

        * dfg/DFGArgumentsEliminationPhase.cpp:

2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Implement $vm.ftlTrue function for FTL testing
        https://bugs.webkit.org/show_bug.cgi?id=183071

        Reviewed by Mark Lam.

        Add $vm.ftlTrue, which becomes true if the caller is compiled in FTL.
        This is useful for testing whether the caller function is compiled in FTL.

        We also remove duplicate DFGTrue function in jsc.cpp. We have $vm.dfgTrue.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * jsc.cpp:
        (GlobalObject::finishCreation):
        (functionFalse1):
        (functionFalse2): Deleted.
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * tools/JSDollarVM.cpp:
        (JSC::functionFTLTrue):
        (JSC::JSDollarVM::finishCreation):

2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
        https://bugs.webkit.org/show_bug.cgi?id=182792

        Reviewed by Mark Lam.

        This patch adds HasIndexedProperty for ArrayStorage and SlowPutArrayStorage in FTL.
        HasIndexedProperty with ArrayStorage frequently causes FTL compilation failures
        in web-tooling-benchmarks.

        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):

2018-02-22  Mark Lam  <mark.lam@apple.com>

        Refactor MacroAssembler code to improve reuse and extensibility.
        https://bugs.webkit.org/show_bug.cgi?id=183054
        <rdar://problem/37797337>

        Reviewed by Saam Barati.

        * assembler/ARM64Assembler.h:
        * assembler/MacroAssembler.cpp:
        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerARM.h:
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::canCompact):
        (JSC::MacroAssemblerARM64::computeJumpType):
        (JSC::MacroAssemblerARM64::jumpSizeDelta):
        (JSC::MacroAssemblerARM64::link):
        (JSC::MacroAssemblerARM64::load64):
        (JSC::MacroAssemblerARM64::load64WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM64::load32):
        (JSC::MacroAssemblerARM64::load32WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM64::load16):
        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
        (JSC::MacroAssemblerARM64::load8):
        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
        (JSC::MacroAssemblerARM64::store64):
        (JSC::MacroAssemblerARM64::store64WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM64::store32):
        (JSC::MacroAssemblerARM64::store32WithAddressOffsetPatch):
        (JSC::MacroAssemblerARM64::store16):
        (JSC::MacroAssemblerARM64::store8):
        (JSC::MacroAssemblerARM64::getEffectiveAddress):
        (JSC::MacroAssemblerARM64::branchDoubleNonZero):
        (JSC::MacroAssemblerARM64::branchDoubleZeroOrNaN):
        (JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
        (JSC::MacroAssemblerARM64::loadDouble):
        (JSC::MacroAssemblerARM64::loadFloat):
        (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
        (JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
        (JSC::MacroAssemblerARM64::storeDouble):
        (JSC::MacroAssemblerARM64::storeFloat):
        (JSC::MacroAssemblerARM64::call):
        (JSC::MacroAssemblerARM64::jump):
        (JSC::MacroAssemblerARM64::tailRecursiveCall):
        (JSC::MacroAssemblerARM64::setCarry):
        (JSC::MacroAssemblerARM64::reemitInitialMoveWithPatch):
        (JSC::MacroAssemblerARM64::isBreakpoint):
        (JSC::MacroAssemblerARM64::invert):
        (JSC::MacroAssemblerARM64::readCallTarget):
        (JSC::MacroAssemblerARM64::replaceWithVMHalt):
        (JSC::MacroAssemblerARM64::replaceWithJump):
        (JSC::MacroAssemblerARM64::maxJumpReplacementSize):
        (JSC::MacroAssemblerARM64::patchableJumpSize):
        (JSC::MacroAssemblerARM64::repatchCall):
        (JSC::MacroAssemblerARM64::makeBranch):
        (JSC::MacroAssemblerARM64::makeCompareAndBranch):
        (JSC::MacroAssemblerARM64::makeTestBitAndBranch):
        (JSC::MacroAssemblerARM64::ARM64Condition):
        (JSC::MacroAssemblerARM64::moveWithFixedWidth):
        (JSC::MacroAssemblerARM64::load):
        (JSC::MacroAssemblerARM64::store):
        (JSC::MacroAssemblerARM64::tryLoadWithOffset):
        (JSC::MacroAssemblerARM64::tryLoadSignedWithOffset):
        (JSC::MacroAssemblerARM64::tryStoreWithOffset):
        (JSC::MacroAssemblerARM64::jumpAfterFloatingPointCompare):
        (JSC::MacroAssemblerARM64::linkCall):
        * assembler/MacroAssemblerARMv7.h:
        * assembler/MacroAssemblerMIPS.h:
        * assembler/MacroAssemblerX86Common.h:
        * assembler/ProbeStack.h:
        - Removed a forward declaration of an obsolete class.

2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>

        Remove sleep(double) and sleepMS(double) interfaces
        https://bugs.webkit.org/show_bug.cgi?id=183038

        Reviewed by Mark Lam.

        * bytecode/SuperSampler.cpp:
        (JSC::initializeSuperSampler):

2018-02-21  Don Olmstead  <don.olmstead@sony.com>

        [CMake] Split declaration of JSC headers into public and private
        https://bugs.webkit.org/show_bug.cgi?id=182980

        Reviewed by Michael Catanzaro.

        * CMakeLists.txt:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * PlatformWPE.cmake:
        * PlatformWin.cmake:

2018-02-20  Saam Barati  <sbarati@apple.com>

        DFG::VarargsForwardingPhase should eliminate getting argument length
        https://bugs.webkit.org/show_bug.cgi?id=182959

        Reviewed by Keith Miller.

        This patch teaches the DFG VarargsForwardingPhase to not treat
        length accesses on Cloned/Direct Arguments objects as escapes.
        It teaches this phase to materialize the length in the same
        way the ArgumentsEliminationPhase does.
        
        This is around a 0.5-1% speedup on ARES6 on my iMac. It speeds
        up the ML subtest by 2-4%.
        
        This patch also extends compileGetArgumentCountIncludingThis to take
        a parameter that is the inline call frame to load from (in the case
        where the inline call frame is a varargs frame). This allows the
        the emitCodeToGetArgumentsArrayLength helper function to just emit
        a GetArgumentCountIncludingThis node instead of a GetLocal. If we
        emitted a GetLocal, we'd need to rerun CPS rethreading.

        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArgumentsUtilities.cpp:
        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::getArgumentCount):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::argumentsInlineCallFrame):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis):
        * dfg/DFGVarargsForwardingPhase.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentCountIncludingThis):

2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Support ArrayPush for ArrayStorage
        https://bugs.webkit.org/show_bug.cgi?id=182782

        Reviewed by Saam Barati.

        This patch adds support for ArrayPush(ArrayStorage). We just port ArrayPush(ArrayStorage) in DFG to FTL.

        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):

2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Support ArrayPop for ArrayStorage
        https://bugs.webkit.org/show_bug.cgi?id=182783

        Reviewed by Saam Barati.

        This patch adds ArrayPop(ArrayStorage) support to FTL. We port the implementation in DFG to FTL.

        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):

2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
        https://bugs.webkit.org/show_bug.cgi?id=182731

        Reviewed by Saam Barati.

        This patch adds support for Arrayify(ArrayStorage/SlowPutArrayStorage) to FTL.
        Due to ArrayifyToStructure and CheckArray changes, necessary changes for
        supporting Arrayify in FTL are already done. Just allowing it in FTLCapabilities.cpp
        is enough.

        We fix FTL's CheckArray logic. Previously, CheckArray(SlowPutArrayStorage) does not pass
        ArrayStorage in FTL. But now it passes this as DFG does. Moreover, we fix DFG's CheckArray
        where CheckArray(ArrayStorage+NonArray) can pass ArrayStorage+Array.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::silentFill):
        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
        * dfg/DFGSpeculativeJIT.h:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):

2018-02-19  Saam Barati  <sbarati@apple.com>

        Don't use JSFunction's allocation profile when getting the prototype can be effectful
        https://bugs.webkit.org/show_bug.cgi?id=182942
        <rdar://problem/37584764>

        Reviewed by Mark Lam.

        Prior to this patch, the create_this implementation assumed that anything
        that is a JSFunction can use the object allocation profile and go down the
        fast path to allocate the |this| object. Implied by this approach is that
        accessing the 'prototype' property of the incoming function is not an
        effectful operation. This is inherent to the ObjectAllocationProfile 
        data structure: it caches the prototype field. However, getting the
        'prototype' property might be an effectful operation, e.g, it could
        be a getter. Many variants of functions in JS have the 'prototype' property
        as non-configurable. However, some functions, like bound functions, do not
        have the 'prototype' field with these attributes.
        
        This patch adds the notion of 'canUseAllocationProfile' to JSFunction
        and threads it through so that we only go down the fast path and use
        the allocation profile when the prototype property is non-configurable.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ClassExprNode::emitBytecode):
        * dfg/DFGOperations.cpp:
        * runtime/CommonSlowPaths.cpp:
        (JSC::SLOW_PATH_DECL):
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::prototypeForConstruction):
        (JSC::JSFunction::allocateAndInitializeRareData):
        (JSC::JSFunction::initializeRareData):
        (JSC::JSFunction::getOwnPropertySlot):
        (JSC::JSFunction::canUseAllocationProfileNonInline):
        * runtime/JSFunction.h:
        (JSC::JSFunction::ensureRareDataAndAllocationProfile):
        * runtime/JSFunctionInlines.h:
        (JSC::JSFunction::canUseAllocationProfile):

2018-02-19  Saam Barati  <sbarati@apple.com>

        Don't mark an array profile out of bounds for the cases where the DFG will convert the access to SaneChain
        https://bugs.webkit.org/show_bug.cgi?id=182912
        <rdar://problem/37685083>

        Reviewed by Keith Miller.

        In the baseline JIT and LLInt, when we loading a hole from an original array,
        with the array prototype chain being normal, we end up marking the ArrayProfile
        for that GetByVal as out of bounds. However, the DFG knows exactly how to
        optimize this case by returning undefined when loading from a hole. Currently,
        it only does this for Contiguous arrays (and sometimes Double arrays).
        This patch just makes sure to not mark the ArrayProfile as out of bounds
        in this scenario for Contiguous arrays, since the DFG will always optimize
        this case.
        
        However, we should extend this by profiling when a GetByVal loads a hole. By
        doing so, we can optimize this for Int32, ArrayStorage, and maybe even Double
        arrays. That work will happen in:
        https://bugs.webkit.org/show_bug.cgi?id=182940
        
        This patch is a 30-50%  speedup on JetStream's hash-map test. This patch
        speeds up JetStream by 1% when testing on my iMac.

        * dfg/DFGArrayMode.cpp:
        (JSC::DFG::ArrayMode::refine const):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * jit/JITOperations.cpp:
        (JSC::getByVal):
        (JSC::canAccessArgumentIndexQuickly): Deleted.
        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::getByVal):
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/CommonSlowPaths.h:
        (JSC::CommonSlowPaths::canAccessArgumentIndexQuickly):

2018-02-17  Filip Pizlo  <fpizlo@apple.com>

        GetArrayMask should support constant folding
        https://bugs.webkit.org/show_bug.cgi?id=182907

        Reviewed by Saam Barati.
        
        Implement constant folding for GetArrayMask. This revealed a bug in tryGetFoldableView, where it was
        ignoring the result of a jsDynamicCast<>(). This wasn't a bug before because it would have been
        impossible for that function to get called with a non-null value if the value was not an array view,
        due to type filtering in CheckArray, the fact that CheckArray had to dominate GetArrayLength, and
        the fact that the other tryGetFoldableView overload made sure that the array mode was some typed
        array.
        
        This isn't a measurable progression, but it does save a register in the codegen for typed array
        accesses. Hopefully these improvements add up.

        * assembler/AssemblerBuffer.h:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::tryGetFoldableView):

2018-02-18  Dominik Inführ  <dominik.infuehr@gmail.com>

        Offlineasm/MIPS: immediates need to be within 16-bit signed values
        https://bugs.webkit.org/show_bug.cgi?id=182890

        Reviewed by Michael Catanzaro.

        In Sequence.getModifiedListMIPS(), we allow immediate values within
        the range -0xffff..0xffff for immediates (addresses and other
        immediates), but then in Immediate.mipsOperand() and
        Address.mipsOperand() we raise if immediate values are not within
        -0x7fff..0x7fff. This is inconsistent, and broke compilation on mips
        since r228552 made the VM structure bigger meaning we address values
        with bigger offsets in llint. This change restricts the allowed range,
        so that a separate load of the value is done for values outside of
        that range.

        * offlineasm/mips.rb:

2018-02-17  Darin Adler  <darin@apple.com>

        Web Inspector: get rid of remaining uses of OptOutput<T>
        https://bugs.webkit.org/show_bug.cgi?id=180607

        Reviewed by Brian Burg.

        * inspector/AsyncStackTrace.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.
        * inspector/AsyncStackTrace.h: Ditto.
        * inspector/ConsoleMessage.cpp: Ditto.

        * inspector/ContentSearchUtilities.cpp: More Inspector namespace removal and ...
        (Inspector::ContentSearchUtilities::getRegularExpressionMatchesByLines): Use a
        Vector instead of a unique_ptr<Vector>.
        (Inspector::ContentSearchUtilities::lineEndings): Ditto.
        (Inspector::ContentSearchUtilities::stylesheetCommentPattern): Deleted.
        (Inspector::ContentSearchUtilities::findMagicComment): Use std::array instead of
        a Vector for a fixed size array; also got rid of reinterpret_cast.
        (Inspector::ContentSearchUtilities::findStylesheetSourceMapURL): Moved the regular
        expression here since it's the only place it was used.

        * inspector/ContentSearchUtilities.h: Cut down on unneeded includes.

        * inspector/InjectedScript.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.

        * inspector/InspectorProtocolTypes.h: Removed OptOutput. Simplified assertions.
        Removed base template for BindingTraits; we only need the specializations.

        * inspector/ScriptCallFrame.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.
        * inspector/ScriptCallFrame.h: Ditto.
        * inspector/ScriptCallStack.cpp: Ditto.
        * inspector/ScriptCallStack.h: Ditto.
        * inspector/agents/InspectorConsoleAgent.cpp: Ditto.
        * inspector/agents/InspectorConsoleAgent.h: Ditto.

        * inspector/agents/InspectorDebuggerAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame): Use std::optional& intead of
        OptOutput* for out arguments.
        * inspector/agents/InspectorDebuggerAgent.h: Ditto.

        * inspector/agents/InspectorHeapAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorHeapAgent::getPreview): Use std::optional& intead of OptOutput*
        for out arguments.
        * inspector/agents/InspectorHeapAgent.h: Ditto.

        * inspector/agents/InspectorRuntimeAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorRuntimeAgent::parse): Use std::optional& intead of OptOutput*
        for out arguments.
        (Inspector::InspectorRuntimeAgent::evaluate): Ditto.
        (Inspector::InspectorRuntimeAgent::callFunctionOn): Ditto.
        (Inspector::InspectorRuntimeAgent::saveResult): Ditto.
        * inspector/agents/InspectorRuntimeAgent.h: Ditto.

        * inspector/agents/InspectorScriptProfilerAgent.cpp: More Inspector namespace removal
        and removed some bogus const.
        * inspector/agents/InspectorScriptProfilerAgent.h: Ditto.

        * inspector/scripts/codegen/cpp_generator.py:
        (CppGenerator.cpp_type_for_unchecked_formal_in_parameter): Removed some bogus const.
        (CppGenerator.cpp_type_for_type_with_name): Ditto.
        (CppGenerator.cpp_type_for_formal_out_parameter): Use std::optional& instead of
        Inspector::Protocol::OptOutput*.
        (CppGenerator.cpp_type_for_formal_async_parameter): Ditto.
        (CppGenerator.cpp_type_for_stack_in_parameter): Ditto.
        (CppGenerator.cpp_type_for_stack_out_parameter): Ditto.

        * inspector/scripts/codegen/cpp_generator_templates.py: Removed ASSERT_DISABLED
        conditional around assertion code which will now compile to nothing if ASSERT is disabled.
        Build strings more simply in a few cases.

        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
        (CppBackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
        Use has_value instead of isAssigned and * operator instead of getValue() since std::optional
        replace OptOutput here.
        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
        Pass by reference instead of pointer now.

        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
        Removed ASSERT_DISABLED conditional around assertion code which will now compile to nothing
        if ASSERT is disabled.

        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
        (CppProtocolTypesImplementationGenerator._generate_assertion_for_object_declaration): Generate
        the assertion function unconditionally, but leave out the assertions if ASSERT_DISABLED is true.
        (CppProtocolTypesImplementationGenerator): Use auto instead of writing out JSON::Object::iterator.

        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
        (ObjCBackendDispatcherImplementationGenerator._generate_conversions_for_command): Build strings
        more simply.

        * inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:
        * inspector/scripts/tests/generic/expected/commands-with-optional-call-return-parameters.json-result:
        * inspector/scripts/tests/generic/expected/events-with-optional-parameters.json-result:
        * inspector/scripts/tests/generic/expected/type-requiring-runtime-casts.json-result:
        Rebaselined.

2018-02-16  Matt Lewis  <jlewis3@apple.com>

        Unreviewed, rolling out r228318.

        The patch that this attempted to fix was rolled out already.

        Reverted changeset:

        "Fix build on ARMv7 traditional JSCOnly bot after r228306"
        https://bugs.webkit.org/show_bug.cgi?id=182563
        https://trac.webkit.org/changeset/228318

2018-02-16  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, roll out r228306 (custom memcpy/memset) because the bots say that it was not a
        progression.

        * assembler/AssemblerBuffer.h:
        (JSC::AssemblerBuffer::append):
        * heap/LargeAllocation.cpp:
        (JSC::LargeAllocation::tryCreate):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::didAddToDirectory):
        * runtime/ArrayBuffer.cpp:
        (JSC::ArrayBufferContents::tryAllocate):
        (JSC::ArrayBufferContents::copyTo):
        (JSC::ArrayBuffer::createInternal):
        * runtime/ArrayBufferView.h:
        (JSC::ArrayBufferView::zeroRangeImpl):
        * runtime/ArrayConventions.cpp:
        (JSC::clearArrayMemset):
        * runtime/ArrayConventions.h:
        (JSC::clearArray):
        * runtime/ArrayPrototype.cpp:
        (JSC::arrayProtoPrivateFuncConcatMemcpy):
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::createOrGrowPropertyStorage):
        (JSC::Butterfly::growArrayRight):
        (JSC::Butterfly::resizeArray):
        * runtime/GenericTypedArrayViewInlines.h:
        (JSC::GenericTypedArrayView<Adaptor>::create):
        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::fastSlice):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSObject.cpp:
        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
        (JSC::JSObject::shiftButterflyAfterFlattening):
        * runtime/PropertyTable.cpp:
        (JSC::PropertyTable::PropertyTable):

2018-02-16  Saam Barati  <sbarati@apple.com>

        Fix bugs from r228411
        https://bugs.webkit.org/show_bug.cgi?id=182851
        <rdar://problem/37577732>

        Reviewed by JF Bastien.

        There was a bug from r228411 where inside the constant folding phase,
        we used an insertCheck method that didn't handle varargs. This would
        lead to a crash. When thinking about the fix for that function, I realized
        a made a couple of mistakes in r228411. One is probably a security bug, and
        the other is a performance bug because it'll prevent CSE for certain flavors
        of GetByVal nodes. Both blunders are similar in nature.
        
        In r228411, I added code in LICM that inserted a CheckVarargs node with children
        of another varargs node. However, to construct this new node's children,
        I just copied the AdjacencyList. This does a shallow copy. What we needed
        was a deep copy. We needed to create a new vararg AdjacencyList that points
        to edges that are deep copies of the original varargs children. This patch
        fixes this goof in LICM.
        
        r228411 made it so that PureValue over a varargs node would just compare actual
        AdjacencyLists structs. So, if you had two GetByVals that had equal santized
        children, their actual AdjacencyList structs are *not* bitwise equal, since they'll
        have different firstChild values. Instead, we need to do a deep compare of their
        adjacency lists. This patch teaches PureValue how to do that.

        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGGraph.h:
        (JSC::DFG::Graph::copyVarargChildren):
        * dfg/DFGInsertionSet.h:
        (JSC::DFG::InsertionSet::insertCheck):
        * dfg/DFGLICMPhase.cpp:
        (JSC::DFG::LICMPhase::attemptHoist):
        * dfg/DFGPureValue.cpp:
        (JSC::DFG::PureValue::dump const):
        * dfg/DFGPureValue.h:
        (JSC::DFG::PureValue::PureValue):
        (JSC::DFG::PureValue::op const):
        (JSC::DFG::PureValue::hash const):
        (JSC::DFG::PureValue::operator== const):
        (JSC::DFG::PureValue::isVarargs const):
        (JSC::DFG::PureValue::children const): Deleted.
        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):
        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):

2018-02-16  Matt Lewis  <jlewis3@apple.com>

        Unreviewed, rolling out r228546.

        This caused a consistent crash on all macOS WK2 platforms.

        Reverted changeset:

        "Web Inspector: get rid of remaining uses of OptOutput<T>"
        https://bugs.webkit.org/show_bug.cgi?id=180607
        https://trac.webkit.org/changeset/228546

2018-02-16  Fujii Hironori  <Hironori.Fujii@sony.com>

        fast/frames/sandboxed-iframe-navigation-top-denied.html is crashing in Inspector::createScriptCallStackForConsole::Exec for GTK
        https://bugs.webkit.org/show_bug.cgi?id=172952

        Reviewed by Michael Catanzaro.

        Null dereference of VM::topCallFrame happens in
        Inspector::createScriptCallStackForConsole if the ExecState has no
        call frames.

        * inspector/ScriptCallStackFactory.cpp:
        (Inspector::createScriptCallStack): Do null check of topCallFrame.
        (Inspector::createScriptCallStackForConsole): Ditto.

2018-02-15  Filip Pizlo  <fpizlo@apple.com>

        Objects that contain dangerous things should be allocated far away from objects that can do OOB
        https://bugs.webkit.org/show_bug.cgi?id=182843

        Reviewed by Saam Barati.
        
        To complete our object distancing plan, we need to put objects that can contain unpoisoned data
        far away from objects that cannot. Objects referenceable from JSValues cannot contain
        unpoisoned data, but auxiliary data can. This further divides auxiliary data that is meant for
        storing mostly JSValues from data that is meant for storing anything.
        
        This is achieved by having three SecurityKinds that are used for MarkedBlock selection and
        zeroing sort of the same way SecurityOriginToken already was.
        
        This change shouldn't make anything slower. If anything, it will be a small speed-up because it
        removes some cases of MarkedBlock zeroing since we don't need to zero blocks used for two of
        the SecurityKinds.

        * Sources.txt:
        * bytecode/ObjectAllocationProfileInlines.h:
        (JSC::ObjectAllocationProfile::initializeProfile):
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::addBlock):
        * heap/BlockDirectory.h:
        * heap/CellAttributes.cpp:
        (JSC::CellAttributes::dump const):
        * heap/CellAttributes.h:
        (JSC::CellAttributes::CellAttributes):
        * heap/LocalAllocator.cpp:
        (JSC::LocalAllocator::allocateSlowCase):
        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::didAddToDirectory):
        (JSC::MarkedBlock::Handle::associateWithOrigin): Deleted.
        * heap/MarkedBlock.h:
        * heap/SecurityKind.cpp: Added.
        (WTF::printInternal):
        * heap/SecurityKind.h: Added.
        * runtime/JSCellInlines.h:
        (JSC::JSCell::subspaceFor):
        * runtime/JSDestructibleObjectHeapCellType.cpp:
        (JSC::JSDestructibleObjectHeapCellType::JSDestructibleObjectHeapCellType):
        * runtime/JSObject.h:
        (JSC::JSObject::subspaceFor):
        * runtime/JSSegmentedVariableObjectHeapCellType.cpp:
        (JSC::JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType):
        * runtime/JSStringHeapCellType.cpp:
        (JSC::JSStringHeapCellType::JSStringHeapCellType):
        * runtime/Symbol.h:
        (JSC::Symbol::subspaceFor):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp:
        (JSC::JSWebAssemblyCodeBlockHeapCellType::JSWebAssemblyCodeBlockHeapCellType):

2018-02-15  Darin Adler  <darin@apple.com>

        Web Inspector: get rid of remaining uses of OptOutput<T>
        https://bugs.webkit.org/show_bug.cgi?id=180607

        Reviewed by Brian Burg.

        * inspector/AsyncStackTrace.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.
        * inspector/AsyncStackTrace.h: Ditto.
        * inspector/ConsoleMessage.cpp: Ditto.

        * inspector/ContentSearchUtilities.cpp: More Inspector namespace removal and ...
        (Inspector::ContentSearchUtilities::getRegularExpressionMatchesByLines): Use a
        Vector instead of a unique_ptr<Vector>.
        (Inspector::ContentSearchUtilities::lineEndings): Ditto.
        (Inspector::ContentSearchUtilities::stylesheetCommentPattern): Deleted.
        (Inspector::ContentSearchUtilities::findMagicComment): Use std::array instead of
        a Vector for a fixed size array; also got rid of reinterpret_cast.
        (Inspector::ContentSearchUtilities::findStylesheetSourceMapURL): Moved the regular
        expression here since it's the only place it was used.

        * inspector/ContentSearchUtilities.h: Cut down on unneeded includes.

        * inspector/InjectedScript.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.

        * inspector/InspectorProtocolTypes.h: Removed OptOutput. Simplified assertions.
        Removed base template for BindingTraits; we only need the specializations.

        * inspector/ScriptCallFrame.cpp: Removed explicit Inspector prefix from code that
        is inside the Inspector namespace already. Also use auto a bit.
        * inspector/ScriptCallFrame.h: Ditto.
        * inspector/ScriptCallStack.cpp: Ditto.
        * inspector/ScriptCallStack.h: Ditto.
        * inspector/agents/InspectorConsoleAgent.cpp: Ditto.
        * inspector/agents/InspectorConsoleAgent.h: Ditto.

        * inspector/agents/InspectorDebuggerAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame): Use std::optional& intead of
        OptOutput* for out arguments.
        * inspector/agents/InspectorDebuggerAgent.h: Ditto.

        * inspector/agents/InspectorHeapAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorHeapAgent::getPreview): Use std::optional& intead of OptOutput*
        for out arguments.
        * inspector/agents/InspectorHeapAgent.h: Ditto.

        * inspector/agents/InspectorRuntimeAgent.cpp: More Inspector namespace removal and ...
        (Inspector::InspectorRuntimeAgent::parse): Use std::optional& intead of OptOutput*
        for out arguments.
        (Inspector::InspectorRuntimeAgent::evaluate): Ditto.
        (Inspector::InspectorRuntimeAgent::callFunctionOn): Ditto.
        (Inspector::InspectorRuntimeAgent::saveResult): Ditto.
        * inspector/agents/InspectorRuntimeAgent.h: Ditto.

        * inspector/agents/InspectorScriptProfilerAgent.cpp: More Inspector namespace removal
        and removed some bogus const.
        * inspector/agents/InspectorScriptProfilerAgent.h: Ditto.

        * inspector/scripts/codegen/cpp_generator.py:
        (CppGenerator.cpp_type_for_unchecked_formal_in_parameter): Removed some bogus const.
        (CppGenerator.cpp_type_for_type_with_name): Ditto.
        (CppGenerator.cpp_type_for_formal_out_parameter): Use std::optional& instead of
        Inspector::Protocol::OptOutput*.
        (CppGenerator.cpp_type_for_formal_async_parameter): Ditto.
        (CppGenerator.cpp_type_for_stack_in_parameter): Ditto.
        (CppGenerator.cpp_type_for_stack_out_parameter): Ditto.

        * inspector/scripts/codegen/cpp_generator_templates.py: Removed ASSERT_DISABLED
        conditional around assertion code which will now compile to nothing if ASSERT is disabled.
        Build strings more simply in a few cases.

        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
        (CppBackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
        Use has_value instead of isAssigned and * operator instead of getValue() since std::optional
        replace OptOutput here.
        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
        Pass by reference instead of pointer now.

        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
        Removed ASSERT_DISABLED conditional around assertion code which will now compile to nothing
        if ASSERT is disabled.

        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
        (CppProtocolTypesImplementationGenerator._generate_assertion_for_object_declaration): Generate
        the assertion function unconditionally, but leave out the assertions if ASSERT_DISABLED is true.
        (CppProtocolTypesImplementationGenerator): Use auto instead of writing out JSON::Object::iterator.

        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
        (ObjCBackendDispatcherImplementationGenerator._generate_conversions_for_command): Build strings
        more simply.

        * inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:
        * inspector/scripts/tests/generic/expected/commands-with-optional-call-return-parameters.json-result:
        * inspector/scripts/tests/generic/expected/events-with-optional-parameters.json-result:
        * inspector/scripts/tests/generic/expected/type-requiring-runtime-casts.json-result:
        Rebaselined.

2018-02-15  Filip Pizlo  <fpizlo@apple.com>

        Unreviewed, roll out r228366 since it did not progress anything.

        * heap/Heap.cpp:
        (JSC::Heap::finalizeUnconditionalFinalizers):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::visitChildren):
        (JSC::ErrorInstance::finalizeUnconditionally): Deleted.
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::stackTrace):
        (JSC::ErrorInstance::subspaceFor): Deleted.
        * runtime/Exception.cpp:
        (JSC::Exception::visitChildren):
        (JSC::Exception::finalizeUnconditionally): Deleted.
        * runtime/Exception.h:
        * runtime/StackFrame.cpp:
        (JSC::StackFrame::visitChildren):
        (JSC::StackFrame::isFinalizationCandidate): Deleted.
        (JSC::StackFrame::finalizeUnconditionally): Deleted.
        * runtime/StackFrame.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2018-02-15  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Remove monotonicallyIncreasingTime and currentTime
        https://bugs.webkit.org/show_bug.cgi?id=182793

        Reviewed by Saam Barati.

        We would like to drop monotonicallyIncreasingTime and currentTime from our tree by
        replacing them with MonotonicTime and WallTime, which are well-typed alternatives,
        compared to double.
        This patch removes monotonicallyIncreasingTime and currentTime in JSC.

