Google Git
Sign in
webkit / WebKit / 0fd7ec908ba87eea05f8d6fd701d4b3b322aabd5 / . / Source / JavaScriptCore / ChangeLog
blob: 46a0636d4a314c9c9cbf47f9d83b695fcf377806 [file] [log] [blame]
fpizlo@apple.com6a23c422012-08-18 00:48:38 +0000[diff] [blame]12012-08-17 Filip Pizlo <fpizlo@apple.com>
2
fpizlo@apple.com0fd7ec92012-08-19 21:59:12 +0000[diff] [blame^]3 The current state of the call frame should be taken into account in the DFG for both predictions and proofs
4 https://bugs.webkit.org/show_bug.cgi?id=94412
5
6 Reviewed by Geoffrey Garen.
7
8 This ensures that no matter how smart the DFG gets, it'll always know through
9 which entrypoint OSR will try to enter, and with which values it will attempt
10 to do so. For prologue OSR, this has no effect other than adding the current
11 arguments to the argument predictions. For loop OSR, this makes our treatment
12 of the loop slightly more conservative - just conservative enough to ensure
13 that OSR succeeds.
14
15 * bytecode/CodeBlock.cpp:
16 (JSC::ProgramCodeBlock::compileOptimized):
17 (JSC::EvalCodeBlock::compileOptimized):
18 (JSC::FunctionCodeBlock::compileOptimized):
19 * bytecode/CodeBlock.h:
20 (CodeBlock):
21 (ProgramCodeBlock):
22 (EvalCodeBlock):
23 (FunctionCodeBlock):
24 * dfg/DFGAbstractState.cpp:
25 (JSC::DFG::AbstractState::initialize):
26 * dfg/DFGAbstractValue.h:
27 (JSC::DFG::AbstractValue::setMostSpecific):
28 (AbstractValue):
29 * dfg/DFGByteCodeParser.cpp:
30 (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
31 (JSC::DFG::ByteCodeParser::parse):
32 * dfg/DFGDriver.cpp:
33 (JSC::DFG::compile):
34 (JSC::DFG::tryCompile):
35 (JSC::DFG::tryCompileFunction):
36 * dfg/DFGDriver.h:
37 (DFG):
38 (JSC::DFG::tryCompile):
39 (JSC::DFG::tryCompileFunction):
40 * dfg/DFGGraph.h:
41 (JSC::DFG::Graph::Graph):
42 (Graph):
43 * jit/JITDriver.h:
44 (JSC::jitCompileIfAppropriate):
45 (JSC::jitCompileFunctionIfAppropriate):
46 * jit/JITStubs.cpp:
47 (JSC::DEFINE_STUB_FUNCTION):
48 * runtime/Executable.cpp:
49 (JSC::EvalExecutable::compileOptimized):
50 (JSC::EvalExecutable::compileInternal):
51 (JSC::ProgramExecutable::compileOptimized):
52 (JSC::ProgramExecutable::compileInternal):
53 (JSC::FunctionExecutable::compileOptimizedForCall):
54 (JSC::FunctionExecutable::compileOptimizedForConstruct):
55 (JSC::FunctionExecutable::compileForCallInternal):
56 (JSC::FunctionExecutable::compileForConstructInternal):
57 * runtime/Executable.h:
58 (EvalExecutable):
59 (ProgramExecutable):
60 (FunctionExecutable):
61 (JSC::FunctionExecutable::compileOptimizedFor):
62 * runtime/ExecutionHarness.h:
63 (JSC::prepareForExecution):
64 (JSC::prepareFunctionForExecution):
65
662012-08-17 Filip Pizlo <fpizlo@apple.com>
67
fpizlo@apple.comd5d9bae2012-08-18 06:01:33 +0000[diff] [blame]68 DFG CSE should be more honest about when it changed the IR
69 https://bugs.webkit.org/show_bug.cgi?id=94408
70
71 Reviewed by Geoffrey Garen.
72
73 The CSE phase now always returns true if it changed the IR.
74
75 * dfg/DFGCSEPhase.cpp:
76 (JSC::DFG::CSEPhase::setReplacement):
77 (JSC::DFG::CSEPhase::eliminate):
78 (JSC::DFG::CSEPhase::performNodeCSE):
79
802012-08-17 Filip Pizlo <fpizlo@apple.com>
81
fpizlo@apple.com6a23c422012-08-18 00:48:38 +0000[diff] [blame]82 DFG is still too pessimistic about what constitutes a side-effect on array accesses
83 https://bugs.webkit.org/show_bug.cgi?id=94309
84
85 Reviewed by Geoffrey Garen.
86
87 This change means that even if structure transition watchpoints are not used for
88 hoisting of clobbered structure checks, we still retain good performance on the
89 benchmarks we care about. That's important, since butterflies will likely make
90 most array structures not watchpointable.
91
92 * dfg/DFGAbstractState.cpp:
93 (JSC::DFG::AbstractState::execute):
94 * dfg/DFGStructureCheckHoistingPhase.cpp:
95 (JSC::DFG::StructureCheckHoistingPhase::run):
96
commit-queue@webkit.orgb421708a2012-08-17 14:16:23 +0000[diff] [blame]972012-08-17 Milian Wolff <milian.wolff@kdab.com>
98
99 [Qt] QNX build fails due to ctype usage in system headers
100 https://bugs.webkit.org/show_bug.cgi?id=93849
101
102 Reviewed by Simon Hausmann.
103
104 Move the check for whether DisallowCType should be active or not
105 to the DisallowCType.h header. This way, we can update the list
106 of platforms or OSes which do not work with this header in a
107 central place. All users can now safely include the header
108 and do not need to place custom guards around it.
109
110 * config.h:
111
hausmann@webkit.orgd1aebfb2012-08-17 09:42:31 +0000[diff] [blame]1122012-08-16 Simon Hausmann <simon.hausmann@nokia.com>
113
114 [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
115 https://bugs.webkit.org/show_bug.cgi?id=93872
116
117 Reviewed by Kenneth Rohde Christiansen.
118
119 * Target.pri: Add missing JSWeakObjectMap file to build.
120
fpizlo@apple.comff86f062012-08-16 20:35:12 +0000[diff] [blame]1212012-08-16 Filip Pizlo <fpizlo@apple.com>
122
fpizlo@apple.com00673b32012-08-16 23:17:24 +0000[diff] [blame]123 Structure check hoisting should be less expensive
124 https://bugs.webkit.org/show_bug.cgi?id=94201
125
126 Reviewed by Mark Hahnenberg.
127
128 This appears like a broad win on short-running programs.
129
130 * dfg/DFGArgumentsSimplificationPhase.cpp:
131 (JSC::DFG::ArgumentsSimplificationPhase::run):
132 * dfg/DFGCSEPhase.cpp:
133 (JSC::DFG::CSEPhase::performNodeCSE):
134 * dfg/DFGDriver.cpp:
135 (JSC::DFG::compile):
136 * dfg/DFGGraph.h:
137 (JSC::DFG::Graph::compareAndSwap):
138 (Graph):
139 (JSC::DFG::Graph::substitute):
140 (JSC::DFG::Graph::substituteGetLocal):
141 * dfg/DFGStructureCheckHoistingPhase.cpp:
142 (JSC::DFG::StructureCheckHoistingPhase::run):
143
1442012-08-16 Filip Pizlo <fpizlo@apple.com>
145
fpizlo@apple.comff86f062012-08-16 20:35:12 +0000[diff] [blame]146 All op_resolve_global instructions should end up in the list of global resolve instructions
147 https://bugs.webkit.org/show_bug.cgi?id=94247
148 <rdar://problem/12103500>
149
150 Reviewed by Mark Hahnenberg.
151
152 * bytecompiler/BytecodeGenerator.cpp:
153 (JSC::BytecodeGenerator::emitResolveWithBase):
154
commit-queue@webkit.orgb0d27632012-08-15 22:31:26 +0000[diff] [blame]1552012-08-15 Bruno de Oliveira Abinader <bruno.abinader@basyskom.com>
156
157 [css3-text] Add CSS3 Text decoration compile flag
158 https://bugs.webkit.org/show_bug.cgi?id=93863
159
160 Reviewed by Julien Chaffraix.
161
162 This patch handles the compile flag implementation, which will come disabled by
163 default, thus not exposing the CSS3 text decoration features to the web, unless
164 when explicitly enabling it with "--css3-text-decoration" build parameter.
165
166 * Configurations/FeatureDefines.xcconfig:
167
commit-queue@webkit.org45974062012-08-15 21:35:55 +0000[diff] [blame]1682012-08-15 Sheriff Bot <webkit.review.bot@gmail.com>
169
170 Unreviewed, rolling out r125687.
171 http://trac.webkit.org/changeset/125687
172 https://bugs.webkit.org/show_bug.cgi?id=94147
173
174 It broke the whole world (Requested by Ossy_night on #webkit).
175
176 * API/JSValueRef.cpp:
177 (JSValueToBoolean):
178 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
179 * bytecode/Watchpoint.h:
180 (WatchpointSet):
181 * debugger/DebuggerCallFrame.h:
182 * dfg/DFGAbstractState.cpp:
183 (JSC::DFG::AbstractState::execute):
184 * dfg/DFGCFGSimplificationPhase.cpp:
185 (JSC::DFG::CFGSimplificationPhase::run):
186 * dfg/DFGOperations.cpp:
187 * dfg/DFGOperations.h:
188 * dfg/DFGSpeculativeJIT32_64.cpp:
189 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
190 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
191 (JSC::DFG::SpeculativeJIT::compile):
192 * dfg/DFGSpeculativeJIT64.cpp:
193 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
194 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
195 (JSC::DFG::SpeculativeJIT::compile):
196 * interpreter/Interpreter.cpp:
197 (JSC::Interpreter::privateExecute):
198 * jit/JITOpcodes.cpp:
199 (JSC::JIT::emit_op_is_undefined):
200 (JSC::JIT::emit_op_jeq_null):
201 (JSC::JIT::emit_op_jneq_null):
202 (JSC::JIT::emit_op_eq_null):
203 (JSC::JIT::emit_op_neq_null):
204 * jit/JITOpcodes32_64.cpp:
205 (JSC::JIT::emit_op_is_undefined):
206 (JSC::JIT::emit_op_jeq_null):
207 (JSC::JIT::emit_op_jneq_null):
208 (JSC::JIT::emit_op_eq_null):
209 (JSC::JIT::emit_op_neq_null):
210 * jit/JITStubs.cpp:
211 (JSC::DEFINE_STUB_FUNCTION):
212 * llint/LLIntSlowPaths.cpp:
213 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
214 * llint/LowLevelInterpreter32_64.asm:
215 * llint/LowLevelInterpreter64.asm:
216 * runtime/ArrayPrototype.cpp:
217 (JSC::arrayProtoFuncFilter):
218 (JSC::arrayProtoFuncEvery):
219 (JSC::arrayProtoFuncSome):
220 * runtime/BooleanConstructor.cpp:
221 (JSC::constructBoolean):
222 (JSC::callBooleanConstructor):
223 * runtime/JSCell.h:
224 (JSCell):
225 * runtime/JSGlobalObject.cpp:
226 (JSC::JSGlobalObject::JSGlobalObject):
227 * runtime/JSGlobalObject.h:
228 (JSGlobalObject):
229 * runtime/JSString.h:
230 (JSC::JSCell::toBoolean):
231 (JSC::JSValue::toBoolean):
232 * runtime/JSValue.h:
233 * runtime/ObjectConstructor.cpp:
234 (JSC::toPropertyDescriptor):
235 * runtime/Operations.cpp:
236 (JSC::jsTypeStringForValue):
237 (JSC::jsIsObjectType):
238 * runtime/Operations.h:
239 (JSC):
240 (JSC::JSValue::equalSlowCaseInline):
241 * runtime/RegExpConstructor.cpp:
242 (JSC::setRegExpConstructorMultiline):
243 * runtime/RegExpPrototype.cpp:
244 (JSC::regExpProtoFuncToString):
245 * runtime/Structure.h:
246
commit-queue@webkit.orgb6cc1852012-08-15 21:09:00 +0000[diff] [blame]2472012-08-15 Gabor Ballabas <gaborb@inf.u-szeged.hu>
248
249 Buildfix after r125541
250 https://bugs.webkit.org/show_bug.cgi?id=94097
251
252 Reviewed by Filip Pizlo.
253
254 r125541 has broken the traditional ARM port build of JSC.
255
256 * assembler/MacroAssemblerARM.h:
257 (JSC::MacroAssemblerARM::neg32):
258 (JSC::MacroAssemblerARM::xor32):
259
mhahnenberg@apple.com35d54552012-08-15 18:32:41 +0000[diff] [blame]2602012-08-14 Mark Hahnenberg <mhahnenberg@apple.com>
261
262 Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
263 https://bugs.webkit.org/show_bug.cgi?id=93884
264
265 Reviewed by Geoffrey Garen.
266
267 With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of
268 MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,
269 we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined
270 objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).
271 For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not
272 masquerade as undefined within frame B, but it will continue to masquerade in frame A.
273
274 There are two primary changes that are taking place here. One is to thread the ExecState* through
275 JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's
276 JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two
277 are distinct, then the object cannot MasqueradeAsUndefined.
278
279 The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined
280 flag in the Structure is checked. For C++ code, this check has been factored into its own function in
281 Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has
282 had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed
283 through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers
284 that are MasqueradesAsUndefined.
285
286 * API/JSValueRef.cpp:
287 (JSValueToBoolean):
288 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
289 * bytecode/Watchpoint.h:
290 (WatchpointSet):
291 * debugger/DebuggerCallFrame.h:
292 (JSC::DebuggerCallFrame::callFrame):
293 * dfg/DFGAbstractState.cpp:
294 (JSC::DFG::AbstractState::execute):
295 * dfg/DFGCFGSimplificationPhase.cpp:
296 (JSC::DFG::CFGSimplificationPhase::run):
297 * dfg/DFGOperations.cpp:
298 * dfg/DFGOperations.h:
299 * dfg/DFGSpeculativeJIT32_64.cpp:
300 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
301 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
302 (JSC::DFG::SpeculativeJIT::compile):
303 * dfg/DFGSpeculativeJIT64.cpp:
304 (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
305 (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
306 (JSC::DFG::SpeculativeJIT::compile):
307 * interpreter/Interpreter.cpp:
308 (JSC::Interpreter::privateExecute):
309 * jit/JITOpcodes.cpp:
310 (JSC::JIT::emit_op_is_undefined):
311 (JSC::JIT::emit_op_jeq_null):
312 (JSC::JIT::emit_op_jneq_null):
313 (JSC::JIT::emit_op_eq_null):
314 (JSC::JIT::emit_op_neq_null):
315 * jit/JITOpcodes32_64.cpp:
316 (JSC::JIT::emit_op_is_undefined):
317 (JSC::JIT::emit_op_jeq_null):
318 (JSC::JIT::emit_op_jneq_null):
319 (JSC::JIT::emit_op_eq_null):
320 (JSC::JIT::emit_op_neq_null):
321 * jit/JITStubs.cpp:
322 (JSC::DEFINE_STUB_FUNCTION):
323 * llint/LLIntSlowPaths.cpp:
324 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
325 * llint/LowLevelInterpreter32_64.asm:
326 * llint/LowLevelInterpreter64.asm:
327 * runtime/ArrayPrototype.cpp:
328 (JSC::arrayProtoFuncFilter):
329 (JSC::arrayProtoFuncEvery):
330 (JSC::arrayProtoFuncSome):
331 * runtime/BooleanConstructor.cpp:
332 (JSC::constructBoolean):
333 (JSC::callBooleanConstructor):
334 * runtime/JSCell.h:
335 (JSCell):
336 * runtime/JSGlobalObject.cpp:
337 (JSC::JSGlobalObject::JSGlobalObject):
338 * runtime/JSGlobalObject.h:
339 (JSGlobalObject):
340 (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
341 * runtime/JSString.h:
342 (JSC::JSCell::toBoolean):
343 (JSC::JSValue::toBoolean):
344 * runtime/JSValue.h:
345 * runtime/ObjectConstructor.cpp:
346 (JSC::toPropertyDescriptor):
347 * runtime/Operations.cpp:
348 (JSC::jsTypeStringForValue):
349 (JSC::jsIsObjectType):
350 * runtime/Operations.h:
351 (JSC):
352 (JSC::JSValue::equalSlowCaseInline):
353 * runtime/RegExpConstructor.cpp:
354 (JSC::setRegExpConstructorMultiline):
355 * runtime/RegExpPrototype.cpp:
356 (JSC::regExpProtoFuncToString):
357 * runtime/Structure.h:
358 (Structure):
359 (JSC::Structure::globalObjectOffset):
360 (JSC::Structure::masqueradesAsUndefined):
361 (JSC):
362
fpizlo@apple.coma0c9a0a2012-08-15 03:10:57 +0000[diff] [blame]3632012-08-14 Filip Pizlo <fpizlo@apple.com>
364
365 Unreviewed, build fix for !ENABLE(DFG_JIT)
366
367 * jit/JITPropertyAccess.cpp:
368 (JSC::JIT::emit_op_get_by_val):
369 (JSC::JIT::emit_op_put_by_val):
370 (JSC::JIT::privateCompilePatchGetArrayLength):
371 * jit/JITPropertyAccess32_64.cpp:
372 (JSC::JIT::emit_op_get_by_val):
373 (JSC::JIT::emit_op_put_by_val):
374 (JSC::JIT::privateCompilePatchGetArrayLength):
375 * llint/LowLevelInterpreter32_64.asm:
376 * llint/LowLevelInterpreter64.asm:
377
fpizlo@apple.comf24804c2012-08-15 02:48:35 +0000[diff] [blame]3782012-08-13 Filip Pizlo <fpizlo@apple.com>
379
380 Array checks should use the structure, not the class info
381 https://bugs.webkit.org/show_bug.cgi?id=93150
382
383 Reviewed by Mark Hahnenberg.
384
385 This changes all array checks used in array accesses (get, put, get length,
386 push, pop) to use the structure, not the class info. Additionally, these
387 checks in the LLInt and baseline JIT record the structure in an ArrayProfile,
388 so that the DFG can know exactly what structure to check for.
389
390 * CMakeLists.txt:
391 * GNUmakefile.list.am:
392 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
393 * JavaScriptCore.xcodeproj/project.pbxproj:
394 * Target.pri:
395 * bytecode/ArrayProfile.cpp: Added.
396 (JSC):
397 (JSC::ArrayProfile::computeUpdatedPrediction):
398 * bytecode/ArrayProfile.h: Added.
399 (JSC):
400 (JSC::arrayModeFromStructure):
401 (ArrayProfile):
402 (JSC::ArrayProfile::ArrayProfile):
403 (JSC::ArrayProfile::bytecodeOffset):
404 (JSC::ArrayProfile::addressOfLastSeenStructure):
405 (JSC::ArrayProfile::observeStructure):
406 (JSC::ArrayProfile::expectedStructure):
407 (JSC::ArrayProfile::structureIsPolymorphic):
408 (JSC::ArrayProfile::hasDefiniteStructure):
409 (JSC::ArrayProfile::observedArrayModes):
410 * bytecode/CodeBlock.cpp:
411 (JSC::CodeBlock::dump):
412 (JSC::CodeBlock::getArrayProfile):
413 (JSC):
414 (JSC::CodeBlock::getOrAddArrayProfile):
415 (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
416 * bytecode/CodeBlock.h:
417 (JSC::CodeBlock::executionEntryCount):
418 (JSC::CodeBlock::numberOfArrayProfiles):
419 (JSC::CodeBlock::arrayProfiles):
420 (JSC::CodeBlock::addArrayProfile):
421 (CodeBlock):
422 * bytecode/Instruction.h:
423 (JSC):
424 (JSC::Instruction::Instruction):
425 * bytecode/Opcode.h:
426 (JSC):
427 (JSC::padOpcodeName):
428 * bytecompiler/BytecodeGenerator.cpp:
429 (JSC::BytecodeGenerator::emitGetArgumentByVal):
430 (JSC::BytecodeGenerator::emitGetByVal):
431 (JSC::BytecodeGenerator::emitPutByVal):
432 * dfg/DFGAbstractState.cpp:
433 (JSC::DFG::AbstractState::initialize):
434 (JSC::DFG::AbstractState::execute):
435 * dfg/DFGAbstractValue.h:
436 (JSC::DFG::StructureAbstractValue::hasSingleton):
437 (StructureAbstractValue):
438 (JSC::DFG::StructureAbstractValue::singleton):
439 * dfg/DFGArgumentsSimplificationPhase.cpp:
440 (JSC::DFG::ArgumentsSimplificationPhase::run):
441 * dfg/DFGByteCodeParser.cpp:
442 (JSC::DFG::ByteCodeParser::parseBlock):
443 * dfg/DFGFixupPhase.cpp:
444 (JSC::DFG::FixupPhase::fixupNode):
445 * dfg/DFGSpeculativeJIT.cpp:
446 (JSC::DFG::SpeculativeJIT::speculateArray):
447 (DFG):
448 (JSC::DFG::SpeculativeJIT::compile):
449 (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
450 (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
451 * dfg/DFGSpeculativeJIT.h:
452 (SpeculativeJIT):
453 * dfg/DFGSpeculativeJIT32_64.cpp:
454 (JSC::DFG::SpeculativeJIT::compile):
455 * dfg/DFGSpeculativeJIT64.cpp:
456 (JSC::DFG::SpeculativeJIT::compile):
457 * dfg/DFGStructureCheckHoistingPhase.cpp:
458 (JSC::DFG::StructureCheckHoistingPhase::run):
459 * jit/JITPropertyAccess.cpp:
460 (JSC::JIT::emit_op_get_by_val):
461 (JSC::JIT::emit_op_put_by_val):
462 (JSC::JIT::privateCompilePatchGetArrayLength):
463 * jit/JITPropertyAccess32_64.cpp:
464 (JSC::JIT::emit_op_get_by_val):
465 (JSC::JIT::emit_op_put_by_val):
466 (JSC::JIT::privateCompilePatchGetArrayLength):
467 * llint/LLIntOffsetsExtractor.cpp:
468 * llint/LowLevelInterpreter32_64.asm:
469 * llint/LowLevelInterpreter64.asm:
470 * runtime/Structure.h:
471 (Structure):
472 (JSC::Structure::classInfoOffset):
473
commit-queue@webkit.orgb1409632012-08-14 11:28:25 +0000[diff] [blame]4742012-08-14 Gabor Ballabas <gaborb@inf.u-szeged.hu>
475
476 Rename functions in the ARM port of DFG-JIT for better code readability.
477 https://bugs.webkit.org/show_bug.cgi?id=93609
478
479 Reviewed by Zoltan Herczeg.
480
481 Rename functions in the ARM port of DFG-JIT for better code
482 readability, and for following the WebKit coding style
483 wherever it is possible.
484
485 * assembler/ARMAssembler.cpp:
486 (JSC::ARMAssembler::genInt):
487 (JSC::ARMAssembler::getImm):
488 (JSC::ARMAssembler::moveImm):
489 (JSC::ARMAssembler::encodeComplexImm):
490 (JSC::ARMAssembler::dataTransfer32):
491 (JSC::ARMAssembler::baseIndexTransfer32):
492 (JSC::ARMAssembler::dataTransfer16):
493 (JSC::ARMAssembler::baseIndexTransfer16):
494 (JSC::ARMAssembler::dataTransferFloat):
495 (JSC::ARMAssembler::baseIndexTransferFloat):
496 * assembler/ARMAssembler.h:
497 (JSC::ARMAssembler::bitAnd):
498 (JSC::ARMAssembler::bitAnds):
499 (JSC::ARMAssembler::eor):
500 (JSC::ARMAssembler::eors):
501 (JSC::ARMAssembler::sub):
502 (JSC::ARMAssembler::subs):
503 (JSC::ARMAssembler::rsb):
504 (JSC::ARMAssembler::rsbs):
505 (JSC::ARMAssembler::add):
506 (JSC::ARMAssembler::adds):
507 (JSC::ARMAssembler::adc):
508 (JSC::ARMAssembler::adcs):
509 (JSC::ARMAssembler::sbc):
510 (JSC::ARMAssembler::sbcs):
511 (JSC::ARMAssembler::rsc):
512 (JSC::ARMAssembler::rscs):
513 (JSC::ARMAssembler::tst):
514 (JSC::ARMAssembler::teq):
515 (JSC::ARMAssembler::cmp):
516 (JSC::ARMAssembler::cmn):
517 (JSC::ARMAssembler::orr):
518 (JSC::ARMAssembler::orrs):
519 (JSC::ARMAssembler::mov):
520 (JSC::ARMAssembler::movw):
521 (JSC::ARMAssembler::movt):
522 (JSC::ARMAssembler::movs):
523 (JSC::ARMAssembler::bic):
524 (JSC::ARMAssembler::bics):
525 (JSC::ARMAssembler::mvn):
526 (JSC::ARMAssembler::mvns):
527 (JSC::ARMAssembler::mul):
528 (JSC::ARMAssembler::muls):
529 (JSC::ARMAssembler::mull):
530 (JSC::ARMAssembler::vmov_f64):
531 (JSC::ARMAssembler::vadd_f64):
532 (JSC::ARMAssembler::vdiv_f64):
533 (JSC::ARMAssembler::vsub_f64):
534 (JSC::ARMAssembler::vmul_f64):
535 (JSC::ARMAssembler::vcmp_f64):
536 (JSC::ARMAssembler::vsqrt_f64):
537 (JSC::ARMAssembler::vabs_f64):
538 (JSC::ARMAssembler::vneg_f64):
539 (JSC::ARMAssembler::ldrImmediate):
540 (JSC::ARMAssembler::ldrUniqueImmediate):
541 (JSC::ARMAssembler::dtrUp):
542 (JSC::ARMAssembler::dtrUpRegister):
543 (JSC::ARMAssembler::dtrDown):
544 (JSC::ARMAssembler::dtrDownRegister):
545 (JSC::ARMAssembler::halfDtrUp):
546 (JSC::ARMAssembler::halfDtrUpRegister):
547 (JSC::ARMAssembler::halfDtrDown):
548 (JSC::ARMAssembler::halfDtrDownRegister):
549 (JSC::ARMAssembler::doubleDtrUp):
550 (JSC::ARMAssembler::doubleDtrDown):
551 (JSC::ARMAssembler::push):
552 (JSC::ARMAssembler::pop):
553 (JSC::ARMAssembler::poke):
554 (JSC::ARMAssembler::peek):
555 (JSC::ARMAssembler::vmov_vfp64):
556 (JSC::ARMAssembler::vmov_arm64):
557 (JSC::ARMAssembler::vmov_vfp32):
558 (JSC::ARMAssembler::vmov_arm32):
559 (JSC::ARMAssembler::vcvt_f64_s32):
560 (JSC::ARMAssembler::vcvt_s32_f64):
561 (JSC::ARMAssembler::vcvt_u32_f64):
562 (JSC::ARMAssembler::vcvt_f64_f32):
563 (JSC::ARMAssembler::vcvt_f32_f64):
564 (JSC::ARMAssembler::clz):
565 (JSC::ARMAssembler::lslRegister):
566 (JSC::ARMAssembler::lsrRegister):
567 (JSC::ARMAssembler::asrRegister):
568 (JSC::ARMAssembler::align):
569 (JSC::ARMAssembler::loadBranchTarget):
570 (JSC::ARMAssembler::vmov):
571 * assembler/MacroAssemblerARM.cpp:
572 (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
573 * assembler/MacroAssemblerARM.h:
574 (JSC::MacroAssemblerARM::add32):
575 (JSC::MacroAssemblerARM::and32):
576 (JSC::MacroAssemblerARM::lshift32):
577 (JSC::MacroAssemblerARM::mul32):
578 (JSC::MacroAssemblerARM::or32):
579 (JSC::MacroAssemblerARM::rshift32):
580 (JSC::MacroAssemblerARM::urshift32):
581 (JSC::MacroAssemblerARM::sub32):
582 (JSC::MacroAssemblerARM::xor32):
583 (JSC::MacroAssemblerARM::countLeadingZeros32):
584 (JSC::MacroAssemblerARM::convertibleLoadPtr):
585 (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
586 (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
587 (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
588 (JSC::MacroAssemblerARM::store32):
589 (JSC::MacroAssemblerARM::pop):
590 (JSC::MacroAssemblerARM::push):
591 (JSC::MacroAssemblerARM::move):
592 (JSC::MacroAssemblerARM::swap):
593 (JSC::MacroAssemblerARM::branch32):
594 (JSC::MacroAssemblerARM::branchTest32):
595 (JSC::MacroAssemblerARM::mull32):
596 (JSC::MacroAssemblerARM::branchSub32):
597 (JSC::MacroAssemblerARM::compare32):
598 (JSC::MacroAssemblerARM::test32):
599 (JSC::MacroAssemblerARM::load32):
600 (JSC::MacroAssemblerARM::relativeTableJump):
601 (JSC::MacroAssemblerARM::moveWithPatch):
602 (JSC::MacroAssemblerARM::loadDouble):
603 (JSC::MacroAssemblerARM::moveDouble):
604 (JSC::MacroAssemblerARM::addDouble):
605 (JSC::MacroAssemblerARM::divDouble):
606 (JSC::MacroAssemblerARM::subDouble):
607 (JSC::MacroAssemblerARM::mulDouble):
608 (JSC::MacroAssemblerARM::sqrtDouble):
609 (JSC::MacroAssemblerARM::absDouble):
610 (JSC::MacroAssemblerARM::negateDouble):
611 (JSC::MacroAssemblerARM::convertInt32ToDouble):
612 (JSC::MacroAssemblerARM::convertFloatToDouble):
613 (JSC::MacroAssemblerARM::convertDoubleToFloat):
614 (JSC::MacroAssemblerARM::branchDouble):
615 (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
616 (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
617 (JSC::MacroAssemblerARM::truncateDoubleToInt32):
618 (JSC::MacroAssemblerARM::truncateDoubleToUint32):
619 (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
620 (JSC::MacroAssemblerARM::branchDoubleNonZero):
621 (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
622
hausmann@webkit.orge9a69542012-08-13 20:44:33 +0000[diff] [blame]6232012-08-13 Simon Hausmann <simon.hausmann@nokia.com>
624
hausmann@webkit.org029be3e2012-08-13 21:37:19 +0000[diff] [blame]625 Unreviewed, rolling out r125444.
626 http://trac.webkit.org/changeset/125444
627 https://bugs.webkit.org/show_bug.cgi?id=93872
628
629 Broke some tests
630
631 * Target.pri:
632
6332012-08-13 Simon Hausmann <simon.hausmann@nokia.com>
634
hausmann@webkit.orge9a69542012-08-13 20:44:33 +0000[diff] [blame]635 [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
636 https://bugs.webkit.org/show_bug.cgi?id=93872
637
638 Reviewed by Kenneth Rohde Christiansen.
639
640 * Target.pri: Add missing JSWeakObjectMap file to build.
641
rakuco@webkit.org56218832012-08-13 20:38:06 +0000[diff] [blame]6422012-08-13 Raphael Kubo da Costa <rakuco@webkit.org>
643
644 [CMake] Remove glib-related Find modules and write single new one instead.
645 https://bugs.webkit.org/show_bug.cgi?id=93786
646
647 Reviewed by Rob Buis.
648
649 * shell/PlatformEfl.cmake: Use GLIB_* instead of Glib_*.
650
allan.jensen@nokia.com3c6f1522012-08-12 11:47:34 +0000[diff] [blame]6512012-08-12 Allan Sandfeld Jensen <allan.jensen@nokia.com>
652
653 Doesn't build with ENABLE_JIT=0
654 https://bugs.webkit.org/show_bug.cgi?id=85042
655
656 Reviewed by Eric Seidel.
657
658 Include headers without which CallFrame.h does not build, and
659 fix gcc warning about comparing unsigned int with 0.
660
661 * dfg/DFGDriver.cpp:
662 * interpreter/Interpreter.cpp:
663 (JSC::Interpreter::isOpcode):
664
commit-queue@webkit.org2d9f0782012-08-10 16:21:25 +0000[diff] [blame]6652012-08-10 Yong Li <yoli@rim.com>
666
667 [BlackBerry] GCActivityCallback should always schedule GC even allocated bytes is a small number
668 https://bugs.webkit.org/show_bug.cgi?id=93650
669
670 Reviewed by Rob Buis.
671
672 Even a small number of allocated JS objects could hold expensive resources.
673
674 * runtime/GCActivityCallbackBlackBerry.cpp:
675 (JSC::DefaultGCActivityCallback::didAllocate):
676
commit-queue@webkit.orgb849db72012-08-09 20:38:56 +0000[diff] [blame]6772012-08-09 Yong Li <yoli@rim.com>
678
679 [QNX] Implement getCPUTime() for OS(QNX)
680 https://bugs.webkit.org/show_bug.cgi?id=93516
681
682 Reviewed by George Staikos.
683
684 Implement getCPUTime() with CLOCK_THREAD_CPUTIME_ID so it will tell
685 exactly how long the current thread has spent without being impacted
686 by other things.
687
688 * runtime/TimeoutChecker.cpp:
689 (JSC::getCPUTime):
690
commit-queue@webkit.org656e6522012-08-09 02:29:35 +0000[diff] [blame]6912012-08-08 Shane Stephens <shanestephens@google.com>
692
693 Compile flag for CSS Hierarchies
694 https://bugs.webkit.org/show_bug.cgi?id=92433
695
696 Reviewed by Tony Chang.
697
698 * Configurations/FeatureDefines.xcconfig:
699
benjamin@webkit.org58ac4792012-08-09 01:29:44 +0000[diff] [blame]7002012-08-08 Benjamin Poulain <bpoulain@apple.com>
701
702 Use char* instead of LChar* for the public interface of String construction from literals
703 https://bugs.webkit.org/show_bug.cgi?id=93402
704
705 Reviewed by Michael Saboff.
706
707 Update JSC' Identifier to use StringImpl::createFromLiteral with a char*.
708
709 * runtime/Identifier.cpp:
710 (JSC::IdentifierASCIIStringTranslator::translate):
711
paroga@webkit.orgcb73ac52012-08-08 07:31:12 +0000[diff] [blame]7122012-08-08 Patrick Gansterer <paroga@webkit.org>
713
paroga@webkit.org34230a82012-08-08 10:43:48 +0000[diff] [blame]714 Remove ce_time.(cpp|h) from list of source files
715 https://bugs.webkit.org/show_bug.cgi?id=93446
716
717 Reviewed by Simon Hausmann.
718
719 r125004 removed the last dependency on functions defined in ce_time.cpp.
720
721 * Target.pri:
722
7232012-08-08 Patrick Gansterer <paroga@webkit.org>
724
paroga@webkit.orgcb73ac52012-08-08 07:31:12 +0000[diff] [blame]725 [WIN] Use GetTimeZoneInformation() for getting the timezone name
726 https://bugs.webkit.org/show_bug.cgi?id=91936
727
728 Reviewed by Ryosuke Niwa.
729
730 The MS CRT implementation of strftime calls the same functions in the background.
731 Using them directly avoids the overhead of parsing the format string and removes
732 the dependency on strftime() for WinCE where this function does not exist.
733
734 * runtime/DateConversion.cpp:
735 (JSC::formatTime):
736
commit-queue@webkit.org3dfe8ce2012-08-07 22:55:04 +0000[diff] [blame]7372012-08-07 Gabor Ballabas <gaborb@inf.u-szeged.hu>
738
739 Refactor magic numbers in the ARM port of DFG-JIT
740 https://bugs.webkit.org/show_bug.cgi?id=93348
741
742 Reviewed by Eric Seidel.
743
744 Introduce new names for hard-coded magic numbers.
745 Refactor constant with confusing names to more descriptive ones.
746
747 * assembler/ARMAssembler.cpp:
748 (JSC::ARMAssembler::patchConstantPoolLoad):
749 (JSC::ARMAssembler::getOp2):
750 (JSC::ARMAssembler::genInt):
751 (JSC::ARMAssembler::getImm):
752 (JSC::ARMAssembler::moveImm):
753 (JSC::ARMAssembler::encodeComplexImm):
754 (JSC::ARMAssembler::dataTransfer32):
755 (JSC::ARMAssembler::dataTransfer16):
756 (JSC::ARMAssembler::dataTransferFloat):
757 (JSC::ARMAssembler::executableCopy):
758 * assembler/ARMAssembler.h:
759 (JSC::ARMAssembler::emitInstruction):
760 (JSC::ARMAssembler::ands_r):
761 (JSC::ARMAssembler::eors_r):
762 (JSC::ARMAssembler::subs_r):
763 (JSC::ARMAssembler::rsbs_r):
764 (JSC::ARMAssembler::adds_r):
765 (JSC::ARMAssembler::adcs_r):
766 (JSC::ARMAssembler::sbcs_r):
767 (JSC::ARMAssembler::rscs_r):
768 (JSC::ARMAssembler::tst_r):
769 (JSC::ARMAssembler::teq_r):
770 (JSC::ARMAssembler::cmp_r):
771 (JSC::ARMAssembler::cmn_r):
772 (JSC::ARMAssembler::orrs_r):
773 (JSC::ARMAssembler::movs_r):
774 (JSC::ARMAssembler::bics_r):
775 (JSC::ARMAssembler::mvns_r):
776 (JSC::ARMAssembler::muls_r):
777 (JSC::ARMAssembler::ldr_imm):
778 (JSC::ARMAssembler::ldr_un_imm):
779 (JSC::ARMAssembler::dtr_u):
780 (JSC::ARMAssembler::dtr_ur):
781 (JSC::ARMAssembler::dtr_dr):
782 (JSC::ARMAssembler::dtrh_u):
783 (JSC::ARMAssembler::dtrh_ur):
784 (JSC::ARMAssembler::fdtr_u):
785 (JSC::ARMAssembler::push_r):
786 (JSC::ARMAssembler::pop_r):
787 (JSC::ARMAssembler::getLdrImmAddress):
788 (JSC::ARMAssembler::getLdrImmAddressOnPool):
789 (JSC::ARMAssembler::patchConstantPoolLoad):
790 (JSC::ARMAssembler::repatchCompact):
791 (JSC::ARMAssembler::replaceWithJump):
792 (JSC::ARMAssembler::replaceWithLoad):
793 (JSC::ARMAssembler::replaceWithAddressComputation):
794 (JSC::ARMAssembler::getOp2Byte):
795 (JSC::ARMAssembler::getOp2Half):
796 (JSC::ARMAssembler::getImm16Op2):
797 (JSC::ARMAssembler::placeConstantPoolBarrier):
798 (JSC::ARMAssembler::getConditionalField):
799 * assembler/MacroAssemblerARM.cpp:
800 (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
801 * assembler/MacroAssemblerARM.h:
802 (JSC::MacroAssemblerARM::and32):
803 (JSC::MacroAssemblerARM::branch32):
804 (JSC::MacroAssemblerARM::branchTest32):
805 (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
806
benjamin@webkit.orgd02c5572012-08-07 21:46:07 +0000[diff] [blame]8072012-08-07 Benjamin Poulain <benjamin@webkit.org>
808
809 Use the initialization from literal for JSC's Identifiers
810 https://bugs.webkit.org/show_bug.cgi?id=93193
811
812 Reviewed by Geoffrey Garen.
813
814 This patches modify Identifier ot take advantage of the new initialization from literal.
815
816 In addition to the memory savings (~600bytes per instance), this gives us a 2% speed
817 improvement on CommonIdentifiers on average.
818
819 * runtime/CommonIdentifiers.cpp:
820 (JSC::CommonIdentifiers::CommonIdentifiers):
821 Null and empty strings are forbidden for literal initialization. Use the most efficient constructors
822 instead of a literal.
823
824 * runtime/Identifier.cpp:
825 (IdentifierASCIIStringTranslator):
826 Rename IdentifierCStringTranslator to IdentifierASCIIStringTranslator to make the text encoding
827 explicit.
828 (JSC::IdentifierASCIIStringTranslator::hash):
829 (JSC::IdentifierASCIIStringTranslator::equal):
830 (JSC::IdentifierASCIIStringTranslator::translate): Use the fast initialization from literal.
831 (JSC::Identifier::add):
832 * runtime/Identifier.h:
833 (JSC::Identifier::Identifier):
834
hausmann@webkit.orga0580522012-08-07 09:24:21 +0000[diff] [blame]8352012-08-07 Simon Hausmann <simon.hausmann@nokia.com>
836
837 [Qt][Win] Remove pthreads linkage
838
839 Reviewed by Csaba Osztrogonác.
840
841 After r124823 linkage to pthreads is not needed anymore for the Windows
842 build.
843
844 * JavaScriptCore.pri:
845
commit-queue@webkit.org6c4f9272012-08-07 08:50:43 +0000[diff] [blame]8462012-08-07 Gabor Ballabas <gaborb@inf.u-szeged.hu>
847
848 Refactor emit*Inst functions and introduce toARMWord functions in DFG-JIT's traditional ARM port
849 https://bugs.webkit.org/show_bug.cgi?id=93266
850
851 Reviewed by Csaba Osztrogonác.
852
853 First part of a bigger refactoring issue trying to make traditional
854 ARM DFG-JIT port easier to read and understand.
855
856
857 * assembler/ARMAssembler.h:
858 (JSC::ARMAssembler::emitInstruction):
859 (JSC::ARMAssembler::emitDoublePrecisionInstruction):
860 (JSC::ARMAssembler::emitSinglePrecisionInstruction):
861 (JSC::ARMAssembler::and_r):
862 (JSC::ARMAssembler::ands_r):
863 (JSC::ARMAssembler::eor_r):
864 (JSC::ARMAssembler::eors_r):
865 (JSC::ARMAssembler::sub_r):
866 (JSC::ARMAssembler::subs_r):
867 (JSC::ARMAssembler::rsb_r):
868 (JSC::ARMAssembler::rsbs_r):
869 (JSC::ARMAssembler::add_r):
870 (JSC::ARMAssembler::adds_r):
871 (JSC::ARMAssembler::adc_r):
872 (JSC::ARMAssembler::adcs_r):
873 (JSC::ARMAssembler::sbc_r):
874 (JSC::ARMAssembler::sbcs_r):
875 (JSC::ARMAssembler::rsc_r):
876 (JSC::ARMAssembler::rscs_r):
877 (JSC::ARMAssembler::tst_r):
878 (JSC::ARMAssembler::teq_r):
879 (JSC::ARMAssembler::cmp_r):
880 (JSC::ARMAssembler::cmn_r):
881 (JSC::ARMAssembler::orr_r):
882 (JSC::ARMAssembler::orrs_r):
883 (JSC::ARMAssembler::mov_r):
884 (JSC::ARMAssembler::movw_r):
885 (JSC::ARMAssembler::movt_r):
886 (JSC::ARMAssembler::movs_r):
887 (JSC::ARMAssembler::bic_r):
888 (JSC::ARMAssembler::bics_r):
889 (JSC::ARMAssembler::mvn_r):
890 (JSC::ARMAssembler::mvns_r):
891 (JSC::ARMAssembler::mul_r):
892 (JSC::ARMAssembler::muls_r):
893 (JSC::ARMAssembler::mull_r):
894 (JSC::ARMAssembler::vmov_f64_r):
895 (JSC::ARMAssembler::vadd_f64_r):
896 (JSC::ARMAssembler::vdiv_f64_r):
897 (JSC::ARMAssembler::vsub_f64_r):
898 (JSC::ARMAssembler::vmul_f64_r):
899 (JSC::ARMAssembler::vcmp_f64_r):
900 (JSC::ARMAssembler::vsqrt_f64_r):
901 (JSC::ARMAssembler::vabs_f64_r):
902 (JSC::ARMAssembler::vneg_f64_r):
903 (JSC::ARMAssembler::ldr_imm):
904 (JSC::ARMAssembler::ldr_un_imm):
905 (JSC::ARMAssembler::dtr_u):
906 (JSC::ARMAssembler::dtr_ur):
907 (JSC::ARMAssembler::dtr_d):
908 (JSC::ARMAssembler::dtr_dr):
909 (JSC::ARMAssembler::dtrh_u):
910 (JSC::ARMAssembler::dtrh_ur):
911 (JSC::ARMAssembler::dtrh_d):
912 (JSC::ARMAssembler::dtrh_dr):
913 (JSC::ARMAssembler::fdtr_u):
914 (JSC::ARMAssembler::fdtr_d):
915 (JSC::ARMAssembler::push_r):
916 (JSC::ARMAssembler::pop_r):
917 (JSC::ARMAssembler::vmov_vfp64_r):
918 (JSC::ARMAssembler::vmov_arm64_r):
919 (JSC::ARMAssembler::vmov_vfp32_r):
920 (JSC::ARMAssembler::vmov_arm32_r):
921 (JSC::ARMAssembler::vcvt_f64_s32_r):
922 (JSC::ARMAssembler::vcvt_s32_f64_r):
923 (JSC::ARMAssembler::vcvt_u32_f64_r):
924 (JSC::ARMAssembler::vcvt_f64_f32_r):
925 (JSC::ARMAssembler::vcvt_f32_f64_r):
926 (JSC::ARMAssembler::vmrs_apsr):
927 (JSC::ARMAssembler::clz_r):
928 (JSC::ARMAssembler::bx):
929 (JSC::ARMAssembler::blx):
930 (JSC::ARMAssembler::linkJump):
931 (JSC::ARMAssembler::toARMWord):
932 (ARMAssembler):
933
paroga@webkit.orgf5643b92012-08-06 23:46:11 +0000[diff] [blame]9342012-08-06 Patrick Gansterer <paroga@webkit.org>
935
paroga@webkit.org156fc552012-08-07 00:29:14 +0000[diff] [blame]936 [WIN] Remove dependency on pthread from MachineStackMarker
937 https://bugs.webkit.org/show_bug.cgi?id=68429
938
939 Reviewed by Geoffrey Garen.
940
941 Windows has no support for calling a destructor for thread specific data.
942 Since we need more control over creating and deleting thread specific keys
943 we can not simply extend WTF::ThreadSpecific with this functionality.
944
945 All thread specific keys created via the new API get stored in a list.
946 After a thread function finished we iterate over this list and call
947 the registered destructor for every item if needed.
948
949 * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly.
950 (JSC::MachineThreads::~MachineThreads):
951 (JSC::MachineThreads::makeUsableFromMultipleThreads):
952 (JSC::MachineThreads::addCurrentThread):
953 * heap/MachineStackMarker.h:
954 (MachineThreads):
955
9562012-08-06 Patrick Gansterer <paroga@webkit.org>
957
paroga@webkit.orgf5643b92012-08-06 23:46:11 +0000[diff] [blame]958 Unify JSC date and time formating functions
959 https://bugs.webkit.org/show_bug.cgi?id=92282
960
961 Reviewed by Geoffrey Garen.
962
963 Replace the existing functions for formating GregorianDateTime
964 with one single function. This removes some code duplications
965 in DatePrototype and is a preperation to fix encoding issues,
966 since we can add UChar* values to the resulting string now.
967
968 * runtime/DateConstructor.cpp:
969 (JSC::callDate):
970 * runtime/DateConversion.cpp:
971 (JSC::formatDateTime):
972 * runtime/DateConversion.h:
973 (JSC):
974 * runtime/DatePrototype.cpp:
975 (JSC::formateDateInstance):
976 (JSC::dateProtoFuncToString):
977 (JSC::dateProtoFuncToUTCString):
978 (JSC::dateProtoFuncToDateString):
979 (JSC::dateProtoFuncToTimeString):
980 (JSC::dateProtoFuncToGMTString):
981
carlosgc@webkit.orga6cd87d2012-08-06 12:35:28 +0000[diff] [blame]9822012-08-06 Carlos Garcia Campos <cgarcia@igalia.com>
983
984 Unreviewed. Fix make distcheck.
985
986 * GNUmakefile.list.am: Add missing header file.
987
commit-queue@webkit.org1b331cb2012-08-06 03:16:46 +0000[diff] [blame]9882012-08-05 Peter Wang <peter.wang@torchmobile.com.cn>
989
990 Web Inspector: [JSC] implement setting breakpoints by line:column
991 https://bugs.webkit.org/show_bug.cgi?id=53003
992
993 Reviewed by Geoffrey Garen.
994
995 Add a counter to Lexer to record the column info of each Token. Add a column parameter to
996 op_debug, cti_op_debug, and _llint_op_debug byte-code command.