        * b3/testb3.cpp:
        (JSC::B3::testComplex):
        * dfg/DFGPhase.h:
        (JSC::DFG::runAndLog):
        * dfg/DFGPlan.cpp:
        (JSC::DFG::Plan::compileInThread):
        (JSC::DFG::Plan::compileInThreadImpl):
        * dfg/DFGPlan.h:
        * dynbench.cpp:
        (JSC::benchmarkImpl):
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::isPagedOut):
        * heap/BlockDirectory.h:
        * heap/FullGCActivityCallback.cpp:
        (JSC::FullGCActivityCallback::doCollection):
        * heap/Heap.cpp:
        (JSC::Heap::isPagedOut):
        (JSC::Heap::sweepSynchronously):
        * heap/Heap.h:
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::isPagedOut):
        * heap/MarkedSpace.h:
        * inspector/agents/InspectorConsoleAgent.cpp:
        (Inspector::InspectorConsoleAgent::startTiming):
        (Inspector::InspectorConsoleAgent::stopTiming):
        * inspector/agents/InspectorConsoleAgent.h:
        * inspector/agents/InspectorRuntimeAgent.cpp:
        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
        * jit/JIT.cpp:
        (JSC::JIT::compileWithoutLinking):
        (JSC::JIT::compileTimeStats):
        * jit/JIT.h:
        * jsc.cpp:
        (StopWatch::start):
        (StopWatch::stop):
        (StopWatch::getElapsedMS):
        (functionPreciseTime):
        (runJSC):
        * profiler/ProfilerDatabase.cpp:
        (JSC::Profiler::Database::logEvent):
        * profiler/ProfilerEvent.cpp:
        (JSC::Profiler::Event::toJS const):
        * profiler/ProfilerEvent.h:
        (JSC::Profiler::Event::Event):
        (JSC::Profiler::Event::time const):
        * runtime/CodeCache.cpp:
        (JSC::CodeCacheMap::pruneSlowCase):
        * runtime/CodeCache.h:
        (JSC::CodeCacheMap::CodeCacheMap):
        (JSC::CodeCacheMap::prune):
        * runtime/DateConstructor.cpp:
        (JSC::callDate):
        * runtime/TypeProfilerLog.cpp:
        (JSC::TypeProfilerLog::processLogEntries):
        * testRegExp.cpp:
        (StopWatch::start):
        (StopWatch::stop):
        (StopWatch::getElapsedMS):

2018-02-14  Keith Miller  <keith_miller@apple.com>

        We should be able to jsDynamicCast from JSType when possible
        https://bugs.webkit.org/show_bug.cgi?id=182804

        Reviewed by Filip Pizlo and Mark Lam.

        This patch beefs up jsDynamicCast in some of the cases where we
        can use the JSType to quickly determine if a cell is a subclass of
        the desired type. Since all JSCells have a range of JSTypes they support,
        if there is a range exclusive to a class and all subclasses we can use
        that range to quickly determine if the cast should be successful.

        Additionally, the JSValue versions of jsCast and jsDynamicCast now
        call the JSCell version after checking the value is a cell.

        Finally, the casting functions have been moved to a new header,
        JSCast.h

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * bytecode/CallVariant.h:
        * bytecode/CodeBlock.h:
        * bytecode/ExecutableToCodeBlockEdge.h:
        * bytecode/TrackedReferences.h:
        * bytecode/UnlinkedCodeBlock.h:
        * bytecode/UnlinkedFunctionExecutable.h:
        * dfg/DFGAbstractValue.h:
        * dfg/DFGCommonData.h:
        * dfg/DFGFrozenValue.h:
        * dfg/DFGStructureAbstractValue.h:
        * heap/CellContainerInlines.h:
        * heap/ConservativeRoots.cpp:
        * heap/GCLogging.cpp:
        * heap/HeapInlines.h:
        * heap/HeapSnapshotBuilder.cpp:
        * heap/MarkedBlock.cpp:
        * heap/MarkedBlockInlines.h:
        * heap/SubspaceInlines.h:
        * heap/WeakInlines.h:
        * jit/JITOpcodes.cpp:
        * jit/JITOpcodes32_64.cpp:
        * llint/LLIntOffsetsExtractor.cpp:
        * runtime/ArrayBufferNeuteringWatchpoint.h:
        * runtime/BigIntPrototype.cpp:
        * runtime/ClassInfo.h:
        * runtime/CustomGetterSetter.h:
        * runtime/FunctionRareData.h:
        * runtime/GetterSetter.h:
        * runtime/InferredType.h:
        * runtime/InferredTypeTable.h:
        * runtime/InferredValue.h:
        * runtime/InternalFunction.cpp:
        (JSC::InternalFunction::finishCreation):
        * runtime/JSAPIValueWrapper.h:
        * runtime/JSArray.h:
        (JSC::JSArray::finishCreation):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::finishCreation):
        * runtime/JSCast.h: Added.
        (JSC::jsCast):
        (JSC::JSCastingHelpers::jsDynamicCastGenericImpl):
        (JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl):
        (JSC::JSCastingHelpers::JSDynamicCastTraits::cast):
        (JSC::jsDynamicCast):
        * runtime/JSCell.cpp:
        * runtime/JSCell.h:
        (JSC::jsCast): Deleted.
        (JSC::jsDynamicCast): Deleted.
        * runtime/JSCellInlines.h:
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::finishCreation):
        * runtime/JSJob.h:
        * runtime/JSObject.h:
        (JSC::JSObject::finishCreation):
        * runtime/JSPromiseDeferred.h:
        * runtime/JSPropertyNameEnumerator.h:
        * runtime/NativeStdFunctionCell.h:
        * runtime/ScopedArgumentsTable.h:
        * runtime/SparseArrayValueMap.h:
        * runtime/Structure.h:
        * runtime/StructureChain.h:
        * runtime/StructureRareData.h:
        * tools/CellProfile.h:
        * wasm/js/JSWebAssemblyCodeBlock.h:

2018-02-14  Michael Saboff  <msaboff@apple.com>

        Crash: triggerOMGTierUpThunkGenerator() doesn't align the stack pointer before calling C++ code
        https://bugs.webkit.org/show_bug.cgi?id=182808

        Reviewed by Keith Miller.

        Set up a proper frame with a prologue and epilogue to align the stack pointer for the rest of the
        thunk.

        * wasm/WasmThunks.cpp:
        (JSC::Wasm::triggerOMGTierUpThunkGenerator):

2018-02-14  Saam Barati  <sbarati@apple.com>

        Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
        https://bugs.webkit.org/show_bug.cgi?id=182801

        Reviewed by Keith Miller.

        VMTraps would sometimes install traps when it paused the JS thread when it
        was in C code. This is wrong, as installing traps mallocs, and the JS thread
        may have been holding the malloc lock while in C code. This could lead to a
        deadlock when C code was holding the malloc lock.
        
        This patch makes it so that we only install traps when we've proven the PC
        is in JIT or LLInt code. If we're in JIT/LLInt code, we are guaranteed that
        we're not holding the malloc lock.

        * jsc.cpp:
        (GlobalObject::finishCreation):
        (functionMallocInALoop):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::tryInstallTrapBreakpoints):

2018-02-14  Michael Saboff  <msaboff@apple.com>

        REGRESSION(225695) : com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::RegExp::match + 630 :: stack overflow
        https://bugs.webkit.org/show_bug.cgi?id=182705

        Reviewed by Mark Lam.

        Moved the pattern context buffer used by YARR JIT'ed code from a stack local to a lazily allocated
        buffer on the VM.  Exposed when the buffer is needed to reduce likelihood that we'd allocated it.
        Guarded use of the buffer with a lock since the DFG compiler may call into YARR JIT'ed code on a
        compilation thread.

        * runtime/RegExpInlines.h:
        (JSC::RegExp::matchInline):
        * runtime/VM.cpp:
        (JSC::VM::~VM):
        (JSC::VM::acquireRegExpPatternContexBuffer):
        (JSC::VM::releaseRegExpPatternContexBuffer):
        * runtime/VM.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generate):
        (JSC::Yarr::YarrGenerator::backtrack):
        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
        (JSC::Yarr::YarrGenerator::generateEnter):
        (JSC::Yarr::YarrGenerator::generateReturn):
        (JSC::Yarr::YarrGenerator::YarrGenerator):
        (JSC::Yarr::YarrGenerator::compile):
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrCodeBlock::usesPatternContextBuffer):
        (JSC::Yarr::YarrCodeBlock::setUsesPaternContextBuffer):

2018-02-13  Saam Barati  <sbarati@apple.com>

        putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
        https://bugs.webkit.org/show_bug.cgi?id=182755
        <rdar://problem/37080864>

        Reviewed by Keith Miller.

        putDirectIndexSlowOrBeyondVectorLength with non-zero attributes only converted
        the object in question to a dictionary indexing mode when the index is less than
        the vector length. This makes no sense. If we're defining a getter, setter, or read
        only property, we must always enter the dictionary indexing mode irrespective
        of the index in relation to the vector length.

        * runtime/JSObject.cpp:
        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):

2018-02-13  Saam Barati  <sbarati@apple.com>

        Follup fix to r228411 for 32-bit builds. I missed a place where we used non vararg getter for child2().

        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):

2018-02-13  Guillaume Emont  <guijemont@igalia.com>

        [YarrJIT][ARM] We need to save r8 as it is the initial start register
        https://bugs.webkit.org/show_bug.cgi?id=182157

        Reviewed by Saam Barati.

        Register r8 is the initial start register since r224172, so we need to
        save it. We still need to save r6 as well even though it is not the
        initial start register any more, since it is used by the
        MacroAssembler which we use (we get crashes in some situations if we
        don't save r6). This issue was discovered because
        stress/regress-174044.js crashes on a raspberry pi 2 when compiled in
        -O2.

        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generateEnter):
        (JSC::Yarr::YarrGenerator::generateReturn):

2018-02-13  Caitlin Potter  <caitp@igalia.com>

        [JSC] cache TaggedTemplate arrays by callsite rather than by contents
        https://bugs.webkit.org/show_bug.cgi?id=182717

        Reviewed by Yusuke Suzuki.

        https://github.com/tc39/ecma262/pull/890 imposes a change to template
        literals, to allow template callsite arrays to be collected when the
        code containing the tagged template call is collected. This spec change
        has received concensus and been ratified.

        This change eliminates the eternal map associating template contents
        with arrays.

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setConstantRegisters):
        * bytecode/DirectEvalCodeCache.cpp:
        (JSC::DirectEvalCodeCache::setSlow):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::addTemplateObjectConstant):
        (JSC::BytecodeGenerator::emitGetTemplateObject):
        (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
        * bytecompiler/BytecodeGenerator.h:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseMemberExpression):
        * parser/Parser.h:
        * parser/ParserModes.h:
        * runtime/EvalExecutable.h:
        (JSC::EvalExecutable::allowDirectEvalCache const):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::templateRegistry): Deleted.
        * runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
        (JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
        (JSC::JSTemplateObjectDescriptor::create):
        (JSC::JSTemplateObjectDescriptor::destroy):
        (JSC::JSTemplateObjectDescriptor::createTemplateObject):
        * runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
        (JSC::isTemplateObjectDescriptor):
        * runtime/JSTemplateRegistryKey.cpp: Removed.
        * runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
        (JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
        * runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
        (JSC::TemplateObjectDescriptor::operator== const):
        (JSC::TemplateObjectDescriptor::operator!= const):
        (JSC::TemplateObjectDescriptor::Hasher::hash):
        (JSC::TemplateObjectDescriptor::Hasher::equal):
        (JSC::TemplateObjectDescriptor::create):
        (JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
        (JSC::TemplateObjectDescriptor::calculateHash):
        * runtime/TemplateRegistry.h: Removed.
        * runtime/TemplateRegistryKeyTable.cpp: Removed.
        * runtime/TemplateRegistryKeyTable.h: Removed.
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::templateRegistryKeyTable): Deleted.
        * runtime/VMEntryScope.cpp:

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setConstantRegisters):
        * bytecode/DirectEvalCodeCache.cpp:
        (JSC::DirectEvalCodeCache::setSlow):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::addTemplateObjectConstant):
        (JSC::BytecodeGenerator::emitGetTemplateObject):
        (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
        * bytecompiler/BytecodeGenerator.h:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseMemberExpression):
        * parser/Parser.h:
        * parser/ParserModes.h:
        * runtime/EvalExecutable.h:
        (JSC::EvalExecutable::allowDirectEvalCache const):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::templateRegistry): Deleted.
        * runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
        (JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
        (JSC::JSTemplateObjectDescriptor::create):
        (JSC::JSTemplateObjectDescriptor::destroy):
        (JSC::JSTemplateObjectDescriptor::createTemplateObject):
        * runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
        (JSC::isTemplateObjectDescriptor):
        * runtime/JSTemplateRegistryKey.cpp: Removed.
        * runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
        (JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
        * runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
        (JSC::TemplateObjectDescriptor::operator== const):
        (JSC::TemplateObjectDescriptor::operator!= const):
        (JSC::TemplateObjectDescriptor::Hasher::hash):
        (JSC::TemplateObjectDescriptor::Hasher::equal):
        (JSC::TemplateObjectDescriptor::create):
        (JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
        (JSC::TemplateObjectDescriptor::calculateHash):
        * runtime/TemplateRegistry.h: Removed.
        * runtime/TemplateRegistryKeyTable.cpp: Removed.
        * runtime/TemplateRegistryKeyTable.h: Removed.
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::templateRegistryKeyTable): Deleted.
        * runtime/VMEntryScope.cpp:

        * CMakeLists.txt:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::setConstantRegisters):
        * bytecode/DirectEvalCodeCache.cpp:
        (JSC::DirectEvalCodeCache::setSlow):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::addTemplateObjectConstant):
        (JSC::BytecodeGenerator::emitGetTemplateObject):
        (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
        * bytecompiler/BytecodeGenerator.h:
        * parser/Parser.cpp:
        (JSC::Parser<LexerType>::parseInner):
        (JSC::Parser<LexerType>::parseMemberExpression):
        * parser/Parser.h:
        * parser/ParserModes.h:
        * runtime/EvalExecutable.h:
        (JSC::EvalExecutable::allowDirectEvalCache const):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::templateRegistry): Deleted.
        * runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
        (JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
        (JSC::JSTemplateObjectDescriptor::create):
        (JSC::JSTemplateObjectDescriptor::destroy):
        (JSC::JSTemplateObjectDescriptor::createTemplateObject):
        * runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
        (JSC::isTemplateObjectDescriptor):
        * runtime/JSTemplateRegistryKey.cpp: Removed.
        * runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
        (JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
        * runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
        (JSC::TemplateObjectDescriptor::operator== const):
        (JSC::TemplateObjectDescriptor::operator!= const):
        (JSC::TemplateObjectDescriptor::Hasher::hash):
        (JSC::TemplateObjectDescriptor::Hasher::equal):
        (JSC::TemplateObjectDescriptor::create):
        (JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
        (JSC::TemplateObjectDescriptor::calculateHash):
        * runtime/TemplateRegistry.h: Removed.
        * runtime/TemplateRegistryKeyTable.cpp: Removed.
        * runtime/TemplateRegistryKeyTable.h: Removed.
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::templateRegistryKeyTable): Deleted.
        * runtime/VMEntryScope.cpp:

2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>

        Support GetArrayLength on ArrayStorage in the FTL
        https://bugs.webkit.org/show_bug.cgi?id=182625

        Reviewed by Saam Barati.

        This patch adds GetArrayLength and CheckArray + ArrayStorage & SlowPutArrayStorage support for FTL.
        The implementation is trivial; just porting one in DFG to FTL.

        This fixes several FTL compilation failures in web-tooling-benchmarks while we still need to support
        ArrayPush, ArrayPop, Arrayify, and PutByVal.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::checkArray):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
        (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):
        (JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForCheckArray):

2018-02-10  Filip Pizlo  <fpizlo@apple.com>

        Lock down JSFunction
        https://bugs.webkit.org/show_bug.cgi?id=182652

        Reviewed by Saam Barati.
        
        This poisons pointers in JSFunction and puts all of the types in the JSFunction hierarchy in
        isospaces.
        
        This is so neutral on JetStream: 0.01% slower with p = 0.969211.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
        (JSC::DFG::SpeculativeJIT::compileNewFunction):
        (JSC::DFG::SpeculativeJIT::compileCreateThis):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
        (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
        (JSC::FTL::DFG::LowerDFGToB3::weakPointer):
        (JSC::FTL::DFG::LowerDFGToB3::weakPoisonedPointer):
        * ftl/FTLOutput.h:
        (JSC::FTL::Output::weakPointer):
        (JSC::FTL::Output::weakPoisonedPointer):
        * heap/MarkedSpace.cpp:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_create_this):
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/JSAsyncFunction.h:
        (JSC::JSAsyncFunction::subspaceFor):
        * runtime/JSAsyncGeneratorFunction.h:
        (JSC::JSAsyncGeneratorFunction::subspaceFor):
        * runtime/JSBoundFunction.h:
        (JSC::JSBoundFunction::subspaceFor):
        * runtime/JSCPoison.h:
        * runtime/JSCustomGetterSetterFunction.h:
        (JSC::JSCustomGetterSetterFunction::subspaceFor):
        * runtime/JSFunction.h:
        (JSC::JSFunction::subspaceFor):
        * runtime/JSGeneratorFunction.h:
        (JSC::JSGeneratorFunction::subspaceFor):
        * runtime/JSNativeStdFunction.h:
        (JSC::JSNativeStdFunction::subspaceFor):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * wasm/js/WebAssemblyFunction.h:
        * wasm/js/WebAssemblyWrapperFunction.h:

2018-02-12  Saam Barati  <sbarati@apple.com>

        Add a GetIndexMask node and make it an input to GetByVal for array and typed array accesses in DFG SSA
        https://bugs.webkit.org/show_bug.cgi?id=182633
        <rdar://problem/37441037>

        Reviewed by Keith Miller.

        This patch introduces a GetIndexMask node to DFG SSA. This is an input to
        GetByVal for the GetByVal variants that do conservative index masking.
        The reason I'm adding this node is I realized there were loads of
        the butterfly index mask inside loops that B3 couldn't reason about
        because B3 can't arbitrarily hoist loads out of loops if those loops
        have side exits (because the side exit might be protecting the safety of the
        load). However, for these loops I analyzed, the DFG would be able to hoist
        these loads out of loops because it knows about JS semantics to correctly
        reason about the safety of hoisting the load.
        
        This is a 1% speedup on JetStream on Mac and iOS in my testing.
        
        This patch also adds some infrastructure for eliminating and doing CSE on
        varargs nodes. Because this patch makes GetByVal a varargs node, I ran into
        issues we never had before. We never had a varargs node that could be CSEd or be
        hoisted out of a loop until I made GetByVal varargs. To make it all work,
        I added a CheckVarargs node. This is just like Check, but it's varargs.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGAdjacencyList.h:
        (JSC::DFG::AdjacencyList::AdjacencyList):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGBackwardsPropagationPhase.cpp:
        (JSC::DFG::BackwardsPropagationPhase::propagate):
        * dfg/DFGBasicBlock.cpp:
        (JSC::DFG::BasicBlock::replaceTerminal):
        * dfg/DFGBasicBlock.h:
        (JSC::DFG::BasicBlock::findTerminal const):
        * dfg/DFGBasicBlockInlines.h:
        (JSC::DFG::BasicBlock::replaceTerminal):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGCFGSimplificationPhase.cpp:
        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
        * dfg/DFGCPSRethreadingPhase.cpp:
        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
        * dfg/DFGCSEPhase.cpp:
        * dfg/DFGCleanUpPhase.cpp:
        (JSC::DFG::CleanUpPhase::run):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        (JSC::DFG::ConstantFoldingPhase::fixUpsilons):
        * dfg/DFGDCEPhase.cpp:
        (JSC::DFG::DCEPhase::run):
        (JSC::DFG::DCEPhase::fixupBlock):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::fixupChecksInBlock):
        * dfg/DFGHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGHeapLocation.h:
        * dfg/DFGIntegerCheckCombiningPhase.cpp:
        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
        * dfg/DFGLICMPhase.cpp:
        (JSC::DFG::LICMPhase::attemptHoist):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::remove):
        (JSC::DFG::Node::convertToIdentityOn):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::replaceWith):
        * dfg/DFGNodeType.h:
        * dfg/DFGObjectAllocationSinkingPhase.cpp:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGPureValue.cpp:
        (JSC::DFG::PureValue::dump const):
        * dfg/DFGPureValue.h:
        (JSC::DFG::PureValue::PureValue):
        * dfg/DFGPutStackSinkingPhase.cpp:
        * dfg/DFGSSAConversionPhase.cpp:
        (JSC::DFG::SSAConversionPhase::run):
        * dfg/DFGSSALoweringPhase.cpp:
        (JSC::DFG::SSALoweringPhase::handleNode):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):
        (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStoreBarrierClusteringPhase.cpp:
        * dfg/DFGValidate.cpp:
        * dfg/DFGVarargsForwardingPhase.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayMask):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
        (JSC::FTL::DFG::LowerDFGToB3::maskedIndex):
        (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):

2018-02-12  Mark Lam  <mark.lam@apple.com>

        Miscellaneous refactoring of offlineasm.
        https://bugs.webkit.org/show_bug.cgi?id=182702
        <rdar://problem/37467887>

        Reviewed by Filip Pizlo.

        1. Refactor out the emission of $asm.comment, $asm.codeOrigin, $asm.annotation,
           and $asm.debugAnnotation into a recordMetaData method.  This standardizes how
           we emit this metadata and makes all backends do it the same way.

        2. Add the ability to include custom offlineasm scripts from WebKitAdditions in
           the future.

        * offlineasm/arm.rb:
        * offlineasm/arm64.rb:
        * offlineasm/ast.rb:
        * offlineasm/backends.rb:
        * offlineasm/cloop.rb:
        * offlineasm/config.rb:
        * offlineasm/mips.rb:
        * offlineasm/risc.rb:
        * offlineasm/x86.rb:

2018-02-12  Saam Barati  <sbarati@apple.com>

        DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
        https://bugs.webkit.org/show_bug.cgi?id=182706
        <rdar://problem/36833681>

        Reviewed by Filip Pizlo.

        When we added support for PhantomNewArrayBuffer, we forgot to update
        the emitCodeToGetArgumentsArrayLength function to handle PhantomNewArrayBuffer.
        This patch adds that support. It's trivial to generate the length for
        a PhantomNewArrayBuffer node since it's a constant buffer, with a constant
        length.

        * dfg/DFGArgumentsUtilities.cpp:
        (JSC::DFG::emitCodeToGetArgumentsArrayLength):

2018-02-12  Mark Lam  <mark.lam@apple.com>

        Add more support for pointer preparations.
        https://bugs.webkit.org/show_bug.cgi?id=182703
        <rdar://problem/37469451>

        Reviewed by Saam Barati.

        * llint/LLIntData.h:
        (JSC::LLInt::getCodePtr):
        * llint/LLIntPCRanges.h:
        (JSC::LLInt::isLLIntPC):
        * runtime/Options.cpp:
        (JSC::recomputeDependentOptions):

2018-02-12  Mark Lam  <mark.lam@apple.com>

        Fix missing exception check in RegExpObject::matchGlobal().
        https://bugs.webkit.org/show_bug.cgi?id=182701
        <rdar://problem/37465865>

        Reviewed by Michael Saboff.

        This issue was discovered when running JSC tests on an asm LLInt build with
        JSC_useJIT=false.

        * runtime/RegExpObject.cpp:
        (JSC::RegExpObject::matchGlobal):

2018-02-11  Guillaume Emont  <guijemont@igalia.com>

        [MIPS] JSC needs to be built with -latomic
        https://bugs.webkit.org/show_bug.cgi?id=182610

        Reviewed by Žan Doberšek.

        Since r228149, on MIPS we need to link with -latomic, because
        __atomic_fetch_add_8 is not available as a compiler intrinsic.

        * CMakeLists.txt:

2018-02-09  Filip Pizlo  <fpizlo@apple.com>

        Don't waste memory for error.stack
        https://bugs.webkit.org/show_bug.cgi?id=182656

        Reviewed by Saam Barati.
        
        This makes the StackFrames in ErrorInstance and Exception weak. We simply forget their
        contents if we GC.
        
        This isn't going to happen under normal operation since your callees and code blocks will
        still be alive when you ask for .stack.
        
        Bug 182650 tracks improving this so that it's not lossy. For now, I think it's worth it,
        since it is likely to recover 3-5 MB on membuster.

        * heap/Heap.cpp:
        (JSC::Heap::finalizeUnconditionalFinalizers):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::visitChildren):
        (JSC::ErrorInstance::finalizeUnconditionally):
        * runtime/ErrorInstance.h:
        (JSC::ErrorInstance::subspaceFor):
        * runtime/Exception.cpp:
        (JSC::Exception::visitChildren):
        (JSC::Exception::finalizeUnconditionally):
        * runtime/Exception.h:
        (JSC::Exception::valueOffset): Deleted.
        (JSC::Exception::value const): Deleted.
        (JSC::Exception::stack const): Deleted.
        (JSC::Exception::didNotifyInspectorOfThrow const): Deleted.
        (JSC::Exception::setDidNotifyInspectorOfThrow): Deleted.
        * runtime/StackFrame.cpp:
        (JSC::StackFrame::isFinalizationCandidate):
        (JSC::StackFrame::finalizeUnconditionally):
        (JSC::StackFrame::visitChildren): Deleted.
        * runtime/StackFrame.h:
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:

2018-02-09  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        Fix build on ARMv7 traditional JSCOnly bot after r228306
        https://bugs.webkit.org/show_bug.cgi?id=182563

        Unreviewed build fix.

        * assembler/AssemblerBuffer.h:

2018-02-08  Filip Pizlo  <fpizlo@apple.com>

        Experiment with alternative implementation of memcpy/memset
        https://bugs.webkit.org/show_bug.cgi?id=182563

        Reviewed by Michael Saboff and Mark Lam.
        
        This adopts new fastCopy/fastZeroFill calls for calls to memcpy/memset that do not take a
        constant size argument.

        * assembler/AssemblerBuffer.h:
        (JSC::AssemblerBuffer::append):
        * runtime/ArrayBuffer.cpp:
        (JSC::ArrayBufferContents::tryAllocate):
        (JSC::ArrayBufferContents::copyTo):
        (JSC::ArrayBuffer::createInternal):
        * runtime/ArrayBufferView.h:
        (JSC::ArrayBufferView::zeroRangeImpl):
        * runtime/ArrayConventions.cpp:
        * runtime/ArrayConventions.h:
        (JSC::clearArray):
        * runtime/ArrayPrototype.cpp:
        (JSC::arrayProtoPrivateFuncConcatMemcpy):
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::createOrGrowPropertyStorage):
        (JSC::Butterfly::growArrayRight):
        (JSC::Butterfly::resizeArray):
        * runtime/GenericTypedArrayViewInlines.h:
        (JSC::GenericTypedArrayView<Adaptor>::create):
        * runtime/JSArray.cpp:
        (JSC::JSArray::appendMemcpy):
        (JSC::JSArray::fastSlice):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::set):
        * runtime/JSObject.cpp:
        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
        (JSC::JSObject::shiftButterflyAfterFlattening):
        * runtime/PropertyTable.cpp:
        (JSC::PropertyTable::PropertyTable):

2018-02-08  Don Olmstead  <don.olmstead@sony.com>

        Remove JavaScriptCore/ForwardingHeaders directory
        https://bugs.webkit.org/show_bug.cgi?id=182594

        Reviewed by Mark Lam.

        * CMakeLists.txt:
        * ForwardingHeaders/JavaScriptCore/APICast.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSBase.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSContextRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSObjectRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSRetainPtr.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSStringRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSTypedArray.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JSValueRef.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JavaScript.h: Removed.
        * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h: Removed.
        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Removed.
        * ForwardingHeaders/JavaScriptCore/WebKitAvailability.h: Removed.

2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
        https://bugs.webkit.org/show_bug.cgi?id=182440

        Reviewed by Darin Adler.

        This patch implements Array.prototype.flatMap and Array.prototype.flatten
        since they are now stage 3 [1].

        [1]: https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray

        * builtins/ArrayPrototype.js:
        (filter):
        (map):
        (globalPrivate.concatSlowPath):
        (globalPrivate.arraySpeciesCreate):
        (globalPrivate.flattenIntoArray):
        (flatten):
        (globalPrivate.flattenIntoArrayWithCallback):
        We separate flattenIntoArray from flattenIntoArrayWithCallback due to performance reason.
        We carefully keep both functions small to encourage inlining.

        (flatMap):
        * runtime/ArrayPrototype.cpp:
        (JSC::ArrayPrototype::finishCreation):

2018-01-13  Darin Adler  <darin@apple.com>

        Event improvements
        https://bugs.webkit.org/show_bug.cgi?id=179591

        Reviewed by Chris Dumez.

        Remove all uses of ScriptValue other than in the implementation of ScriptObject.

        * bindings/ScriptFunctionCall.cpp: Removed include of ScriptValue.h.

        * bindings/ScriptObject.cpp: Removed unused overload of ScriptObject constructor.
        * bindings/ScriptObject.h: Ditto.

        * bindings/ScriptValue.cpp:
        (Deprecated::ScriptValue::~ScriptValue): Deleted.
        (Deprecated::ScriptValue::getString const): Deleted.
        (Deprecated::ScriptValue::toString const): Deleted.
        (Deprecated::ScriptValue::isEqual const): Deleted.
        (Deprecated::ScriptValue::isNull const): Deleted.
        (Deprecated::ScriptValue::isUndefined const): Deleted.
        (Deprecated::ScriptValue::isObject const): Deleted.
        (Deprecated::ScriptValue::isFunction const): Deleted.
        (Deprecated::ScriptValue::toInspectorValue const): Deleted.
        * bindings/ScriptValue.h: Removed many unused functions. Made the rest
        protected since this is now used only in ScriptObject.

        * inspector/ConsoleMessage.cpp:
        (Inspector::ConsoleMessage::addToFrontend): Stop using ScriptValue.
        (Inspector::ConsoleMessage::isEqual const): Updated for change to ScriptArguments::isEqual.

        * inspector/ScriptArguments.cpp:
        (Inspector::ScriptArguments::create): Take a Vector of JSC::Strong, not ScriptValue,
        use rvalue reference with move instead of lvalue reference with swap, and take execution
        state by reference instead of pointer.
        (Inspector::ScriptArguments::createEmpty): Deleted. Can now use create instead.
        (Inspector::ScriptArguments::ScriptArguments): Ditto.
        (Inspector::ScriptArguments::~ScriptArguments): Deleted.
        (Inspector::ScriptArguments::argumentAt const): Updated to use JSC::Strong.
        (Inspector::ScriptArguments::getFirstArgumentAsString): Ditto.
        (Inspector::ScriptArguments::isEqual const): Ditto. Also changed to use JS internals
        instead of calling through the C API.
        * inspector/ScriptArguments.h: Updated for the above.

        * inspector/ScriptCallStackFactory.cpp:
        (Inspector::createScriptArguments): Updated for changes to ScriptArguments.

        * inspector/ScriptDebugServer.cpp: Removed include of ScriptValue.h.
        * inspector/agents/InspectorAgent.cpp: Ditto.
        * inspector/agents/InspectorDebuggerAgent.cpp: Ditto.
        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame): Use JSC::Strong instead
        of ScriptValue.
        (Inspector::InspectorDebuggerAgent::currentCallFrames): Ditto.
        * inspector/agents/InspectorDebuggerAgent.h: Ditto.
        * runtime/ConsoleClient.cpp:
        (JSC::ConsoleClient::printConsoleMessageWithArguments): Ditto.
        (JSC::ConsoleClient::clear): Use ScriptArguments::create and pass an empty vector
        instead of calling a separate createEmpty function.