997
998 * bytecode/CodeBlock.cpp:
999 (JSC::CodeBlock::dump):
1000 * bytecode/Opcode.h:
1001 (JSC):
1002 (JSC::padOpcodeName):
1003 * bytecompiler/BytecodeGenerator.cpp:
1004 (JSC::BytecodeGenerator::resolve):
1005 (JSC::BytecodeGenerator::emitDebugHook):
1006 * bytecompiler/BytecodeGenerator.h:
1007 (BytecodeGenerator):
1008 * bytecompiler/NodesCodegen.cpp:
1009 (JSC::ArrayNode::toArgumentList):
1010 (JSC::ApplyFunctionCallDotNode::emitBytecode):
1011 (JSC::ConstStatementNode::emitBytecode):
1012 (JSC::EmptyStatementNode::emitBytecode):
1013 (JSC::DebuggerStatementNode::emitBytecode):
1014 (JSC::ExprStatementNode::emitBytecode):
1015 (JSC::VarStatementNode::emitBytecode):
1016 (JSC::IfNode::emitBytecode):
1017 (JSC::IfElseNode::emitBytecode):
1018 (JSC::DoWhileNode::emitBytecode):
1019 (JSC::WhileNode::emitBytecode):
1020 (JSC::ForNode::emitBytecode):
1021 (JSC::ForInNode::emitBytecode):
1022 (JSC::ContinueNode::emitBytecode):
1023 (JSC::BreakNode::emitBytecode):
1024 (JSC::ReturnNode::emitBytecode):
1025 (JSC::WithNode::emitBytecode):
1026 (JSC::SwitchNode::emitBytecode):
1027 (JSC::LabelNode::emitBytecode):
1028 (JSC::ThrowNode::emitBytecode):
1029 (JSC::TryNode::emitBytecode):
1030 (JSC::ProgramNode::emitBytecode):
1031 (JSC::EvalNode::emitBytecode):
1032 (JSC::FunctionBodyNode::emitBytecode):
1033 * debugger/Debugger.h:
1034 * interpreter/Interpreter.cpp:
1035 (JSC::Interpreter::unwindCallFrame):
1036 (JSC::Interpreter::throwException):
1037 (JSC::Interpreter::debug):
1038 (JSC::Interpreter::privateExecute):
1039 * interpreter/Interpreter.h:
1040 (Interpreter):
1041 * jit/JITOpcodes.cpp:
1042 (JSC::JIT::emit_op_debug):
1043 * jit/JITOpcodes32_64.cpp:
1044 (JSC::JIT::emit_op_debug):
1045 * jit/JITStubs.cpp:
1046 (JSC::DEFINE_STUB_FUNCTION):
1047 * llint/LLIntSlowPaths.cpp:
1048 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1049 * llint/LowLevelInterpreter.asm:
1050 * parser/ASTBuilder.h:
1051 (ASTBuilder):
1052 (JSC::ASTBuilder::createCommaExpr):
1053 (JSC::ASTBuilder::createLogicalNot):
1054 (JSC::ASTBuilder::createUnaryPlus):
1055 (JSC::ASTBuilder::createVoid):
1056 (JSC::ASTBuilder::thisExpr):
1057 (JSC::ASTBuilder::createResolve):
1058 (JSC::ASTBuilder::createObjectLiteral):
1059 (JSC::ASTBuilder::createArray):
1060 (JSC::ASTBuilder::createNumberExpr):
1061 (JSC::ASTBuilder::createString):
1062 (JSC::ASTBuilder::createBoolean):
1063 (JSC::ASTBuilder::createNull):
1064 (JSC::ASTBuilder::createBracketAccess):
1065 (JSC::ASTBuilder::createDotAccess):
1066 (JSC::ASTBuilder::createRegExp):
1067 (JSC::ASTBuilder::createNewExpr):
1068 (JSC::ASTBuilder::createConditionalExpr):
1069 (JSC::ASTBuilder::createAssignResolve):
1070 (JSC::ASTBuilder::createFunctionExpr):
1071 (JSC::ASTBuilder::createFunctionBody):
1072 (JSC::ASTBuilder::createGetterOrSetterProperty):
1073 (JSC::ASTBuilder::createArgumentsList):
1074 (JSC::ASTBuilder::createPropertyList):
1075 (JSC::ASTBuilder::createFuncDeclStatement):
1076 (JSC::ASTBuilder::createBlockStatement):
1077 (JSC::ASTBuilder::createExprStatement):
1078 (JSC::ASTBuilder::createIfStatement):
1079 (JSC::ASTBuilder::createForLoop):
1080 (JSC::ASTBuilder::createForInLoop):
1081 (JSC::ASTBuilder::createEmptyStatement):
1082 (JSC::ASTBuilder::createVarStatement):
1083 (JSC::ASTBuilder::createReturnStatement):
1084 (JSC::ASTBuilder::createBreakStatement):
1085 (JSC::ASTBuilder::createContinueStatement):
1086 (JSC::ASTBuilder::createTryStatement):
1087 (JSC::ASTBuilder::createSwitchStatement):
1088 (JSC::ASTBuilder::createWhileStatement):
1089 (JSC::ASTBuilder::createDoWhileStatement):
1090 (JSC::ASTBuilder::createLabelStatement):
1091 (JSC::ASTBuilder::createWithStatement):
1092 (JSC::ASTBuilder::createThrowStatement):
1093 (JSC::ASTBuilder::createDebugger):
1094 (JSC::ASTBuilder::createConstStatement):
1095 (JSC::ASTBuilder::appendConstDecl):
1096 (JSC::ASTBuilder::combineCommaNodes):
1097 (JSC::ASTBuilder::appendBinaryOperation):
1098 (JSC::ASTBuilder::createAssignment):
1099 (JSC::ASTBuilder::createNumber):
1100 (JSC::ASTBuilder::makeTypeOfNode):
1101 (JSC::ASTBuilder::makeDeleteNode):
1102 (JSC::ASTBuilder::makeNegateNode):
1103 (JSC::ASTBuilder::makeBitwiseNotNode):
1104 (JSC::ASTBuilder::makeMultNode):
1105 (JSC::ASTBuilder::makeDivNode):
1106 (JSC::ASTBuilder::makeModNode):
1107 (JSC::ASTBuilder::makeAddNode):
1108 (JSC::ASTBuilder::makeSubNode):
1109 (JSC::ASTBuilder::makeLeftShiftNode):
1110 (JSC::ASTBuilder::makeRightShiftNode):
1111 (JSC::ASTBuilder::makeURightShiftNode):
1112 (JSC::ASTBuilder::makeBitOrNode):
1113 (JSC::ASTBuilder::makeBitAndNode):
1114 (JSC::ASTBuilder::makeBitXOrNode):
1115 (JSC::ASTBuilder::makeFunctionCallNode):
1116 (JSC::ASTBuilder::makeBinaryNode):
1117 (JSC::ASTBuilder::makeAssignNode):
1118 (JSC::ASTBuilder::makePrefixNode):
1119 (JSC::ASTBuilder::makePostfixNode):
1120 * parser/Lexer.cpp:
1121 (JSC::::setCode):
1122 (JSC::::internalShift):
1123 (JSC::::shift):
1124 (JSC::::lex):
1125 * parser/Lexer.h:
1126 (Lexer):
1127 (JSC::Lexer::currentColumnNumber):
1128 (JSC::::lexExpectIdentifier):
1129 * parser/NodeConstructors.h:
1130 (JSC::Node::Node):
1131 (JSC::ExpressionNode::ExpressionNode):
1132 (JSC::StatementNode::StatementNode):
1133 (JSC::NullNode::NullNode):
1134 (JSC::BooleanNode::BooleanNode):
1135 (JSC::NumberNode::NumberNode):
1136 (JSC::StringNode::StringNode):
1137 (JSC::RegExpNode::RegExpNode):
1138 (JSC::ThisNode::ThisNode):
1139 (JSC::ResolveNode::ResolveNode):
1140 (JSC::ArrayNode::ArrayNode):
1141 (JSC::PropertyListNode::PropertyListNode):
1142 (JSC::ObjectLiteralNode::ObjectLiteralNode):
1143 (JSC::BracketAccessorNode::BracketAccessorNode):
1144 (JSC::DotAccessorNode::DotAccessorNode):
1145 (JSC::ArgumentListNode::ArgumentListNode):
1146 (JSC::NewExprNode::NewExprNode):
1147 (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
1148 (JSC::FunctionCallValueNode::FunctionCallValueNode):
1149 (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
1150 (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
1151 (JSC::FunctionCallDotNode::FunctionCallDotNode):
1152 (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
1153 (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
1154 (JSC::PrePostResolveNode::PrePostResolveNode):
1155 (JSC::PostfixResolveNode::PostfixResolveNode):
1156 (JSC::PostfixBracketNode::PostfixBracketNode):
1157 (JSC::PostfixDotNode::PostfixDotNode):
1158 (JSC::PostfixErrorNode::PostfixErrorNode):
1159 (JSC::DeleteResolveNode::DeleteResolveNode):
1160 (JSC::DeleteBracketNode::DeleteBracketNode):
1161 (JSC::DeleteDotNode::DeleteDotNode):
1162 (JSC::DeleteValueNode::DeleteValueNode):
1163 (JSC::VoidNode::VoidNode):
1164 (JSC::TypeOfResolveNode::TypeOfResolveNode):
1165 (JSC::TypeOfValueNode::TypeOfValueNode):
1166 (JSC::PrefixResolveNode::PrefixResolveNode):
1167 (JSC::PrefixBracketNode::PrefixBracketNode):
1168 (JSC::PrefixDotNode::PrefixDotNode):
1169 (JSC::PrefixErrorNode::PrefixErrorNode):
1170 (JSC::UnaryOpNode::UnaryOpNode):
1171 (JSC::UnaryPlusNode::UnaryPlusNode):
1172 (JSC::NegateNode::NegateNode):
1173 (JSC::BitwiseNotNode::BitwiseNotNode):
1174 (JSC::LogicalNotNode::LogicalNotNode):
1175 (JSC::BinaryOpNode::BinaryOpNode):
1176 (JSC::MultNode::MultNode):
1177 (JSC::DivNode::DivNode):
1178 (JSC::ModNode::ModNode):
1179 (JSC::AddNode::AddNode):
1180 (JSC::SubNode::SubNode):
1181 (JSC::LeftShiftNode::LeftShiftNode):
1182 (JSC::RightShiftNode::RightShiftNode):
1183 (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
1184 (JSC::LessNode::LessNode):
1185 (JSC::GreaterNode::GreaterNode):
1186 (JSC::LessEqNode::LessEqNode):
1187 (JSC::GreaterEqNode::GreaterEqNode):
1188 (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
1189 (JSC::InstanceOfNode::InstanceOfNode):
1190 (JSC::InNode::InNode):
1191 (JSC::EqualNode::EqualNode):
1192 (JSC::NotEqualNode::NotEqualNode):
1193 (JSC::StrictEqualNode::StrictEqualNode):
1194 (JSC::NotStrictEqualNode::NotStrictEqualNode):
1195 (JSC::BitAndNode::BitAndNode):
1196 (JSC::BitOrNode::BitOrNode):
1197 (JSC::BitXOrNode::BitXOrNode):
1198 (JSC::LogicalOpNode::LogicalOpNode):
1199 (JSC::ConditionalNode::ConditionalNode):
1200 (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
1201 (JSC::AssignResolveNode::AssignResolveNode):
1202 (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
1203 (JSC::AssignBracketNode::AssignBracketNode):
1204 (JSC::AssignDotNode::AssignDotNode):
1205 (JSC::ReadModifyDotNode::ReadModifyDotNode):
1206 (JSC::AssignErrorNode::AssignErrorNode):
1207 (JSC::CommaNode::CommaNode):
1208 (JSC::ConstStatementNode::ConstStatementNode):
1209 (JSC::EmptyStatementNode::EmptyStatementNode):
1210 (JSC::DebuggerStatementNode::DebuggerStatementNode):
1211 (JSC::ExprStatementNode::ExprStatementNode):
1212 (JSC::VarStatementNode::VarStatementNode):
1213 (JSC::IfNode::IfNode):
1214 (JSC::IfElseNode::IfElseNode):
1215 (JSC::DoWhileNode::DoWhileNode):
1216 (JSC::WhileNode::WhileNode):
1217 (JSC::ForNode::ForNode):
1218 (JSC::ContinueNode::ContinueNode):
1219 (JSC::BreakNode::BreakNode):
1220 (JSC::ReturnNode::ReturnNode):
1221 (JSC::WithNode::WithNode):
1222 (JSC::LabelNode::LabelNode):
1223 (JSC::ThrowNode::ThrowNode):
1224 (JSC::TryNode::TryNode):
1225 (JSC::FuncExprNode::FuncExprNode):
1226 (JSC::FuncDeclNode::FuncDeclNode):
1227 (JSC::SwitchNode::SwitchNode):
1228 (JSC::ConstDeclNode::ConstDeclNode):
1229 (JSC::BlockNode::BlockNode):
1230 (JSC::ForInNode::ForInNode):
1231 * parser/Nodes.cpp:
1232 (JSC::StatementNode::setLoc):
1233 (JSC):
1234 (JSC::ScopeNode::ScopeNode):
1235 (JSC::ProgramNode::ProgramNode):
1236 (JSC::ProgramNode::create):
1237 (JSC::EvalNode::EvalNode):
1238 (JSC::EvalNode::create):
1239 (JSC::FunctionBodyNode::FunctionBodyNode):
1240 (JSC::FunctionBodyNode::create):
1241 * parser/Nodes.h:
1242 (Node):
1243 (JSC::Node::columnNo):
1244 (ExpressionNode):
1245 (StatementNode):
1246 (JSC::StatementNode::column):
1247 (NullNode):
1248 (BooleanNode):
1249 (NumberNode):
1250 (StringNode):
1251 (RegExpNode):
1252 (ThisNode):
1253 (ResolveNode):
1254 (ArrayNode):
1255 (PropertyListNode):
1256 (ObjectLiteralNode):
1257 (BracketAccessorNode):
1258 (DotAccessorNode):
1259 (ArgumentListNode):
1260 (NewExprNode):
1261 (EvalFunctionCallNode):
1262 (FunctionCallValueNode):
1263 (FunctionCallResolveNode):
1264 (FunctionCallBracketNode):
1265 (FunctionCallDotNode):
1266 (CallFunctionCallDotNode):
1267 (ApplyFunctionCallDotNode):
1268 (PrePostResolveNode):
1269 (PostfixResolveNode):
1270 (PostfixBracketNode):
1271 (PostfixDotNode):
1272 (PostfixErrorNode):
1273 (DeleteResolveNode):
1274 (DeleteBracketNode):
1275 (DeleteDotNode):
1276 (DeleteValueNode):
1277 (VoidNode):
1278 (TypeOfResolveNode):
1279 (TypeOfValueNode):
1280 (PrefixResolveNode):
1281 (PrefixBracketNode):
1282 (PrefixDotNode):
1283 (PrefixErrorNode):
1284 (UnaryOpNode):
1285 (UnaryPlusNode):
1286 (NegateNode):
1287 (BitwiseNotNode):
1288 (LogicalNotNode):
1289 (BinaryOpNode):
1290 (MultNode):
1291 (DivNode):
1292 (ModNode):
1293 (AddNode):
1294 (SubNode):
1295 (LeftShiftNode):
1296 (RightShiftNode):
1297 (UnsignedRightShiftNode):
1298 (LessNode):
1299 (GreaterNode):
1300 (LessEqNode):
1301 (GreaterEqNode):
1302 (ThrowableBinaryOpNode):
1303 (InstanceOfNode):
1304 (InNode):
1305 (EqualNode):
1306 (NotEqualNode):
1307 (StrictEqualNode):
1308 (NotStrictEqualNode):
1309 (BitAndNode):
1310 (BitOrNode):
1311 (BitXOrNode):
1312 (LogicalOpNode):
1313 (ConditionalNode):
1314 (ReadModifyResolveNode):
1315 (AssignResolveNode):
1316 (ReadModifyBracketNode):
1317 (AssignBracketNode):
1318 (AssignDotNode):
1319 (ReadModifyDotNode):
1320 (AssignErrorNode):
1321 (CommaNode):
1322 (ConstDeclNode):
1323 (ConstStatementNode):
1324 (BlockNode):
1325 (EmptyStatementNode):
1326 (DebuggerStatementNode):
1327 (ExprStatementNode):
1328 (VarStatementNode):
1329 (IfNode):
1330 (IfElseNode):
1331 (DoWhileNode):
1332 (WhileNode):
1333 (ForNode):
1334 (ForInNode):
1335 (ContinueNode):
1336 (BreakNode):
1337 (ReturnNode):
1338 (WithNode):
1339 (LabelNode):
1340 (ThrowNode):
1341 (TryNode):
1342 (ScopeNode):
1343 (ProgramNode):
1344 (EvalNode):
1345 (FunctionBodyNode):
1346 (FuncExprNode):
1347 (FuncDeclNode):
1348 (SwitchNode):
1349 * parser/Parser.cpp:
1350 (JSC::::parseSourceElements):
1351 (JSC::::parseVarDeclaration):
1352 (JSC::::parseConstDeclaration):
1353 (JSC::::parseDoWhileStatement):
1354 (JSC::::parseWhileStatement):
1355 (JSC::::parseVarDeclarationList):
1356 (JSC::::parseConstDeclarationList):
1357 (JSC::::parseForStatement):
1358 (JSC::::parseBreakStatement):
1359 (JSC::::parseContinueStatement):
1360 (JSC::::parseReturnStatement):
1361 (JSC::::parseThrowStatement):
1362 (JSC::::parseWithStatement):
1363 (JSC::::parseSwitchStatement):
1364 (JSC::::parseTryStatement):
1365 (JSC::::parseDebuggerStatement):
1366 (JSC::::parseBlockStatement):
1367 (JSC::::parseStatement):
1368 (JSC::::parseFunctionBody):
1369 (JSC::::parseFunctionInfo):
1370 (JSC::::parseFunctionDeclaration):
1371 (JSC::::parseExpressionOrLabelStatement):
1372 (JSC::::parseExpressionStatement):
1373 (JSC::::parseIfStatement):
1374 (JSC::::parseExpression):
1375 (JSC::::parseAssignmentExpression):
1376 (JSC::::parseConditionalExpression):
1377 (JSC::::parseBinaryExpression):
1378 (JSC::::parseProperty):
1379 (JSC::::parseObjectLiteral):
1380 (JSC::::parseStrictObjectLiteral):
1381 (JSC::::parseArrayLiteral):
1382 (JSC::::parsePrimaryExpression):
1383 (JSC::::parseArguments):
1384 (JSC::::parseMemberExpression):
1385 (JSC::::parseUnaryExpression):
1386 * parser/Parser.h:
1387 (JSC::Parser::next):
1388 (JSC::Parser::nextExpectIdentifier):
1389 (JSC::Parser::tokenStart):
1390 (JSC::Parser::tokenLine):
1391 (JSC::Parser::tokenEnd):
1392 (JSC::Parser::tokenLocation):
1393 (Parser):
1394 (JSC::Parser::getTokenName):
1395 (JSC::::parse):
1396 * parser/ParserTokens.h:
1397 (JSC::JSTokenLocation::JSTokenLocation):
1398 (JSTokenLocation):
1399 (JSToken):
1400 * parser/SourceProviderCacheItem.h:
1401 (JSC::SourceProviderCacheItem::closeBraceToken):
1402 * parser/SyntaxChecker.h:
1403 (JSC::SyntaxChecker::makeFunctionCallNode):
1404 (JSC::SyntaxChecker::createCommaExpr):
1405 (JSC::SyntaxChecker::makeAssignNode):
1406 (JSC::SyntaxChecker::makePrefixNode):
1407 (JSC::SyntaxChecker::makePostfixNode):
1408 (JSC::SyntaxChecker::makeTypeOfNode):
1409 (JSC::SyntaxChecker::makeDeleteNode):
1410 (JSC::SyntaxChecker::makeNegateNode):
1411 (JSC::SyntaxChecker::makeBitwiseNotNode):
1412 (JSC::SyntaxChecker::createLogicalNot):
1413 (JSC::SyntaxChecker::createUnaryPlus):
1414 (JSC::SyntaxChecker::createVoid):
1415 (JSC::SyntaxChecker::thisExpr):
1416 (JSC::SyntaxChecker::createResolve):
1417 (JSC::SyntaxChecker::createObjectLiteral):
1418 (JSC::SyntaxChecker::createArray):
1419 (JSC::SyntaxChecker::createNumberExpr):
1420 (JSC::SyntaxChecker::createString):
1421 (JSC::SyntaxChecker::createBoolean):
1422 (JSC::SyntaxChecker::createNull):
1423 (JSC::SyntaxChecker::createBracketAccess):
1424 (JSC::SyntaxChecker::createDotAccess):
1425 (JSC::SyntaxChecker::createRegExp):
1426 (JSC::SyntaxChecker::createNewExpr):
1427 (JSC::SyntaxChecker::createConditionalExpr):
1428 (JSC::SyntaxChecker::createAssignResolve):
1429 (JSC::SyntaxChecker::createFunctionExpr):
1430 (JSC::SyntaxChecker::createFunctionBody):
1431 (JSC::SyntaxChecker::createArgumentsList):
1432 (JSC::SyntaxChecker::createPropertyList):
1433 (JSC::SyntaxChecker::createFuncDeclStatement):
1434 (JSC::SyntaxChecker::createBlockStatement):
1435 (JSC::SyntaxChecker::createExprStatement):
1436 (JSC::SyntaxChecker::createIfStatement):
1437 (JSC::SyntaxChecker::createForLoop):
1438 (JSC::SyntaxChecker::createForInLoop):
1439 (JSC::SyntaxChecker::createEmptyStatement):
1440 (JSC::SyntaxChecker::createVarStatement):
1441 (JSC::SyntaxChecker::createReturnStatement):
1442 (JSC::SyntaxChecker::createBreakStatement):
1443 (JSC::SyntaxChecker::createContinueStatement):
1444 (JSC::SyntaxChecker::createTryStatement):
1445 (JSC::SyntaxChecker::createSwitchStatement):
1446 (JSC::SyntaxChecker::createWhileStatement):
1447 (JSC::SyntaxChecker::createWithStatement):
1448 (JSC::SyntaxChecker::createDoWhileStatement):
1449 (JSC::SyntaxChecker::createLabelStatement):
1450 (JSC::SyntaxChecker::createThrowStatement):
1451 (JSC::SyntaxChecker::createDebugger):
1452 (JSC::SyntaxChecker::createConstStatement):
1453 (JSC::SyntaxChecker::appendConstDecl):
1454 (JSC::SyntaxChecker::createGetterOrSetterProperty):
1455 (JSC::SyntaxChecker::combineCommaNodes):
1456 (JSC::SyntaxChecker::operatorStackPop):
1457
fpizlo@apple.com8ab9c432012-08-03 21:41:05 +0000[diff] [blame]14582012-08-03 Filip Pizlo <fpizlo@apple.com>
1459
fpizlo@apple.com63dda942012-08-04 01:01:27 +0000[diff] [blame]1460 Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
1461 https://bugs.webkit.org/show_bug.cgi?id=92691
1462
1463 Reviewed by Mark Hahnenberg.
1464
1465 The state of the stubs was changing after we determined the type (by virtue of the slow path
1466 function that was called), since the get or put (in this case put) could cause arbitrary
1467 side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
1468 function to determine what to do, but an easier fix for now is to have the slow path give up
1469 if its assumptions were invalidated by a side effect.
1470
1471 * dfg/DFGOperations.cpp:
1472 * jit/JITStubs.cpp:
1473 (JSC::DEFINE_STUB_FUNCTION):
1474
14752012-08-03 Filip Pizlo <fpizlo@apple.com>
1476
fpizlo@apple.come4a4d792012-08-03 22:42:29 +0000[diff] [blame]1477 DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
1478 https://bugs.webkit.org/show_bug.cgi?id=93162
1479
1480 Reviewed by Mark Hahnenberg.
1481
1482 This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
1483 by a ForceOSRExit if the value profile had no data.
1484
1485 * dfg/DFGByteCodeParser.cpp:
1486 (JSC::DFG::ByteCodeParser::parseBlock):
1487
14882012-08-03 Filip Pizlo <fpizlo@apple.com>
1489
fpizlo@apple.com8ab9c432012-08-03 21:41:05 +0000[diff] [blame]1490 DFG::StructureCheckHoistingPhase keeps a Node& around for too long
1491 https://bugs.webkit.org/show_bug.cgi?id=93157
1492
1493 Reviewed by Mark Hahnenberg.
1494
1495 * dfg/DFGStructureCheckHoistingPhase.cpp:
1496 (JSC::DFG::StructureCheckHoistingPhase::run):
1497
paroga@webkit.org438d93a2012-08-03 05:06:38 +0000[diff] [blame]14982012-08-02 Patrick Gansterer <paroga@webkit.org>
1499
1500 Move getLocalTime() as static inline function to DateMath
1501 https://bugs.webkit.org/show_bug.cgi?id=92955
1502
1503 Reviewed by Ryosuke Niwa.
1504
1505 getCurrentLocalTime() and getLocalTime() has been superseded with the
1506 GregorianDateTime class. So we can move it into DateMath.cpp as an static inline
1507 function. This allows us to remove the dependecy on time() and localtime()
1508 for Windows CE, where this functions require the ce_time library to work.
1509
1510 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1511
fpizlo@apple.com3088f182012-08-02 21:10:43 +0000[diff] [blame]15122012-08-02 Filip Pizlo <fpizlo@apple.com>
1513
fpizlo@apple.com978a0eb2012-08-03 03:27:08 +0000[diff] [blame]1514 ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
1515 https://bugs.webkit.org/show_bug.cgi?id=91074
1516
1517 Reviewed by Mark Hahnenberg.
1518
1519 Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
1520 CFA had proven shouldn't be performed, leading to asserts that a node should not have
1521 exit sites. This is a debug-only assert with no release symptom - we were just emitting
1522 a check that was not reachable.
1523
1524 Also found, and fixed, a bug where structure check hoisting was slightly confusing the
1525 CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
1526 would make the backend happy - but the CFA would produce subtly wrong results.
1527
1528 * bytecode/SpeculatedType.h:
1529 (JSC::isOtherOrEmptySpeculation):
1530 (JSC):
1531 * dfg/DFGDriver.cpp:
1532 (JSC::DFG::compile):
1533 * dfg/DFGGraph.cpp:
1534 (JSC::DFG::Graph::dump):
1535 * dfg/DFGSpeculativeJIT64.cpp:
1536 (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
1537 (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
1538
15392012-08-02 Filip Pizlo <fpizlo@apple.com>
1540
fpizlo@apple.com3088f182012-08-02 21:10:43 +0000[diff] [blame]1541 Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
1542
1543 * dfg/DFGStructureCheckHoistingPhase.cpp:
1544 (JSC::DFG::StructureCheckHoistingPhase::run):
1545
mhahnenberg@apple.com85c200b2012-08-02 17:32:35 +0000[diff] [blame]15462012-08-01 Mark Hahnenberg <mhahnenberg@apple.com>
1547
1548 Remove all uses of ClassInfo for JSStrings in JIT code
1549 https://bugs.webkit.org/show_bug.cgi?id=92935
1550
1551 Reviewed by Geoffrey Garen.
1552
1553 This is the first step in removing our dependence on in-object ClassInfo pointers
1554 in JIT code. Most of the changes are to check the Structure, which is unique for
1555 JSString primitives.
1556
1557 * bytecode/SpeculatedType.cpp:
1558 (JSC::speculationFromClassInfo):
1559 (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
1560 since there wasn't a JSGlobalData immediately available to grab the JSString
1561 Structure out of.
1562 * dfg/DFGSpeculativeJIT.cpp:
1563 (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
1564 * dfg/DFGSpeculativeJIT32_64.cpp:
1565 (JSC::DFG::SpeculativeJIT::compile):
1566 * dfg/DFGSpeculativeJIT64.cpp:
1567 (JSC::DFG::SpeculativeJIT::compile):
1568 * jit/JITInlineMethods.h:
1569 (JSC::JIT::emitLoadCharacterString):
1570 * jit/JITOpcodes.cpp:
1571 (JSC::JIT::privateCompileCTIMachineTrampolines):
1572 (JSC::JIT::emit_op_to_primitive):
1573 (JSC::JIT::emit_op_convert_this):
1574 * jit/JITOpcodes32_64.cpp:
1575 (JSC::JIT::privateCompileCTIMachineTrampolines):
1576 (JSC::JIT::emit_op_to_primitive):
1577 (JSC::JIT::emitSlow_op_eq):
1578 (JSC::JIT::emitSlow_op_neq):
1579 (JSC::JIT::compileOpStrictEq):
1580 (JSC::JIT::emit_op_convert_this):
1581 * jit/JITPropertyAccess.cpp:
1582 (JSC::JIT::stringGetByValStubGenerator):
1583 (JSC::JIT::emitSlow_op_get_by_val):
1584 * jit/JITPropertyAccess32_64.cpp:
1585 (JSC::JIT::stringGetByValStubGenerator):
1586 (JSC::JIT::emitSlow_op_get_by_val):
1587 * jit/SpecializedThunkJIT.h:
1588 (JSC::SpecializedThunkJIT::loadJSStringArgument):
1589 * jit/ThunkGenerators.cpp:
1590 (JSC::stringCharLoad):
1591 (JSC::charCodeAtThunkGenerator):
1592 (JSC::charAtThunkGenerator):
1593
fpizlo@apple.com58ec4b02012-08-02 08:22:57 +0000[diff] [blame]15942012-08-02 Filip Pizlo <fpizlo@apple.com>
1595
fpizlo@apple.com470cde52012-08-02 08:27:48 +0000[diff] [blame]1596 Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
1597 in a method signature is painfully redundant.
1598
1599 * dfg/DFGSpeculativeJIT.h:
1600 (SpeculativeJIT):
1601
16022012-08-02 Filip Pizlo <fpizlo@apple.com>
1603
fpizlo@apple.com58ec4b02012-08-02 08:22:57 +0000[diff] [blame]1604 DFGSpeculativeJIT.h has too many inline method bodies
1605 https://bugs.webkit.org/show_bug.cgi?id=92957
1606
1607 Reviewed by Antti Koivisto.
1608
1609 * dfg/DFGSpeculativeJIT.cpp:
1610 (JSC::DFG::SpeculativeJIT::speculationCheck):
1611 (DFG):
1612 (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
1613 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
1614 (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
1615 (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
1616 (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
1617 * dfg/DFGSpeculativeJIT.h:
1618 (SpeculativeJIT):
1619
commit-queue@webkit.org709de8f2012-08-02 06:44:46 +0000[diff] [blame]16202012-08-01 Sheriff Bot <webkit.review.bot@gmail.com>
1621
1622 Unreviewed, rolling out r124406.
1623 http://trac.webkit.org/changeset/124406
1624 https://bugs.webkit.org/show_bug.cgi?id=92951
1625
1626 it set the Mac bots on fire (Requested by pizlo on #webkit).
1627
1628 * bytecode/Opcode.h:
1629 (JSC):
1630 (JSC::padOpcodeName):
1631 * bytecompiler/BytecodeGenerator.cpp:
1632 (JSC::BytecodeGenerator::emitDebugHook):
1633 * bytecompiler/BytecodeGenerator.h:
1634 (BytecodeGenerator):
1635 * bytecompiler/NodesCodegen.cpp:
1636 (JSC::ArrayNode::toArgumentList):
1637 (JSC::ApplyFunctionCallDotNode::emitBytecode):
1638 (JSC::ConditionalNode::emitBytecode):
1639 (JSC::ConstStatementNode::emitBytecode):
1640 (JSC::EmptyStatementNode::emitBytecode):
1641 (JSC::DebuggerStatementNode::emitBytecode):
1642 (JSC::ExprStatementNode::emitBytecode):
1643 (JSC::VarStatementNode::emitBytecode):
1644 (JSC::IfNode::emitBytecode):
1645 (JSC::IfElseNode::emitBytecode):
1646 (JSC::DoWhileNode::emitBytecode):
1647 (JSC::WhileNode::emitBytecode):
1648 (JSC::ForNode::emitBytecode):
1649 (JSC::ForInNode::emitBytecode):
1650 (JSC::ContinueNode::emitBytecode):
1651 (JSC::BreakNode::emitBytecode):
1652 (JSC::ReturnNode::emitBytecode):
1653 (JSC::WithNode::emitBytecode):
1654 (JSC::SwitchNode::emitBytecode):
1655 (JSC::LabelNode::emitBytecode):
1656 (JSC::ThrowNode::emitBytecode):
1657 (JSC::TryNode::emitBytecode):
1658 (JSC::ProgramNode::emitBytecode):
1659 (JSC::EvalNode::emitBytecode):
1660 (JSC::FunctionBodyNode::emitBytecode):
1661 * debugger/Debugger.h:
1662 * interpreter/Interpreter.cpp:
1663 (JSC::Interpreter::unwindCallFrame):
1664 (JSC::Interpreter::throwException):
1665 (JSC::Interpreter::debug):
1666 * interpreter/Interpreter.h:
1667 (Interpreter):
1668 * jit/JITOpcodes.cpp:
1669 (JSC::JIT::emit_op_debug):
1670 * jit/JITOpcodes32_64.cpp:
1671 (JSC::JIT::emit_op_debug):
1672 * jit/JITStubs.cpp:
1673 (JSC::DEFINE_STUB_FUNCTION):
1674 * llint/LLIntSlowPaths.cpp:
1675 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1676 * parser/ASTBuilder.h:
1677 (ASTBuilder):
1678 (JSC::ASTBuilder::createCommaExpr):
1679 (JSC::ASTBuilder::createLogicalNot):
1680 (JSC::ASTBuilder::createUnaryPlus):
1681 (JSC::ASTBuilder::createVoid):
1682 (JSC::ASTBuilder::thisExpr):
1683 (JSC::ASTBuilder::createResolve):
1684 (JSC::ASTBuilder::createObjectLiteral):
1685 (JSC::ASTBuilder::createArray):
1686 (JSC::ASTBuilder::createNumberExpr):
1687 (JSC::ASTBuilder::createString):
1688 (JSC::ASTBuilder::createBoolean):
1689 (JSC::ASTBuilder::createNull):
1690 (JSC::ASTBuilder::createBracketAccess):
1691 (JSC::ASTBuilder::createDotAccess):
1692 (JSC::ASTBuilder::createRegExp):
1693 (JSC::ASTBuilder::createNewExpr):
1694 (JSC::ASTBuilder::createConditionalExpr):
1695 (JSC::ASTBuilder::createAssignResolve):
1696 (JSC::ASTBuilder::createFunctionExpr):
1697 (JSC::ASTBuilder::createFunctionBody):
1698 (JSC::ASTBuilder::createGetterOrSetterProperty):
1699 (JSC::ASTBuilder::createArgumentsList):
1700 (JSC::ASTBuilder::createPropertyList):
1701 (JSC::ASTBuilder::createFuncDeclStatement):
1702 (JSC::ASTBuilder::createBlockStatement):
1703 (JSC::ASTBuilder::createExprStatement):
1704 (JSC::ASTBuilder::createIfStatement):
1705 (JSC::ASTBuilder::createForLoop):
1706 (JSC::ASTBuilder::createForInLoop):
1707 (JSC::ASTBuilder::createEmptyStatement):
1708 (JSC::ASTBuilder::createVarStatement):
1709 (JSC::ASTBuilder::createReturnStatement):
1710 (JSC::ASTBuilder::createBreakStatement):
1711 (JSC::ASTBuilder::createContinueStatement):
1712 (JSC::ASTBuilder::createTryStatement):
1713 (JSC::ASTBuilder::createSwitchStatement):
1714 (JSC::ASTBuilder::createWhileStatement):
1715 (JSC::ASTBuilder::createDoWhileStatement):
1716 (JSC::ASTBuilder::createLabelStatement):
1717 (JSC::ASTBuilder::createWithStatement):
1718 (JSC::ASTBuilder::createThrowStatement):
1719 (JSC::ASTBuilder::createDebugger):
1720 (JSC::ASTBuilder::createConstStatement):
1721 (JSC::ASTBuilder::appendConstDecl):
1722 (JSC::ASTBuilder::combineCommaNodes):
1723 (JSC::ASTBuilder::appendBinaryOperation):
1724 (JSC::ASTBuilder::createAssignment):
1725 (JSC::ASTBuilder::createNumber):
1726 (JSC::ASTBuilder::makeTypeOfNode):
1727 (JSC::ASTBuilder::makeDeleteNode):
1728 (JSC::ASTBuilder::makeNegateNode):
1729 (JSC::ASTBuilder::makeBitwiseNotNode):
1730 (JSC::ASTBuilder::makeMultNode):
1731 (JSC::ASTBuilder::makeDivNode):
1732 (JSC::ASTBuilder::makeModNode):
1733 (JSC::ASTBuilder::makeAddNode):
1734 (JSC::ASTBuilder::makeSubNode):
1735 (JSC::ASTBuilder::makeLeftShiftNode):
1736 (JSC::ASTBuilder::makeRightShiftNode):
1737 (JSC::ASTBuilder::makeURightShiftNode):
1738 (JSC::ASTBuilder::makeBitOrNode):
1739 (JSC::ASTBuilder::makeBitAndNode):
1740 (JSC::ASTBuilder::makeBitXOrNode):
1741 (JSC::ASTBuilder::makeFunctionCallNode):
1742 (JSC::ASTBuilder::makeBinaryNode):
1743 (JSC::ASTBuilder::makeAssignNode):
1744 (JSC::ASTBuilder::makePrefixNode):
1745 (JSC::ASTBuilder::makePostfixNode):
1746 * parser/Lexer.cpp:
1747 (JSC::::setCode):
1748 (JSC::::internalShift):
1749 (JSC::::shift):
1750 (JSC::::lex):
1751 * parser/Lexer.h:
1752 (Lexer):
1753 (JSC::::lexExpectIdentifier):
1754 * parser/NodeConstructors.h:
1755 (JSC::Node::Node):
1756 (JSC::ExpressionNode::ExpressionNode):
1757 (JSC::StatementNode::StatementNode):
1758 (JSC::NullNode::NullNode):
1759 (JSC::BooleanNode::BooleanNode):
1760 (JSC::NumberNode::NumberNode):
1761 (JSC::StringNode::StringNode):
1762 (JSC::RegExpNode::RegExpNode):
1763 (JSC::ThisNode::ThisNode):
1764 (JSC::ResolveNode::ResolveNode):
1765 (JSC::ArrayNode::ArrayNode):
1766 (JSC::PropertyListNode::PropertyListNode):
1767 (JSC::ObjectLiteralNode::ObjectLiteralNode):
1768 (JSC::BracketAccessorNode::BracketAccessorNode):
1769 (JSC::DotAccessorNode::DotAccessorNode):
1770 (JSC::ArgumentListNode::ArgumentListNode):
1771 (JSC::NewExprNode::NewExprNode):
1772 (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
1773 (JSC::FunctionCallValueNode::FunctionCallValueNode):
1774 (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
1775 (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
1776 (JSC::FunctionCallDotNode::FunctionCallDotNode):
1777 (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
1778 (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
1779 (JSC::PrePostResolveNode::PrePostResolveNode):
1780 (JSC::PostfixResolveNode::PostfixResolveNode):
1781 (JSC::PostfixBracketNode::PostfixBracketNode):
1782 (JSC::PostfixDotNode::PostfixDotNode):
1783 (JSC::PostfixErrorNode::PostfixErrorNode):
1784 (JSC::DeleteResolveNode::DeleteResolveNode):
1785 (JSC::DeleteBracketNode::DeleteBracketNode):
1786 (JSC::DeleteDotNode::DeleteDotNode):
1787 (JSC::DeleteValueNode::DeleteValueNode):
1788 (JSC::VoidNode::VoidNode):
1789 (JSC::TypeOfResolveNode::TypeOfResolveNode):
1790 (JSC::TypeOfValueNode::TypeOfValueNode):
1791 (JSC::PrefixResolveNode::PrefixResolveNode):
1792 (JSC::PrefixBracketNode::PrefixBracketNode):
1793 (JSC::PrefixDotNode::PrefixDotNode):
1794 (JSC::PrefixErrorNode::PrefixErrorNode):
1795 (JSC::UnaryOpNode::UnaryOpNode):
1796 (JSC::UnaryPlusNode::UnaryPlusNode):
1797 (JSC::NegateNode::NegateNode):
1798 (JSC::BitwiseNotNode::BitwiseNotNode):
1799 (JSC::LogicalNotNode::LogicalNotNode):
1800 (JSC::BinaryOpNode::BinaryOpNode):
1801 (JSC::MultNode::MultNode):
1802 (JSC::DivNode::DivNode):
1803 (JSC::ModNode::ModNode):
1804 (JSC::AddNode::AddNode):
1805 (JSC::SubNode::SubNode):
1806 (JSC::LeftShiftNode::LeftShiftNode):
1807 (JSC::RightShiftNode::RightShiftNode):
1808 (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
1809 (JSC::LessNode::LessNode):
1810 (JSC::GreaterNode::GreaterNode):
1811 (JSC::LessEqNode::LessEqNode):
1812 (JSC::GreaterEqNode::GreaterEqNode):
1813 (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
1814 (JSC::InstanceOfNode::InstanceOfNode):
1815 (JSC::InNode::InNode):
1816 (JSC::EqualNode::EqualNode):
1817 (JSC::NotEqualNode::NotEqualNode):
1818 (JSC::StrictEqualNode::StrictEqualNode):
1819 (JSC::NotStrictEqualNode::NotStrictEqualNode):
1820 (JSC::BitAndNode::BitAndNode):
1821 (JSC::BitOrNode::BitOrNode):
1822 (JSC::BitXOrNode::BitXOrNode):
1823 (JSC::LogicalOpNode::LogicalOpNode):
1824 (JSC::ConditionalNode::ConditionalNode):
1825 (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
1826 (JSC::AssignResolveNode::AssignResolveNode):
1827 (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
1828 (JSC::AssignBracketNode::AssignBracketNode):
1829 (JSC::AssignDotNode::AssignDotNode):
1830 (JSC::ReadModifyDotNode::ReadModifyDotNode):
1831 (JSC::AssignErrorNode::AssignErrorNode):
1832 (JSC::CommaNode::CommaNode):
1833 (JSC::ConstStatementNode::ConstStatementNode):
1834 (JSC::EmptyStatementNode::EmptyStatementNode):
1835 (JSC::DebuggerStatementNode::DebuggerStatementNode):
1836 (JSC::ExprStatementNode::ExprStatementNode):
1837 (JSC::VarStatementNode::VarStatementNode):
1838 (JSC::IfNode::IfNode):
1839 (JSC::IfElseNode::IfElseNode):
1840 (JSC::DoWhileNode::DoWhileNode):
1841 (JSC::WhileNode::WhileNode):
1842 (JSC::ForNode::ForNode):
1843 (JSC::ContinueNode::ContinueNode):
1844 (JSC::BreakNode::BreakNode):
1845 (JSC::ReturnNode::ReturnNode):
1846 (JSC::WithNode::WithNode):
1847 (JSC::LabelNode::LabelNode):
1848 (JSC::ThrowNode::ThrowNode):
1849 (JSC::TryNode::TryNode):
1850 (JSC::FuncExprNode::FuncExprNode):
1851 (JSC::FuncDeclNode::FuncDeclNode):
1852 (JSC::SwitchNode::SwitchNode):
1853 (JSC::ConstDeclNode::ConstDeclNode):
1854 (JSC::BlockNode::BlockNode):
1855 (JSC::ForInNode::ForInNode):
1856 * parser/Nodes.cpp:
1857 (JSC):
1858 (JSC::StatementNode::setLoc):
1859 (JSC::ScopeNode::ScopeNode):
1860 (JSC::ProgramNode::ProgramNode):
1861 (JSC::ProgramNode::create):
1862 (JSC::EvalNode::EvalNode):
1863 (JSC::EvalNode::create):
1864 (JSC::FunctionBodyNode::FunctionBodyNode):
1865 (JSC::FunctionBodyNode::create):
1866 * parser/Nodes.h:
1867 (Node):
1868 (ExpressionNode):
1869 (StatementNode):
1870 (NullNode):
1871 (BooleanNode):
1872 (NumberNode):
1873 (StringNode):
1874 (RegExpNode):
1875 (ThisNode):
1876 (ResolveNode):
1877 (ArrayNode):
1878 (PropertyListNode):
1879 (ObjectLiteralNode):
1880 (BracketAccessorNode):
1881 (DotAccessorNode):
1882 (ArgumentListNode):
1883 (NewExprNode):
1884 (EvalFunctionCallNode):
1885 (FunctionCallValueNode):
1886 (FunctionCallResolveNode):
1887 (FunctionCallBracketNode):
1888 (FunctionCallDotNode):
1889 (CallFunctionCallDotNode):
1890 (ApplyFunctionCallDotNode):
1891 (PrePostResolveNode):
1892 (PostfixResolveNode):
1893 (PostfixBracketNode):
1894 (PostfixDotNode):
1895 (PostfixErrorNode):
1896 (DeleteResolveNode):
1897 (DeleteBracketNode):
1898 (DeleteDotNode):
1899 (DeleteValueNode):
1900 (VoidNode):
1901 (TypeOfResolveNode):
1902 (TypeOfValueNode):
1903 (PrefixResolveNode):
1904 (PrefixBracketNode):
1905 (PrefixDotNode):
1906 (PrefixErrorNode):
1907 (UnaryOpNode):
1908 (UnaryPlusNode):
1909 (NegateNode):
1910 (BitwiseNotNode):
1911 (LogicalNotNode):
1912 (BinaryOpNode):
1913 (MultNode):
1914 (DivNode):
1915 (ModNode):
1916 (AddNode):
1917 (SubNode):
1918 (LeftShiftNode):
1919 (RightShiftNode):
1920 (UnsignedRightShiftNode):
1921 (LessNode):
1922 (GreaterNode):
1923 (LessEqNode):
1924 (GreaterEqNode):
1925 (ThrowableBinaryOpNode):
1926 (InstanceOfNode):
1927 (InNode):
1928 (EqualNode):
1929 (NotEqualNode):
1930 (StrictEqualNode):
1931 (NotStrictEqualNode):
1932 (BitAndNode):
1933 (BitOrNode):
1934 (BitXOrNode):
1935 (LogicalOpNode):
1936 (ConditionalNode):
1937 (ReadModifyResolveNode):
1938 (AssignResolveNode):
1939 (ReadModifyBracketNode):
1940 (AssignBracketNode):
1941 (AssignDotNode):
1942 (ReadModifyDotNode):
1943 (AssignErrorNode):
1944 (CommaNode):
1945 (ConstDeclNode):
1946 (ConstStatementNode):
1947 (BlockNode):
1948 (EmptyStatementNode):
1949 (DebuggerStatementNode):
1950 (ExprStatementNode):
1951 (VarStatementNode):
1952 (IfNode):
1953 (IfElseNode):
1954 (DoWhileNode):
1955 (WhileNode):
1956 (ForNode):
1957 (ForInNode):
1958 (ContinueNode):
1959 (BreakNode):
1960 (ReturnNode):
1961 (WithNode):
1962 (LabelNode):
1963 (ThrowNode):
1964 (TryNode):
1965 (ScopeNode):
1966 (ProgramNode):
1967 (EvalNode):
1968 (FunctionBodyNode):
1969 (FuncExprNode):
1970 (FuncDeclNode):
1971 (SwitchNode):
1972 * parser/Parser.cpp:
1973 (JSC::::parseSourceElements):
1974 (JSC::::parseVarDeclaration):
1975 (JSC::::parseConstDeclaration):
1976 (JSC::::parseDoWhileStatement):
1977 (JSC::::parseWhileStatement):
1978 (JSC::::parseVarDeclarationList):
1979 (JSC::::parseConstDeclarationList):
1980 (JSC::::parseForStatement):
1981 (JSC::::parseBreakStatement):
1982 (JSC::::parseContinueStatement):
1983 (JSC::::parseReturnStatement):
1984 (JSC::::parseThrowStatement):
1985 (JSC::::parseWithStatement):
1986 (JSC::::parseSwitchStatement):
1987 (JSC::::parseTryStatement):
1988 (JSC::::parseDebuggerStatement):
1989 (JSC::::parseBlockStatement):
1990 (JSC::::parseStatement):
1991 (JSC::::parseFunctionBody):
1992 (JSC::::parseFunctionInfo):
1993 (JSC::::parseFunctionDeclaration):
1994 (JSC::::parseExpressionOrLabelStatement):
1995 (JSC::::parseExpressionStatement):
1996 (JSC::::parseIfStatement):
1997 (JSC::::parseExpression):
1998 (JSC::::parseAssignmentExpression):
1999 (JSC::::parseConditionalExpression):
2000 (JSC::::parseBinaryExpression):
2001 (JSC::::parseProperty):
2002 (JSC::::parseObjectLiteral):
2003 (JSC::::parseStrictObjectLiteral):
2004 (JSC::::parseArrayLiteral):
2005 (JSC::::parsePrimaryExpression):
2006 (JSC::::parseArguments):
2007 (JSC::::parseMemberExpression):
2008 (JSC::::parseUnaryExpression):
2009 * parser/Parser.h:
2010 (JSC::Parser::next):
2011 (JSC::Parser::nextExpectIdentifier):
2012 (JSC::Parser::tokenStart):
2013 (JSC::Parser::tokenLine):
2014 (JSC::Parser::tokenEnd):
2015 (JSC::Parser::getTokenName):
2016 (JSC::::parse):
2017 * parser/ParserTokens.h:
2018 (JSC::JSTokenInfo::JSTokenInfo):
2019 (JSTokenInfo):
2020 (JSToken):
2021 * parser/SourceProviderCacheItem.h:
2022 (JSC::SourceProviderCacheItem::closeBraceToken):
2023 * parser/SyntaxChecker.h:
2024 (JSC::SyntaxChecker::makeFunctionCallNode):
2025 (JSC::SyntaxChecker::createCommaExpr):
2026 (JSC::SyntaxChecker::makeAssignNode):
2027 (JSC::SyntaxChecker::makePrefixNode):
2028 (JSC::SyntaxChecker::makePostfixNode):
2029 (JSC::SyntaxChecker::makeTypeOfNode):
2030 (JSC::SyntaxChecker::makeDeleteNode):
2031 (JSC::SyntaxChecker::makeNegateNode):
2032 (JSC::SyntaxChecker::makeBitwiseNotNode):
2033 (JSC::SyntaxChecker::createLogicalNot):
2034 (JSC::SyntaxChecker::createUnaryPlus):
2035 (JSC::SyntaxChecker::createVoid):
2036 (JSC::SyntaxChecker::thisExpr):
2037 (JSC::SyntaxChecker::createResolve):
2038 (JSC::SyntaxChecker::createObjectLiteral):
2039 (JSC::SyntaxChecker::createArray):
2040 (JSC::SyntaxChecker::createNumberExpr):
2041 (JSC::SyntaxChecker::createString):
2042 (JSC::SyntaxChecker::createBoolean):
2043 (JSC::SyntaxChecker::createNull):
2044 (JSC::SyntaxChecker::createBracketAccess):
2045 (JSC::SyntaxChecker::createDotAccess):
2046 (JSC::SyntaxChecker::createRegExp):
2047 (JSC::SyntaxChecker::createNewExpr):
2048 (JSC::SyntaxChecker::createConditionalExpr):
2049 (JSC::SyntaxChecker::createAssignResolve):
2050 (JSC::SyntaxChecker::createFunctionExpr):
2051 (JSC::SyntaxChecker::createFunctionBody):
2052 (JSC::SyntaxChecker::createArgumentsList):
2053 (JSC::SyntaxChecker::createPropertyList):
2054 (JSC::SyntaxChecker::createFuncDeclStatement):
2055 (JSC::SyntaxChecker::createBlockStatement):
2056 (JSC::SyntaxChecker::createExprStatement):
2057 (JSC::SyntaxChecker::createIfStatement):
2058 (JSC::SyntaxChecker::createForLoop):
2059 (JSC::SyntaxChecker::createForInLoop):
2060 (JSC::SyntaxChecker::createEmptyStatement):
2061 (JSC::SyntaxChecker::createVarStatement):
2062 (JSC::SyntaxChecker::createReturnStatement):
2063 (JSC::SyntaxChecker::createBreakStatement):
2064 (JSC::SyntaxChecker::createContinueStatement):
2065 (JSC::SyntaxChecker::createTryStatement):
2066 (JSC::SyntaxChecker::createSwitchStatement):
2067 (JSC::SyntaxChecker::createWhileStatement):
2068 (JSC::SyntaxChecker::createWithStatement):
2069 (JSC::SyntaxChecker::createDoWhileStatement):
2070 (JSC::SyntaxChecker::createLabelStatement):
2071 (JSC::SyntaxChecker::createThrowStatement):
2072 (JSC::SyntaxChecker::createDebugger):
2073 (JSC::SyntaxChecker::createConstStatement):
2074 (JSC::SyntaxChecker::appendConstDecl):
2075 (JSC::SyntaxChecker::createGetterOrSetterProperty):
2076 (JSC::SyntaxChecker::combineCommaNodes):
2077 (JSC::SyntaxChecker::operatorStackPop):
2078
commit-queue@webkit.org3772d072012-08-02 04:49:25 +0000[diff] [blame]20792012-08-01 Peter Wang <peter.wang@torchmobile.com.cn>
2080
2081 Web Inspector: [JSC] implement setting breakpoints by line:column
2082 https://bugs.webkit.org/show_bug.cgi?id=53003
2083
2084 Reviewed by Geoffrey Garen.
2085
2086 Add a counter in lexer to record the column of each token. Debugger will use column info
2087 in "Pretty Print" debug mode of Inspector.
2088
2089 * bytecode/Opcode.h:
2090 (JSC):
2091 (JSC::padOpcodeName):
2092 * bytecompiler/BytecodeGenerator.cpp:
2093 (JSC::BytecodeGenerator::emitDebugHook):
2094 * bytecompiler/BytecodeGenerator.h:
2095 (BytecodeGenerator):
2096 * bytecompiler/NodesCodegen.cpp:
2097 (JSC::ArrayNode::toArgumentList):
2098 (JSC::ApplyFunctionCallDotNode::emitBytecode):
2099 (JSC::ConditionalNode::emitBytecode):
2100 (JSC::ConstStatementNode::emitBytecode):
2101 (JSC::EmptyStatementNode::emitBytecode):
2102 (JSC::DebuggerStatementNode::emitBytecode):
2103 (JSC::ExprStatementNode::emitBytecode):
2104 (JSC::VarStatementNode::emitBytecode):
2105 (JSC::IfNode::emitBytecode):
2106 (JSC::IfElseNode::emitBytecode):
2107 (JSC::DoWhileNode::emitBytecode):
2108 (JSC::WhileNode::emitBytecode):
2109 (JSC::ForNode::emitBytecode):
2110 (JSC::ForInNode::emitBytecode):
2111 (JSC::ContinueNode::emitBytecode):
2112 (JSC::BreakNode::emitBytecode):
2113 (JSC::ReturnNode::emitBytecode):
2114 (JSC::WithNode::emitBytecode):
2115 (JSC::SwitchNode::emitBytecode):
2116 (JSC::LabelNode::emitBytecode):
2117 (JSC::ThrowNode::emitBytecode):
2118 (JSC::TryNode::emitBytecode):
2119 (JSC::ProgramNode::emitBytecode):
2120 (JSC::EvalNode::emitBytecode):
2121 (JSC::FunctionBodyNode::emitBytecode):
2122 * debugger/Debugger.h:
2123 * interpreter/Interpreter.cpp:
2124 (JSC::Interpreter::unwindCallFrame):
2125 (JSC::Interpreter::throwException):
2126 (JSC::Interpreter::debug):
2127 * interpreter/Interpreter.h:
2128 (Interpreter):
2129 * jit/JITOpcodes.cpp:
2130 (JSC::JIT::emit_op_debug):
2131 * jit/JITOpcodes32_64.cpp:
2132 (JSC::JIT::emit_op_debug):
2133 * jit/JITStubs.cpp:
2134 (JSC::DEFINE_STUB_FUNCTION):
2135 * llint/LLIntSlowPaths.cpp:
2136 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2137 * parser/ASTBuilder.h:
2138 (ASTBuilder):
2139 (JSC::ASTBuilder::createCommaExpr):
2140 (JSC::ASTBuilder::createLogicalNot):
2141 (JSC::ASTBuilder::createUnaryPlus):
2142 (JSC::ASTBuilder::createVoid):
2143 (JSC::ASTBuilder::thisExpr):
2144 (JSC::ASTBuilder::createResolve):
2145 (JSC::ASTBuilder::createObjectLiteral):
2146 (JSC::ASTBuilder::createArray):
2147 (JSC::ASTBuilder::createNumberExpr):
2148 (JSC::ASTBuilder::createString):
2149 (JSC::ASTBuilder::createBoolean):
2150 (JSC::ASTBuilder::createNull):
2151 (JSC::ASTBuilder::createBracketAccess):
2152 (JSC::ASTBuilder::createDotAccess):
2153 (JSC::ASTBuilder::createRegExp):
2154 (JSC::ASTBuilder::createNewExpr):
2155 (JSC::ASTBuilder::createConditionalExpr):
2156 (JSC::ASTBuilder::createAssignResolve):
2157 (JSC::ASTBuilder::createFunctionExpr):
2158 (JSC::ASTBuilder::createFunctionBody):
2159 (JSC::ASTBuilder::createGetterOrSetterProperty):
2160 (JSC::ASTBuilder::createArgumentsList):
2161 (JSC::ASTBuilder::createPropertyList):
2162 (JSC::ASTBuilder::createFuncDeclStatement):
2163 (JSC::ASTBuilder::createBlockStatement):
2164 (JSC::ASTBuilder::createExprStatement):
2165 (JSC::ASTBuilder::createIfStatement):
2166 (JSC::ASTBuilder::createForLoop):
2167 (JSC::ASTBuilder::createForInLoop):
2168 (JSC::ASTBuilder::createEmptyStatement):
2169 (JSC::ASTBuilder::createVarStatement):
2170 (JSC::ASTBuilder::createReturnStatement):
2171 (JSC::ASTBuilder::createBreakStatement):
2172 (JSC::ASTBuilder::createContinueStatement):
2173 (JSC::ASTBuilder::createTryStatement):
2174 (JSC::ASTBuilder::createSwitchStatement):
2175 (JSC::ASTBuilder::createWhileStatement):
2176 (JSC::ASTBuilder::createDoWhileStatement):
2177 (JSC::ASTBuilder::createLabelStatement):
2178 (JSC::ASTBuilder::createWithStatement):
2179 (JSC::ASTBuilder::createThrowStatement):
2180 (JSC::ASTBuilder::createDebugger):
2181 (JSC::ASTBuilder::createConstStatement):
2182 (JSC::ASTBuilder::appendConstDecl):
2183 (JSC::ASTBuilder::combineCommaNodes):
2184 (JSC::ASTBuilder::appendBinaryOperation):
2185 (JSC::ASTBuilder::createAssignment):
2186 (JSC::ASTBuilder::createNumber):
2187 (JSC::ASTBuilder::makeTypeOfNode):
2188 (JSC::ASTBuilder::makeDeleteNode):
2189 (JSC::ASTBuilder::makeNegateNode):
2190 (JSC::ASTBuilder::makeBitwiseNotNode):
2191 (JSC::ASTBuilder::makeMultNode):
2192 (JSC::ASTBuilder::makeDivNode):
2193 (JSC::ASTBuilder::makeModNode):
2194 (JSC::ASTBuilder::makeAddNode):
2195 (JSC::ASTBuilder::makeSubNode):
2196 (JSC::ASTBuilder::makeLeftShiftNode):
2197 (JSC::ASTBuilder::makeRightShiftNode):
2198 (JSC::ASTBuilder::makeURightShiftNode):
2199 (JSC::ASTBuilder::makeBitOrNode):
2200 (JSC::ASTBuilder::makeBitAndNode):
2201 (JSC::ASTBuilder::makeBitXOrNode):
2202 (JSC::ASTBuilder::makeFunctionCallNode):
2203 (JSC::ASTBuilder::makeBinaryNode):
2204 (JSC::ASTBuilder::makeAssignNode):
2205 (JSC::ASTBuilder::makePrefixNode):
2206 (JSC::ASTBuilder::makePostfixNode):
2207 * parser/Lexer.cpp:
2208 (JSC::::setCode):
2209 (JSC::::internalShift):
2210 (JSC::::shift):
2211 (JSC::::lex):
2212 * parser/Lexer.h:
2213 (Lexer):
2214 (JSC::Lexer::currentColumnNumber):
2215 (JSC::::lexExpectIdentifier):
2216 * parser/NodeConstructors.h:
2217 (JSC::Node::Node):
2218 (JSC::ExpressionNode::ExpressionNode):
2219 (JSC::StatementNode::StatementNode):
2220 (JSC::NullNode::NullNode):
2221 (JSC::BooleanNode::BooleanNode):
2222 (JSC::NumberNode::NumberNode):
2223 (JSC::StringNode::StringNode):
2224 (JSC::RegExpNode::RegExpNode):
2225 (JSC::ThisNode::ThisNode):
2226 (JSC::ResolveNode::ResolveNode):
2227 (JSC::ArrayNode::ArrayNode):
2228 (JSC::PropertyListNode::PropertyListNode):
2229 (JSC::ObjectLiteralNode::ObjectLiteralNode):
2230 (JSC::BracketAccessorNode::BracketAccessorNode):
2231 (JSC::DotAccessorNode::DotAccessorNode):
2232 (JSC::ArgumentListNode::ArgumentListNode):
2233 (JSC::NewExprNode::NewExprNode):
2234 (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
2235 (JSC::FunctionCallValueNode::FunctionCallValueNode):
2236 (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
2237 (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
2238 (JSC::FunctionCallDotNode::FunctionCallDotNode):
2239 (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
2240 (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
2241 (JSC::PrePostResolveNode::PrePostResolveNode):
2242 (JSC::PostfixResolveNode::PostfixResolveNode):
2243 (JSC::PostfixBracketNode::PostfixBracketNode):
2244 (JSC::PostfixDotNode::PostfixDotNode):
2245 (JSC::PostfixErrorNode::PostfixErrorNode):
2246 (JSC::DeleteResolveNode::DeleteResolveNode):
2247 (JSC::DeleteBracketNode::DeleteBracketNode):
2248 (JSC::DeleteDotNode::DeleteDotNode):
2249 (JSC::DeleteValueNode::DeleteValueNode):
2250 (JSC::VoidNode::VoidNode):
2251 (JSC::TypeOfResolveNode::TypeOfResolveNode):
2252 (JSC::TypeOfValueNode::TypeOfValueNode):
2253 (JSC::PrefixResolveNode::PrefixResolveNode):
2254 (JSC::PrefixBracketNode::PrefixBracketNode):
2255 (JSC::PrefixDotNode::PrefixDotNode):
2256 (JSC::PrefixErrorNode::PrefixErrorNode):
2257 (JSC::UnaryOpNode::UnaryOpNode):
2258 (JSC::UnaryPlusNode::UnaryPlusNode):
2259 (JSC::NegateNode::NegateNode):
2260 (JSC::BitwiseNotNode::BitwiseNotNode):
2261 (JSC::LogicalNotNode::LogicalNotNode):
2262 (JSC::BinaryOpNode::BinaryOpNode):
2263 (JSC::MultNode::MultNode):
2264 (JSC::DivNode::DivNode):
2265 (JSC::ModNode::ModNode):
2266 (JSC::AddNode::AddNode):
2267 (JSC::SubNode::SubNode):
2268 (JSC::LeftShiftNode::LeftShiftNode):
2269 (JSC::RightShiftNode::RightShiftNode):
2270 (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
2271 (JSC::LessNode::LessNode):
2272 (JSC::GreaterNode::GreaterNode):
2273 (JSC::LessEqNode::LessEqNode):
2274 (JSC::GreaterEqNode::GreaterEqNode):
2275 (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
2276 (JSC::InstanceOfNode::InstanceOfNode):
2277 (JSC::InNode::InNode):
2278 (JSC::EqualNode::EqualNode):
2279 (JSC::NotEqualNode::NotEqualNode):
2280 (JSC::StrictEqualNode::StrictEqualNode):
2281 (JSC::NotStrictEqualNode::NotStrictEqualNode):
2282 (JSC::BitAndNode::BitAndNode):
2283 (JSC::BitOrNode::BitOrNode):
2284 (JSC::BitXOrNode::BitXOrNode):
2285 (JSC::LogicalOpNode::LogicalOpNode):
2286 (JSC::ConditionalNode::ConditionalNode):
2287 (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
2288 (JSC::AssignResolveNode::AssignResolveNode):
2289 (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
2290 (JSC::AssignBracketNode::AssignBracketNode):
2291 (JSC::AssignDotNode::AssignDotNode):
2292 (JSC::ReadModifyDotNode::ReadModifyDotNode):
2293 (JSC::AssignErrorNode::AssignErrorNode):
2294 (JSC::CommaNode::CommaNode):
2295 (JSC::ConstStatementNode::ConstStatementNode):
2296 (JSC::EmptyStatementNode::EmptyStatementNode):
2297 (JSC::DebuggerStatementNode::DebuggerStatementNode):
2298 (JSC::ExprStatementNode::ExprStatementNode):
2299 (JSC::VarStatementNode::VarStatementNode):
2300 (JSC::IfNode::IfNode):
2301 (JSC::IfElseNode::IfElseNode):
2302 (JSC::DoWhileNode::DoWhileNode):
2303 (JSC::WhileNode::WhileNode):
2304 (JSC::ForNode::ForNode):
2305 (JSC::ContinueNode::ContinueNode):
2306 (JSC::BreakNode::BreakNode):
2307 (JSC::ReturnNode::ReturnNode):
2308 (JSC::WithNode::WithNode):
2309 (JSC::LabelNode::LabelNode):
2310 (JSC::ThrowNode::ThrowNode):
2311 (JSC::TryNode::TryNode):
2312 (JSC::FuncExprNode::FuncExprNode):
2313 (JSC::FuncDeclNode::FuncDeclNode):
2314 (JSC::SwitchNode::SwitchNode):
2315 (JSC::ConstDeclNode::ConstDeclNode):
2316 (JSC::BlockNode::BlockNode):
2317 (JSC::ForInNode::ForInNode):
2318 * parser/Nodes.cpp:
2319 (JSC::StatementNode::setLoc):
2320 (JSC):
2321 (JSC::ScopeNode::ScopeNode):
2322 (JSC::ProgramNode::ProgramNode):
2323 (JSC::ProgramNode::create):
2324 (JSC::EvalNode::EvalNode):
2325 (JSC::EvalNode::create):
2326 (JSC::FunctionBodyNode::FunctionBodyNode):
2327 (JSC::FunctionBodyNode::create):
2328 * parser/Nodes.h:
2329 (Node):
2330 (JSC::Node::columnNo):
2331 (ExpressionNode):
2332 (StatementNode):
2333 (JSC::StatementNode::column):
2334 (NullNode):
2335 (BooleanNode):
2336 (NumberNode):
2337 (StringNode):
2338 (RegExpNode):
2339 (ThisNode):
2340 (ResolveNode):
2341 (ArrayNode):
2342 (PropertyListNode):
2343 (ObjectLiteralNode):
2344 (BracketAccessorNode):
2345 (DotAccessorNode):
2346 (ArgumentListNode):
2347 (NewExprNode):
2348 (EvalFunctionCallNode):
2349 (FunctionCallValueNode):
2350 (FunctionCallResolveNode):
2351 (FunctionCallBracketNode):
2352 (FunctionCallDotNode):
2353 (CallFunctionCallDotNode):
2354 (ApplyFunctionCallDotNode):
2355 (PrePostResolveNode):
2356 (PostfixResolveNode):
2357 (PostfixBracketNode):
2358 (PostfixDotNode):
2359 (PostfixErrorNode):
2360 (DeleteResolveNode):
2361 (DeleteBracketNode):
2362 (DeleteDotNode):
2363 (DeleteValueNode):
2364 (VoidNode):
2365 (TypeOfResolveNode):
2366 (TypeOfValueNode):
2367 (PrefixResolveNode):
2368 (PrefixBracketNode):
2369 (PrefixDotNode):
2370 (PrefixErrorNode):
2371 (UnaryOpNode):
2372 (UnaryPlusNode):
2373 (NegateNode):
2374 (BitwiseNotNode):
2375 (LogicalNotNode):
2376 (BinaryOpNode):
2377 (MultNode):
2378 (DivNode):
2379 (ModNode):
2380 (AddNode):
2381 (SubNode):
2382 (LeftShiftNode):
2383 (RightShiftNode):
2384 (UnsignedRightShiftNode):
2385 (LessNode):
2386 (GreaterNode):
2387 (LessEqNode):
2388 (GreaterEqNode):
2389 (ThrowableBinaryOpNode):
2390 (InstanceOfNode):
2391 (InNode):
2392 (EqualNode):
2393 (NotEqualNode):
2394 (StrictEqualNode):
2395 (NotStrictEqualNode):
2396 (BitAndNode):
2397 (BitOrNode):
2398 (BitXOrNode):
2399 (LogicalOpNode):
2400 (ConditionalNode):
2401 (ReadModifyResolveNode):
2402 (AssignResolveNode):
2403 (ReadModifyBracketNode):
2404 (AssignBracketNode):
2405 (AssignDotNode):
2406 (ReadModifyDotNode):
2407 (AssignErrorNode):
2408 (CommaNode):
2409 (ConstDeclNode):
2410 (ConstStatementNode):
2411 (BlockNode):
2412 (EmptyStatementNode):
2413 (DebuggerStatementNode):
2414 (ExprStatementNode):
2415 (VarStatementNode):
2416 (IfNode):
2417 (IfElseNode):
2418 (DoWhileNode):
2419 (WhileNode):
2420 (ForNode):
2421 (ForInNode):
2422 (ContinueNode):
2423 (BreakNode):
2424 (ReturnNode):
2425 (WithNode):
2426 (LabelNode):
2427 (ThrowNode):
2428 (TryNode):
2429 (ScopeNode):
2430 (ProgramNode):
2431 (EvalNode):
2432 (FunctionBodyNode):
2433 (FuncExprNode):
2434 (FuncDeclNode):
2435 (SwitchNode):
2436 * parser/Parser.cpp:
2437 (JSC::::parseSourceElements):
2438 (JSC::::parseVarDeclaration):
2439 (JSC::::parseConstDeclaration):
2440 (JSC::::parseDoWhileStatement):
2441 (JSC::::parseWhileStatement):
2442 (JSC::::parseVarDeclarationList):
2443 (JSC::::parseConstDeclarationList):
2444 (JSC::::parseForStatement):
2445 (JSC::::parseBreakStatement):
2446 (JSC::::parseContinueStatement):
2447 (JSC::::parseReturnStatement):
2448 (JSC::::parseThrowStatement):
2449 (JSC::::parseWithStatement):
2450 (JSC::::parseSwitchStatement):
2451 (JSC::::parseTryStatement):
2452 (JSC::::parseDebuggerStatement):
2453 (JSC::::parseBlockStatement):
2454 (JSC::::parseStatement):
2455 (JSC::::parseFunctionBody):
2456 (JSC::::parseFunctionInfo):
2457 (JSC::::parseFunctionDeclaration):
2458 (JSC::::parseExpressionOrLabelStatement):
2459 (JSC::::parseExpressionStatement):
2460 (JSC::::parseIfStatement):
2461 (JSC::::parseExpression):
2462 (JSC::::parseAssignmentExpression):
2463 (JSC::::parseConditionalExpression):
2464 (JSC::::parseBinaryExpression):
2465 (JSC::::parseProperty):
2466 (JSC::::parseObjectLiteral):
2467 (JSC::::parseStrictObjectLiteral):
2468 (JSC::::parseArrayLiteral):
2469 (JSC::::parsePrimaryExpression):
2470 (JSC::::parseArguments):
2471 (JSC::::parseMemberExpression):
2472 (JSC::::parseUnaryExpression):
2473 * parser/Parser.h:
2474 (JSC::Parser::next):
2475 (JSC::Parser::nextExpectIdentifier):
2476 (JSC::Parser::tokenStart):
2477 (JSC::Parser::tokenLine):
2478 (JSC::Parser::tokenEnd):
2479 (JSC::Parser::tokenLocation):
2480 (Parser):
2481 (JSC::Parser::getTokenName):
2482 (JSC::::parse):
2483 * parser/ParserTokens.h:
2484 (JSC::JSTokenLocation::JSTokenLocation):
2485 (JSTokenLocation):
2486 (JSToken):
2487 * parser/SourceProviderCacheItem.h:
2488 (JSC::SourceProviderCacheItem::closeBraceToken):
2489 * parser/SyntaxChecker.h:
2490 (JSC::SyntaxChecker::makeFunctionCallNode):
2491 (JSC::SyntaxChecker::createCommaExpr):
2492 (JSC::SyntaxChecker::makeAssignNode):
2493 (JSC::SyntaxChecker::makePrefixNode):
2494 (JSC::SyntaxChecker::makePostfixNode):
2495 (JSC::SyntaxChecker::makeTypeOfNode):
2496 (JSC::SyntaxChecker::makeDeleteNode):
2497 (JSC::SyntaxChecker::makeNegateNode):
2498 (JSC::SyntaxChecker::makeBitwiseNotNode):
2499 (JSC::SyntaxChecker::createLogicalNot):
2500 (JSC::SyntaxChecker::createUnaryPlus):
2501 (JSC::SyntaxChecker::createVoid):
2502 (JSC::SyntaxChecker::thisExpr):
2503 (JSC::SyntaxChecker::createResolve):
2504 (JSC::SyntaxChecker::createObjectLiteral):
2505 (JSC::SyntaxChecker::createArray):
2506 (JSC::SyntaxChecker::createNumberExpr):
2507 (JSC::SyntaxChecker::createString):
2508 (JSC::SyntaxChecker::createBoolean):
2509 (JSC::SyntaxChecker::createNull):
2510 (JSC::SyntaxChecker::createBracketAccess):
2511 (JSC::SyntaxChecker::createDotAccess):
2512 (JSC::SyntaxChecker::createRegExp):
2513 (JSC::SyntaxChecker::createNewExpr):
2514 (JSC::SyntaxChecker::createConditionalExpr):
2515 (JSC::SyntaxChecker::createAssignResolve):
2516 (JSC::SyntaxChecker::createFunctionExpr):
2517 (JSC::SyntaxChecker::createFunctionBody):
2518 (JSC::SyntaxChecker::createArgumentsList):
2519 (JSC::SyntaxChecker::createPropertyList):
2520 (JSC::SyntaxChecker::createFuncDeclStatement):
2521 (JSC::SyntaxChecker::createBlockStatement):
2522 (JSC::SyntaxChecker::createExprStatement):
2523 (JSC::SyntaxChecker::createIfStatement):
2524 (JSC::SyntaxChecker::createForLoop):
2525 (JSC::SyntaxChecker::createForInLoop):
2526 (JSC::SyntaxChecker::createEmptyStatement):
2527 (JSC::SyntaxChecker::createVarStatement):
2528 (JSC::SyntaxChecker::createReturnStatement):
2529 (JSC::SyntaxChecker::createBreakStatement):
2530 (JSC::SyntaxChecker::createContinueStatement):
2531 (JSC::SyntaxChecker::createTryStatement):
2532 (JSC::SyntaxChecker::createSwitchStatement):
2533 (JSC::SyntaxChecker::createWhileStatement):
2534 (JSC::SyntaxChecker::createWithStatement):
2535 (JSC::SyntaxChecker::createDoWhileStatement):
2536 (JSC::SyntaxChecker::createLabelStatement):
2537 (JSC::SyntaxChecker::createThrowStatement):
2538 (JSC::SyntaxChecker::createDebugger):
2539 (JSC::SyntaxChecker::createConstStatement):
2540 (JSC::SyntaxChecker::appendConstDecl):
2541 (JSC::SyntaxChecker::createGetterOrSetterProperty):
2542 (JSC::SyntaxChecker::combineCommaNodes):
2543 (JSC::SyntaxChecker::operatorStackPop):
2544
fpizlo@apple.com270a7ad2012-08-02 01:28:10 +0000[diff] [blame]25452012-08-01 Filip Pizlo <fpizlo@apple.com>
2546
fpizlo@apple.comcaa68812012-08-02 04:32:30 +0000[diff] [blame]2547 DFG should hoist structure checks