        * runtime/VM.cpp:
        (JSC::VM::createLeaked): Deleted.
        * runtime/VM.h: Deleted createLeaked.

2018-02-06  Brian Burg  <bburg@apple.com>

        Web Inspector: protocol generator should automatically deduce the correct include style to use
        https://bugs.webkit.org/show_bug.cgi?id=182505

        Reviewed by Timothy Hatcher.

        Currently the generated imports use a mix of system header imports (powered by forwarding headers)
        and framework-style includes. Since forwarding headers are going away, this patch stops
        using system header includes for headers that are JavaScriptCore private headers. Instead,
        use either a relative include or a framework include.

        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
        (CppAlternateBackendDispatcherHeaderGenerator.generate_output):
        (CppAlternateBackendDispatcherHeaderGenerator):
        (CppAlternateBackendDispatcherHeaderGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
        (CppBackendDispatcherHeaderGenerator.generate_output):
        (CppBackendDispatcherHeaderGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
        (CppBackendDispatcherImplementationGenerator.generate_output):
        (CppBackendDispatcherImplementationGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
        (CppFrontendDispatcherHeaderGenerator.generate_output):
        (CppFrontendDispatcherHeaderGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
        (CppFrontendDispatcherImplementationGenerator.generate_output):
        (CppFrontendDispatcherImplementationGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
        (CppProtocolTypesHeaderGenerator.generate_output):
        (CppProtocolTypesHeaderGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
        (CppProtocolTypesImplementationGenerator.generate_output):
        (CppProtocolTypesImplementationGenerator._generate_secondary_header_includes):
        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
        (ObjCBackendDispatcherHeaderGenerator):
        Convert existing header lists to the new entries format, which includes the
        allowable target frameworks and the relative path to the header.

        * inspector/scripts/codegen/generator.py:
        (Generator.generate_includes_from_entries):
        Copied from the same in the builtins code generator. It still works great.

        * inspector/scripts/tests/all/expected/definitions-with-mac-platform.json-result:
        * inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:
        * inspector/scripts/tests/generic/expected/commands-with-optional-call-return-parameters.json-result:
        * inspector/scripts/tests/generic/expected/definitions-with-mac-platform.json-result:
        * inspector/scripts/tests/generic/expected/domain-availability.json-result:
        * inspector/scripts/tests/generic/expected/domains-with-varying-command-sizes.json-result:
        * inspector/scripts/tests/generic/expected/enum-values.json-result:
        * inspector/scripts/tests/generic/expected/events-with-optional-parameters.json-result:
        * inspector/scripts/tests/generic/expected/generate-domains-with-feature-guards.json-result:
        * inspector/scripts/tests/generic/expected/same-type-id-different-domain.json-result:
        * inspector/scripts/tests/generic/expected/shadowed-optional-type-setters.json-result:
        * inspector/scripts/tests/generic/expected/type-declaration-aliased-primitive-type.json-result:
        * inspector/scripts/tests/generic/expected/type-declaration-array-type.json-result:
        * inspector/scripts/tests/generic/expected/type-declaration-enum-type.json-result:
        * inspector/scripts/tests/generic/expected/type-declaration-object-type.json-result:
        * inspector/scripts/tests/generic/expected/type-requiring-runtime-casts.json-result:
        * inspector/scripts/tests/generic/expected/type-with-open-parameters.json-result:
        * inspector/scripts/tests/generic/expected/worker-supported-domains.json-result:
        * inspector/scripts/tests/ios/expected/definitions-with-mac-platform.json-result:
        * inspector/scripts/tests/mac/expected/definitions-with-mac-platform.json-result:
        Rebaseline.

2018-02-06  Keith Miller  <keith_miller@apple.com>

        put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
        https://bugs.webkit.org/show_bug.cgi?id=182549
        <rdar://problem/36189995>

        Reviewed by Saam Barati.

        Previously, the llint/baseline caching for put_to_scope and
        get_from_scope would cache lexical environments when the
        varInjectionWatchpoint had been fired for global properties. Code
        in the DFG does not follow this same assumption so we could
        potentially return the wrong result. Additionally, the baseline
        would write barrier the global object rather than the lexical
        enviroment object. This patch makes it so that we do not cache
        anything other than the global object for when the resolve type is
        GlobalPropertyWithVarInjectionChecks or GlobalProperty.

        * assembler/MacroAssembler.cpp:
        (JSC::MacroAssembler::jitAssert):
        * assembler/MacroAssembler.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_from_scope):
        (JSC::JIT::emit_op_put_to_scope):
        * runtime/CommonSlowPaths.h:
        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
        * runtime/Options.h:

2018-01-28  Filip Pizlo  <fpizlo@apple.com>

        Global objects should be able to use TLCs to allocate from different blocks from each other
        https://bugs.webkit.org/show_bug.cgi?id=182227

        Reviewed by JF Bastien.
        
        This uses TLCs to create at least `minimumDistanceBetweenCellsFromDifferenOrigins` bytes of
        distance between objects from different origins, using the following combination of things. For
        short lets refer to that constant as K.
        
        - Since r227721, LargeAllocation puts K bytes padding at the end of each allocation.
        
        - Since r227718, MarkedBlock puts at least K bytes in its footer.
        
        - Since r227617, global objects can have their own TLCs, which make them allocate from a
          different set of blocks than other global objects. The TLC of a global object comes into
          effect when you enter the VM via that global object.
        
        - With this change, TLCs and blocks both have security origins. A TLC will only use blocks that
          share the same security origin or empty blocks (in which case we zero the block and change
          its security origin).
        
        WebCore determines the TLC-GlobalObject mapping. By default, global objects would simply use
        the VM's default TLC. WebCore makes it so that DOM windows (but not worker global objects) get
        a TLC based on their document's SecurityOrigin.
        
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::findBlockForAllocation):
        (JSC::BlockDirectory::prepareForAllocation):
        * heap/BlockDirectory.h:
        * heap/LocalAllocator.cpp:
        (JSC::LocalAllocator::LocalAllocator):
        (JSC::LocalAllocator::reset):
        (JSC::LocalAllocator::~LocalAllocator):
        (JSC::LocalAllocator::allocateSlowCase):
        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
        * heap/LocalAllocator.h:
        (JSC::LocalAllocator::tlc const):
        * heap/MarkStackMergingConstraint.cpp:
        * heap/MarkStackMergingConstraint.h:
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::associateWithOrigin):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::Handle::securityOriginToken const):
        * heap/SecurityOriginToken.cpp: Added.
        (JSC::uniqueSecurityOriginToken):
        * heap/SecurityOriginToken.h: Added.
        * heap/ThreadLocalCache.cpp:
        (JSC::ThreadLocalCache::create):
        (JSC::ThreadLocalCache::ThreadLocalCache):
        (JSC::ThreadLocalCache::allocateData):
        (JSC::ThreadLocalCache::installSlow):
        * heap/ThreadLocalCache.h:
        (JSC::ThreadLocalCache::securityOriginToken const):
        * heap/ThreadLocalCacheInlines.h:
        (JSC::ThreadLocalCache::install):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        (JSC::JSGlobalObject::createThreadLocalCache):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::threadLocalCache):
        (JSC::JSGlobalObject::threadLocalCache const): Deleted.
        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::VMEntryScope):
        (JSC::VMEntryScope::~VMEntryScope):
        * runtime/VMEntryScope.h:

2018-02-05  Don Olmstead  <don.olmstead@sony.com>

        JavaScriptCore files should not be included relatively
        https://bugs.webkit.org/show_bug.cgi?id=182452

        Reviewed by Keith Miller.

        * API/JSCallbackConstructor.h:
        * CMakeLists.txt:
        * disassembler/ARM64Disassembler.cpp:
        * disassembler/ARMv7Disassembler.cpp:
        * heap/LockDuringMarking.h:
        * inspector/InjectedScriptBase.h:
        * inspector/InjectedScriptHost.h:
        * inspector/JavaScriptCallFrame.h:
        * inspector/ScriptArguments.h:
        * inspector/ScriptDebugListener.h:
        * inspector/ScriptDebugServer.h:
        * inspector/agents/InspectorAgent.h:
        * inspector/agents/InspectorConsoleAgent.h:
        * inspector/agents/InspectorDebuggerAgent.h:
        * inspector/agents/InspectorHeapAgent.h:
        * inspector/agents/InspectorRuntimeAgent.h:
        * inspector/agents/InspectorScriptProfilerAgent.h:
        * runtime/RegExp.h:

2018-02-05  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r228012.
        https://bugs.webkit.org/show_bug.cgi?id=182493

        "It regressed ARES-6 by 2-4%" (Requested by saamyjoon on
        #webkit).

        Reverted changeset:

        "[JSC] Clean up ArraySpeciesCreate"
        https://bugs.webkit.org/show_bug.cgi?id=182434
        https://trac.webkit.org/changeset/228012

2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>

        Rebaseline bindings generator tests after r228032.
        https://bugs.webkit.org/show_bug.cgi?id=182445

        Unreviewed test gardening.

        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:

2018-02-02  Saam Barati  <sbarati@apple.com>

        Make various DFG_ASSERTs provide more data to WTFCrashWithInfo
        https://bugs.webkit.org/show_bug.cgi?id=182453
        <rdar://problem/37174236>

        Reviewed by JF Bastien and Mark Lam.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGArgumentsUtilities.cpp:
        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupChecksInBlock):
        * dfg/DFGFlowIndexing.h:
        (JSC::DFG::FlowIndexing::shadowIndex const):
        * dfg/DFGLICMPhase.cpp:
        (JSC::DFG::LICMPhase::run):
        (JSC::DFG::LICMPhase::attemptHoist):
        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
        (JSC::DFG::LoopPreHeaderCreationPhase::run):
        * dfg/DFGPutStackSinkingPhase.cpp:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileArithAbs):
        (JSC::DFG::SpeculativeJIT::compileArithRounding):
        (JSC::DFG::SpeculativeJIT::compileToPrimitive):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::fillJSValue):
        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStoreBarrierClusteringPhase.cpp:
        * dfg/DFGStoreBarrierInsertionPhase.cpp:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetStack):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithClz32):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithAbs):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
        (JSC::FTL::DFG::LowerDFGToB3::compilePutById):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
        (JSC::FTL::DFG::LowerDFGToB3::compare):
        (JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
        (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
        (JSC::FTL::DFG::LowerDFGToB3::lowInt52):
        (JSC::FTL::DFG::LowerDFGToB3::lowCell):
        (JSC::FTL::DFG::LowerDFGToB3::lowBoolean):
        (JSC::FTL::DFG::LowerDFGToB3::lowDouble):
        (JSC::FTL::DFG::LowerDFGToB3::lowJSValue):

2018-02-02  Don Olmstead  <don.olmstead@sony.com>

        JS Builtins should include JavaScriptCore headers directly
        https://bugs.webkit.org/show_bug.cgi?id=182445

        Reviewed by Yusuke Suzuki.

        * Scripts/builtins/builtins_generator.py:
        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:

2018-02-02  Saam Barati  <sbarati@apple.com>

        When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
        https://bugs.webkit.org/show_bug.cgi?id=182368
        <rdar://problem/36932466>

        Reviewed by Mark Lam.

        When preserving liveness when inserting Unreachable nodes after ForceOSRExit,
        we must add the VariableAccessData to the given argument position. Otherwise,
        we may end up with a VariableAccessData that doesn't respect the shouldNeverUnbox bit.
        If we end up with such a situation, it can lead to invalid IR after the
        arguments elimination phase optimizes a GetByVal to a GetStack.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::flushImpl):
        (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
        (JSC::DFG::ByteCodeParser::flush):
        (JSC::DFG::ByteCodeParser::flushForTerminal):
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        (JSC::DFG::ByteCodeParser::parse):

2018-02-02  Mark Lam  <mark.lam@apple.com>

        More ARM64_32 fixes.
        https://bugs.webkit.org/show_bug.cgi?id=182441
        <rdar://problem/37162310>

        Reviewed by Dan Bernstein.

        I also disabled more dynamicPoisoning code in ARM64_32.  This code assumes a
        64-bit pointer which is not applicable here.

        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitDynamicPoison):
        (JSC::AssemblyHelpers::emitDynamicPoisonOnLoadedType):
        (JSC::AssemblyHelpers::emitDynamicPoisonOnType):

2018-02-02  Saam Barati  <sbarati@apple.com>

        MapHash should return true to doesGC in the DFG depending on useKind because it might resolve a rope
        https://bugs.webkit.org/show_bug.cgi?id=182402

        Reviewed by Yusuke Suzuki.

        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):

2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Clean up ArraySpeciesCreate
        https://bugs.webkit.org/show_bug.cgi?id=182434

        Reviewed by Saam Barati.

        We have duplicate code in filter, map, concatSlowPath.
        This patch creates a new global private function @arraySpeciesCreate,
        and use it.

        * builtins/ArrayPrototype.js:
        (globalPrivate.arraySpeciesCreate):
        (filter):
        (map):
        (globalPrivate.concatSlowPath):

2018-02-01  Mark Lam  <mark.lam@apple.com>

        Fix broken bounds check in FTL's compileGetMyArgumentByVal().
        https://bugs.webkit.org/show_bug.cgi?id=182419
        <rdar://problem/37044945>

        Reviewed by Saam Barati.

        In compileGetMyArgumentByVal(), it computes:
            limit = m_out.sub(limit, m_out.constInt32(m_node->numberOfArgumentsToSkip()));
            ...
            LValue isOutOfBounds = m_out.aboveOrEqual(originalIndex, limit);

        where the original "limit" is the number of arguments passed in by the caller.
        If the original limit is less than numberOfArgumentsToSkip, the resultant limit
        will be a large unsigned number.  As a result, this will defeat the bounds check
        that follows it.

        Note: later on in compileGetMyArgumentByVal(), we have to adjust adjust the index
        value by adding numberOfArgumentsToSkip to it, in order to determine the actual
        entry in the arguments array to get.

        The fix is to just add numberOfArgumentsToSkip to index upfront (instead of
        subtracting it from limit), and doing an overflow speculation check on that
        addition before doing the bounds check.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):

2018-02-01  Keith Miller  <keith_miller@apple.com>

        Fix crashes due to mishandling custom sections.
        https://bugs.webkit.org/show_bug.cgi?id=182404
        <rdar://problem/36935863>

        Reviewed by Saam Barati.

        This also cleans up some of our validation code. We also
        mistakenly, allowed unknown (different from custom sections with
        id: 0) section ids.

        * wasm/WasmModuleParser.cpp:
        (JSC::Wasm::ModuleParser::parse):
        * wasm/WasmModuleParser.h:
        * wasm/WasmSections.h:
        (JSC::Wasm::isKnownSection):
        (JSC::Wasm::decodeSection):
        (JSC::Wasm::validateOrder):
        (JSC::Wasm::makeString):
        (JSC::Wasm::isValidSection): Deleted.

2018-02-01  Michael Catanzaro  <mcatanzaro@igalia.com>

        -Wreturn-type warning in DFGObjectAllocationSinkingPhase.cpp
        https://bugs.webkit.org/show_bug.cgi?id=182389

        Reviewed by Yusuke Suzuki.

        Fix the warning.

        As a bonus, remove a couple unreachable breaks for good measure.

        * dfg/DFGObjectAllocationSinkingPhase.cpp:

2018-02-01  Chris Dumez  <cdumez@apple.com>

        Queue a microtask when a waitUntil() promise is settled
        https://bugs.webkit.org/show_bug.cgi?id=182372
        <rdar://problem/37101019>

        Reviewed by Mark Lam.

        Export a symbol so it can be used in WebCore.

        * runtime/JSGlobalObject.h:

2018-01-31  Don Olmstead  <don.olmstead@sony.com>

        [CMake] Make JavaScriptCore headers copies
        https://bugs.webkit.org/show_bug.cgi?id=182303

        Reviewed by Alex Christensen.

        * CMakeLists.txt:
        * PlatformGTK.cmake:
        * PlatformJSCOnly.cmake:
        * PlatformMac.cmake:
        * PlatformWPE.cmake:
        * PlatformWin.cmake:
        * shell/CMakeLists.txt:
        * shell/PlatformWin.cmake:

2018-01-31  Saam Barati  <sbarati@apple.com>

        Replace tryLargeMemalignVirtual with tryLargeZeroedMemalignVirtual and use it to allocate large zeroed memory in Wasm
        https://bugs.webkit.org/show_bug.cgi?id=182064
        <rdar://problem/36840132>

        Reviewed by Geoffrey Garen.

        This patch switches WebAssembly Memory to always use bmalloc's
        zeroed virtual allocation API. This makes it so that we don't
        dirty the memory to zero it. It's a huge compile time speedup
        on WasmBench on iOS.

        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::create):
        (JSC::Wasm::Memory::~Memory):
        (JSC::Wasm::Memory::addressIsInActiveFastMemory):
        (JSC::Wasm::Memory::grow):
        (JSC::Wasm::commitZeroPages): Deleted.

2018-01-31  Mark Lam  <mark.lam@apple.com>

        Build fix for CLoop after r227874.
        https://bugs.webkit.org/show_bug.cgi?id=182155
        <rdar://problem/36286266>

        Not reviewed.

        Just needed support for lea of a LabelReference in cloop.rb (just like those
        added for arm64.rb and x86.rb).

        * offlineasm/cloop.rb:

2018-01-31  Keith Miller  <keith_miller@apple.com>

        Canonicalize aquiring the JSCell lock.
        https://bugs.webkit.org/show_bug.cgi?id=182320

        Reviewed by Michael Saboff.

        It's currently kinda annoying to figure out where
        we aquire the a JSCell's lock. This patch adds a
        helper to make it easier to grep...

        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::visitChildren):
        (JSC::UnlinkedCodeBlock::setInstructions):
        (JSC::UnlinkedCodeBlock::shrinkToFit):
        * runtime/ErrorInstance.cpp:
        (JSC::ErrorInstance::finishCreation):
        (JSC::ErrorInstance::materializeErrorInfoIfNeeded):
        (JSC::ErrorInstance::visitChildren):
        * runtime/JSArray.cpp:
        (JSC::JSArray::shiftCountWithArrayStorage):
        (JSC::JSArray::unshiftCountWithArrayStorage):
        * runtime/JSCell.h:
        (JSC::JSCell::cellLock):
        * runtime/JSObject.cpp:
        (JSC::JSObject::visitButterflyImpl):
        (JSC::JSObject::convertContiguousToArrayStorage):
        * runtime/JSPropertyNameEnumerator.cpp:
        (JSC::JSPropertyNameEnumerator::visitChildren):
        * runtime/SparseArrayValueMap.cpp:
        (JSC::SparseArrayValueMap::add):
        (JSC::SparseArrayValueMap::remove):
        (JSC::SparseArrayValueMap::visitChildren):

2018-01-31  Saam Barati  <sbarati@apple.com>

        JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
        https://bugs.webkit.org/show_bug.cgi?id=182074
        <rdar://problem/36846261>

        Reviewed by Mark Lam.

        This patch teaches the JSONP evaluator about the global lexical environment.
        Before, it was using the global object as the global scope, but that's wrong.
        The global lexical environment is the first node in the global scope chain.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::executeProgram):
        * jsc.cpp:
        (GlobalObject::finishCreation):
        (shellSupportsRichSourceInfo):
        (functionDisableRichSourceInfo):
        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser<CharType>::tryJSONPParse):
        * runtime/LiteralParser.h:

2018-01-31  Saam Barati  <sbarati@apple.com>

        clean up pushToSaveImmediateWithoutTouchingRegisters a bit
        https://bugs.webkit.org/show_bug.cgi?id=181774

        Reviewed by JF Bastien.

        This function on ARM64 was considering what to do with the scratch
        register. And conditionally invalidated what was in it. This is not
        relevant though, since the function always recovers what was in that
        register. This patch just switches it to using dataTempRegister
        directly and updates the comment to describe why it can do so safely.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):

2018-01-30  Mark Lam  <mark.lam@apple.com>

        Apply poisoning to TypedArray vector pointers.
        https://bugs.webkit.org/show_bug.cgi?id=182155
        <rdar://problem/36286266>

        Reviewed by JF Bastien.

        The TypeArray's vector pointer is now poisoned.  The poison value is chosen based
        on a TypeArray's jsType.  The JSType must be between FirstTypedArrayType and
        LastTypedArrayType.  At runtime, we enforce that the index is well-behaved by
        masking it against TypedArrayPoisonIndexMask.  TypedArrayPoisonIndexMask (16) is
        the number of TypedArray types (10) rounded up to the next power of 2.
        Accordingly, we reserve an array of TypedArrayPoisonIndexMask poisons so that we
        can use index masking on the index, and be guaranteed that the masked index will
        be within bounds of the poisons array.

        1. Fixed both DFG and FTL versions of compileGetTypedArrayByteOffset() to not
           do any unnecessary work if the TypedArray vector is null.

           FTL's cagedMayBeNull() is no longer needed because it is only used by
           compileGetTypedArrayByteOffset(), and we need to enhance it to handle unpoisoning
           in a TypedArray specific way.  So, might as well do the work inline in
           compileGetTypedArrayByteOffset() instead.

        2. Removed an unnecessary null-check in DFGSpeculativeJIT's compileNewTypedArrayWithSize()
           because there's already a null check above it that ensures that sizeGPR is
           never null.

        3. In LLInt's _llint_op_get_by_val, move the TypedArray length check before the
           loading of the vector for unpoisoning and uncaging.  We don't need the vector
           if the length is 0.

        Implementation notes on the need to null check the TypeArray vector:

        1. DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds() does not need a
           m_poisonedVector null check because the function is a null check.

        2. DFG::SpeculativeJIT::compileGetIndexedPropertyStorage() does not need a
           m_poisonedVector null check because it is followed by a call to
           cageTypedArrayStorage() which assumes that storageReg cannot be null.

        3. DFG::SpeculativeJIT::compileGetTypedArrayByteOffset() already has a
           m_poisonedVector null check.

        4. DFG::SpeculativeJIT::compileNewTypedArrayWithSize() does not need a vector null
           check because the poisoning code is preceded by a sizeGPR null check, which
           ensures that the storageGPR (vector to be poisoned) is not null.

        5. FTL's compileGetIndexedPropertyStorage() does not need a m_poisonedVector null
           check because it is followed by a call to caged() which assumes that the
           vector cannot be null.

        6. FTL's compileGetTypedArrayByteOffset() already has a m_poisonedVector null check.

        7. FTL's compileNewTypedArray() does not need a vector null check because the
           poisoning code is preceded by a size null check, which ensures that the
           storage (vector to be poisoned) is not null.

        8. FTL's speculateTypedArrayIsNotNeutered() does not need a
           m_poisonedVector null check because the function is a null check.

        9. IntrinsicGetterAccessCase::emitIntrinsicGetter()'s TypedArrayByteOffsetIntrinsic
           case needs a null check so that it does not try to unpoison a null vector.

        10. JIT::emitIntTypedArrayGetByVal() does not need a vector null check because
            we already do a length check even before loading the vector.

        11. JIT::emitFloatTypedArrayGetByVal() does not need a vector null check because
            we already do a length check even before loading the vector.

        12. JIT::emitIntTypedArrayPutByVal() does not need a vector null check because
            we already do a length check even before loading the vector.

        13. JIT::emitFloatTypedArrayPutByVal() does not need a vector null check because
            we already do a length check even before loading the vector.

        14. LLInt's loadTypedArrayCaged() does not need a vector null check because its
            client will do a TypedArray length check before calling it.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::checkArray):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasArrayMode):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):
        (JSC::FTL::DFG::LowerDFGToB3::cagedMayBeNull): Deleted.
        * jit/IntrinsicEmitter.cpp:
        (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitIntTypedArrayGetByVal):
        (JSC::JIT::emitFloatTypedArrayGetByVal):
        (JSC::JIT::emitIntTypedArrayPutByVal):
        (JSC::JIT::emitFloatTypedArrayPutByVal):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/arm64.rb:
        * offlineasm/x86.rb:
        * runtime/CagedBarrierPtr.h:
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::JSArrayBufferView):
        (JSC::JSArrayBufferView::finalize):
        (JSC::JSArrayBufferView::neuter):
        * runtime/JSArrayBufferView.h:
        (JSC::JSArrayBufferView::vector const):
        (JSC::JSArrayBufferView::offsetOfPoisonedVector):
        (JSC::JSArrayBufferView::poisonFor):
        (JSC::JSArrayBufferView::Poison::key):
        (JSC::JSArrayBufferView::offsetOfVector): Deleted.
        * runtime/JSCPoison.cpp:
        (JSC::initializePoison):
        * runtime/JSCPoison.h:
        * runtime/JSGenericTypedArrayViewInlines.h:
        (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
        * runtime/JSObject.h:

2018-01-30  Fujii Hironori  <Hironori.Fujii@sony.com>

        [Win] Warning fix.
        https://bugs.webkit.org/show_bug.cgi?id=177007

        Reviewed by Yusuke Suzuki.

        * interpreter/StackVisitor.cpp:
        (JSC::StackVisitor::Frame::dump const):
        Changed the type of locationRawBits from unsigned to uintptr_t.
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::createNumberFormat):
        Initialize 'style' to avoid potentially uninitialized local variable warning.

2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Implement trimStart and trimEnd
        https://bugs.webkit.org/show_bug.cgi?id=182233

        Reviewed by Mark Lam.

        String.prototype.{trimStart,trimEnd} are now stage 3[1].
        String.prototype.{trimLeft,trimRight} are alias to these functions.

        We rename these functions to trimStart and trimEnd, and put them as
        trimLeft and trimRight too.

        [1]: https://tc39.github.io/proposal-string-left-right-trim/

        * runtime/StringPrototype.cpp:
        (JSC::StringPrototype::finishCreation):
        (JSC::trimString):
        (JSC::stringProtoFuncTrim):
        (JSC::stringProtoFuncTrimStart):
        (JSC::stringProtoFuncTrimEnd):
        (JSC::stringProtoFuncTrimLeft): Deleted.
        (JSC::stringProtoFuncTrimRight): Deleted.

2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Relax line terminators in String to make JSON subset of JS
        https://bugs.webkit.org/show_bug.cgi?id=182232

        Reviewed by Keith Miller.

        "Subsume JSON" spec is now stage 3[1]. Before this spec change,
        JSON can accept \u2028 / \u2029 in string while JS cannot do that.
        It accidentally made JSON non subset of JS.

        Now we extend our JS string to accept \u2028 / \u2029 to make JSON
        subset of JS in this spec change.

        [1]: https://github.com/tc39/proposal-json-superset

        * parser/Lexer.cpp:
        (JSC::Lexer<T>::parseStringSlowCase):

2018-01-29  Jiewen Tan  <jiewen_tan@apple.com>

        [WebAuthN] Add a compile-time feature flag
        https://bugs.webkit.org/show_bug.cgi?id=182211
        <rdar://problem/36936365>

        Reviewed by Brent Fulgham.

        * Configurations/FeatureDefines.xcconfig:

2018-01-29  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
        https://bugs.webkit.org/show_bug.cgi?id=182249

        Reviewed by Keith Miller.

        Changed clobberize() handling of CompareEq, et al to properly handle comparisons between
        Untyped and Object values when compared against built in types.  Such comparisons can
        invoke toNumber() or other methods.

        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):

2018-01-29  Matt Lewis  <jlewis3@apple.com>

        Unreviewed, rolling out r227725.

        This caused internal failures.

        Reverted changeset:

        "JSC Sampling Profiler: Detect tester and testee when sampling
        in RegExp JIT"
        https://bugs.webkit.org/show_bug.cgi?id=152729
        https://trac.webkit.org/changeset/227725

2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>

        JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
        https://bugs.webkit.org/show_bug.cgi?id=152729

        Reviewed by Saam Barati.

        This patch extends SamplingProfiler to recognize JIT RegExp execution. We record
        executing RegExp in VM so that SamplingProfiler can detect it. This is better
        than the previous VM::isExecutingInRegExpJIT flag approach since

        1. isExecutingInRegExpJIT is set after starting executing JIT RegExp code. Thus,
        if we suspend the thread just before executing this flag, or just after clearing
        this flag, SamplingProfiler gets invalid frame, and frame validation fails. We
        should set such a flag before and after executing JIT RegExp code.

        2. This removes VM dependency from YarrJIT which is not essential one.

        We add ExecutionContext enum to RegExp::matchInline not to mark execution if it
        is done in non JS thread.

        * bytecode/BytecodeDumper.cpp:
        (JSC::regexpName):
        (JSC::BytecodeDumper<Block>::dumpRegExps):
        (JSC::regexpToSourceString): Deleted.
        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * runtime/RegExp.cpp:
        (JSC::RegExp::compile):
        (JSC::RegExp::match):
        (JSC::RegExp::matchConcurrently):
        (JSC::RegExp::compileMatchOnly):
        (JSC::RegExp::toSourceString const):
        * runtime/RegExp.h:
        * runtime/RegExpInlines.h:
        (JSC::RegExp::matchInline):
        * runtime/RegExpMatchesArray.h:
        (JSC::createRegExpMatchesArray):
        * runtime/SamplingProfiler.cpp:
        (JSC::SamplingProfiler::SamplingProfiler):
        (JSC::SamplingProfiler::timerLoop):
        (JSC::SamplingProfiler::takeSample):
        (JSC::SamplingProfiler::processUnverifiedStackTraces):
        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
        (JSC::SamplingProfiler::StackFrame::displayName):
        (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests):
        (JSC::SamplingProfiler::StackFrame::functionStartLine):
        (JSC::SamplingProfiler::StackFrame::functionStartColumn):
        (JSC::SamplingProfiler::StackFrame::sourceID):
        (JSC::SamplingProfiler::StackFrame::url):
        (WTF::printInternal):
        (JSC::SamplingProfiler::~SamplingProfiler): Deleted.
        * runtime/SamplingProfiler.h:
        * runtime/VM.h:
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generateEnter):
        (JSC::Yarr::YarrGenerator::generateReturn):
        (JSC::Yarr::YarrGenerator::YarrGenerator):
        (JSC::Yarr::jitCompile):
        * yarr/YarrJIT.h:

2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG][FTL] WeakMap#set should have DFG node
        https://bugs.webkit.org/show_bug.cgi?id=180015

        Reviewed by Saam Barati.

        This patch adds WeakMapSet and WeakSetAdd DFG nodes to handle them efficiently in DFG and FTL.
        We also define CSE rules for them. Now, WeakMapSet and WeakSetAdd can offer the results of
        the subsequent WeakMapGet if CSE allows.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::addVarArgChild):
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        WeakMap operations do not cause GC.

        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileWeakSetAdd):
        (JSC::DFG::SpeculativeJIT::compileWeakMapSet):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileWeakSetAdd):
        (JSC::FTL::DFG::LowerDFGToB3::compileWeakMapSet):
        * jit/JITOperations.h:
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * runtime/WeakMapPrototype.cpp:
        (JSC::WeakMapPrototype::finishCreation):
        * runtime/WeakSetPrototype.cpp:
        (JSC::WeakSetPrototype::finishCreation):

2018-01-28  Filip Pizlo  <fpizlo@apple.com>

        LargeAllocation should do the same distancing as MarkedBlock
        https://bugs.webkit.org/show_bug.cgi?id=182226

        Reviewed by Saam Barati.