2548 https://bugs.webkit.org/show_bug.cgi?id=92696
2549
2550 Reviewed by Gavin Barraclough.
2551
2552 This hoists structure checks in the same way that we would hoist array checks, but with added
2553 complexity to cope with the fact that the structure of an object may change. This is handled
2554 by performing a side effects analysis over the region in which the respective variable is
2555 live. If a structure clobbering side effect may happen then we either hoist the structure
2556 checks and fall back on structure transition watchpoints (if the watchpoint set is still
2557 valid), or we avoid hoisting altogether.
2558
2559 Doing this required teaching the CFA that we may have an expectation that an object has a
2560 particular structure even after structure clobbering happens, in the sense that structure
2561 proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
2562 OSR entry may know about it, since we cannot allow entry to happen if the variable has a
2563 clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
2564 the baseline JIT has a completely unrelated structure.
2565
2566 This is mostly performance neutral.
2567
2568 * CMakeLists.txt:
2569 * GNUmakefile.list.am:
2570 * JavaScriptCore.xcodeproj/project.pbxproj:
2571 * Target.pri:
2572 * bytecode/ValueRecovery.h:
2573 (JSC::ValueRecovery::isSet):
2574 (JSC::ValueRecovery::operator!):
2575 (ValueRecovery):
2576 * dfg/DFGAbstractState.cpp:
2577 (JSC::DFG::AbstractState::execute):
2578 (JSC::DFG::AbstractState::clobberWorld):
2579 (DFG):
2580 (JSC::DFG::AbstractState::clobberCapturedVars):
2581 * dfg/DFGAbstractState.h:
2582 (AbstractState):
2583 * dfg/DFGAbstractValue.h:
2584 (JSC::DFG::AbstractValue::clear):
2585 (JSC::DFG::AbstractValue::isClear):
2586 (JSC::DFG::AbstractValue::makeTop):
2587 (JSC::DFG::AbstractValue::isTop):
2588 (JSC::DFG::AbstractValue::set):
2589 (JSC::DFG::AbstractValue::operator==):
2590 (JSC::DFG::AbstractValue::merge):
2591 (JSC::DFG::AbstractValue::filter):
2592 (JSC::DFG::AbstractValue::validate):
2593 (JSC::DFG::AbstractValue::validateForEntry):
2594 (AbstractValue):
2595 (JSC::DFG::AbstractValue::checkConsistency):
2596 (JSC::DFG::AbstractValue::dump):
2597 * dfg/DFGByteCodeParser.cpp:
2598 (JSC::DFG::ByteCodeParser::setLocal):
2599 (JSC::DFG::ByteCodeParser::getArgument):
2600 (JSC::DFG::ByteCodeParser::setArgument):
2601 (JSC::DFG::ByteCodeParser::parseBlock):
2602 (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
2603 * dfg/DFGCSEPhase.cpp:
2604 (JSC::DFG::CSEPhase::checkStructureLoadElimination):
2605 (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
2606 (JSC::DFG::CSEPhase::putStructureStoreElimination):
2607 (JSC::DFG::CSEPhase::getLocalLoadElimination):
2608 (JSC::DFG::CSEPhase::performNodeCSE):
2609 * dfg/DFGDriver.cpp:
2610 (JSC::DFG::compile):
2611 * dfg/DFGGraph.cpp:
2612 (JSC::DFG::Graph::dump):
2613 * dfg/DFGGraph.h:
2614 (JSC::DFG::Graph::vote):
2615 (Graph):
2616 * dfg/DFGNode.h:
2617 (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
2618 (Node):
2619 (JSC::DFG::Node::hasStructureSet):
2620 * dfg/DFGNodeType.h:
2621 (DFG):
2622 * dfg/DFGOSREntry.cpp:
2623 (JSC::DFG::prepareOSREntry):
2624 * dfg/DFGPredictionPropagationPhase.cpp:
2625 (JSC::DFG::PredictionPropagationPhase::propagate):
2626 (PredictionPropagationPhase):
2627 (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
2628 * dfg/DFGSpeculativeJIT.h:
2629 (SpeculativeJIT):
2630 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
2631 (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
2632 (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
2633 (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
2634 (JSC::DFG::SpeculateCellOperand::gpr):
2635 (SpeculateCellOperand):
2636 * dfg/DFGSpeculativeJIT32_64.cpp:
2637 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2638 (JSC::DFG::SpeculativeJIT::compile):
2639 * dfg/DFGSpeculativeJIT64.cpp:
2640 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2641 (JSC::DFG::SpeculativeJIT::compile):
2642 * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
2643 (DFG):
2644 (StructureCheckHoistingPhase):
2645 (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
2646 (JSC::DFG::StructureCheckHoistingPhase::run):
2647 (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
2648 (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
2649 (JSC::DFG::StructureCheckHoistingPhase::clobber):
2650 (CheckData):
2651 (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
2652 (JSC::DFG::performStructureCheckHoisting):
2653 * dfg/DFGStructureCheckHoistingPhase.h: Added.
2654 (DFG):
2655 * dfg/DFGVariableAccessData.h:
2656 (VariableAccessData):
2657 (JSC::DFG::VariableAccessData::VariableAccessData):
2658 (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
2659 (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
2660 (JSC::DFG::VariableAccessData::clearVotes):
2661 (JSC::DFG::VariableAccessData::vote):
2662 (JSC::DFG::VariableAccessData::voteRatio):
2663 (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
2664 * runtime/Options.h:
2665 (JSC):
2666
26672012-08-01 Filip Pizlo <fpizlo@apple.com>
2668
fpizlo@apple.com270a7ad2012-08-02 01:28:10 +0000[diff] [blame]2669 DFG should distinguish between PutByVal's that clobber the world and ones that don't
2670 https://bugs.webkit.org/show_bug.cgi?id=92923
2671
2672 Reviewed by Mark Hahnenberg.
2673
2674 This is performance-neutral. I also confirmed that it's neutral if we make the
2675 clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
2676 which should feed nicely into work on removing uses of ClassInfo.
2677
2678 * bytecode/DFGExitProfile.h:
2679 * dfg/DFGAbstractState.cpp:
2680 (JSC::DFG::AbstractState::execute):
2681 * dfg/DFGByteCodeParser.cpp:
2682 (JSC::DFG::ByteCodeParser::parseBlock):
2683 * dfg/DFGCSEPhase.cpp:
2684 (JSC::DFG::CSEPhase::getByValLoadElimination):
2685 (JSC::DFG::CSEPhase::checkStructureLoadElimination):
2686 (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
2687 (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
2688 (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
2689 (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
2690 (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2691 (JSC::DFG::CSEPhase::performNodeCSE):
2692 * dfg/DFGFixupPhase.cpp:
2693 (JSC::DFG::FixupPhase::fixupNode):
2694 * dfg/DFGGraph.h:
2695 (JSC::DFG::Graph::byValIsPure):
2696 (JSC::DFG::Graph::clobbersWorld):
2697 * dfg/DFGNodeType.h:
2698 (DFG):
2699 * dfg/DFGPredictionPropagationPhase.cpp:
2700 (JSC::DFG::PredictionPropagationPhase::propagate):
2701 * dfg/DFGSpeculativeJIT32_64.cpp:
2702 (JSC::DFG::SpeculativeJIT::compile):
2703 * dfg/DFGSpeculativeJIT64.cpp:
2704 (JSC::DFG::SpeculativeJIT::compile):
2705
jianli@chromium.orgf66b5812012-08-02 00:14:28 +0000[diff] [blame]27062012-08-01 Jian Li <jianli@chromium.org>
2707
2708 Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
2709 https://bugs.webkit.org/show_bug.cgi?id=90298
2710
2711 Reviewed by Adam Barth.
2712
2713 * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
2714
paroga@webkit.orgf3f2e132012-08-01 20:49:26 +0000[diff] [blame]27152012-08-01 Patrick Gansterer <paroga@webkit.org>
2716
2717 Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
2718 https://bugs.webkit.org/show_bug.cgi?id=92286
2719
2720 Reviewed by Geoffrey Garen.
2721
2722 Add a method to GregorianDateTime to set its values to the current locale time.
2723 Replacing all occurrences of getCurrentLocalTime with the new function allows
2724 us to remove getCurrentLocalTime in a next step.
2725
2726 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2727
mhahnenberg@apple.comf19f9352012-08-01 19:24:58 +0000[diff] [blame]27282012-08-01 Mark Hahnenberg <mhahnenberg@apple.com>
2729
2730 C++ code should get ClassInfo from the Structure
2731 https://bugs.webkit.org/show_bug.cgi?id=92892
2732
2733 Reviewed by Geoffrey Garen.
2734
2735 In our march to remove ClassInfo from our JSCell object headers, we can switch
2736 C++ code over to grabbing the ClassInfo from the Structure since it is finally
2737 safe to do so now that Structure access is safe during finalization/destruction.
2738 The remaining JIT code changes can be done in a separate patch.
2739
2740 * heap/MarkedBlock.cpp:
2741 (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more
2742 since the Structure should still be valid at this point.
2743 * heap/WeakSetInlines.h:
2744 (JSC::WeakBlock::finalize): Ditto.
2745 * runtime/JSCell.h:
2746 (JSC):
2747 * runtime/Structure.h:
2748 (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be
2749 inline. Use a different method of getting the JSCell's Structure based on
2750 whether we're in GC_VALIDATION mode or not, since always using get() will cause
2751 infinite recursion in GC_VALIDATION mode.
2752 (JSC):
2753
mhahnenberg@apple.com42853a62012-08-01 18:55:03 +0000[diff] [blame]27542012-07-31 Mark Hahnenberg <mhahnenberg@apple.com>
2755
2756 MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
2757 https://bugs.webkit.org/show_bug.cgi?id=92819
2758
2759 Reviewed by Geoffrey Garen.
2760
2761 If we are forced to allocate a new block for Structures because we are unable to safely
2762 sweep our pre-existing Structure blocks, we should sweep another random block so that we
2763 can start sweeping Structure blocks sooner.
2764
2765 * heap/IncrementalSweeper.cpp:
2766 (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
2767 (JSC):
2768 (JSC::IncrementalSweeper::sweepNextBlock):
2769 * heap/IncrementalSweeper.h:
2770 (IncrementalSweeper):
2771 * heap/MarkedAllocator.cpp:
2772 (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep
2773 our Structure blocks, call sweepNextBlock instead.
2774
weinig@apple.comd824f452012-07-31 23:50:04 +0000[diff] [blame]27752012-07-31 Sam Weinig <sam@webkit.org>
2776
2777 Fix the Windows build.
2778
2779 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2780
ggaren@apple.come0d70122012-07-31 23:46:53 +0000[diff] [blame]27812012-07-31 Geoffrey Garen <ggaren@apple.com>
2782
2783 Maybe fix the GCC build.
2784
2785 * heap/HeapBlock.h:
2786 (HeapBlock): Accommodate incorrect parsing in GCC.
2787
weinig@apple.com329b8062012-07-31 23:24:31 +0000[diff] [blame]27882012-07-31 Sam Weinig <sam@webkit.org>
2789
2790 Stop masking 8 bits off of the visited link hash. We need all the bits!
2791 https://bugs.webkit.org/show_bug.cgi?id=92799
2792
2793 Reviewed by Anders Carlsson.
2794
2795 * runtime/Identifier.cpp:
2796 (JSC::IdentifierCStringTranslator::hash):
2797 (JSC::IdentifierLCharFromUCharTranslator::hash):
2798 * runtime/Identifier.h:
2799 (JSC::IdentifierCharBufferTranslator::hash):
2800 Update for new function names.
2801
ggaren@apple.comc33983c2012-07-31 23:07:46 +0000[diff] [blame]28022012-07-31 Geoffrey Garen <ggaren@apple.com>
2803
2804 Maybe break the Windows build.
2805
2806 Reviewed by Anders Carlsson.
2807
2808 Formally objected to by Sam Weinig.
2809
2810 * heap/HeapBlock.h:
2811 (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
2812
mhahnenberg@apple.com59c64f12012-07-31 23:05:12 +0000[diff] [blame]28132012-07-30 Mark Hahnenberg <mhahnenberg@apple.com>
2814
2815 Structures should be swept after all other objects
2816 https://bugs.webkit.org/show_bug.cgi?id=92679
2817
2818 Reviewed by Filip Pizlo.
2819
2820 In order to get rid of ClassInfo from our objects, we need to be able to safely get the
2821 ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
2822 Structure, but currently it is not safe to do so because the order of destruction of objects
2823 is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
2824 sweeping Structures after everything else.
2825
2826 * heap/Heap.cpp:
2827 (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
2828 If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
2829 safe to sweep structures since we'll always do Structures last anyways due to the ordering of
2830 MarkedSpace::forEachBlock.
2831 (JSC):
2832 (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
2833 calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
2834 these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
2835 calls during lastChanceToFinalize().
2836 * heap/Heap.h:
2837 (Heap):
2838 * heap/HeapTimer.h:
2839 (HeapTimer):
2840 * heap/IncrementalSweeper.cpp:
2841 (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
2842 This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
2843 the first time.
2844 (JSC):
2845 (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
2846 make our first pass. We now null out the slots as we sweep them so that we can quickly find the
2847 Structures during the second pass.
2848 (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
2849 (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
2850 the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
2851 assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
2852 iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
2853 (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
2854 * heap/IncrementalSweeper.h: Add declarations for new stuff.
2855 (IncrementalSweeper):
2856 * heap/MarkedAllocator.cpp:
2857 (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
2858 if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
2859 the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
2860 will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
2861 Structure garbage.
2862 (JSC::MarkedAllocator::addBlock):
2863 * heap/MarkedAllocator.h:
2864 (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
2865 longer valid to allocate from, so we set the current block to null.
2866 * heap/MarkedBlock.cpp:
2867 (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
2868 at an unsafe time.
2869 * heap/MarkedSpace.cpp:
2870 (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
2871 (JSC):
2872 * heap/MarkedSpace.h:
2873 (JSC):
2874 * runtime/JSGlobalData.cpp:
2875 (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
2876
ggaren@apple.comdd7793a2012-07-31 21:26:38 +0000[diff] [blame]28772012-07-31 Geoffrey Garen <ggaren@apple.com>
2878
ggaren@apple.com0aa5f2a2012-07-31 23:00:53 +0000[diff] [blame]2879 Fix all the other builds I just broke. Maybe fix the Windows build.
2880
2881 * heap/HeapBlock.h:
2882 (HeapBlock): WTF?
2883
28842012-07-31 Geoffrey Garen <ggaren@apple.com>
2885
ggaren@apple.comeff3a062012-07-31 22:27:38 +0000[diff] [blame]2886 Maybe fix the Windows build.
2887
2888 * heap/HeapBlock.h:
2889 (HeapBlock): WTF?
2890
28912012-07-31 Geoffrey Garen <ggaren@apple.com>
2892
ggaren@apple.comc5be1dd2012-07-31 22:59:49 +0000[diff] [blame]2893 Maybe fix the Windows build.
2894
2895 * heap/HeapBlock.h:
2896 (HeapBlock): WTF?
2897
28982012-07-31 Geoffrey Garen <ggaren@apple.com>
2899
ggaren@apple.comdd7793a2012-07-31 21:26:38 +0000[diff] [blame]2900 Removed some public data and casting from the Heap
2901 https://bugs.webkit.org/show_bug.cgi?id=92777
2902
2903 Reviewed by Oliver Hunt.
2904
2905 * heap/BlockAllocator.cpp:
2906 (JSC::BlockAllocator::releaseFreeBlocks):
2907 (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
2908 since HeapBlock is a template, and not a class, now. Call destroy()
2909 instead of monkeying around with DeadBlock's internal data because
2910 encapsulation is good.
2911
2912 * heap/BlockAllocator.h:
2913 (DeadBlock): Added a class to represent a dead block, since HeapBlock is
2914 a template now, and can't be instantiated directly.
2915
2916 (JSC::DeadBlock::DeadBlock):
2917 (JSC::DeadBlock::create):
2918 (BlockAllocator):
2919 (JSC::BlockAllocator::allocate):
2920 (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
2921 encapsulation is good.
2922
2923 * heap/CopiedBlock.h:
2924 (CopiedBlock::destroy): No need for a destroy() function, since we
2925 inherit one now.
2926
2927 (JSC::CopiedBlock::CopiedBlock):
2928 (JSC::CopiedBlock::payloadEnd):
2929 (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
2930 HeapBlock.
2931
2932 * heap/CopiedSpace.cpp:
2933 (JSC::CopiedSpace::~CopiedSpace):
2934 (JSC::CopiedSpace::doneCopying):
2935 (JSC::CopiedSpace::size):
2936 (JSC::CopiedSpace::capacity):
2937 (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
2938 necessary, now that our list and its nodes have the right type.
2939
2940 * heap/CopiedSpace.h: Use the right type in our data structures because
2941 it improves clarity.
2942
2943 * heap/CopiedSpaceInlineMethods.h:
2944 (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
2945
2946 * heap/HeapBlock.h:
2947 (HeapBlock): Made this a class template so we can return the right type
2948 in linked list operations. Made our data private because encapsulation
2949 is good.
2950
2951 (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
2952 duplicate destroy() functions in our subclasses.
2953
2954 (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
2955 By using const, this accessor prevents clients from accidentally deleting
2956 our allocation.
2957
2958 * heap/MarkedAllocator.cpp:
2959 (JSC::MarkedAllocator::isPagedOut):
2960 (JSC::MarkedAllocator::tryAllocateHelper):
2961 (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
2962 no longer necessary, now that our list and its nodes have the right type.
2963
2964 * heap/MarkedAllocator.h:
2965 (MarkedAllocator):
2966 (JSC::MarkedAllocator::reset):
2967 (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
2968
2969 * heap/MarkedBlock.cpp:
2970 (JSC::MarkedBlock::destroy): Removed this function because our parent
2971 class provides it for us now.
2972
2973 (JSC::MarkedBlock::MarkedBlock):
2974 * heap/MarkedBlock.h:
2975 (MarkedBlock):
2976 (JSC::MarkedBlock::capacity): Updated for encapsulation.
2977
fpizlo@apple.com46e4e4e2012-07-31 18:48:17 +0000[diff] [blame]29782012-07-31 Filip Pizlo <fpizlo@apple.com>
2979
2980 DFG OSR exit profiling has unusual oversights
2981 https://bugs.webkit.org/show_bug.cgi?id=92728
2982
2983 Reviewed by Geoffrey Garen.
2984
2985 * dfg/DFGOSRExit.cpp:
2986 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
2987 * dfg/DFGSpeculativeJIT.h:
2988 (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2989 * dfg/DFGSpeculativeJIT32_64.cpp:
2990 (JSC::DFG::SpeculativeJIT::compile):
2991 * dfg/DFGSpeculativeJIT64.cpp:
2992 (JSC::DFG::SpeculativeJIT::compile):
2993
commit-queue@webkit.orge03e44a2012-07-31 18:44:03 +0000[diff] [blame]29942012-07-31 Chao-ying Fu <fu@mips.com>
2995
2996 Add MIPS add32 function
2997 https://bugs.webkit.org/show_bug.cgi?id=91522
2998
2999 Reviewed by Oliver Hunt.
3000
3001 Add isCompactPtrAlignedAddressOffset.
3002 Add a new version of add32 that accepts AbsoluteAddress as inputs.
3003
3004 * assembler/MacroAssemblerMIPS.h:
3005 (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
3006 (MacroAssemblerMIPS):
3007 (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
3008
commit-queue@webkit.org764c9fb2012-07-31 01:48:18 +0000[diff] [blame]30092012-07-30 Sheriff Bot <webkit.review.bot@gmail.com>
3010
3011 Unreviewed, rolling out r124123.
3012 http://trac.webkit.org/changeset/124123
3013 https://bugs.webkit.org/show_bug.cgi?id=92700
3014
3015 ASSERT crashes terminate webkit Layout tests (Requested by
3016 msaboff on #webkit).
3017
3018 * heap/Heap.cpp:
3019 * heap/Heap.h:
3020 (Heap):
3021 * heap/IncrementalSweeper.cpp:
3022 (JSC::IncrementalSweeper::doSweep):
3023 (JSC::IncrementalSweeper::startSweeping):
3024 (JSC::IncrementalSweeper::IncrementalSweeper):
3025 (JSC):
3026 * heap/IncrementalSweeper.h:
3027 (IncrementalSweeper):
3028 * heap/MarkedAllocator.cpp:
3029 (JSC::MarkedAllocator::tryAllocateHelper):
3030 (JSC::MarkedAllocator::addBlock):
3031 * heap/MarkedAllocator.h:
3032 (JSC::MarkedAllocator::zapFreeList):
3033 * heap/MarkedBlock.cpp:
3034 (JSC::MarkedBlock::sweepHelper):
3035 * heap/MarkedSpace.cpp:
3036 * heap/MarkedSpace.h:
3037 (JSC::MarkedSpace::sweep):
3038 (JSC):
3039 * runtime/JSGlobalData.cpp:
3040 (JSC::JSGlobalData::~JSGlobalData):
3041
mhahnenberg@apple.com3c1699e2012-07-31 00:33:53 +0000[diff] [blame]30422012-07-30 Mark Hahnenberg <mhahnenberg@apple.com>
3043
3044 Structures should be swept after all other objects
3045 https://bugs.webkit.org/show_bug.cgi?id=92679
3046
3047 Reviewed by Filip Pizlo.
3048
3049 In order to get rid of ClassInfo from our objects, we need to be able to safely get the
3050 ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
3051 Structure, but currently it is not safe to do so because the order of destruction of objects
3052 is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
3053 sweeping Structures after everything else.
3054
3055 * heap/Heap.cpp:
3056 (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
3057 If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
3058 safe to sweep structures since we'll always do Structures last anyways due to the ordering of
3059 MarkedSpace::forEachBlock.
3060 (JSC):
3061 (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
3062 calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
3063 these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
3064 calls during lastChanceToFinalize().
3065 * heap/Heap.h:
3066 (Heap):
3067 * heap/HeapTimer.h:
3068 (HeapTimer):
3069 * heap/IncrementalSweeper.cpp:
3070 (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
3071 This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
3072 the first time.
3073 (JSC):
3074 (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
3075 make our first pass. We now null out the slots as we sweep them so that we can quickly find the
3076 Structures during the second pass.
3077 (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
3078 (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
3079 the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
3080 assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
3081 iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
3082 (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
3083 * heap/IncrementalSweeper.h: Add declarations for new stuff.
3084 (IncrementalSweeper):
3085 * heap/MarkedAllocator.cpp:
3086 (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
3087 if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
3088 the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
3089 will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
3090 Structure garbage.
3091 (JSC::MarkedAllocator::addBlock):
3092 * heap/MarkedAllocator.h:
3093 (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
3094 longer valid to allocate from, so we set the current block to null.
3095 * heap/MarkedBlock.cpp:
3096 (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
3097 at an unsafe time.
3098 * heap/MarkedSpace.cpp:
3099 (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
3100 (JSC):
3101 * heap/MarkedSpace.h:
3102 (JSC):
3103 * runtime/JSGlobalData.cpp:
3104 (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
3105
fpizlo@apple.com7cc53e02012-07-29 23:15:30 +0000[diff] [blame]31062012-07-29 Filip Pizlo <fpizlo@apple.com>
3107
3108 PropertyNameArray::m_shouldCache is only assigned and never used
3109 https://bugs.webkit.org/show_bug.cgi?id=92598
3110
3111 Reviewed by Dan Bernstein.
3112
3113 * runtime/PropertyNameArray.h:
3114 (JSC::PropertyNameArray::PropertyNameArray):
3115 (PropertyNameArray):
3116
commit-queue@webkit.orgc1c4f122012-07-29 21:59:53 +0000[diff] [blame]31172012-07-29 Rik Cabanier <cabanier@adobe.com>
3118
3119 Add ENABLE_CSS_COMPOSITING flag
3120 https://bugs.webkit.org/show_bug.cgi?id=92553
3121
3122 Reviewed by Dirk Schulze.
3123
3124 Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
3125
3126 * Configurations/FeatureDefines.xcconfig:
3127
mhahnenberg@apple.comaa1f4ec2012-07-27 19:29:03 +0000[diff] [blame]31282012-07-27 Mark Hahnenberg <mhahnenberg@apple.com>
3129
mhahnenberg@apple.com7f5b9592012-07-27 22:59:14 +0000[diff] [blame]3130 Split functionality of MarkedAllocator::m_currentBlock
3131 https://bugs.webkit.org/show_bug.cgi?id=92550
3132
3133 Reviewed by Filip Pizlo.
3134
3135 MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently
3136 being used for allocation and the beginning of the list of blocks that need to be swept. We should split
3137 these two functionalities into two separate fields.
3138
3139 * heap/MarkedAllocator.cpp:
3140 (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the
3141 initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
3142 (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and
3143 m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep,
3144 we assign both of them to point to the new block.
3145 (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is
3146 m_blocksToSweep and if so, advance it to the next block in the list.
3147 * heap/MarkedAllocator.h:
3148 (MarkedAllocator): Initialize m_blocksToSweep.
3149 (JSC::MarkedAllocator::MarkedAllocator):
3150 (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
3151 at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a
3152 block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to
3153 the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
3154
31552012-07-27 Mark Hahnenberg <mhahnenberg@apple.com>
3156
mhahnenberg@apple.comaa1f4ec2012-07-27 19:29:03 +0000[diff] [blame]3157 Increase inline storage for JSFinalObjects by one
3158 https://bugs.webkit.org/show_bug.cgi?id=92526
3159
3160 Reviewed by Geoffrey Garen.
3161
3162 Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on
3163 64-bit platforms by 1.
3164
3165 * llint/LowLevelInterpreter.asm: Change the constant.
3166 * runtime/PropertyOffset.h: Change the constant.
3167 (JSC):
3168
jer.noble@apple.com50ecb282012-07-27 16:31:07 +0000[diff] [blame]31692012-07-27 Jer Noble <jer.noble@apple.com>
3170
3171 Support a rational time class for use by media elements.
3172 https://bugs.webkit.org/show_bug.cgi?id=88787
3173
3174 Re-export WTF::MediaTime from JavaScriptCore.
3175
3176 Reviewed by Eric Carlson.
3177
3178 * JavaScriptCore.order:
3179 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3180
fpizlo@apple.comd510fc22012-07-27 00:11:44 +0000[diff] [blame]31812012-07-26 Filip Pizlo <fpizlo@apple.com>
3182
3183 JSObject::reallocateStorageIfNecessary is neither used nor defined
3184 https://bugs.webkit.org/show_bug.cgi?id=92417
3185
3186 Reviewed by Mark Rowe.
3187
3188 * runtime/JSObject.h:
3189 (JSObject):
3190
mhahnenberg@apple.comb44a7f02012-07-26 23:27:53 +0000[diff] [blame]31912012-07-26 Mark Hahnenberg <mhahnenberg@apple.com>
3192
3193 Allocate Structures in a separate part of the Heap
3194 https://bugs.webkit.org/show_bug.cgi?id=92420
3195
3196 Reviewed by Filip Pizlo.
3197
3198 To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate
3199 part of the Heap that will be swept after all other objects. This first patch will just be separating Structures
3200 out into their own separate MarkedAllocator. Everything else will behave identically.
3201
3202 * heap/Heap.h: New function to allocate Structures in the Heap.
3203 (Heap):
3204 (JSC):
3205 (JSC::Heap::allocateStructure):
3206 * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
3207 (JSC::MarkedAllocator::allocateBlock):
3208 * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
3209 (JSC::MarkedAllocator::onlyContainsStructures):
3210 (MarkedAllocator):
3211 (JSC::MarkedAllocator::MarkedAllocator):
3212 (JSC::MarkedAllocator::init):
3213 * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to
3214 distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
3215 (JSC::MarkedBlock::create):
3216 (JSC::MarkedBlock::MarkedBlock):
3217 * heap/MarkedBlock.h:
3218 (MarkedBlock):
3219 (JSC::MarkedBlock::onlyContainsStructures):
3220 (JSC):
3221 * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
3222 (JSC::MarkedSpace::MarkedSpace):
3223 (JSC::MarkedSpace::resetAllocators):
3224 (JSC::MarkedSpace::canonicalizeCellLivenessData):
3225 (JSC::MarkedSpace::isPagedOut):
3226 * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
3227 (MarkedSpace):
3228 (JSC::MarkedSpace::allocatorFor):
3229 (JSC::MarkedSpace::allocateStructure):
3230 (JSC):
3231 (JSC::MarkedSpace::forEachBlock):
3232 * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
3233 for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
3234 Heap.
3235 (Structure):
3236 (JSC::Structure):
3237 (JSC):
3238 (JSC::Structure::create):
3239 (JSC::Structure::createStructure):
3240
fpizlo@apple.com2b1d81e2012-07-26 23:01:05 +0000[diff] [blame]32412012-07-26 Filip Pizlo <fpizlo@apple.com>
3242
3243 JSArray has methods that are neither used nor defined
3244 https://bugs.webkit.org/show_bug.cgi?id=92416
3245
3246 Reviewed by Simon Fraser.
3247
3248 * runtime/JSArray.h:
3249 (JSArray):
3250
zherczeg@webkit.org4a637582012-07-26 12:29:10 +0000[diff] [blame]32512012-07-26 Zoltan Herczeg <zherczeg@webkit.org>
3252
3253 [Qt][ARM]ARMAssembler needs buildfix afert r123417
3254 https://bugs.webkit.org/show_bug.cgi?id=92086
3255
3256 Reviewed by Csaba Osztrogonác.
3257
3258 The ARM implementation of this should be optimized code path
3259 is covered by a non-optimized code path. This patch fixes this,
3260 and adds a new function which returns with the offset range.
3261
3262 * assembler/ARMAssembler.h:
3263 (JSC::ARMAssembler::readPointer):
3264 (ARMAssembler):
3265 (JSC::ARMAssembler::repatchInt32):
3266 (JSC::ARMAssembler::repatchCompact):
3267 * assembler/MacroAssemblerARM.h:
3268 (MacroAssemblerARM):
3269 (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
3270 (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
3271
mhahnenberg@apple.com9a75d6f2012-07-26 06:06:25 +0000[diff] [blame]32722012-07-25 Mark Hahnenberg <mhahnenberg@apple.com>
3273
3274 Build fix for 32-bit after r123682
3275
3276 * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
3277 we only removed one 4-byte word and we need to be 8-byte aligned.
3278 (JSObject):
3279
fpizlo@apple.com338a70dc2012-07-26 01:22:59 +0000[diff] [blame]32802012-07-25 Filip Pizlo <fpizlo@apple.com>
3281
3282 JSC GC object copying APIs should allow for greater flexibility
3283 https://bugs.webkit.org/show_bug.cgi?id=92316
3284
3285 Reviewed by Mark Hahnenberg.
3286
3287 It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
3288 They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
3289
3290 * JavaScriptCore.xcodeproj/project.pbxproj:
3291 * heap/MarkStack.cpp:
3292 (JSC::SlotVisitor::allocateNewSpaceSlow):
3293 (JSC::SlotVisitor::allocateNewSpaceOrPin):
3294 (JSC):
3295 (JSC::SlotVisitor::copyAndAppend):
3296 * heap/MarkStack.h:
3297 (MarkStack):
3298 (JSC::MarkStack::appendUnbarrieredValue):
3299 (JSC):
3300 * heap/SlotVisitor.h:
3301 * heap/SlotVisitorInlineMethods.h: Added.
3302 (JSC):
3303 (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
3304 (JSC::SlotVisitor::allocateNewSpace):
3305 * runtime/JSObject.cpp:
3306 (JSC::JSObject::visitOutOfLineStorage):
3307 (JSC):
3308 (JSC::JSObject::visitChildren):
3309 (JSC::JSFinalObject::visitChildren):
3310 * runtime/JSObject.h:
3311 (JSObject):
3312
mhahnenberg@apple.com0e8fce12012-07-26 00:12:58 +0000[diff] [blame]33132012-07-25 Mark Hahnenberg <mhahnenberg@apple.com>
3314
3315 Remove JSObject::m_inheritorID
3316 https://bugs.webkit.org/show_bug.cgi?id=88378
3317
3318 Reviewed by Filip Pizlo.
3319
3320 This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
3321 and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
3322 Instead use a private named value in the object's property storage.
3323
3324 * dfg/DFGSpeculativeJIT.h:
3325 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
3326 * jit/JITInlineMethods.h:
3327 (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
3328 * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
3329 * runtime/JSGlobalData.h:
3330 (JSGlobalData): Added private name 'm_inheritorIDKey'.
3331 * runtime/JSGlobalThis.cpp:
3332 (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
3333 * runtime/JSObject.cpp:
3334 (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
3335 (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
3336 (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure
3337 it's got the DontEnum attribute!!
3338 * runtime/JSObject.h:
3339 (JSObject):
3340 (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
3341 (JSC):
3342 (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
3343
caio.oliveira@openbossa.org947a2282012-07-25 22:15:05 +0000[diff] [blame]33442012-07-25 Caio Marcelo de Oliveira Filho <caio.oliveira@openbossa.org>
3345
3346 Create a specialized pair for use in HashMap iterators
3347 https://bugs.webkit.org/show_bug.cgi?id=92137
3348
3349 Reviewed by Ryosuke Niwa.
3350
3351 Update a couple of sites that relied on the fact that "contents" of iterators were
3352 std::pairs.
3353
3354 * profiler/Profile.cpp:
3355 (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
3356 is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
3357 the key) to get the proper key parameter for KeyValuePair.
3358 * tools/ProfileTreeNode.h:
3359 (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
3360 instead of declaring it manually. This will make use of the new KeyValuePair.
3361
paroga@webkit.orgcf6740e2012-07-25 07:42:03 +0000[diff] [blame]33622012-07-25 Patrick Gansterer <paroga@webkit.org>
3363
3364 REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
3365 https://bugs.webkit.org/show_bug.cgi?id=92218
3366
3367 Reviewed by Csaba Osztrogonác.
3368
3369 * runtime/DatePrototype.cpp:
3370 (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
3371
fpizlo@apple.coma7f7dcd2012-07-24 19:47:18 +0000[diff] [blame]33722012-07-24 Filip Pizlo <fpizlo@apple.com>
3373
3374 REGRESSION(r123417): It made tests assert/crash on 32 bit
3375 https://bugs.webkit.org/show_bug.cgi?id=92088
3376
3377 Reviewed by Mark Hahnenberg.
3378
3379 The pointer arithmetic was wrong, because negative numbers are hard to think about.
3380
3381 * dfg/DFGRepatch.cpp:
3382 (JSC::DFG::emitPutTransitionStub):
3383 * dfg/DFGSpeculativeJIT.cpp:
3384 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3385
paroga@webkit.orgf2de22c2012-07-24 19:03:57 +0000[diff] [blame]33862012-07-24 Patrick Gansterer <paroga@webkit.org>
3387
paroga@webkit.org683889f2012-07-24 19:25:30 +0000[diff] [blame]3388 Store the full year in GregorianDateTime
3389 https://bugs.webkit.org/show_bug.cgi?id=92067
3390
3391 Reviewed by Geoffrey Garen.
3392
3393 Use the full year instead of the offset from year 1900
3394 for the year member variable of GregorianDateTime.
3395
3396 * runtime/DateConstructor.cpp:
3397 (JSC::constructDate):
3398 (JSC::dateUTC):
3399 * runtime/DateConversion.cpp:
3400 (JSC::formatDate):
3401 (JSC::formatDateUTCVariant):
3402 * runtime/DatePrototype.cpp:
3403 (JSC::formatLocaleDate):
3404 (JSC::fillStructuresUsingDateArgs):
3405 (JSC::dateProtoFuncToISOString):
3406 (JSC::dateProtoFuncGetFullYear):
3407 (JSC::dateProtoFuncGetUTCFullYear):
3408 (JSC::dateProtoFuncSetYear):
3409 * runtime/JSDateMath.cpp:
3410 (JSC::gregorianDateTimeToMS):
3411 (JSC::msToGregorianDateTime):
3412
34132012-07-24 Patrick Gansterer <paroga@webkit.org>
3414
paroga@webkit.orgf2de22c2012-07-24 19:03:57 +0000[diff] [blame]3415 [WIN] Build fix after r123417.
3416
3417 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3418
paroga@webkit.org175d46f2012-07-24 05:19:55 +0000[diff] [blame]34192012-07-23 Patrick Gansterer <paroga@webkit.org>
3420
3421 Move GregorianDateTime from JSC to WTF namespace
3422 https://bugs.webkit.org/show_bug.cgi?id=91948
3423
3424 Reviewed by Geoffrey Garen.
3425
3426 Moving GregorianDateTime into the WTF namespace allows us to us to
3427 use it in WebCore too. The new class has the same behaviour as the
3428 old struct. Only the unused timeZone member has been removed.
3429
3430 * runtime/DateConstructor.cpp:
3431 * runtime/DateConversion.cpp:
3432 * runtime/DateConversion.h:
3433 * runtime/DateInstance.h:
3434 * runtime/DatePrototype.cpp:
3435 * runtime/JSDateMath.cpp:
3436 * runtime/JSDateMath.h:
3437
fpizlo@apple.com94a9c102012-07-23 22:38:30 +0000[diff] [blame]34382012-07-23 Filip Pizlo <fpizlo@apple.com>
3439
fpizlo@apple.com961a9562012-07-24 02:13:19 +0000[diff] [blame]3440 Property storage should grow in reverse address direction, to support butterflies
3441 https://bugs.webkit.org/show_bug.cgi?id=91788
3442
3443 Reviewed by Geoffrey Garen.
3444
3445 Changes property storage to grow to the left, and changes the property storage pointer to point
3446 one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
3447
3448 Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
3449 and a slow mode of object access in LLInt.
3450
3451 * assembler/ARMv7Assembler.h:
3452 (JSC::ARMv7Assembler::repatchCompact):
3453 * assembler/MacroAssemblerARMv7.h:
3454 (MacroAssemblerARMv7):
3455 (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
3456 (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
3457 * assembler/MacroAssemblerX86Common.h:
3458 (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
3459 (JSC::MacroAssemblerX86Common::repatchCompact):
3460 * assembler/X86Assembler.h:
3461 (JSC::X86Assembler::repatchCompact):
3462 * bytecode/CodeBlock.cpp:
3463 (JSC::dumpStructure):
3464 * bytecode/GetByIdStatus.h:
3465 (JSC::GetByIdStatus::GetByIdStatus):
3466 * dfg/DFGOperations.cpp:
3467 * dfg/DFGOperations.h:
3468 * dfg/DFGRepatch.cpp:
3469 (JSC::DFG::tryCacheGetByID):
3470 (JSC::DFG::emitPutTransitionStub):
3471 * dfg/DFGSpeculativeJIT.cpp:
3472 (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3473 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3474 * dfg/DFGSpeculativeJIT.h:
3475 (JSC::DFG::SpeculativeJIT::callOperation):
3476 * dfg/DFGSpeculativeJIT32_64.cpp:
3477 (JSC::DFG::SpeculativeJIT::compile):
3478 * dfg/DFGSpeculativeJIT64.cpp:
3479 (JSC::DFG::SpeculativeJIT::compile):
3480 * heap/ConservativeRoots.cpp:
3481 (JSC::ConservativeRoots::genericAddPointer):
3482 * heap/CopiedSpace.h:
3483 (CopiedSpace):
3484 * heap/CopiedSpaceInlineMethods.h:
3485 (JSC::CopiedSpace::pinIfNecessary):
3486 (JSC):
3487 * jit/JITPropertyAccess.cpp:
3488 (JSC::JIT::compileGetDirectOffset):
3489 * jit/JITPropertyAccess32_64.cpp:
3490 (JSC::JIT::compileGetDirectOffset):
3491 * jit/JITStubs.cpp:
3492 (JSC::JITThunks::tryCacheGetByID):
3493 * jsc.cpp:
3494 (GlobalObject::finishCreation):
3495 (functionDescribe):
3496 * llint/LLIntCommon.h:
3497 * llint/LLIntSlowPaths.cpp:
3498 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3499 * llint/LowLevelInterpreter32_64.asm:
3500 * llint/LowLevelInterpreter64.asm:
3501 * runtime/JSObject.cpp:
3502 (JSC::JSObject::visitChildren):
3503 (JSC::JSFinalObject::visitChildren):
3504 (JSC::JSObject::growOutOfLineStorage):
3505 * runtime/JSObject.h:
3506 (JSC::JSObject::getDirectLocation):
3507 (JSC::JSObject::offsetForLocation):
3508 * runtime/JSValue.h:
3509 (JSValue):
3510 * runtime/PropertyOffset.h:
3511 (JSC::offsetInOutOfLineStorage):
3512
35132012-07-23 Filip Pizlo <fpizlo@apple.com>
3514
fpizlo@apple.com5128a712012-07-23 22:46:14 +0000[diff] [blame]3515 DFG is too aggressive in performing the specific value optimization on loads
3516 https://bugs.webkit.org/show_bug.cgi?id=92034
3517
3518 Reviewed by Mark Hahnenberg.
3519
3520 This ensures that we don't do optimizations based on a structure having a specific
3521 value, if there is no way to detect that the value is despecified. This is the
3522 case for dictionaries, since despecifying a value in a dictionary does not lead to
3523 a transition and so cannot be caught by either structure checks or structure
3524 transition watchpoints.
3525
3526 * bytecode/GetByIdStatus.cpp:
3527 (JSC::GetByIdStatus::computeFromLLInt):
3528 (JSC::GetByIdStatus::computeForChain):
3529 (JSC::GetByIdStatus::computeFor):
3530 * bytecode/ResolveGlobalStatus.cpp:
3531 (JSC::computeForStructure):
3532
35332012-07-23 Filip Pizlo <fpizlo@apple.com>
3534
fpizlo@apple.com94a9c102012-07-23 22:38:30 +0000[diff] [blame]3535 REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
3536 https://bugs.webkit.org/show_bug.cgi?id=92002
3537
3538 Reviewed by Mark Hahnenberg.
3539
3540 In the process of changing the nature of local variable typing, I forgot to modify one of the places where
3541 we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
3542
3543 * dfg/DFGSpeculativeJIT.cpp:
3544 (JSC::DFG::SpeculativeJIT::compile):
3545
simon.fraser@apple.com8b810602012-07-23 21:03:45 +0000[diff] [blame]35462012-07-23 Simon Fraser <simon.fraser@apple.com>
3547
3548 Part 2 of: Implement sticky positioning
3549 https://bugs.webkit.org/show_bug.cgi?id=90046
3550
3551 Reviewed by Ojan Vafai.
3552
3553 Turn on ENABLE_CSS_STICKY_POSITION.
3554
3555 * Configurations/FeatureDefines.xcconfig:
3556
paroga@webkit.orgf4635662012-07-23 20:53:35 +0000[diff] [blame]35572012-07-23 Patrick Gansterer <paroga@webkit.org>
3558
3559 Move JSC::parseDate() from DateConversion to JSDateMath
3560 https://bugs.webkit.org/show_bug.cgi?id=91982
3561
3562 Reviewed by Geoffrey Garen.
3563
3564 Moveing this function into the other files removes the dependency
3565 on JSC spcific classes in DateConversion.{cpp|h}.
3566
3567 * runtime/DateConversion.cpp:
3568 * runtime/DateConversion.h:
3569 (JSC):
3570 * runtime/JSDateMath.cpp:
3571 (JSC::parseDate):
3572 (JSC):
3573 * runtime/JSDateMath.h:
3574 (JSC):
3575
simon.fraser@apple.com5cc8c732012-07-23 17:45:43 +0000[diff] [blame]35762012-07-23 Simon Fraser <simon.fraser@apple.com>
3577
3578 Part 1 of: Implement sticky positioning
3579 https://bugs.webkit.org/show_bug.cgi?id=90046
3580
3581 Reviewed by Ojan Vafai.
3582
3583 Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
3584
3585 Sort the ENABLE_CSS lines in the file. Make sure all the flags
3586 are in FEATURE_DEFINES.
3587
3588 * Configurations/FeatureDefines.xcconfig:
3589
commit-queue@webkit.org1f562642012-07-23 15:49:29 +0000[diff] [blame]35902012-07-23 Yong Li <yoli@rim.com>
3591
3592 [BlackBerry] Implement GCActivityCallback with platform timer
3593 https://bugs.webkit.org/show_bug.cgi?id=90175
3594
3595 Reviewed by Rob Buis.
3596
3597 Use JSLock when performing GC to avoid assertions.
3598
3599 * runtime/GCActivityCallbackBlackBerry.cpp:
3600 (JSC::DefaultGCActivityCallback::doWork):
3601
tkent@chromium.orgd89d5452012-07-22 23:23:53 +0000[diff] [blame]36022012-07-23 Kent Tamura <tkent@chromium.org>
3603
3604 Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
3605 https://bugs.webkit.org/show_bug.cgi?id=91941
3606
3607 Reviewed by Kentaro Hara.
3608
3609 A flag name for an elmement should be ENABLE_*_ELEMENT.
3610
3611 * Configurations/FeatureDefines.xcconfig:
3612
tkent@chromium.org43921e62012-07-22 10:59:32 +0000[diff] [blame]36132012-07-22 Kent Tamura <tkent@chromium.org>
3614
3615 Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
3616 https://bugs.webkit.org/show_bug.cgi?id=91928
3617
3618 Reviewed by Kentaro Hara.
3619
3620 A flag name for an elmement should be ENABLE_*_ELEMENT.
3621
3622 * Configurations/FeatureDefines.xcconfig:
3623
paroga@webkit.org6a026682012-07-21 21:22:28 +0000[diff] [blame]36242012-07-21 Patrick Gansterer <paroga@webkit.org>
3625
3626 [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
3627 https://bugs.webkit.org/show_bug.cgi?id=83436
3628
3629 Reviewed by Brent Fulgham.
3630
3631 The MS CRT implementation of strftime calls the same two functions.
3632 Using them directly avoids the overhead of parsing the format string and removes
3633 the dependency on strftime() for WinCE where this function does not exist.
3634
3635 * runtime/DatePrototype.cpp:
3636 (JSC::formatLocaleDate):
3637
tkent@chromium.org3d897372012-07-21 02:00:46 +0000[diff] [blame]36382012-07-20 Kent Tamura <tkent@chromium.org>
3639
3640 Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
3641 https://bugs.webkit.org/show_bug.cgi?id=91846
3642
3643 Reviewed by Kentaro Hara.
3644
3645 A flag name for an elmement should be ENABLE_*_ELEMENT.
3646
3647 * Configurations/FeatureDefines.xcconfig:
3648
commit-queue@webkit.org68c202c2012-07-20 20:09:02 +0000[diff] [blame]36492012-07-20 Han Shen <shenhan@google.com>
3650
3651 [Chromium] Compilation fails under gcc 4.7
3652 https://bugs.webkit.org/show_bug.cgi?id=90227
3653
3654 Reviewed by Tony Chang.
3655
3656 Disable warnings about c++0x compatibility in gcc newer than 4.6.
3657
3658 * JavaScriptCore.gyp/JavaScriptCore.gyp:
3659
fpizlo@apple.com00528432012-07-20 03:50:02 +0000[diff] [blame]36602012-07-18 Filip Pizlo <fpizlo@apple.com>
3661
3662 DFG cell checks should be hoisted
3663 https://bugs.webkit.org/show_bug.cgi?id=91717
3664
3665 Reviewed by Geoffrey Garen.
3666
3667 The DFG has always had the policy of hoisting array and integer checks to
3668 the point of variable assignment. Eventually, we added doubles and booleans
3669 to the mix. But cells should really be part of this as well, particularly
3670 for 32-bit where accessing a known-type variable is dramatically cheaper
3671 than accessing a variable whose types is only predicted but otherwise
3672 unproven.