        This makes LargeAllocation do the same exact distancing that MarkedBlock promises to do.
        
        To make that possible, this patch first makes MarkedBlock know exactly how much distancing it
        is doing:
        
        - I've rationalized the payloadSize calculation. In particular, I made MarkedSpace use the
          calculation done in MarkedBlock. MarkedSpace used to do the math a different way. This
          keeps the old way just for a static_assert.
        
        - The promised amount of distancing is now codified in HeapCell.h as
          minimumDistanceBetweenCellsFromDifferentOrigins. We assert that the footer size is at least
          as big as this. I didn't want to just use footer size for this constant because then, if
          you increased the size of the footer, you'd also add padding to every large allocation.
        
        Then this patch just adds minimumDistanceBetweenCellsFromDifferentOrigins to each large
        allocation. It also zeroes that slice of memory to prevent any information leaks that way.
        
        This is perf neutral. Large allocations start out at ~8000 bytes. The amount of padding is
        ~300 bytes. That's 3.75% space overhead for objects that are ~8000 bytes, zero overhead for
        smaller objects, and diminishing overhead for larger objects. We allocate very few large
        objects, so we shouldn't have any real space overhead from this.

        * heap/HeapCell.h:
        * heap/LargeAllocation.cpp:
        (JSC::LargeAllocation::tryCreate):
        * heap/MarkedBlock.h:
        * heap/MarkedSpace.h:

2018-01-27  Filip Pizlo  <fpizlo@apple.com>

        Make MarkedBlock::Footer bigger
        https://bugs.webkit.org/show_bug.cgi?id=182220

        Reviewed by JF Bastien.
        
        This makes the block footer larger by moving the newlyAllocated bits from the handle into
        the footer.
        
        It used to be profitable to put anything we could into the handle because that would free up
        payload space inside the block. But now that we want to use the footer for padding, it's
        profitable to put GC state information - especially data that is used by the GC itself and so
        is not useful for a Spectre attack - into the footer to increase object distancing.

        * heap/CellContainer.cpp:
        (JSC::CellContainer::isNewlyAllocated const):
        * heap/IsoCellSet.cpp:
        (JSC::IsoCellSet::sweepToFreeList):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::Handle):
        (JSC::MarkedBlock::Footer::Footer):
        (JSC::MarkedBlock::Handle::stopAllocating):
        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
        (JSC::MarkedBlock::Handle::resumeAllocating):
        (JSC::MarkedBlock::aboutToMarkSlow):
        (JSC::MarkedBlock::resetAllocated):
        (JSC::MarkedBlock::Handle::resetAllocated): Deleted.
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::newlyAllocatedVersion const):
        (JSC::MarkedBlock::isNewlyAllocated):
        (JSC::MarkedBlock::setNewlyAllocated):
        (JSC::MarkedBlock::clearNewlyAllocated):
        (JSC::MarkedBlock::newlyAllocated const):
        (JSC::MarkedBlock::Handle::newlyAllocatedVersion const): Deleted.
        (JSC::MarkedBlock::Handle::isNewlyAllocated): Deleted.
        (JSC::MarkedBlock::Handle::setNewlyAllocated): Deleted.
        (JSC::MarkedBlock::Handle::clearNewlyAllocated): Deleted.
        (JSC::MarkedBlock::Handle::newlyAllocated const): Deleted.
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::isNewlyAllocatedStale const):
        (JSC::MarkedBlock::hasAnyNewlyAllocated):
        (JSC::MarkedBlock::Handle::isLive):
        (JSC::MarkedBlock::Handle::specializedSweep):
        (JSC::MarkedBlock::Handle::newlyAllocatedMode):
        (JSC::MarkedBlock::Handle::isNewlyAllocatedStale const): Deleted.
        (JSC::MarkedBlock::Handle::hasAnyNewlyAllocated): Deleted.
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::endMarking):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::appendJSCellOrAuxiliary):

2018-01-27  Filip Pizlo  <fpizlo@apple.com>

        MarkedBlock should have a footer instead of a header
        https://bugs.webkit.org/show_bug.cgi?id=182217

        Reviewed by JF Bastien.
        
        This moves the MarkedBlock's meta-data from the header to the footer. This doesn't really
        change anything except for some compile-time constants, so it should not affect performance.
        
        This change is to help protect against Spectre attacks on structure checks, which allow for
        small-offset out-of-bounds access. By putting the meta-data at the end of the block, small
        OOBs will only get to other objects in the same block or the block footer. The block footer
        is not super interesting. So, if we combine this with the TLC change (r227617), this means we
        can use blocks as the mechanism of achieving distance between objects from different origins.
        We just need to avoid ever putting objects from different origins in the same block. That's
        what bug 181636 is about.
        
        * heap/BlockDirectory.cpp:
        (JSC::blockHeaderSize): Deleted.
        (JSC::BlockDirectory::blockSizeForBytes): Deleted.
        * heap/BlockDirectory.h:
        * heap/HeapUtil.h:
        (JSC::HeapUtil::findGCObjectPointersForMarking):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::MarkedBlock):
        (JSC::MarkedBlock::~MarkedBlock):
        (JSC::MarkedBlock::Footer::Footer):
        (JSC::MarkedBlock::Footer::~Footer):
        (JSC::MarkedBlock::Handle::stopAllocating):
        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
        (JSC::MarkedBlock::Handle::resumeAllocating):
        (JSC::MarkedBlock::aboutToMarkSlow):
        (JSC::MarkedBlock::resetMarks):
        (JSC::MarkedBlock::assertMarksNotStale):
        (JSC::MarkedBlock::Handle::didConsumeFreeList):
        (JSC::MarkedBlock::markCount):
        (JSC::MarkedBlock::clearHasAnyMarked):
        (JSC::MarkedBlock::Handle::didAddToDirectory):
        (JSC::MarkedBlock::Handle::didRemoveFromDirectory):
        (JSC::MarkedBlock::Handle::sweep):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::markingVersion const):
        (JSC::MarkedBlock::lock):
        (JSC::MarkedBlock::subspace const):
        (JSC::MarkedBlock::footer):
        (JSC::MarkedBlock::footer const):
        (JSC::MarkedBlock::handle):
        (JSC::MarkedBlock::handle const):
        (JSC::MarkedBlock::Handle::blockFooter):
        (JSC::MarkedBlock::isAtomAligned):
        (JSC::MarkedBlock::Handle::cellAlign):
        (JSC::MarkedBlock::blockFor):
        (JSC::MarkedBlock::vm const):
        (JSC::MarkedBlock::weakSet):
        (JSC::MarkedBlock::cellSize):
        (JSC::MarkedBlock::attributes const):
        (JSC::MarkedBlock::atomNumber):
        (JSC::MarkedBlock::areMarksStale):
        (JSC::MarkedBlock::aboutToMark):
        (JSC::MarkedBlock::isMarkedRaw):
        (JSC::MarkedBlock::isMarked):
        (JSC::MarkedBlock::testAndSetMarked):
        (JSC::MarkedBlock::marks const):
        (JSC::MarkedBlock::isAtom):
        (JSC::MarkedBlock::Handle::forEachCell):
        (JSC::MarkedBlock::hasAnyMarked const):
        (JSC::MarkedBlock::noteMarked):
        (WTF::MarkedBlockHash::hash):
        (JSC::MarkedBlock::firstAtom): Deleted.
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::marksConveyLivenessDuringMarking):
        (JSC::MarkedBlock::Handle::isLive):
        (JSC::MarkedBlock::Handle::specializedSweep):
        (JSC::MarkedBlock::Handle::forEachLiveCell):
        (JSC::MarkedBlock::Handle::forEachDeadCell):
        (JSC::MarkedBlock::Handle::forEachMarkedCell):
        * heap/MarkedSpace.cpp:
        * heap/MarkedSpace.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>

        DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
        https://bugs.webkit.org/show_bug.cgi?id=182213

        Reviewed by Mark Lam.

        toStringWithRadixInternal is originally used for the slow path if the given value is larger than radix or negative.
        As a result, it does not accept 0 correctly, and produces an empty string. Since DFGStrengthReductionPhase uses
        this function, it accidentally converts NumberToStringWithValidRadixConstant(0, radix) to an empty string.
        This patch fixes toStringWithRadixInternal to accept 0. This change fixes twitch.tv's issue.

        We also add a careful cast to avoid `-INT32_MIN`. It does not produce incorrect value in x86 in practice,
        but it is UB, and a compiler may assume that the given value is never INT32_MIN and could do an incorrect optimization.

        * runtime/NumberPrototype.cpp:
        (JSC::toStringWithRadixInternal):

2018-01-26  Saam Barati  <sbarati@apple.com>

        Fix emitAllocateWithNonNullAllocator to work on arm
        https://bugs.webkit.org/show_bug.cgi?id=182187
        <rdar://problem/36906550>

        Reviewed by Filip Pizlo.

        This patch unifies the x86 and ARM paths in emitAllocateWithNonNullAllocator
        and makes it so that emitAllocateWithNonNullAllocator uses the macro scratch
        register on ARM.

        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):

2018-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        Rebaselining builtin generator tests after r227685.

        Unreviewed.

        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
        It used to be that the builtins generator was minifying by default. That was an accident
        and we now only minify on Release builds. The generator tests are now getting the
        default unminified output behavior so they need to update their expectations
        for some extra whitespace.

2018-01-26  Mark Lam  <mark.lam@apple.com>

        We should only append ParserArenaDeletable pointers to ParserArena::m_deletableObjects.
        https://bugs.webkit.org/show_bug.cgi?id=182180
        <rdar://problem/36460697>

        Reviewed by Michael Saboff.

        Some parser Node subclasses extend ParserArenaDeletable via multiple inheritance,
        but not as the Node's first base class.  ParserArena::m_deletableObjects is
        expecting pointers to objects of the shape of ParserArenaDeletable.  We ensure
        this by allocating the Node subclass, and casting it to ParserArenaDeletable to
        get the correct pointer to append to ParserArena::m_deletableObjects.

        To simplify things, we introduce a JSC_MAKE_PARSER_ARENA_DELETABLE_ALLOCATED 
        (analogous to WTF_MAKE_FAST_ALLOCATED) for use in Node subclasses that extends
        ParserArenaDeletable.

        * parser/NodeConstructors.h:
        (JSC::ParserArenaDeletable::operator new):
        * parser/Nodes.h:
        * parser/ParserArena.h:
        (JSC::ParserArena::allocateDeletable):

2018-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        JavaScriptCore builtins should be partially minified in Release builds not Debug builds
        https://bugs.webkit.org/show_bug.cgi?id=182165

        Reviewed by Keith Miller.

        * Scripts/builtins/builtins_model.py:
        (BuiltinFunction.fromString):
        Apply minifications on Release builds instead of Debug builds.
        Also eliminate leading whitespace.

2018-01-26  Filip Pizlo  <fpizlo@apple.com>

        Disable TLS-based TLCs
        https://bugs.webkit.org/show_bug.cgi?id=182175

        Reviewed by Saam Barati.

        Check for the new USE(FAST_TLS_FOR_TLC) flag instead of just ENABLE(FAST_TLS_JIT).

        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::~BlockDirectory):
        * heap/BlockDirectory.h:
        * heap/ThreadLocalCache.cpp:
        (JSC::ThreadLocalCache::installSlow):
        (JSC::ThreadLocalCache::installData):
        * heap/ThreadLocalCache.h:
        * heap/ThreadLocalCacheInlines.h:
        (JSC::ThreadLocalCache::getImpl):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
        * runtime/VM.cpp:
        (JSC::VM::~VM):
        * runtime/VM.h:

2018-01-25  Yusuke Suzuki  <utatane.tea@gmail.com>

        imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/errorhandling.html crashes
        https://bugs.webkit.org/show_bug.cgi?id=181980

        Reviewed by Ryosuke Niwa.

        We accidentally failed to propagate errored promise in instantiate and satify phase if entry.{instantiate,satisfy}
        promises are set. Since we just returned `entry`, it becomes succeeded promise even if the dependent fetch, instantiate,
        and satisfy promises are failed. This patch fixes error propagation by returning `entry.instantiate` and `entry.satisfy`
        correctly.

        * builtins/ModuleLoaderPrototype.js:
        (requestInstantiate):
        (requestSatisfy):

2018-01-25  Mark Lam  <mark.lam@apple.com>

        Gardening: fix 32-bit build after r227643.
        https://bugs.webkit.org/show_bug.cgi?id=182086

        Not reviewed.

        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitDynamicPoisonOnLoadedType):

2018-01-24  Filip Pizlo  <fpizlo@apple.com>

        DirectArguments should protect itself using dynamic poisoning and precise index masking
        https://bugs.webkit.org/show_bug.cgi?id=182086

        Reviewed by Saam Barati.
        
        This implements dynamic poisoning and precise index masking in DirectArguments, using the
        helpers from <wtf/MathExtras.h> and helpers in AssemblyHelpers and FTL::LowerDFGToB3.
        
        We use dynamic poisoning for DirectArguments since this object did not have any additional
        indirection inside it that could have been poisoned. So, we use the xor of the expected type
        and the actual type as an additional input into the pointer.
        
        We use precise index masking for bounds checks, because it's not worth doing index masking
        unless we know that precise index masking is too slow.

        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::lshiftPtr):
        (JSC::MacroAssembler::rshiftPtr):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
        (JSC::FTL::DFG::LowerDFGToB3::preciseIndexMask64):
        (JSC::FTL::DFG::LowerDFGToB3::preciseIndexMask32):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoison):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnLoadedType):
        (JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnType):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitPreciseIndexMask32):
        (JSC::AssemblyHelpers::emitDynamicPoison):
        (JSC::AssemblyHelpers::emitDynamicPoisonOnLoadedType):
        (JSC::AssemblyHelpers::emitDynamicPoisonOnType):
        * jit/AssemblyHelpers.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitDirectArgumentsGetByVal):
        * runtime/DirectArguments.h:
        (JSC::DirectArguments::getIndexQuickly const):
        (JSC::DirectArguments::setIndexQuickly):
        (JSC::DirectArguments::argument):
        * runtime/GenericArgumentsInlines.h:

2018-01-25  Mark Lam  <mark.lam@apple.com>

        Rename some local vars from type to typedArrayType for greater clarity.
        https://bugs.webkit.org/show_bug.cgi?id=182148
        <rdar://problem/36882310>

        Reviewed by Saam Barati.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):

2018-01-25  Filip Pizlo  <fpizlo@apple.com>

        JSC GC should support TLCs (thread local caches)
        https://bugs.webkit.org/show_bug.cgi?id=181559

        Reviewed by Mark Lam and Saam Barati.
        
        This is a big step towards object distancing by site origin. This patch implements TLCs, or
        thread-local caches, which allow each thread to allocate from its own free lists. It also
        means that any given thread can context-switch TLCs. This will allow us to do separate
        allocation for separate site origins. Eventually, once we reshape how MarkedBlock looks, this
        will allow us to have a hard distancing constraint between objects from different origins.
        
        In this new design, every "size class" is represented as a BlockDirectory (formerly known as
        MarkedAllocator, prior to r226822). This contains a bag of blocks allocated using some
        aligned memory allocator (which roughly represents which cage you came out of), and anyone
        using the same allocator can share those blocks - but so long as they are in that
        BlockDirectory, they will have the size and type of that directory. Previously, each
        BlockDirectory had exactly one FreeList. Now, each BlockDirectory has a double-linked-list of
        LocalAllocators, each of which has a FreeList.
        
        To decide which LocalAllocator to allocate out of, we need a ThreadLocalCache and a
        BlockDirectory. The directory gives us an offset-within-the-ThreadLocalCache, which we simply
        call the Allocator (which is just a POD type that contains a 32-bit offset). Each allocation
        starts by figuring out what Allocator it wants (often we have this information at JIT time).
        Then the allocation loads its ThreadLocalCache::Data from a fast TLS slot. Then we add the
        Allocator offset to the ThreadLocalCache::Data to get the LocalAllocator. Note that we use
        offsets as opposed to indices to make it easy to do the math on each allocation (if
        LocalAllocator had a weird size then every allocation would have to do an imul).
        
        This is a definite slow-down on GC-heavy benchmarks, but by a small margin, and only on
        unusually heavy tests. For example, boyer and splay are both 3% regressed, but the Octane
        geomean is just fine. The JetStream score regressed by 0.5% with p = 0.08 (so maybe there is
        something there, but it's not significant according to our threshold).
        
        Relanding after fixing ARM64 bug in AssemblyHelpers::emitAllocateWithNonNullAllocator(). That
        function needs to be careful to avoid using the scratch register because the FTL will call it
        in disallow-scratch-register mode.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * b3/B3LowerToAir.cpp:
        * b3/B3PatchpointSpecial.cpp:
        (JSC::B3::PatchpointSpecial::admitsStack):
        * b3/B3StackmapSpecial.cpp:
        (JSC::B3::StackmapSpecial::forEachArgImpl):
        (JSC::B3::StackmapSpecial::isArgValidForRep):
        * b3/B3StackmapValue.cpp:
        (JSC::B3::StackmapValue::appendSomeRegisterWithClobber):
        * b3/B3StackmapValue.h:
        * b3/B3Validate.cpp:
        * b3/B3ValueRep.cpp:
        (JSC::B3::ValueRep::addUsedRegistersTo const):
        (JSC::B3::ValueRep::dump const):
        (WTF::printInternal):
        * b3/B3ValueRep.h:
        (JSC::B3::ValueRep::ValueRep):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/ObjectAllocationProfile.h:
        (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
        (JSC::ObjectAllocationProfile::clear):
        * bytecode/ObjectAllocationProfileInlines.h:
        (JSC::ObjectAllocationProfile::initializeProfile):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::compileMakeRope):
        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileCreateThis):
        (JSC::DFG::SpeculativeJIT::compileNewObject):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
        * heap/Allocator.cpp: Added.
        (JSC::Allocator::cellSize const):
        * heap/Allocator.h: Added.
        (JSC::Allocator::Allocator):
        (JSC::Allocator::offset const):
        (JSC::Allocator::operator== const):
        (JSC::Allocator::operator!= const):
        (JSC::Allocator::operator bool const):
        * heap/AllocatorInlines.h: Added.
        (JSC::Allocator::allocate const):
        (JSC::Allocator::tryAllocate const):
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::BlockDirectory):
        (JSC::BlockDirectory::findBlockForAllocation):
        (JSC::BlockDirectory::stopAllocating):
        (JSC::BlockDirectory::prepareForAllocation):
        (JSC::BlockDirectory::stopAllocatingForGood):
        (JSC::BlockDirectory::resumeAllocating):
        (JSC::BlockDirectory::endMarking):
        (JSC::BlockDirectory::isFreeListedCell):
        (JSC::BlockDirectory::didConsumeFreeList): Deleted.
        (JSC::BlockDirectory::tryAllocateWithoutCollecting): Deleted.
        (JSC::BlockDirectory::allocateIn): Deleted.
        (JSC::BlockDirectory::tryAllocateIn): Deleted.
        (JSC::BlockDirectory::doTestCollectionsIfNeeded): Deleted.
        (JSC::BlockDirectory::allocateSlowCase): Deleted.
        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::cellKind const):
        (JSC::BlockDirectory::allocator const):
        (JSC::BlockDirectory::freeList const): Deleted.
        (JSC::BlockDirectory::offsetOfFreeList): Deleted.
        (JSC::BlockDirectory::offsetOfCellSize): Deleted.
        * heap/BlockDirectoryInlines.h:
        (JSC::BlockDirectory::isFreeListedCell const): Deleted.
        (JSC::BlockDirectory::allocate): Deleted.
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::CompleteSubspace):
        (JSC::CompleteSubspace::allocatorFor):
        (JSC::CompleteSubspace::allocate):
        (JSC::CompleteSubspace::allocateNonVirtual):
        (JSC::CompleteSubspace::allocatorForSlow):
        (JSC::CompleteSubspace::allocateSlow):
        (JSC::CompleteSubspace::tryAllocateSlow):
        * heap/CompleteSubspace.h:
        (JSC::CompleteSubspace::allocatorForSizeStep):
        (JSC::CompleteSubspace::allocatorForNonVirtual):
        * heap/FreeList.h:
        * heap/GCDeferralContext.h:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::lastChanceToFinalize):
        * heap/Heap.h:
        (JSC::Heap::threadLocalCacheLayout):
        * heap/IsoCellSet.h:
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::allocatorFor):
        (JSC::IsoSubspace::allocate):
        (JSC::IsoSubspace::allocateNonVirtual):
        * heap/IsoSubspace.h:
        (JSC::IsoSubspace::allocatorForNonVirtual):
        * heap/LocalAllocator.cpp: Added.
        (JSC::LocalAllocator::LocalAllocator):
        (JSC::LocalAllocator::reset):
        (JSC::LocalAllocator::~LocalAllocator):
        (JSC::LocalAllocator::stopAllocating):
        (JSC::LocalAllocator::resumeAllocating):
        (JSC::LocalAllocator::prepareForAllocation):
        (JSC::LocalAllocator::stopAllocatingForGood):
        (JSC::LocalAllocator::allocateSlowCase):
        (JSC::LocalAllocator::didConsumeFreeList):
        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
        (JSC::LocalAllocator::allocateIn):
        (JSC::LocalAllocator::tryAllocateIn):
        (JSC::LocalAllocator::doTestCollectionsIfNeeded):
        (JSC::LocalAllocator::isFreeListedCell const):
        * heap/LocalAllocator.h: Added.
        (JSC::LocalAllocator::offsetOfFreeList):
        (JSC::LocalAllocator::offsetOfCellSize):
        * heap/LocalAllocatorInlines.h: Added.
        (JSC::LocalAllocator::allocate):
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::stopAllocatingForGood):
        * heap/MarkedSpace.h:
        * heap/SlotVisitor.cpp:
        * heap/SlotVisitor.h:
        * heap/Subspace.h:
        * heap/ThreadLocalCache.cpp: Added.
        (JSC::ThreadLocalCache::create):
        (JSC::ThreadLocalCache::ThreadLocalCache):
        (JSC::ThreadLocalCache::~ThreadLocalCache):
        (JSC::ThreadLocalCache::allocateData):
        (JSC::ThreadLocalCache::destroyData):
        (JSC::ThreadLocalCache::installSlow):
        (JSC::ThreadLocalCache::installData):
        (JSC::ThreadLocalCache::allocatorSlow):
        (JSC::ThreadLocalCache::destructor):
        * heap/ThreadLocalCache.h: Added.
        (JSC::ThreadLocalCache::offsetOfSize):
        (JSC::ThreadLocalCache::offsetOfFirstAllocator):
        * heap/ThreadLocalCacheInlines.h: Added.
        (JSC::ThreadLocalCache::getImpl):
        (JSC::ThreadLocalCache::get):
        (JSC::ThreadLocalCache::install):
        (JSC::ThreadLocalCache::allocator):
        (JSC::ThreadLocalCache::tryGetAllocator):
        * heap/ThreadLocalCacheLayout.cpp: Added.
        (JSC::ThreadLocalCacheLayout::ThreadLocalCacheLayout):
        (JSC::ThreadLocalCacheLayout::~ThreadLocalCacheLayout):
        (JSC::ThreadLocalCacheLayout::allocateOffset):
        (JSC::ThreadLocalCacheLayout::snapshot):
        (JSC::ThreadLocalCacheLayout::directory):
        * heap/ThreadLocalCacheLayout.h: Added.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
        (JSC::AssemblyHelpers::emitAllocate):
        (JSC::AssemblyHelpers::emitAllocateVariableSized):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::vm):
        (JSC::AssemblyHelpers::emitAllocateJSCell):
        (JSC::AssemblyHelpers::emitAllocateJSObject):
        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator): Deleted.
        (JSC::AssemblyHelpers::emitAllocate): Deleted.
        (JSC::AssemblyHelpers::emitAllocateVariableSized): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emit_op_create_this):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emit_op_create_this):
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::createUninitialized):
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::growArrayRight):
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::overrideThings):
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
        * runtime/HashMapImpl.h:
        (JSC::HashMapBuffer::create):
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        (JSC::JSArray::unshiftCountSlowCase):
        * runtime/JSArray.h:
        (JSC::JSArray::tryCreate):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSCellInlines.h:
        (JSC::tryAllocateCellHelper):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::threadLocalCache const):
        * runtime/JSLock.cpp:
        (JSC::JSLock::didAcquireLock):
        * runtime/Options.h:
        * runtime/RegExpMatchesArray.h:
        (JSC::tryCreateUninitializedRegExpMatchesArray):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::VMEntryScope):

2018-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r227592.
        https://bugs.webkit.org/show_bug.cgi?id=182110

        it made ARM64 (Linux and iOS) crash (Requested by pizlo-mbp on
        #webkit).

        Reverted changeset:

        "JSC GC should support TLCs (thread local caches)"
        https://bugs.webkit.org/show_bug.cgi?id=181559
        https://trac.webkit.org/changeset/227592

2018-01-25  Alejandro G. Castro  <alex@igalia.com>

        undefined reference to 'JSC::B3::BasicBlock::fallThrough() const
        https://bugs.webkit.org/show_bug.cgi?id=180637

        Reviewed by Michael Catanzaro.

        We need to make sure the implementation of the inline functions is
        compiled when we compile the code using the function, now that the
        compilation is divided, or we could end up with undefined symbols
        when the declaration is not inlined, at least with some compilers
        and optimizations enabled -O2.

        * b3/B3SwitchValue.cpp: replace the include.

2018-01-20  Filip Pizlo  <fpizlo@apple.com>

        JSC GC should support TLCs (thread local caches)
        https://bugs.webkit.org/show_bug.cgi?id=181559

        Reviewed by Mark Lam and Saam Barati.
        
        This is a big step towards object distancing by site origin. This patch implements TLCs, or
        thread-local caches, which allow each thread to allocate from its own free lists. It also
        means that any given thread can context-switch TLCs. This will allow us to do separate
        allocation for separate site origins. Eventually, once we reshape how MarkedBlock looks, this
        will allow us to have a hard distancing constraint between objects from different origins.
        
        In this new design, every "size class" is represented as a BlockDirectory (formerly known as
        MarkedAllocator, prior to r226822). This contains a bag of blocks allocated using some
        aligned memory allocator (which roughly represents which cage you came out of), and anyone
        using the same allocator can share those blocks - but so long as they are in that
        BlockDirectory, they will have the size and type of that directory. Previously, each
        BlockDirectory had exactly one FreeList. Now, each BlockDirectory has a double-linked-list of
        LocalAllocators, each of which has a FreeList.
        
        To decide which LocalAllocator to allocate out of, we need a ThreadLocalCache and a
        BlockDirectory. The directory gives us an offset-within-the-ThreadLocalCache, which we simply
        call the Allocator (which is just a POD type that contains a 32-bit offset). Each allocation
        starts by figuring out what Allocator it wants (often we have this information at JIT time).
        Then the allocation loads its ThreadLocalCache::Data from a fast TLS slot. Then we add the
        Allocator offset to the ThreadLocalCache::Data to get the LocalAllocator. Note that we use
        offsets as opposed to indices to make it easy to do the math on each allocation (if
        LocalAllocator had a weird size then every allocation would have to do an imul).
        
        This is a definite slow-down on GC-heavy benchmarks, but by a small margin, and only on
        unusually heavy tests. For example, boyer and splay are both 3% regressed, but the Octane
        geomean is just fine. The JetStream score regressed by 0.5% with p = 0.08 (so maybe there is
        something there, but it's not significant according to our threshold).