3673
3674 This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
3675 for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
3676 all). Any slow-downs can, and should, be addressed by making the hoisting
3677 logic cognizant of variables that are never used in a manner that requires
3678 type checks, and by sinking argument checks to the point(s) of first use.
3679
3680 To make this work I had to change some OSR machinery, and special-case the
3681 type predictions of the 'this' argument for constructors. OSR exit normally
3682 assumes that arguments are boxed, which happens to be true because the
3683 type prediction used for check hoisting is LUB'd with the type of the
3684 argument that was passed in - so either the arguments are always stored to
3685 with the full tag+payload, or if only the payload is stored then the tag
3686 matches whatever the caller would have set. But not so with the 'this'
3687 argument for constructors, which is not initialized by the caller. We
3688 could make this more precise by having argument types for OSR be inferred
3689 using similar machinery to other locals, but I figured that for this patch
3690 I should use the surgical fix.
3691
3692 * assembler/MacroAssemblerX86_64.h:
3693 (JSC::MacroAssemblerX86_64::branchTestPtr):
3694 (MacroAssemblerX86_64):
3695 * assembler/X86Assembler.h:
3696 (JSC::X86Assembler::testq_rm):
3697 (X86Assembler):
3698 * dfg/DFGAbstractState.cpp:
3699 (JSC::DFG::AbstractState::initialize):
3700 (JSC::DFG::AbstractState::execute):
3701 * dfg/DFGDriver.cpp:
3702 (JSC::DFG::compile):
3703 * dfg/DFGGraph.h:
3704 (JSC::DFG::Graph::isCreatedThisArgument):
3705 (Graph):
3706 * dfg/DFGSpeculativeJIT.cpp:
3707 (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
3708 * dfg/DFGSpeculativeJIT32_64.cpp:
3709 (JSC::DFG::SpeculativeJIT::compile):
3710 * dfg/DFGSpeculativeJIT64.cpp:
3711 (JSC::DFG::SpeculativeJIT::compile):
3712 * dfg/DFGValueSource.h:
3713 (JSC::DFG::ValueSource::forSpeculation):
3714
fpizlo@apple.com26e27a62012-07-20 00:04:51 +0000[diff] [blame]37152012-07-19 Filip Pizlo <fpizlo@apple.com>
3716
3717 Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
3718 https://bugs.webkit.org/show_bug.cgi?id=91796
3719
3720 Reviewed by Geoffrey Garen.
3721
3722 * dfg/DFGRepatch.cpp:
3723 (JSC::DFG::emitPutTransitionStub):
3724 * dfg/DFGSpeculativeJIT.cpp:
3725 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3726 * runtime/JSObject.cpp:
3727 (JSC::JSObject::growOutOfLineStorage):
3728
commit-queue@webkit.orge602eca2012-07-19 20:53:22 +0000[diff] [blame]37292012-07-19 Mark Lam <mark.lam@apple.com>
3730
3731 Bug fixes and enhancements for OfflineASM annotation system.
3732 https://bugs.webkit.org/show_bug.cgi?id=91690
3733
3734 Reviewed by Filip Pizlo.
3735
3736 * offlineasm/armv7.rb: added default handling of Instruction lower().
3737 * offlineasm/asm.rb: added more support for annotations and more pretty printing.
3738 * offlineasm/ast.rb: added more support for annotations.
3739 * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
3740 * offlineasm/parser.rb: added more support for annotations.
3741 * offlineasm/transform.rb: added more support for annotations.
3742 * offlineasm/x86.rb: added default handling of Instruction lower().
3743
paroga@webkit.orgcb7c1a12012-07-19 18:20:53 +0000[diff] [blame]37442012-07-19 Patrick Gansterer <paroga@webkit.org>
3745
3746 [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
3747 https://bugs.webkit.org/show_bug.cgi?id=91243
3748
3749 Reviewed by Geoffrey Garen.
3750
3751 Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
3752
3753 * runtime/JSGlobalData.h:
3754 (JSC):
3755
commit-queue@webkit.orgf06140e2012-07-19 15:45:26 +0000[diff] [blame]37562012-07-19 Mark Lam <mark.lam@apple.com>
3757
3758 Fixed broken ENABLE_JIT=0 build.
3759 https://bugs.webkit.org/show_bug.cgi?id=91725
3760
3761 Reviewed by Oliver Hunt.
3762
3763 * bytecode/Watchpoint.cpp:
3764 * heap/JITStubRoutineSet.h:
3765 (JSC):
3766 (JITStubRoutineSet):
3767 (JSC::JITStubRoutineSet::JITStubRoutineSet):
3768 (JSC::JITStubRoutineSet::~JITStubRoutineSet):
3769 (JSC::JITStubRoutineSet::add):
3770 (JSC::JITStubRoutineSet::clearMarks):
3771 (JSC::JITStubRoutineSet::mark):
3772 (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
3773 (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
3774
kkristof@inf.u-szeged.hub203f612012-07-19 13:21:38 +0000[diff] [blame]37752012-07-19 Kristóf Kosztyó <kkristof@inf.u-szeged.hu>
3776
3777 [Qt] Unreviewed buildfix after r123042.
3778
3779 * interpreter/Interpreter.cpp:
3780 (JSC::Interpreter::dumpRegisters):
3781
fpizlo@apple.com1ffdcff2012-07-19 00:30:34 +0000[diff] [blame]37822012-07-18 Filip Pizlo <fpizlo@apple.com>
3783
3784 DFG should emit inline code for property storage (re)allocation
3785 https://bugs.webkit.org/show_bug.cgi?id=91597
3786
3787 Reviewed by Oliver Hunt.
3788
3789 This adds two new ops to the DFG IR: AllocatePropertyStorage and
3790 ReallocatePropertyStorage. It enables these to interact properly with
3791 CSE so that a GetPropertyStorage on something for which we have
3792 obviously done a (Re)AllocatePropertyStorage will result in the
3793 GetPropertyStorage being eliminated. Other than that, the code
3794 emitted for these ops is identical to the code we were emitting in
3795 the corresponding PutById stub.
3796
3797 * dfg/DFGAbstractState.cpp:
3798 (JSC::DFG::AbstractState::execute):
3799 * dfg/DFGByteCodeParser.cpp:
3800 (JSC::DFG::ByteCodeParser::parseBlock):
3801 * dfg/DFGCSEPhase.cpp:
3802 (JSC::DFG::CSEPhase::putStructureStoreElimination):
3803 (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
3804 * dfg/DFGNode.h:
3805 (JSC::DFG::Node::hasStructureTransitionData):
3806 * dfg/DFGNodeType.h:
3807 (DFG):
3808 * dfg/DFGOperations.cpp:
3809 * dfg/DFGOperations.h:
3810 * dfg/DFGPredictionPropagationPhase.cpp:
3811 (JSC::DFG::PredictionPropagationPhase::propagate):
3812 * dfg/DFGSpeculativeJIT.cpp:
3813 (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
3814 (DFG):
3815 (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
3816 * dfg/DFGSpeculativeJIT.h:
3817 (JSC::DFG::SpeculativeJIT::callOperation):
3818 (SpeculativeJIT):
3819 * dfg/DFGSpeculativeJIT32_64.cpp:
3820 (JSC::DFG::SpeculativeJIT::compile):
3821 * dfg/DFGSpeculativeJIT64.cpp:
3822 (JSC::DFG::SpeculativeJIT::compile):
3823 * runtime/Structure.cpp:
3824 (JSC::nextOutOfLineStorageCapacity):
3825 * runtime/Structure.h:
3826 (JSC):
3827
oliver@apple.coma08210b2012-07-18 23:26:06 +0000[diff] [blame]38282012-07-16 Oliver Hunt <oliver@apple.com>
3829
3830 dumpCallFrame is broken in ToT
3831 https://bugs.webkit.org/show_bug.cgi?id=91444
3832
3833 Reviewed by Gavin Barraclough.
3834
3835 Various changes have been made to the SF calling convention, but
3836 dumpCallFrame has not been updated to reflect these changes.
3837 That resulted in both bogus information, as well as numerous
3838 assertions of sadness.
3839
3840 This patch makes dumpCallFrame actually work again and adds the
3841 wonderful feature of telling you the name of the variable that a
3842 register reflects, or what value it contains.
3843
3844 * bytecode/CodeBlock.cpp:
3845 (JSC::CodeBlock::nameForRegister):
3846 A really innefficient mechanism for finding the name of a local register.
3847 This should only ever be used by debug code so this should be okay.
3848 * bytecode/CodeBlock.h:
3849 (CodeBlock):
3850 * bytecompiler/BytecodeGenerator.cpp:
3851 (JSC::BytecodeGenerator::generate):
3852 Debug builds no longer throw away a functions symbol table, this allows
3853 us to actually perform a register# to name mapping
3854 * dfg/DFGJITCompiler.cpp:
3855 (JSC::DFG::JITCompiler::link):
3856 We weren't propogating the bytecode offset here leading to assertions
3857 in debug builds when dumping bytecode of DFG compiled code.
3858 * interpreter/Interpreter.cpp:
3859 (JSC):
3860 (JSC::Interpreter::dumpRegisters):
3861 Rework to actually be correct.
3862 (JSC::getCallerInfo):
3863 Return the byteocde offset as well now, given we have to determine it
3864 anyway.
3865 (JSC::Interpreter::getStackTrace):
3866 (JSC::Interpreter::retrieveCallerFromVMCode):
3867 * interpreter/Interpreter.h:
3868 (Interpreter):
3869 * jsc.cpp:
3870 (GlobalObject::finishCreation):
3871 (functionDumpCallFrame):
3872 Give debug builds of JSC a method for calling dumpCallFrame so we can
3873 inspect a callframe without requiring us to break in a debugger.
3874
fpizlo@apple.comc6429b82012-07-18 22:17:18 +0000[diff] [blame]38752012-07-18 Filip Pizlo <fpizlo@apple.com>
3876
3877 DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
3878 https://bugs.webkit.org/show_bug.cgi?id=91599
3879
3880 Reviewed by Geoffrey Garen.
3881
3882 * dfg/DFGRepatch.cpp:
3883 (JSC::DFG::emitPutTransitionStub):
3884
fpizlo@apple.com07669e22012-07-17 23:11:23 +0000[diff] [blame]38852012-07-17 Filip Pizlo <fpizlo@apple.com>
3886
fpizlo@apple.com41c6f1e2012-07-18 04:42:55 +0000[diff] [blame]3887 DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
3888 https://bugs.webkit.org/show_bug.cgi?id=91576
3889
3890 Reviewed by Gavin Barraclough.
3891
3892 * dfg/DFGRepatch.cpp:
3893 (JSC::DFG::emitPutTransitionStub):
3894
38952012-07-17 Filip Pizlo <fpizlo@apple.com>
3896
fpizlo@apple.com07669e22012-07-17 23:11:23 +0000[diff] [blame]3897 [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
3898 https://bugs.webkit.org/show_bug.cgi?id=91476
3899
3900 Reviewed by Mark Hahnenberg.
3901
3902 The 32-bit repatching code was not correctly adapted to the new world where there may not always
3903 be an available scratch register. Fixed it by ensuring that the scratch register we select does
3904 not overlap with the value tag.
3905
3906 * dfg/DFGRepatch.cpp:
3907 (JSC::DFG::generateProtoChainAccessStub):
3908 (JSC::DFG::tryCacheGetByID):
3909 (JSC::DFG::tryBuildGetByIDList):
3910 (JSC::DFG::emitPutReplaceStub):
3911
rgabor@webkit.org600a0c12012-07-17 07:59:57 +0000[diff] [blame]39122012-07-17 Gabor Rapcsanyi <rgabor@webkit.org>
3913
3914 Unreviewed buildfix from Zoltan Herczeg after 122768.
3915
3916 * dfg/DFGCCallHelpers.h:
3917 (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
3918 (CCallHelpers):
3919
commit-queue@webkit.org7bf73302012-07-17 07:11:52 +0000[diff] [blame]39202012-07-17 David Barr <davidbarr@chromium.org>
3921
3922 Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
3923 https://bugs.webkit.org/show_bug.cgi?id=89055
3924
3925 Reviewed by Kent Tamura.
3926
3927 The css3-images module is at candidate recommendation.
3928 http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
3929
3930 Add a configuration option for CSS image-orientation support, disabling it by default.
3931
3932 * Configurations/FeatureDefines.xcconfig:
3933
fpizlo@apple.com68bef1d2012-07-17 01:43:56 +0000[diff] [blame]39342012-07-16 Filip Pizlo <fpizlo@apple.com>
3935
3936 Unreviewed, roll out 122790 because it broke the Windows build. I'm not
3937 sure what to do with exported symbols that are predicated on NDEBUG.
3938
3939 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3940 * bytecode/CodeBlock.cpp:
3941 (JSC):
3942 * bytecode/CodeBlock.h:
3943 (CodeBlock):
3944 * bytecompiler/BytecodeGenerator.cpp:
3945 (JSC::BytecodeGenerator::generate):
3946 * dfg/DFGJITCompiler.cpp:
3947 (JSC::DFG::JITCompiler::link):
3948 * interpreter/Interpreter.cpp:
3949 (JSC):
3950 (JSC::Interpreter::dumpRegisters):
3951 (JSC::getCallerInfo):
3952 (JSC::Interpreter::getStackTrace):
3953 (JSC::Interpreter::retrieveCallerFromVMCode):
3954 * interpreter/Interpreter.h:
3955 (Interpreter):
3956 * jsc.cpp:
3957 (GlobalObject::finishCreation):
3958
oliver@apple.com0acb42b2012-07-17 01:14:18 +0000[diff] [blame]39592012-07-16 Oliver Hunt <oliver@apple.com>
3960
3961 dumpCallFrame is broken in ToT
3962 https://bugs.webkit.org/show_bug.cgi?id=91444
3963
3964 Reviewed by Gavin Barraclough.
3965
3966 Various changes have been made to the SF calling convention, but
3967 dumpCallFrame has not been updated to reflect these changes.
3968 That resulted in both bogus information, as well as numerous
3969 assertions of sadness.
3970
3971 This patch makes dumpCallFrame actually work again and adds the
3972 wonderful feature of telling you the name of the variable that a
3973 register reflects, or what value it contains.
3974
3975 * bytecode/CodeBlock.cpp:
3976 (JSC::CodeBlock::nameForRegister):
3977 A really innefficient mechanism for finding the name of a local register.
3978 This should only ever be used by debug code so this should be okay.
3979 * bytecode/CodeBlock.h:
3980 (CodeBlock):
3981 * bytecompiler/BytecodeGenerator.cpp:
3982 (JSC::BytecodeGenerator::generate):
3983 Debug builds no longer throw away a functions symbol table, this allows
3984 us to actually perform a register# to name mapping
3985 * dfg/DFGJITCompiler.cpp:
3986 (JSC::DFG::JITCompiler::link):
3987 We weren't propogating the bytecode offset here leading to assertions
3988 in debug builds when dumping bytecode of DFG compiled code.
3989 * interpreter/Interpreter.cpp:
3990 (JSC):
3991 (JSC::Interpreter::dumpRegisters):
3992 Rework to actually be correct.
3993 (JSC::getCallerInfo):
3994 Return the byteocde offset as well now, given we have to determine it
3995 anyway.
3996 (JSC::Interpreter::getStackTrace):
3997 (JSC::Interpreter::retrieveCallerFromVMCode):
3998 * interpreter/Interpreter.h:
3999 (Interpreter):
4000 * jsc.cpp:
4001 (GlobalObject::finishCreation):
4002 (functionDumpCallFrame):
4003 Give debug builds of JSC a method for calling dumpCallFrame so we can
4004 inspect a callframe without requiring us to break in a debugger.
4005
fpizlo@apple.comcd8b6662012-07-16 22:17:29 +0000[diff] [blame]40062012-07-16 Filip Pizlo <fpizlo@apple.com>
4007
4008 Unreviewed, adding forgotten files.
4009
4010 * dfg/DFGRegisterSet.h: Added.
4011 (DFG):
4012 (RegisterSet):
4013 (JSC::DFG::RegisterSet::RegisterSet):
4014 (JSC::DFG::RegisterSet::asPOD):
4015 (JSC::DFG::RegisterSet::copyInfo):
4016 (JSC::DFG::RegisterSet::set):
4017 (JSC::DFG::RegisterSet::setGPRByIndex):
4018 (JSC::DFG::RegisterSet::clear):
4019 (JSC::DFG::RegisterSet::get):
4020 (JSC::DFG::RegisterSet::getGPRByIndex):
4021 (JSC::DFG::RegisterSet::getFreeGPR):
4022 (JSC::DFG::RegisterSet::setFPRByIndex):
4023 (JSC::DFG::RegisterSet::getFPRByIndex):
4024 (JSC::DFG::RegisterSet::setByIndex):
4025 (JSC::DFG::RegisterSet::getByIndex):
4026 (JSC::DFG::RegisterSet::numberOfSetGPRs):
4027 (JSC::DFG::RegisterSet::numberOfSetFPRs):
4028 (JSC::DFG::RegisterSet::numberOfSetRegisters):
4029 (JSC::DFG::RegisterSet::setBit):
4030 (JSC::DFG::RegisterSet::clearBit):
4031 (JSC::DFG::RegisterSet::getBit):
4032 * dfg/DFGScratchRegisterAllocator.h: Added.
4033 (DFG):
4034 (ScratchRegisterAllocator):
4035 (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
4036 (JSC::DFG::ScratchRegisterAllocator::lock):
4037 (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
4038 (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
4039 (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
4040 (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
4041 (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
4042 (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
4043 (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
4044 (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
4045 (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
4046
fpizlo@apple.com2f2052a2012-07-16 22:08:21 +0000[diff] [blame]40472012-07-15 Filip Pizlo <fpizlo@apple.com>
4048
4049 DFG PutById transition should handle storage allocation, and inline it
4050 https://bugs.webkit.org/show_bug.cgi?id=91337
4051
4052 Reviewed by Oliver Hunt.
4053
4054 This enables the patching of DFG PutById to handle the out-of-line storage
4055 allocation case. Furthermore, it inlines out-of-line storage allocation (and
4056 reallocation) into the generated stubs.
4057
4058 To do this, this patch adds the ability to store the relevant register
4059 allocation state (i.e. the set of in-use registers) in the structure stub
4060 info so that the stub generation code can more flexibly select scratch
4061 registers: sometimes it needs none, sometimes one - or sometimes up to
4062 three. Moreover, to make the stub generation register allocation simple and
4063 maintainable, this patch introduces a reusable scratch register allocator
4064 class. This register allocator understands that some registers are in use by
4065 the main path code and so must be spilled as necessary, other registers are
4066 locked for use in the stub itself and so cannot even be spilled, while still
4067 others may be allocated for scratch purposes. A scratch register that is
4068 used must be spilled. If a register is locked, it cannot be used as a
4069 scratch register. If a register is used, it can be used as a scratch
4070 register so long as it is spilled.
4071
4072 This is a sub-1% speed-up on V8 and neutral elsewhere.
4073
4074 * GNUmakefile.list.am:
4075 * JavaScriptCore.xcodeproj/project.pbxproj:
4076 * assembler/MacroAssemblerCodeRef.h:
4077 (FunctionPtr):
4078 (JSC::FunctionPtr::FunctionPtr):
4079 * bytecode/StructureStubInfo.h:
4080 * dfg/DFGCCallHelpers.h:
4081 (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
4082 (CCallHelpers):
4083 * dfg/DFGGPRInfo.h:
4084 * dfg/DFGJITCompiler.cpp:
4085 (JSC::DFG::JITCompiler::link):
4086 * dfg/DFGJITCompiler.h:
4087 (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
4088 (PropertyAccessRecord):
4089 * dfg/DFGOperations.cpp:
4090 * dfg/DFGOperations.h:
4091 * dfg/DFGRegisterBank.h:
4092 (JSC::DFG::RegisterBank::isInUse):
4093 (RegisterBank):
4094 * dfg/DFGRegisterSet.h: Added.
4095 (DFG):
4096 (RegisterSet):
4097 (JSC::DFG::RegisterSet::RegisterSet):
4098 (JSC::DFG::RegisterSet::asPOD):
4099 (JSC::DFG::RegisterSet::copyInfo):
4100 (JSC::DFG::RegisterSet::set):
4101 (JSC::DFG::RegisterSet::setGPRByIndex):
4102 (JSC::DFG::RegisterSet::clear):
4103 (JSC::DFG::RegisterSet::get):
4104 (JSC::DFG::RegisterSet::getGPRByIndex):
4105 (JSC::DFG::RegisterSet::getFreeGPR):
4106 (JSC::DFG::RegisterSet::setFPRByIndex):
4107 (JSC::DFG::RegisterSet::getFPRByIndex):
4108 (JSC::DFG::RegisterSet::setByIndex):
4109 (JSC::DFG::RegisterSet::getByIndex):
4110 (JSC::DFG::RegisterSet::numberOfSetGPRs):
4111 (JSC::DFG::RegisterSet::numberOfSetFPRs):
4112 (JSC::DFG::RegisterSet::numberOfSetRegisters):
4113 (JSC::DFG::RegisterSet::setBit):
4114 (JSC::DFG::RegisterSet::clearBit):
4115 (JSC::DFG::RegisterSet::getBit):
4116 * dfg/DFGRepatch.cpp:
4117 (JSC::DFG::generateProtoChainAccessStub):
4118 (JSC::DFG::tryCacheGetByID):
4119 (JSC::DFG::tryBuildGetByIDList):
4120 (JSC::DFG::emitPutReplaceStub):
4121 (JSC::DFG::emitPutTransitionStub):
4122 (JSC::DFG::tryCachePutByID):
4123 (JSC::DFG::tryBuildPutByIdList):
4124 * dfg/DFGScratchRegisterAllocator.h: Added.
4125 (DFG):
4126 (ScratchRegisterAllocator):
4127 (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
4128 (JSC::DFG::ScratchRegisterAllocator::lock):
4129 (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
4130 (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
4131 (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
4132 (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
4133 (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
4134 (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
4135 (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
4136 (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
4137 (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
4138 * dfg/DFGSpeculativeJIT.h:
4139 (SpeculativeJIT):
4140 (JSC::DFG::SpeculativeJIT::usedRegisters):
4141 * dfg/DFGSpeculativeJIT32_64.cpp:
4142 (JSC::DFG::SpeculativeJIT::cachedGetById):
4143 (JSC::DFG::SpeculativeJIT::cachedPutById):
4144 (JSC::DFG::SpeculativeJIT::compile):
4145 * dfg/DFGSpeculativeJIT64.cpp:
4146 (JSC::DFG::SpeculativeJIT::cachedGetById):
4147 (JSC::DFG::SpeculativeJIT::cachedPutById):
4148 (JSC::DFG::SpeculativeJIT::compile):
4149 * heap/CopiedAllocator.h:
4150 (CopiedAllocator):
4151 (JSC::CopiedAllocator::fastPathShouldSucceed):
4152 (JSC):
4153
paroga@webkit.org24c86b82012-07-16 20:06:15 +0000[diff] [blame]41542012-07-16 Patrick Gansterer <paroga@webkit.org>
4155
4156 Add dfg switch to create_jit_stubs script
4157 https://bugs.webkit.org/show_bug.cgi?id=91256
4158
4159 Reviewed by Geoffrey Garen.
4160
4161 * create_jit_stubs: Add a switch to enable or disable the generation of
4162 stub functions in #if ENABLE(DFG_JIT) conditions.
4163
rgabor@webkit.org58c69f82012-07-16 15:05:57 +0000[diff] [blame]41642012-07-16 Gabor Rapcsanyi <rgabor@webkit.org>
4165
rgabor@webkit.org43ad3e52012-07-16 16:16:03 +0000[diff] [blame]4166 Unreviewed buildfix after r122729. Typo fix.
4167
4168 * assembler/MacroAssemblerARM.h:
4169 (JSC::MacroAssemblerARM::add32):
4170
41712012-07-16 Gabor Rapcsanyi <rgabor@webkit.org>
4172
rgabor@webkit.org58c69f82012-07-16 15:05:57 +0000[diff] [blame]4173 Unreviewed buildfix from Zoltan Herczeg after r122677.
4174 Implement missing add32 function to MacroAssemblerARM.
4175
4176 * assembler/MacroAssemblerARM.h:
4177 (JSC::MacroAssemblerARM::add32):
4178 (MacroAssemblerARM):
4179
fpizlo@apple.com327f2372012-07-15 04:02:16 +0000[diff] [blame]41802012-07-14 Filip Pizlo <fpizlo@apple.com>
4181
fpizlo@apple.coma4eaa8a2012-07-15 05:23:58 +0000[diff] [blame]4182 DFG PutByVal opcodes should accept more than 3 operands
4183 https://bugs.webkit.org/show_bug.cgi?id=91332
4184
4185 Reviewed by Oliver Hunt.
4186
4187 Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
4188 4 or more operands in the future.
4189
4190 * dfg/DFGAbstractState.cpp:
4191 (JSC::DFG::AbstractState::execute):
4192 * dfg/DFGByteCodeParser.cpp:
4193 (JSC::DFG::ByteCodeParser::parseBlock):
4194 * dfg/DFGCSEPhase.cpp:
4195 (JSC::DFG::CSEPhase::getByValLoadElimination):
4196 (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
4197 (JSC::DFG::CSEPhase::performNodeCSE):
4198 * dfg/DFGFixupPhase.cpp:
4199 (JSC::DFG::FixupPhase::fixupNode):
4200 (JSC::DFG::FixupPhase::fixDoubleEdge):
4201 * dfg/DFGGraph.h:
4202 (JSC::DFG::Graph::byValIsPure):
4203 (JSC::DFG::Graph::varArgNumChildren):
4204 (Graph):
4205 (JSC::DFG::Graph::numChildren):
4206 (JSC::DFG::Graph::varArgChild):
4207 (JSC::DFG::Graph::child):
4208 * dfg/DFGNodeType.h:
4209 (DFG):
4210 * dfg/DFGPredictionPropagationPhase.cpp:
4211 (JSC::DFG::PredictionPropagationPhase::propagate):
4212 * dfg/DFGSpeculativeJIT.cpp:
4213 (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
4214 (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
4215 * dfg/DFGSpeculativeJIT32_64.cpp:
4216 (JSC::DFG::SpeculativeJIT::compile):
4217 * dfg/DFGSpeculativeJIT64.cpp:
4218 (JSC::DFG::SpeculativeJIT::compile):
4219
42202012-07-14 Filip Pizlo <fpizlo@apple.com>
4221
fpizlo@apple.com327f2372012-07-15 04:02:16 +0000[diff] [blame]4222 Rationalize and optimize storage allocation
4223 https://bugs.webkit.org/show_bug.cgi?id=91303
4224
4225 Reviewed by Oliver Hunt.
4226
4227 This implements a backwards bump allocator for copied space storage
4228 allocation, shown in pseudo-code below:
4229
4230 pointer bump(size) {
4231 pointer tmp = allocator->remaining;
4232 tmp -= size;
4233 if (tmp < 0)
4234 fail;
4235 allocator->remaining = tmp;
4236 return allocator->payloadEnd - tmp - size;
4237 }
4238
4239 The advantage of this allocator is that it:
4240
4241 - Only requires one comparison in the common case where size is known to
4242 not be huge, and this comparison can be done by checking the sign bit
4243 of the subtraction.
4244
4245 - Can be implemented even when only one register is available. This
4246 register is reused for both temporary storage during allocation and
4247 for the result.
4248
4249 - Preserves the behavior that memory in a block is filled in from lowest
4250 address to highest address, which allows for a cheap reallocation fast
4251 path.
4252
4253 - Is resilient against the block used for allocation being the last one
4254 in virtual memory, thereby otherwise leading to the risk of overflow
4255 in the bump pointer, despite only doing one branch.
4256
4257 In order to implement this allocator using the smallest possible chunk
4258 of code, I refactored the copied space code so that all of the allocation
4259 logic is in CopiedAllocator, and all of the state is in either
4260 CopiedBlock or CopiedAllocator. This should make changing the allocation
4261 fast path easier in the future.
4262
4263 In order to do this, I needed to add some new assembler support,
4264 particularly for various forms of add(address, register) and negPtr().
4265
4266 This is performance neutral. The purpose of this change is to facilitate
4267 further inlining of storage allocation without having to reserve
4268 additional registers or emit too much code.
4269
4270 * assembler/MacroAssembler.h:
4271 (JSC::MacroAssembler::addPtr):
4272 (MacroAssembler):
4273 (JSC::MacroAssembler::negPtr):
4274 * assembler/MacroAssemblerARMv7.h:
4275 (MacroAssemblerARMv7):
4276 (JSC::MacroAssemblerARMv7::add32):
4277 * assembler/MacroAssemblerX86.h:
4278 (JSC::MacroAssemblerX86::add32):
4279 (MacroAssemblerX86):
4280 * assembler/MacroAssemblerX86_64.h:
4281 (MacroAssemblerX86_64):
4282 (JSC::MacroAssemblerX86_64::addPtr):
4283 (JSC::MacroAssemblerX86_64::negPtr):
4284 * assembler/X86Assembler.h:
4285 (X86Assembler):
4286 (JSC::X86Assembler::addl_mr):
4287 (JSC::X86Assembler::addq_mr):
4288 (JSC::X86Assembler::negq_r):
4289 * heap/CopiedAllocator.h:
4290 (CopiedAllocator):
4291 (JSC::CopiedAllocator::isValid):
4292 (JSC::CopiedAllocator::CopiedAllocator):
4293 (JSC::CopiedAllocator::tryAllocate):
4294 (JSC):
4295 (JSC::CopiedAllocator::tryReallocate):
4296 (JSC::CopiedAllocator::forceAllocate):
4297 (JSC::CopiedAllocator::resetCurrentBlock):
4298 (JSC::CopiedAllocator::setCurrentBlock):
4299 (JSC::CopiedAllocator::currentCapacity):
4300 * heap/CopiedBlock.h:
4301 (CopiedBlock):
4302 (JSC::CopiedBlock::create):
4303 (JSC::CopiedBlock::zeroFillWilderness):
4304 (JSC::CopiedBlock::CopiedBlock):
4305 (JSC::CopiedBlock::payloadEnd):
4306 (JSC):
4307 (JSC::CopiedBlock::payloadCapacity):
4308 (JSC::CopiedBlock::data):
4309 (JSC::CopiedBlock::dataEnd):
4310 (JSC::CopiedBlock::dataSize):
4311 (JSC::CopiedBlock::wilderness):
4312 (JSC::CopiedBlock::wildernessEnd):
4313 (JSC::CopiedBlock::wildernessSize):
4314 (JSC::CopiedBlock::size):
4315 * heap/CopiedSpace.cpp:
4316 (JSC::CopiedSpace::tryAllocateSlowCase):
4317 (JSC::CopiedSpace::tryAllocateOversize):
4318 (JSC::CopiedSpace::tryReallocate):
4319 (JSC::CopiedSpace::doneFillingBlock):
4320 (JSC::CopiedSpace::doneCopying):
4321 * heap/CopiedSpace.h:
4322 (CopiedSpace):
4323 * heap/CopiedSpaceInlineMethods.h:
4324 (JSC::CopiedSpace::startedCopying):
4325 (JSC::CopiedSpace::allocateBlockForCopyingPhase):
4326 (JSC::CopiedSpace::allocateBlock):
4327 (JSC::CopiedSpace::tryAllocate):
4328 (JSC):
4329 * heap/MarkStack.cpp:
4330 (JSC::SlotVisitor::startCopying):
4331 (JSC::SlotVisitor::allocateNewSpace):
4332 (JSC::SlotVisitor::doneCopying):
4333 * heap/SlotVisitor.h:
4334 (JSC::SlotVisitor::SlotVisitor):
4335 * jit/JIT.h:
4336 * jit/JITInlineMethods.h:
4337 (JSC::JIT::emitAllocateBasicStorage):
4338 (JSC::JIT::emitAllocateJSArray):
4339
commit-queue@webkit.org782c20b2012-07-14 00:44:47 +0000[diff] [blame]43402012-07-13 Mark Lam <mark.lam@apple.com>
4341
4342 OfflineASM Pretty printing and commenting enhancements.
4343 https://bugs.webkit.org/show_bug.cgi?id=91281
4344
4345 Reviewed by Filip Pizlo.
4346
4347 Added some minor pretty printing in the OfflineASM.
4348 Also added infrastruture for adding multiple types of comments and
4349 annotations with the ability to enable/disable them in the generated
4350 output as desired.
4351
4352 * GNUmakefile.list.am: add new file config.rb.
4353 * llint/LLIntOfflineAsmConfig.h:
4354 Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
4355 This will allow us to redefine these for other backends later.
4356 * llint/LowLevelInterpreter32_64.asm:
4357 Add a small example of instruction annotations for now.
4358 * llint/LowLevelInterpreter64.asm:
4359 Add a small example of instruction annotations for now.
4360 * offlineasm/armv7.rb: Added handling of annotations.
4361 * offlineasm/asm.rb:
4362 Added machinery to dump the new comments and annotations.
4363 Also added some indentations to make the output a little prettier.
4364 * offlineasm/ast.rb: Added annotation field in class Instruction.
4365 * offlineasm/backends.rb:
4366 * offlineasm/config.rb: Added.
4367 Currently only contains commenting options. This file is meant to be
4368 a centralized place for build config values much like config.h for
4369 JavaScriptCore.
4370 * offlineasm/generate_offset_extractor.rb:
4371 * offlineasm/instructions.rb:
4372 * offlineasm/offsets.rb:
4373 * offlineasm/opt.rb:
4374 * offlineasm/parser.rb: Parse and record annotations.
4375 * offlineasm/registers.rb:
4376 * offlineasm/self_hash.rb:
4377 * offlineasm/settings.rb:
4378 * offlineasm/transform.rb:
4379 * offlineasm/x86.rb: Added handling of annotations.
4380
fpizlo@apple.com8ff7c5e72012-07-13 23:55:18 +0000[diff] [blame]43812012-07-13 Filip Pizlo <fpizlo@apple.com>
4382
4383 ASSERTION FAILED: use.useKind() != DoubleUse
4384 https://bugs.webkit.org/show_bug.cgi?id=91082
4385
4386 Reviewed by Geoffrey Garen.
4387
4388 The implementation of Branch() was unwisely relying on register allocation state
4389 to decide what speculations to perform. That's never correct.
4390
4391 * dfg/DFGSpeculativeJIT32_64.cpp:
4392 (JSC::DFG::SpeculativeJIT::compile):
4393 * dfg/DFGSpeculativeJIT64.cpp:
4394 (JSC::DFG::SpeculativeJIT::compile):
4395
commit-queue@webkit.org2e002d12012-07-13 23:36:34 +0000[diff] [blame]43962012-07-13 Sheriff Bot <webkit.review.bot@gmail.com>
4397
4398 Unreviewed, rolling out r122640.
4399 http://trac.webkit.org/changeset/122640
4400 https://bugs.webkit.org/show_bug.cgi?id=91298
4401
4402 LLInt apparently does not expect to mark these (Requested by
4403 olliej on #webkit).
4404
4405 * bytecode/CodeBlock.cpp:
4406 (JSC::CodeBlock::visitStructures):
4407 (JSC::CodeBlock::stronglyVisitStrongReferences):
4408
oliver@apple.comca095d52012-07-13 23:12:14 +0000[diff] [blame]44092012-07-13 Oliver Hunt <oliver@apple.com>
4410
4411 LLInt fails to mark structures stored in the bytecode
4412 https://bugs.webkit.org/show_bug.cgi?id=91296
4413
4414 Reviewed by Geoffrey Garen.
4415
4416 LLInt stores structures in the bytecode, so we need to visit the appropriate
4417 instructions as we would if we were running in the classic interpreter.
4418 This requires adding additional checks for the LLInt specific opcodes, and
4419 the lint specific variants of operand ordering.
4420
4421 * bytecode/CodeBlock.cpp:
4422 (JSC::CodeBlock::visitStructures):
4423 (JSC::CodeBlock::stronglyVisitStrongReferences):
4424
commit-queue@webkit.orgf9b0ef22012-07-13 20:12:36 +0000[diff] [blame]44252012-07-13 Yong Li <yoli@rim.com>
4426
4427 [BlackBerry] Implement GCActivityCallback with platform timer
4428 https://bugs.webkit.org/show_bug.cgi?id=90175
4429
4430 Reviewed by Rob Buis.
4431
4432 Implement GCActivityCallback and HeapTimer for BlackBerry port.
4433
4434 * heap/HeapTimer.cpp:
4435 (JSC):
4436 (JSC::HeapTimer::HeapTimer):
4437 (JSC::HeapTimer::~HeapTimer):
4438 (JSC::HeapTimer::timerDidFire):
4439 (JSC::HeapTimer::synchronize):
4440 (JSC::HeapTimer::invalidate):
4441 (JSC::HeapTimer::didStartVMShutdown):
4442 * heap/HeapTimer.h:
4443 (HeapTimer):
4444 * runtime/GCActivityCallbackBlackBerry.cpp:
4445 (JSC):
4446 (JSC::DefaultGCActivityCallback::doWork):
4447 (JSC::DefaultGCActivityCallback::didAllocate):
4448 (JSC::DefaultGCActivityCallback::willCollect):
4449 (JSC::DefaultGCActivityCallback::cancel):
4450
paroga@webkit.orgcc7dc5b2012-07-13 16:35:46 +0000[diff] [blame]44512012-07-13 Patrick Gansterer <paroga@webkit.org>
4452
paroga@webkit.org4a3ecbd2012-07-13 16:53:20 +0000[diff] [blame]4453 [WIN] Fix compilation of DFGRepatch.cpp
4454 https://bugs.webkit.org/show_bug.cgi?id=91241
4455
4456 Reviewed by Geoffrey Garen.
4457
4458 Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
4459 to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
4460
4461 * dfg/DFGRepatch.cpp:
4462 (JSC::DFG::dfgResetGetByID):
4463 (JSC::DFG::dfgResetPutByID):
4464
44652012-07-13 Patrick Gansterer <paroga@webkit.org>
4466
paroga@webkit.orgcc7dc5b2012-07-13 16:35:46 +0000[diff] [blame]4467 Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
4468 https://bugs.webkit.org/show_bug.cgi?id=91238
4469
4470 Reviewed by Zoltan Herczeg.
4471
4472 r121885 changed the assembler instruction only for COMPILER(GCC).
4473 Use the same instructions for the other compilers too.
4474
4475 * jit/JITStubs.cpp:
4476 (JSC::ctiTrampoline):
4477 (JSC::ctiTrampolineEnd):
4478 (JSC::ctiVMThrowTrampoline):
4479
fpizlo@apple.comedcb7a92012-07-13 05:31:05 +0000[diff] [blame]44802012-07-12 Filip Pizlo <fpizlo@apple.com>
4481
fpizlo@apple.comcf716122012-07-13 06:41:18 +0000[diff] [blame]4482 DFG property access stubs should use structure transition watchpoints
4483 https://bugs.webkit.org/show_bug.cgi?id=91135
4484
4485 Reviewed by Geoffrey Garen.
4486
4487 This adds a Watchpoint subclass that will clear a structure stub (i.e.
4488 a property access stub) when fired. The DFG stub generation code now
4489 uses this optimization.
4490
4491 * CMakeLists.txt:
4492 * GNUmakefile.list.am:
4493 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4494 * JavaScriptCore.xcodeproj/project.pbxproj:
4495 * Target.pri:
4496 * bytecode/CodeBlock.cpp:
4497 (JSC):
4498 (JSC::CodeBlock::finalizeUnconditionally):
4499 (JSC::CodeBlock::resetStub):
4500 (JSC::CodeBlock::resetStubInternal):
4501 * bytecode/CodeBlock.h:
4502 (JSC):
4503 (CodeBlock):
4504 * bytecode/StructureStubClearingWatchpoint.cpp: Added.
4505 (JSC):
4506 (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
4507 (JSC::StructureStubClearingWatchpoint::push):
4508 (JSC::StructureStubClearingWatchpoint::fireInternal):
4509 (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
4510 (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
4511 (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
4512 * bytecode/StructureStubClearingWatchpoint.h: Added.
4513 (JSC):
4514 (StructureStubClearingWatchpoint):
4515 (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
4516 (WatchpointsOnStructureStubInfo):
4517 (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
4518 (JSC::WatchpointsOnStructureStubInfo::codeBlock):
4519 (JSC::WatchpointsOnStructureStubInfo::stubInfo):
4520 * bytecode/StructureStubInfo.h:
4521 (JSC::StructureStubInfo::reset):
4522 (JSC::StructureStubInfo::addWatchpoint):
4523 (StructureStubInfo):
4524 * dfg/DFGRepatch.cpp:
4525 (JSC::DFG::addStructureTransitionCheck):
4526 (DFG):
4527 (JSC::DFG::generateProtoChainAccessStub):
4528 (JSC::DFG::emitPutTransitionStub):
4529 * jit/JumpReplacementWatchpoint.h:
4530
45312012-07-12 Filip Pizlo <fpizlo@apple.com>
4532
fpizlo@apple.comedcb7a92012-07-13 05:31:05 +0000[diff] [blame]4533 DFG CFA may get overzealous in loops that have code that must exit
4534 https://bugs.webkit.org/show_bug.cgi?id=91188
4535
4536 Reviewed by Gavin Barraclough.
4537
4538 Ensure that if the CFA assumes that an operation must exit, then it will always exit
4539 no matter what happens after. That's necessary to preserve soundness.
4540
4541 Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
4542 variable-at-head was the first access in the second block in the merge, if the first
4543 block did not read the variable. That's totally wrong, if the first block was in fact
4544 doing a phantom read. I removed that fixup and instead hardened the rest of the
4545 compiler.
4546
4547 * dfg/DFGAbstractState.cpp:
4548 (JSC::DFG::AbstractState::endBasicBlock):
4549 * dfg/DFGBasicBlock.h:
4550 (JSC::DFG::BasicBlock::BasicBlock):
4551 (BasicBlock):
4552 * dfg/DFGCFAPhase.cpp:
4553 (JSC::DFG::CFAPhase::performBlockCFA):
4554 * dfg/DFGCFGSimplificationPhase.cpp:
4555 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
4556 * dfg/DFGConstantFoldingPhase.cpp:
4557 (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
4558 (JSC::DFG::ConstantFoldingPhase::run):
4559 (ConstantFoldingPhase):
4560 (JSC::DFG::ConstantFoldingPhase::foldConstants):
4561 (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
4562 * dfg/DFGVariableEventStream.cpp:
4563 (JSC::DFG::VariableEventStream::reconstruct):
4564
allan.jensen@nokia.comb619bbf22012-07-12 15:34:35 +0000[diff] [blame]45652012-07-12 Allan Sandfeld Jensen <allan.jensen@nokia.com>
4566
4567 [Qt] Implement MemoryUsageSupport
4568 https://bugs.webkit.org/show_bug.cgi?id=91094
4569
4570 Reviewed by Adam Barth.
4571
4572 Compile in MemoryStatistics so we can make use of the interface.
4573
4574 * Target.pri:
4575
ossy@webkit.org8db5d862012-07-12 07:53:08 +0000[diff] [blame]45762012-07-12 Csaba Osztrogonác <ossy@webkit.org>
4577
4578 Remove dead code after r122392.
4579 https://bugs.webkit.org/show_bug.cgi?id=91049
4580
4581 Reviewed by Filip Pizlo.
4582
4583 * dfg/DFGSpeculativeJIT64.cpp:
4584 (JSC::DFG::SpeculativeJIT::emitCall):
4585
commit-queue@webkit.org55a950b2012-07-12 02:49:24 +0000[diff] [blame]45862012-07-11 Adenilson Cavalcanti <cavalcantii@gmail.com>
4587
4588 Build fix + remove dead code
4589 https://bugs.webkit.org/show_bug.cgi?id=91039
4590
4591 Reviewed by Filip Pizlo.
4592
4593 An unused variable was breaking compilation (thanks to warnings being treated as errors).
4594
4595 * dfg/DFGSpeculativeJIT32_64.cpp:
4596 (JSC::DFG::SpeculativeJIT::emitCall):
4597
mrowe@apple.comc8887bf2012-07-12 02:01:25 +0000[diff] [blame]45982012-07-11 Mark Rowe <mrowe@apple.com>
4599
4600 <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
4601
4602 Reviewed by Dan Bernstein.
4603
4604 The deployment target is already set to the version that we're targeting, and it's that setting
4605 which determines which functionality from the SDK is available to us.
4606
4607 * Configurations/Base.xcconfig:
4608
fpizlo@apple.com3d949152012-07-11 23:12:35 +0000[diff] [blame]46092012-07-11 Filip Pizlo <fpizlo@apple.com>
4610
fpizlo@apple.com5e135772012-07-12 00:12:03 +0000[diff] [blame]4611 DFG should have fast virtual calls
4612 https://bugs.webkit.org/show_bug.cgi?id=90924
4613
4614 Reviewed by Gavin Barraclough.
4615
4616 Implements virtual call support in the style of the old JIT, with the
4617 caveat that we still use the same slow path for both InternalFunction
4618 calls and JSFunction calls. Also rationalized the way that our
4619 CodeOrigin indices tie into exception checks (previously it was a
4620 strange one-to-one mapping with fairly limited assertions; now it's a
4621 one-to-many mapping for CodeOrigins to exception checks, respectively).
4622 I also took the opportunity to clean up
4623 CallLinkInfo::callReturnLocation, which previously was either a Call or
4624 a NearCall. Now it's just a NearCall. As well, exceptions during slow
4625 path call resolution are now handled by returning an exception throwing
4626 thunk rather than returning null. And finally, I made a few things
4627 public that were previously private-with-lots-of-friends, because I
4628 truly despise the thought of listing each thunk generating function as
4629 a friend of JSValue and friends.
4630
4631 * bytecode/CallLinkInfo.cpp:
4632 (JSC::CallLinkInfo::unlink):
4633 * bytecode/CallLinkInfo.h:
4634 (CallLinkInfo):
4635 * bytecode/CodeOrigin.h:
4636 (JSC::CodeOrigin::CodeOrigin):
4637 (JSC::CodeOrigin::isSet):
4638 * dfg/DFGAssemblyHelpers.h:
4639 (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
4640 * dfg/DFGCCallHelpers.h:
4641 (JSC::DFG::CCallHelpers::CCallHelpers):
4642 * dfg/DFGGPRInfo.h:
4643 (GPRInfo):
4644 * dfg/DFGJITCompiler.cpp:
4645 (JSC::DFG::JITCompiler::link):
4646 (JSC::DFG::JITCompiler::compileFunction):
4647 * dfg/DFGJITCompiler.h:
4648 (JSC::DFG::CallBeginToken::CallBeginToken):
4649 (JSC::DFG::CallBeginToken::~CallBeginToken):
4650 (CallBeginToken):
4651 (JSC::DFG::CallBeginToken::set):
4652 (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
4653 (JSC::DFG::CallBeginToken::codeOrigin):
4654 (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
4655 (CallExceptionRecord):
4656 (JSC::DFG::JITCompiler::currentCodeOriginIndex):
4657 (JITCompiler):
4658 (JSC::DFG::JITCompiler::beginCall):
4659 (JSC::DFG::JITCompiler::notifyCall):
4660 (JSC::DFG::JITCompiler::prepareForExceptionCheck):
4661 (JSC::DFG::JITCompiler::addExceptionCheck):
4662 (JSC::DFG::JITCompiler::addFastExceptionCheck):
4663 * dfg/DFGOperations.cpp:
4664 * dfg/DFGRepatch.cpp:
4665 (JSC::DFG::dfgLinkFor):
4666 * dfg/DFGSpeculativeJIT.h:
4667 (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
4668 * dfg/DFGSpeculativeJIT32_64.cpp:
4669 (JSC::DFG::SpeculativeJIT::emitCall):
4670 * dfg/DFGSpeculativeJIT64.cpp:
4671 (JSC::DFG::SpeculativeJIT::emitCall):
4672 * dfg/DFGThunks.cpp:
4673 (JSC::DFG::emitPointerValidation):
4674 (DFG):
4675 (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
4676 (JSC::DFG::slowPathFor):
4677 (JSC::DFG::linkForThunkGenerator):
4678 (JSC::DFG::linkCallThunkGenerator):
4679 (JSC::DFG::linkConstructThunkGenerator):
4680 (JSC::DFG::virtualForThunkGenerator):
4681 (JSC::DFG::virtualCallThunkGenerator):
4682 (JSC::DFG::virtualConstructThunkGenerator):
4683 * dfg/DFGThunks.h:
4684 (DFG):
4685 * jit/JIT.cpp:
4686 (JSC::JIT::privateCompile):
4687 (JSC::JIT::linkFor):
4688 * runtime/Executable.h:
4689 (ExecutableBase):
4690 (JSC::ExecutableBase::offsetOfJITCodeFor):
4691 (JSC::ExecutableBase::offsetOfNumParametersFor):
4692 * runtime/JSValue.h:
4693 (JSValue):
4694
46952012-07-11 Filip Pizlo <fpizlo@apple.com>
4696
fpizlo@apple.com3a264a12012-07-11 23:33:20 +0000[diff] [blame]4697 Accidentally used the wrong license (3-clause instead of 2-clause) in some
4698 files I just committed.
4699
4700 Rubber stamped by Oliver Hunt.
4701
4702 * bytecode/Watchpoint.cpp:
4703 * bytecode/Watchpoint.h:
4704 * jit/JumpReplacementWatchpoint.cpp:
4705 * jit/JumpReplacementWatchpoint.h:
4706
47072012-07-11 Filip Pizlo <fpizlo@apple.com>
4708
fpizlo@apple.com3d949152012-07-11 23:12:35 +0000[diff] [blame]4709 Watchpoints and jump replacement should be decoupled
4710 https://bugs.webkit.org/show_bug.cgi?id=91016
4711
4712 Reviewed by Oliver Hunt.
4713
4714 * CMakeLists.txt:
4715 * GNUmakefile.list.am:
4716 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4717 * JavaScriptCore.xcodeproj/project.pbxproj:
4718 * Target.pri:
4719 * assembler/AbstractMacroAssembler.h:
4720 (JSC):
4721 (Label):
4722 * bytecode/CodeBlock.h:
4723 (JSC::CodeBlock::appendWatchpoint):
4724 (JSC::CodeBlock::watchpoint):
4725 (DFGData):
4726 * bytecode/Watchpoint.cpp:
4727 (JSC):
4728 * bytecode/Watchpoint.h:
4729 (JSC::Watchpoint::Watchpoint):
4730 (Watchpoint):
4731 (JSC::Watchpoint::fire):
4732 * dfg/DFGSpeculativeJIT.h:
4733 (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
4734 * jit/JumpReplacementWatchpoint.cpp: Added.
4735 (JSC):
4736 (JSC::JumpReplacementWatchpoint::correctLabels):
4737 (JSC::JumpReplacementWatchpoint::fireInternal):
4738 * jit/JumpReplacementWatchpoint.h: Added.
4739 (JSC):
4740 (JumpReplacementWatchpoint):
4741 (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
4742 (JSC::JumpReplacementWatchpoint::setDestination):
4743
kevino@webkit.org2b81ef22012-07-11 20:23:39 +0000[diff] [blame]47442012-07-11 Kevin Ollivier <kevino@theolliviers.com>
4745
4746 [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by
4747 another file.
4748
4749 * wscript:
4750
commit-queue@webkit.orgd847b5c2012-07-11 19:48:29 +0000[diff] [blame]47512012-07-11 Chao-ying Fu <fu@mips.com>
4752
4753 Add MIPS convertibleLoadPtr and other functions
4754 https://bugs.webkit.org/show_bug.cgi?id=90714
4755
4756 Reviewed by Oliver Hunt.
4757
4758 * assembler/MIPSAssembler.h:
4759 (JSC::MIPSAssembler::labelIgnoringWatchpoints):
4760 (MIPSAssembler):
4761 (JSC::MIPSAssembler::replaceWithLoad):
4762 (JSC::MIPSAssembler::replaceWithAddressComputation):
4763 * assembler/MacroAssemblerMIPS.h:
4764 (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
4765 (MacroAssemblerMIPS):
4766
andersca@apple.come73df4c2012-07-11 19:41:03 +0000[diff] [blame]47672012-07-11 Anders Carlsson <andersca@apple.com>
4768
4769 Add -Wtautological-compare and -Wsign-compare warning flags
4770 https://bugs.webkit.org/show_bug.cgi?id=90994
4771
4772 Reviewed by Mark Rowe.
4773
4774 * Configurations/Base.xcconfig:
4775
benjamin@webkit.orgea8276a2012-07-11 18:15:17 +0000[diff] [blame]47762012-07-11 Benjamin Poulain <bpoulain@apple.com>
4777
4778 Simplify the copying of JSC ARMv7's LinkRecord
4779 https://bugs.webkit.org/show_bug.cgi?id=90930
4780
4781 Reviewed by Filip Pizlo.
4782
4783 The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
4784 memmove() to move the objects.
4785
4786 The problem is memmove() is overkill for this object, moving the value can be done with
4787 3 load-store. This patch adds an operator= to the class doing more efficient copying.
4788 This reduces the link time by 19%.
4789
4790 * assembler/ARMv7Assembler.h:
4791 (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
4792 (JSC::ARMv7Assembler::LinkRecord::operator=):
4793 (JSC::ARMv7Assembler::LinkRecord::from):
4794 (JSC::ARMv7Assembler::LinkRecord::setFrom):
4795 (JSC::ARMv7Assembler::LinkRecord::to):
4796 (JSC::ARMv7Assembler::LinkRecord::type):
4797 (JSC::ARMv7Assembler::LinkRecord::linkType):
4798 (JSC::ARMv7Assembler::LinkRecord::setLinkType):
4799 (JSC::ARMv7Assembler::LinkRecord::condition):
4800
wingo@igalia.com8d1d0d42012-07-11 17:50:15 +0000[diff] [blame]48012012-07-11 Andy Wingo <wingo@igalia.com>
4802
4803 jsc: Parse options before creating global data
4804 https://bugs.webkit.org/show_bug.cgi?id=90975
4805
4806 Reviewed by Filip Pizlo.
4807
4808 This patch moves the options parsing in "jsc" before the creation
4809 of the JSGlobalData, so that --useJIT=no has a chance to take
4810 effect.
4811
4812 * jsc.cpp:
4813 (CommandLine::parseArguments): Refactor to be a class, and take
4814 argc and argv as constructor arguments.
4815 (jscmain): Move arg parsing before JSGlobalData creation.
4816
fpizlo@apple.com39c94a42012-07-10 09:18:47 +0000[diff] [blame]48172012-07-10 Filip Pizlo <fpizlo@apple.com>
4818
ossy@webkit.orgb626a9e2012-07-10 09:36:13 +0000[diff] [blame]4819 REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
4820 https://bugs.webkit.org/show_bug.cgi?id=90852
4821
4822 Reviewed by Zoltan Herczeg.
4823
4824 If we can't use the range filter, we should still make sure that the
4825 address is remotely sane, otherwise the hashtables will assert.
4826
4827 * jit/JITStubRoutine.h:
4828 (JSC::JITStubRoutine::passesFilter):
4829
48302012-07-10 Filip Pizlo <fpizlo@apple.com>
4831
fpizlo@apple.com39c94a42012-07-10 09:18:47 +0000[diff] [blame]4832 DFG recompilation heuristics should be based on count, not rate
4833 https://bugs.webkit.org/show_bug.cgi?id=90146
4834
4835 Reviewed by Oliver Hunt.
4836
4837 Rolling r121511 back in after fixing the DFG's interpretation of op_div
4838 profiling, with Gavin's rubber stamp.
4839
4840 This removes a bunch of code that was previously trying to prevent spurious
4841 reoptimizations if a large enough majority of executions of a code block did
4842 not result in OSR exit. It turns out that this code was purely harmful. This
4843 patch removes all of that logic and replaces it with a dead-simple
4844 heuristic: if you exit more than N times (where N is an exponential function
4845 of the number of times the code block has already been recompiled) then we
4846 will recompile.
4847
4848 This appears to be a broad ~1% win on many benchmarks large and small.
4849
4850 * bytecode/CodeBlock.cpp:
4851 (JSC::CodeBlock::CodeBlock):
4852 * bytecode/CodeBlock.h:
4853 (JSC::CodeBlock::couldTakeSpecialFastCase):
4854 (CodeBlock):
4855 (JSC::CodeBlock::osrExitCounter):
4856 (JSC::CodeBlock::countOSRExit):
4857 (JSC::CodeBlock::addressOfOSRExitCounter):
4858 (JSC::CodeBlock::offsetOfOSRExitCounter):
4859 (JSC::CodeBlock::adjustedExitCountThreshold):
4860 (JSC::CodeBlock::exitCountThresholdForReoptimization):
4861 (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4862 (JSC::CodeBlock::shouldReoptimizeNow):
4863 (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4864 * bytecode/ExecutionCounter.cpp:
4865 (JSC::ExecutionCounter::setThreshold):
4866 * bytecode/ExecutionCounter.h:
4867 (ExecutionCounter):
4868 (JSC::ExecutionCounter::clippedThreshold):
4869 * dfg/DFGByteCodeParser.cpp:
4870 (JSC::DFG::ByteCodeParser::makeDivSafe):
4871 * dfg/DFGJITCompiler.cpp:
4872 (JSC::DFG::JITCompiler::compileBody):
4873 * dfg/DFGOSRExit.cpp:
4874 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4875 * dfg/DFGOSRExitCompiler.cpp:
4876 (JSC::DFG::OSRExitCompiler::handleExitCounts):
4877 * dfg/DFGOperations.cpp:
4878 * jit/JITStubs.cpp:
4879 (JSC::DEFINE_STUB_FUNCTION):
4880 * runtime/Options.h:
4881 (JSC):
4882
commit-queue@webkit.orge1bba8e2012-07-10 05:45:21 +0000[diff] [blame]48832012-07-09 Matt Falkenhagen <falken@chromium.org>
4884
4885 Add ENABLE_DIALOG_ELEMENT and skeleton files
4886 https://bugs.webkit.org/show_bug.cgi?id=90521
4887
4888 Reviewed by Kent Tamura.
4889
4890 * Configurations/FeatureDefines.xcconfig:
4891
fpizlo@apple.com746b8c52012-07-09 23:26:54 +0000[diff] [blame]48922012-07-09 Filip Pizlo <fpizlo@apple.com>
4893
fpizlo@apple.com629c1cd2012-07-10 01:50:44 +0000[diff] [blame]4894 Unreviewed, roll out http://trac.webkit.org/changeset/121511
4895 It made in-browser V8v7 10% slower.
4896
4897 * bytecode/CodeBlock.cpp:
4898 (JSC::CodeBlock::CodeBlock):
4899 * bytecode/CodeBlock.h:
4900 (CodeBlock):
4901 (JSC::CodeBlock::countSpeculationSuccess):
4902 (JSC::CodeBlock::countSpeculationFailure):
4903 (JSC::CodeBlock::speculativeSuccessCounter):
4904 (JSC::CodeBlock::speculativeFailCounter):
4905 (JSC::CodeBlock::forcedOSRExitCounter):
4906 (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
4907 (JSC::CodeBlock::addressOfSpeculativeFailCounter):
4908 (JSC::CodeBlock::addressOfForcedOSRExitCounter):
4909 (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
4910 (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
4911 (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
4912 (JSC::CodeBlock::largeFailCountThreshold):
4913 (JSC::CodeBlock::largeFailCountThresholdForLoop):
4914 (JSC::CodeBlock::shouldReoptimizeNow):
4915 (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4916 * bytecode/ExecutionCounter.cpp:
4917 (JSC::ExecutionCounter::setThreshold):
4918 * bytecode/ExecutionCounter.h:
4919 (ExecutionCounter):
4920 * dfg/DFGJITCompiler.cpp:
4921 (JSC::DFG::JITCompiler::compileBody):
4922 * dfg/DFGOSRExit.cpp:
4923 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4924 * dfg/DFGOSRExitCompiler.cpp:
4925 (JSC::DFG::OSRExitCompiler::handleExitCounts):
4926 * dfg/DFGOperations.cpp:
4927 * jit/JITStubs.cpp:
4928 (JSC::DEFINE_STUB_FUNCTION):
4929 * runtime/Options.h:
4930 (JSC):
4931
49322012-07-09 Filip Pizlo <fpizlo@apple.com>
4933
fpizlo@apple.comcacd7dc2012-07-09 23:28:53 +0000[diff] [blame]4934 DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
4935 https://bugs.webkit.org/show_bug.cgi?id=90829
4936 <rdar://problem/11823843>
4937
4938 Reviewed by Oliver Hunt.
4939
4940 If a node is shown to have been mispredicted during CFA, then don't allow constant
4941 folding to make the graph even more degenerate. Instead, pull back on constant folding
4942 and allow the normal OSR machinery to fix our profiling so that a future recompilation
4943 doesn't see the same mistake.
4944
4945 * dfg/DFGAbstractState.cpp:
4946 (JSC::DFG::AbstractState::execute):
4947 * dfg/DFGAbstractState.h:
4948 (JSC::DFG::AbstractState::trySetConstant):
4949 (AbstractState):
4950 * dfg/DFGPhase.h:
4951 (JSC::DFG::Phase::name):
4952 (Phase):
4953 (JSC::DFG::runAndLog):
4954 (DFG):
4955 (JSC::DFG::runPhase):
4956
49572012-07-09 Filip Pizlo <fpizlo@apple.com>
4958
fpizlo@apple.com746b8c52012-07-09 23:26:54 +0000[diff] [blame]4959 It should be possible to jettison JIT stub routines even if they are currently running
4960 https://bugs.webkit.org/show_bug.cgi?id=90731
4961
4962 Reviewed by Gavin Barraclough.
4963
4964 This gives the GC awareness of all JIT-generated stubs for inline caches. That
4965 means that if you want to delete a JIT-generated stub, you don't have to worry
4966 about whether or not it is currently running: if there is a chance that it might
4967 be, the GC will kindly defer deletion until non-running-ness is proved.
4968
4969 * CMakeLists.txt:
4970 * GNUmakefile.list.am:
4971 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4972 * JavaScriptCore.xcodeproj/project.pbxproj:
4973 * Target.pri:
4974 * bytecode/Instruction.h:
4975 (JSC):
4976 (PolymorphicStubInfo):
4977 (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
4978 (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
4979 * bytecode/PolymorphicPutByIdList.cpp:
4980 (JSC::PutByIdAccess::fromStructureStubInfo):
4981 * bytecode/PolymorphicPutByIdList.h:
4982 (JSC::PutByIdAccess::transition):
4983 (JSC::PutByIdAccess::replace):
4984 (JSC::PutByIdAccess::stubRoutine):
4985 (PutByIdAccess):
4986 (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
4987 * bytecode/StructureStubInfo.h:
4988 (JSC::StructureStubInfo::reset):
4989 * dfg/DFGRepatch.cpp:
4990 (JSC::DFG::generateProtoChainAccessStub):
4991 (JSC::DFG::tryCacheGetByID):
4992 (JSC::DFG::tryBuildGetByIDList):
4993 (JSC::DFG::tryBuildGetByIDProtoList):
4994 (JSC::DFG::emitPutReplaceStub):
4995 (JSC::DFG::emitPutTransitionStub):
4996 (JSC::DFG::tryCachePutByID):
4997 (JSC::DFG::tryBuildPutByIdList):
4998 * heap/ConservativeRoots.cpp:
4999 (JSC):
5000 (DummyMarkHook):
5001 (JSC::DummyMarkHook::mark):
5002 (JSC::ConservativeRoots::add):
5003 (CompositeMarkHook):
5004 (JSC::CompositeMarkHook::CompositeMarkHook):
5005 (JSC::CompositeMarkHook::mark):
5006 * heap/ConservativeRoots.h:
5007 (JSC):
5008 (ConservativeRoots):
5009 * heap/Heap.cpp:
5010 (JSC::Heap::markRoots):
5011 (JSC::Heap::deleteUnmarkedCompiledCode):
5012 * heap/Heap.h:
5013 (JSC):
5014 (Heap):
5015 * heap/JITStubRoutineSet.cpp: Added.
5016 (JSC):
5017 (JSC::JITStubRoutineSet::JITStubRoutineSet):
5018 (JSC::JITStubRoutineSet::~JITStubRoutineSet):
5019 (JSC::JITStubRoutineSet::add):
5020 (JSC::JITStubRoutineSet::clearMarks):
5021 (JSC::JITStubRoutineSet::markSlow):
5022 (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
5023 (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
5024 * heap/JITStubRoutineSet.h: Added.
5025 (JSC):
5026 (JITStubRoutineSet):
5027 (JSC::JITStubRoutineSet::mark):
5028 * heap/MachineStackMarker.h:
5029 (JSC):
5030 * interpreter/RegisterFile.cpp:
5031 (JSC::RegisterFile::gatherConservativeRoots):
5032 * interpreter/RegisterFile.h:
5033 (JSC):
5034 * jit/ExecutableAllocator.cpp:
5035 (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
5036 * jit/ExecutableAllocator.h:
5037 (JSC):
5038 * jit/ExecutableAllocatorFixedVMPool.cpp:
5039 (JSC):
5040 (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
5041 * jit/GCAwareJITStubRoutine.cpp: Added.
5042 (JSC):
5043 (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
5044 (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
5045 (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
5046 (JSC::GCAwareJITStubRoutine::deleteFromGC):
5047 (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
5048 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
5049 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
5050 (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
5051 (JSC::createJITStubRoutine):
5052 * jit/GCAwareJITStubRoutine.h: Added.
5053 (JSC):
5054 (GCAwareJITStubRoutine):
5055 (JSC::GCAwareJITStubRoutine::markRequiredObjects):
5056 (MarkingGCAwareJITStubRoutineWithOneObject):
5057 * jit/JITPropertyAccess.cpp:
5058 (JSC::JIT::privateCompilePutByIdTransition):
5059 (JSC::JIT::privateCompilePatchGetArrayLength):
5060 (JSC::JIT::privateCompileGetByIdProto):
5061 (JSC::JIT::privateCompileGetByIdSelfList):
5062 (JSC::JIT::privateCompileGetByIdProtoList):
5063 (JSC::JIT::privateCompileGetByIdChainList):
5064 (JSC::JIT::privateCompileGetByIdChain):
5065 * jit/JITPropertyAccess32_64.cpp:
5066 (JSC::JIT::privateCompilePutByIdTransition):
5067 (JSC::JIT::privateCompilePatchGetArrayLength):
5068 (JSC::JIT::privateCompileGetByIdProto):
5069 (JSC::JIT::privateCompileGetByIdSelfList):
5070 (JSC::JIT::privateCompileGetByIdProtoList):
5071 (JSC::JIT::privateCompileGetByIdChainList):
5072 (JSC::JIT::privateCompileGetByIdChain):
5073 * jit/JITStubRoutine.cpp: Added.
5074 (JSC):
5075 (JSC::JITStubRoutine::~JITStubRoutine):
5076 (JSC::JITStubRoutine::observeZeroRefCount):
5077 * jit/JITStubRoutine.h: Added.
5078 (JSC):
5079 (JITStubRoutine):
5080 (JSC::JITStubRoutine::JITStubRoutine):
5081 (JSC::JITStubRoutine::createSelfManagedRoutine):
5082 (JSC::JITStubRoutine::code):
5083 (JSC::JITStubRoutine::asCodePtr):
5084 (JSC::JITStubRoutine::ref):
5085 (JSC::JITStubRoutine::deref):
5086 (JSC::JITStubRoutine::startAddress):
5087 (JSC::JITStubRoutine::endAddress):
5088 (JSC::JITStubRoutine::addressStep):
5089 (JSC::JITStubRoutine::canPerformRangeFilter):
5090 (JSC::JITStubRoutine::filteringStartAddress):
5091 (JSC::JITStubRoutine::filteringExtentSize):
5092 (JSC::JITStubRoutine::passesFilter):
5093 * jit/JITStubs.cpp:
5094 (JSC::DEFINE_STUB_FUNCTION):
5095 (JSC::getPolymorphicAccessStructureListSlot):
5096
commit-queue@webkit.orgfb3c9682012-07-09 15:39:09 +0000[diff] [blame]50972012-07-09 Sheriff Bot <webkit.review.bot@gmail.com>
5098
5099 Unreviewed, rolling out r122107.
5100 http://trac.webkit.org/changeset/122107
5101 https://bugs.webkit.org/show_bug.cgi?id=90794
5102
5103 Build failure on Mac debug bots (Requested by falken_ on
5104 #webkit).
5105
5106 * Configurations/FeatureDefines.xcconfig:
5107
commit-queue@webkit.orgb46a45d2012-07-09 14:42:00 +0000[diff] [blame]51082012-07-09 Matt Falkenhagen <falken@chromium.org>
5109
5110 Add ENABLE_DIALOG_ELEMENT and skeleton files
5111 https://bugs.webkit.org/show_bug.cgi?id=90521
5112
5113 Reviewed by Kent Tamura.
5114
5115 * Configurations/FeatureDefines.xcconfig:
5116
rniwa@webkit.orga5efe7e2012-07-09 06:19:54 +0000[diff] [blame]51172012-07-08 Ryosuke Niwa <rniwa@webkit.org>
5118
5119 gcc build fix after r121925.
5120
5121 * runtime/JSObject.h:
5122 (JSC::JSFinalObject::finishCreation):
5123
zherczeg@webkit.orgadfdb1f2012-07-08 10:00:04 +0000[diff] [blame]51242012-07-08 Zoltan Herczeg <zherczeg@webkit.org>
5125
5126 [Qt][ARM] Implementing missing macro assembler instructions after r121925
5127 https://bugs.webkit.org/show_bug.cgi?id=90657
5128
5129 Reviewed by Csaba Osztrogonác.
5130
5131 Implementing convertibleLoadPtr, replaceWithLoad and
5132 replaceWithAddressComputation.
5133
5134 * assembler/ARMAssembler.h:
5135 (JSC::ARMAssembler::replaceWithLoad):
5136 (ARMAssembler):
5137 (JSC::ARMAssembler::replaceWithAddressComputation):
5138 * assembler/MacroAssemblerARM.h:
5139 (JSC::MacroAssemblerARM::convertibleLoadPtr):
5140 (MacroAssemblerARM):
5141
fpizlo@apple.com18066da2012-07-07 00:43:21 +0000[diff] [blame]51422012-07-06 Filip Pizlo <fpizlo@apple.com>
5143
5144 WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
5145 https://bugs.webkit.org/show_bug.cgi?id=90703
5146
5147 Reviewed by Michael Saboff.
5148
5149 It turns out that in my object model refactoring, I managed to fix get_by_pname in all
5150 execution engines except 64-bit baseline JIT.
5151
5152 * jit/JITPropertyAccess.cpp:
5153 (JSC::JIT::emit_op_get_by_pname):
5154
commit-queue@webkit.org650e3e62012-07-06 20:41:09 +0000[diff] [blame]51552012-07-06 Pravin D <pravind.2k4@gmail.com>
5156
5157 Build Error on Qt Linux build
5158 https://bugs.webkit.org/show_bug.cgi?id=90699
5159
5160 Reviewed by Laszlo Gombos.
5161
5162 * parser/Parser.cpp:
5163 (JSC::::parseForStatement):
5164 Removed unused boolean variable as this was causing build error on Qt Linux.
5165
commit-queue@webkit.orgc182dfc2012-07-06 17:39:20 +0000[diff] [blame]51662012-07-06 Nuno Lopes <nlopes@apple.com>
5167
5168 Fix build with recent clang.
5169 https://bugs.webkit.org/show_bug.cgi?id=90634
5170
5171 Reviewed by Oliver Hunt.
5172
5173 * jit/SpecializedThunkJIT.h:
5174 (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
5175 (SpecializedThunkJIT):
5176 * jit/ThunkGenerators.cpp:
5177 (JSC::charCodeAtThunkGenerator):
5178 (JSC::charAtThunkGenerator):
5179 (JSC::fromCharCodeThunkGenerator):
5180 (JSC::sqrtThunkGenerator):
5181 (JSC::floorThunkGenerator):
5182 (JSC::ceilThunkGenerator):
5183 (JSC::roundThunkGenerator):
5184 (JSC::expThunkGenerator):
5185 (JSC::logThunkGenerator):
5186 (JSC::absThunkGenerator):
5187 (JSC::powThunkGenerator):
5188 * parser/ASTBuilder.h:
5189 (JSC::ASTBuilder::createAssignResolve):
5190 (JSC::ASTBuilder::createForLoop):
5191 (JSC::ASTBuilder::createForInLoop):
5192 (JSC::ASTBuilder::makeAssignNode):
5193 (JSC::ASTBuilder::makePrefixNode):
5194 (JSC::ASTBuilder::makePostfixNode):
5195 * parser/NodeConstructors.h:
5196 (JSC::PostfixErrorNode::PostfixErrorNode):
5197 (JSC::PrefixErrorNode::PrefixErrorNode):
5198 (JSC::AssignResolveNode::AssignResolveNode):
5199 (JSC::AssignErrorNode::AssignErrorNode):
5200 (JSC::ForNode::ForNode):
5201 (JSC::ForInNode::ForInNode):
5202 * parser/Nodes.h:
5203 (FunctionCallResolveNode):
5204 (PostfixErrorNode):
5205 (PrefixErrorNode):
5206 (ReadModifyResolveNode):
5207 (AssignResolveNode):
5208 (AssignErrorNode):
5209 (ForNode):
5210 (ForInNode):
5211 * parser/Parser.cpp:
5212 (JSC::::parseVarDeclarationList):
5213 (JSC::::parseForStatement):
5214 * parser/SyntaxChecker.h:
5215 (JSC::SyntaxChecker::createAssignResolve):
5216 (JSC::SyntaxChecker::createForLoop):
5217
zherczeg@webkit.orgb3b18db2012-07-06 08:42:29 +0000[diff] [blame]52182012-07-06 Zoltan Herczeg <zherczeg@webkit.org>
5219
5220 [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
5221 https://bugs.webkit.org/show_bug.cgi?id=90656
5222
5223 Reviewed by Csaba Osztrogonác.
5224
5225 Typo fixes.
5226
5227 * assembler/MacroAssemblerARM.cpp:
5228 (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
5229 Rename getOp2Byte() -> getOp2Half()
5230 * assembler/MacroAssemblerARMv7.h:
5231 (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
5232 Add a necessary space.
5233 * jit/JITStubs.cpp:
5234 (JSC):
5235 Revert INLINE_ARM_FUNCTION macro.
5236
fpizlo@apple.come26c6d22012-07-06 07:01:35 +0000[diff] [blame]52372012-07-05 Filip Pizlo <fpizlo@apple.com>
5238
5239 REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
5240 https://bugs.webkit.org/show_bug.cgi?id=90658
5241
5242 Reviewed by Zoltan Herczeg.
5243
5244 Under the new object model, out-of-line property accesses such as those
5245 in ResolveGlobal must account for the fact that the offset to the Kth
5246 property is represented by K + inlineStorageCapacity. Hence, the property
5247 loads in ResolveGlobal must have an additional -inlineStorageCapacity *
5248 sizeof(JSValue) offset.
5249
5250 * dfg/DFGSpeculativeJIT32_64.cpp:
5251 (JSC::DFG::SpeculativeJIT::compile):
5252
ossy@webkit.orgc5b75fd2012-07-06 04:52:26 +0000[diff] [blame]52532012-07-05 Csaba Osztrogonác <ossy@webkit.org>
5254
5255 [Qt] Unreviewed 64 bit buildfix after r121925.
5256
5257 * bytecode/PutByIdStatus.cpp:
5258 (JSC::PutByIdStatus::computeFromLLInt):
5259
msaboff@apple.comb1b64c72012-07-06 00:04:05 +0000[diff] [blame]52602012-07-05 Michael Saboff <msaboff@apple.com>
5261
5262 JSString::tryHashConstLock() fails to get exclusive lock
5263 https://bugs.webkit.org/show_bug.cgi?id=90639
5264
5265 Reviewed by Oliver Hunt.
5266
5267 Added check that the string is already locked even before compare and swap.
5268
5269 * heap/MarkStack.cpp:
5270 (JSC::JSString::tryHashConstLock):
5271
fpizlo@apple.comd68b1f82012-07-05 22:55:51 +0000[diff] [blame]52722012-07-04 Filip Pizlo <fpizlo@apple.com>
5273
5274 Inline property storage should not be wasted when it is exhausted
5275 https://bugs.webkit.org/show_bug.cgi?id=90347
5276
5277 Reviewed by Gavin Barraclough.
5278
5279 Previously, if we switched an object from using inline storage to out-of-line
5280 storage, we would abandon the inline storage. This would have two main implications:
5281 (i) all accesses to the object, even for properties that were previously in inline
5282 storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
5283 of space since we must allocate additional out-of-line storage to hold properties
5284 that would have fit in the inline storage. There's also the copying cost when
5285 switching to out-of-line storage - we must copy all inline properties into ouf-of-line
5286 storage.
5287
5288 This patch changes the way that object property storage works so that we can use both
5289 inline and out-of-line storage concurrently. This is accomplished by introducing a
5290 new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
5291 behaves as follows:
5292
5293 offset == -1: invalid offset, indicating a property that does not exist.
5294
5295 0 <= offset <= inlineStorageCapacity: offset into inline storage.
5296
5297 inlineStorageCapacity < offset: offset into out-of-line storage.
5298
5299 Because non-final objects don't have inline storage, the only valid PropertyOffsets
5300 for those objects' properties are -1 or > inlineStorageCapacity.
5301
5302 This now means that the decision to use inline or out-of-line storage for an access is
5303 made based on the offset, rather than the structure. It also means that any access
5304 where the offset is a variable must have an extra branch, unless the type of the
5305 object is also known (if it's known to be a non-final object then we can just assert
5306 that the offset is >= inlineStorageCapacity).
5307
5308 This looks like a big Kraken speed-up and a slight V8 speed-up.
5309
5310 * GNUmakefile.list.am:
5311 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5312 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5313 * JavaScriptCore.xcodeproj/project.pbxproj:
5314 * assembler/ARMv7Assembler.h:
5315 (ARMv7Assembler):
5316 (JSC::ARMv7Assembler::ldrWide8BitImmediate):
5317 (JSC::ARMv7Assembler::replaceWithLoad):
5318 (JSC::ARMv7Assembler::replaceWithAddressComputation):
5319 * assembler/AbstractMacroAssembler.h:
5320 (AbstractMacroAssembler):
5321 (ConvertibleLoadLabel):
5322 (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
5323 (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
5324 (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
5325 (JSC::AbstractMacroAssembler::replaceWithLoad):
5326 (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
5327 * assembler/CodeLocation.h:
5328 (JSC):
5329 (CodeLocationCommon):
5330 (CodeLocationConvertibleLoad):
5331 (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
5332 (JSC::CodeLocationCommon::convertibleLoadAtOffset):
5333 * assembler/LinkBuffer.cpp:
5334 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5335 * assembler/LinkBuffer.h:
5336 (LinkBuffer):
5337 (JSC::LinkBuffer::locationOf):
5338 * assembler/MacroAssemblerARMv7.h:
5339 (MacroAssemblerARMv7):
5340 (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
5341 * assembler/MacroAssemblerX86.h:
5342 (JSC::MacroAssemblerX86::convertibleLoadPtr):
5343 (MacroAssemblerX86):
5344 * assembler/MacroAssemblerX86_64.h:
5345 (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
5346 (MacroAssemblerX86_64):
5347 * assembler/RepatchBuffer.h:
5348 (RepatchBuffer):
5349 (JSC::RepatchBuffer::replaceWithLoad):
5350 (JSC::RepatchBuffer::replaceWithAddressComputation):
5351 (JSC::RepatchBuffer::setLoadInstructionIsActive):
5352 * assembler/X86Assembler.h:
5353 (JSC::X86Assembler::replaceWithLoad):
5354 (X86Assembler):
5355 (JSC::X86Assembler::replaceWithAddressComputation):
5356 * bytecode/CodeBlock.cpp:
5357 (JSC::CodeBlock::printGetByIdOp):
5358 (JSC::CodeBlock::dump):
5359 (JSC::CodeBlock::finalizeUnconditionally):
5360 * bytecode/GetByIdStatus.cpp:
5361 (JSC::GetByIdStatus::computeFromLLInt):
5362 (JSC::GetByIdStatus::computeForChain):
5363 (JSC::GetByIdStatus::computeFor):
5364 * bytecode/GetByIdStatus.h:
5365 (JSC::GetByIdStatus::GetByIdStatus):
5366 (JSC::GetByIdStatus::offset):
5367 (GetByIdStatus):
5368 * bytecode/Opcode.h:
5369 (JSC):
5370 (JSC::padOpcodeName):
5371 * bytecode/PutByIdStatus.cpp:
5372 (JSC::PutByIdStatus::computeFromLLInt):
5373 (JSC::PutByIdStatus::computeFor):
5374 * bytecode/PutByIdStatus.h:
5375 (JSC::PutByIdStatus::PutByIdStatus):
5376 (JSC::PutByIdStatus::offset):
5377 (PutByIdStatus):
5378 * bytecode/ResolveGlobalStatus.cpp:
5379 (JSC):
5380 (JSC::computeForStructure):
5381 * bytecode/ResolveGlobalStatus.h:
5382 (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
5383 (JSC::ResolveGlobalStatus::offset):
5384 (ResolveGlobalStatus):
5385 * bytecode/StructureSet.h:
5386 (StructureSet):
5387 * bytecode/StructureStubInfo.h:
5388 * dfg/DFGByteCodeParser.cpp:
5389 (ByteCodeParser):
5390 (JSC::DFG::ByteCodeParser::handleGetByOffset):
5391 (JSC::DFG::ByteCodeParser::handleGetById):
5392 (JSC::DFG::ByteCodeParser::parseBlock):
5393 * dfg/DFGCapabilities.h:
5394 (JSC::DFG::canCompileOpcode):
5395 * dfg/DFGJITCompiler.cpp:
5396 (JSC::DFG::JITCompiler::link):
5397 * dfg/DFGJITCompiler.h:
5398 (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
5399 (PropertyAccessRecord):
5400 * dfg/DFGRepatch.cpp:
5401 (JSC::DFG::dfgRepatchByIdSelfAccess):
5402 (JSC::DFG::generateProtoChainAccessStub):
5403 (JSC::DFG::tryCacheGetByID):
5404 (JSC::DFG::tryBuildGetByIDList):
5405 (JSC::DFG::tryBuildGetByIDProtoList):
5406 (JSC::DFG::emitPutReplaceStub):
5407 (JSC::DFG::emitPutTransitionStub):
5408 (JSC::DFG::tryCachePutByID):
5409 (JSC::DFG::tryBuildPutByIdList):
5410 * dfg/DFGSpeculativeJIT.h:
5411 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
5412 * dfg/DFGSpeculativeJIT32_64.cpp:
5413 (JSC::DFG::SpeculativeJIT::cachedGetById):
5414 (JSC::DFG::SpeculativeJIT::cachedPutById):
5415 (JSC::DFG::SpeculativeJIT::compile):
5416 * dfg/DFGSpeculativeJIT64.cpp:
5417 (JSC::DFG::SpeculativeJIT::cachedGetById):
5418 (JSC::DFG::SpeculativeJIT::cachedPutById):
5419 (JSC::DFG::SpeculativeJIT::compile):
5420 * heap/MarkStack.cpp:
5421 (JSC::visitChildren):
5422 * interpreter/Interpreter.cpp:
5423 (JSC::Interpreter::tryCacheGetByID):
5424 (JSC::Interpreter::privateExecute):
5425 * jit/JIT.cpp:
5426 (JSC::JIT::privateCompileMainPass):
5427 (JSC::JIT::privateCompileSlowCases):
5428 (JSC::PropertyStubCompilationInfo::copyToStubInfo):
5429 * jit/JIT.h:
5430 (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
5431 (JSC::JIT::compileGetByIdProto):
5432 (JSC::JIT::compileGetByIdSelfList):
5433 (JSC::JIT::compileGetByIdProtoList):
5434 (JSC::JIT::compileGetByIdChainList):
5435 (JSC::JIT::compileGetByIdChain):
5436 (JSC::JIT::compilePutByIdTransition):
5437 (JIT):
5438 * jit/JITInlineMethods.h:
5439 (JSC::JIT::emitAllocateBasicJSObject):
5440 * jit/JITOpcodes.cpp:
5441 (JSC::JIT::emit_op_resolve_global):
5442 * jit/JITOpcodes32_64.cpp:
5443 (JSC::JIT::emit_op_resolve_global):
5444 * jit/JITPropertyAccess.cpp:
5445 (JSC::JIT::compileGetDirectOffset):
5446 (JSC::JIT::emit_op_method_check):
5447 (JSC::JIT::compileGetByIdHotPath):
5448 (JSC::JIT::emit_op_put_by_id):
5449 (JSC::JIT::compilePutDirectOffset):
5450 (JSC::JIT::privateCompilePutByIdTransition):
5451 (JSC::JIT::patchGetByIdSelf):
5452 (JSC::JIT::patchPutByIdReplace):
5453 (JSC::JIT::privateCompileGetByIdProto):
5454 (JSC::JIT::privateCompileGetByIdSelfList):
5455 (JSC::JIT::privateCompileGetByIdProtoList):
5456 (JSC::JIT::privateCompileGetByIdChainList):
5457 (JSC::JIT::privateCompileGetByIdChain):
5458 * jit/JITPropertyAccess32_64.cpp:
5459 (JSC::JIT::emit_op_method_check):
5460 (JSC::JIT::compileGetByIdHotPath):
5461 (JSC::JIT::emit_op_put_by_id):
5462 (JSC::JIT::compilePutDirectOffset):
5463 (JSC::JIT::compileGetDirectOffset):
5464 (JSC::JIT::privateCompilePutByIdTransition):
5465 (JSC::JIT::patchGetByIdSelf):
5466 (JSC::JIT::patchPutByIdReplace):
5467 (JSC::JIT::privateCompileGetByIdProto):
5468 (JSC::JIT::privateCompileGetByIdSelfList):
5469 (JSC::JIT::privateCompileGetByIdProtoList):
5470 (JSC::JIT::privateCompileGetByIdChainList):
5471 (JSC::JIT::privateCompileGetByIdChain):
5472 (JSC::JIT::emit_op_get_by_pname):
5473 * jit/JITStubs.cpp:
5474 (JSC::JITThunks::tryCacheGetByID):
5475 (JSC::DEFINE_STUB_FUNCTION):
5476 * llint/LLIntSlowPaths.cpp:
5477 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5478 * llint/LowLevelInterpreter.asm:
5479 * llint/LowLevelInterpreter32_64.asm:
5480 * llint/LowLevelInterpreter64.asm:
5481 * offlineasm/x86.rb:
5482 * runtime/JSGlobalObject.h:
5483 (JSGlobalObject):
5484 (JSC::JSGlobalObject::functionNameOffset):
5485 * runtime/JSObject.cpp:
5486 (JSC::JSObject::visitChildren):
5487 (JSC):
5488 (JSC::JSFinalObject::visitChildren):
5489 (JSC::JSObject::put):
5490 (JSC::JSObject::deleteProperty):
5491 (JSC::JSObject::getPropertySpecificValue):
5492 (JSC::JSObject::removeDirect):
5493 (JSC::JSObject::growOutOfLineStorage):
5494 (JSC::JSObject::getOwnPropertyDescriptor):
5495 * runtime/JSObject.h:
5496 (JSObject):
5497 (JSC::JSObject::getDirect):
5498 (JSC::JSObject::getDirectLocation):
5499 (JSC::JSObject::hasInlineStorage):
5500 (JSC::JSObject::inlineStorageUnsafe):
5501 (JSC::JSObject::inlineStorage):
5502 (JSC::JSObject::outOfLineStorage):
5503 (JSC::JSObject::locationForOffset):
5504 (JSC::JSObject::offsetForLocation):
5505 (JSC::JSObject::getDirectOffset):
5506 (JSC::JSObject::putDirectOffset):
5507 (JSC::JSObject::putUndefinedAtDirectOffset):
5508 (JSC::JSObject::addressOfOutOfLineStorage):
5509 (JSC::JSObject::finishCreation):
5510 (JSC::JSNonFinalObject::JSNonFinalObject):
5511 (JSC::JSNonFinalObject::finishCreation):
5512 (JSFinalObject):
5513 (JSC::JSFinalObject::finishCreation):
5514 (JSC::JSFinalObject::JSFinalObject):
5515 (JSC::JSObject::offsetOfOutOfLineStorage):
5516 (JSC::JSObject::setOutOfLineStorage):
5517 (JSC::JSObject::JSObject):
5518 (JSC):
5519 (JSC::JSCell::fastGetOwnProperty):
5520 (JSC::JSObject::putDirectInternal):
5521 (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
5522 (JSC::JSObject::putDirectWithoutTransition):
5523 (JSC::offsetRelativeToPatchedStorage):
5524 (JSC::indexRelativeToBase):
5525 (JSC::offsetRelativeToBase):
5526 * runtime/JSPropertyNameIterator.cpp:
5527 (JSC::JSPropertyNameIterator::create):
5528 * runtime/JSPropertyNameIterator.h:
5529 (JSPropertyNameIterator):
5530 (JSC::JSPropertyNameIterator::getOffset):
5531 (JSC::JSPropertyNameIterator::finishCreation):
5532 * runtime/JSValue.cpp:
5533 (JSC::JSValue::putToPrimitive):
5534 * runtime/Operations.h:
5535 (JSC::normalizePrototypeChain):
5536 * runtime/Options.cpp:
5537 (JSC):
5538 (JSC::Options::initialize):
5539 * runtime/PropertyMapHashTable.h:
5540 (PropertyMapEntry):
5541 (JSC::PropertyMapEntry::PropertyMapEntry):
5542 (PropertyTable):
5543 (JSC::PropertyTable::PropertyTable):
5544 (JSC::PropertyTable::getDeletedOffset):
5545 (JSC::PropertyTable::addDeletedOffset):
5546 (JSC::PropertyTable::nextOffset):
5547 (JSC):
5548 (JSC::PropertyTable::sizeInMemory):
5549 * runtime/PropertyOffset.h: Added.
5550 (JSC):
5551 (JSC::checkOffset):
5552 (JSC::validateOffset):
5553 (JSC::isValidOffset):
5554 (JSC::isInlineOffset):
5555 (JSC::isOutOfLineOffset):
5556 (JSC::offsetInInlineStorage):
5557 (JSC::offsetInOutOfLineStorage):
5558 (JSC::offsetInRespectiveStorage):
5559 (JSC::numberOfOutOfLineSlotsForLastOffset):
5560 (JSC::numberOfSlotsForLastOffset):
5561 (JSC::nextPropertyOffsetFor):
5562 (JSC::firstPropertyOffsetFor):
5563 * runtime/PropertySlot.h:
5564 (JSC::PropertySlot::cachedOffset):
5565 (JSC::PropertySlot::setValue):
5566 (JSC::PropertySlot::setCacheableGetterSlot):
5567 (JSC::PropertySlot::clearOffset):
5568 * runtime/PutPropertySlot.h:
5569 (JSC::PutPropertySlot::setExistingProperty):
5570 (JSC::PutPropertySlot::setNewProperty):
5571 (JSC::PutPropertySlot::cachedOffset):
5572 (PutPropertySlot):
5573 * runtime/Structure.cpp:
5574 (JSC::Structure::Structure):
5575 (JSC::Structure::materializePropertyMap):
5576 (JSC::nextOutOfLineStorageCapacity):
5577 (JSC::Structure::growOutOfLineCapacity):
5578 (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
5579 (JSC::Structure::addPropertyTransitionToExistingStructure):
5580 (JSC::Structure::addPropertyTransition):
5581 (JSC::Structure::removePropertyTransition):
5582 (JSC::Structure::flattenDictionaryStructure):
5583 (JSC::Structure::addPropertyWithoutTransition):
5584 (JSC::Structure::removePropertyWithoutTransition):
5585 (JSC::Structure::copyPropertyTableForPinning):
5586 (JSC::Structure::get):
5587 (JSC::Structure::putSpecificValue):
5588 (JSC::Structure::remove):
5589 * runtime/Structure.h:
5590 (Structure):
5591 (JSC::Structure::putWillGrowOutOfLineStorage):
5592 (JSC::Structure::previousID):
5593 (JSC::Structure::outOfLineCapacity):
5594 (JSC::Structure::outOfLineSizeForKnownFinalObject):
5595 (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
5596 (JSC::Structure::outOfLineSize):
5597 (JSC::Structure::hasInlineStorage):
5598 (JSC::Structure::inlineCapacity):
5599 (JSC::Structure::inlineSizeForKnownFinalObject):
5600 (JSC::Structure::inlineSize):
5601 (JSC::Structure::totalStorageSize):
5602 (JSC::Structure::totalStorageCapacity):
5603 (JSC::Structure::firstValidOffset):
5604 (JSC::Structure::lastValidOffset):
5605 (JSC::Structure::isValidOffset):
5606 (JSC::Structure::isEmpty):
5607 (JSC::Structure::transitionCount):
5608 (JSC::Structure::get):
5609
oliver@apple.com5635b542012-07-05 20:36:37 +0000[diff] [blame]56102012-07-05 Oliver Hunt <oliver@apple.com>
5611
5612 JSObjectCallAsFunction should thisConvert the provided thisObject
5613 https://bugs.webkit.org/show_bug.cgi?id=90628
5614
5615 Reviewed by Gavin Barraclough.
5616
5617 Perform this conversion on the provided this object.
5618
5619 * API/JSObjectRef.cpp:
5620 (JSObjectCallAsFunction):
5621
zherczeg@webkit.orgd6e661f2012-07-05 07:04:16 +0000[diff] [blame]56222012-07-05 Zoltan Herczeg <zherczeg@webkit.org>
5623
zherczeg@webkit.orgda8c37d2012-07-05 07:53:51 +0000[diff] [blame]5624 [Qt] Unreviewed buildfix after r121886. Typo fix.
5625
5626 * assembler/MacroAssemblerARM.cpp:
5627 (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
5628
56292012-07-05 Zoltan Herczeg <zherczeg@webkit.org>
5630
zherczeg@webkit.orgd6e661f2012-07-05 07:04:16 +0000[diff] [blame]5631 Port DFG JIT to traditional ARM
5632 https://bugs.webkit.org/show_bug.cgi?id=90198
5633
5634 Reviewed by Filip Pizlo.
5635
5636 This patch contains the macro assembler part of the
5637 DFG JIT support on ARM systems with fixed 32 bit instruction
5638 width. A large amount of old code was refactored, and the ARMv4
5639 or lower support is removed from the macro assembler.
5640
5641 Sunspider is improved by 8%, and V8 is 92%.
5642
5643 * assembler/ARMAssembler.cpp:
5644 (JSC::ARMAssembler::dataTransfer32):
5645 (JSC::ARMAssembler::baseIndexTransfer32):
5646 (JSC):
5647 (JSC::ARMAssembler::dataTransfer16):
5648 (JSC::ARMAssembler::baseIndexTransfer16):
5649 (JSC::ARMAssembler::dataTransferFloat):
5650 (JSC::ARMAssembler::baseIndexTransferFloat):
5651 (JSC::ARMAssembler::executableCopy):
5652 * assembler/ARMAssembler.h:
5653 (JSC::ARMAssembler::ARMAssembler):
5654 (JSC::ARMAssembler::emitInst):
5655 (JSC::ARMAssembler::vmov_f64_r):
5656 (ARMAssembler):
5657 (JSC::ARMAssembler::vabs_f64_r):
5658 (JSC::ARMAssembler::vneg_f64_r):
5659 (JSC::ARMAssembler::ldr_imm):
5660 (JSC::ARMAssembler::ldr_un_imm):
5661 (JSC::ARMAssembler::dtr_u):
5662 (JSC::ARMAssembler::dtr_ur):
5663 (JSC::ARMAssembler::dtr_d):
5664 (JSC::ARMAssembler::dtr_dr):
5665 (JSC::ARMAssembler::dtrh_u):
5666 (JSC::ARMAssembler::dtrh_ur):
5667 (JSC::ARMAssembler::dtrh_d):
5668 (JSC::ARMAssembler::dtrh_dr):
5669 (JSC::ARMAssembler::fdtr_u):
5670 (JSC::ARMAssembler::fdtr_d):
5671 (JSC::ARMAssembler::push_r):
5672 (JSC::ARMAssembler::pop_r):
5673 (JSC::ARMAssembler::poke_r):
5674 (JSC::ARMAssembler::peek_r):
5675 (JSC::ARMAssembler::vmov_vfp64_r):
5676 (JSC::ARMAssembler::vmov_arm64_r):
5677 (JSC::ARMAssembler::vmov_vfp32_r):
5678 (JSC::ARMAssembler::vmov_arm32_r):
5679 (JSC::ARMAssembler::vcvt_u32_f64_r):
5680 (JSC::ARMAssembler::vcvt_f64_f32_r):
5681 (JSC::ARMAssembler::vcvt_f32_f64_r):
5682 (JSC::ARMAssembler::clz_r):
5683 (JSC::ARMAssembler::bkpt):
5684 (JSC::ARMAssembler::bx):
5685 (JSC::ARMAssembler::blx):
5686 (JSC::ARMAssembler::labelIgnoringWatchpoints):
5687 (JSC::ARMAssembler::labelForWatchpoint):
5688 (JSC::ARMAssembler::label):
5689 (JSC::ARMAssembler::getLdrImmAddress):
5690 (JSC::ARMAssembler::replaceWithJump):
5691 (JSC::ARMAssembler::maxJumpReplacementSize):
5692 (JSC::ARMAssembler::getOp2Byte):
5693 (JSC::ARMAssembler::getOp2Half):
5694 (JSC::ARMAssembler::RM):
5695 (JSC::ARMAssembler::RS):
5696 (JSC::ARMAssembler::RD):
5697 (JSC::ARMAssembler::RN):
5698 * assembler/AssemblerBufferWithConstantPool.h:
5699 (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
5700 * assembler/MacroAssemblerARM.cpp:
5701 (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
5702 * assembler/MacroAssemblerARM.h:
5703 (JSC::MacroAssemblerARM::add32):
5704 (MacroAssemblerARM):
5705 (JSC::MacroAssemblerARM::and32):
5706 (JSC::MacroAssemblerARM::lshift32):
5707 (JSC::MacroAssemblerARM::mul32):
5708 (JSC::MacroAssemblerARM::neg32):
5709 (JSC::MacroAssemblerARM::rshift32):
5710 (JSC::MacroAssemblerARM::urshift32):
5711 (JSC::MacroAssemblerARM::xor32):
5712 (JSC::MacroAssemblerARM::load8):
5713 (JSC::MacroAssemblerARM::load8Signed):
5714 (JSC::MacroAssemblerARM::load16):
5715 (JSC::MacroAssemblerARM::load16Signed):
5716 (JSC::MacroAssemblerARM::load32):
5717 (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
5718 (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
5719 (JSC::MacroAssemblerARM::store8):
5720 (JSC::MacroAssemblerARM::store16):
5721 (JSC::MacroAssemblerARM::store32):
5722 (JSC::MacroAssemblerARM::move):
5723 (JSC::MacroAssemblerARM::jump):
5724 (JSC::MacroAssemblerARM::branchAdd32):
5725 (JSC::MacroAssemblerARM::mull32):
5726 (JSC::MacroAssemblerARM::branchMul32):
5727 (JSC::MacroAssemblerARM::nearCall):
5728 (JSC::MacroAssemblerARM::compare32):
5729 (JSC::MacroAssemblerARM::test32):
5730 (JSC::MacroAssemblerARM::sub32):
5731 (JSC::MacroAssemblerARM::call):
5732 (JSC::MacroAssemblerARM::loadFloat):
5733 (JSC::MacroAssemblerARM::loadDouble):
5734 (JSC::MacroAssemblerARM::storeFloat):
5735 (JSC::MacroAssemblerARM::storeDouble):
5736 (JSC::MacroAssemblerARM::moveDouble):
5737 (JSC::MacroAssemblerARM::addDouble):
5738 (JSC::MacroAssemblerARM::divDouble):
5739 (JSC::MacroAssemblerARM::subDouble):
5740 (JSC::MacroAssemblerARM::mulDouble):
5741 (JSC::MacroAssemblerARM::absDouble):
5742 (JSC::MacroAssemblerARM::negateDouble):
5743 (JSC::MacroAssemblerARM::convertInt32ToDouble):
5744 (JSC::MacroAssemblerARM::convertFloatToDouble):
5745 (JSC::MacroAssemblerARM::convertDoubleToFloat):
5746 (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
5747 (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
5748 (JSC::MacroAssemblerARM::truncateDoubleToInt32):
5749 (JSC::MacroAssemblerARM::truncateDoubleToUint32):
5750 (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
5751 (JSC::MacroAssemblerARM::branchDoubleNonZero):
5752 (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
5753 (JSC::MacroAssemblerARM::invert):
5754 (JSC::MacroAssemblerARM::replaceWithJump):
5755 (JSC::MacroAssemblerARM::maxJumpReplacementSize):
5756 (JSC::MacroAssemblerARM::call32):
5757 * assembler/SH4Assembler.h:
5758 (JSC::SH4Assembler::label):
5759 * dfg/DFGAssemblyHelpers.h:
5760 (JSC::DFG::AssemblyHelpers::debugCall):
5761 (JSC::DFG::AssemblyHelpers::boxDouble):
5762 (JSC::DFG::AssemblyHelpers::unboxDouble):
5763 * dfg/DFGCCallHelpers.h:
5764 (CCallHelpers):
5765 (JSC::DFG::CCallHelpers::setupArguments):
5766 * dfg/DFGFPRInfo.h:
5767 (DFG):
5768 * dfg/DFGGPRInfo.h:
5769 (DFG):
5770 (GPRInfo):
5771 * dfg/DFGOperations.cpp:
5772 (JSC):
5773 * dfg/DFGSpeculativeJIT.h:
5774 (SpeculativeJIT):
5775 (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
5776 (JSC::DFG::SpeculativeJIT::appendCallSetResult):
5777 * jit/JITStubs.cpp:
5778 (JSC):
5779 * jit/JITStubs.h:
5780 (JITStackFrame):
5781 * jit/JSInterfaceJIT.h:
5782 (JSInterfaceJIT):
5783
commit-queue@webkit.orgd106bf22012-07-04 21:36:52 +0000[diff] [blame]57842012-07-04 Anthony Scian <ascian@rim.com>
5785
5786 Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
5787 https://bugs.webkit.org/show_bug.cgi?id=40118
5788
5789 Reviewed by Yong Li.
5790
5791 Added member functions to expose function name, urlString, and line #.
5792 Refactored toString to make use of these member functions to reduce
5793 duplicated code for future maintenance.
5794
5795 Manually tested refactoring of toString by tracing thrown exceptions.
5796
5797 * interpreter/Interpreter.h:
5798 (JSC::StackFrame::toString):
5799 (JSC::StackFrame::friendlySourceURL):
5800 (JSC::StackFrame::friendlyFunctionName):
5801 (JSC::StackFrame::friendlyLineNumber):
5802
wingo@igalia.com17649d82012-07-04 20:32:26 +0000[diff] [blame]58032012-07-04 Andy Wingo <wingo@igalia.com>
5804
5805 [GTK] Enable parallel GC
5806 https://bugs.webkit.org/show_bug.cgi?id=90568
5807
5808 Reviewed by Martin Robinson.
5809
5810 * runtime/Options.cpp: Include <algorithm.h> for std::min.
5811
commit-queue@webkit.org1fcb31a2012-07-04 16:16:01 +0000[diff] [blame]58122012-07-04 John Mellor <johnme@chromium.org>
5813
5814 Text Autosizing: Add compile flag and runtime setting
5815 https://bugs.webkit.org/show_bug.cgi?id=87394
5816
5817 This patch renames Font Boosting to Text Autosizing.
5818
5819 Reviewed by Adam Barth.
5820
5821 * Configurations/FeatureDefines.xcconfig:
5822
msaboff@apple.comd08f3502012-07-03 22:57:00 +0000[diff] [blame]58232012-07-03 Michael Saboff <msaboff@apple.com>
5824
5825 Enh: Hash Const JSString in Backing Stores to Save Memory
5826 https://bugs.webkit.org/show_bug.cgi?id=86024
5827
5828 Reviewed by Oliver Hunt.
5829
5830 During garbage collection, each marking thread keeps a HashMap of
5831 strings. While visiting via MarkStack::copyAndAppend(), we check to
5832 see if the string we are visiting is already in the HashMap. If not
5833 we add it. If so, we change the reference to the current string we're
5834 visiting to the prior string.
5835
5836 To reduce the performance impact of this change, two throttles have
5837 ben added. 1) We only try hash consting if a significant number of new
5838 strings have been created since the last hash const. Currently this is
5839 set at 100 strings. 2) If a string is unique at the end of a marking
5840 it will not be checked during further GC phases. In some cases this
5841 won't catch all duplicates, but we are trying to catch the growth of
5842 duplicate strings.
5843
5844 * heap/Heap.cpp:
5845 (JSC::Heap::markRoots):
5846 * heap/MarkStack.cpp:
5847 (JSC::MarkStackThreadSharedData::resetChildren):
5848 (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
5849 (JSC::MarkStackThreadSharedData::reset):
5850 (JSC::MarkStack::setup): Check to see if enough strings have been created
5851 to hash const.
5852 (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
5853 (JSC::JSString::tryHashConstLock): New method to lock JSString for
5854 hash consting.
5855 (JSC::JSString::releaseHashConstLock): New unlock method.
5856 (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
5857 try to hash const the string.
5858 (JSC::MarkStack::internalAppend): New method that performs the hash consting.
5859 (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
5860 consting internalAppend().
5861 * heap/MarkStack.h:
5862 (MarkStackThreadSharedData):
5863 (MarkStack):
5864 * runtime/JSGlobalData.cpp:
5865 (JSC::JSGlobalData::JSGlobalData):
5866 * runtime/JSGlobalData.h:
5867 (JSGlobalData):
5868 (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
5869 (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
5870 * runtime/JSString.h:
5871 (JSString): Changed from using bool flags to using an unsigned
5872 m_flags field. This works better with the weakCompareAndSwap in
5873 JSString::tryHashConstLock(). Changed the 8bitness setting and
5874 checking to use new accessors.
5875 (JSC::JSString::JSString):
5876 (JSC::JSString::finishCreation):
5877 (JSC::JSString::is8Bit): Updated for new m_flags.
5878 (JSC::JSString::setIs8Bit): New setter.
5879 New hash const flags accessors:
5880 (JSC::JSString::isHashConstSingleton):
5881 (JSC::JSString::clearHashConstSingleton):
5882 (JSC::JSString::setHashConstSingleton):
5883 (JSC::JSRopeString::finishCreation):
5884 (JSC::JSRopeString::append):
5885
tony@chromium.orga47ad862012-07-03 20:26:08 +0000[diff] [blame]58862012-07-03 Tony Chang <tony@chromium.org>
5887
5888 [chromium] Unreviewed, update .gitignore to handle VS2010 files.
5889
5890 * JavaScriptCore.gyp/.gitignore:
5891
commit-queue@webkit.orgfbda60c2012-07-03 19:19:22 +0000[diff] [blame]58922012-07-03 Mark Lam <mark.lam@apple.com>
5893
5894 Add ability to symbolically set and dump JSC VM options.
5895 See comments in runtime/Options.h for details on how the options work.
5896 https://bugs.webkit.org/show_bug.cgi?id=90420
5897
5898 Reviewed by Filip Pizlo.
5899
5900 * assembler/LinkBuffer.cpp:
5901 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5902 * assembler/LinkBuffer.h:
5903 (JSC):
5904 * bytecode/CodeBlock.cpp:
5905 (JSC::CodeBlock::shouldOptimizeNow):
5906 * bytecode/CodeBlock.h:
5907 (JSC::CodeBlock::likelyToTakeSlowCase):
5908 (JSC::CodeBlock::couldTakeSlowCase):
5909 (JSC::CodeBlock::likelyToTakeSpecialFastCase):
5910 (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
5911 (JSC::CodeBlock::likelyToTakeAnySlowCase):
5912 (JSC::CodeBlock::jitAfterWarmUp):
5913 (JSC::CodeBlock::jitSoon):
5914 (JSC::CodeBlock::reoptimizationRetryCounter):
5915 (JSC::CodeBlock::countReoptimization):
5916 (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
5917 (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
5918 (JSC::CodeBlock::optimizeSoon):
5919 (JSC::CodeBlock::exitCountThresholdForReoptimization):
5920 (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
5921 * bytecode/ExecutionCounter.h:
5922 (JSC::ExecutionCounter::clippedThreshold):
5923 * dfg/DFGByteCodeParser.cpp:
5924 (JSC::DFG::ByteCodeParser::handleInlining):
5925 * dfg/DFGCapabilities.h:
5926 (JSC::DFG::mightCompileEval):
5927 (JSC::DFG::mightCompileProgram):
5928 (JSC::DFG::mightCompileFunctionForCall):
5929 (JSC::DFG::mightCompileFunctionForConstruct):
5930 (JSC::DFG::mightInlineFunctionForCall):
5931 (JSC::DFG::mightInlineFunctionForConstruct):
5932 * dfg/DFGCommon.h:
5933 (JSC::DFG::shouldShowDisassembly):
5934 * dfg/DFGDriver.cpp:
5935 (JSC::DFG::compile):
5936 * dfg/DFGOSRExit.cpp:
5937 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
5938 * dfg/DFGVariableAccessData.h:
5939 (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
5940 * heap/MarkStack.cpp:
5941 (JSC::MarkStackSegmentAllocator::allocate):
5942 (JSC::MarkStackSegmentAllocator::shrinkReserve):
5943 (JSC::MarkStackArray::MarkStackArray):
5944 (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
5945 (JSC::SlotVisitor::donateKnownParallel):
5946 (JSC::SlotVisitor::drain):
5947 (JSC::SlotVisitor::drainFromShared):
5948 * heap/MarkStack.h:
5949 (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
5950 (JSC::MarkStack::addOpaqueRoot):
5951 * heap/SlotVisitor.h:
5952 (JSC::SlotVisitor::donate):
5953 * jit/JIT.cpp:
5954 (JSC::JIT::emitOptimizationCheck):
5955 * jsc.cpp:
5956 (printUsageStatement):
5957 (parseArguments):
5958 * runtime/InitializeThreading.cpp:
5959 (JSC::initializeThreadingOnce):
5960 * runtime/JSGlobalData.cpp:
5961 (JSC::enableAssembler):
5962 * runtime/JSGlobalObject.cpp:
5963 (JSC::JSGlobalObject::JSGlobalObject):
5964 * runtime/Options.cpp:
5965 (JSC):
5966 (JSC::overrideOptionWithHeuristic):
5967 (JSC::Options::initialize):
5968 (JSC::Options::setOption):
5969 (JSC::Options::dumpAllOptions):
5970 (JSC::Options::dumpOption):
5971 * runtime/Options.h:
5972 (JSC):
5973 (Options):
5974 (EntryInfo):
5975
commit-queue@webkit.org337179a2012-07-03 13:43:13 +0000[diff] [blame]59762012-07-03 Jocelyn Turcotte <jocelyn.turcotte@nokia.com> Joel Dillon <joel.dillon@codethink.co.uk>
5977
5978 [Qt][Win] Fix broken QtWebKit5.lib linking
5979 https://bugs.webkit.org/show_bug.cgi?id=88321
5980
5981 Reviewed by Kenneth Rohde Christiansen.
5982
5983 The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
5984 when building JavaScriptCore, if both are packaged in the same DLL, instead
5985 of relying on the code to handle this.
5986 The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
5987 except for a check in Source/JavaScriptCore/config.h.
5988
5989 Keeping the old way for the WX port as requested by the port's contributors.
5990 For non-Windows ports there is no difference between IMPORT and EXPORT, no
5991 change is needed.
5992
5993 * API/JSBase.h:
5994 JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
5995 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
5996 Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
5997 * runtime/JSExportMacros.h:
5998
fpizlo@apple.comaedde2e2012-07-03 00:10:08 +0000[diff] [blame]59992012-07-02 Filip Pizlo <fpizlo@apple.com>
6000
fpizlo@apple.com8618e4b2012-07-03 01:27:16 +0000[diff] [blame]6001 DFG OSR exit value recoveries should be computed lazily
6002 https://bugs.webkit.org/show_bug.cgi?id=82155
6003
6004 Reviewed by Gavin Barraclough.
6005
6006 This change aims to reduce one aspect of DFG compile times: the fact
6007 that we currently compute the value recoveries for each local and
6008 argument on every speculation check. We compile many speculation checks,
6009 so this can add up quick. The strategy that this change takes is to
6010 have the DFG save just enough information about how the compiler is
6011 choosing to represent state, that the DFG::OSRExitCompiler can reify
6012 the value recoveries lazily.
6013
6014 This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
6015
6016 I also took the opportunity to fix the sampling regions profiler (it
6017 was missing an export macro) and to put in more sampling regions in
6018 the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
6019 false).