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * b3/B3LowerToAir.cpp:
        * b3/B3PatchpointSpecial.cpp:
        (JSC::B3::PatchpointSpecial::admitsStack):
        * b3/B3StackmapSpecial.cpp:
        (JSC::B3::StackmapSpecial::forEachArgImpl):
        (JSC::B3::StackmapSpecial::isArgValidForRep):
        * b3/B3StackmapValue.cpp:
        (JSC::B3::StackmapValue::appendSomeRegisterWithClobber):
        * b3/B3StackmapValue.h:
        * b3/B3Validate.cpp:
        * b3/B3ValueRep.cpp:
        (JSC::B3::ValueRep::addUsedRegistersTo const):
        (JSC::B3::ValueRep::dump const):
        (WTF::printInternal):
        * b3/B3ValueRep.h:
        (JSC::B3::ValueRep::ValueRep):
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/ObjectAllocationProfile.h:
        (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
        (JSC::ObjectAllocationProfile::clear):
        * bytecode/ObjectAllocationProfileInlines.h:
        (JSC::ObjectAllocationProfile::initializeProfile):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::compileMakeRope):
        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileCreateThis):
        (JSC::DFG::SpeculativeJIT::compileNewObject):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
        * heap/Allocator.cpp: Added.
        (JSC::Allocator::cellSize const):
        * heap/Allocator.h: Added.
        (JSC::Allocator::Allocator):
        (JSC::Allocator::offset const):
        (JSC::Allocator::operator== const):
        (JSC::Allocator::operator!= const):
        (JSC::Allocator::operator bool const):
        * heap/AllocatorInlines.h: Added.
        (JSC::Allocator::allocate const):
        (JSC::Allocator::tryAllocate const):
        * heap/BlockDirectory.cpp:
        (JSC::BlockDirectory::BlockDirectory):
        (JSC::BlockDirectory::findBlockForAllocation):
        (JSC::BlockDirectory::stopAllocating):
        (JSC::BlockDirectory::prepareForAllocation):
        (JSC::BlockDirectory::stopAllocatingForGood):
        (JSC::BlockDirectory::resumeAllocating):
        (JSC::BlockDirectory::endMarking):
        (JSC::BlockDirectory::isFreeListedCell):
        (JSC::BlockDirectory::didConsumeFreeList): Deleted.
        (JSC::BlockDirectory::tryAllocateWithoutCollecting): Deleted.
        (JSC::BlockDirectory::allocateIn): Deleted.
        (JSC::BlockDirectory::tryAllocateIn): Deleted.
        (JSC::BlockDirectory::doTestCollectionsIfNeeded): Deleted.
        (JSC::BlockDirectory::allocateSlowCase): Deleted.
        * heap/BlockDirectory.h:
        (JSC::BlockDirectory::cellKind const):
        (JSC::BlockDirectory::allocator const):
        (JSC::BlockDirectory::freeList const): Deleted.
        (JSC::BlockDirectory::offsetOfFreeList): Deleted.
        (JSC::BlockDirectory::offsetOfCellSize): Deleted.
        * heap/BlockDirectoryInlines.h:
        (JSC::BlockDirectory::isFreeListedCell const): Deleted.
        (JSC::BlockDirectory::allocate): Deleted.
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::CompleteSubspace):
        (JSC::CompleteSubspace::allocatorFor):
        (JSC::CompleteSubspace::allocate):
        (JSC::CompleteSubspace::allocateNonVirtual):
        (JSC::CompleteSubspace::allocatorForSlow):
        (JSC::CompleteSubspace::allocateSlow):
        (JSC::CompleteSubspace::tryAllocateSlow):
        * heap/CompleteSubspace.h:
        (JSC::CompleteSubspace::allocatorForSizeStep):
        (JSC::CompleteSubspace::allocatorForNonVirtual):
        * heap/FreeList.h:
        * heap/GCDeferralContext.h:
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::lastChanceToFinalize):
        * heap/Heap.h:
        (JSC::Heap::threadLocalCacheLayout):
        * heap/IsoCellSet.h:
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::allocatorFor):
        (JSC::IsoSubspace::allocate):
        (JSC::IsoSubspace::allocateNonVirtual):
        * heap/IsoSubspace.h:
        (JSC::IsoSubspace::allocatorForNonVirtual):
        * heap/LocalAllocator.cpp: Added.
        (JSC::LocalAllocator::LocalAllocator):
        (JSC::LocalAllocator::reset):
        (JSC::LocalAllocator::~LocalAllocator):
        (JSC::LocalAllocator::stopAllocating):
        (JSC::LocalAllocator::resumeAllocating):
        (JSC::LocalAllocator::prepareForAllocation):
        (JSC::LocalAllocator::stopAllocatingForGood):
        (JSC::LocalAllocator::allocateSlowCase):
        (JSC::LocalAllocator::didConsumeFreeList):
        (JSC::LocalAllocator::tryAllocateWithoutCollecting):
        (JSC::LocalAllocator::allocateIn):
        (JSC::LocalAllocator::tryAllocateIn):
        (JSC::LocalAllocator::doTestCollectionsIfNeeded):
        (JSC::LocalAllocator::isFreeListedCell const):
        * heap/LocalAllocator.h: Added.
        (JSC::LocalAllocator::offsetOfFreeList):
        (JSC::LocalAllocator::offsetOfCellSize):
        * heap/LocalAllocatorInlines.h: Added.
        (JSC::LocalAllocator::allocate):
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::stopAllocatingForGood):
        * heap/MarkedSpace.h:
        * heap/SlotVisitor.cpp:
        * heap/SlotVisitor.h:
        * heap/Subspace.h:
        * heap/ThreadLocalCache.cpp: Added.
        (JSC::ThreadLocalCache::create):
        (JSC::ThreadLocalCache::ThreadLocalCache):
        (JSC::ThreadLocalCache::~ThreadLocalCache):
        (JSC::ThreadLocalCache::allocateData):
        (JSC::ThreadLocalCache::destroyData):
        (JSC::ThreadLocalCache::installSlow):
        (JSC::ThreadLocalCache::installData):
        (JSC::ThreadLocalCache::allocatorSlow):
        (JSC::ThreadLocalCache::destructor):
        * heap/ThreadLocalCache.h: Added.
        (JSC::ThreadLocalCache::offsetOfSize):
        (JSC::ThreadLocalCache::offsetOfFirstAllocator):
        * heap/ThreadLocalCacheInlines.h: Added.
        (JSC::ThreadLocalCache::getImpl):
        (JSC::ThreadLocalCache::get):
        (JSC::ThreadLocalCache::install):
        (JSC::ThreadLocalCache::allocator):
        (JSC::ThreadLocalCache::tryGetAllocator):
        * heap/ThreadLocalCacheLayout.cpp: Added.
        (JSC::ThreadLocalCacheLayout::ThreadLocalCacheLayout):
        (JSC::ThreadLocalCacheLayout::~ThreadLocalCacheLayout):
        (JSC::ThreadLocalCacheLayout::allocateOffset):
        (JSC::ThreadLocalCacheLayout::snapshot):
        (JSC::ThreadLocalCacheLayout::directory):
        * heap/ThreadLocalCacheLayout.h: Added.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
        (JSC::AssemblyHelpers::emitAllocate):
        (JSC::AssemblyHelpers::emitAllocateVariableSized):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::vm):
        (JSC::AssemblyHelpers::emitAllocateJSCell):
        (JSC::AssemblyHelpers::emitAllocateJSObject):
        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator): Deleted.
        (JSC::AssemblyHelpers::emitAllocate): Deleted.
        (JSC::AssemblyHelpers::emitAllocateVariableSized): Deleted.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emit_op_create_this):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        (JSC::JIT::emit_op_create_this):
        * runtime/ButterflyInlines.h:
        (JSC::Butterfly::createUninitialized):
        (JSC::Butterfly::tryCreate):
        (JSC::Butterfly::growArrayRight):
        * runtime/DirectArguments.cpp:
        (JSC::DirectArguments::overrideThings):
        * runtime/GenericArgumentsInlines.h:
        (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
        * runtime/HashMapImpl.h:
        (JSC::HashMapBuffer::create):
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        (JSC::JSArray::unshiftCountSlowCase):
        * runtime/JSArray.h:
        (JSC::JSArray::tryCreate):
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
        * runtime/JSCellInlines.h:
        (JSC::tryAllocateCellHelper):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::JSGlobalObject):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::threadLocalCache const):
        * runtime/JSLock.cpp:
        (JSC::JSLock::didAcquireLock):
        * runtime/Options.h:
        * runtime/RegExpMatchesArray.h:
        (JSC::tryCreateUninitializedRegExpMatchesArray):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        * runtime/VMEntryScope.cpp:
        (JSC::VMEntryScope::VMEntryScope):

2018-01-24  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Simplify update-LegacyInspectorBackendCommands.rb
        https://bugs.webkit.org/show_bug.cgi?id=182067

        Reviewed by Brian Burg.

        * inspector/scripts/codegen/models.py:
        (Framework.fromString):
        (Frameworks):
        * inspector/scripts/generate-inspector-protocol-bindings.py:
        (generate_from_specification):
        Allow framework WebInspectorUI to generate just the backend commands files.

2018-01-23  Mark Lam  <mark.lam@apple.com>

        Update Poisoned pointers to take a Poison class instead of a uintptr_t&.
        https://bugs.webkit.org/show_bug.cgi?id=182017
        <rdar://problem/36795513>

        Reviewed by Filip Pizlo and JF Bastien.

        Removed the POISON() macro.  Now that we have Poison types, we can just use the
        the Poison type instead and make the code a bit nicer to read.

        * API/JSAPIWrapperObject.h:
        * API/JSCallbackFunction.h:
        * API/JSCallbackObject.h:
        * b3/B3LowerMacros.cpp:
        * b3/testb3.cpp:
        (JSC::B3::testInterpreter):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::instructions):
        (JSC::CodeBlock::instructions const):
        * dfg/DFGOSRExitCompilerCommon.h:
        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCheckSubClass):
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
        * jit/JIT.h:
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * parser/UnlinkedSourceCode.h:
        * runtime/ArrayPrototype.h:
        * runtime/CustomGetterSetter.h:
        * runtime/DateInstance.h:
        * runtime/InternalFunction.h:
        * runtime/JSArrayBuffer.h:
        * runtime/JSCPoison.cpp:
        (JSC::initializePoison):
        * runtime/JSCPoison.h:
        * runtime/JSGlobalObject.h:
        * runtime/JSScriptFetchParameters.h:
        * runtime/JSScriptFetcher.h:
        * runtime/NativeExecutable.h:
        * runtime/StructureTransitionTable.h:
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrier::poison): Deleted.
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/JSWebAssemblyCodeBlock.cpp:
        (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/JSWebAssemblyInstance.h:
        (JSC::JSWebAssemblyInstance::poison):
        * wasm/js/JSWebAssemblyMemory.h:
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/JSWebAssemblyTable.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunctionBase.h:
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyToJSCallee.h:
        * wasm/js/WebAssemblyWrapperFunction.h:

2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, suppress GCC warnings
        https://bugs.webkit.org/show_bug.cgi?id=181976

        * runtime/TypedArrayType.h:

2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        [YARR] Add diagnosis for YarrJIT failures
        https://bugs.webkit.org/show_bug.cgi?id=181927

        Reviewed by Sam Weinig.

        It is nice if we can see the reason why YarrJIT fails to compile a given pattern.
        This patch introduces Yarr::JITFailureReason and dumps messages if Options::dumpCompiledRegExpPatterns is specified.

        * runtime/RegExp.cpp:
        (JSC::RegExp::compile):
        (JSC::RegExp::compileMatchOnly):
        * yarr/YarrJIT.cpp:
        (JSC::Yarr::YarrGenerator::generateTerm):
        (JSC::Yarr::YarrGenerator::backtrackTerm):
        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
        (JSC::Yarr::YarrGenerator::YarrGenerator):
        (JSC::Yarr::YarrGenerator::compile):
        (JSC::Yarr::dumpCompileFailure):
        (JSC::Yarr::jitCompile):
        * yarr/YarrJIT.h:
        (JSC::Yarr::YarrCodeBlock::setFallBack):
        (JSC::Yarr::YarrCodeBlock::fallBack):
        (JSC::Yarr::YarrCodeBlock::clear):
        (JSC::Yarr::YarrCodeBlock::YarrCodeBlock): Deleted.
        (JSC::Yarr::YarrCodeBlock::~YarrCodeBlock): Deleted.
        (JSC::Yarr::YarrCodeBlock::isFallBack): Deleted.

2018-01-23  Alex Christensen  <achristensen@webkit.org>

        Remove pre-Sierra-OS-specific code in WTF and JavaScriptCore
        https://bugs.webkit.org/show_bug.cgi?id=182028

        Reviewed by Keith Miller.

        * inspector/remote/cocoa/RemoteInspectorXPCConnection.h:
        * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:
        (Inspector::RemoteInspectorXPCConnection::handleEvent):

2018-01-23  Filip Pizlo  <fpizlo@apple.com>

        Use precise index masking for FTL GetByArgumentByVal
        https://bugs.webkit.org/show_bug.cgi?id=182006

        Reviewed by Keith Miller.
        
        This protects speculative out-of-bounds on arguments[index].
        
        Making this work right involved fixing a possible overflow situation with
        numberOfArgumentsToSkip.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasNumberOfArgumentsToSkip):
        (JSC::DFG::Node::numberOfArgumentsToSkip):
        * dfg/DFGStackLayoutPhase.cpp:
        (JSC::DFG::StackLayoutPhase::run):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):

2018-01-23  David Kilzer  <ddkilzer@apple.com>

        Follow-up for: oss-fuzz jsc build is broken: StringImpl.h:27:10: fatal error: 'unicode/ustring.h' file not found
        <https://webkit.org/b/181871>
        <rdar://problem/36669691>

        Address feedback for this change.

        * CMakeLists.txt: Change "SYSTEM PUBLIC" to "SYSTEM PRIVATE" per
        feedback from Konstantin Tokarev.

2018-01-23  Robin Morisset  <rmorisset@apple.com>

        Rollout r219636
        https://bugs.webkit.org/show_bug.cgi?id=181997
        <rdar://problem/35883022>

        Unreviewed, as it is a rollout.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        * runtime/JSArray.cpp:
        (JSC::JSArray::tryCreateUninitializedRestricted):
        * runtime/JSArray.h:
        (JSC::JSArray::tryCreate):
        * runtime/JSObject.cpp:
        (JSC::JSObject::ensureLengthSlow):

2018-01-23  Mark Lam  <mark.lam@apple.com>

        Re-arrange TypedArray JSTypes to match the order of the TypedArrayType enum list.
        https://bugs.webkit.org/show_bug.cgi?id=181976
        <rdar://problem/36766936>

        Reviewed by Filip Pizlo.

        1. The order of TypedArray JSTypes now matches the order the TypedArrayType enum
           list.  I also added static asserts in TypedArrayType.h to enforce this.

           Also redefined FOR_EACH_TYPED_ARRAY_TYPE() in terms of

        2. Define 4 new values:
           a. FirstTypedArrayType
           b. LastTypedArrayType
           c. NumberOfTypedArrayTypesExcludingDataView
           d. NumberOfTypedArrayTypes

           Use these everywhere where we iterate or bisect the TypedArray JSTypes.

        3. Removed NUMBER_OF_TYPED_ARRAY_TYPES, and use NumberOfTypedArrayTypes instead.

        4. Simplify the code that converts between TypedArrayType and JSType.

           Changed typedArrayTypeForType() to be the mirror image of typeForTypedArrayType().
           Previously, typedArrayTypeForType() converts DataViewType to NotTypedArray
           instead of TypeDataView.  Now, it converts to TypeDataView.

           This does not result in any change of behavior because typedArrayTypeForType()
           is only called in Structure::hasIndexingHeader(), and its result is passed to
           isTypedView(), which handles TypeDataView correctly.

        5. Also fixed a bug in SpeculativeJIT::compileGetTypedArrayByteOffset().
           If the vector is null, we can skip the rest of the checks.  While the current
           code does not result in incorrect behavior, it is inefficient, and communicates
           wrong information to the reader i.e. implying that there's something in the
           dataGPR when there's not.  The dataGPR should also be null in this case.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::isTypedArrayView):
        * ftl/FTLOSRExit.cpp:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::visitChildren):
        * runtime/JSType.h:
        * runtime/TypedArrayType.cpp:
        (JSC::typeForTypedArrayType): Deleted.
        * runtime/TypedArrayType.h:
        (JSC::typedArrayTypeForType):
        (JSC::typeForTypedArrayType):

2018-01-23  Filip Pizlo  <fpizlo@apple.com>

        DFG should always flush `this`
        https://bugs.webkit.org/show_bug.cgi?id=181999

        Reviewed by Saam Barati and Mark Lam.
        
        This is going to make it possible to use precise index masking for arguments-on-the-stack
        accesses with an index adjusted so that 0 is this. Without this change, we would have no way
        of masking when the argument count is 0, unless we padded the argument area so that there was
        always an argument slot after `this` and it was always initialized.
        
        This is neutral on all benchmarks.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::flushImpl):
        (JSC::DFG::ByteCodeParser::flushForTerminalImpl):
        (JSC::DFG::ByteCodeParser::flush):
        (JSC::DFG::ByteCodeParser::flushForTerminal):
        (JSC::DFG::ByteCodeParser::parse):
        (JSC::DFG::flushImpl): Deleted.
        (JSC::DFG::flushForTerminalImpl): Deleted.
        * dfg/DFGPreciseLocalClobberize.h:
        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

2018-01-23  Filip Pizlo  <fpizlo@apple.com>

        JSC should use a speculation fence on VM entry/exit
        https://bugs.webkit.org/show_bug.cgi?id=181991

        Reviewed by JF Bastien and Mark Lam.
        
        This adds a WTF::speculationFence on VM entry and exit.
        
        For a microbenchmark that just calls a native function (supplied via an Objective-C block) in a
        tight loop from JS is a 0% regression on x86 and a 11% regression on ARM64.
        
        * runtime/JSLock.cpp:
        (JSC::JSLock::didAcquireLock):
        (JSC::JSLock::willReleaseLock):

2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] JIT requires sizeof(bool) == 1
        https://bugs.webkit.org/show_bug.cgi?id=181150

        Reviewed by Saam Barati.

        LLInt and JIT assumes that sizeof(bool) == 1. But it is implementation-dependent in C++ spec.
        Since this is a mandatory requirement in JSC, we add a static_assert to ensure this.

        * runtime/InitializeThreading.cpp:

2018-01-23  Robin Morisset  <rmorisset@apple.com>

        Update the argument count in DFGByteCodeParser::handleRecursiveCall
        https://bugs.webkit.org/show_bug.cgi?id=181739
        <rdar://problem/36627662>

        Reviewed by Saam Barati.

        When calling a function, its number of arguments is set on the stack. When we turn a recursive tail call
        into a jump, we should update that stack slot as there is no guarantee that the function was originally
        called with the same number of arguments. Forgetting to do this is observable through 'arguments.length'.

        It required adding a new DFG node: 'SetArgumentCountIncludingThis', that takes an unsigned int
        as its first OpInfo field, and stores it to the stack at the right place.

        We must be a bit careful in where we put this new node, as it ClobbersExit.
        We must also fix DFGArgumentsEliminationPhase and DFGPutStackSinkingPhase as they assumed that any node that writes to the stack must write to either an argument or a local.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGArgumentsEliminationPhase.cpp:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.h:
        (JSC::DFG::Node::argumentCountIncludingThis):
        * dfg/DFGNodeType.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGPutStackSinkingPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileSetArgumentCountIncludingThis):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileSetArgumentCountIncludingThis):

2018-01-22  Michael Saboff  <msaboff@apple.com>

        DFG abstract interpreter needs to properly model effects of some Math ops
        https://bugs.webkit.org/show_bug.cgi?id=181886

        Reviewed by Saam Barati.

        Reviewed the processing of the various ArithXXX and CompareXXX and found that
        several nodes don't handle UntypedUse.  Added clobberWorld() for those cases.

        * dfg/DFGAbstractInterpreter.h:
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):

2018-01-21  Wenson Hsieh  <wenson_hsieh@apple.com>

        Add a new feature flag for EXTRA_ZOOM_MODE and reintroduce AdditionalFeatureDefines.h
        https://bugs.webkit.org/show_bug.cgi?id=181918

        Reviewed by Tim Horton.

        Add EXTRA_ZOOM_MODE to FeatureDefines.xconfig (off by default).

        * Configurations/FeatureDefines.xcconfig:

2018-01-20  Caio Lima  <ticaiolima@gmail.com>

        [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
        https://bugs.webkit.org/show_bug.cgi?id=181182

        Reviewed by Darin Adler.

        Casting double to integer is undefined behavior when the truncation
        results into a value that doesn't fit into integer size,
        according C++ spec[1]. Thus, we are changing bigIntProtoFuncToString and
        numberProtoFuncToString to remove these source of undefined
        behavior.

        [1] - http://en.cppreference.com/w/cpp/language/implicit_conversion

        * runtime/BigIntPrototype.cpp:
        (JSC::bigIntProtoFuncToString):
        * runtime/NumberPrototype.cpp:
        (JSC::numberProtoFuncToString):
        (JSC::extractToStringRadixArgument):
        (JSC::extractRadixFromArgs): Deleted.
        * runtime/NumberPrototype.h:

2018-01-19  Saam Barati  <sbarati@apple.com>

        Kill ArithNegate's ArithProfile assert inside BytecodeParser
        https://bugs.webkit.org/show_bug.cgi?id=181877
        <rdar://problem/36630552>

        Reviewed by Mark Lam.

        Before this patch, we used to assert that op_negate's result ArithProfile
        only produces number. It's logically true that negate only produces a number.
        However, the DFG may incorrectly pick this ArithProfile when doing OSR exit
        profiling. So we'll end up profiling something that's likely the input to
        negate. This patch removes the assert. We cede to the fact that Graph::methodOfGettingAValueProfileFor
        is entirely heuristic based, potentially leading to profiling results being imprecise.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::makeSafe):

2018-01-19  David Kilzer  <ddkilzer@apple.com>

        oss-fuzz jsc build is broken: StringImpl.h:27:10: fatal error: 'unicode/ustring.h' file not found
        <https://webkit.org/b/181871>

        Rubber-stamped by JF Bastien.

        * CMakeLists.txt: Add ICU header search path to
        LLIntOffsetsExtractor target by reusing
        JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES.

2018-01-19  Saam Barati  <sbarati@apple.com>

        Spread's effects are modeled incorrectly both in AI and in Clobberize
        https://bugs.webkit.org/show_bug.cgi?id=181867
        <rdar://problem/36290415>

        Reviewed by Michael Saboff.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):

2018-01-19  Keith Miller  <keith_miller@apple.com>

        HaveInternalSDK includes should be "#include?"
        https://bugs.webkit.org/show_bug.cgi?id=179670

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:

2018-01-18  JF Bastien  <jfbastien@apple.com>

        Set the minimum executable allocator size properly
        https://bugs.webkit.org/show_bug.cgi?id=181816
        <rdar://problem/36635533>

        Reviewed by Saam Barati.

        Executable allocator expects at least two page size's worth of
        allocation in certain conditions, and that causes some tests to
        now fail because they ask for less. Set that minimum correctly. We
        were already rounding up to a page size, so having a minimum of 2
        page sizes is fine.

        * jit/ExecutableAllocator.cpp:
        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):

2018-01-18  Michael Saboff  <msaboff@apple.com>

        Unreviewed build fix for Windows

        * interpreter/FrameTracers.h:
        (JSC::assertStackPointerIsAligned): Can't use gcc style inlined assembly
        on Windows.

2018-01-18  Mark Lam  <mark.lam@apple.com>

        Poisons should be initialized after Options are initialized.
        https://bugs.webkit.org/show_bug.cgi?id=181807
        <rdar://problem/36629138>

        Reviewed by Keith Miller.

        This is because poison initialization may depend on options.

        * runtime/InitializeThreading.cpp:
        (JSC::initializeThreading):

2018-01-18  Dan Bernstein  <mitz@apple.com>

        [Xcode] Streamline and future-proof target-macOS-version-dependent build setting definitions
        https://bugs.webkit.org/show_bug.cgi?id=181803

        Reviewed by Tim Horton.

        * Configurations/Base.xcconfig: Updated.
        * Configurations/DebugRelease.xcconfig: Ditto.
        * Configurations/FeatureDefines.xcconfig: Adopted macOSTargetConditionals helpers.
        * Configurations/Version.xcconfig: Updated.
        * Configurations/macOSTargetConditionals.xcconfig: Added. Defines helper build settings
          useful for defining settings that depend on the target macOS version.

2018-01-18  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r226068): [X86] Crash in JavaScriptCore ShadowChicken when handling exceptions
        https://bugs.webkit.org/show_bug.cgi?id=181802

        Reviewed by Filip Pizlo.

        There where a few places where the stack isn't properly aligned for X86 when we call into C++ code.
        Two places are where we call into exception handling code, the LLInt and from nativeForGenerator.
        The other place was when we call into the operationOSRWriteBarrier().

        Added an assert check that the stack is aligned on X86 platforms in the native call tracing code.
        This helped find the other cases beyond the original problem.

        * dfg/DFGOSRExitCompilerCommon.cpp:
        (JSC::DFG::osrWriteBarrier):
        * interpreter/FrameTracers.h:
        (JSC::assertStackPointerIsAligned):
        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
        (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore):
        * jit/ThunkGenerators.cpp:
        (JSC::nativeForGenerator):
        * llint/LowLevelInterpreter32_64.asm:

2018-01-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r227096.
        https://bugs.webkit.org/show_bug.cgi?id=181788

        "it caused a 15% octane regression" (Requested by saamyjoon on
        #webkit).

        Reverted changeset:

        "Support MultiGetByOffset in the DFG"
        https://bugs.webkit.org/show_bug.cgi?id=181466
        https://trac.webkit.org/changeset/227096

2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
        https://bugs.webkit.org/show_bug.cgi?id=181535

        Reviewed by Saam Barati.

        When executing the code like `string.match(/regexp/)`, `/regexp/` object is created every time we execute this code.
        However, user rarely cares about this `/regexp/` object. Typically, it is soon discarded even if it has `lastIndex`
        information. So we should not create RegExpObject for this typical case.

        This patch introduces PhantomNewRegexp. We convert NewRegexp node to PhantomNewRegexp in Object Allocation Sinking (OAS)
        phase. We should do this analysis in OAS phase since we track modifications to `lastIndex` in the OAS phase. Even if
        `lastIndex` is modified, it may not be read by users. So we have a chance to drop this NewRegexp beacause we carefully model
        SetRegExpObjectLastIndex and GetRegExpObjectLastIndex in OAS phase.

        This patch is a first attempt to drop NewRegexp. So we start optimizing it with the simple step: we first drop RegExp with
        non-global and non-sticky one. We can later extend this optimization for RegExp with global flag. But this is not included
        in this patch.

        We convert RegExpExec to RegExpExecNonGlobalOrSticky if we find that the given RegExpObject's RegExp is not global/sticky
        flagged. Since we do not need to touch `lastIndex` property in this case, RegExpExecNonGlobalOrSticky just takes RegExp
        instead of RegExpObject. This offers the chance to make NewRegExp unused.

        We also convert RegExpMatchFast to RegExpExecNonGlobalOrSticky if its RegExpObject's RegExp is non-global and non-sticky,
        since they are the same behavior.

        The above optimization completely removes NewRegexp in SixSpeed's regexp-u.{es5,es6}. The resulted execution time is
        somewhat pure execution time of our Yarr implementation.

                                     baseline                  patched

            regex-u.es5          34.8557+-0.5963     ^      6.1507+-0.5526        ^ definitely 5.6670x faster
            regex-u.es6          89.1919+-3.3851     ^     32.0917+-0.4260        ^ definitely 2.7793x faster

        This patch does not change Octane/RegExp so much since it heavily uses String.prototype.replace, which is not handled in
        this patch right now. We should support StringReplace node in subsequent patches.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGClobbersExitState.cpp:
        (JSC::DFG::clobbersExitState):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::dump):
        * dfg/DFGMayExit.cpp:
        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::convertToRegExpExecNonGlobalOrSticky):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToPhantomNewRegexp):
        (JSC::DFG::Node::convertToSetRegExpObjectLastIndex):
        (JSC::DFG::Node::hasHeapPrediction):
        (JSC::DFG::Node::hasCellOperand):
        (JSC::DFG::Node::isPhantomAllocation):
        (JSC::DFG::Node::hasIgnoreLastIndexIsWritable):
        (JSC::DFG::Node::ignoreLastIndexIsWritable):
        * dfg/DFGNodeType.h:
        * dfg/DFGObjectAllocationSinkingPhase.cpp:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGPromotedHeapLocation.cpp:
        (WTF::printInternal):
        * dfg/DFGPromotedHeapLocation.h:
        (JSC::DFG::PromotedLocationDescriptor::neededForMaterialization const):
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileNewRegexp):
        (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
        (JSC::DFG::SpeculativeJIT::compileRegExpExecNonGlobalOrSticky):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGStrengthReductionPhase.cpp:
        (JSC::DFG::StrengthReductionPhase::handleNode):
        * dfg/DFGValidate.cpp:
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExecNonGlobalOrSticky):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
        (JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
        * ftl/FTLOperations.cpp:
        (JSC::FTL::operationPopulateObjectInOSR):
        (JSC::FTL::operationMaterializeObjectInOSR):
        * jit/JITOperations.h:
        * runtime/RegExpObject.h:
        (JSC::RegExpObject::create):

2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Remove unused helper functions to convert node to PutHint
        https://bugs.webkit.org/show_bug.cgi?id=181775

        Reviewed by Saam Barati.

        We are using PromotedHeapLocation::createHint. So they are not necessary.

        * dfg/DFGNode.cpp:
        (JSC::DFG::Node::convertToPutHint): Deleted.
        (JSC::DFG::Node::convertToPutStructureHint): Deleted.
        (JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
        (JSC::DFG::Node::convertToPutClosureVarHint): Deleted.
        * dfg/DFGNode.h:

2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, suppress warnings on GCC

        Since `length` and `p` are always positive or zero,
        static_cast<unsigned>() does what we want.

        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::parseInt):

2018-01-17  Saam Barati  <sbarati@apple.com>

        Disable Atomics when SharedArrayBuffer isn’t enabled
        https://bugs.webkit.org/show_bug.cgi?id=181572
        <rdar://problem/36553206>

        Reviewed by Michael Saboff.

        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::createAtomicsProperty): Deleted.

2018-01-17  Saam Barati  <sbarati@apple.com>

        Support MultiGetByOffset in the DFG
        https://bugs.webkit.org/show_bug.cgi?id=181466

        Reviewed by Keith Miller.

        This seems to benefit Speedometer in my local testing. It seems like this
        might be around a 0.5% improvement.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleGetById):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGGraph.h:
        (JSC::DFG::Graph::supportsMultiGetByOffset):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):

2018-01-17  Saam Barati  <sbarati@apple.com>

        DFG::Node::convertToConstant needs to clear the varargs flags
        https://bugs.webkit.org/show_bug.cgi?id=181697
        <rdar://problem/36497332>

        Reviewed by Yusuke Suzuki.

        * dfg/DFGNode.h:
        (JSC::DFG::Node::convertToConstant):

2018-01-16  JF Bastien  <jfbastien@apple.com>

        Allow dangerous disabling of poison
        https://bugs.webkit.org/show_bug.cgi?id=181685
        <rdar://problem/36546265>

        Reviewed by Keith Miller.

        Some tools such as leak detectors and such like to look at real
        pointers, and poisoned ones confuse them. Add a JSC option to
        disable poisoning, but log to the console when this is done.

        * runtime/JSCPoison.cpp:
        (JSC::initializePoison):
        * runtime/Options.h:

2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r226937.

        Tests added with this change are failing due to a missing
        exception check.

        Reverted changeset:

        "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
        double to int32_t"
        https://bugs.webkit.org/show_bug.cgi?id=181182
        https://trac.webkit.org/changeset/226937

2018-01-16  Michael Catanzaro  <mcatanzaro@igalia.com>

        Test programs should only be built in developer mode
        https://bugs.webkit.org/show_bug.cgi?id=181653

        Reviewed by Carlos Garcia Campos.

        Build test programs only in developer mode, and fix code style.

        * shell/CMakeLists.txt:

2018-01-15  Michael Catanzaro  <mcatanzaro@igalia.com>

        Improve use of ExportMacros
        https://bugs.webkit.org/show_bug.cgi?id=181652

        Reviewed by Konstantin Tokarev.

        * API/JSBase.h: Update a comment.
        * inspector/InspectorBackendDispatcher.h: Use a better, yet equivalent, WTF macro.
        * runtime/JSExportMacros.h: Simplify the #defines in this file.

2018-01-15  JF Bastien  <jfbastien@apple.com>

        Remove makePoisonedUnique
        https://bugs.webkit.org/show_bug.cgi?id=181630
        <rdar://problem/36498623>

        Reviewed by Mark Lam.

        I added a conversion from std::unique_ptr, so we can just use
        std::make_unique and it'll auto-poison when converted.

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::makePoisonedUnique): Deleted.
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::makePoisonedUnique): Deleted.

2018-01-15  Michael Catanzaro  <mcatanzaro@igalia.com>

        REGRESSION(r226266): [GTK] RELEASE_ASSERT(reservedZoneSize >= minimumReservedZoneSize) in JSC::VM::updateStackLimits
        https://bugs.webkit.org/show_bug.cgi?id=181438
        <rdar://problem/36376724>

        Reviewed by Carlos Garcia Campos.

        Roll out the functional changes of r226266. We'll keep the minor CMake library type setting
        cleanup, but we have to switch back to building JSC only as a shared library, and we have to
        get rid of the version script.

        * PlatformGTK.cmake:
        * javascriptcoregtk-symbols.map: Removed.

2018-01-14  Saam Barati  <sbarati@apple.com>

        Unreviewed. r226928 broke the CLOOP build. This patch fixes the CLOOP build.

        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFromLLInt):
        (JSC::CallLinkStatus::computeExitSiteData):

2018-01-13  Mark Lam  <mark.lam@apple.com>

        Replace all use of ConstExprPoisoned with Poisoned.
        https://bugs.webkit.org/show_bug.cgi?id=181542
        <rdar://problem/36442138>

        Reviewed by JF Bastien.

        1. All JSC poisons are now defined in JSCPoison.h.

        2. Change all clients to use the new poison values via the POISON() macro.

        3. The LLInt code has been updated to handle CodeBlock poison.  Some of this code
           uses the t5 temp register, which is not available on the Windows port.
           Fortunately, we don't currently do poisoning on the Windows port yet.  So,
           it will just work for now.

           When poisoning is enabled for the Windows port, this LLInt code will need a
           Windows specific implementation to workaround its lack of a t5 register.

        * API/JSAPIWrapperObject.h:
        * API/JSCallbackFunction.h:
        * API/JSCallbackObject.h:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodePtr::emptyValue):
        (JSC::MacroAssemblerCodePtr::deletedValue):
        * b3/B3LowerMacros.cpp:
        * b3/testb3.cpp:
        (JSC::B3::testInterpreter):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::instructions):
        (JSC::CodeBlock::instructions const):
        (JSC::CodeBlock::makePoisonedUnique):
        * dfg/DFGOSRExitCompilerCommon.h:
        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileCheckSubClass):
        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
        * jit/JIT.h:
        * jit/ThunkGenerators.cpp:
        (JSC::virtualThunkFor):
        (JSC::nativeForGenerator):
        (JSC::boundThisNoArgsFunctionCallGenerator):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * parser/UnlinkedSourceCode.h:
        * runtime/ArrayPrototype.h:
        * runtime/CustomGetterSetter.h:
        * runtime/DateInstance.h:
        * runtime/InternalFunction.h:
        * runtime/JSArrayBuffer.h:
        * runtime/JSCPoison.cpp: Copied from Source/JavaScriptCore/runtime/JSCPoisonedPtr.cpp.
        (JSC::initializePoison):
        * runtime/JSCPoison.h:
        (): Deleted.
        * runtime/JSCPoisonedPtr.cpp: Removed.
        * runtime/JSCPoisonedPtr.h: Removed.
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::makePoisonedUnique):
        * runtime/JSScriptFetchParameters.h:
        * runtime/JSScriptFetcher.h:
        * runtime/NativeExecutable.h:
        * runtime/StructureTransitionTable.h:
        (JSC::StructureTransitionTable::map const):
        (JSC::StructureTransitionTable::weakImpl const):
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrier::poison):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):
        * wasm/js/JSWebAssemblyCodeBlock.cpp:
        (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/JSWebAssemblyInstance.h:
        * wasm/js/JSWebAssemblyMemory.h:
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/JSWebAssemblyTable.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunctionBase.h:
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyToJSCallee.h:
        * wasm/js/WebAssemblyWrapperFunction.h:

2018-01-13  Caio Lima  <ticaiolima@gmail.com>

        [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
        https://bugs.webkit.org/show_bug.cgi?id=181182

        Reviewed by Darin Adler.

        Casting double to integer is undefined behavior when the truncation
        results into a value that doesn't fit into integer size, according C++
        spec[1]. Thus, we are changing bigIntProtoFuncToString and
        numberProtoFuncToString to remove these source of undefined behavior.

        [1] - http://en.cppreference.com/w/cpp/language/implicit_conversion

        * runtime/BigIntPrototype.cpp:
        (JSC::bigIntProtoFuncToString):
        * runtime/NumberPrototype.cpp:
        (JSC::numberProtoFuncToString):
        (JSC::extractRadixFromArgs): Deleted.
        (JSC::extractToStringRadixArgument): Added.

2018-01-12  Saam Barati  <sbarati@apple.com>

        Move ExitProfile to UnlinkedCodeBlock so it can be shared amongst CodeBlocks backed by the same UnlinkedCodeBlock
        https://bugs.webkit.org/show_bug.cgi?id=181545

        Reviewed by Michael Saboff.

        This patch follows the theme of putting optimization profiling information on
        UnlinkedCodeBlock. This allows the unlinked code cache to remember OSR exit data.
        This often leads to the first compile of a CodeBlock, backed by an UnlinkedCodeBlock
        pulled from the code cache, making better compilation decisions, usually
        resulting in fewer exits, and fewer recompilations.
        
        This is a 1% Speedometer progression in my testing.

        * bytecode/BytecodeDumper.cpp:
        (JSC::BytecodeDumper<CodeBlock>::dumpProfilesForBytecodeOffset):
        * bytecode/CallLinkStatus.cpp:
        (JSC::CallLinkStatus::computeFromLLInt):
        (JSC::CallLinkStatus::computeFor):
        (JSC::CallLinkStatus::computeExitSiteData):
        (JSC::CallLinkStatus::computeDFGStatuses):
        * bytecode/CallLinkStatus.h:
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::addFrequentExitSite): Deleted.
        (JSC::CodeBlock::hasExitSite const): Deleted.
        (JSC::CodeBlock::exitProfile): Deleted.
        * bytecode/DFGExitProfile.cpp:
        (JSC::DFG::ExitProfile::add):
        (JSC::DFG::QueryableExitProfile::initialize):
        * bytecode/DFGExitProfile.h:
        (JSC::DFG::ExitProfile::hasExitSite const):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::hasExitSite):
        (JSC::GetByIdStatus::computeFor):
        (JSC::GetByIdStatus::computeForStubInfo):
        * bytecode/GetByIdStatus.h:
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::hasExitSite):
        (JSC::PutByIdStatus::computeFor):
        (JSC::PutByIdStatus::computeForStubInfo):
        * bytecode/PutByIdStatus.h:
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::UnlinkedCodeBlock::livenessAnalysisSlow):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedCodeBlock::hasExitSite const):
        (JSC::UnlinkedCodeBlock::hasExitSite):
        (JSC::UnlinkedCodeBlock::exitProfile):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        * dfg/DFGGraph.h:
        (JSC::DFG::Graph::hasGlobalExitSite):
        (JSC::DFG::Graph::hasExitSite):
        * dfg/DFGLICMPhase.cpp:
        (JSC::DFG::LICMPhase::attemptHoist):
        * dfg/DFGOSRExitBase.cpp:
        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):

2018-01-12  JF Bastien  <jfbastien@apple.com>

        PoisonedWriteBarrier
        https://bugs.webkit.org/show_bug.cgi?id=181599
        <rdar://problem/36474351>

        Reviewed by Mark Lam.

        Allow poisoning of WriteBarrier objects, and use this for
        WebAssembly because it is perf-neutral, at least on WasmBench on
        my MBP. If it indeed is perf-neutral according to the bots, start
        using it in more performance-sensitive places.

        * heap/HandleTypes.h:
        * heap/SlotVisitor.h:
        * heap/SlotVisitorInlines.h:
        (JSC::SlotVisitor::append):
        (JSC::SlotVisitor::appendHidden):
        * runtime/JSCJSValue.h:
        * runtime/JSCPoison.h:
        * runtime/Structure.h:
        * runtime/StructureInlines.h:
        (JSC::Structure::setPrototypeWithoutTransition):
        (JSC::Structure::setGlobalObject):
        (JSC::Structure::setPreviousID):
        * runtime/WriteBarrier.h:
        (JSC::WriteBarrierBase::copyFrom):
        (JSC::WriteBarrierBase::get const):
        (JSC::WriteBarrierBase::operator* const):
        (JSC::WriteBarrierBase::operator-> const):
        (JSC::WriteBarrierBase::clear):
        (JSC::WriteBarrierBase::slot):
        (JSC::WriteBarrierBase::operator bool const):
        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
        (JSC::WriteBarrierBase::unvalidatedGet const):
        (JSC::operator==):
        * runtime/WriteBarrierInlines.h:
        (JSC::Traits>::set):
        (JSC::Traits>::setMayBeNull):
        (JSC::Traits>::setEarlyValue):
        (JSC::DumbValueTraits<Unknown>>::set):
        * wasm/WasmInstance.h:
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
        (JSC::JSWebAssemblyInstance::finishCreation):
        (JSC::JSWebAssemblyInstance::visitChildren):
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyInstance.h:
        (JSC::JSWebAssemblyInstance::offsetOfPoisonedCallee):
        * wasm/js/JSWebAssemblyMemory.h:
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::JSWebAssemblyTable):
        (JSC::JSWebAssemblyTable::grow):
        (JSC::JSWebAssemblyTable::clearFunction):
        * wasm/js/JSWebAssemblyTable.h:
        * wasm/js/WasmToJS.cpp:
        (JSC::Wasm::materializeImportJSCell):
        (JSC::Wasm::handleBadI64Use):
        (JSC::Wasm::wasmToJS):
        * wasm/js/WebAssemblyFunctionBase.h:
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::link):
        (JSC::WebAssemblyModuleRecord::evaluate):
        * wasm/js/WebAssemblyModuleRecord.h:
        * wasm/js/WebAssemblyToJSCallee.h:
        * wasm/js/WebAssemblyWrapperFunction.h:

2018-01-12  Saam Barati  <sbarati@apple.com>

        CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
        https://bugs.webkit.org/show_bug.cgi?id=181177
        <rdar://problem/36205704>

        Reviewed by Yusuke Suzuki.

        The semantics of CheckStructure are such that it does not allow the empty value to flow through it.
        However, we may eliminate a CheckStructure if it's preceded by a CheckStructureOrEmpty. This doesn't
        have semantic consequences when validation is turned off. However, with validation on, this trips up
        our OSR exit machinery that says when an exit is allowed to happen.
        
        Consider the following IR:
        
        a: GetClosureVar // Or any other node that produces BytecodeTop
        ...
        c: CheckStructure(Cell:@a, {s2})
        d: PutByOffset(KnownCell:@a, KnownCell:@a, @value)
        
        In the TypeCheckHoistingPhase, we may insert CheckStructureOrEmptys like this:
        a: GetClosureVar
        e: CheckStructureOrEmpty(@a, {s1})
        ...
        f: CheckStructureOrEmpty(@a, {s2})
        c: CheckStructure(Cell:@a, {s2})
        d: PutByOffset(KnownCell:@a, KnownCell:@a, @value)
        
        This will cause constant folding to change the IR to:
        a: GetClosureVar
        e: CheckStructureOrEmpty(@a, {s1})
        ...
        f: CheckStructureOrEmpty(@a, {s2})
        d: PutByOffset(KnownCell:@a, KnownCell:@a, @value)
        
        Our mayExit analysis determines that the PutByOffset should not exit. Note
        that AI will determine the only value the PutByOffset can see in @a is 
        the empty value. Because KnownCell filters SpecCell and not SpecCellCheck,
        when lowering the PutByOffset, we reach a contradiction in AI and emit
        an OSR exit. However, because mayExit said we couldn't exit, we assert.
        
        Note that if we did not run the TypeCheckHoistingPhase on this IR, AI
        would have determined we would OSR exit at the second CheckStructure.
        
        This patch makes it so constant folding produces the following IR:
        a: GetClosureVar
        e: CheckStructureOrEmpty(@a, {s1})
        g: AssertNotEmpty(@a)
        ...
        f: CheckStructureOrEmpty(@a, {s2})
        h: AssertNotEmpty(@a)
        d: PutByOffset(KnownCell:@a, KnownCell:@a, @value)
        
        This modification will cause AI to know we will OSR exit before even reaching
        the PutByOffset. Note that in the original IR, the GetClosureVar won't
        actually produce the TDZ value. If it did, bytecode would have caused us
        to emit a CheckNotEmpty before the CheckStructure/PutByOffset combo. That's
        why this bug is about IR bookkeeping and not an actual error in IR analysis.
        This patch introduces AssertNotEmpty instead of using CheckNotEmpty to be
        more congruous with CheckStructure's semantics of crashing on the empty value
        as input (on 64 bit platforms).

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNodeType.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):

2018-01-12  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Remove unnecessary raw pointer in InspectorConsoleAgent
        https://bugs.webkit.org/show_bug.cgi?id=181579
        <rdar://problem/36193759>

        Reviewed by Brian Burg.

        * inspector/agents/InspectorConsoleAgent.h:
        * inspector/agents/InspectorConsoleAgent.cpp:
        (Inspector::InspectorConsoleAgent::clearMessages):
        (Inspector::InspectorConsoleAgent::addConsoleMessage):
        Switch from a raw pointer to m_consoleMessages.last().
        Also move the expiration check into the if block since it can only
        happen inside here when the number of console messages changes.

        (Inspector::InspectorConsoleAgent::discardValues):
        Also clear the expired message count when messages are cleared.

2018-01-12  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Create parallel SlotVisitors apriori
        https://bugs.webkit.org/show_bug.cgi?id=180907

        Reviewed by Saam Barati.

        The number of SlotVisitors are capped with the number of HeapHelperPool's threads + 2.
        If we create these SlotVisitors apropri, we do not need to create SlotVisitors dynamically.
        Then we do not need to grab locks while iterating all the SlotVisitors.

        In addition, we do not need to consider the case that the number of SlotVisitors increases
        after setting up VisitCounters in MarkingConstraintSolver since the number of SlotVisitors
        does not increase any more.

        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::runBeginPhase):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::forEachSlotVisitor):
        (JSC::Heap::numberOfSlotVisitors): Deleted.
        * heap/MarkingConstraintSolver.cpp:
        (JSC::MarkingConstraintSolver::didVisitSomething const):

2018-01-12  Saam Barati  <sbarati@apple.com>

        Each variant of a polymorphic inlined call should be exitOK at the top of the block
        https://bugs.webkit.org/show_bug.cgi?id=181562
        <rdar://problem/36445624>

        Reviewed by Yusuke Suzuki.

        Before this patch, the very first block in the switch for polymorphic call
        inlining will have exitOK at the top. The others are not guaranteed to.
        That was just a bug. They're all exitOK at the top. This will lead to crashes
        in FixupPhase because we won't have a node in a block that has ExitOK, so
        when we fixup various type checks, we assert out.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleInlining):

2018-01-11  Keith Miller  <keith_miller@apple.com>

        Rename ENABLE_ASYNC_ITERATION to ENABLE_JS_ASYNC_ITERATION
        https://bugs.webkit.org/show_bug.cgi?id=181573

        Reviewed by Simon Fraser.

        * Configurations/FeatureDefines.xcconfig:
        * runtime/Options.h:

2018-01-11  Michael Saboff  <msaboff@apple.com>

        REGRESSION(226788): AppStore Crashed @ JavaScriptCore: JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters
        https://bugs.webkit.org/show_bug.cgi?id=181570

        Reviewed by Keith Miller.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::abortWithReason):
        Reverting these functions to use dataTempRegister and memoryTempRegister as they are
        JIT release asserts that will crash the program.

        (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):
        Changed this so that it invalidates any cached dataTmpRegister contents if temp register
        caching is enabled.

2018-01-11  Filip Pizlo  <fpizlo@apple.com>

        Rename MarkedAllocator to BlockDirectory and AllocatorAttributes to CellAttributes
        https://bugs.webkit.org/show_bug.cgi?id=181543

        Rubber stamped by Michael Saboff.
        
        In a world that has thread-local caches, the thing we now call the "MarkedAllocator" doesn't
        really have anything to do with allocation anymore. The allocation will be done by something
        in the TLC. When you move the allocation logic out of MarkedAllocator, it becomes just a
        place to find blocks (a "block directory").

        Once we do that renaming, the term "allocator attributes" becomes weird. Those are really the
        attributes of the HeapCellType. So let's call them CellAttributes.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):
        * bytecode/ObjectAllocationProfile.h:
        * bytecode/ObjectAllocationProfileInlines.h:
        (JSC::ObjectAllocationProfile::initializeProfile):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::compileMakeRope):
        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
        (JSC::DFG::SpeculativeJIT::compileNewObject):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
        * ftl/FTLAbstractHeapRepository.h:
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
        * heap/AlignedMemoryAllocator.cpp:
        (JSC::AlignedMemoryAllocator::registerDirectory):
        (JSC::AlignedMemoryAllocator::registerAllocator): Deleted.
        * heap/AlignedMemoryAllocator.h:
        (JSC::AlignedMemoryAllocator::firstDirectory const):
        (JSC::AlignedMemoryAllocator::firstAllocator const): Deleted.
        * heap/AllocatorAttributes.cpp: Removed.
        * heap/AllocatorAttributes.h: Removed.
        * heap/BlockDirectory.cpp: Copied from Source/JavaScriptCore/heap/MarkedAllocator.cpp.
        (JSC::BlockDirectory::BlockDirectory):
        (JSC::BlockDirectory::setSubspace):
        (JSC::BlockDirectory::isPagedOut):
        (JSC::BlockDirectory::findEmptyBlockToSteal):
        (JSC::BlockDirectory::didConsumeFreeList):
        (JSC::BlockDirectory::tryAllocateWithoutCollecting):
        (JSC::BlockDirectory::allocateIn):
        (JSC::BlockDirectory::tryAllocateIn):
        (JSC::BlockDirectory::doTestCollectionsIfNeeded):
        (JSC::BlockDirectory::allocateSlowCase):
        (JSC::BlockDirectory::blockSizeForBytes):
        (JSC::BlockDirectory::tryAllocateBlock):
        (JSC::BlockDirectory::addBlock):
        (JSC::BlockDirectory::removeBlock):
        (JSC::BlockDirectory::stopAllocating):
        (JSC::BlockDirectory::prepareForAllocation):
        (JSC::BlockDirectory::lastChanceToFinalize):
        (JSC::BlockDirectory::resumeAllocating):
        (JSC::BlockDirectory::beginMarkingForFullCollection):
        (JSC::BlockDirectory::endMarking):
        (JSC::BlockDirectory::snapshotUnsweptForEdenCollection):
        (JSC::BlockDirectory::snapshotUnsweptForFullCollection):
        (JSC::BlockDirectory::findBlockToSweep):
        (JSC::BlockDirectory::sweep):
        (JSC::BlockDirectory::shrink):
        (JSC::BlockDirectory::assertNoUnswept):
        (JSC::BlockDirectory::parallelNotEmptyBlockSource):
        (JSC::BlockDirectory::dump const):
        (JSC::BlockDirectory::dumpBits):
        (JSC::BlockDirectory::markedSpace const):
        (JSC::MarkedAllocator::MarkedAllocator): Deleted.
        (JSC::MarkedAllocator::setSubspace): Deleted.
        (JSC::MarkedAllocator::isPagedOut): Deleted.
        (JSC::MarkedAllocator::findEmptyBlockToSteal): Deleted.
        (JSC::MarkedAllocator::didConsumeFreeList): Deleted.
        (JSC::MarkedAllocator::tryAllocateWithoutCollecting): Deleted.
        (JSC::MarkedAllocator::allocateIn): Deleted.
        (JSC::MarkedAllocator::tryAllocateIn): Deleted.
        (JSC::MarkedAllocator::doTestCollectionsIfNeeded): Deleted.
        (JSC::MarkedAllocator::allocateSlowCase): Deleted.
        (JSC::MarkedAllocator::blockSizeForBytes): Deleted.
        (JSC::MarkedAllocator::tryAllocateBlock): Deleted.
        (JSC::MarkedAllocator::addBlock): Deleted.
        (JSC::MarkedAllocator::removeBlock): Deleted.
        (JSC::MarkedAllocator::stopAllocating): Deleted.
        (JSC::MarkedAllocator::prepareForAllocation): Deleted.
        (JSC::MarkedAllocator::lastChanceToFinalize): Deleted.
        (JSC::MarkedAllocator::resumeAllocating): Deleted.
        (JSC::MarkedAllocator::beginMarkingForFullCollection): Deleted.
        (JSC::MarkedAllocator::endMarking): Deleted.
        (JSC::MarkedAllocator::snapshotUnsweptForEdenCollection): Deleted.
        (JSC::MarkedAllocator::snapshotUnsweptForFullCollection): Deleted.
        (JSC::MarkedAllocator::findBlockToSweep): Deleted.
        (JSC::MarkedAllocator::sweep): Deleted.
        (JSC::MarkedAllocator::shrink): Deleted.
        (JSC::MarkedAllocator::assertNoUnswept): Deleted.
        (JSC::MarkedAllocator::parallelNotEmptyBlockSource): Deleted.
        (JSC::MarkedAllocator::dump const): Deleted.
        (JSC::MarkedAllocator::dumpBits): Deleted.
        (JSC::MarkedAllocator::markedSpace const): Deleted.
        * heap/BlockDirectory.h: Copied from Source/JavaScriptCore/heap/MarkedAllocator.h.
        (JSC::BlockDirectory::attributes const):
        (JSC::BlockDirectory::forEachBitVector):
        (JSC::BlockDirectory::forEachBitVectorWithName):
        (JSC::BlockDirectory::nextDirectory const):
        (JSC::BlockDirectory::nextDirectoryInSubspace const):
        (JSC::BlockDirectory::nextDirectoryInAlignedMemoryAllocator const):
        (JSC::BlockDirectory::setNextDirectory):
        (JSC::BlockDirectory::setNextDirectoryInSubspace):
        (JSC::BlockDirectory::setNextDirectoryInAlignedMemoryAllocator):
        (JSC::BlockDirectory::offsetOfFreeList):
        (JSC::BlockDirectory::offsetOfCellSize):
        (JSC::MarkedAllocator::cellSize const): Deleted.
        (JSC::MarkedAllocator::attributes const): Deleted.
        (JSC::MarkedAllocator::needsDestruction const): Deleted.
        (JSC::MarkedAllocator::destruction const): Deleted.
        (JSC::MarkedAllocator::cellKind const): Deleted.
        (JSC::MarkedAllocator::heap): Deleted.
        (JSC::MarkedAllocator::bitvectorLock): Deleted.
        (JSC::MarkedAllocator::forEachBitVector): Deleted.
        (JSC::MarkedAllocator::forEachBitVectorWithName): Deleted.
        (JSC::MarkedAllocator::nextAllocator const): Deleted.
        (JSC::MarkedAllocator::nextAllocatorInSubspace const): Deleted.
        (JSC::MarkedAllocator::nextAllocatorInAlignedMemoryAllocator const): Deleted.
        (JSC::MarkedAllocator::setNextAllocator): Deleted.
        (JSC::MarkedAllocator::setNextAllocatorInSubspace): Deleted.
        (JSC::MarkedAllocator::setNextAllocatorInAlignedMemoryAllocator): Deleted.
        (JSC::MarkedAllocator::subspace const): Deleted.
        (JSC::MarkedAllocator::freeList const): Deleted.
        (JSC::MarkedAllocator::offsetOfFreeList): Deleted.
        (JSC::MarkedAllocator::offsetOfCellSize): Deleted.
        * heap/BlockDirectoryInlines.h: Copied from Source/JavaScriptCore/heap/MarkedAllocatorInlines.h.
        (JSC::BlockDirectory::isFreeListedCell const):
        (JSC::BlockDirectory::allocate):
        (JSC::BlockDirectory::forEachBlock):
        (JSC::BlockDirectory::forEachNotEmptyBlock):
        (JSC::MarkedAllocator::isFreeListedCell const): Deleted.
        (JSC::MarkedAllocator::allocate): Deleted.
        (JSC::MarkedAllocator::forEachBlock): Deleted.
        (JSC::MarkedAllocator::forEachNotEmptyBlock): Deleted.
        * heap/CellAttributes.cpp: Copied from Source/JavaScriptCore/heap/AllocatorAttributes.cpp.
        (JSC::CellAttributes::dump const):
        (JSC::AllocatorAttributes::dump const): Deleted.
        * heap/CellAttributes.h: Copied from Source/JavaScriptCore/heap/AllocatorAttributes.h.
        (JSC::CellAttributes::CellAttributes):
        (JSC::AllocatorAttributes::AllocatorAttributes): Deleted.
        * heap/CompleteSubspace.cpp:
        (JSC::CompleteSubspace::allocatorFor):
        (JSC::CompleteSubspace::allocateNonVirtual):
        (JSC::CompleteSubspace::allocatorForSlow):
        (JSC::CompleteSubspace::tryAllocateSlow):
        * heap/CompleteSubspace.h:
        (JSC::CompleteSubspace::allocatorForSizeStep):
        (JSC::CompleteSubspace::allocatorForNonVirtual):
        * heap/GCDeferralContext.h:
        * heap/Heap.cpp:
        (JSC::Heap::updateAllocationLimits):
        * heap/Heap.h:
        * heap/HeapCell.h:
        * heap/HeapCellInlines.h:
        (JSC::HeapCell::cellAttributes const):
        (JSC::HeapCell::destructionMode const):
        (JSC::HeapCell::cellKind const):
        (JSC::HeapCell::allocatorAttributes const): Deleted.
        * heap/HeapCellType.cpp:
        (JSC::HeapCellType::HeapCellType):
        * heap/HeapCellType.h:
        (JSC::HeapCellType::attributes const):
        * heap/IncrementalSweeper.cpp:
        (JSC::IncrementalSweeper::IncrementalSweeper):
        (JSC::IncrementalSweeper::sweepNextBlock):
        (JSC::IncrementalSweeper::startSweeping):
        (JSC::IncrementalSweeper::stopSweeping):
        * heap/IncrementalSweeper.h:
        * heap/IsoCellSet.cpp:
        (JSC::IsoCellSet::IsoCellSet):
        (JSC::IsoCellSet::parallelNotEmptyMarkedBlockSource):
        (JSC::IsoCellSet::addSlow):
        (JSC::IsoCellSet::didRemoveBlock):
        (JSC::IsoCellSet::sweepToFreeList):
        * heap/IsoCellSetInlines.h:
        (JSC::IsoCellSet::forEachMarkedCell):
        (JSC::IsoCellSet::forEachLiveCell):
        * heap/IsoSubspace.cpp:
        (JSC::IsoSubspace::IsoSubspace):
        (JSC::IsoSubspace::allocatorFor):
        (JSC::IsoSubspace::allocateNonVirtual):
        * heap/IsoSubspace.h:
        (JSC::IsoSubspace::allocatorForNonVirtual):
        * heap/LargeAllocation.h:
        (JSC::LargeAllocation::attributes const):
        * heap/MarkedAllocator.cpp: Removed.
        * heap/MarkedAllocator.h: Removed.
        * heap/MarkedAllocatorInlines.h: Removed.
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::~Handle):
        (JSC::MarkedBlock::Handle::setIsFreeListed):
        (JSC::MarkedBlock::Handle::stopAllocating):
        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
        (JSC::MarkedBlock::Handle::resumeAllocating):
        (JSC::MarkedBlock::aboutToMarkSlow):
        (JSC::MarkedBlock::Handle::didConsumeFreeList):
        (JSC::MarkedBlock::noteMarkedSlow):
        (JSC::MarkedBlock::Handle::removeFromDirectory):
        (JSC::MarkedBlock::Handle::didAddToDirectory):
        (JSC::MarkedBlock::Handle::didRemoveFromDirectory):
        (JSC::MarkedBlock::Handle::dumpState):
        (JSC::MarkedBlock::Handle::subspace const):
        (JSC::MarkedBlock::Handle::sweep):
        (JSC::MarkedBlock::Handle::isFreeListedCell const):
        (JSC::MarkedBlock::Handle::removeFromAllocator): Deleted.
        (JSC::MarkedBlock::Handle::didAddToAllocator): Deleted.
        (JSC::MarkedBlock::Handle::didRemoveFromAllocator): Deleted.
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::Handle::directory const):
        (JSC::MarkedBlock::Handle::attributes const):
        (JSC::MarkedBlock::attributes const):
        (JSC::MarkedBlock::Handle::allocator const): Deleted.
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::Handle::isAllocated):
        (JSC::MarkedBlock::Handle::isLive):
        (JSC::MarkedBlock::Handle::specializedSweep):
        (JSC::MarkedBlock::Handle::isEmpty):
        * heap/MarkedSpace.cpp:
        (JSC::MarkedSpace::lastChanceToFinalize):
        (JSC::MarkedSpace::sweep):
        (JSC::MarkedSpace::stopAllocating):
        (JSC::MarkedSpace::resumeAllocating):
        (JSC::MarkedSpace::isPagedOut):
        (JSC::MarkedSpace::freeBlock):
        (JSC::MarkedSpace::shrink):
        (JSC::MarkedSpace::beginMarking):
        (JSC::MarkedSpace::endMarking):
        (JSC::MarkedSpace::snapshotUnswept):
        (JSC::MarkedSpace::assertNoUnswept):
        (JSC::MarkedSpace::dumpBits):
        (JSC::MarkedSpace::addBlockDirectory):
        (JSC::MarkedSpace::addMarkedAllocator): Deleted.
        * heap/MarkedSpace.h:
        (JSC::MarkedSpace::firstDirectory const):
        (JSC::MarkedSpace::directoryLock):
        (JSC::MarkedSpace::forEachBlock):
        (JSC::MarkedSpace::forEachDirectory):
        (JSC::MarkedSpace::firstAllocator const): Deleted.
        (JSC::MarkedSpace::allocatorLock): Deleted.
        (JSC::MarkedSpace::forEachAllocator): Deleted.
        * heap/MarkedSpaceInlines.h:
        * heap/Subspace.cpp:
        (JSC::Subspace::initialize):
        (JSC::Subspace::prepareForAllocation):
        (JSC::Subspace::findEmptyBlockToSteal):
        (JSC::Subspace::parallelDirectorySource):
        (JSC::Subspace::parallelNotEmptyMarkedBlockSource):
        (JSC::Subspace::sweep):
        (JSC::Subspace::parallelAllocatorSource): Deleted.
        * heap/Subspace.h:
        (JSC::Subspace::attributes const):
        (JSC::Subspace::didCreateFirstDirectory):
        (JSC::Subspace::didCreateFirstAllocator): Deleted.
        * heap/SubspaceInlines.h:
        (JSC::Subspace::forEachDirectory):
        (JSC::Subspace::forEachMarkedBlock):
        (JSC::Subspace::forEachNotEmptyMarkedBlock):
        (JSC::Subspace::forEachAllocator): Deleted.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
        (JSC::AssemblyHelpers::emitAllocate):
        (JSC::AssemblyHelpers::emitAllocateJSCell):
        (JSC::AssemblyHelpers::emitAllocateJSObject):
        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
        * jit/JIT.h:
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_new_object):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_new_object):
        * runtime/JSDestructibleObjectHeapCellType.cpp:
        (JSC::JSDestructibleObjectHeapCellType::JSDestructibleObjectHeapCellType):
        * runtime/JSSegmentedVariableObjectHeapCellType.cpp:
        (JSC::JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType):
        * runtime/JSStringHeapCellType.cpp:
        (JSC::JSStringHeapCellType::JSStringHeapCellType):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp:
        (JSC::JSWebAssemblyCodeBlockHeapCellType::JSWebAssemblyCodeBlockHeapCellType):

2018-01-11  Saam Barati  <sbarati@apple.com>

        When inserting Unreachable in byte code parser we need to flush all the right things
        https://bugs.webkit.org/show_bug.cgi?id=181509
        <rdar://problem/36423110>

        Reviewed by Mark Lam.

        I added code in r226655 that had its own mechanism for preserving liveness when
        inserting Unreachable nodes after ForceOSRExit. There are two ways to preserve
        liveness: PhantomLocal and Flush. Certain values *must* be flushed to the stack.
        I got some of these values wrong, which was leading to a crash when recovering the
        callee value from an inlined frame. Instead of making the same mistake and repeating
        similar code again, this patch refactors this logic to be shared with the other
        liveness preservation code in the DFG bytecode parser. This is what I should have
        done in my initial patch.