6020
6021 * CMakeLists.txt:
6022 * GNUmakefile.list.am:
6023 * JavaScriptCore.xcodeproj/project.pbxproj:
6024 * Target.pri:
6025 * bytecode/CodeBlock.cpp:
6026 (JSC):
6027 (JSC::CodeBlock::shrinkDFGDataToFit):
6028 * bytecode/CodeBlock.h:
6029 (CodeBlock):
6030 (JSC::CodeBlock::minifiedDFG):
6031 (JSC::CodeBlock::variableEventStream):
6032 (DFGData):
6033 * bytecode/Operands.h:
6034 (JSC::Operands::hasOperand):
6035 (Operands):
6036 (JSC::Operands::size):
6037 (JSC::Operands::at):
6038 (JSC::Operands::operator[]):
6039 (JSC::Operands::isArgument):
6040 (JSC::Operands::isVariable):
6041 (JSC::Operands::argumentForIndex):
6042 (JSC::Operands::variableForIndex):
6043 (JSC::Operands::operandForIndex):
6044 (JSC):
6045 (JSC::dumpOperands):
6046 * bytecode/SamplingTool.h:
6047 (SamplingRegion):
6048 * dfg/DFGByteCodeParser.cpp:
6049 (JSC::DFG::parse):
6050 * dfg/DFGCFAPhase.cpp:
6051 (JSC::DFG::performCFA):
6052 * dfg/DFGCSEPhase.cpp:
6053 (JSC::DFG::performCSE):
6054 * dfg/DFGFixupPhase.cpp:
6055 (JSC::DFG::performFixup):
6056 * dfg/DFGGenerationInfo.h:
6057 (JSC::DFG::GenerationInfo::GenerationInfo):
6058 (JSC::DFG::GenerationInfo::initConstant):
6059 (JSC::DFG::GenerationInfo::initInteger):
6060 (JSC::DFG::GenerationInfo::initJSValue):
6061 (JSC::DFG::GenerationInfo::initCell):
6062 (JSC::DFG::GenerationInfo::initBoolean):
6063 (JSC::DFG::GenerationInfo::initDouble):
6064 (JSC::DFG::GenerationInfo::initStorage):
6065 (GenerationInfo):
6066 (JSC::DFG::GenerationInfo::noticeOSRBirth):
6067 (JSC::DFG::GenerationInfo::use):
6068 (JSC::DFG::GenerationInfo::spill):
6069 (JSC::DFG::GenerationInfo::setSpilled):
6070 (JSC::DFG::GenerationInfo::fillJSValue):
6071 (JSC::DFG::GenerationInfo::fillCell):
6072 (JSC::DFG::GenerationInfo::fillInteger):
6073 (JSC::DFG::GenerationInfo::fillBoolean):
6074 (JSC::DFG::GenerationInfo::fillDouble):
6075 (JSC::DFG::GenerationInfo::fillStorage):
6076 (JSC::DFG::GenerationInfo::appendFill):
6077 (JSC::DFG::GenerationInfo::appendSpill):
6078 * dfg/DFGJITCompiler.cpp:
6079 (JSC::DFG::JITCompiler::link):
6080 (JSC::DFG::JITCompiler::compile):
6081 (JSC::DFG::JITCompiler::compileFunction):
6082 * dfg/DFGMinifiedGraph.h: Added.
6083 (DFG):
6084 (MinifiedGraph):
6085 (JSC::DFG::MinifiedGraph::MinifiedGraph):
6086 (JSC::DFG::MinifiedGraph::at):
6087 (JSC::DFG::MinifiedGraph::append):
6088 (JSC::DFG::MinifiedGraph::prepareAndShrink):
6089 (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
6090 (JSC::DFG::MinifiedGraph::originalGraphSize):
6091 * dfg/DFGMinifiedNode.cpp: Added.
6092 (DFG):
6093 (JSC::DFG::MinifiedNode::fromNode):
6094 * dfg/DFGMinifiedNode.h: Added.
6095 (DFG):
6096 (JSC::DFG::belongsInMinifiedGraph):
6097 (MinifiedNode):
6098 (JSC::DFG::MinifiedNode::MinifiedNode):
6099 (JSC::DFG::MinifiedNode::index):
6100 (JSC::DFG::MinifiedNode::op):
6101 (JSC::DFG::MinifiedNode::hasChild1):
6102 (JSC::DFG::MinifiedNode::child1):
6103 (JSC::DFG::MinifiedNode::hasConstant):
6104 (JSC::DFG::MinifiedNode::hasConstantNumber):
6105 (JSC::DFG::MinifiedNode::constantNumber):
6106 (JSC::DFG::MinifiedNode::hasWeakConstant):
6107 (JSC::DFG::MinifiedNode::weakConstant):
6108 (JSC::DFG::MinifiedNode::getIndex):
6109 (JSC::DFG::MinifiedNode::compareByNodeIndex):
6110 (JSC::DFG::MinifiedNode::hasChild):
6111 * dfg/DFGNode.h:
6112 (Node):
6113 * dfg/DFGOSRExit.cpp:
6114 (JSC::DFG::OSRExit::OSRExit):
6115 * dfg/DFGOSRExit.h:
6116 (OSRExit):
6117 * dfg/DFGOSRExitCompiler.cpp:
6118 * dfg/DFGOSRExitCompiler.h:
6119 (OSRExitCompiler):
6120 * dfg/DFGOSRExitCompiler32_64.cpp:
6121 (JSC::DFG::OSRExitCompiler::compileExit):
6122 * dfg/DFGOSRExitCompiler64.cpp:
6123 (JSC::DFG::OSRExitCompiler::compileExit):
6124 * dfg/DFGPredictionPropagationPhase.cpp:
6125 (JSC::DFG::performPredictionPropagation):
6126 * dfg/DFGRedundantPhiEliminationPhase.cpp:
6127 (JSC::DFG::performRedundantPhiElimination):
6128 * dfg/DFGSpeculativeJIT.cpp:
6129 (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
6130 (DFG):
6131 (JSC::DFG::SpeculativeJIT::fillStorage):
6132 (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
6133 (JSC::DFG::SpeculativeJIT::compileMovHint):
6134 (JSC::DFG::SpeculativeJIT::compile):
6135 (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
6136 * dfg/DFGSpeculativeJIT.h:
6137 (DFG):
6138 (JSC::DFG::SpeculativeJIT::use):
6139 (SpeculativeJIT):
6140 (JSC::DFG::SpeculativeJIT::spill):
6141 (JSC::DFG::SpeculativeJIT::speculationCheck):
6142 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
6143 (JSC::DFG::SpeculativeJIT::recordSetLocal):
6144 * dfg/DFGSpeculativeJIT32_64.cpp:
6145 (JSC::DFG::SpeculativeJIT::fillInteger):
6146 (JSC::DFG::SpeculativeJIT::fillDouble):
6147 (JSC::DFG::SpeculativeJIT::fillJSValue):
6148 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
6149 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
6150 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
6151 (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
6152 (JSC::DFG::SpeculativeJIT::compile):
6153 * dfg/DFGSpeculativeJIT64.cpp:
6154 (JSC::DFG::SpeculativeJIT::fillInteger):
6155 (JSC::DFG::SpeculativeJIT::fillDouble):
6156 (JSC::DFG::SpeculativeJIT::fillJSValue):
6157 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
6158 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
6159 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
6160 (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
6161 (JSC::DFG::SpeculativeJIT::compile):
6162 * dfg/DFGValueRecoveryOverride.h: Added.
6163 (DFG):
6164 (ValueRecoveryOverride):
6165 (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
6166 * dfg/DFGValueSource.cpp: Added.
6167 (DFG):
6168 (JSC::DFG::ValueSource::dump):
6169 * dfg/DFGValueSource.h: Added.
6170 (DFG):
6171 (JSC::DFG::dataFormatToValueSourceKind):
6172 (JSC::DFG::valueSourceKindToDataFormat):
6173 (JSC::DFG::isInRegisterFile):
6174 (ValueSource):
6175 (JSC::DFG::ValueSource::ValueSource):
6176 (JSC::DFG::ValueSource::forPrediction):
6177 (JSC::DFG::ValueSource::forDataFormat):
6178 (JSC::DFG::ValueSource::isSet):
6179 (JSC::DFG::ValueSource::kind):
6180 (JSC::DFG::ValueSource::isInRegisterFile):
6181 (JSC::DFG::ValueSource::dataFormat):
6182 (JSC::DFG::ValueSource::valueRecovery):
6183 (JSC::DFG::ValueSource::nodeIndex):
6184 (JSC::DFG::ValueSource::nodeIndexFromKind):
6185 (JSC::DFG::ValueSource::kindFromNodeIndex):
6186 * dfg/DFGVariableEvent.cpp: Added.
6187 (DFG):
6188 (JSC::DFG::VariableEvent::dump):
6189 (JSC::DFG::VariableEvent::dumpFillInfo):
6190 (JSC::DFG::VariableEvent::dumpSpillInfo):
6191 * dfg/DFGVariableEvent.h: Added.
6192 (DFG):
6193 (VariableEvent):
6194 (JSC::DFG::VariableEvent::VariableEvent):
6195 (JSC::DFG::VariableEvent::reset):
6196 (JSC::DFG::VariableEvent::fillGPR):
6197 (JSC::DFG::VariableEvent::fillPair):
6198 (JSC::DFG::VariableEvent::fillFPR):
6199 (JSC::DFG::VariableEvent::spill):
6200 (JSC::DFG::VariableEvent::death):
6201 (JSC::DFG::VariableEvent::setLocal):
6202 (JSC::DFG::VariableEvent::movHint):
6203 (JSC::DFG::VariableEvent::kind):
6204 (JSC::DFG::VariableEvent::nodeIndex):
6205 (JSC::DFG::VariableEvent::dataFormat):
6206 (JSC::DFG::VariableEvent::gpr):
6207 (JSC::DFG::VariableEvent::tagGPR):
6208 (JSC::DFG::VariableEvent::payloadGPR):
6209 (JSC::DFG::VariableEvent::fpr):
6210 (JSC::DFG::VariableEvent::virtualRegister):
6211 (JSC::DFG::VariableEvent::operand):
6212 (JSC::DFG::VariableEvent::variableRepresentation):
6213 * dfg/DFGVariableEventStream.cpp: Added.
6214 (DFG):
6215 (JSC::DFG::VariableEventStream::logEvent):
6216 (MinifiedGenerationInfo):
6217 (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
6218 (JSC::DFG::MinifiedGenerationInfo::update):
6219 (JSC::DFG::VariableEventStream::reconstruct):
6220 * dfg/DFGVariableEventStream.h: Added.
6221 (DFG):
6222 (VariableEventStream):
6223 (JSC::DFG::VariableEventStream::appendAndLog):
6224 * dfg/DFGVirtualRegisterAllocationPhase.cpp:
6225 (JSC::DFG::performVirtualRegisterAllocation):
6226
62272012-07-02 Filip Pizlo <fpizlo@apple.com>
6228
fpizlo@apple.comaedde2e2012-07-03 00:10:08 +0000[diff] [blame]6229 DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
6230 https://bugs.webkit.org/show_bug.cgi?id=90407
6231
6232 Reviewed by Mark Hahnenberg.
6233
6234 * dfg/DFGArgumentsSimplificationPhase.cpp:
6235 (JSC::DFG::ArgumentsSimplificationPhase::run):
6236
barraclough@apple.com15ab3352012-07-02 19:25:59 +0000[diff] [blame]62372012-07-02 Gavin Barraclough <barraclough@apple.com>
6238
6239 Array.prototype.pop should throw if property is not configurable
6240 https://bugs.webkit.org/show_bug.cgi?id=75788
6241
6242 Rubber Stamped by Oliver Hunt.
6243
6244 No real bug here any more, but the error we throw sometimes has a misleading message.
6245
6246 * runtime/JSArray.cpp:
6247 (JSC::JSArray::pop):
6248
fpizlo@apple.com3aef57f2012-06-30 19:28:26 +0000[diff] [blame]62492012-06-29 Filip Pizlo <fpizlo@apple.com>
6250
fpizlo@apple.com604d38a2012-07-01 03:54:49 +0000[diff] [blame]6251 JSObject wastes too much memory on unused property slots
6252 https://bugs.webkit.org/show_bug.cgi?id=90255
6253
6254 Reviewed by Mark Hahnenberg.
6255
6256 Rolling back in after applying a simple fix: it appears that
6257 JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
6258 property storage than necessary. Fixing this appears to resolve the crash.
6259
6260 This does a few things:
6261
6262 - JSNonFinalObject no longer has inline property storage.
6263
6264 - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
6265 or 2x the inline storage for JSFinalObject.
6266
6267 - Property storage is only reallocated if it needs to be. Previously, we
6268 would reallocate the property storage on any transition where the original
6269 structure said shouldGrowProperyStorage(), but this led to spurious
6270 reallocations when doing transitionless property adds and there are
6271 deleted property slots available. That in turn led to crashes, because we
6272 would switch to out-of-line storage even if the capacity matched the
6273 criteria for inline storage.
6274
6275 - Inline JSFunction allocation is killed off because we don't have a good
6276 way of inlining property storage allocation. This didn't hurt performance.
6277 Killing off code is better than fixing it if that code wasn't doing any
6278 good.
6279
6280 This looks like a 1% progression on V8.
6281
6282 * interpreter/Interpreter.cpp:
6283 (JSC::Interpreter::privateExecute):
6284 * jit/JIT.cpp:
6285 (JSC::JIT::privateCompileSlowCases):
6286 * jit/JIT.h:
6287 * jit/JITInlineMethods.h:
6288 (JSC::JIT::emitAllocateBasicJSObject):
6289 (JSC):
6290 * jit/JITOpcodes.cpp:
6291 (JSC::JIT::emit_op_new_func):
6292 (JSC):
6293 (JSC::JIT::emit_op_new_func_exp):
6294 * runtime/JSFunction.cpp:
6295 (JSC::JSFunction::finishCreation):
6296 * runtime/JSObject.h:
6297 (JSC::JSObject::isUsingInlineStorage):
6298 (JSObject):
6299 (JSC::JSObject::finishCreation):
6300 (JSC):
6301 (JSC::JSNonFinalObject::hasInlineStorage):
6302 (JSNonFinalObject):
6303 (JSC::JSNonFinalObject::JSNonFinalObject):
6304 (JSC::JSNonFinalObject::finishCreation):
6305 (JSC::JSFinalObject::hasInlineStorage):
6306 (JSC::JSFinalObject::finishCreation):
6307 (JSC::JSObject::offsetOfInlineStorage):
6308 (JSC::JSObject::setPropertyStorage):
6309 (JSC::Structure::inlineStorageCapacity):
6310 (JSC::Structure::isUsingInlineStorage):
6311 (JSC::JSObject::putDirectInternal):
6312 (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
6313 (JSC::JSObject::putDirectWithoutTransition):
6314 * runtime/Structure.cpp:
6315 (JSC::Structure::Structure):
6316 (JSC::nextPropertyStorageCapacity):
6317 (JSC):
6318 (JSC::Structure::growPropertyStorageCapacity):
6319 (JSC::Structure::suggestedNewPropertyStorageSize):
6320 * runtime/Structure.h:
6321 (JSC::Structure::putWillGrowPropertyStorage):
6322 (Structure):
6323
63242012-06-29 Filip Pizlo <fpizlo@apple.com>
6325
fpizlo@apple.com3aef57f2012-06-30 19:28:26 +0000[diff] [blame]6326 Webkit crashes in DFG on Google Docs when creating a new document
6327 https://bugs.webkit.org/show_bug.cgi?id=90209
6328
6329 Reviewed by Gavin Barraclough.
6330
6331 Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
6332 captured variable.
6333
6334 * dfg/DFGCFGSimplificationPhase.cpp:
6335 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
6336
zandobersek@gmail.com069a2d32012-06-30 12:09:15 +0000[diff] [blame]63372012-06-30 Zan Dobersek <zandobersek@gmail.com>
6338
6339 Unreviewed, rolling out r121605.
6340 http://trac.webkit.org/changeset/121605
6341 https://bugs.webkit.org/show_bug.cgi?id=90336
6342
6343 Changes caused flaky crashes in sputnik/Unicode tests on Apple
6344 WK1 and GTK Linux builders
6345
6346 * interpreter/Interpreter.cpp:
6347 (JSC::Interpreter::privateExecute):
6348 * jit/JIT.cpp:
6349 (JSC::JIT::privateCompileSlowCases):
6350 * jit/JIT.h:
6351 * jit/JITInlineMethods.h:
6352 (JSC::JIT::emitAllocateBasicJSObject):
6353 (JSC::JIT::emitAllocateJSFinalObject):
6354 (JSC):
6355 (JSC::JIT::emitAllocateJSFunction):
6356 * jit/JITOpcodes.cpp:
6357 (JSC::JIT::emit_op_new_func):
6358 (JSC::JIT::emitSlow_op_new_func):
6359 (JSC):
6360 (JSC::JIT::emit_op_new_func_exp):
6361 (JSC::JIT::emitSlow_op_new_func_exp):
6362 * runtime/JSFunction.cpp:
6363 (JSC::JSFunction::finishCreation):
6364 * runtime/JSObject.h:
6365 (JSC::JSObject::isUsingInlineStorage):
6366 (JSObject):
6367 (JSC::JSObject::finishCreation):
6368 (JSC):
6369 (JSNonFinalObject):
6370 (JSC::JSNonFinalObject::JSNonFinalObject):
6371 (JSC::JSNonFinalObject::finishCreation):
6372 (JSFinalObject):
6373 (JSC::JSFinalObject::finishCreation):
6374 (JSC::JSObject::offsetOfInlineStorage):
6375 (JSC::JSObject::setPropertyStorage):
6376 (JSC::Structure::isUsingInlineStorage):
6377 (JSC::JSObject::putDirectInternal):
6378 (JSC::JSObject::putDirectWithoutTransition):
6379 (JSC::JSObject::transitionTo):
6380 * runtime/Structure.cpp:
6381 (JSC::Structure::Structure):
6382 (JSC):
6383 (JSC::Structure::growPropertyStorageCapacity):
6384 (JSC::Structure::suggestedNewPropertyStorageSize):
6385 * runtime/Structure.h:
6386 (JSC::Structure::shouldGrowPropertyStorage):
6387 (JSC::Structure::propertyStorageSize):
6388
mhahnenberg@apple.com3100b432012-06-30 01:14:09 +0000[diff] [blame]63892012-06-29 Mark Hahnenberg <mhahnenberg@apple.com>
6390
6391 Remove warning about protected values when the Heap is being destroyed
6392 https://bugs.webkit.org/show_bug.cgi?id=90302
6393
6394 Reviewed by Geoffrey Garen.
6395
6396 Having to do book-keeping about whether values allocated from a certain
6397 VM are or are not protected makes the JSC API much more difficult to use
6398 correctly. Clients should be able to throw an entire VM away and not have
6399 to worry about unprotecting all of the values that they protected earlier.
6400
6401 * heap/Heap.cpp:
6402 (JSC::Heap::lastChanceToFinalize):
6403
fpizlo@apple.com9243e792012-06-30 00:25:01 +0000[diff] [blame]64042012-06-29 Filip Pizlo <fpizlo@apple.com>
6405
6406 JSObject wastes too much memory on unused property slots
6407 https://bugs.webkit.org/show_bug.cgi?id=90255
6408
6409 Reviewed by Mark Hahnenberg.
6410
6411 This does a few things:
6412
6413 - JSNonFinalObject no longer has inline property storage.
6414
6415 - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
6416 or 2x the inline storage for JSFinalObject.
6417
6418 - Property storage is only reallocated if it needs to be. Previously, we
6419 would reallocate the property storage on any transition where the original
6420 structure said shouldGrowProperyStorage(), but this led to spurious
6421 reallocations when doing transitionless property adds and there are
6422 deleted property slots available. That in turn led to crashes, because we
6423 would switch to out-of-line storage even if the capacity matched the
6424 criteria for inline storage.
6425
6426 - Inline JSFunction allocation is killed off because we don't have a good
6427 way of inlining property storage allocation. This didn't hurt performance.
6428 Killing off code is better than fixing it if that code wasn't doing any
6429 good.
6430
6431 This looks like a 1% progression on V8.
6432
6433 * interpreter/Interpreter.cpp:
6434 (JSC::Interpreter::privateExecute):
6435 * jit/JIT.cpp:
6436 (JSC::JIT::privateCompileSlowCases):
6437 * jit/JIT.h:
6438 * jit/JITInlineMethods.h:
6439 (JSC::JIT::emitAllocateBasicJSObject):
6440 (JSC):
6441 * jit/JITOpcodes.cpp:
6442 (JSC::JIT::emit_op_new_func):
6443 (JSC):
6444 (JSC::JIT::emit_op_new_func_exp):
6445 * runtime/JSFunction.cpp:
6446 (JSC::JSFunction::finishCreation):
6447 * runtime/JSObject.h:
6448 (JSC::JSObject::isUsingInlineStorage):
6449 (JSObject):
6450 (JSC::JSObject::finishCreation):
6451 (JSC):
6452 (JSC::JSNonFinalObject::hasInlineStorage):
6453 (JSNonFinalObject):
6454 (JSC::JSNonFinalObject::JSNonFinalObject):
6455 (JSC::JSNonFinalObject::finishCreation):
6456 (JSC::JSFinalObject::hasInlineStorage):
6457 (JSC::JSFinalObject::finishCreation):
6458 (JSC::JSObject::offsetOfInlineStorage):
6459 (JSC::JSObject::setPropertyStorage):
6460 (JSC::Structure::inlineStorageCapacity):
6461 (JSC::Structure::isUsingInlineStorage):
6462 (JSC::JSObject::putDirectInternal):
6463 (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
6464 (JSC::JSObject::putDirectWithoutTransition):
6465 * runtime/Structure.cpp:
6466 (JSC::Structure::Structure):
6467 (JSC::nextPropertyStorageCapacity):
6468 (JSC):
6469 (JSC::Structure::growPropertyStorageCapacity):
6470 (JSC::Structure::suggestedNewPropertyStorageSize):
6471 * runtime/Structure.h:
6472 (JSC::Structure::putWillGrowPropertyStorage):
6473 (Structure):
6474
fpizlo@apple.com48a964b2012-06-29 02:40:14 +0000[diff] [blame]64752012-06-28 Filip Pizlo <fpizlo@apple.com>
6476
6477 DFG recompilation heuristics should be based on count, not rate
6478 https://bugs.webkit.org/show_bug.cgi?id=90146
6479
6480 Reviewed by Oliver Hunt.
6481
6482 This removes a bunch of code that was previously trying to prevent spurious
6483 reoptimizations if a large enough majority of executions of a code block did
6484 not result in OSR exit. It turns out that this code was purely harmful. This
6485 patch removes all of that logic and replaces it with a dead-simple
6486 heuristic: if you exit more than N times (where N is an exponential function
6487 of the number of times the code block has already been recompiled) then we
6488 will recompile.
6489
6490 This appears to be a broad ~1% win on many benchmarks large and small.
6491
6492 * bytecode/CodeBlock.cpp:
6493 (JSC::CodeBlock::CodeBlock):
6494 * bytecode/CodeBlock.h:
6495 (JSC::CodeBlock::osrExitCounter):
6496 (JSC::CodeBlock::countOSRExit):
6497 (CodeBlock):
6498 (JSC::CodeBlock::addressOfOSRExitCounter):
6499 (JSC::CodeBlock::offsetOfOSRExitCounter):
6500 (JSC::CodeBlock::adjustedExitCountThreshold):
6501 (JSC::CodeBlock::exitCountThresholdForReoptimization):
6502 (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
6503 (JSC::CodeBlock::shouldReoptimizeNow):
6504 (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
6505 * bytecode/ExecutionCounter.cpp:
6506 (JSC::ExecutionCounter::setThreshold):
6507 * bytecode/ExecutionCounter.h:
6508 (ExecutionCounter):
6509 (JSC::ExecutionCounter::clippedThreshold):
6510 * dfg/DFGJITCompiler.cpp:
6511 (JSC::DFG::JITCompiler::compileBody):
6512 * dfg/DFGOSRExit.cpp:
6513 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
6514 * dfg/DFGOSRExitCompiler.cpp:
6515 (JSC::DFG::OSRExitCompiler::handleExitCounts):
6516 * dfg/DFGOperations.cpp:
6517 * jit/JITStubs.cpp:
6518 (JSC::DEFINE_STUB_FUNCTION):
6519 * runtime/Options.cpp:
6520 (Options):
6521 (JSC::Options::initializeOptions):
6522 * runtime/Options.h:
6523 (Options):
6524
commit-queue@webkit.org97ee82b2012-06-28 23:03:07 +0000[diff] [blame]65252012-06-28 Mark Lam <mark.lam@apple.com>
6526
6527 Adding a commenting utility to record BytecodeGenerator comments
6528 with opcodes that are emitted. Presently, the comments can only
6529 be constant strings. Adding comments for opcodes is optional.
6530 If a comment is added, the comment will be printed following the
6531 opcode when CodeBlock::dump() is called.
6532
6533 This utility is disabled by default, and is only meant for VM
6534 development purposes. It should not be enabled for product builds.
6535
6536 To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
6537 to 1.
6538
6539 https://bugs.webkit.org/show_bug.cgi?id=90095
6540
6541 Reviewed by Geoffrey Garen.
6542
6543 * GNUmakefile.list.am:
6544 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6545 * JavaScriptCore.xcodeproj/project.pbxproj:
6546 * bytecode/CodeBlock.cpp:
6547 (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
6548 (JSC):
6549 (JSC::CodeBlock::printUnaryOp): Add comment dumps.
6550 (JSC::CodeBlock::printBinaryOp): Add comment dumps.
6551 (JSC::CodeBlock::printConditionalJump): Add comment dumps.
6552 (JSC::CodeBlock::printCallOp): Add comment dumps.
6553 (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
6554 (JSC::CodeBlock::dump): Add comment dumps.
6555 (JSC::CodeBlock::CodeBlock):
6556 (JSC::CodeBlock::commentForBytecodeOffset):
6557 Finds the comment for an opcode if available.
6558 (JSC::CodeBlock::dumpBytecodeComments):
6559 For debugging whether comments are collected.
6560 It is not being called anywhere.
6561 * bytecode/CodeBlock.h:
6562 (CodeBlock):
6563 (JSC::CodeBlock::bytecodeComments):
6564 * bytecode/Comment.h: Added.
6565 (JSC):
6566 (Comment):
6567 * bytecompiler/BytecodeGenerator.cpp:
6568 (JSC::BytecodeGenerator::BytecodeGenerator):
6569 (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
6570 (JSC):
6571 (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
6572 (JSC::BytecodeGenerator::prependComment):
6573 Registers a comment for emitComemnt() to use later.
6574 * bytecompiler/BytecodeGenerator.h:
6575 (BytecodeGenerator):
6576 (JSC::BytecodeGenerator::emitComment):
6577 (JSC::BytecodeGenerator::prependComment):
6578 These are inlined versions of these functions that nullify them
6579 when ENABLE_BYTECODE_COMMENTS is 0.
6580 (JSC::BytecodeGenerator::comments):
6581
oliver@apple.com41383bc2012-06-28 20:54:06 +0000[diff] [blame]65822012-06-28 Oliver Hunt <oliver@apple.com>
6583
6584 32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
6585 https://bugs.webkit.org/show_bug.cgi?id=90127
6586
6587 Reviewed by Filip Pizlo.
6588
6589 The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
6590 correctly. This patch fixes this by killing the fill info in the GenerationInfo
6591 when the spillFormat doesn't guarantee the value is a double.
6592
6593 * dfg/DFGSpeculativeJIT32_64.cpp:
6594 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
6595
tkent@chromium.orgb53db042012-06-28 08:48:20 +0000[diff] [blame]65962012-06-28 Kent Tamura <tkent@chromium.org>
6597
6598 Classify form control states by their owner forms
6599 https://bugs.webkit.org/show_bug.cgi?id=89950
6600
6601 Reviewed by Hajime Morita.
6602
6603 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6604 Expose WTF::StringBuilder::canShrink()
6605
msaboff@apple.comff141582012-06-28 01:14:20 +0000[diff] [blame]66062012-06-27 Michael Saboff <msaboff@apple.com>
6607
6608 [Win] jscore-tests flakey
6609 https://bugs.webkit.org/show_bug.cgi?id=88118
6610
6611 Reviewed by Jessie Berlin.
6612
6613 jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
6614 instead it gets 126. Added a new option to jsc (-x) which prints the exit
6615 code before exiting. jsDriver.pl uses this option on Windows and parses the
6616 exit code output for the exit code, removing it before comparing the actual
6617 and expected outputs. Filed a follow on "FIXME" defect:
6618 [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
6619 https://bugs.webkit.org/show_bug.cgi?id=90119
6620
6621 * jsc.cpp:
6622 (CommandLine::CommandLine):
6623 (CommandLine):
6624 (printUsageStatement):
6625 (parseArguments):
6626 (jscmain):
6627 * tests/mozilla/jsDriver.pl:
6628 (execute_tests):
6629
commit-queue@webkit.orge12e2f32012-06-28 01:09:22 +0000[diff] [blame]66302012-06-27 Sheriff Bot <webkit.review.bot@gmail.com>
6631
6632 Unreviewed, rolling out r121359.
6633 http://trac.webkit.org/changeset/121359
6634 https://bugs.webkit.org/show_bug.cgi?id=90115
6635
6636 Broke many inspector tests (Requested by jpfau on #webkit).
6637
6638 * interpreter/Interpreter.h:
6639 (JSC::StackFrame::toString):
6640
fpizlo@apple.com12c18392012-06-27 23:16:10 +0000[diff] [blame]66412012-06-27 Filip Pizlo <fpizlo@apple.com>
6642
fpizlo@apple.comc01022e2012-06-28 00:49:55 +0000[diff] [blame]6643 Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
6644 https://bugs.webkit.org/show_bug.cgi?id=90053
6645 <rdar://problem/11764613>
6646
6647 Reviewed by Mark Hahnenberg.
6648
6649 The problem is that the code was assuming that the recovery should be Undefined if the source of
6650 the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
6651 UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
6652 In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
6653 was already in place but the fast check for !shouldGenerate() broke it.
6654
6655 * dfg/DFGSpeculativeJIT.cpp:
6656 (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
6657
66582012-06-27 Filip Pizlo <fpizlo@apple.com>
6659
fpizlo@apple.com12c18392012-06-27 23:16:10 +0000[diff] [blame]6660 DFG disassembly should be easier to read
6661 https://bugs.webkit.org/show_bug.cgi?id=90106
6662
6663 Reviewed by Mark Hahnenberg.
6664
6665 Did a few things:
6666
6667 - Options::showDFGDisassembly now shows OSR exit disassembly as well.
6668
6669 - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
6670 to read.
6671
6672 - DFG graph disassembly view shows a few additional node types that turn out to be
6673 essential for understanding OSR exits.
6674
6675 Put together, these changes reinforce the philosophy that anything needed for computing
6676 OSR exit is just as important as the machine code itself. Of course, we still don't take
6677 that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
6678 revisit that in the future.
6679
6680 * assembler/LinkBuffer.cpp:
6681 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
6682 * assembler/LinkBuffer.h:
6683 (JSC):
6684 * dfg/DFGDisassembler.cpp:
6685 (JSC::DFG::Disassembler::dump):
6686 * dfg/DFGGraph.cpp:
6687 (JSC::DFG::Graph::dumpBlockHeader):
6688 * dfg/DFGNode.h:
6689 (JSC::DFG::Node::willHaveCodeGenOrOSR):
6690 * dfg/DFGOSRExitCompiler.cpp:
6691 * jit/JIT.cpp:
6692 (JSC::JIT::privateCompile):
6693
mhahnenberg@apple.come16f8092012-06-27 23:08:26 +0000[diff] [blame]66942012-06-25 Mark Hahnenberg <mhahnenberg@apple.com>
6695
6696 JSLock should be per-JSGlobalData
6697 https://bugs.webkit.org/show_bug.cgi?id=89123
6698
6699 Reviewed by Geoffrey Garen.
6700
6701 * API/APIShims.h:
6702 (APIEntryShimWithoutLock):
6703 (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
6704 determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
6705 HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
6706 JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
6707 its destruction has begun.
6708 (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
6709 (JSC::APIEntryShim::APIEntryShim):
6710 (APIEntryShim):
6711 (JSC::APIEntryShim::~APIEntryShim):
6712 (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
6713 Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
6714 and before we've released it, which can only done in APIEntryShim.
6715 (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
6716 * API/JSContextRef.cpp:
6717 (JSGlobalContextCreate):
6718 (JSGlobalContextCreateInGroup):
6719 (JSGlobalContextRelease):
6720 (JSContextCreateBacktrace):
6721 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6722 * heap/CopiedSpace.cpp:
6723 (JSC::CopiedSpace::tryAllocateSlowCase):
6724 * heap/Heap.cpp:
6725 (JSC::Heap::protect):
6726 (JSC::Heap::unprotect):
6727 (JSC::Heap::collect):
6728 (JSC::Heap::setActivityCallback):
6729 (JSC::Heap::activityCallback):
6730 (JSC::Heap::sweeper):
6731 * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
6732 are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
6733 and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
6734 prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
6735 (Heap):
6736 * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
6737 (JSC::HeapTimer::~HeapTimer):
6738 (JSC::HeapTimer::invalidate):
6739 (JSC):
6740 (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
6741 that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
6742 HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
6743 (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
6744 out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
6745 but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
6746 we were interrupted between releasing our mutex and trying to grab the APILock.
6747 * heap/HeapTimer.h:
6748 (HeapTimer):
6749 * heap/IncrementalSweeper.cpp:
6750 (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
6751 all of that for us.
6752 (JSC::IncrementalSweeper::create):
6753 * heap/IncrementalSweeper.h:
6754 (IncrementalSweeper):
6755 * heap/MarkedAllocator.cpp:
6756 (JSC::MarkedAllocator::allocateSlowCase):
6757 * heap/WeakBlock.cpp:
6758 (JSC::WeakBlock::reap):
6759 * jsc.cpp:
6760 (functionGC):
6761 (functionReleaseExecutableMemory):
6762 (jscmain):
6763 * runtime/Completion.cpp:
6764 (JSC::checkSyntax):
6765 (JSC::evaluate):
6766 * runtime/GCActivityCallback.h:
6767 (DefaultGCActivityCallback):
6768 (JSC::DefaultGCActivityCallback::create):
6769 * runtime/JSGlobalData.cpp:
6770 (JSC::JSGlobalData::JSGlobalData):
6771 (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
6772 that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
6773 it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
6774 APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
6775 (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
6776 (JSC::JSGlobalData::sharedInstanceInternal):
6777 * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
6778 de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
6779 (JSGlobalData):
6780 (JSC::JSGlobalData::apiLock):
6781 * runtime/JSGlobalObject.cpp:
6782 (JSC::JSGlobalObject::~JSGlobalObject):
6783 (JSC::JSGlobalObject::init):
6784 * runtime/JSLock.cpp:
6785 (JSC):
6786 (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
6787 (JSC::GlobalJSLock::~GlobalJSLock):
6788 (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
6789 it can successfully unlock it later without it disappearing from underneath it.
6790 (JSC::JSLockHolder::~JSLockHolder):
6791 (JSC::JSLock::JSLock):
6792 (JSC::JSLock::~JSLock):
6793 (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
6794 actually waiting for long periods.
6795 (JSC::JSLock::unlock):
6796 (JSC::JSLock::currentThreadIsHoldingLock):
6797 (JSC::JSLock::dropAllLocks):
6798 (JSC::JSLock::dropAllLocksUnconditionally):
6799 (JSC::JSLock::grabAllLocks):
6800 (JSC::JSLock::DropAllLocks::DropAllLocks):
6801 (JSC::JSLock::DropAllLocks::~DropAllLocks):
6802 * runtime/JSLock.h:
6803 (JSC):
6804 (GlobalJSLock):
6805 (JSLockHolder):
6806 (JSLock):
6807 (DropAllLocks):
6808 * runtime/WeakGCMap.h:
6809 (JSC::WeakGCMap::set):
6810 * testRegExp.cpp:
6811 (realMain):
6812
fpizlo@apple.coma8de6ba2012-06-27 21:25:23 +0000[diff] [blame]68132012-06-27 Filip Pizlo <fpizlo@apple.com>
6814
fpizlo@apple.com4a4978b2012-06-27 21:45:08 +0000[diff] [blame]6815 x86 disassembler confuses immediates with addresses
6816 https://bugs.webkit.org/show_bug.cgi?id=90099
6817
6818 Reviewed by Mark Hahnenberg.
6819
6820 Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
6821 accordance with the gas and AT&T syntax.
6822
6823 * disassembler/udis86/udis86_syn-att.c:
6824 (gen_operand):
6825
68262012-06-27 Filip Pizlo <fpizlo@apple.com>
6827
fpizlo@apple.coma8de6ba2012-06-27 21:25:23 +0000[diff] [blame]6828 Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
6829
6830 Rubber stamped by Mark Hahnenberg.
6831
6832 * runtime/Options.cpp:
6833 (JSC::Options::initializeOptions):
6834
commit-queue@webkit.org50c978a2012-06-27 19:54:48 +0000[diff] [blame]68352012-06-27 Anthony Scian <ascian@rim.com>
6836
6837 Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
6838 https://bugs.webkit.org/show_bug.cgi?id=40118
6839
6840 Reviewed by Yong Li.
6841
6842 Added member functions to expose function name, urlString, and line #.
6843 Refactored toString to make use of these member functions to reduce
6844 duplicated code for future maintenance.
6845
6846 Manually tested refactoring of toString by tracing thrown exceptions.
6847
6848 * interpreter/Interpreter.h:
6849 (StackFrame):
6850 (JSC::StackFrame::toString):
6851 (JSC::StackFrame::friendlySourceURL):
6852 (JSC::StackFrame::friendlyFunctionName):
6853 (JSC::StackFrame::friendlyLineNumber):
6854
vestbo@webkit.org36e47da2012-06-27 13:02:03 +0000[diff] [blame]68552012-06-27 Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
6856
6857 [Qt] Remove redundant c++11 warning suppression code
6858
6859 This is already handled in default_post.
6860
6861 Reviewed by Tor Arne Vestbø.
6862
6863 * Target.pri:
6864
vestbo@webkit.orgcaf4d2f2012-06-27 11:30:42 +0000[diff] [blame]68652012-06-26 Tor Arne Vestbø <tor.arne.vestbo@nokia.com>
6866
6867 [Qt] Add missing heades to HEADERS
6868
6869 For JavaScriptCore there aren't any Qt specific files, so we include all
6870 headers for easy editing in Qt Creator.
6871
6872 Reviewed by Simon Hausmann.
6873
6874 * Target.pri:
6875
dominicc@chromium.org5940f722012-06-27 09:44:31 +0000[diff] [blame]68762012-06-26 Dominic Cooney <dominicc@chromium.org>
6877
6878 [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
6879 https://bugs.webkit.org/show_bug.cgi?id=90029
6880
6881 Reviewed by Adam Barth.
6882
6883 * gyp: Removed.
6884 * gyp/generate-derived-sources.sh: Removed.
6885 * gyp/generate-dtrace-header.sh: Removed.
6886 * gyp/run-if-exists.sh: Removed.
6887 * gyp/update-info-plist.sh: Removed.
6888
ggaren@apple.com6b348072012-06-27 03:44:05 +0000[diff] [blame]68892012-06-26 Geoffrey Garen <ggaren@apple.com>
6890
6891 Reduced (but did not eliminate) use of "berzerker GC"
6892 https://bugs.webkit.org/show_bug.cgi?id=89237
6893
6894 Reviewed by Gavin Barraclough.
6895
6896 (PART 2)
6897
6898 This part turns off "berzerker GC" and turns on incremental shrinking.
6899
6900 * heap/IncrementalSweeper.cpp:
6901 (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
6902 maintain the behavior we used to get from the occasional berzerker GC,
6903 which would run all finalizers and then free or shrink all blocks
6904 synchronously.
6905
6906 * heap/MarkedBlock.h:
6907 (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
6908 safe to sweep a zapped block (that's the point of zapping), and it's
6909 sometimes profitable. For example, consider this case: Block A does some
6910 allocation (transitioning Block A from Marked to FreeListed), then GC
6911 happens (transitioning Block A to Zapped), then all objects in Block A
6912 are free, then the incremental sweeper visits Block A. If we skipped
6913 Zapped blocks, we'd skip Block A, even though it would be profitable to
6914 run its destructors and free its memory.
6915
6916 * runtime/GCActivityCallback.cpp:
6917 (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
6918 this incrementally.
6919
fpizlo@apple.com580d9d72012-06-27 01:34:01 +0000[diff] [blame]69202012-06-26 Filip Pizlo <fpizlo@apple.com>
6921
6922 DFG PutByValAlias is too aggressive
6923 https://bugs.webkit.org/show_bug.cgi?id=90026
6924 <rdar://problem/11751830>
6925
6926 Reviewed by Gavin Barraclough.
6927
6928 For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
6929 performance by much.
6930
6931 For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
6932 is within bounds. This also has the effect of making our out-of-bounds handling consistent
6933 with WebCore.
6934
6935 * dfg/DFGCSEPhase.cpp:
6936 (JSC::DFG::CSEPhase::performNodeCSE):
6937 * dfg/DFGGraph.h:
6938 (JSC::DFG::Graph::byValIsPure):
6939 (JSC::DFG::Graph::clobbersWorld):
6940 * dfg/DFGNodeType.h:
6941 (DFG):
6942 * dfg/DFGSpeculativeJIT.cpp:
6943 (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
6944 (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
6945
commit-queue@webkit.org63a25eb2012-06-26 19:55:32 +0000[diff] [blame]69462012-06-26 Yong Li <yoli@rim.com>
6947
6948 [BlackBerry] Add JSC statistics into about:memory
6949 https://bugs.webkit.org/show_bug.cgi?id=89779
6950
6951 Reviewed by Rob Buis.
6952
6953 Fix non-JIT build on BlackBerry broken by r121196.
6954
6955 * runtime/MemoryStatistics.cpp:
6956 (JSC::globalMemoryStatistics):
6957
fpizlo@apple.com6c89cd32012-06-26 19:42:05 +0000[diff] [blame]69582012-06-25 Filip Pizlo <fpizlo@apple.com>
6959
6960 DFG::operationNewArray is unnecessarily slow, and may use the wrong array
6961 prototype when inlined
6962 https://bugs.webkit.org/show_bug.cgi?id=89821
6963
6964 Reviewed by Geoffrey Garen.
6965
6966 Fixes all array allocations to use the right structure, and hence the right prototype. Adds
6967 inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
6968 empty arrays.
6969
6970 * dfg/DFGAbstractState.cpp:
6971 (JSC::DFG::AbstractState::execute):
6972 * dfg/DFGByteCodeParser.cpp:
6973 (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
6974 * dfg/DFGCCallHelpers.h:
6975 (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
6976 (CCallHelpers):
6977 * dfg/DFGNodeType.h:
6978 (DFG):
6979 * dfg/DFGOperations.cpp:
6980 * dfg/DFGOperations.h:
6981 * dfg/DFGPredictionPropagationPhase.cpp:
6982 (JSC::DFG::PredictionPropagationPhase::propagate):
6983 * dfg/DFGSpeculativeJIT.h:
6984 (JSC::DFG::SpeculativeJIT::callOperation):
6985 * dfg/DFGSpeculativeJIT32_64.cpp:
6986 (JSC::DFG::SpeculativeJIT::compile):
6987 * dfg/DFGSpeculativeJIT64.cpp:
6988 (JSC::DFG::SpeculativeJIT::compile):
6989 * runtime/JSArray.h:
6990 (JSC):
6991 (JSC::constructArray):
6992 * runtime/JSGlobalObject.h:
6993 (JSC):
6994 (JSC::constructArray):
6995
fpizlo@apple.com0b6ad50752012-06-26 09:22:45 +0000[diff] [blame]69962012-06-26 Filip Pizlo <fpizlo@apple.com>
6997
6998 New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
6999 https://bugs.webkit.org/show_bug.cgi?id=89953
7000
7001 Reviewed by Zoltan Herczeg.
7002
7003 DFG 32-bit JIT was confused about the difference between a predicted type and a
7004 proven type. This is easy to get confused about, since a local that is predicted int32
7005 almost always means that the local must be an int32 since speculations are hoisted to
7006 stores to locals. But that is less likely to be the case for arguments, where there is
7007 an additional least-upper-bounding step: any store to an argument with a weird type
7008 may force the argument to be any type.
7009
7010 This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
7011 GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
7012 a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
7013 than the VariableAccessData::prediction(), which is a predicted type.
7014
7015 * dfg/DFGSpeculativeJIT32_64.cpp:
7016 (JSC::DFG::SpeculativeJIT::compile):
7017
fpizlo@apple.com41a1f0e2012-06-26 02:53:39 +0000[diff] [blame]70182012-06-25 Filip Pizlo <fpizlo@apple.com>
7019
7020 JSC should try to make profiling deterministic because otherwise reproducing failures is
7021 nearly impossible
7022 https://bugs.webkit.org/show_bug.cgi?id=89940
7023
7024 Rubber stamped by Gavin Barraclough.
7025
7026 This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
7027 into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
7028 artificially low (and statically predetermined!) value. This gives most of the benefit of
7029 threshold randomization without actually making the system behave completely differently on
7030 each invocation.
7031
7032 * bytecode/ExecutionCounter.cpp:
7033 (JSC::ExecutionCounter::setThreshold):
7034 * runtime/Options.cpp:
7035 (Options):
7036 (JSC::Options::initializeOptions):
7037 * runtime/Options.h:
7038 (Options):
7039
fpizlo@apple.com3745dbc2012-06-26 02:14:07 +0000[diff] [blame]70402012-06-22 Filip Pizlo <fpizlo@apple.com>
7041
7042 Value profiling should use tier-up threshold randomization to get more coverage
7043 https://bugs.webkit.org/show_bug.cgi?id=89802
7044
7045 Reviewed by Gavin Barraclough.
7046
7047 This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
7048 times before actually doing OSR. If we take the OSR slow path before the execution
7049 count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
7050 compute the current latest least-upper-bound SpecType of all values seen in each
7051 ValueProfile.
7052
7053 * bytecode/CodeBlock.cpp:
7054 (JSC::CodeBlock::stronglyVisitStrongReferences):
7055 (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
7056 (JSC):
7057 (JSC::CodeBlock::updateAllPredictions):
7058 (JSC::CodeBlock::shouldOptimizeNow):
7059 * bytecode/CodeBlock.h:
7060 (JSC::CodeBlock::llintExecuteCounter):
7061 (JSC::CodeBlock::jitExecuteCounter):
7062 (CodeBlock):
7063 (JSC::CodeBlock::updateAllPredictions):
7064 * bytecode/ExecutionCounter.cpp:
7065 (JSC::ExecutionCounter::setThreshold):
7066 (JSC::ExecutionCounter::status):
7067 (JSC):
7068 * bytecode/ExecutionCounter.h:
7069 (JSC::ExecutionCounter::count):
7070 (ExecutionCounter):
7071 * dfg/DFGAbstractState.cpp:
7072 (JSC::DFG::AbstractState::execute):
7073 * dfg/DFGOperations.cpp:
7074 * dfg/DFGSpeculativeJIT.cpp:
7075 (JSC::DFG::SpeculativeJIT::compile):
7076 * jit/JITStubs.cpp:
7077 (JSC::DEFINE_STUB_FUNCTION):
7078 * llint/LLIntSlowPaths.cpp:
7079 (JSC::LLInt::jitCompileAndSetHeuristics):
7080 (JSC::LLInt::entryOSR):
7081 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
7082 * runtime/JSGlobalObject.cpp:
7083 (JSC::JSGlobalObject::JSGlobalObject):
7084 (JSC):
7085 * runtime/JSGlobalObject.h:
7086 (JSGlobalObject):
7087 (JSC::JSGlobalObject::weakRandomInteger):
7088 * runtime/Options.cpp:
7089 (Options):
7090 (JSC::Options::initializeOptions):
7091 * runtime/Options.h:
7092 (Options):
7093 * runtime/WeakRandom.h:
7094 (WeakRandom):
7095 (JSC::WeakRandom::seedUnsafe):
7096
commit-queue@webkit.orgd3790912012-06-26 00:08:19 +0000[diff] [blame]70972012-06-25 Yong Li <yoli@rim.com>
7098
7099 [BlackBerry] Add JSC statistics into about:memory
7100 https://bugs.webkit.org/show_bug.cgi?id=89779
7101
7102 Reviewed by Rob Buis.
7103
7104 Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
7105
7106 * PlatformBlackBerry.cmake:
7107 * runtime/MemoryStatistics.cpp:
7108 (JSC::globalMemoryStatistics):
7109
zandobersek@gmail.coma6460e12012-06-23 13:41:40 +0000[diff] [blame]71102012-06-23 Sheriff Bot <webkit.review.bot@gmail.com>
7111
7112 Unreviewed, rolling out r121058.
7113 http://trac.webkit.org/changeset/121058
7114 https://bugs.webkit.org/show_bug.cgi?id=89809
7115
7116 Patch causes plugins tests to crash in GTK debug builds
7117 (Requested by zdobersek on #webkit).
7118
7119 * API/APIShims.h:
7120 (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
7121 (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
7122 (APIEntryShimWithoutLock):
7123 (JSC::APIEntryShim::APIEntryShim):
7124 (APIEntryShim):
7125 (JSC::APICallbackShim::~APICallbackShim):
7126 * API/JSContextRef.cpp:
7127 (JSGlobalContextCreate):
7128 (JSGlobalContextCreateInGroup):
7129 (JSGlobalContextRelease):
7130 (JSContextCreateBacktrace):
7131 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
7132 * heap/CopiedSpace.cpp:
7133 (JSC::CopiedSpace::tryAllocateSlowCase):
7134 * heap/Heap.cpp:
7135 (JSC::Heap::protect):
7136 (JSC::Heap::unprotect):
7137 (JSC::Heap::collect):
7138 (JSC::Heap::setActivityCallback):
7139 (JSC::Heap::activityCallback):
7140 (JSC::Heap::sweeper):
7141 * heap/Heap.h:
7142 (Heap):
7143 * heap/HeapTimer.cpp:
7144 (JSC::HeapTimer::~HeapTimer):
7145 (JSC::HeapTimer::invalidate):
7146 (JSC::HeapTimer::timerDidFire):
7147 (JSC):
7148 * heap/HeapTimer.h:
7149 (HeapTimer):
7150 * heap/IncrementalSweeper.cpp:
7151 (JSC::IncrementalSweeper::doWork):
7152 (JSC::IncrementalSweeper::create):
7153 * heap/IncrementalSweeper.h:
7154 (IncrementalSweeper):
7155 * heap/MarkedAllocator.cpp:
7156 (JSC::MarkedAllocator::allocateSlowCase):
7157 * heap/WeakBlock.cpp:
7158 (JSC::WeakBlock::reap):
7159 * jsc.cpp:
7160 (functionGC):
7161 (functionReleaseExecutableMemory):
7162 (jscmain):
7163 * runtime/Completion.cpp:
7164 (JSC::checkSyntax):
7165 (JSC::evaluate):
7166 * runtime/GCActivityCallback.h:
7167 (DefaultGCActivityCallback):
7168 (JSC::DefaultGCActivityCallback::create):
7169 * runtime/JSGlobalData.cpp:
7170 (JSC::JSGlobalData::JSGlobalData):
7171 (JSC::JSGlobalData::~JSGlobalData):
7172 (JSC::JSGlobalData::sharedInstance):
7173 (JSC::JSGlobalData::sharedInstanceInternal):
7174 * runtime/JSGlobalData.h:
7175 (JSGlobalData):
7176 * runtime/JSGlobalObject.cpp:
7177 (JSC::JSGlobalObject::~JSGlobalObject):
7178 (JSC::JSGlobalObject::init):
7179 * runtime/JSLock.cpp:
7180 (JSC):
7181 (JSC::createJSLockCount):
7182 (JSC::JSLock::lockCount):
7183 (JSC::setLockCount):
7184 (JSC::JSLock::JSLock):
7185 (JSC::JSLock::lock):
7186 (JSC::JSLock::unlock):
7187 (JSC::JSLock::currentThreadIsHoldingLock):
7188 (JSC::JSLock::DropAllLocks::DropAllLocks):
7189 (JSC::JSLock::DropAllLocks::~DropAllLocks):
7190 * runtime/JSLock.h:
7191 (JSC):
7192 (JSLock):
7193 (JSC::JSLock::JSLock):
7194 (JSC::JSLock::~JSLock):
7195 (DropAllLocks):
7196 * runtime/WeakGCMap.h:
7197 (JSC::WeakGCMap::set):
7198 * testRegExp.cpp:
7199 (realMain):
7200
achicu@adobe.comcead7612012-06-23 01:23:48 +0000[diff] [blame]72012012-06-22 Alexandru Chiculita <achicu@adobe.com>
7202
7203 [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
7204 https://bugs.webkit.org/show_bug.cgi?id=89781
7205
7206 Reviewed by Dean Jackson.
7207
7208 Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
7209
7210 * Configurations/FeatureDefines.xcconfig:
7211
fpizlo@apple.com16e2cbf2012-06-22 23:32:59 +0000[diff] [blame]72122012-06-22 Filip Pizlo <fpizlo@apple.com>
7213
7214 DFG tier-up should happen in prologues, not epilogues
7215 https://bugs.webkit.org/show_bug.cgi?id=89752
7216
7217 Reviewed by Geoffrey Garen.
7218
7219 This change has two outcomes:
7220
7221 1) Slightly reduces the likelihood that a function will be optimized both
7222 standalone and via inlining. Previously, if you had a call sequence like foo()
7223 calls bar() exactly once, and nobody else calls bar(), then bar() would get
7224 optimized first (because it returns first) and then foo() gets optimized. If foo()
7225 can inline bar() then that means that bar() gets optimized twice. But now, if we
7226 optimize in prologues, then foo() will be optimized first. If it inlines bar(),
7227 that means that there will no longer be any calls to bar().
7228
7229 2) It lets us kill some code in JITStubs. Epilogue tier-up was very different from
7230 loop tier-up, since epilogue tier-up should not attempt OSR. But prologue tier-up
7231 requires OSR (albeit really easy OSR since it's the top of the compilation unit),
7232 so it becomes just like loop tier-up. As a result, we now have one optimization
7233 hook (cti_optimize) instead of two (cti_optimize_from_loop and
7234 cti_optimize_from_ret).
7235
7236 As a consequence of not having an optimization check in epilogues, the OSR exit
7237 code must now trigger reoptimization itself instead of just signaling the epilogue
7238 check to fire.
7239
7240 This also adds the ability to count the number of DFG compilations, which was
7241 useful for debugging this patch and might be useful for other things in the future.
7242
7243 * bytecode/CodeBlock.cpp:
7244 (JSC::CodeBlock::reoptimize):
7245 (JSC):
7246 * bytecode/CodeBlock.h:
7247 (CodeBlock):
7248 * dfg/DFGByteCodeParser.cpp:
7249 (JSC::DFG::ByteCodeParser::parseCodeBlock):
7250 * dfg/DFGDriver.cpp:
7251 (DFG):
7252 (JSC::DFG::getNumCompilations):
7253 (JSC::DFG::compile):
7254 * dfg/DFGDriver.h:
7255 (DFG):
7256 * dfg/DFGOSRExitCompiler.cpp:
7257 (JSC::DFG::OSRExitCompiler::handleExitCounts):
7258 * dfg/DFGOperations.cpp:
7259 * dfg/DFGOperations.h:
7260 * jit/JIT.cpp:
7261 (JSC::JIT::emitOptimizationCheck):
7262 * jit/JIT.h:
7263 * jit/JITCall32_64.cpp:
7264 (JSC::JIT::emit_op_ret):
7265 (JSC::JIT::emit_op_ret_object_or_this):
7266 * jit/JITOpcodes.cpp:
7267 (JSC::JIT::emit_op_ret):
7268 (JSC::JIT::emit_op_ret_object_or_this):
7269 (JSC::JIT::emit_op_enter):
7270 * jit/JITOpcodes32_64.cpp:
7271 (JSC::JIT::emit_op_enter):
7272 * jit/JITStubs.cpp:
7273 (JSC::DEFINE_STUB_FUNCTION):
7274 * jit/JITStubs.h:
7275
mhahnenberg@apple.com6d9f86d2012-06-22 21:42:46 +0000[diff] [blame]72762012-06-20 Mark Hahnenberg <mhahnenberg@apple.com>
7277
7278 JSLock should be per-JSGlobalData
7279 https://bugs.webkit.org/show_bug.cgi?id=89123
7280
7281 Reviewed by Gavin Barraclough.
7282
7283 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
7284 * API/APIShims.h:
7285 (APIEntryShimWithoutLock):
7286 (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
7287 determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
7288 HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
7289 JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
7290 its destruction has begun.
7291 (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
7292 (JSC::APIEntryShim::APIEntryShim):
7293 (APIEntryShim):
7294 (JSC::APIEntryShim::~APIEntryShim):
7295 (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
7296 Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
7297 and before we've released it, which can only done in APIEntryShim.
7298 (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
7299 * API/JSContextRef.cpp:
7300 (JSGlobalContextCreate):
7301 (JSGlobalContextCreateInGroup):
7302 (JSGlobalContextRelease):
7303 (JSContextCreateBacktrace):
7304 * heap/CopiedSpace.cpp:
7305 (JSC::CopiedSpace::tryAllocateSlowCase):
7306 * heap/Heap.cpp:
7307 (JSC::Heap::protect):
7308 (JSC::Heap::unprotect):
7309 (JSC::Heap::collect):
7310 (JSC::Heap::setActivityCallback):
7311 (JSC::Heap::activityCallback):
7312 (JSC::Heap::sweeper):
7313 * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
7314 are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
7315 and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
7316 prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
7317 (Heap):
7318 * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
7319 (JSC::HeapTimer::~HeapTimer):
7320 (JSC::HeapTimer::invalidate):
7321 (JSC):
7322 (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
7323 that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
7324 HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
7325 (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
7326 out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
7327 but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
7328 we were interrupted between releasing our mutex and trying to grab the APILock.
7329 * heap/HeapTimer.h:
7330 (HeapTimer):
7331 * heap/IncrementalSweeper.cpp:
7332 (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
7333 all of that for us.
7334 (JSC::IncrementalSweeper::create):
7335 * heap/IncrementalSweeper.h:
7336 (IncrementalSweeper):
7337 * heap/MarkedAllocator.cpp:
7338 (JSC::MarkedAllocator::allocateSlowCase):
7339 * heap/WeakBlock.cpp:
7340 (JSC::WeakBlock::reap):
7341 * jsc.cpp:
7342 (functionGC):
7343 (functionReleaseExecutableMemory):
7344 (jscmain):
7345 * runtime/Completion.cpp:
7346 (JSC::checkSyntax):
7347 (JSC::evaluate):
7348 * runtime/GCActivityCallback.h:
7349 (DefaultGCActivityCallback):
7350 (JSC::DefaultGCActivityCallback::create):
7351 * runtime/JSGlobalData.cpp:
7352 (JSC::JSGlobalData::JSGlobalData):
7353 (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
7354 that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
7355 it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
7356 APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
7357 (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
7358 (JSC::JSGlobalData::sharedInstanceInternal):
7359 * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
7360 de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
7361 (JSGlobalData):
7362 (JSC::JSGlobalData::apiLock):
7363 * runtime/JSGlobalObject.cpp:
7364 (JSC::JSGlobalObject::~JSGlobalObject):
7365 (JSC::JSGlobalObject::init):
7366 * runtime/JSLock.cpp:
7367 (JSC):
7368 (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
7369 (JSC::GlobalJSLock::~GlobalJSLock):
7370 (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
7371 it can successfully unlock it later without it disappearing from underneath it.
7372 (JSC::JSLockHolder::~JSLockHolder):
7373 (JSC::JSLock::JSLock):
7374 (JSC::JSLock::~JSLock):
7375 (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
7376 actually waiting for long periods.
7377 (JSC::JSLock::unlock):
7378 (JSC::JSLock::currentThreadIsHoldingLock):
7379 (JSC::JSLock::dropAllLocks):
7380 (JSC::JSLock::dropAllLocksUnconditionally):
7381 (JSC::JSLock::grabAllLocks):
7382 (JSC::JSLock::DropAllLocks::DropAllLocks):
7383 (JSC::JSLock::DropAllLocks::~DropAllLocks):
7384 * runtime/JSLock.h:
7385 (JSC):
7386 (GlobalJSLock):
7387 (JSLockHolder):
7388 (JSLock):
7389 (DropAllLocks):
7390 * runtime/WeakGCMap.h:
7391 (JSC::WeakGCMap::set):
7392 * testRegExp.cpp:
7393 (realMain):
7394
peter@chromium.org166f5bb2012-06-22 16:20:33 +0000[diff] [blame]73952012-06-22 Peter Beverloo <peter@chromium.org>
7396
7397 [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
7398 https://bugs.webkit.org/show_bug.cgi?id=88853
7399
7400 Reviewed by Steve Block.
7401
7402 The Android exclusions were necessary to fix a gyp generation error, as
7403 the gcc_version variable wasn't being defined for Android. Remove these
7404 exceptions when Chromium is able to define the gcc_version variable.
7405
7406 * JavaScriptCore.gyp/JavaScriptCore.gyp:
7407
fpizlo@apple.com90011802012-06-22 01:33:30 +0000[diff] [blame]74082012-06-21 Filip Pizlo <fpizlo@apple.com>
7409
7410 op_resolve_global should not prevent DFG inlining
7411 https://bugs.webkit.org/show_bug.cgi?id=89726
7412
7413 Reviewed by Gavin Barraclough.
7414
7415 * bytecode/CodeBlock.cpp:
7416 (JSC::CodeBlock::CodeBlock):
7417 (JSC::CodeBlock::shrinkToFit):
7418 * bytecode/GlobalResolveInfo.h:
7419 (JSC::GlobalResolveInfo::GlobalResolveInfo):
7420 (GlobalResolveInfo):
7421 * dfg/DFGByteCodeParser.cpp:
7422 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
7423 * dfg/DFGCapabilities.h:
7424 (JSC::DFG::canInlineOpcode):
7425 * dfg/DFGOperations.cpp:
7426 * dfg/DFGOperations.h:
7427 * dfg/DFGSpeculativeJIT.h:
7428 (JSC::DFG::SpeculativeJIT::callOperation):
7429 * dfg/DFGSpeculativeJIT32_64.cpp:
7430 (JSC::DFG::SpeculativeJIT::compile):
7431 * dfg/DFGSpeculativeJIT64.cpp:
7432 (JSC::DFG::SpeculativeJIT::compile):
7433
fpizlo@apple.com618044d2012-06-21 22:55:42 +0000[diff] [blame]74342012-06-20 Filip Pizlo <fpizlo@apple.com>
7435
7436 DFG should inline 'new Array()'
7437 https://bugs.webkit.org/show_bug.cgi?id=89632
7438
7439 Reviewed by Geoffrey Garen.
7440
7441 This adds support for treating InternalFunction like intrinsics. The code
7442 to do so is actually quite clean, so I don't feel bad about perpetuating
7443 the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
7444
7445 Currently this newfound power is only used to inline 'new Array()'.
7446
7447 * dfg/DFGByteCodeParser.cpp:
7448 (ByteCodeParser):
7449 (JSC::DFG::ByteCodeParser::handleCall):
7450 (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
7451 (DFG):
7452 * dfg/DFGGraph.h:
7453 (JSC::DFG::Graph::isInternalFunctionConstant):
7454 (JSC::DFG::Graph::valueOfInternalFunctionConstant):
7455
mhahnenberg@apple.coma2373032012-06-21 22:38:39 +0000[diff] [blame]74562012-06-21 Mark Hahnenberg <mhahnenberg@apple.com>
7457
7458 Adding copyrights to new files.
7459
7460 * heap/HeapTimer.cpp:
7461 * heap/HeapTimer.h:
7462 * heap/IncrementalSweeper.cpp:
7463 * heap/IncrementalSweeper.h:
7464
commit-queue@webkit.orgc8209e72012-06-21 17:34:26 +0000[diff] [blame]74652012-06-21 Arnaud Renevier <arno@renevier.net>
7466
7467 make sure headers are included only once per file
7468 https://bugs.webkit.org/show_bug.cgi?id=88922
7469
7470 Reviewed by Alexey Proskuryakov.
7471
7472 * bytecode/CodeBlock.h:
7473 * heap/MachineStackMarker.cpp:
7474 * runtime/JSVariableObject.h:
7475
commit-queue@webkit.orgbff9a102012-06-21 15:46:40 +0000[diff] [blame]74762012-06-21 Ryuan Choi <ryuan.choi@gmail.com>
7477
7478 [EFL][WK2] Make WebKit2/Efl headers and resources installable.
7479 https://bugs.webkit.org/show_bug.cgi?id=88207
7480
7481 Reviewed by Chang Shu.
7482
7483 * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
7484
ggaren@apple.com4b67d0d2012-06-21 02:00:08 +0000[diff] [blame]74852012-06-20 Geoffrey Garen <ggaren@apple.com>
7486
7487 Reduced (but did not eliminate) use of "berzerker GC"
7488 https://bugs.webkit.org/show_bug.cgi?id=89237
7489
7490 Reviewed by Gavin Barraclough.
7491
7492 (PART 1)
7493
7494 This patch turned out to be crashy, so I'm landing the non-crashy bits
7495 first.
7496
7497 This part is pre-requisite refactoring. I didn't actually turn off
7498 "berzerker GC" or turn on incremental shrinking.
7499
7500 * heap/MarkedAllocator.cpp:
7501 (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
7502 we throw away the block we're currently allocating out of. Otherwise, we'll
7503 allocate out of a stale free list.
7504
7505 * heap/MarkedSpace.cpp:
7506 (JSC::Free::Free):
7507 (JSC::Free::operator()):
7508 (JSC::Free::returnValue): Refactored this functor to use a shared helper
7509 function, so we can share our implementation with the incremental sweeper.
7510
7511 Also changed to freeing individual blocks immediately instead of linking
7512 them into a list for later freeing. This makes the programming interface
7513 simpler, and it's slightly more efficient to boot.
7514
7515 (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
7516
7517 (JSC::MarkedSpace::freeBlock):
7518 (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
7519 with the incremental sweeper.
7520
7521 (JSC::MarkedSpace::shrink): Updated for new functor behavior.
7522
7523 * heap/MarkedSpace.h: Statically typed languages are awesome.
7524
fpizlo@apple.com8c462122012-06-20 21:07:33 +0000[diff] [blame]75252012-06-20 Filip Pizlo <fpizlo@apple.com>
7526
fpizlo@apple.com3bcb2112012-06-21 01:38:49 +0000[diff] [blame]7527 DFG should optimize ResolveGlobal
7528 https://bugs.webkit.org/show_bug.cgi?id=89617
7529
7530 Reviewed by Oliver Hunt.
7531
7532 This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
7533 adds the specific function optimization to ResolveGlobal, when it is inlined. And,
7534 it makes internal functions act like specific functions, since that will be the
7535 most common use-case of this optimization.
7536
7537 This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
7538 with this optimization, which is to completely inline common "globally resolved"
7539 function and constructor calls, like "new Array()".
7540
7541 * CMakeLists.txt:
7542 * GNUmakefile.list.am:
7543 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
7544 * JavaScriptCore.xcodeproj/project.pbxproj:
7545 * Target.pri:
7546 * bytecode/CodeBlock.cpp:
7547 (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
7548 * bytecode/CodeBlock.h:
7549 (CodeBlock):
7550 (JSC::CodeBlock::numberOfGlobalResolveInfos):
7551 * bytecode/GlobalResolveInfo.h:
7552 (JSC::getGlobalResolveInfoBytecodeOffset):
7553 (JSC):
7554 * bytecode/ResolveGlobalStatus.cpp: Added.
7555 (JSC):
7556 (JSC::computeForStructure):
7557 (JSC::computeForLLInt):
7558 (JSC::ResolveGlobalStatus::computeFor):
7559 * bytecode/ResolveGlobalStatus.h: Added.
7560 (JSC):
7561 (ResolveGlobalStatus):
7562 (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
7563 (JSC::ResolveGlobalStatus::state):
7564 (JSC::ResolveGlobalStatus::isSet):
7565 (JSC::ResolveGlobalStatus::operator!):
7566 (JSC::ResolveGlobalStatus::isSimple):
7567 (JSC::ResolveGlobalStatus::takesSlowPath):
7568 (JSC::ResolveGlobalStatus::structure):
7569 (JSC::ResolveGlobalStatus::offset):
7570 (JSC::ResolveGlobalStatus::specificValue):
7571 * dfg/DFGByteCodeParser.cpp:
7572 (ByteCodeParser):
7573 (JSC::DFG::ByteCodeParser::handleGetByOffset):
7574 (DFG):
7575 (JSC::DFG::ByteCodeParser::handleGetById):
7576 (JSC::DFG::ByteCodeParser::parseBlock):
7577 * runtime/JSObject.cpp:
7578 (JSC::getCallableObjectSlow):
7579 (JSC):
7580 (JSC::JSObject::put):
7581 (JSC::JSObject::putDirectVirtual):
7582 (JSC::JSObject::putDirectAccessor):
7583 * runtime/JSObject.h:
7584 (JSC):
7585 (JSC::getCallableObject):
7586 (JSC::JSObject::putOwnDataProperty):
7587 (JSC::JSObject::putDirect):
7588 (JSC::JSObject::putDirectWithoutTransition):
7589
75902012-06-20 Filip Pizlo <fpizlo@apple.com>
7591
fpizlo@apple.com2e368f72012-06-20 23:55:18 +0000[diff] [blame]7592 Functions on global objects should be specializable
7593 https://bugs.webkit.org/show_bug.cgi?id=89615
7594
7595 Reviewed by Oliver Hunt.
7596
7597 I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
7598 and it didn't. Bug 33343 was the reason why we disabled global object function specialization
7599 to begin with. So I'm guessing this is safe.
7600
7601 * runtime/JSGlobalObject.cpp:
7602 (JSC::JSGlobalObject::init):
7603
76042012-06-20 Filip Pizlo <fpizlo@apple.com>
7605
fpizlo@apple.com8c462122012-06-20 21:07:33 +0000[diff] [blame]7606 build-webkit failure due to illegal 32-bit integer constants in code
7607 generated by offlineasm
7608 https://bugs.webkit.org/show_bug.cgi?id=89347
7609
7610 Reviewed by Geoffrey Garen.
7611
7612 The offending constants are the magic numbers used by offlineasm to find
7613 offsets in the generated machine code. Added code to turn them into what
7614 the C++ compiler will believe to be valid 32-bit values.
7615
7616 * offlineasm/offsets.rb:
7617
ggaren@apple.com30ef2b32012-06-20 18:24:02 +0000[diff] [blame]76182012-06-19 Geoffrey Garen <ggaren@apple.com>
7619
7620 Made the incremental sweeper more aggressive
7621 https://bugs.webkit.org/show_bug.cgi?id=89527
7622
7623 Reviewed by Oliver Hunt.
7624
7625 This is a pre-requisite to getting rid of "berzerker GC" because we need
7626 the sweeper to reclaim memory in a timely fashion, or we'll see a memory
7627 footprint regression.
7628
7629 * heap/IncrementalSweeper.h:
7630 * heap/IncrementalSweeper.cpp:
7631 (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
7632 no need to use a data member to record it.
7633
7634 (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
7635 small time slice. This is better than sweeping only one block per timer
7636 fire because that strategy has a heavy timer overhead, and artificially
7637 delays memory reclamation.
7638
fpizlo@apple.com3d517672012-06-20 17:48:23 +0000[diff] [blame]76392012-06-20 Filip Pizlo <fpizlo@apple.com>
7640
7641 DFG should be able to print disassembly interleaved with the IR
7642 https://bugs.webkit.org/show_bug.cgi?id=89551
7643
7644 Reviewed by Geoffrey Garen.
fpizlo@apple.come245b3f2012-06-20 17:51:07 +0000[diff] [blame]7645
7646 This change also removes running Dominators unconditionally on every DFG
7647 compile. Dominators are designed to be computed on-demand, and currently
7648 the only demand is graph dumps.
fpizlo@apple.com3d517672012-06-20 17:48:23 +0000[diff] [blame]7649
7650 * CMakeLists.txt:
7651 * GNUmakefile.list.am:
7652 * JavaScriptCore.xcodeproj/project.pbxproj:
7653 * Target.pri:
7654 * assembler/ARMv7Assembler.h:
7655 (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
7656 (ARMv7Assembler):
7657 * assembler/AbstractMacroAssembler.h:
7658 (AbstractMacroAssembler):
7659 (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
7660 * assembler/X86Assembler.h:
7661 (X86Assembler):
7662 (JSC::X86Assembler::labelIgnoringWatchpoints):
7663 * dfg/DFGCommon.h:
7664 (JSC::DFG::shouldShowDisassembly):
7665 (DFG):
7666 * dfg/DFGDisassembler.cpp: Added.
7667 (DFG):
7668 (JSC::DFG::Disassembler::Disassembler):
7669 (JSC::DFG::Disassembler::dump):
7670 (JSC::DFG::Disassembler::dumpDisassembly):
7671 * dfg/DFGDisassembler.h: Added.
7672 (DFG):
7673 (Disassembler):
7674 (JSC::DFG::Disassembler::setStartOfCode):
7675 (JSC::DFG::Disassembler::setForBlock):
7676 (JSC::DFG::Disassembler::setForNode):
7677 (JSC::DFG::Disassembler::setEndOfMainPath):
7678 (JSC::DFG::Disassembler::setEndOfCode):
7679 * dfg/DFGDriver.cpp:
7680 (JSC::DFG::compile):
7681 * dfg/DFGGraph.cpp:
7682 (JSC::DFG::Graph::dumpCodeOrigin):
7683 (JSC::DFG::Graph::amountOfNodeWhiteSpace):
7684 (DFG):
7685 (JSC::DFG::Graph::printNodeWhiteSpace):
7686 (JSC::DFG::Graph::dump):
7687 (JSC::DFG::Graph::dumpBlockHeader):
7688 * dfg/DFGGraph.h:
7689 * dfg/DFGJITCompiler.cpp:
7690 (JSC::DFG::JITCompiler::JITCompiler):
7691 (DFG):
7692 (JSC::DFG::JITCompiler::compile):
7693 (JSC::DFG::JITCompiler::compileFunction):
7694 * dfg/DFGJITCompiler.h:
7695 (JITCompiler):
7696 (JSC::DFG::JITCompiler::setStartOfCode):
7697 (JSC::DFG::JITCompiler::setForBlock):
7698 (JSC::DFG::JITCompiler::setForNode):
7699 (JSC::DFG::JITCompiler::setEndOfMainPath):
7700 (JSC::DFG::JITCompiler::setEndOfCode):
7701 * dfg/DFGNode.h:
7702 (Node):
7703 (JSC::DFG::Node::willHaveCodeGen):
7704 * dfg/DFGNodeFlags.cpp:
7705 (JSC::DFG::nodeFlagsAsString):
7706 * dfg/DFGSpeculativeJIT.cpp:
7707 (JSC::DFG::SpeculativeJIT::compile):
7708 * dfg/DFGSpeculativeJIT.h:
7709 (SpeculativeJIT):
7710 * runtime/Options.cpp:
7711 (Options):
7712 (JSC::Options::initializeOptions):
7713 * runtime/Options.h:
7714 (Options):
7715
fpizlo@apple.com2adf5272012-06-20 01:33:30 +0000[diff] [blame]77162012-06-19 Filip Pizlo <fpizlo@apple.com>
7717
7718 JSC should be able to show disassembly for all generated JIT code
7719 https://bugs.webkit.org/show_bug.cgi?id=89536
7720
7721 Reviewed by Gavin Barraclough.
7722
7723 Now instead of doing linkBuffer.finalizeCode(), you do
7724 FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
7725 prints your explanation and the disassembled code, if
7726 Options::showDisassembly is set to true.
7727
7728 * CMakeLists.txt:
7729 * GNUmakefile.list.am:
7730 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7731 * JavaScriptCore.xcodeproj/project.pbxproj:
7732 * Target.pri:
7733 * assembler/LinkBuffer.cpp: Added.
7734 (JSC):
7735 (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
7736 (JSC::LinkBuffer::finalizeCodeWithDisassembly):
7737 (JSC::LinkBuffer::linkCode):
7738 (JSC::LinkBuffer::performFinalization):
7739 (JSC::LinkBuffer::dumpLinkStatistics):
7740 (JSC::LinkBuffer::dumpCode):
7741 * assembler/LinkBuffer.h:
7742 (LinkBuffer):
7743 (JSC):
7744 * assembler/MacroAssemblerCodeRef.h:
7745 (JSC::MacroAssemblerCodeRef::tryToDisassemble):
7746 (MacroAssemblerCodeRef):
7747 * dfg/DFGJITCompiler.cpp:
7748 (JSC::DFG::JITCompiler::compile):
7749 (JSC::DFG::JITCompiler::compileFunction):
7750 * dfg/DFGOSRExitCompiler.cpp:
7751 * dfg/DFGRepatch.cpp:
7752 (JSC::DFG::generateProtoChainAccessStub):
7753 (JSC::DFG::tryCacheGetByID):
7754 (JSC::DFG::tryBuildGetByIDList):
7755 (JSC::DFG::emitPutReplaceStub):
7756 (JSC::DFG::emitPutTransitionStub):
7757 * dfg/DFGThunks.cpp:
7758 (JSC::DFG::osrExitGenerationThunkGenerator):
7759 * disassembler/Disassembler.h:
7760 (JSC):
7761 (JSC::tryToDisassemble):
7762 * disassembler/UDis86Disassembler.cpp:
7763 (JSC::tryToDisassemble):
7764 * jit/JIT.cpp:
7765 (JSC::JIT::privateCompile):
7766 * jit/JITCode.h:
7767 (JSC::JITCode::tryToDisassemble):
7768 * jit/JITOpcodes.cpp:
7769 (JSC::JIT::privateCompileCTIMachineTrampolines):
7770 * jit/JITOpcodes32_64.cpp:
7771 (JSC::JIT::privateCompileCTIMachineTrampolines):
7772 (JSC::JIT::privateCompileCTINativeCall):
7773 * jit/JITPropertyAccess.cpp:
7774 (JSC::JIT::stringGetByValStubGenerator):
7775 (JSC::JIT::privateCompilePutByIdTransition):
7776 (JSC::JIT::privateCompilePatchGetArrayLength):
7777 (JSC::JIT::privateCompileGetByIdProto):
7778 (JSC::JIT::privateCompileGetByIdSelfList):
7779 (JSC::JIT::privateCompileGetByIdProtoList):
7780 (JSC::JIT::privateCompileGetByIdChainList):
7781 (JSC::JIT::privateCompileGetByIdChain):
7782 * jit/JITPropertyAccess32_64.cpp:
7783 (JSC::JIT::stringGetByValStubGenerator):
7784 (JSC::JIT::privateCompilePutByIdTransition):
7785 (JSC::JIT::privateCompilePatchGetArrayLength):
7786 (JSC::JIT::privateCompileGetByIdProto):
7787 (JSC::JIT::privateCompileGetByIdSelfList):
7788 (JSC::JIT::privateCompileGetByIdProtoList):
7789 (JSC::JIT::privateCompileGetByIdChainList):
7790 (JSC::JIT::privateCompileGetByIdChain):
7791 * jit/SpecializedThunkJIT.h:
7792 (JSC::SpecializedThunkJIT::finalize):
7793 * jit/ThunkGenerators.cpp:
7794 (JSC::charCodeAtThunkGenerator):
7795 (JSC::charAtThunkGenerator):
7796 (JSC::fromCharCodeThunkGenerator):
7797 (JSC::sqrtThunkGenerator):
7798 (JSC::floorThunkGenerator):
7799 (JSC::ceilThunkGenerator):
7800 (JSC::roundThunkGenerator):
7801 (JSC::expThunkGenerator):
7802 (JSC::logThunkGenerator):
7803 (JSC::absThunkGenerator):
7804 (JSC::powThunkGenerator):
7805 * llint/LLIntThunks.cpp:
7806 (JSC::LLInt::generateThunkWithJumpTo):
7807 (JSC::LLInt::functionForCallEntryThunkGenerator):
7808 (JSC::LLInt::functionForConstructEntryThunkGenerator):
7809 (JSC::LLInt::functionForCallArityCheckThunkGenerator):
7810 (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
7811 (JSC::LLInt::evalEntryThunkGenerator):
7812 (JSC::LLInt::programEntryThunkGenerator):
7813 * runtime/Options.cpp:
7814 (Options):
7815 (JSC::Options::initializeOptions):
7816 * runtime/Options.h:
7817 (Options):
7818 * yarr/YarrJIT.cpp:
7819 (JSC::Yarr::YarrGenerator::compile):
7820
mhahnenberg@apple.com7ffd08d2012-06-20 00:20:30 +0000[diff] [blame]78212012-06-19 Mark Hahnenberg <mhahnenberg@apple.com>
7822
7823 [Qt][Mac] REGRESSION(r120742): It broke the build
7824 https://bugs.webkit.org/show_bug.cgi?id=89516
7825
7826 Reviewed by Geoffrey Garen.
7827
7828 Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform
7829 code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms
7830 without CF support. These if-defs will probably disappear in the future when we
7831 use cross-platform timers in HeapTimer.
7832
7833 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7834 * JavaScriptCore.xcodeproj/project.pbxproj:
7835 * runtime/GCActivityCallback.cpp:
7836 (JSC):
7837 (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
7838 (JSC::DefaultGCActivityCallback::doWork):
7839 (JSC::DefaultGCActivityCallback::scheduleTimer):
7840 (JSC::DefaultGCActivityCallback::cancelTimer):
7841 (JSC::DefaultGCActivityCallback::didAllocate):
7842 (JSC::DefaultGCActivityCallback::willCollect):
7843 (JSC::DefaultGCActivityCallback::cancel):
7844 * runtime/GCActivityCallbackCF.cpp: Removed.
7845
fpizlo@apple.com152abff2012-06-19 23:10:12 +0000[diff] [blame]78462012-06-19 Filip Pizlo <fpizlo@apple.com>
7847
7848 DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
7849 https://bugs.webkit.org/show_bug.cgi?id=89511
7850 <rdar://problem/11700089>
7851
7852 Reviewed by Geoffrey Garen.
7853
7854 * dfg/DFGAbstractState.cpp:
7855 (JSC::DFG::AbstractState::execute):
7856
commit-queue@webkit.orgb6833002012-06-19 21:06:08 +0000[diff] [blame]78572012-06-19 Mark Lam <mark.lam@apple.com>
7858
7859 CodeBlock::needsCallReturnIndices() is no longer needed.
7860 https://bugs.webkit.org/show_bug.cgi?id=89490
7861
7862 Reviewed by Geoffrey Garen.
7863
7864 * bytecode/CodeBlock.h:
7865 (JSC::CodeBlock::needsCallReturnIndices): removed.
7866 * dfg/DFGJITCompiler.cpp:
7867 (JSC::DFG::JITCompiler::link):
7868 * jit/JIT.cpp:
7869 (JSC::JIT::privateCompile):
7870
fpizlo@apple.com861ea7b2012-06-19 20:05:06 +0000[diff] [blame]78712012-06-19 Filip Pizlo <fpizlo@apple.com>
7872
7873 Unreviewed, try to fix Windows build.
7874
7875 * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
7876
fpizlo@apple.com01c2a192012-06-19 19:42:55 +0000[diff] [blame]78772012-06-17 Filip Pizlo <fpizlo@apple.com>
7878
7879 It should be possible to look at disassembly
7880 https://bugs.webkit.org/show_bug.cgi?id=89319
7881
7882 Reviewed by Sam Weinig.
7883
7884 This imports the udis86 disassembler library. The library is placed
7885 behind an abstraction in disassembler/Disassembler.h, so that we can
7886 in the future use other disassemblers (for other platforms) whenever
7887 appropriate. As a first step, the disassembler is being invoked for
7888 DFG verbose dumps.
7889
7890 If we ever want to merge a new version of udis86 in the future, I've
7891 made notes about changes I made to the library in
7892 disassembler/udis86/differences.txt.
7893
7894 * CMakeLists.txt:
7895 * DerivedSources.make:
7896 * GNUmakefile.list.am:
7897 * JavaScriptCore.pri:
7898 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7899 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
7900 * JavaScriptCore.xcodeproj/project.pbxproj:
7901 * dfg/DFGJITCompiler.cpp:
7902 (JSC::DFG::JITCompiler::compile):
7903 (JSC::DFG::JITCompiler::compileFunction):
7904 * disassembler: Added.
7905 * disassembler/Disassembler.h: Added.
7906 (JSC):
7907 (JSC::tryToDisassemble):
7908 * disassembler/UDis86Disassembler.cpp: Added.
7909 (JSC):
7910 (JSC::tryToDisassemble):
7911 * disassembler/udis86: Added.
7912 * disassembler/udis86/differences.txt: Added.
7913 * disassembler/udis86/itab.py: Added.
7914 (UdItabGenerator):
7915 (UdItabGenerator.__init__):
7916 (UdItabGenerator.toGroupId):
7917 (UdItabGenerator.genLookupTable):
7918 (UdItabGenerator.genLookupTableList):
7919 (UdItabGenerator.genInsnTable):
7920 (genItabH):
7921 (genItabH.UD_ITAB_H):
7922 (genItabC):
7923 (genItab):
7924 (main):
7925 * disassembler/udis86/optable.xml: Added.
7926 * disassembler/udis86/ud_opcode.py: Added.
7927 (UdOpcodeTables):
7928 (UdOpcodeTables.sizeOfTable):
7929 (UdOpcodeTables.nameOfTable):
7930 (UdOpcodeTables.updateTable):
7931 (UdOpcodeTables.Insn):
7932 (UdOpcodeTables.Insn.__init__):
7933 (UdOpcodeTables.Insn.__init__.opcode):
7934 (UdOpcodeTables.parse):
7935 (UdOpcodeTables.addInsnDef):
7936 (UdOpcodeTables.print_table):
7937 (UdOpcodeTables.print_tree):
7938 * disassembler/udis86/ud_optable.py: Added.
7939 (UdOptableXmlParser):
7940 (UdOptableXmlParser.parseDef):
7941 (UdOptableXmlParser.parse):
7942 (printFn):
7943 (parse):
7944 (main):
7945 * disassembler/udis86/udis86.c: Added.
7946 (ud_init):
7947 (ud_disassemble):
7948 (ud_set_mode):
7949 (ud_set_vendor):
7950 (ud_set_pc):
7951 (ud):
7952 (ud_insn_asm):
7953 (ud_insn_off):
7954 (ud_insn_hex):
7955 (ud_insn_ptr):
7956 (ud_insn_len):
7957 * disassembler/udis86/udis86.h: Added.
7958 * disassembler/udis86/udis86_decode.c: Added.
7959 (eff_adr_mode):
7960 (ud_lookup_mnemonic):
7961 (decode_prefixes):
7962 (modrm):
7963 (resolve_operand_size):
7964 (resolve_mnemonic):
7965 (decode_a):
7966 (decode_gpr):
7967 (resolve_gpr64):
7968 (resolve_gpr32):
7969 (resolve_reg):
7970 (decode_imm):
7971 (decode_modrm_reg):
7972 (decode_modrm_rm):
7973 (decode_o):
7974 (decode_operand):
7975 (decode_operands):
7976 (clear_insn):
7977 (resolve_mode):
7978 (gen_hex):
7979 (decode_insn):
7980 (decode_3dnow):
7981 (decode_ssepfx):
7982 (decode_ext):
7983 (decode_opcode):
7984 (ud_decode):
7985 * disassembler/udis86/udis86_decode.h: Added.
7986 (ud_itab_entry_operand):
7987 (ud_itab_entry):
7988 (ud_lookup_table_list_entry):
7989 (sse_pfx_idx):
7990 (mode_idx):
7991 (modrm_mod_idx):
7992 (vendor_idx):
7993 (is_group_ptr):
7994 (group_idx):
7995 * disassembler/udis86/udis86_extern.h: Added.
7996 * disassembler/udis86/udis86_input.c: Added.
7997 (inp_buff_hook):
7998 (inp_file_hook):
7999 (ud):
8000 (ud_set_user_opaque_data):
8001 (ud_get_user_opaque_data):
8002 (ud_set_input_buffer):
8003 (ud_set_input_file):
8004 (ud_input_skip):
8005 (ud_input_end):
8006 (ud_inp_next):
8007 (ud_inp_back):
8008 (ud_inp_peek):
8009 (ud_inp_move):
8010 (ud_inp_uint8):
8011 (ud_inp_uint16):
8012 (ud_inp_uint32):
8013 (ud_inp_uint64):
8014 * disassembler/udis86/udis86_input.h: Added.
8015 * disassembler/udis86/udis86_itab_holder.c: Added.
8016 * disassembler/udis86/udis86_syn-att.c: Added.
8017 (opr_cast):
8018 (gen_operand):
8019 (ud_translate_att):
8020 * disassembler/udis86/udis86_syn-intel.c: Added.
8021 (opr_cast):
8022 (gen_operand):
8023 (ud_translate_intel):
8024 * disassembler/udis86/udis86_syn.c: Added.
8025 * disassembler/udis86/udis86_syn.h: Added.
8026 (mkasm):
8027 * disassembler/udis86/udis86_types.h: Added.
8028 (ud_operand):
8029 (ud):
8030 * jit/JITCode.h:
8031 (JITCode):
8032 (JSC::JITCode::tryToDisassemble):
8033
mhahnenberg@apple.coma7ec41b2012-06-19 19:17:31 +0000[diff] [blame]80342012-06-19 Mark Hahnenberg <mhahnenberg@apple.com>
8035
8036 GCActivityCallback and IncrementalSweeper should share code
8037 https://bugs.webkit.org/show_bug.cgi?id=89400
8038
8039 Reviewed by Geoffrey Garen.
8040
8041 A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper.
8042 We should extract the common functionality out into a separate class that both of them
8043 can inherit from. This refactoring will be an even greater boon when we add the ability
8044 to shut these two agents down in a thread-safe fashion
8045
8046 * CMakeLists.txt:
8047 * GNUmakefile.list.am:
8048 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8049 * JavaScriptCore.xcodeproj/project.pbxproj:
8050 * Target.pri:
8051 * heap/Heap.cpp:
8052 (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when
8053 we're initializing the GCActivityCallback and the IncrementalSweeper.
8054 * heap/Heap.h:
8055 (Heap):
8056 * heap/HeapTimer.cpp: Added.
8057 (JSC):
8058 (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
8059 DefaultGCActivityCallback::commonConstructor() used to do.
8060 (JSC::HeapTimer::~HeapTimer): Call to invalidate().
8061 (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
8062 Virtual so that non-CF subclasses can override.
8063 (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
8064 (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
8065 * heap/HeapTimer.h: Added. This is the class that serves as the common base class for
8066 both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing
8067 across threads for its subclasses.
8068 (JSC):
8069 (HeapTimer):
8070 * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality
8071 between IncrementalSweeper and GCActivityCallback into a common ancestor.
8072 (JSC):
8073 (JSC::IncrementalSweeper::doWork):
8074 (JSC::IncrementalSweeper::IncrementalSweeper):
8075 (JSC::IncrementalSweeper::cancelTimer):
8076 (JSC::IncrementalSweeper::create):
8077 * heap/IncrementalSweeper.h:
8078 (IncrementalSweeper):
8079 * runtime/GCActivityCallback.cpp:
8080 (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
8081 (JSC::DefaultGCActivityCallback::doWork):
8082 * runtime/GCActivityCallback.h:
8083 (GCActivityCallback):
8084 (JSC::GCActivityCallback::willCollect):
8085 (JSC::GCActivityCallback::GCActivityCallback):
8086 (JSC):
8087 (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in
8088 the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in
8089 HeapTimer anyways, so we only need the m_delay field now.
8090 * runtime/GCActivityCallbackBlackBerry.cpp:
8091 (JSC):
8092 (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
8093 (JSC::DefaultGCActivityCallback::doWork):
8094 (JSC::DefaultGCActivityCallback::didAllocate):
8095 * runtime/GCActivityCallbackCF.cpp:
8096 (JSC):
8097 (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
8098 (JSC::DefaultGCActivityCallback::doWork):
8099 (JSC::DefaultGCActivityCallback::scheduleTimer):
8100 (JSC::DefaultGCActivityCallback::cancelTimer):
8101 (JSC::DefaultGCActivityCallback::didAllocate):
8102 (JSC::DefaultGCActivityCallback::willCollect):
8103 (JSC::DefaultGCActivityCallback::cancel):
8104
8105
commit-queue@webkit.orgf5584612012-06-19 09:13:52 +0000[diff] [blame]81062012-06-19 Mike West <mkwst@chromium.org>
8107
8108 Introduce ENABLE_CSP_NEXT configuration flag.
8109 https://bugs.webkit.org/show_bug.cgi?id=89300
8110
8111 Reviewed by Adam Barth.
8112
8113 The 1.0 draft of the Content Security Policy spec is just about to
8114 move to Last Call. We'll hide work on the upcoming 1.1 spec behind
8115 this ENABLE flag, disabled by default.
8116
8117 Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
8118
8119 * Configurations/FeatureDefines.xcconfig:
8120
commit-queue@webkit.org3e0a1a02012-06-19 06:07:28 +0000[diff] [blame]81212012-06-18 Mark Lam <mark.lam@apple.com>
8122
8123 Changed JSC to always record line number information so that error.stack
8124 and window.onerror() can report proper line numbers.
8125 https://bugs.webkit.org/show_bug.cgi?id=89410
8126
8127 Reviewed by Geoffrey Garen.
8128
8129 * bytecode/CodeBlock.cpp:
8130 (JSC::CodeBlock::CodeBlock):
8131 (JSC::CodeBlock::lineNumberForBytecodeOffset):
8132 (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
8133
8134 * bytecode/CodeBlock.h:
8135 (JSC::CodeBlock::addLineInfo):
8136 (JSC::CodeBlock::hasLineInfo): Unused. Now removed.
8137 (JSC::CodeBlock::needsCallReturnIndices):
8138 (CodeBlock):
8139 (RareData): Hoisted m_lineInfo out of m_rareData. m_lineInfo is now
8140 filled in unconditionally.
8141
8142 * bytecompiler/BytecodeGenerator.h:
8143 (JSC::BytecodeGenerator::addLineInfo):
8144
aestes@apple.comf6d51392012-06-19 03:32:30 +0000[diff] [blame]81452012-06-18 Andy Estes <aestes@apple.com>
8146
aestes@apple.com6cc46942012-06-19 03:34:03 +0000[diff] [blame]8147 Fix r120663, which didn't land the change that was reviewed.
8148
81492012-06-18 Andy Estes <aestes@apple.com>
8150
aestes@apple.comf6d51392012-06-19 03:32:30 +0000[diff] [blame]8151 [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
8152 https://bugs.webkit.org/show_bug.cgi?id=89415
8153
8154 Reviewed by Sam Weinig.
8155
8156 In the case where canUseJIT was a non-NULL CFBooleanRef,
8157 enableAssembler() would leak both canUseJITKey and canUseJIT by
8158 returning before calling CFRelease. Fix this by using RetainPtr.
8159
8160 * runtime/JSGlobalData.cpp:
8161 (JSC::enableAssembler):
8162
ggaren@apple.com2318dbc2012-06-18 04:35:21 +0000[diff] [blame]81632012-06-17 Geoffrey Garen <ggaren@apple.com>
8164
8165 GC copy phase spends needless cycles zero-filling blocks
8166 https://bugs.webkit.org/show_bug.cgi?id=89128
8167
8168 Reviewed by Gavin Barraclough.
8169
8170 We only need to zero-fill when we're allocating memory that might not
8171 get fully initialized before GC.
8172
8173 * heap/CopiedBlock.h:
8174 (JSC::CopiedBlock::createNoZeroFill):
8175 (JSC::CopiedBlock::create): Added a way to create without zero-filling.
8176 This is our optimization.
8177
8178 (JSC::CopiedBlock::zeroFillToEnd):
8179 (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
8180 so we can sometimes create without zero-filling.
8181
8182 * heap/CopiedSpace.cpp:
8183 (JSC::CopiedSpace::init):
8184 (JSC::CopiedSpace::tryAllocateSlowCase):
8185 (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
8186 to clarify that the new block is always newly-allocated.
8187
8188 (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
8189 of a block that might be used in the future for allocation. (Most of the
8190 time, this is a no-op, since we've already filled the block completely.)
8191
8192 (JSC::CopiedSpace::getFreshBlock): Removed this function because the
8193 abstraction of "allocation must succeed" is no longer useful.
8194
8195 * heap/CopiedSpace.h: Updated declarations to match.
8196
8197 * heap/CopiedSpaceInlineMethods.h:
8198 (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
8199 knows that it can skip zero-filling.
8200
8201 Added tighter scoping to our lock, to improve parallelism.
8202
8203 (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
8204 into this function, for simplicity.
8205
8206 * heap/MarkStack.cpp:
8207 (JSC::SlotVisitor::startCopying):
8208 (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
8209 function for great good.
8210
fpizlo@apple.com73df57b2012-06-18 01:59:18 +0000[diff] [blame]82112012-06-17 Filip Pizlo <fpizlo@apple.com>
8212
8213 DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
8214 https://bugs.webkit.org/show_bug.cgi?id=89316
8215
8216 Reviewed by Oliver Hunt.
8217
8218 * dfg/DFGByteCodeParser.cpp:
8219 (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
8220 (ByteCodeParser):
8221 (JSC::DFG::ByteCodeParser::handleGetById):
8222 (JSC::DFG::ByteCodeParser::parseBlock):
8223
commit-queue@webkit.orgf8968a72012-06-15 22:24:21 +0000[diff] [blame]82242012-06-15 Yong Li <yoli@rim.com>
8225
8226 [BlackBerry] Put platform-specific GC policy in GCActivityCallback
8227 https://bugs.webkit.org/show_bug.cgi?id=89236
8228
8229 Reviewed by Rob Buis.
8230
8231 Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
8232 low memory GC policy there.
8233
8234 * PlatformBlackBerry.cmake:
8235 * heap/Heap.h:
8236 (JSC::Heap::isSafeToCollect): Added.
8237 * runtime/GCActivityCallbackBlackBerry.cpp: Added.
8238 (JSC):
8239 (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
8240 (DefaultGCActivityCallbackPlatformData):
8241 (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
8242 (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
8243 (JSC::DefaultGCActivityCallback::didAllocate):
8244 (JSC::DefaultGCActivityCallback::willCollect):
8245 (JSC::DefaultGCActivityCallback::synchronize):
8246 (JSC::DefaultGCActivityCallback::cancel):
8247
fpizlo@apple.com666a2d52012-06-15 22:21:44 +0000[diff] [blame]82482012-06-15 Filip Pizlo <fpizlo@apple.com>
8249
8250 DFG should be able to set watchpoints on structure transitions in the
8251 method check prototype chain
8252 https://bugs.webkit.org/show_bug.cgi?id=89058
8253
8254 Adding the same assertion to 32-bit that I added to 64-bit. This change
8255 does not affect correctness but it's a good thing for assertion coverage.
8256
8257 * dfg/DFGSpeculativeJIT32_64.cpp:
8258 (JSC::DFG::SpeculativeJIT::compile):
8259
fpizlo@apple.comb75911b2012-06-13 20:53:52 +0000[diff] [blame]82602012-06-13 Filip Pizlo <fpizlo@apple.com>
8261
fpizlo@apple.com04e41152012-06-15 22:14:53 +0000[diff] [blame]8262 DFG should be able to set watchpoints on structure transitions in the
8263 method check prototype chain
8264 https://bugs.webkit.org/show_bug.cgi?id=89058
8265
8266 Reviewed by Gavin Barraclough.
8267
8268 This adds the ability to set watchpoints on Structures, and then does
8269 the most modest thing we can do with this ability: the DFG now sets
8270 watchpoints on structure transitions in the prototype chain of method
8271 checks.
8272
8273 This appears to be a >1% speed-up on V8.
8274
8275 * bytecode/PutByIdStatus.cpp:
8276 (JSC::PutByIdStatus::computeFromLLInt):
8277 (JSC::PutByIdStatus::computeFor):
8278 * bytecode/StructureSet.h:
8279 (JSC::StructureSet::containsOnly):
8280 (StructureSet):
8281 * bytecode/Watchpoint.cpp:
8282 (JSC::WatchpointSet::WatchpointSet):
8283 (JSC::InlineWatchpointSet::add):
8284 (JSC):
8285 (JSC::InlineWatchpointSet::inflateSlow):
8286 (JSC::InlineWatchpointSet::freeFat):
8287 * bytecode/Watchpoint.h:
8288 (WatchpointSet):
8289 (JSC):
8290 (InlineWatchpointSet):
8291 (JSC::InlineWatchpointSet::InlineWatchpointSet):
8292 (JSC::InlineWatchpointSet::~InlineWatchpointSet):
8293 (JSC::InlineWatchpointSet::hasBeenInvalidated):
8294 (JSC::InlineWatchpointSet::isStillValid):
8295 (JSC::InlineWatchpointSet::startWatching):
8296 (JSC::InlineWatchpointSet::notifyWrite):
8297 (JSC::InlineWatchpointSet::isFat):
8298 (JSC::InlineWatchpointSet::fat):
8299 (JSC::InlineWatchpointSet::inflate):
8300 * dfg/DFGAbstractState.cpp:
8301 (JSC::DFG::AbstractState::execute):
8302 * dfg/DFGByteCodeParser.cpp:
8303 (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
8304 (ByteCodeParser):
8305 (JSC::DFG::ByteCodeParser::parseBlock):
8306 * dfg/DFGCSEPhase.cpp:
8307 (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
8308 (CSEPhase):
8309 (JSC::DFG::CSEPhase::performNodeCSE):
8310 * dfg/DFGCommon.h:
8311 * dfg/DFGGraph.cpp:
8312 (JSC::DFG::Graph::dump):
8313 * dfg/DFGGraph.h:
8314 (JSC::DFG::Graph::isCellConstant):
8315 * dfg/DFGJITCompiler.h:
8316 (JSC::DFG::JITCompiler::addWeakReferences):
8317 (JITCompiler):
8318 * dfg/DFGNode.h:
8319 (JSC::DFG::Node::hasStructure):
8320 (Node):
8321 (JSC::DFG::Node::structure):
8322 * dfg/DFGNodeType.h:
8323 (DFG):
8324 * dfg/DFGPredictionPropagationPhase.cpp:
8325 (JSC::DFG::PredictionPropagationPhase::propagate):
8326 * dfg/DFGRepatch.cpp:
8327 (JSC::DFG::emitPutTransitionStub):
8328 * dfg/DFGSpeculativeJIT64.cpp:
8329 (JSC::DFG::SpeculativeJIT::compile):
8330 * jit/JITStubs.cpp:
8331 (JSC::JITThunks::tryCachePutByID):
8332 * llint/LLIntSlowPaths.cpp:
8333 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8334 * runtime/Structure.cpp:
8335 (JSC::Structure::Structure):
8336 * runtime/Structure.h:
8337 (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
8338 (Structure):
8339 (JSC::Structure::transitionWatchpointSetIsStillValid):
8340 (JSC::Structure::addTransitionWatchpoint):
8341 (JSC::Structure::notifyTransitionFromThisStructure):
8342 (JSC::JSCell::setStructure):
8343 * runtime/SymbolTable.cpp:
8344 (JSC::SymbolTableEntry::attemptToWatch):
8345
83462012-06-13 Filip Pizlo <fpizlo@apple.com>
8347
fpizlo@apple.comb75911b2012-06-13 20:53:52 +0000[diff] [blame]8348 DFG should be able to set watchpoints on global variables
8349 https://bugs.webkit.org/show_bug.cgi?id=88692
8350
8351 Reviewed by Geoffrey Garen.
8352
8353 Rolling back in after fixing Windows build issues, and implementing
8354 branchTest8 for the Qt port's strange assemblers.
8355
8356 This implements global variable constant folding by allowing the optimizing
8357 compiler to set a "watchpoint" on globals that it wishes to constant fold.
8358 If the watchpoint fires, then an OSR exit is forced by overwriting the
8359 machine code that the optimizing compiler generated with a jump.
8360
8361 As such, this patch is adding quite a bit of stuff:
8362
8363 - Jump replacement on those hardware targets supported by the optimizing
8364 JIT. It is now possible to patch in a jump instruction over any recorded
8365 watchpoint label. The jump must be "local" in the sense that it must be
8366 within the range of the largest jump distance supported by a one
8367 instruction jump.
8368
8369 - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
8370 that records the location where a jump must be inserted and the
8371 destination to which it should jump. Watchpoints can be added to a
8372 WatchpointSet. The WatchpointSet can be fired all at once, which plants
8373 all jumps. WatchpointSet also remembers if it had ever been invalidated,
8374 which allows for monotonicity: we typically don't want to optimize using
8375 watchpoints on something for which watchpoints had previously fired. The
8376 act of notifying a WatchpointSet has a trivial fast path in case no
8377 Watchpoints are registered (one-byte load+branch).
8378
8379 - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
8380 except that you don't have to emit branches. But, you need to know what
8381 WatchpointSet to add the resulting Watchpoint to. Not everything that
8382 you could write a speculationCheck() for will have a WatchpointSet that
8383 would get notified if the condition you were speculating against became
8384 invalid.
8385
8386 - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
8387 do so without incurring any space overhead for those entries that don't
8388 have WatchpointSets.
8389
8390 - The bytecode generator infers all global function variables to be
8391 watchable, and makes all stores perform the WatchpointSet's write check,
8392 and marks all loads as being potentially watchable (i.e. you can compile
8393 them to a watchpoint and a constant).
8394
8395 Put together, this allows for fully sleazy inlining of calls to globally
8396 declared functions. The inline prologue will no longer contain the load of
8397 the function, or any checks of the function you're calling. I.e. it's
8398 pretty much like the kind of inlining you would see in Java or C++.
8399 Furthermore, the watchpointing functionality is built to be fairly general,
8400 and should allow setting watchpoints on all sorts of interesting things
8401 in the future.
8402
8403 The sleazy inlining means that we will now sometimes inline in code paths
8404 that have never executed. Previously, to inline we would have either had
8405 to have executed the call (to read the call's inline cache) or have
8406 executed the method check (to read the method check's inline cache). Now,
8407 we might inline when the callee is a watched global variable. This
8408 revealed some humorous bugs. First, constant folding disagreed with CFA
8409 over what kinds of operations can clobber (example: code path A is dead
8410 but stores a String into variable X, all other code paths store 0 into
8411 X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
8412 clobbering constant, but constant folding thought it was clobbering
8413 because it saw the String prediction). Second, inlining would crash if
8414 the inline callee had not been compiled. This patch fixes both bugs,
8415 since otherwise run-javascriptcore-tests would report regressions.
8416
8417 * CMakeLists.txt:
8418 * GNUmakefile.list.am:
8419 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
8420 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8421 * JavaScriptCore.xcodeproj/project.pbxproj:
8422 * Target.pri:
8423 * assembler/ARMv7Assembler.h:
8424 (ARMv7Assembler):
8425 (JSC::ARMv7Assembler::ARMv7Assembler):
8426 (JSC::ARMv7Assembler::labelForWatchpoint):
8427 (JSC::ARMv7Assembler::label):
8428 (JSC::ARMv7Assembler::replaceWithJump):
8429 (JSC::ARMv7Assembler::maxJumpReplacementSize):
8430 * assembler/AbstractMacroAssembler.h:
8431 (JSC):
8432 (AbstractMacroAssembler):
8433 (Label):
8434 (JSC::AbstractMacroAssembler::watchpointLabel):
8435 (JSC::AbstractMacroAssembler::readPointer):
8436 * assembler/AssemblerBuffer.h:
8437 * assembler/MacroAssemblerARM.h:
8438 (JSC::MacroAssemblerARM::branchTest8):
8439 (MacroAssemblerARM):
8440 (JSC::MacroAssemblerARM::replaceWithJump):
8441 (JSC::MacroAssemblerARM::maxJumpReplacementSize):
8442 * assembler/MacroAssemblerARMv7.h:
8443 (JSC::MacroAssemblerARMv7::load8Signed):
8444 (JSC::MacroAssemblerARMv7::load16Signed):
8445 (MacroAssemblerARMv7):
8446 (JSC::MacroAssemblerARMv7::replaceWithJump):
8447 (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
8448 (JSC::MacroAssemblerARMv7::branchTest8):
8449 (JSC::MacroAssemblerARMv7::jump):
8450 (JSC::MacroAssemblerARMv7::makeBranch):
8451 * assembler/MacroAssemblerMIPS.h:
8452 (JSC::MacroAssemblerMIPS::branchTest8):
8453 (MacroAssemblerMIPS):
8454 (JSC::MacroAssemblerMIPS::replaceWithJump):
8455 (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
8456 * assembler/MacroAssemblerSH4.h:
8457 (JSC::MacroAssemblerSH4::branchTest8):
8458 (MacroAssemblerSH4):
8459 (JSC::MacroAssemblerSH4::replaceWithJump):
8460 (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
8461 * assembler/MacroAssemblerX86.h:
8462 (MacroAssemblerX86):
8463 (JSC::MacroAssemblerX86::branchTest8):
8464 * assembler/MacroAssemblerX86Common.h:
8465 (JSC::MacroAssemblerX86Common::replaceWithJump):
8466 (MacroAssemblerX86Common):
8467 (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
8468 * assembler/MacroAssemblerX86_64.h:
8469 (MacroAssemblerX86_64):
8470 (JSC::MacroAssemblerX86_64::branchTest8):
8471 * assembler/X86Assembler.h:
8472 (JSC::X86Assembler::X86Assembler):
8473 (X86Assembler):
8474 (JSC::X86Assembler::cmpb_im):
8475 (JSC::X86Assembler::testb_im):
8476 (JSC::X86Assembler::labelForWatchpoint):
8477 (JSC::X86Assembler::label):
8478 (JSC::X86Assembler::replaceWithJump):
8479 (JSC::X86Assembler::maxJumpReplacementSize):
8480 (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
8481 * bytecode/CodeBlock.cpp:
8482 (JSC):
8483 (JSC::CodeBlock::printGetByIdCacheStatus):
8484 (JSC::CodeBlock::dump):
8485 * bytecode/CodeBlock.h:
8486 (JSC::CodeBlock::appendOSRExit):
8487 (JSC::CodeBlock::appendSpeculationRecovery):
8488 (CodeBlock):
8489 (JSC::CodeBlock::appendWatchpoint):
8490 (JSC::CodeBlock::numberOfWatchpoints):
8491 (JSC::CodeBlock::watchpoint):
8492 (DFGData):
8493 * bytecode/DFGExitProfile.h:
8494 (JSC::DFG::exitKindToString):
8495 (JSC::DFG::exitKindIsCountable):
8496 * bytecode/GetByIdStatus.cpp:
8497 (JSC::GetByIdStatus::computeForChain):
8498 * bytecode/Instruction.h:
8499 (Instruction):
8500 (JSC::Instruction::Instruction):
8501 * bytecode/Opcode.h:
8502 (JSC):
8503 (JSC::padOpcodeName):
8504 * bytecode/Watchpoint.cpp: Added.
8505 (JSC):
8506 (JSC::Watchpoint::~Watchpoint):
8507 (JSC::Watchpoint::correctLabels):
8508 (JSC::Watchpoint::fire):
8509 (JSC::WatchpointSet::WatchpointSet):
8510 (JSC::WatchpointSet::~WatchpointSet):
8511 (JSC::WatchpointSet::add):
8512 (JSC::WatchpointSet::notifyWriteSlow):
8513 (JSC::WatchpointSet::fireAllWatchpoints):
8514 * bytecode/Watchpoint.h: Added.
8515 (JSC):
8516 (Watchpoint):
8517 (JSC::Watchpoint::Watchpoint):
8518 (JSC::Watchpoint::setDestination):
8519 (WatchpointSet):
8520 (JSC::WatchpointSet::isStillValid):
8521 (JSC::WatchpointSet::hasBeenInvalidated):
8522 (JSC::WatchpointSet::startWatching):
8523 (JSC::WatchpointSet::notifyWrite):
8524 (JSC::WatchpointSet::addressOfIsWatched):
8525 * bytecompiler/BytecodeGenerator.cpp:
8526 (JSC::ResolveResult::checkValidity):
8527 (JSC::BytecodeGenerator::addGlobalVar):
8528 (JSC::BytecodeGenerator::BytecodeGenerator):
8529 (JSC::BytecodeGenerator::resolve):
8530 (JSC::BytecodeGenerator::emitResolve):
8531 (JSC::BytecodeGenerator::emitResolveWithBase):
8532 (JSC::BytecodeGenerator::emitResolveWithThis):
8533 (JSC::BytecodeGenerator::emitGetStaticVar):
8534 (JSC::BytecodeGenerator::emitPutStaticVar):
8535 * bytecompiler/BytecodeGenerator.h:
8536 (BytecodeGenerator):
8537 * bytecompiler/NodesCodegen.cpp:
8538 (JSC::FunctionCallResolveNode::emitBytecode):
8539 (JSC::PostfixResolveNode::emitBytecode):
8540 (JSC::PrefixResolveNode::emitBytecode):
8541 (JSC::ReadModifyResolveNode::emitBytecode):
8542 (JSC::AssignResolveNode::emitBytecode):
8543 (JSC::ConstDeclNode::emitCodeSingle):
8544 * dfg/DFGAbstractState.cpp:
8545 (JSC::DFG::AbstractState::execute):
8546 (JSC::DFG::AbstractState::clobberStructures):
8547 * dfg/DFGAbstractState.h:
8548 (AbstractState):
8549 (JSC::DFG::AbstractState::didClobber):
8550 * dfg/DFGByteCodeParser.cpp:
8551 (JSC::DFG::ByteCodeParser::handleInlining):
8552 (JSC::DFG::ByteCodeParser::parseBlock):
8553 * dfg/DFGCCallHelpers.h:
8554 (CCallHelpers):
8555 (JSC::DFG::CCallHelpers::setupArguments):
8556 * dfg/DFGCSEPhase.cpp:
8557 (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
8558 (CSEPhase):
8559 (JSC::DFG::CSEPhase::globalVarStoreElimination):
8560 (JSC::DFG::CSEPhase::performNodeCSE):
8561 * dfg/DFGCapabilities.h:
8562 (JSC::DFG::canCompileOpcode):
8563 * dfg/DFGConstantFoldingPhase.cpp:
8564 (JSC::DFG::ConstantFoldingPhase::run):
8565 * dfg/DFGCorrectableJumpPoint.h:
8566 (JSC::DFG::CorrectableJumpPoint::isSet):
8567 (CorrectableJumpPoint):
8568 * dfg/DFGJITCompiler.cpp:
8569 (JSC::DFG::JITCompiler::linkOSRExits):
8570 (JSC::DFG::JITCompiler::link):
8571 * dfg/DFGNode.h:
8572 (JSC::DFG::Node::hasIdentifierNumberForCheck):
8573 (Node):
8574 (JSC::DFG::Node::identifierNumberForCheck):
8575 (JSC::DFG::Node::hasRegisterPointer):
8576 * dfg/DFGNodeType.h:
8577 (DFG):
8578 * dfg/DFGOSRExit.cpp:
8579 (JSC::DFG::OSRExit::OSRExit):
8580 * dfg/DFGOSRExit.h:
8581 (OSRExit):
8582 * dfg/DFGOperations.cpp:
8583 * dfg/DFGOperations.h:
8584 * dfg/DFGPredictionPropagationPhase.cpp:
8585 (JSC::DFG::PredictionPropagationPhase::propagate):
8586 * dfg/DFGSpeculativeJIT.h:
8587 (JSC::DFG::SpeculativeJIT::callOperation):
8588 (JSC::DFG::SpeculativeJIT::appendCall):
8589 (SpeculativeJIT):
8590 (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
8591 * dfg/DFGSpeculativeJIT32_64.cpp:
8592 (JSC::DFG::SpeculativeJIT::compile):
8593 * dfg/DFGSpeculativeJIT64.cpp:
8594 (JSC::DFG::SpeculativeJIT::compile):
8595 * interpreter/Interpreter.cpp:
8596 (JSC::Interpreter::privateExecute):
8597 * jit/JIT.cpp:
8598 (JSC::JIT::privateCompileMainPass):
8599 (JSC::JIT::privateCompileSlowCases):
8600 * jit/JIT.h:
8601 * jit/JITPropertyAccess.cpp:
8602 (JSC::JIT::emit_op_put_global_var_check):
8603 (JSC):
8604 (JSC::JIT::emitSlow_op_put_global_var_check):
8605 * jit/JITPropertyAccess32_64.cpp:
8606 (JSC::JIT::emit_op_put_global_var_check):
8607 (JSC):
8608 (JSC::JIT::emitSlow_op_put_global_var_check):
8609 * jit/JITStubs.cpp:
8610 (JSC::DEFINE_STUB_FUNCTION):
8611 (JSC):
8612 * jit/JITStubs.h:
8613 * llint/LLIntSlowPaths.cpp:
8614 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8615 (LLInt):
8616 * llint/LLIntSlowPaths.h:
8617 (LLInt):
8618 * llint/LowLevelInterpreter32_64.asm:
8619 * llint/LowLevelInterpreter64.asm:
8620 * runtime/JSObject.cpp:
8621 (JSC::JSObject::removeDirect):
8622 * runtime/JSObject.h:
8623 (JSObject):
8624 * runtime/JSSymbolTableObject.h:
8625 (JSC::symbolTableGet):
8626 (JSC::symbolTablePut):
8627 (JSC::symbolTablePutWithAttributes):
8628 * runtime/SymbolTable.cpp: Added.