        * bytecode/InlineCallFrame.h:
        (JSC::remapOperand):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::flushImpl):
        (JSC::DFG::flushForTerminalImpl):
        (JSC::DFG::ByteCodeParser::flush):
        (JSC::DFG::ByteCodeParser::flushForTerminal):
        (JSC::DFG::ByteCodeParser::parse):

2018-01-11  Saam Barati  <sbarati@apple.com>

        JITMathIC code in the FTL is wrong when code gets duplicated
        https://bugs.webkit.org/show_bug.cgi?id=181525
        <rdar://problem/36351993>

        Reviewed by Michael Saboff and Keith Miller.

        B3/Air may duplicate code for various reasons. Patchpoint generators inside
        FTLLower must be aware that they can be called multiple times because of this.
        The patchpoint for math ICs was not aware of this, and shared state amongst
        all invocations of the patchpoint's generator. This patch fixes this bug so
        that each invocation of the patchpoint's generator gets a unique math IC.

        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::addMathIC):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
        (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
        (JSC::FTL::DFG::LowerDFGToB3::compileMathIC): Deleted.
        * jit/JITMathIC.h:
        (JSC::isProfileEmpty):

2018-01-11  Michael Saboff  <msaboff@apple.com>

        Ensure there are no unsafe uses of MacroAssemblerARM64::dataTempRegister
        https://bugs.webkit.org/show_bug.cgi?id=181512

        Reviewed by Saam Barati.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::abortWithReason):
        (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):
        All current uses of dataTempRegister in these functions are safe, but it makes sense to
        fix them in case they might be used elsewhere.

2018-01-04  Filip Pizlo  <fpizlo@apple.com>

        CodeBlocks should be in IsoSubspaces
        https://bugs.webkit.org/show_bug.cgi?id=180884

        Reviewed by Saam Barati.
        
        This moves CodeBlocks into IsoSubspaces. Doing so means that we no longer need to have the
        special CodeBlockSet HashSets of new and old CodeBlocks. We also no longer use
        WeakReferenceHarvester or UnconditionalFinalizer. Instead:
        
        - Code block sweeping is now just eager sweeping. This means that it automatically takes
          advantage of our unswept set, which roughly corresponds to what CodeBlockSet used to use
          its eden set for.
        
        - Those idea of Executable "weakly visiting" the CodeBlock is replaced by Executable
          marking a ExecutableToCodeBlockEdge object. That object being marked corresponds to what
          we used to call CodeBlock "having been weakly visited". This means that CodeBlockSet no
          longer has to clear the set of weakly visited code blocks. This also means that
          determining CodeBlock liveness, propagating CodeBlock transitions, and jettisoning
          CodeBlocks during GC are now the edge's job. The edge is also in an IsoSubspace and it
          has IsoCellSets to tell us which edges have output constraints (what we used to call
          CodeBlock's weak reference harvester) and which have unconditional finalizers.
        
        - CodeBlock now uses an IsoCellSet to tell if it has an unconditional finalizer.
        
        - CodeBlockSet still exists!  It has one unified HashSet of CodeBlocks that we use to
          handle requests from the sampler, debugger, and other facilities. They may want to ask
          if some pointer corresponds to a CodeBlock during stages of execution during which the
          GC is unable to answer isLive() queries. The trickiest is the sampling profiler thread.
          There is no way that the GC's isLive could tell us of a CodeBlock that had already been
          allocated has now been full constructed.
        
        Rolling this back in because it was rolled out by mistake. There was a flaky crash that was
        happening before and after this change, but we misread the revision numbers at first and
        thought that this was the cause.
        
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::finishCreationCommon):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::stronglyVisitStrongReferences):
        (JSC::CodeBlock::hasInstalledVMTrapBreakpoints const):
        (JSC::CodeBlock::installVMTrapBreakpoints):
        (JSC::CodeBlock::dumpMathICStats):
        (JSC::CodeBlock::visitWeakly): Deleted.
        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::subspaceFor):
        (JSC::CodeBlock::ownerEdge const):
        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
        * bytecode/EvalCodeBlock.h:
        (JSC::EvalCodeBlock::create): Deleted.
        (JSC::EvalCodeBlock::createStructure): Deleted.
        (JSC::EvalCodeBlock::variable): Deleted.
        (JSC::EvalCodeBlock::numVariables): Deleted.
        (JSC::EvalCodeBlock::functionHoistingCandidate): Deleted.
        (JSC::EvalCodeBlock::numFunctionHoistingCandidates): Deleted.
        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock const): Deleted.
        * bytecode/ExecutableToCodeBlockEdge.cpp: Added.
        (JSC::ExecutableToCodeBlockEdge::createStructure):
        (JSC::ExecutableToCodeBlockEdge::create):
        (JSC::ExecutableToCodeBlockEdge::visitChildren):
        (JSC::ExecutableToCodeBlockEdge::visitOutputConstraints):
        (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
        (JSC::ExecutableToCodeBlockEdge::activate):
        (JSC::ExecutableToCodeBlockEdge::deactivate):
        (JSC::ExecutableToCodeBlockEdge::deactivateAndUnwrap):
        (JSC::ExecutableToCodeBlockEdge::wrap):
        (JSC::ExecutableToCodeBlockEdge::wrapAndActivate):
        (JSC::ExecutableToCodeBlockEdge::ExecutableToCodeBlockEdge):
        (JSC::ExecutableToCodeBlockEdge::runConstraint):
        * bytecode/ExecutableToCodeBlockEdge.h: Added.
        (JSC::ExecutableToCodeBlockEdge::subspaceFor):
        (JSC::ExecutableToCodeBlockEdge::codeBlock const):
        (JSC::ExecutableToCodeBlockEdge::unwrap):
        * bytecode/FunctionCodeBlock.h:
        (JSC::FunctionCodeBlock::subspaceFor):
        (JSC::FunctionCodeBlock::createStructure):
        * bytecode/ModuleProgramCodeBlock.h:
        (JSC::ModuleProgramCodeBlock::create): Deleted.
        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
        * bytecode/ProgramCodeBlock.h:
        (JSC::ProgramCodeBlock::create): Deleted.
        (JSC::ProgramCodeBlock::createStructure): Deleted.
        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
        * debugger/Debugger.cpp:
        (JSC::Debugger::SetSteppingModeFunctor::operator() const):
        (JSC::Debugger::ToggleBreakpointFunctor::operator() const):
        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::operator() const):
        (JSC::Debugger::ClearDebuggerRequestsFunctor::operator() const):
        * heap/CodeBlockSet.cpp:
        (JSC::CodeBlockSet::contains):
        (JSC::CodeBlockSet::dump const):
        (JSC::CodeBlockSet::add):
        (JSC::CodeBlockSet::remove):
        (JSC::CodeBlockSet::promoteYoungCodeBlocks): Deleted.
        (JSC::CodeBlockSet::clearMarksForFullCollection): Deleted.
        (JSC::CodeBlockSet::lastChanceToFinalize): Deleted.
        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced): Deleted.
        * heap/CodeBlockSet.h:
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterate):
        (JSC::CodeBlockSet::iterateViaSubspaces):
        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::genericAddPointer):
        (JSC::DummyMarkHook::markKnownJSCell):
        (JSC::CompositeMarkHook::mark):
        (JSC::CompositeMarkHook::markKnownJSCell):
        * heap/ConservativeRoots.h:
        * heap/Heap.cpp:
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::finalizeMarkedUnconditionalFinalizers):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::beginMarking):
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepInFinalize):
        (JSC::Heap::forEachCodeBlockImpl):
        (JSC::Heap::forEachCodeBlockIgnoringJITPlansImpl):
        (JSC::Heap::addCoreConstraints):
        (JSC::Heap::finalizeUnconditionalFinalizersInIsoSubspace): Deleted.
        * heap/Heap.h:
        * heap/HeapCell.h:
        * heap/HeapCellInlines.h:
        (JSC::HeapCell::subspace const):
        * heap/HeapInlines.h:
        (JSC::Heap::forEachCodeBlock):
        (JSC::Heap::forEachCodeBlockIgnoringJITPlans):
        * heap/HeapUtil.h:
        (JSC::HeapUtil::findGCObjectPointersForMarking):
        * heap/IsoCellSet.cpp:
        (JSC::IsoCellSet::parallelNotEmptyMarkedBlockSource):
        * heap/IsoCellSet.h:
        * heap/IsoCellSetInlines.h:
        (JSC::IsoCellSet::forEachMarkedCellInParallel):
        (JSC::IsoCellSet::forEachLiveCell):
        * heap/LargeAllocation.h:
        (JSC::LargeAllocation::subspace const):
        * heap/MarkStackMergingConstraint.cpp:
        (JSC::MarkStackMergingConstraint::executeImpl):
        * heap/MarkStackMergingConstraint.h:
        * heap/MarkedAllocator.cpp:
        (JSC::MarkedAllocator::parallelNotEmptyBlockSource):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::didAddToAllocator):
        (JSC::MarkedBlock::Handle::didRemoveFromAllocator):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::subspace const):
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::Handle::forEachLiveCell):
        * heap/MarkedSpaceInlines.h:
        (JSC::MarkedSpace::forEachLiveCell):
        * heap/MarkingConstraint.cpp:
        (JSC::MarkingConstraint::execute):
        (JSC::MarkingConstraint::doParallelWork):
        (JSC::MarkingConstraint::finishParallelWork): Deleted.
        (JSC::MarkingConstraint::doParallelWorkImpl): Deleted.
        (JSC::MarkingConstraint::finishParallelWorkImpl): Deleted.
        * heap/MarkingConstraint.h:
        * heap/MarkingConstraintSet.cpp:
        (JSC::MarkingConstraintSet::add):
        * heap/MarkingConstraintSet.h:
        (JSC::MarkingConstraintSet::add):
        * heap/MarkingConstraintSolver.cpp:
        (JSC::MarkingConstraintSolver::execute):
        (JSC::MarkingConstraintSolver::addParallelTask):
        (JSC::MarkingConstraintSolver::runExecutionThread):
        (JSC::MarkingConstraintSolver::didExecute): Deleted.
        * heap/MarkingConstraintSolver.h:
        (JSC::MarkingConstraintSolver::TaskWithConstraint::TaskWithConstraint):
        (JSC::MarkingConstraintSolver::TaskWithConstraint::operator== const):
        * heap/SimpleMarkingConstraint.cpp:
        (JSC::SimpleMarkingConstraint::SimpleMarkingConstraint):
        (JSC::SimpleMarkingConstraint::executeImpl):
        * heap/SimpleMarkingConstraint.h:
        (JSC::SimpleMarkingConstraint::SimpleMarkingConstraint):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::addParallelConstraintTask):
        * heap/SlotVisitor.h:
        * heap/Subspace.cpp:
        (JSC::Subspace::sweep):
        * heap/Subspace.h:
        * heap/SubspaceInlines.h:
        (JSC::Subspace::forEachLiveCell):
        * llint/LowLevelInterpreter.asm:
        * runtime/EvalExecutable.cpp:
        (JSC::EvalExecutable::visitChildren):
        * runtime/EvalExecutable.h:
        (JSC::EvalExecutable::codeBlock):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::baselineCodeBlockFor):
        (JSC::FunctionExecutable::visitChildren):
        * runtime/FunctionExecutable.h:
        * runtime/JSType.h:
        * runtime/ModuleProgramExecutable.cpp:
        (JSC::ModuleProgramExecutable::visitChildren):
        * runtime/ModuleProgramExecutable.h:
        * runtime/ProgramExecutable.cpp:
        (JSC::ProgramExecutable::visitChildren):
        * runtime/ProgramExecutable.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::installCode):
        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::SpaceAndFinalizerSet::SpaceAndFinalizerSet):
        (JSC::VM::SpaceAndFinalizerSet::finalizerSetFor):
        (JSC::VM::forEachCodeBlockSpace):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::handleTraps):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::codeBlockForMachinePC):
        (JSC::VMInspector::isValidCodeBlock):

2018-01-11  Michael Saboff  <msaboff@apple.com>

        Add a DOM gadget for Spectre testing
        https://bugs.webkit.org/show_bug.cgi?id=181351

        Reviewed by Ryosuke Niwa.

        * runtime/Options.h:

2018-01-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG][FTL] regExpMatchFast should be handled
        https://bugs.webkit.org/show_bug.cgi?id=180988

        Reviewed by Mark Lam.

        RegExp.prototype.@@match has a fast path, @regExpMatchFast. This patch annotates this function
        with RegExpMatchFastIntrinsic, and introduces RegExpMatch DFG node. This paves the way to
        make NewRegexp PhantomNewRegexp if it is not used except for setting/getting its lastIndex property.

        To improve RegExp.prototype.@@match's performance more, we make this builtin function small by moving
        slow path part to `@matchSlow()` private function.

        It improves SixSpeed regex-u.{es5,es6} largely since they stress String.prototype.match, which calls
        this regExpMatchFast function.

                                 baseline                  patched

        regex-u.es5          55.3835+-6.3002     ^     36.2431+-2.0797        ^ definitely 1.5281x faster
        regex-u.es6         110.4624+-6.2896     ^     94.1012+-7.2433        ^ definitely 1.1739x faster

        * builtins/RegExpPrototype.js:
        (globalPrivate.matchSlow):
        (overriddenName.string_appeared_here.match):
        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGDoesGC.cpp:
        (JSC::DFG::doesGC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasHeapPrediction):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSafeToExecute.h:
        (JSC::DFG::safeToExecute):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileRegExpMatch):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLCapabilities.cpp:
        (JSC::FTL::canCompile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpMatch):
        * runtime/Intrinsic.cpp:
        (JSC::intrinsicName):
        * runtime/Intrinsic.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/RegExpPrototype.cpp:
        (JSC::regExpProtoFuncMatchFast):

2018-01-11  Saam Barati  <sbarati@apple.com>

        Our for-in caching is wrong when we add indexed properties on things in the prototype chain
        https://bugs.webkit.org/show_bug.cgi?id=181508

        Reviewed by Yusuke Suzuki.

        Our for-in caching would cache structure chains that had prototypes with
        indexed properties. Clearly this is wrong. This caching breaks when a prototype
        adds new indexed properties. We would continue to enumerate the old cached
        state of properties, and not include the new indexed properties.
        
        The old code used to prevent caching only if the base structure had
        indexed properties. This patch extends it to prevent caching if the
        base, or any structure in the prototype chain, has indexed properties.

        * runtime/Structure.cpp:
        (JSC::Structure::canCachePropertyNameEnumerator const):

2018-01-10  JF Bastien  <jfbastien@apple.com>

        Poison small JSObject derivatives which only contain pointers
        https://bugs.webkit.org/show_bug.cgi?id=181483
        <rdar://problem/36407127>

        Reviewed by Mark Lam.

        I wrote a script that finds interesting things to poison or
        generally harden. These stood out because they derive from
        JSObject and only contain a few pointer or pointer-like fields,
        and could therefore just be poisoned. This also requires some
        template "improvements" to our poisoning machinery. Worth noting
        is that I'm making PoisonedUniquePtr move-assignable and
        move-constructible from unique_ptr, which makes it a better
        drop-in replacement because we don't need to use
        makePoisonedUniquePtr. This means function-locals can be
        unique_ptr and get the nice RAII pattern, and once the function is
        done you can just move to the class' PoisonedUniquePtr without
        worrying.

        * API/JSAPIWrapperObject.h:
        (JSC::JSAPIWrapperObject::wrappedObject):
        * API/JSAPIWrapperObject.mm:
        (JSC::JSAPIWrapperObject::JSAPIWrapperObject):
        * API/JSCallbackObject.h:
        * runtime/ArrayPrototype.h:
        * runtime/DateInstance.h:
        * runtime/JSArrayBuffer.cpp:
        (JSC::JSArrayBuffer::finishCreation):
        (JSC::JSArrayBuffer::isShared const):
        (JSC::JSArrayBuffer::sharingMode const):
        * runtime/JSArrayBuffer.h:
        * runtime/JSCPoison.h:

2018-01-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r226667 and r226673.
        https://bugs.webkit.org/show_bug.cgi?id=181488

        This caused a flaky crash. (Requested by mlewis13 on #webkit).

        Reverted changesets:

        "CodeBlocks should be in IsoSubspaces"
        https://bugs.webkit.org/show_bug.cgi?id=180884
        https://trac.webkit.org/changeset/226667

        "REGRESSION (r226667): CodeBlocks should be in IsoSubspaces"
        https://bugs.webkit.org/show_bug.cgi?id=180884
        https://trac.webkit.org/changeset/226673

2018-01-09  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r226667): CodeBlocks should be in IsoSubspaces
        <https://bugs.webkit.org/show_bug.cgi?id=180884>

        Fixes the following build error:

            heap/Heap.cpp:2708:10: error: lambda capture 'this' is not used [-Werror,-Wunused-lambda-capture]

        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints): Remove 'this' from lambda to
        fix the build.

2018-01-09  Keith Miller  <keith_miller@apple.com>

        and32 with an Address source on ARM64 did not invalidate dataTempRegister
        https://bugs.webkit.org/show_bug.cgi?id=181467

        Reviewed by Michael Saboff.

        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::and32):

2018-01-04  Filip Pizlo  <fpizlo@apple.com>

        CodeBlocks should be in IsoSubspaces
        https://bugs.webkit.org/show_bug.cgi?id=180884

        Reviewed by Saam Barati.
        
        This moves CodeBlocks into IsoSubspaces. Doing so means that we no longer need to have the
        special CodeBlockSet HashSets of new and old CodeBlocks. We also no longer use
        WeakReferenceHarvester or UnconditionalFinalizer. Instead:
        
        - Code block sweeping is now just eager sweeping. This means that it automatically takes
          advantage of our unswept set, which roughly corresponds to what CodeBlockSet used to use
          its eden set for.
        
        - Those idea of Executable "weakly visiting" the CodeBlock is replaced by Executable
          marking a ExecutableToCodeBlockEdge object. That object being marked corresponds to what
          we used to call CodeBlock "having been weakly visited". This means that CodeBlockSet no
          longer has to clear the set of weakly visited code blocks. This also means that
          determining CodeBlock liveness, propagating CodeBlock transitions, and jettisoning
          CodeBlocks during GC are now the edge's job. The edge is also in an IsoSubspace and it
          has IsoCellSets to tell us which edges have output constraints (what we used to call
          CodeBlock's weak reference harvester) and which have unconditional finalizers.
        
        - CodeBlock now uses an IsoCellSet to tell if it has an unconditional finalizer.
        
        - CodeBlockSet still exists!  It has one unified HashSet of CodeBlocks that we use to
          handle requests from the sampler, debugger, and other facilities. They may want to ask
          if some pointer corresponds to a CodeBlock during stages of execution during which the
          GC is unable to answer isLive() queries. The trickiest is the sampling profiler thread.
          There is no way that the GC's isLive could tell us of a CodeBlock that had already been
          allocated has now been full constructed.
        
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::finishCreationCommon):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::determineLiveness):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::stronglyVisitStrongReferences):
        (JSC::CodeBlock::hasInstalledVMTrapBreakpoints const):
        (JSC::CodeBlock::installVMTrapBreakpoints):
        (JSC::CodeBlock::dumpMathICStats):
        (JSC::CodeBlock::visitWeakly): Deleted.
        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::subspaceFor):
        (JSC::CodeBlock::ownerEdge const):
        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
        * bytecode/EvalCodeBlock.h:
        (JSC::EvalCodeBlock::create): Deleted.
        (JSC::EvalCodeBlock::createStructure): Deleted.
        (JSC::EvalCodeBlock::variable): Deleted.
        (JSC::EvalCodeBlock::numVariables): Deleted.
        (JSC::EvalCodeBlock::functionHoistingCandidate): Deleted.
        (JSC::EvalCodeBlock::numFunctionHoistingCandidates): Deleted.
        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock const): Deleted.
        * bytecode/ExecutableToCodeBlockEdge.cpp: Added.
        (JSC::ExecutableToCodeBlockEdge::createStructure):
        (JSC::ExecutableToCodeBlockEdge::create):
        (JSC::ExecutableToCodeBlockEdge::visitChildren):
        (JSC::ExecutableToCodeBlockEdge::visitOutputConstraints):
        (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
        (JSC::ExecutableToCodeBlockEdge::activate):
        (JSC::ExecutableToCodeBlockEdge::deactivate):
        (JSC::ExecutableToCodeBlockEdge::deactivateAndUnwrap):
        (JSC::ExecutableToCodeBlockEdge::wrap):
        (JSC::ExecutableToCodeBlockEdge::wrapAndActivate):
        (JSC::ExecutableToCodeBlockEdge::ExecutableToCodeBlockEdge):
        (JSC::ExecutableToCodeBlockEdge::runConstraint):
        * bytecode/ExecutableToCodeBlockEdge.h: Added.
        (JSC::ExecutableToCodeBlockEdge::subspaceFor):
        (JSC::ExecutableToCodeBlockEdge::codeBlock const):
        (JSC::ExecutableToCodeBlockEdge::unwrap):
        * bytecode/FunctionCodeBlock.h:
        (JSC::FunctionCodeBlock::subspaceFor):
        (JSC::FunctionCodeBlock::createStructure):
        * bytecode/ModuleProgramCodeBlock.h:
        (JSC::ModuleProgramCodeBlock::create): Deleted.
        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
        * bytecode/ProgramCodeBlock.h:
        (JSC::ProgramCodeBlock::create): Deleted.
        (JSC::ProgramCodeBlock::createStructure): Deleted.
        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
        * debugger/Debugger.cpp:
        (JSC::Debugger::SetSteppingModeFunctor::operator() const):
        (JSC::Debugger::ToggleBreakpointFunctor::operator() const):
        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::operator() const):
        (JSC::Debugger::ClearDebuggerRequestsFunctor::operator() const):
        * heap/CodeBlockSet.cpp:
        (JSC::CodeBlockSet::contains):
        (JSC::CodeBlockSet::dump const):
        (JSC::CodeBlockSet::add):
        (JSC::CodeBlockSet::remove):
        (JSC::CodeBlockSet::promoteYoungCodeBlocks): Deleted.
        (JSC::CodeBlockSet::clearMarksForFullCollection): Deleted.
        (JSC::CodeBlockSet::lastChanceToFinalize): Deleted.
        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced): Deleted.
        * heap/CodeBlockSet.h:
        * heap/CodeBlockSetInlines.h:
        (JSC::CodeBlockSet::iterate):
        (JSC::CodeBlockSet::iterateViaSubspaces):
        * heap/ConservativeRoots.cpp:
        (JSC::ConservativeRoots::genericAddPointer):
        (JSC::DummyMarkHook::markKnownJSCell):
        (JSC::CompositeMarkHook::mark):
        (JSC::CompositeMarkHook::markKnownJSCell):
        * heap/ConservativeRoots.h:
        * heap/Heap.cpp:
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::finalizeMarkedUnconditionalFinalizers):
        (JSC::Heap::finalizeUnconditionalFinalizers):
        (JSC::Heap::beginMarking):
        (JSC::Heap::deleteUnmarkedCompiledCode):
        (JSC::Heap::sweepInFinalize):
        (JSC::Heap::forEachCodeBlockImpl):
        (JSC::Heap::forEachCodeBlockIgnoringJITPlansImpl):
        (JSC::Heap::addCoreConstraints):
        (JSC::Heap::finalizeUnconditionalFinalizersInIsoSubspace): Deleted.
        * heap/Heap.h:
        * heap/HeapCell.h:
        * heap/HeapCellInlines.h:
        (JSC::HeapCell::subspace const):
        * heap/HeapInlines.h:
        (JSC::Heap::forEachCodeBlock):
        (JSC::Heap::forEachCodeBlockIgnoringJITPlans):
        * heap/HeapUtil.h:
        (JSC::HeapUtil::findGCObjectPointersForMarking):
        * heap/IsoCellSet.cpp:
        (JSC::IsoCellSet::parallelNotEmptyMarkedBlockSource):
        * heap/IsoCellSet.h:
        * heap/IsoCellSetInlines.h:
        (JSC::IsoCellSet::forEachMarkedCellInParallel):
        (JSC::IsoCellSet::forEachLiveCell):
        * heap/LargeAllocation.h:
        (JSC::LargeAllocation::subspace const):
        * heap/MarkStackMergingConstraint.cpp:
        (JSC::MarkStackMergingConstraint::executeImpl):
        * heap/MarkStackMergingConstraint.h:
        * heap/MarkedAllocator.cpp:
        (JSC::MarkedAllocator::parallelNotEmptyBlockSource):
        * heap/MarkedBlock.cpp:
        (JSC::MarkedBlock::Handle::didAddToAllocator):
        (JSC::MarkedBlock::Handle::didRemoveFromAllocator):
        * heap/MarkedBlock.h:
        (JSC::MarkedBlock::subspace const):
        * heap/MarkedBlockInlines.h:
        (JSC::MarkedBlock::Handle::forEachLiveCell):
        * heap/MarkedSpaceInlines.h:
        (JSC::MarkedSpace::forEachLiveCell):
        * heap/MarkingConstraint.cpp:
        (JSC::MarkingConstraint::execute):
        (JSC::MarkingConstraint::doParallelWork):
        (JSC::MarkingConstraint::finishParallelWork): Deleted.
        (JSC::MarkingConstraint::doParallelWorkImpl): Deleted.
        (JSC::MarkingConstraint::finishParallelWorkImpl): Deleted.
        * heap/MarkingConstraint.h:
        * heap/MarkingConstraintSet.cpp:
        (JSC::MarkingConstraintSet::add):
        * heap/MarkingConstraintSet.h:
        (JSC::MarkingConstraintSet::add):
        * heap/MarkingConstraintSolver.cpp:
        (JSC::MarkingConstraintSolver::execute):
        (JSC::MarkingConstraintSolver::addParallelTask):
        (JSC::MarkingConstraintSolver::runExecutionThread):
        (JSC::MarkingConstraintSolver::didExecute): Deleted.
        * heap/MarkingConstraintSolver.h:
        (JSC::MarkingConstraintSolver::TaskWithConstraint::TaskWithConstraint):
        (JSC::MarkingConstraintSolver::TaskWithConstraint::operator== const):
        * heap/SimpleMarkingConstraint.cpp:
        (JSC::SimpleMarkingConstraint::SimpleMarkingConstraint):
        (JSC::SimpleMarkingConstraint::executeImpl):
        * heap/SimpleMarkingConstraint.h:
        (JSC::SimpleMarkingConstraint::SimpleMarkingConstraint):
        * heap/SlotVisitor.cpp:
        (JSC::SlotVisitor::addParallelConstraintTask):
        * heap/SlotVisitor.h:
        * heap/Subspace.cpp:
        (JSC::Subspace::sweep):
        * heap/Subspace.h:
        * heap/SubspaceInlines.h:
        (JSC::Subspace::forEachLiveCell):
        * llint/LowLevelInterpreter.asm:
        * runtime/EvalExecutable.cpp:
        (JSC::EvalExecutable::visitChildren):
        * runtime/EvalExecutable.h:
        (JSC::EvalExecutable::codeBlock):
        * runtime/FunctionExecutable.cpp:
        (JSC::FunctionExecutable::baselineCodeBlockFor):
        (JSC::FunctionExecutable::visitChildren):
        * runtime/FunctionExecutable.h:
        * runtime/JSType.h:
        * runtime/ModuleProgramExecutable.cpp:
        (JSC::ModuleProgramExecutable::visitChildren):
        * runtime/ModuleProgramExecutable.h:
        * runtime/ProgramExecutable.cpp:
        (JSC::ProgramExecutable::visitChildren):
        * runtime/ProgramExecutable.h:
        * runtime/ScriptExecutable.cpp:
        (JSC::ScriptExecutable::installCode):
        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
        * runtime/VM.cpp:
        (JSC::VM::VM):
        * runtime/VM.h:
        (JSC::VM::SpaceAndFinalizerSet::SpaceAndFinalizerSet):
        (JSC::VM::SpaceAndFinalizerSet::finalizerSetFor):
        (JSC::VM::forEachCodeBlockSpace):
        * runtime/VMTraps.cpp:
        (JSC::VMTraps::handleTraps):
        * tools/VMInspector.cpp:
        (JSC::VMInspector::codeBlockForMachinePC):
        (JSC::VMInspector::isValidCodeBlock):

2018-01-09  Michael Saboff  <msaboff@apple.com>

        Unreviewed, rolling out r226600 and r226603
        https://bugs.webkit.org/show_bug.cgi?id=181351

        Add a DOM gadget for Spectre testing

        * runtime/Options.h:

2018-01-09  Saam Barati  <sbarati@apple.com>

        Reduce graph size by replacing terminal nodes in blocks that have a ForceOSRExit with Unreachable
        https://bugs.webkit.org/show_bug.cgi?id=181409

        Reviewed by Keith Miller.

        When I was looking at profiler data for Speedometer, I noticed that one of
        the hottest functions in Speedometer is around 1100 bytecode operations long.
        Only about 100 of those bytecode ops ever execute. However, we ended up
        spending a lot of time compiling basic blocks that never executed. We often
        plant ForceOSRExit nodes when we parse bytecodes that have a null value profile.
        This is the case when such a node never executes.
        
        This patch makes it so that anytime a block has a ForceOSRExit, we replace its
        terminal node with an Unreachable node (and remove all nodes after the
        ForceOSRExit). This will cut down on graph size when such a block dominates
        other blocks in the CFG. This allows us to get rid of huge chunks of the CFG
        in certain programs. When doing this transformation, we also insert
        Flushes/PhantomLocals to ensure we can recover values that are bytecode
        live-in to the ForceOSRExit.
        
        Using ForceOSRExit as the signal for this is a bit of a hack. It definitely
        does not get rid of all the CFG that it could. If we decide it's worth
        it, we could use additional inputs into this mechanism. For example, we could
        profile if a basic block ever executes inside the LLInt/Baseline, and
        remove parts of the CFG based on that.
        
        When running Speedometer with the concurrent JIT turned off, this patch
        improves DFG/FTL compile times by around 5%.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::addToGraph):
        (JSC::DFG::ByteCodeParser::parse):

2018-01-09  Mark Lam  <mark.lam@apple.com>

        ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
        https://bugs.webkit.org/show_bug.cgi?id=181388
        <rdar://problem/36349351>

        Reviewed by Saam Barati.

        When there are duplicate setters or getters, we may end up overwriting a getter
        with a setter, or vice versa.  This patch adds tracking for getters/setters that
        have been overwritten with duplicates and ignore them.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::PropertyListNode::emitBytecode):
        * parser/NodeConstructors.h:
        (JSC::PropertyNode::PropertyNode):
        * parser/Nodes.h:
        (JSC::PropertyNode::isOverriddenByDuplicate const):
        (JSC::PropertyNode::setIsOverriddenByDuplicate):

2018-01-08  Zan Dobersek  <zdobersek@igalia.com>

        REGRESSION(r225913): about 30 JSC test failures on ARMv7
        https://bugs.webkit.org/show_bug.cgi?id=181162
        <rdar://problem/36261349>

        Unreviewed follow-up to r226298. Enable the fast case in
        DFG::SpeculativeJIT::compileArraySlice() for any 64-bit platform,
        assuming in good faith that enough GP registers are available on any
        such configuration. The accompanying comment is adjusted to describe
        this assumption.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileArraySlice):

2018-01-08  JF Bastien  <jfbastien@apple.com>

        WebAssembly: mask indexed accesses to Table
        https://bugs.webkit.org/show_bug.cgi?id=181412
        <rdar://problem/36363236>

        Reviewed by Saam Barati.

        WebAssembly Table indexed accesses are user-controlled and
        bounds-checked. Force allocations of Table data to be a
        power-of-two, and explicitly mask accesses after bounds-check
        branches.

        Rename misleading usage of "size" when "length" of a Table was
        intended.

        Rename the Spectre option from "disable" to "enable".

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        * runtime/Options.h:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmTable.cpp:
        (JSC::Wasm::Table::allocatedLength):
        (JSC::Wasm::Table::setLength):
        (JSC::Wasm::Table::create):
        (JSC::Wasm::Table::Table):
        (JSC::Wasm::Table::grow):
        (JSC::Wasm::Table::clearFunction):
        (JSC::Wasm::Table::setFunction):
        * wasm/WasmTable.h:
        (JSC::Wasm::Table::length const):
        (JSC::Wasm::Table::offsetOfLength):
        (JSC::Wasm::Table::offsetOfMask):
        (JSC::Wasm::Table::mask const):
        (JSC::Wasm::Table::isValidLength):
        * wasm/js/JSWebAssemblyInstance.cpp:
        (JSC::JSWebAssemblyInstance::create):
        * wasm/js/JSWebAssemblyTable.cpp:
        (JSC::JSWebAssemblyTable::JSWebAssemblyTable):
        (JSC::JSWebAssemblyTable::visitChildren):
        (JSC::JSWebAssemblyTable::grow):
        (JSC::JSWebAssemblyTable::getFunction):
        (JSC::JSWebAssemblyTable::clearFunction):
        (JSC::JSWebAssemblyTable::setFunction):
        * wasm/js/JSWebAssemblyTable.h:
        (JSC::JSWebAssemblyTable::isValidLength):
        (JSC::JSWebAssemblyTable::length const):
        (JSC::JSWebAssemblyTable::allocatedLength const):
        * wasm/js/WebAssemblyModuleRecord.cpp:
        (JSC::WebAssemblyModuleRecord::evaluate):
        * wasm/js/WebAssemblyTablePrototype.cpp:
        (JSC::webAssemblyTableProtoFuncLength):
        (JSC::webAssemblyTableProtoFuncGrow):
        (JSC::webAssemblyTableProtoFuncGet):
        (JSC::webAssemblyTableProtoFuncSet):

2018-01-08  Michael Saboff  <msaboff@apple.com>

        Add a DOM gadget for Spectre testing
        https://bugs.webkit.org/show_bug.cgi?id=181351

        Reviewed by Michael Saboff.

        Added a new JSC::Option named enableSpectreGadgets to enable any gadgets added to test
        Spectre mitigations.

        * runtime/Options.h:

2018-01-08  Mark Lam  <mark.lam@apple.com>

        Rename CodeBlock::m_vm to CodeBlock::m_poisonedVM.
        https://bugs.webkit.org/show_bug.cgi?id=181403
        <rdar://problem/36359789>

        Rubber-stamped by JF Bastien.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::jettison):
        (JSC::CodeBlock::predictedMachineCodeSize):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::vm const):
        (JSC::CodeBlock::addConstant):
        (JSC::CodeBlock::heap const):
        (JSC::CodeBlock::replaceConstant):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:

2018-01-07  Mark Lam  <mark.lam@apple.com>

        Apply poisoning to more pointers in JSC.
        https://bugs.webkit.org/show_bug.cgi?id=181096
        <rdar://problem/36182970>

        Reviewed by JF Bastien.

        * assembler/MacroAssembler.h:
        (JSC::MacroAssembler::xorPtr):
        * assembler/MacroAssemblerARM64.h:
        (JSC::MacroAssemblerARM64::xor64):
        * assembler/MacroAssemblerX86_64.h:
        (JSC::MacroAssemblerX86_64::xor64):
        - Add xorPtr implementation.

        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::inferredName const):
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::finishCreation):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::setConstantRegisters):
        (JSC::CodeBlock::visitWeakly):
        (JSC::CodeBlock::visitChildren):
        (JSC::CodeBlock::propagateTransitions):
        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
        (JSC::CodeBlock::finalizeLLIntInlineCaches):
        (JSC::CodeBlock::finalizeBaselineJITInlineCaches):
        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
        (JSC::CodeBlock::jettison):
        (JSC::CodeBlock::predictedMachineCodeSize):
        (JSC::CodeBlock::findPC):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::UnconditionalFinalizer::UnconditionalFinalizer):
        (JSC::CodeBlock::WeakReferenceHarvester::WeakReferenceHarvester):
        (JSC::CodeBlock::stubInfoBegin):
        (JSC::CodeBlock::stubInfoEnd):
        (JSC::CodeBlock::callLinkInfosBegin):
        (JSC::CodeBlock::callLinkInfosEnd):
        (JSC::CodeBlock::instructions):
        (JSC::CodeBlock::instructions const):
        (JSC::CodeBlock::vm const):
        * dfg/DFGOSRExitCompilerCommon.h:
        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
        * jit/JIT.h:
        * llint/LLIntOfflineAsmConfig.h:
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter64.asm:
        * parser/UnlinkedSourceCode.h:
        * runtime/JSCPoison.h:
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        * runtime/JSGlobalObject.h:
        * runtime/JSScriptFetchParameters.h:
        * runtime/JSScriptFetcher.h:
        * runtime/StructureTransitionTable.h:
        * wasm/js/JSWebAssemblyCodeBlock.cpp:
        (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
        (JSC::JSWebAssemblyCodeBlock::visitChildren):
        (JSC::JSWebAssemblyCodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
        * wasm/js/JSWebAssemblyCodeBlock.h:

2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>

        Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
        https://bugs.webkit.org/show_bug.cgi?id=181321

        Reviewed by Saam Barati.

        According to ECMA262 16.2[1], functions created using the bind method must not have
        "caller" and "arguments" own properties.

        [1]: https://tc39.github.io/ecma262/#sec-forbidden-extensions

        * runtime/JSBoundFunction.cpp:
        (JSC::JSBoundFunction::finishCreation):

2018-01-05  JF Bastien  <jfbastien@apple.com>

        WebAssembly: poison JS object's secrets
        https://bugs.webkit.org/show_bug.cgi?id=181339
        <rdar://problem/36325001>

        Reviewed by Mark Lam.

        Separating WebAssembly's JS objects from their non-JS
        implementation means that all interesting information lives
        outside of the JS object itself. This patch poisons each JS
        object's pointer to non-JS implementation using the poisoning
        mechanism and a unique key per JS object type origin.

        * runtime/JSCPoison.h:
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper): JS -> wasm stores the JS
        object in a stack slot when fast TLS is disabled. This requires
        that we unpoison the Wasm::Instance.
        * wasm/js/JSWebAssemblyCodeBlock.h:
        * wasm/js/JSWebAssemblyInstance.h:
        (JSC::JSWebAssemblyInstance::offsetOfPoisonedInstance): renamed to
        be explicit that the pointer is poisoned.
        * wasm/js/JSWebAssemblyMemory.h:
        * wasm/js/JSWebAssemblyModule.h:
        * wasm/js/JSWebAssemblyTable.h:

2018-01-05  Michael Saboff  <msaboff@apple.com>

        Add ability to disable indexed property masking for testing
        https://bugs.webkit.org/show_bug.cgi?id=181350

        Reviewed by Keith Miller.

        Made the masking of indexed properties runtime controllable via a new JSC::Option
        named disableSpectreMitigations.  This is done to test the efficacy of that mitigation.

        The new option has a generic name as it will probably be used to disable future mitigations.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
        (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
        (JSC::FTL::DFG::LowerDFGToB3::maskedIndex):
        (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
        * jit/JIT.cpp:
        (JSC::JIT::JIT):
        * jit/JIT.h:
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitDoubleLoad):
        (JSC::JIT::emitContiguousLoad):
        (JSC::JIT::emitArrayStorageLoad):
        * runtime/Options.h:
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):

2018-01-05  Michael Saboff  <msaboff@apple.com>

        Allow JSC Config Files to set Restricted Options
        https://bugs.webkit.org/show_bug.cgi?id=181352

        Reviewed by Mark Lam.

        * runtime/ConfigFile.cpp:
        (JSC::ConfigFile::parse):

2018-01-04  Keith Miller  <keith_miller@apple.com>

        TypedArrays and Wasm should use index masking.
        https://bugs.webkit.org/show_bug.cgi?id=181313

        Reviewed by Michael Saboff.

        We should have index masking for our TypedArray code in the
        DFG/FTL and for Wasm when doing bounds checking. Index masking for
        Wasm is added to the WasmBoundsCheckValue. Since we don't CSE any
        WasmBoundsCheckValues we don't need to worry about combining a
        bounds check for a load and a store. I went with fusing the
        pointer masking in the WasmBoundsCheckValue since it should reduce
        additional compiler overhead.

        * b3/B3LowerToAir.cpp:
        * b3/B3Validate.cpp:
        * b3/B3WasmBoundsCheckValue.cpp:
        (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue):
        (JSC::B3::WasmBoundsCheckValue::dumpMeta const):
        * b3/B3WasmBoundsCheckValue.h:
        (JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const):
        * b3/air/AirCustom.h:
        (JSC::B3::Air::WasmBoundsCheckCustom::generate):
        * b3/testb3.cpp:
        (JSC::B3::testWasmBoundsCheck):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
        (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
        (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
        (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emitIntTypedArrayGetByVal):
        * runtime/Butterfly.h:
        (JSC::Butterfly::computeIndexingMask const):
        (JSC::Butterfly::computeIndexingMaskForVectorLength): Deleted.
        * runtime/JSArrayBufferView.cpp:
        (JSC::JSArrayBufferView::JSArrayBufferView):
        * wasm/WasmB3IRGenerator.cpp:
        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
        (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
        (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
        (JSC::Wasm::B3IRGenerator::load):
        (JSC::Wasm::B3IRGenerator::store):
        (JSC::Wasm::B3IRGenerator::addCallIndirect):
        * wasm/WasmBinding.cpp:
        (JSC::Wasm::wasmToWasm):
        * wasm/WasmMemory.cpp:
        (JSC::Wasm::Memory::Memory):
        (JSC::Wasm::Memory::grow):
        * wasm/WasmMemory.h:
        (JSC::Wasm::Memory::offsetOfIndexingMask):
        * wasm/WasmMemoryInformation.cpp:
        (JSC::Wasm::PinnedRegisterInfo::get):
        (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
        * wasm/WasmMemoryInformation.h:
        (JSC::Wasm::PinnedRegisterInfo::toSave const):
        * wasm/js/JSToWasm.cpp:
        (JSC::Wasm::createJSToWasmWrapper):

2018-01-05  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r226434.
        https://bugs.webkit.org/show_bug.cgi?id=181322

        32bit JSC failure in x86 (Requested by yusukesuzuki on
        #webkit).

        Reverted changeset:

        "[DFG] Unify ToNumber implementation in 32bit and 64bit by
        changing 32bit Int32Tag and LowestTag"
        https://bugs.webkit.org/show_bug.cgi?id=181134
        https://trac.webkit.org/changeset/226434

2018-01-04  Devin Rousso  <webkit@devinrousso.com>

        Web Inspector: replace HTMLCanvasElement with CanvasRenderingContext for instrumentation logic
        https://bugs.webkit.org/show_bug.cgi?id=180770

        Reviewed by Joseph Pecoraro.

        * inspector/protocol/Canvas.json:

2018-01-04  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r226405.
        https://bugs.webkit.org/show_bug.cgi?id=181318

        Speculative rollout due to Octane/SplayLatency,Octane/Splay
        regressions (Requested by yusukesuzuki on #webkit).

        Reverted changeset:

        "[JSC] Create parallel SlotVisitors apriori"
        https://bugs.webkit.org/show_bug.cgi?id=180907
        https://trac.webkit.org/changeset/226405

2018-01-04  Saam Barati  <sbarati@apple.com>

        Do value profiling in to_this
        https://bugs.webkit.org/show_bug.cgi?id=181299

        Reviewed by Filip Pizlo.

        This patch adds value profiling to to_this. We use the result of the value
        profiling only for strict mode code when we don't predict that the input is
        of a specific type. This helps when the input is SpecCellOther. Such cells
        might implement a custom ToThis, which can produce an arbitrary result. Before
        this patch, in prediction propagation, we were saying that a ToThis with a
        SpecCellOther input also produced SpecCellOther. However, this is incorrect,
        given that the input may implement ToThis that produces an arbitrary result.
        This is seen inside Speedometer. This patch fixes an OSR exit loop in Speedometer.
        
        Interestingly, this patch only does value profiling on the slow path. The fast
        path of to_this in the LLInt/baseline just perform a structure check. If it
        passes, the result is the same as the input. Therefore, doing value profiling
        from the fast path wouldn't actually produce new information for the ValueProfile.

        * bytecode/BytecodeDumper.cpp:
        (JSC::BytecodeDumper<Block>::dumpBytecode):
        * bytecode/BytecodeList.json:
        * bytecode/CodeBlock.cpp:
        (JSC::CodeBlock::finishCreation):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        (JSC::BytecodeGenerator::emitToThis):
        * bytecompiler/BytecodeGenerator.h:
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):
        * dfg/DFGNode.h:
        (JSC::DFG::Node::hasHeapPrediction):
        * dfg/DFGPredictionPropagationPhase.cpp:
        * runtime/CommonSlowPaths.cpp:
        (JSC::SLOW_PATH_DECL):

2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Unify ToNumber implementation in 32bit and 64bit by changing 32bit Int32Tag and LowestTag
        https://bugs.webkit.org/show_bug.cgi?id=181134

        Reviewed by Mark Lam.

        We would like to unify DFG ToNumber implementation in 32bit and 64bit. One problem is that
        branchIfNumber signature is different between 32bit and 64bit. 32bit implementation requires
        an additional scratch register. We do not want to allocate an unnecessary register in 64bit
        implementation.

        This patch removes the additional register in branchIfNumber/branchIfNotNumber in both 32bit
        and 64bit implementation. To achieve this goal, we change Int32Tag and LowestTag order. By
        setting Int32Tag as LowestTag, we can query whether the given tag is a number by checking
        `<= LowestTag(Int32Tag)`.

        We also change the order of UndefinedTag, NullTag, and BooleanTag to keep `(UndefinedTag | 1) == NullTag`.

        We also clean up speculateMisc implementation by adding branchIfMisc/branchIfNotMisc.

        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
        (JSC::DFG::SpeculativeJIT::speculateNumber):
        (JSC::DFG::SpeculativeJIT::speculateMisc):
        (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):
        (JSC::DFG::SpeculativeJIT::compileToNumber):
        * dfg/DFGSpeculativeJIT.h:
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compile):
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::branchIfNotType):
        (JSC::AssemblyHelpers::jitAssertIsJSNumber):
        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::branchIfMisc):
        (JSC::AssemblyHelpers::branchIfNotMisc):
        (JSC::AssemblyHelpers::branchIfNumber):
        (JSC::AssemblyHelpers::branchIfNotNumber):
        (JSC::AssemblyHelpers::branchIfNotDoubleKnownNotInt32):
        (JSC::AssemblyHelpers::emitTypeOf):
        * jit/JITAddGenerator.cpp:
        (JSC::JITAddGenerator::generateFastPath):
        * jit/JITArithmetic32_64.cpp:
        (JSC::JIT::emitBinaryDoubleOp):
        * jit/JITDivGenerator.cpp:
        (JSC::JITDivGenerator::loadOperand):
        * jit/JITMulGenerator.cpp:
        (JSC::JITMulGenerator::generateInline):
        (JSC::JITMulGenerator::generateFastPath):
        * jit/JITNegGenerator.cpp:
        (JSC::JITNegGenerator::generateInline):
        (JSC::JITNegGenerator::generateFastPath):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_is_number):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_to_number):
        (JSC::JIT::emit_op_profile_type):
        * jit/JITRightShiftGenerator.cpp:
        (JSC::JITRightShiftGenerator::generateFastPath):
        * jit/JITSubGenerator.cpp:
        (JSC::JITSubGenerator::generateInline):
        (JSC::JITSubGenerator::generateFastPath):
        * llint/LLIntData.cpp:
        (JSC::LLInt::Data::performAssertions):
        * llint/LowLevelInterpreter.asm:
        * llint/LowLevelInterpreter32_64.asm:
        * runtime/JSCJSValue.h:

2018-01-04  JF Bastien  <jfbastien@apple.com>

        Add assembler support for x86 lfence and sfence
        https://bugs.webkit.org/show_bug.cgi?id=181311
        <rdar://problem/36301780>

        Reviewed by Michael Saboff.

        Useful for testing performance of serializing instructions (hint:
        it's not good).

        * assembler/MacroAssemblerX86Common.h:
        (JSC::MacroAssemblerX86Common::lfence):
        (JSC::MacroAssemblerX86Common::sfence):
        * assembler/X86Assembler.h:
        (JSC::X86Assembler::lfence):
        (JSC::X86Assembler::sfence):

2018-01-04  Saam Barati  <sbarati@apple.com>

        Add a new pattern matching rule to Graph::methodOfGettingAValueProfileFor for SetLocal(@nodeWithHeapPrediction)
        https://bugs.webkit.org/show_bug.cgi?id=181296

        Reviewed by Filip Pizlo.

        Inside Speedometer's Ember test, there is a recompile loop like:
        a: GetByVal(..., semanticOriginX)
        b: SetLocal(Cell:@a, semanticOriginX)
        
        where the cell check always fails. For reasons I didn't investigate, the
        baseline JIT's value profiling doesn't accurately capture the GetByVal's
        result.
        
        However, when compiling this cell speculation check in the DFG, we get a null
        MethodOfGettingAValueProfile inside Graph::methodOfGettingAValueProfileFor for
        this IR pattern because both @a and @b have the same semantic origin. We
        should not follow the same semantic origin heuristic when dealing with
        SetLocal since SetLocal(@nodeWithHeapPrediction) is such a common IR pattern.
        For patterns like this, we introduce a new heuristic: @NodeThatDoesNotProduceAValue(@nodeWithHeapPrediction).
        For this IR pattern, we will update the value profile for the semantic origin
        for @nodeWithHeapPrediction. So, for the Speedometer example above, we
        will correctly update the GetByVal's value profile, which will prevent
        an OSR exit loop.

        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):

2018-01-04  Keith Miller  <keith_miller@apple.com>

        Array Storage operations sometimes did not update the indexing mask correctly.
        https://bugs.webkit.org/show_bug.cgi?id=181301

        Reviewed by Mark Lam.

        I will add tests in a follow up patch. See: https://bugs.webkit.org/show_bug.cgi?id=181303

        * runtime/JSArray.cpp:
        (JSC::JSArray::shiftCountWithArrayStorage):
        * runtime/JSObject.cpp:
        (JSC::JSObject::increaseVectorLength):

2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [DFG] Define defs for MapSet/SetAdd to participate in CSE
        https://bugs.webkit.org/show_bug.cgi?id=179911

        Reviewed by Saam Barati.

        With this patch, our MapSet and SetAdd DFG nodes participate in CSE.
        To handle a bit tricky DFG Map operation nodes, MapSet and SetAdd
        produce added bucket as its result. Subsequent GetMapBucket will
        be removed by CSE.

        * dfg/DFGAbstractInterpreterInlines.h:
        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
        * dfg/DFGClobberize.h:
        (JSC::DFG::clobberize):
        * dfg/DFGNodeType.h:
        * dfg/DFGOperations.cpp:
        * dfg/DFGOperations.h:
        * dfg/DFGPredictionPropagationPhase.cpp:
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::compileSetAdd):
        (JSC::DFG::SpeculativeJIT::compileMapSet):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::callOperation):
        * ftl/FTLLowerDFGToB3.cpp:
        (JSC::FTL::DFG::LowerDFGToB3::compileSetAdd):
        (JSC::FTL::DFG::LowerDFGToB3::compileMapSet):
        * jit/JITOperations.h:
        * runtime/HashMapImpl.h:
        (JSC::HashMapImpl::addNormalized):
        (JSC::HashMapImpl::addNormalizedInternal):

2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Remove LocalScope
        https://bugs.webkit.org/show_bug.cgi?id=181206

        Reviewed by Geoffrey Garen.

        The last user of HandleStack and LocalScope is JSON. But MarkedArgumentBuffer is enough for their use.
        This patch changes JSON parsing and stringifying to using MarkedArgumentBuffer. And remove HandleStack
        and LocalScope.

        We make Stringifier and Walker WTF_FORBID_HEAP_ALLOCATION to place them on the stack. So they can hold
        JSObject* directly in their fields.

        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * heap/HandleStack.cpp: Removed.
        * heap/HandleStack.h: Removed.
        * heap/Heap.cpp:
        (JSC::Heap::addCoreConstraints):
        * heap/Heap.h:
        (JSC::Heap::handleSet):
        (JSC::Heap::handleStack): Deleted.
        * heap/Local.h: Removed.
        * heap/LocalScope.h: Removed.
        * runtime/JSONObject.cpp:
        (JSC::Stringifier::Holder::object const):
        (JSC::gap):
        (JSC::Stringifier::Stringifier):
        (JSC::Stringifier::stringify):
        (JSC::Stringifier::appendStringifiedValue):
        (JSC::Stringifier::Holder::Holder):
        (JSC::Stringifier::Holder::appendNextProperty):
        (JSC::Walker::Walker):
        (JSC::Walker::callReviver):
        (JSC::Walker::walk):
        (JSC::JSONProtoFuncParse):
        (JSC::JSONProtoFuncStringify):
        (JSC::JSONParse):
        (JSC::JSONStringify):

2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [FTL] Optimize ObjectAllocationSinking mergePointerSets by using removeIf
        https://bugs.webkit.org/show_bug.cgi?id=180238

        Reviewed by Saam Barati.

        We can optimize ObjectAllocationSinking a bit by using removeIf.

        * dfg/DFGObjectAllocationSinkingPhase.cpp:

2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Create parallel SlotVisitors apriori
        https://bugs.webkit.org/show_bug.cgi?id=180907

        Reviewed by Saam Barati.

        The number of SlotVisitors are capped with the number of HeapHelperPool's threads + 2.
        If we create these SlotVisitors apriori, we do not need to create SlotVisitors dynamically.
        Then we do not need to grab locks while iterating all the SlotVisitors.

        In addition, we do not need to consider the case that the number of SlotVisitors increases
        after setting up VisitCounters in MarkingConstraintSolver since the number of SlotVisitors
        does not increase any more.

        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC::Heap::runBeginPhase):
        * heap/Heap.h:
        * heap/HeapInlines.h:
        (JSC::Heap::forEachSlotVisitor):
        (JSC::Heap::numberOfSlotVisitors): Deleted.
        * heap/MarkingConstraintSolver.cpp:
        (JSC::MarkingConstraintSolver::didVisitSomething const):

2018-01-03  Ting-Wei Lan  <lantw44@gmail.com>

        Replace hard-coded paths in shebangs with #!/usr/bin/env
        https://bugs.webkit.org/show_bug.cgi?id=181040

        Reviewed by Alex Christensen.

        * Scripts/UpdateContents.py:
        * Scripts/cssmin.py:
        * Scripts/generate-combined-inspector-json.py:
        * Scripts/xxd.pl:
        * create_hash_table:
        * generate-bytecode-files:
        * wasm/generateWasm.py:
        * wasm/generateWasmOpsHeader.py:
        * yarr/generateYarrCanonicalizeUnicode:

2018-01-03  Michael Saboff  <msaboff@apple.com>

        Disable SharedArrayBuffers from Web API
        https://bugs.webkit.org/show_bug.cgi?id=181266

        Reviewed by Saam Barati.

        Removed SharedArrayBuffer prototype and structure from GlobalObject creation
        to disable.

        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildren):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::arrayBufferPrototype const):
        (JSC::JSGlobalObject::arrayBufferStructure const):

2018-01-03  Michael Saboff  <msaboff@apple.com>

        Add "noInline" to $vm
        https://bugs.webkit.org/show_bug.cgi?id=181265

        Reviewed by Mark Lam.

        This would be useful for web based tests.

        * tools/JSDollarVM.cpp:
        (JSC::getExecutableForFunction):
        (JSC::functionNoInline):
        (JSC::JSDollarVM::finishCreation):

2018-01-03  Michael Saboff  <msaboff@apple.com>

        Remove unnecessary flushing of Butterfly pointer in functionCpuClflush()
        https://bugs.webkit.org/show_bug.cgi?id=181263

        Reviewed by Mark Lam.

        Flushing the butterfly pointer provides no benefit and slows this function.

        * tools/JSDollarVM.cpp:
        (JSC::functionCpuClflush):

2018-01-03  Saam Barati  <sbarati@apple.com>

        Fix BytecodeParser op_catch assert to work with useProfiler=1
        https://bugs.webkit.org/show_bug.cgi?id=181260

        Reviewed by Keith Miller.

        op_catch was asserting that the current block was empty. This is only true
        if the profiler isn't enabled. When the profiler is enabled, we will
        insert a CountExecution node before each bytecode. This patch fixes the
        assert to work with the profiler.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::parseBlock):

2018-01-03  Per Arne Vollan  <pvollan@apple.com>

        [Win][Debug] testapi link error.
        https://bugs.webkit.org/show_bug.cgi?id=181247
        <rdar://problem/36166729>

        Reviewed by Brent Fulgham.

        Do not set the runtime library compile flag for C files, it is already set to the correct value.
 
        * shell/PlatformWin.cmake:

2018-01-03  Robin Morisset  <rmorisset@apple.com>

        Inlining of a function that ends in op_unreachable crashes
        https://bugs.webkit.org/show_bug.cgi?id=181027

        Reviewed by Filip Pizlo.

        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::allocateTargetableBlock):
        (JSC::DFG::ByteCodeParser::inlineCall):

2018-01-02  Saam Barati  <sbarati@apple.com>

        Incorrect assertion inside AccessCase
        https://bugs.webkit.org/show_bug.cgi?id=181200
        <rdar://problem/35494754>

        Reviewed by Yusuke Suzuki.

        Consider a PutById compiled to a setter in a function like so:
        
        ```
        function foo(o) { o.f = o; }
        ```
        
        The DFG will often assign the same registers to the baseGPR (o in o.f) and the
        valueRegsPayloadGPR (o in the RHS). The code totally works when these are assigned
        to the same register. However, we're asserting that they're not the same register.
        This patch just removes this invalid assertion.

        * bytecode/AccessCase.cpp:
        (JSC::AccessCase::generateImpl):

2018-01-02  Caio Lima  <ticaiolima@gmail.com>

        [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
        https://bugs.webkit.org/show_bug.cgi?id=175359

        Reviewed by Yusuke Suzuki.

        This patch is implementing BigIntConstructor and BigIntPrototype
        following spec[1, 2]. As addition, we are also implementing BigIntObject
        warapper to handle ToObject(v) abstract operation when "v" is a BigInt
        primitive. With these classes, now it's possible to syntetize
        BigInt.prototype and then call "toString", "valueOf" and
        "toLocaleString" when the primitive is a BigInt.
        BigIntConstructor exposes an API to parse other primitives such as
        Number, Boolean and String to BigInt.
        We decided to skip parseInt implementation, since it was removed from
        spec.

        [1] - https://tc39.github.io/proposal-bigint/#sec-bigint-constructor
        [2] - https://tc39.github.io/proposal-bigint/#sec-properties-of-the-bigint-prototype-object 

        * CMakeLists.txt:
        * DerivedSources.make:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * Sources.txt:
        * jsc.cpp:
        * runtime/BigIntConstructor.cpp: Added.
        (JSC::BigIntConstructor::BigIntConstructor):
        (JSC::BigIntConstructor::finishCreation):
        (JSC::isSafeInteger):
        (JSC::toBigInt):
        (JSC::callBigIntConstructor):
        (JSC::bigIntConstructorFuncAsUintN):
        (JSC::bigIntConstructorFuncAsIntN):
        * runtime/BigIntConstructor.h: Added.
        (JSC::BigIntConstructor::create):
        (JSC::BigIntConstructor::createStructure):
        * runtime/BigIntObject.cpp: Added.
        (JSC::BigIntObject::BigIntObject):
        (JSC::BigIntObject::finishCreation):
        (JSC::BigIntObject::toStringName):
        (JSC::BigIntObject::defaultValue):
        * runtime/BigIntObject.h: Added.
        (JSC::BigIntObject::create):
        (JSC::BigIntObject::internalValue const):
        (JSC::BigIntObject::createStructure):
        * runtime/BigIntPrototype.cpp: Added.
        (JSC::BigIntPrototype::BigIntPrototype):
        (JSC::BigIntPrototype::finishCreation):
        (JSC::toThisBigIntValue):
        (JSC::bigIntProtoFuncToString):
        (JSC::bigIntProtoFuncToLocaleString):
        (JSC::bigIntProtoFuncValueOf):
        * runtime/BigIntPrototype.h: Added.
        (JSC::BigIntPrototype::create):
        (JSC::BigIntPrototype::createStructure):
        * runtime/IntlCollator.cpp:
        (JSC::IntlCollator::initializeCollator):
        * runtime/IntlNumberFormat.cpp:
        (JSC::IntlNumberFormat::initializeNumberFormat):
        * runtime/JSBigInt.cpp:
        (JSC::JSBigInt::createFrom):
        (JSC::JSBigInt::parseInt):
        (JSC::JSBigInt::toObject const):
        * runtime/JSBigInt.h:
        * runtime/JSCJSValue.cpp:
        (JSC::JSValue::synthesizePrototype const):
        * runtime/JSCPoisonedPtr.cpp:
        * runtime/JSCell.cpp:
        (JSC::JSCell::toObjectSlow const):
        * runtime/JSGlobalObject.cpp:
        (JSC::JSGlobalObject::init):
        (JSC::JSGlobalObject::visitChildren):
        * runtime/JSGlobalObject.h:
        (JSC::JSGlobalObject::bigIntPrototype const):
        (JSC::JSGlobalObject::bigIntObjectStructure const):
        * runtime/StructureCache.h:
        * runtime/StructureInlines.h:
        (JSC::prototypeForLookupPrimitiveImpl):

2018-01-02  Tim Horton  <timothy_horton@apple.com>

        Fix the MathCommon build with a recent compiler
        https://bugs.webkit.org/show_bug.cgi?id=181216

        Reviewed by Sam Weinig.

        * runtime/MathCommon.cpp:
        (JSC::fdlibmPow):
        This cast drops the 'const' qualifier from the pointer to 'one',
        but it doesn't have to, and it makes the compiler sad.

== Rolled over to ChangeLog-2018-01-01 ==