8629 (JSC):
8630 (JSC::SymbolTableEntry::copySlow):
8631 (JSC::SymbolTableEntry::freeFatEntrySlow):
8632 (JSC::SymbolTableEntry::couldBeWatched):
8633 (JSC::SymbolTableEntry::attemptToWatch):
8634 (JSC::SymbolTableEntry::addressOfIsWatched):
8635 (JSC::SymbolTableEntry::addWatchpoint):
8636 (JSC::SymbolTableEntry::notifyWriteSlow):
8637 (JSC::SymbolTableEntry::inflateSlow):
8638 * runtime/SymbolTable.h:
8639 (JSC):
8640 (SymbolTableEntry):
8641 (Fast):
8642 (JSC::SymbolTableEntry::Fast::Fast):
8643 (JSC::SymbolTableEntry::Fast::isNull):
8644 (JSC::SymbolTableEntry::Fast::getIndex):
8645 (JSC::SymbolTableEntry::Fast::isReadOnly):
8646 (JSC::SymbolTableEntry::Fast::getAttributes):
8647 (JSC::SymbolTableEntry::Fast::isFat):
8648 (JSC::SymbolTableEntry::SymbolTableEntry):
8649 (JSC::SymbolTableEntry::~SymbolTableEntry):
8650 (JSC::SymbolTableEntry::operator=):
8651 (JSC::SymbolTableEntry::isNull):
8652 (JSC::SymbolTableEntry::getIndex):
8653 (JSC::SymbolTableEntry::getFast):
8654 (JSC::SymbolTableEntry::getAttributes):
8655 (JSC::SymbolTableEntry::isReadOnly):
8656 (JSC::SymbolTableEntry::watchpointSet):
8657 (JSC::SymbolTableEntry::notifyWrite):
8658 (FatEntry):
8659 (JSC::SymbolTableEntry::FatEntry::FatEntry):
8660 (JSC::SymbolTableEntry::isFat):
8661 (JSC::SymbolTableEntry::fatEntry):
8662 (JSC::SymbolTableEntry::inflate):
8663 (JSC::SymbolTableEntry::bits):
8664 (JSC::SymbolTableEntry::freeFatEntry):
8665 (JSC::SymbolTableEntry::pack):
8666 (JSC::SymbolTableEntry::isValidIndex):
8667
zandobersek@gmail.com88d53732012-06-13 09:38:42 +0000[diff] [blame]86682012-06-13 Sheriff Bot <webkit.review.bot@gmail.com>
8669
8670 Unreviewed, rolling out r120172.
8671 http://trac.webkit.org/changeset/120172
8672 https://bugs.webkit.org/show_bug.cgi?id=88976
8673
8674 The patch causes compilation failures on Gtk, Qt and Apple Win
8675 bots (Requested by zdobersek on #webkit).
8676
8677 * CMakeLists.txt:
8678 * GNUmakefile.list.am:
8679 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
8680 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8681 * JavaScriptCore.xcodeproj/project.pbxproj:
8682 * Target.pri:
8683 * assembler/ARMv7Assembler.h:
8684 (JSC::ARMv7Assembler::nop):
8685 (JSC::ARMv7Assembler::label):
8686 (JSC::ARMv7Assembler::readPointer):
8687 (ARMv7Assembler):
8688 * assembler/AbstractMacroAssembler.h:
8689 (JSC):
8690 (AbstractMacroAssembler):
8691 (Label):
8692 * assembler/AssemblerBuffer.h:
8693 * assembler/MacroAssemblerARM.h:
8694 * assembler/MacroAssemblerARMv7.h:
8695 (JSC::MacroAssemblerARMv7::nop):
8696 (JSC::MacroAssemblerARMv7::jump):
8697 (JSC::MacroAssemblerARMv7::makeBranch):
8698 * assembler/MacroAssemblerMIPS.h:
8699 * assembler/MacroAssemblerSH4.h:
8700 * assembler/MacroAssemblerX86.h:
8701 (MacroAssemblerX86):
8702 (JSC::MacroAssemblerX86::moveWithPatch):
8703 * assembler/MacroAssemblerX86Common.h:
8704 * assembler/MacroAssemblerX86_64.h:
8705 (JSC::MacroAssemblerX86_64::branchTest8):
8706 * assembler/X86Assembler.h:
8707 (JSC::X86Assembler::cmpb_im):
8708 (JSC::X86Assembler::codeSize):
8709 (JSC::X86Assembler::label):
8710 (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
8711 * bytecode/CodeBlock.cpp:
8712 (JSC::CodeBlock::dump):
8713 * bytecode/CodeBlock.h:
8714 (JSC::CodeBlock::appendOSRExit):
8715 (JSC::CodeBlock::appendSpeculationRecovery):
8716 (DFGData):
8717 * bytecode/DFGExitProfile.h:
8718 (JSC::DFG::exitKindToString):
8719 (JSC::DFG::exitKindIsCountable):
8720 * bytecode/Instruction.h:
8721 * bytecode/Opcode.h:
8722 (JSC):
8723 (JSC::padOpcodeName):
8724 * bytecode/Watchpoint.cpp: Removed.
8725 * bytecode/Watchpoint.h: Removed.
8726 * bytecompiler/BytecodeGenerator.cpp:
8727 (JSC::ResolveResult::checkValidity):
8728 (JSC::BytecodeGenerator::addGlobalVar):
8729 (JSC::BytecodeGenerator::BytecodeGenerator):
8730 (JSC::BytecodeGenerator::resolve):
8731 (JSC::BytecodeGenerator::emitResolve):
8732 (JSC::BytecodeGenerator::emitResolveWithBase):
8733 (JSC::BytecodeGenerator::emitResolveWithThis):
8734 (JSC::BytecodeGenerator::emitGetStaticVar):
8735 (JSC::BytecodeGenerator::emitPutStaticVar):
8736 * bytecompiler/BytecodeGenerator.h:
8737 (BytecodeGenerator):
8738 * bytecompiler/NodesCodegen.cpp:
8739 (JSC::FunctionCallResolveNode::emitBytecode):
8740 (JSC::PostfixResolveNode::emitBytecode):
8741 (JSC::PrefixResolveNode::emitBytecode):
8742 (JSC::ReadModifyResolveNode::emitBytecode):
8743 (JSC::AssignResolveNode::emitBytecode):
8744 (JSC::ConstDeclNode::emitCodeSingle):
8745 * dfg/DFGAbstractState.cpp:
8746 (JSC::DFG::AbstractState::execute):
8747 (JSC::DFG::AbstractState::clobberStructures):
8748 * dfg/DFGAbstractState.h:
8749 (AbstractState):
8750 * dfg/DFGByteCodeParser.cpp:
8751 (JSC::DFG::ByteCodeParser::handleInlining):
8752 (JSC::DFG::ByteCodeParser::parseBlock):
8753 * dfg/DFGCCallHelpers.h:
8754 (JSC::DFG::CCallHelpers::setupArguments):
8755 * dfg/DFGCSEPhase.cpp:
8756 (JSC::DFG::CSEPhase::globalVarStoreElimination):
8757 (JSC::DFG::CSEPhase::performNodeCSE):
8758 * dfg/DFGCapabilities.h:
8759 (JSC::DFG::canCompileOpcode):
8760 * dfg/DFGConstantFoldingPhase.cpp:
8761 (JSC::DFG::ConstantFoldingPhase::run):
8762 * dfg/DFGCorrectableJumpPoint.h:
8763 * dfg/DFGJITCompiler.cpp:
8764 (JSC::DFG::JITCompiler::linkOSRExits):
8765 (JSC::DFG::JITCompiler::link):
8766 * dfg/DFGNode.h:
8767 (JSC::DFG::Node::hasRegisterPointer):
8768 * dfg/DFGNodeType.h:
8769 (DFG):
8770 * dfg/DFGOSRExit.cpp:
8771 (JSC::DFG::OSRExit::OSRExit):
8772 * dfg/DFGOSRExit.h:
8773 (OSRExit):
8774 * dfg/DFGOperations.cpp:
8775 * dfg/DFGOperations.h:
8776 * dfg/DFGPredictionPropagationPhase.cpp:
8777 (JSC::DFG::PredictionPropagationPhase::propagate):
8778 * dfg/DFGSpeculativeJIT.h:
8779 (JSC::DFG::SpeculativeJIT::callOperation):
8780 (JSC::DFG::SpeculativeJIT::appendCallSetResult):
8781 (JSC::DFG::SpeculativeJIT::speculationCheck):
8782 * dfg/DFGSpeculativeJIT32_64.cpp:
8783 (JSC::DFG::SpeculativeJIT::compile):
8784 * dfg/DFGSpeculativeJIT64.cpp:
8785 (JSC::DFG::SpeculativeJIT::compile):
8786 * jit/JIT.cpp:
8787 (JSC::JIT::privateCompileMainPass):
8788 (JSC::JIT::privateCompileSlowCases):
8789 * jit/JIT.h:
8790 * jit/JITPropertyAccess.cpp:
8791 * jit/JITPropertyAccess32_64.cpp:
8792 * jit/JITStubs.cpp:
8793 * jit/JITStubs.h:
8794 * llint/LLIntSlowPaths.cpp:
8795 * llint/LLIntSlowPaths.h:
8796 (LLInt):
8797 * llint/LowLevelInterpreter32_64.asm:
8798 * llint/LowLevelInterpreter64.asm:
8799 * runtime/JSObject.cpp:
8800 (JSC::JSObject::removeDirect):
8801 * runtime/JSObject.h:
8802 (JSObject):
8803 * runtime/JSSymbolTableObject.h:
8804 (JSC::symbolTableGet):
8805 (JSC::symbolTablePut):
8806 (JSC::symbolTablePutWithAttributes):
8807 * runtime/SymbolTable.cpp: Removed.
8808 * runtime/SymbolTable.h:
8809 (JSC):
8810 (JSC::SymbolTableEntry::isNull):
8811 (JSC::SymbolTableEntry::getIndex):
8812 (SymbolTableEntry):
8813 (JSC::SymbolTableEntry::getAttributes):
8814 (JSC::SymbolTableEntry::isReadOnly):
8815 (JSC::SymbolTableEntry::pack):
8816 (JSC::SymbolTableEntry::isValidIndex):
8817
fpizlo@apple.com3bdd4c92012-06-13 04:56:22 +0000[diff] [blame]88182012-06-12 Filip Pizlo <fpizlo@apple.com>
8819
fpizlo@apple.comb6c5eeb2012-06-13 08:20:39 +0000[diff] [blame]8820 DFG should be able to set watchpoints on global variables
8821 https://bugs.webkit.org/show_bug.cgi?id=88692
8822
8823 Reviewed by Geoffrey Garen.
8824
8825 This implements global variable constant folding by allowing the optimizing
8826 compiler to set a "watchpoint" on globals that it wishes to constant fold.
8827 If the watchpoint fires, then an OSR exit is forced by overwriting the
8828 machine code that the optimizing compiler generated with a jump.
8829
8830 As such, this patch is adding quite a bit of stuff:
8831
8832 - Jump replacement on those hardware targets supported by the optimizing
8833 JIT. It is now possible to patch in a jump instruction over any recorded
8834 watchpoint label. The jump must be "local" in the sense that it must be
8835 within the range of the largest jump distance supported by a one
8836 instruction jump.
8837
8838 - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
8839 that records the location where a jump must be inserted and the
8840 destination to which it should jump. Watchpoints can be added to a
8841 WatchpointSet. The WatchpointSet can be fired all at once, which plants
8842 all jumps. WatchpointSet also remembers if it had ever been invalidated,
8843 which allows for monotonicity: we typically don't want to optimize using
8844 watchpoints on something for which watchpoints had previously fired. The
8845 act of notifying a WatchpointSet has a trivial fast path in case no
8846 Watchpoints are registered (one-byte load+branch).
8847
8848 - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
8849 except that you don't have to emit branches. But, you need to know what
8850 WatchpointSet to add the resulting Watchpoint to. Not everything that
8851 you could write a speculationCheck() for will have a WatchpointSet that
8852 would get notified if the condition you were speculating against became
8853 invalid.
8854
8855 - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
8856 do so without incurring any space overhead for those entries that don't
8857 have WatchpointSets.
8858
8859 - The bytecode generator infers all global function variables to be
8860 watchable, and makes all stores perform the WatchpointSet's write check,
8861 and marks all loads as being potentially watchable (i.e. you can compile
8862 them to a watchpoint and a constant).
8863
8864 Put together, this allows for fully sleazy inlining of calls to globally
8865 declared functions. The inline prologue will no longer contain the load of
8866 the function, or any checks of the function you're calling. I.e. it's
8867 pretty much like the kind of inlining you would see in Java or C++.
8868 Furthermore, the watchpointing functionality is built to be fairly general,
8869 and should allow setting watchpoints on all sorts of interesting things
8870 in the future.
8871
8872 The sleazy inlining means that we will now sometimes inline in code paths
8873 that have never executed. Previously, to inline we would have either had
8874 to have executed the call (to read the call's inline cache) or have
8875 executed the method check (to read the method check's inline cache). Now,
8876 we might inline when the callee is a watched global variable. This
8877 revealed some humorous bugs. First, constant folding disagreed with CFA
8878 over what kinds of operations can clobber (example: code path A is dead
8879 but stores a String into variable X, all other code paths store 0 into
8880 X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
8881 clobbering constant, but constant folding thought it was clobbering
8882 because it saw the String prediction). Second, inlining would crash if
8883 the inline callee had not been compiled. This patch fixes both bugs,
8884 since otherwise run-javascriptcore-tests would report regressions.
8885
8886 * CMakeLists.txt:
8887 * GNUmakefile.list.am:
8888 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8889 * JavaScriptCore.xcodeproj/project.pbxproj:
8890 * Target.pri:
8891 * assembler/ARMv7Assembler.h:
8892 (ARMv7Assembler):
8893 (JSC::ARMv7Assembler::ARMv7Assembler):
8894 (JSC::ARMv7Assembler::labelForWatchpoint):
8895 (JSC::ARMv7Assembler::label):
8896 (JSC::ARMv7Assembler::replaceWithJump):
8897 (JSC::ARMv7Assembler::maxJumpReplacementSize):
8898 * assembler/AbstractMacroAssembler.h:
8899 (JSC):
8900 (AbstractMacroAssembler):
8901 (Label):
8902 (JSC::AbstractMacroAssembler::watchpointLabel):
8903 * assembler/AssemblerBuffer.h:
8904 * assembler/MacroAssemblerARM.h:
8905 (JSC::MacroAssemblerARM::replaceWithJump):
8906 (MacroAssemblerARM):
8907 (JSC::MacroAssemblerARM::maxJumpReplacementSize):
8908 * assembler/MacroAssemblerARMv7.h:
8909 (MacroAssemblerARMv7):
8910 (JSC::MacroAssemblerARMv7::replaceWithJump):
8911 (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
8912 (JSC::MacroAssemblerARMv7::branchTest8):
8913 (JSC::MacroAssemblerARMv7::jump):
8914 (JSC::MacroAssemblerARMv7::makeBranch):
8915 * assembler/MacroAssemblerMIPS.h:
8916 (JSC::MacroAssemblerMIPS::replaceWithJump):
8917 (MacroAssemblerMIPS):
8918 (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
8919 * assembler/MacroAssemblerSH4.h:
8920 (JSC::MacroAssemblerSH4::replaceWithJump):
8921 (MacroAssemblerSH4):
8922 (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
8923 * assembler/MacroAssemblerX86.h:
8924 (MacroAssemblerX86):
8925 (JSC::MacroAssemblerX86::branchTest8):
8926 * assembler/MacroAssemblerX86Common.h:
8927 (JSC::MacroAssemblerX86Common::replaceWithJump):
8928 (MacroAssemblerX86Common):
8929 (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
8930 * assembler/MacroAssemblerX86_64.h:
8931 (MacroAssemblerX86_64):
8932 (JSC::MacroAssemblerX86_64::branchTest8):
8933 * assembler/X86Assembler.h:
8934 (JSC::X86Assembler::X86Assembler):
8935 (X86Assembler):
8936 (JSC::X86Assembler::cmpb_im):
8937 (JSC::X86Assembler::testb_im):
8938 (JSC::X86Assembler::labelForWatchpoint):
8939 (JSC::X86Assembler::label):
8940 (JSC::X86Assembler::replaceWithJump):
8941 (JSC::X86Assembler::maxJumpReplacementSize):
8942 (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
8943 * bytecode/CodeBlock.cpp:
8944 (JSC::CodeBlock::dump):
8945 * bytecode/CodeBlock.h:
8946 (JSC::CodeBlock::appendOSRExit):
8947 (JSC::CodeBlock::appendSpeculationRecovery):
8948 (CodeBlock):
8949 (JSC::CodeBlock::appendWatchpoint):
8950 (JSC::CodeBlock::numberOfWatchpoints):
8951 (JSC::CodeBlock::watchpoint):
8952 (DFGData):
8953 * bytecode/DFGExitProfile.h:
8954 (JSC::DFG::exitKindToString):
8955 (JSC::DFG::exitKindIsCountable):
8956 * bytecode/Instruction.h:
8957 (Instruction):
8958 (JSC::Instruction::Instruction):
8959 * bytecode/Opcode.h:
8960 (JSC):
8961 (JSC::padOpcodeName):
8962 * bytecode/Watchpoint.cpp: Added.
8963 (JSC):
8964 (JSC::Watchpoint::~Watchpoint):
8965 (JSC::Watchpoint::correctLabels):
8966 (JSC::Watchpoint::fire):
8967 (JSC::WatchpointSet::WatchpointSet):
8968 (JSC::WatchpointSet::~WatchpointSet):
8969 (JSC::WatchpointSet::add):
8970 (JSC::WatchpointSet::notifyWriteSlow):
8971 (JSC::WatchpointSet::fireAllWatchpoints):
8972 * bytecode/Watchpoint.h: Added.
8973 (JSC):
8974 (Watchpoint):
8975 (JSC::Watchpoint::Watchpoint):
8976 (JSC::Watchpoint::setDestination):
8977 (WatchpointSet):
8978 (JSC::WatchpointSet::isStillValid):
8979 (JSC::WatchpointSet::hasBeenInvalidated):
8980 (JSC::WatchpointSet::startWatching):
8981 (JSC::WatchpointSet::notifyWrite):
8982 (JSC::WatchpointSet::addressOfIsWatched):
8983 * bytecompiler/BytecodeGenerator.cpp:
8984 (JSC::ResolveResult::checkValidity):
8985 (JSC::BytecodeGenerator::addGlobalVar):
8986 (JSC::BytecodeGenerator::BytecodeGenerator):
8987 (JSC::BytecodeGenerator::resolve):
8988 (JSC::BytecodeGenerator::emitResolve):
8989 (JSC::BytecodeGenerator::emitResolveWithBase):
8990 (JSC::BytecodeGenerator::emitResolveWithThis):
8991 (JSC::BytecodeGenerator::emitGetStaticVar):
8992 (JSC::BytecodeGenerator::emitPutStaticVar):
8993 * bytecompiler/BytecodeGenerator.h:
8994 (BytecodeGenerator):
8995 * bytecompiler/NodesCodegen.cpp:
8996 (JSC::FunctionCallResolveNode::emitBytecode):
8997 (JSC::PostfixResolveNode::emitBytecode):
8998 (JSC::PrefixResolveNode::emitBytecode):
8999 (JSC::ReadModifyResolveNode::emitBytecode):
9000 (JSC::AssignResolveNode::emitBytecode):
9001 (JSC::ConstDeclNode::emitCodeSingle):
9002 * dfg/DFGAbstractState.cpp:
9003 (JSC::DFG::AbstractState::execute):
9004 (JSC::DFG::AbstractState::clobberStructures):
9005 * dfg/DFGAbstractState.h:
9006 (AbstractState):
9007 (JSC::DFG::AbstractState::didClobber):
9008 * dfg/DFGByteCodeParser.cpp:
9009 (JSC::DFG::ByteCodeParser::handleInlining):
9010 (JSC::DFG::ByteCodeParser::parseBlock):
9011 * dfg/DFGCCallHelpers.h:
9012 (CCallHelpers):
9013 (JSC::DFG::CCallHelpers::setupArguments):
9014 * dfg/DFGCSEPhase.cpp:
9015 (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
9016 (CSEPhase):
9017 (JSC::DFG::CSEPhase::globalVarStoreElimination):
9018 (JSC::DFG::CSEPhase::performNodeCSE):
9019 * dfg/DFGCapabilities.h:
9020 (JSC::DFG::canCompileOpcode):
9021 * dfg/DFGConstantFoldingPhase.cpp:
9022 (JSC::DFG::ConstantFoldingPhase::run):
9023 * dfg/DFGCorrectableJumpPoint.h:
9024 (JSC::DFG::CorrectableJumpPoint::isSet):
9025 (CorrectableJumpPoint):
9026 * dfg/DFGJITCompiler.cpp:
9027 (JSC::DFG::JITCompiler::linkOSRExits):
9028 (JSC::DFG::JITCompiler::link):
9029 * dfg/DFGNode.h:
9030 (JSC::DFG::Node::hasIdentifierNumberForCheck):
9031 (Node):
9032 (JSC::DFG::Node::identifierNumberForCheck):
9033 (JSC::DFG::Node::hasRegisterPointer):
9034 * dfg/DFGNodeType.h:
9035 (DFG):
9036 * dfg/DFGOSRExit.cpp:
9037 (JSC::DFG::OSRExit::OSRExit):
9038 * dfg/DFGOSRExit.h:
9039 (OSRExit):
9040 * dfg/DFGOperations.cpp:
9041 * dfg/DFGOperations.h:
9042 * dfg/DFGPredictionPropagationPhase.cpp:
9043 (JSC::DFG::PredictionPropagationPhase::propagate):
9044 * dfg/DFGSpeculativeJIT.h:
9045 (JSC::DFG::SpeculativeJIT::callOperation):
9046 (JSC::DFG::SpeculativeJIT::appendCall):
9047 (SpeculativeJIT):
9048 (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
9049 * dfg/DFGSpeculativeJIT32_64.cpp:
9050 (JSC::DFG::SpeculativeJIT::compile):
9051 * dfg/DFGSpeculativeJIT64.cpp:
9052 (JSC::DFG::SpeculativeJIT::compile):
9053 * jit/JIT.cpp:
9054 (JSC::JIT::privateCompileMainPass):
9055 (JSC::JIT::privateCompileSlowCases):
9056 * jit/JIT.h:
9057 * jit/JITPropertyAccess.cpp:
9058 (JSC::JIT::emit_op_put_global_var_check):
9059 (JSC):
9060 (JSC::JIT::emitSlow_op_put_global_var_check):
9061 * jit/JITPropertyAccess32_64.cpp:
9062 (JSC::JIT::emit_op_put_global_var_check):
9063 (JSC):
9064 (JSC::JIT::emitSlow_op_put_global_var_check):
9065 * jit/JITStubs.cpp:
9066 (JSC::JITThunks::JITThunks):
9067 (JSC::DEFINE_STUB_FUNCTION):
9068 (JSC):
9069 * jit/JITStubs.h:
9070 * llint/LLIntSlowPaths.cpp:
9071 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
9072 (LLInt):
9073 * llint/LLIntSlowPaths.h:
9074 (LLInt):
9075 * llint/LowLevelInterpreter32_64.asm:
9076 * llint/LowLevelInterpreter64.asm:
9077 * runtime/JSObject.cpp:
9078 (JSC::JSObject::removeDirect):
9079 * runtime/JSObject.h:
9080 (JSObject):
9081 * runtime/JSSymbolTableObject.h:
9082 (JSC::symbolTableGet):
9083 (JSC::symbolTablePut):
9084 (JSC::symbolTablePutWithAttributes):
9085 * runtime/SymbolTable.cpp: Added.
9086 (JSC):
9087 (JSC::SymbolTableEntry::copySlow):
9088 (JSC::SymbolTableEntry::freeFatEntrySlow):
9089 (JSC::SymbolTableEntry::couldBeWatched):
9090 (JSC::SymbolTableEntry::attemptToWatch):
9091 (JSC::SymbolTableEntry::addressOfIsWatched):
9092 (JSC::SymbolTableEntry::addWatchpoint):
9093 (JSC::SymbolTableEntry::notifyWriteSlow):
9094 (JSC::SymbolTableEntry::inflateSlow):
9095 * runtime/SymbolTable.h:
9096 (JSC):
9097 (SymbolTableEntry):
9098 (Fast):
9099 (JSC::SymbolTableEntry::Fast::Fast):
9100 (JSC::SymbolTableEntry::Fast::isNull):
9101 (JSC::SymbolTableEntry::Fast::getIndex):
9102 (JSC::SymbolTableEntry::Fast::isReadOnly):
9103 (JSC::SymbolTableEntry::Fast::getAttributes):
9104 (JSC::SymbolTableEntry::Fast::isFat):
9105 (JSC::SymbolTableEntry::SymbolTableEntry):
9106 (JSC::SymbolTableEntry::~SymbolTableEntry):
9107 (JSC::SymbolTableEntry::operator=):
9108 (JSC::SymbolTableEntry::isNull):
9109 (JSC::SymbolTableEntry::getIndex):
9110 (JSC::SymbolTableEntry::getFast):
9111 (JSC::SymbolTableEntry::getAttributes):
9112 (JSC::SymbolTableEntry::isReadOnly):
9113 (JSC::SymbolTableEntry::watchpointSet):
9114 (JSC::SymbolTableEntry::notifyWrite):
9115 (FatEntry):
9116 (JSC::SymbolTableEntry::FatEntry::FatEntry):
9117 (JSC::SymbolTableEntry::isFat):
9118 (JSC::SymbolTableEntry::fatEntry):
9119 (JSC::SymbolTableEntry::inflate):
9120 (JSC::SymbolTableEntry::bits):
9121 (JSC::SymbolTableEntry::freeFatEntry):
9122 (JSC::SymbolTableEntry::pack):
9123 (JSC::SymbolTableEntry::isValidIndex):
9124
91252012-06-12 Filip Pizlo <fpizlo@apple.com>
9126
fpizlo@apple.com3bdd4c92012-06-13 04:56:22 +0000[diff] [blame]9127 Unreviewed build fix for ARMv7 debug builds.
9128
9129 * jit/JITStubs.cpp:
9130 (JSC::JITThunks::JITThunks):
9131
ggaren@apple.com3c89f392012-06-13 02:50:50 +0000[diff] [blame]91322012-06-12 Geoffrey Garen <ggaren@apple.com>
9133
9134 Build fix for case-sensitive file systems: use the right case.
9135
9136 * heap/ListableHandler.h:
9137
ggaren@apple.com639160c2012-06-13 02:06:50 +0000[diff] [blame]91382012-06-11 Geoffrey Garen <ggaren@apple.com>
9139
9140 GC should be 1.7X faster
9141 https://bugs.webkit.org/show_bug.cgi?id=88840
9142
9143 Reviewed by Oliver Hunt.
9144
9145 I profiled, and removed anything that showed up as a concurrency
9146 bottleneck. Then, I added 3 threads to our max thread count, since we
9147 can scale up to more threads now.
9148
9149 * heap/BlockAllocator.cpp:
9150 (JSC::BlockAllocator::BlockAllocator):
9151 (JSC::BlockAllocator::~BlockAllocator):
9152 (JSC::BlockAllocator::releaseFreeBlocks):
9153 (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
9154 (JSC::BlockAllocator::waitForRelativeTime):
9155 (JSC::BlockAllocator::blockFreeingThreadMain):
9156 * heap/BlockAllocator.h:
9157 (BlockAllocator):
9158 (JSC::BlockAllocator::allocate):
9159 (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
9160 where we're just popping a linked list. (A pthread mutex would sleep our
9161 thread even if the lock were only contended for a microsecond.)
9162
9163 Scope the lock to avoid holding it while allocating VM, since that's a
9164 slow activity and it doesn't modify any of our data structures.
9165
9166 We still use a pthread mutex to handle our condition variable since we
9167 have to, and it's not a hot path.
9168
9169 * heap/CopiedSpace.cpp:
9170 (JSC::CopiedSpace::CopiedSpace):
9171 (JSC::CopiedSpace::doneFillingBlock):
9172 * heap/CopiedSpace.h:
9173 (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
9174 since it just guards linked list and hash table manipulation.
9175
9176 * heap/MarkStack.cpp:
9177 (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
9178 (JSC::MarkStackSegmentAllocator::allocate):
9179 (JSC::MarkStackSegmentAllocator::release):
9180 (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
9181 we're just managing a linked list.
9182
9183 (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
9184 to our current stack size. This fixes cases where we used to donate too
9185 much. Interestingly, donating too much was starving the donor (when it
9186 ran out of work later) *and* the recipient (since it had to wait on a
9187 long donation operation to complete before it could acquire the lock).
9188
9189 In the worst case, we're still guaranteed to donate N cells in roughly log N time.
9190
9191 This change also fixes cases where we used to donate too little, since
9192 we would always keep a fixed minimum number of cells. In the worst case,
9193 with N marking threads, would could have N large object graph roots in
9194 our stack for the duration of GC, and scale to only 1 thread.
9195
9196 It's an interesting observation that a single object in the mark stack
9197 might represent an arbitrarily large object graph -- and only the act
9198 of marking can find out.
9199
9200 (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
9201 threads. Once again, this fixes cases where constants could cause us
9202 to steal too much or too little.
9203
9204 (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
9205 if they're idle. We can afford to do this because we're conservative
9206 about when we donate.
9207
9208 (JSC::SlotVisitor::drainFromShared):
9209 * heap/MarkStack.h:
9210 (MarkStackSegmentAllocator):
9211 (MarkStackArray):
9212 (JSC):
9213 * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
9214 single function, for simplicity.
9215
9216 * runtime/Options.cpp:
9217 (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
9218 a lot. We can afford to do this because, in the common case, donation is
9219 a single branch that decides not to donate.
9220
9221 (cpusToUse): Use more CPUs now, since we scale better now.
9222
9223 * runtime/Options.h:
9224 (Options): Removed now-unused variables.
9225
fpizlo@apple.com53ef1042012-06-13 01:29:07 +0000[diff] [blame]92262012-06-12 Filip Pizlo <fpizlo@apple.com>
9227
9228 REGRESSION(120121): inspector tests crash in DFG
9229 https://bugs.webkit.org/show_bug.cgi?id=88941
9230
9231 Reviewed by Geoffrey Garen.
9232
9233 The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
9234 already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
9235 is that the second way depends on the node referring to other nodes in the to-be-jettisoned
9236 block. After fixup they potentially will refer to nodes in the block being merged to.
9237
9238 * dfg/DFGCFGSimplificationPhase.cpp:
9239 (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
9240 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
9241
leo.yang@torchmobile.com.cneac79cd2012-06-13 00:23:49 +0000[diff] [blame]92422012-06-12 Leo Yang <leo.yang@torchmobile.com.cn>
9243
9244 Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
9245 https://bugs.webkit.org/show_bug.cgi?id=87334
9246
9247 Reviewed by Geoffrey Garen.
9248
9249 Add a copy member function to JSC::HasTable. This function will copy all data
9250 members except for *table* which contains thread specific data that prevents
9251 up copying it. When you want to copy a JSC::HashTable that was constructed
9252 on another thread you should call JSC::HashTable::copy().
9253
9254 * runtime/Lookup.h:
9255 (JSC::HashTable::copy):
9256 (HashTable):
9257
fpizlo@apple.comdfd92802012-06-12 21:15:43 +0000[diff] [blame]92582012-06-12 Filip Pizlo <fpizlo@apple.com>
9259
fpizlo@apple.com888325a2012-06-12 23:16:51 +0000[diff] [blame]9260 DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
9261 until after CFG simplification
9262 https://bugs.webkit.org/show_bug.cgi?id=88927
9263 <rdar://problem/11513971>
9264
9265 Reviewed by Geoffrey Garen.
9266
9267 Speculation fixup needs to run if simplification did things, because simplification can change
9268 predictions - particularly if you had a control flow path that stored weird things into a
9269 variable, but that path got axed by the simplifier.
9270
9271 Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
9272 one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
9273
9274 * dfg/DFGDriver.cpp:
9275 (JSC::DFG::compile):
9276 * dfg/DFGFixupPhase.cpp:
9277 (JSC::DFG::FixupPhase::fixupNode):
9278
92792012-06-12 Filip Pizlo <fpizlo@apple.com>
9280
fpizlo@apple.comdfd92802012-06-12 21:15:43 +0000[diff] [blame]9281 REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
9282 https://bugs.webkit.org/show_bug.cgi?id=88783
9283 <rdar://problem/11640299>
9284
9285 Reviewed by Geoffrey Garen.
9286
9287 If you don't keep alive the base of an object access over the various checks
9288 you do for the prototype chain, you're going to have a bad time.
9289
9290 * dfg/DFGByteCodeParser.cpp:
9291 (JSC::DFG::ByteCodeParser::handleGetById):
9292
commit-queue@webkit.orgce7e7ef2012-06-12 07:08:14 +0000[diff] [blame]92932012-06-12 Hojong Han <hojong.han@samsung.com>
9294
9295 Property names of the built-in object cannot be retrieved
9296 after trying to delete one of its properties
9297 https://bugs.webkit.org/show_bug.cgi?id=86461
9298
9299 Reviewed by Gavin Barraclough.
9300
9301 * runtime/JSObject.cpp:
9302 (JSC::getClassPropertyNames):
9303 (JSC::JSObject::getOwnPropertyNames):
9304
gyuyoung.kim@samsung.com7a201592012-06-12 00:58:24 +0000[diff] [blame]93052012-06-11 Gyuyoung Kim <gyuyoung.kim@samsung.com>
9306
9307 [CMAKE][EFL] Remove duplicated executable output path
9308 https://bugs.webkit.org/show_bug.cgi?id=88765
9309
9310 Reviewed by Daniel Bates.
9311
9312 CMake files for EFL port have redefined executable output path. However, EFL port doesn't
9313 need to define again because it is already defined in top-level CMake file.
9314
9315 * shell/CMakeLists.txt:
9316
carlosgc@webkit.orgf4fbe002012-06-11 15:31:19 +0000[diff] [blame]93172012-06-11 Carlos Garcia Campos <cgarcia@igalia.com>
9318
9319 Unreviewed. Fix make distcheck issues.
9320
9321 * GNUmakefile.list.am: Remove non existent header file.
9322
paroga@webkit.org7a01e282012-06-10 12:25:57 +0000[diff] [blame]93232012-06-10 Patrick Gansterer <paroga@webkit.org>
9324
paroga@webkit.orga601a8b2012-06-10 12:49:32 +0000[diff] [blame]9325 Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
9326
9327 * runtime/Executable.h:
9328 (ExecutableBase):
9329 (JSC::ExecutableBase::clearCodeVirtual):
9330
93312012-06-10 Patrick Gansterer <paroga@webkit.org>
9332
paroga@webkit.org7a01e282012-06-10 12:25:57 +0000[diff] [blame]9333 Unreviewed. Build fix for !ENABLE(JIT) after r119844.
9334
9335 * runtime/Executable.h:
9336 (ExecutableBase):
9337 (JSC):
9338
dominicc@chromium.org2a95e332012-06-10 06:31:14 +0000[diff] [blame]93392012-06-09 Dominic Cooney <dominicc@chromium.org>
9340
9341 [Chromium] Remove JavaScriptCore dependencies from gyp
9342 https://bugs.webkit.org/show_bug.cgi?id=88510
9343
9344 Reviewed by Adam Barth.
9345
9346 Chromium doesn't support JSC any more and there doesn't seem to be
9347 a strong interest in using GYP as the common build system in other
9348 ports.
9349
9350 * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
9351 * JavaScriptCore.gypi: Only include YARR source.
9352 * gyp/JavaScriptCore.gyp: Removed.
9353 * gyp/gtk.gyp: Removed.
9354
ggaren@apple.com642da3e2012-06-09 17:34:30 +0000[diff] [blame]93552012-06-09 Geoffrey Garen <ggaren@apple.com>
9356
9357 Unreviewed, rolling back in part2 of r118646.
9358
9359 This patch removes eager finalization.
9360
9361 Weak pointer finalization should be lazy
9362 https://bugs.webkit.org/show_bug.cgi?id=87599
9363
9364 Reviewed by Sam Weinig.
9365
9366 * heap/Heap.cpp:
9367 (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
9368
9369 * heap/MarkedBlock.cpp:
9370 (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
9371 since we won't get another chance.
9372
9373 * heap/MarkedBlock.h:
9374 (JSC::MarkedBlock::sweepWeakSet):
9375 * heap/MarkedSpace.cpp:
9376 (MarkedSpace::WeakSetSweep):
9377 * heap/MarkedSpace.h:
9378 (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
9379
commit-queue@webkit.org5deb7492012-06-09 09:05:22 +0000[diff] [blame]93802012-06-09 Sukolsak Sakshuwong <sukolsak@google.com>
9381
9382 Add UNDO_MANAGER flag
9383 https://bugs.webkit.org/show_bug.cgi?id=87908
9384
9385 Reviewed by Tony Chang.
9386
9387 * Configurations/FeatureDefines.xcconfig:
9388
ggaren@apple.com642da3e2012-06-09 17:34:30 +0000[diff] [blame]93892012-06-08 Geoffrey Garen <ggaren@apple.com>
ggaren@apple.com218a16a2012-06-08 23:57:58 +0000[diff] [blame]9390
9391 Unreviewed, rolling back in part1 of r118646.
9392
9393 This patch includes everything necessary for lazy finalization, but
9394 keeps eager finalization enabled for the time being.
9395
9396 Weak pointer finalization should be lazy
9397 https://bugs.webkit.org/show_bug.cgi?id=87599
9398
9399 Reviewed by Sam Weinig.
9400
9401 * heap/MarkedBlock.cpp:
9402 * heap/MarkedBlock.h:
9403 (JSC::MarkedBlock::resetAllocator):
9404 * heap/MarkedSpace.cpp:
9405 (JSC::MarkedSpace::resetAllocators):
9406 * heap/MarkedSpace.h:
9407 (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
9408 It will happen automatically when a weak set is swept. It's simpler to
9409 have only one canonical way for this to happen, and it wasn't buying
9410 us anything to do it eagerly.
9411 * heap/WeakBlock.cpp:
9412 (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
9413 the sweep would be a no-op. If even one finalizer is pending, we need to
9414 run it, since we won't get another chance.
9415 * heap/WeakSet.cpp:
9416 (JSC::WeakSet::sweep): This loop can be simpler now that
9417 WeakBlock::sweep() does what we mean.
9418 Reset our allocator after a sweep because this is the optimal time to
9419 start trying to recycle old weak pointers.
9420 (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
9421 allocator because we've swept already, and forcing a new sweep would be
9422 wasteful.
9423 * heap/WeakSet.h:
9424 (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
9425 because the shrink may have removed the block the allocator was going to
9426 allocate out of.
9427
barraclough@apple.com9dd771c2012-06-08 21:30:35 +0000[diff] [blame]94282012-06-08 Gavin Barraclough <barraclough@apple.com>
9429
9430 Unreviewed roll out r119795.
9431
9432 This broke jquery/core.html
9433
9434 * dfg/DFGSpeculativeJIT.h:
9435 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
9436 * jit/JITInlineMethods.h:
9437 (JSC::JIT::emitAllocateBasicJSObject):
9438 * llint/LowLevelInterpreter.asm:
9439 * runtime/JSGlobalData.h:
9440 (JSGlobalData):
9441 * runtime/JSGlobalThis.cpp:
9442 (JSC::JSGlobalThis::setUnwrappedObject):
9443 * runtime/JSObject.cpp:
9444 (JSC::JSObject::visitChildren):
9445 (JSC::JSObject::createInheritorID):
9446 * runtime/JSObject.h:
9447 (JSObject):
9448 (JSC::JSObject::resetInheritorID):
9449 (JSC):
9450 (JSC::JSObject::offsetOfInheritorID):
9451 (JSC::JSObject::inheritorID):
9452
fpizlo@apple.com0bcbc112012-06-08 20:02:57 +0000[diff] [blame]94532012-06-08 Filip Pizlo <fpizlo@apple.com>
9454
9455 PredictedType should be called SpeculatedType
9456 https://bugs.webkit.org/show_bug.cgi?id=88477
9457
9458 Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
9459 I accidentally renamed ByteCodeParser::getPrediction to
9460 ByteCodeParser::getSpeculation. That was not the intent. This changes it
9461 back.
9462
9463 * dfg/DFGByteCodeParser.cpp:
9464 (JSC::DFG::ByteCodeParser::addCall):
9465 (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
9466 (JSC::DFG::ByteCodeParser::getPrediction):
9467 (JSC::DFG::ByteCodeParser::handleCall):
9468 (JSC::DFG::ByteCodeParser::parseBlock):
9469
wingo@igalia.com332e9bf2012-06-08 19:57:40 +0000[diff] [blame]94702012-06-08 Andy Wingo <wingo@igalia.com>
9471
9472 Explictly mark stubs called by JIT as being internal
9473 https://bugs.webkit.org/show_bug.cgi?id=88552
9474
9475 Reviewed by Filip Pizlo.
9476
9477 * dfg/DFGOSRExitCompiler.h:
9478 * dfg/DFGOperations.cpp:
9479 * dfg/DFGOperations.h:
9480 * jit/HostCallReturnValue.h:
9481 * jit/JITStubs.cpp:
9482 * jit/JITStubs.h:
9483 * jit/ThunkGenerators.cpp:
9484 * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
9485 WTF_INTERNAL. Change most calls to SYMBOL_STRING_RELOCATION to
9486 LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
9487 to truly global symbols.
9488 * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
9489 SYMBOL_STRING_RELOCATION.
9490
fpizlo@apple.comf4a2ac32012-06-08 20:04:47 +0000[diff] [blame]94912012-06-08 Geoffrey Garen <ggaren@apple.com>
9492
ggaren@apple.comd7147572012-06-08 18:17:16 +0000[diff] [blame]9493 Don't rely on weak pointers for eager CodeBlock finalization
9494 https://bugs.webkit.org/show_bug.cgi?id=88465
9495
9496 Reviewed by Gavin Barraclough.
9497
9498 This is incompatible with lazy weak pointer finalization.
9499
9500 I considered just making CodeBlock finalization lazy-friendly, but it
9501 turns out that the heap is already way up in CodeBlock's business when
9502 it comes to finalization, so I decided to finish the job and move full
9503 responsibility for CodeBlock finalization into the heap.
9504
9505 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
9506 will build.
9507
9508 * debugger/Debugger.cpp: Updated for rename.
9509
9510 * heap/Heap.cpp:
9511 (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
9512 where we would not delete code for a code block that had been previously
9513 jettisoned. I don't know if this happens in practice -- I mostly did
9514 this to improve consistency with deleteUnmarkedCompiledCode.
9515
9516 (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
9517 eager finalization of unmarked code blocks.
9518
9519 (JSC::Heap::collect): Updated for rename. Updated to call
9520 deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
9521 blocks too.
9522
9523 (JSC::Heap::addCompiledCode): Renamed, since this points to all code
9524 now, not just functions.
9525
9526 * heap/Heap.h:
9527 (Heap): Keep track of all user code, not just functions. This is a
9528 negligible additional overhead, since most code is function code.
9529
9530 * runtime/Executable.cpp:
9531 (JSC::*::finalize): Removed these functions, since we don't rely on
9532 weak pointer finalization anymore.
9533
9534 (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
9535 into base class so all executables can be in the list.
9536
9537 (JSC::EvalExecutable::clearCode):
9538 (JSC::ProgramExecutable::clearCode):
9539 (JSC::FunctionExecutable::clearCode): All we need to do is delete our
9540 CodeBlock -- that will delete all of its internal data structures.
9541
9542 (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
9543 function to improve clarity.
9544
9545 * runtime/Executable.h:
9546 (JSC::ExecutableBase): Moved linked-list stuff
9547 into base class so all executables can be in the list.
9548
9549 (JSC::NativeExecutable::create):
9550 (NativeExecutable):
9551 (ScriptExecutable):
9552 (JSC::ScriptExecutable::finishCreation):
9553 (JSC::EvalExecutable::create):
9554 (EvalExecutable):
9555 (JSC::ProgramExecutable::create):
9556 (ProgramExecutable):
9557 (FunctionExecutable):
9558 (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
9559 will call us back to destroy our code block.
9560
9561 (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
9562 for clarity.
9563
9564 (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
9565
9566 (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
9567 the heap needs to make polymorphic calls to clear code.
9568
9569 * runtime/JSGlobalData.cpp:
9570 (JSC::StackPreservingRecompiler::operator()):
9571 * runtime/JSGlobalObject.cpp:
9572 (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
9573 renames.
9574
fpizlo@apple.comfd598b92012-06-08 01:31:21 +0000[diff] [blame]95752012-06-07 Filip Pizlo <fpizlo@apple.com>
9576
9577 DFG should inline prototype chain accesses, and do the right things if the
9578 specific function optimization is available
9579 https://bugs.webkit.org/show_bug.cgi?id=88594
9580
9581 Reviewed by Gavin Barraclough.
9582
9583 Looks like a 3% win on V8.
9584
9585 * bytecode/CodeBlock.h:
9586 (JSC::Structure::prototypeForLookup):
9587 (JSC):
9588 * bytecode/GetByIdStatus.cpp:
9589 (JSC::GetByIdStatus::computeFromLLInt):
9590 (JSC):
9591 (JSC::GetByIdStatus::computeForChain):
9592 (JSC::GetByIdStatus::computeFor):
9593 * bytecode/GetByIdStatus.h:
9594 (JSC::GetByIdStatus::GetByIdStatus):
9595 (JSC::GetByIdStatus::isSimple):
9596 (JSC::GetByIdStatus::chain):
9597 (JSC::GetByIdStatus::specificValue):
9598 (GetByIdStatus):
9599 * bytecode/StructureSet.h:
9600 (StructureSet):
9601 (JSC::StructureSet::singletonStructure):
9602 * bytecode/StructureStubInfo.h:
9603 (JSC::StructureStubInfo::initGetByIdProto):
9604 (JSC::StructureStubInfo::initGetByIdChain):
9605 * dfg/DFGByteCodeParser.cpp:
9606 (JSC::DFG::ByteCodeParser::handleGetById):
9607 * dfg/DFGRepatch.cpp:
9608 (JSC::DFG::tryCacheGetByID):
9609 * jit/JITStubs.cpp:
9610 (JSC::JITThunks::tryCacheGetByID):
9611 * runtime/JSGlobalObject.h:
9612 (JSC::Structure::prototypeForLookup):
9613 (JSC):
9614 * runtime/Structure.h:
9615 (Structure):
9616
barraclough@apple.com48386932012-06-08 00:29:27 +0000[diff] [blame]96172012-06-07 Gavin Barraclough <barraclough@apple.com>
9618
barraclough@apple.com64b74e02012-06-08 04:25:58 +0000[diff] [blame]9619 Remove JSObject::m_inheritorID
9620 https://bugs.webkit.org/show_bug.cgi?id=88378
9621
9622 Reviewed by Geoff Garen.
9623
9624 This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
9625 and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
9626 Instead use a private named value in the object's property storage.
9627
9628 * dfg/DFGSpeculativeJIT.h:
9629 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
9630 - No need m_inheritorID to initialize!
9631 * jit/JITInlineMethods.h:
9632 (JSC::JIT::emitAllocateBasicJSObject):
9633 - No need m_inheritorID to initialize!
9634 * llint/LowLevelInterpreter.asm:
9635 - No need m_inheritorID to initialize!
9636 * runtime/JSGlobalData.h:
9637 (JSGlobalData):
9638 - Added private name 'm_inheritorIDKey'.
9639 * runtime/JSGlobalThis.cpp:
9640 (JSC::JSGlobalThis::setUnwrappedObject):
9641 - resetInheritorID is now passed a JSGlobalData&.
9642 * runtime/JSObject.cpp:
9643 (JSC::JSObject::visitChildren):
9644 - No m_inheritorID to be marked.
9645 (JSC::JSObject::createInheritorID):
9646 - Store the newly created inheritorID in the property map.
9647 * runtime/JSObject.h:
9648 (JSC::JSObject::resetInheritorID):
9649 - Remove the inheritorID from property storage.
9650 (JSC::JSObject::inheritorID):
9651 - Read the inheritorID from property storage.
9652
96532012-06-07 Gavin Barraclough <barraclough@apple.com>
9654
barraclough@apple.com48386932012-06-08 00:29:27 +0000[diff] [blame]9655 Math.pow on iOS does not support denormal numbers.
9656 https://bugs.webkit.org/show_bug.cgi?id=88592
9657
9658 Reviewed by Filip Pizlo.
9659
9660 Import an implementation from fdlibm, detect cases where it is safe to use the system
9661 implementation & where we should fall back to fdlibm.
9662
9663 * runtime/MathObject.cpp:
9664 (JSC::isDenormal):
9665 (JSC::isEdgeCase):
9666 (JSC::mathPow):
9667 - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
9668 (JSC::mathProtoFuncPow):
9669 - Changed to use mathPow.
9670 (JSC::fdlibmScalbn):
9671 (JSC::fdlibmPow):
9672 - These functions imported from fdlibm; original style retained to ease future merging.
9673
paroga@webkit.orga334f732012-06-07 23:24:14 +0000[diff] [blame]96742012-06-07 Patrick Gansterer <paroga@webkit.org>
9675
9676 Unreviewed. Build fix for !ENABLE(JIT) after r119441.
9677
9678 * interpreter/Interpreter.cpp:
9679 (JSC::Interpreter::privateExecute):
9680
wingo@igalia.comb8305a82012-06-07 16:05:19 +0000[diff] [blame]96812012-06-07 Andy Wingo <wingo@igalia.com>
9682
9683 Unreviewed build fix after r119593.
9684
9685 * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
9686 uses of "name" to be "label", the macro's parameter. Otherwise we
9687 serialize mentions of the literal symbol "name" into the objcode.
9688 Causes a build error using GNU ld (not gold).
9689
rniwa@webkit.org475cf8d2012-06-07 02:47:14 +0000[diff] [blame]96902012-06-06 Ryosuke Niwa <rniwa@webkit.org>
9691
9692 Chromium build fix attempt. Why do we need to list these files in gyp!?
9693
9694 * JavaScriptCore.gypi:
9695
fpizlo@apple.comd5547492012-06-07 00:23:36 +0000[diff] [blame]96962012-06-06 Filip Pizlo <fpizlo@apple.com>
9697
fpizlo@apple.com62336162012-06-07 01:35:59 +0000[diff] [blame]9698 PredictedType should be called SpeculatedType
9699 https://bugs.webkit.org/show_bug.cgi?id=88477
9700
9701 Rubber stamped by Gavin Barraclough.
9702
9703 * CMakeLists.txt:
9704 * GNUmakefile.list.am:
9705 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
9706 * JavaScriptCore.xcodeproj/project.pbxproj:
9707 * Target.pri:
9708 * bytecode/CodeBlock.cpp:
9709 (JSC::CodeBlock::shouldOptimizeNow):
9710 (JSC::CodeBlock::dumpValueProfiles):
9711 * bytecode/CodeBlock.h:
9712 (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
9713 * bytecode/LazyOperandValueProfile.cpp:
9714 (JSC::LazyOperandValueProfileParser::prediction):
9715 * bytecode/LazyOperandValueProfile.h:
9716 (LazyOperandValueProfileParser):
9717 * bytecode/PredictedType.cpp: Removed.
9718 * bytecode/PredictedType.h: Removed.
9719 * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
9720 (JSC::speculationToString):
9721 (JSC::speculationToAbbreviatedString):
9722 (JSC::speculationFromClassInfo):
9723 (JSC::speculationFromStructure):
9724 (JSC::speculationFromCell):
9725 (JSC::speculationFromValue):
9726 * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
9727 (JSC):
9728 (JSC::isAnySpeculation):
9729 (JSC::isCellSpeculation):
9730 (JSC::isObjectSpeculation):
9731 (JSC::isFinalObjectSpeculation):
9732 (JSC::isFinalObjectOrOtherSpeculation):
9733 (JSC::isFixedIndexedStorageObjectSpeculation):
9734 (JSC::isStringSpeculation):
9735 (JSC::isArraySpeculation):
9736 (JSC::isFunctionSpeculation):
9737 (JSC::isInt8ArraySpeculation):
9738 (JSC::isInt16ArraySpeculation):
9739 (JSC::isInt32ArraySpeculation):
9740 (JSC::isUint8ArraySpeculation):
9741 (JSC::isUint8ClampedArraySpeculation):
9742 (JSC::isUint16ArraySpeculation):
9743 (JSC::isUint32ArraySpeculation):
9744 (JSC::isFloat32ArraySpeculation):
9745 (JSC::isFloat64ArraySpeculation):
9746 (JSC::isArgumentsSpeculation):
9747 (JSC::isActionableIntMutableArraySpeculation):
9748 (JSC::isActionableFloatMutableArraySpeculation):
9749 (JSC::isActionableTypedMutableArraySpeculation):
9750 (JSC::isActionableMutableArraySpeculation):
9751 (JSC::isActionableArraySpeculation):
9752 (JSC::isArrayOrOtherSpeculation):
9753 (JSC::isMyArgumentsSpeculation):
9754 (JSC::isInt32Speculation):
9755 (JSC::isDoubleRealSpeculation):
9756 (JSC::isDoubleSpeculation):
9757 (JSC::isNumberSpeculation):
9758 (JSC::isBooleanSpeculation):
9759 (JSC::isOtherSpeculation):
9760 (JSC::isEmptySpeculation):
9761 (JSC::mergeSpeculations):
9762 (JSC::mergeSpeculation):
9763 * bytecode/StructureSet.h:
9764 (JSC::StructureSet::speculationFromStructures):
9765 * bytecode/ValueProfile.h:
9766 (JSC::ValueProfileBase::ValueProfileBase):
9767 (JSC::ValueProfileBase::dump):
9768 (JSC::ValueProfileBase::computeUpdatedPrediction):
9769 (ValueProfileBase):
9770 * dfg/DFGAbstractState.cpp:
9771 (JSC::DFG::AbstractState::initialize):
9772 (JSC::DFG::AbstractState::execute):
9773 (JSC::DFG::AbstractState::mergeStateAtTail):
9774 * dfg/DFGAbstractState.h:
9775 (JSC::DFG::AbstractState::speculateInt32Unary):
9776 (JSC::DFG::AbstractState::speculateNumberUnary):
9777 (JSC::DFG::AbstractState::speculateBooleanUnary):
9778 (JSC::DFG::AbstractState::speculateInt32Binary):
9779 (JSC::DFG::AbstractState::speculateNumberBinary):
9780 * dfg/DFGAbstractValue.h:
9781 (JSC::DFG::StructureAbstractValue::filter):
9782 (JSC::DFG::StructureAbstractValue::speculationFromStructures):
9783 (JSC::DFG::AbstractValue::AbstractValue):
9784 (JSC::DFG::AbstractValue::clear):
9785 (JSC::DFG::AbstractValue::isClear):
9786 (JSC::DFG::AbstractValue::makeTop):
9787 (JSC::DFG::AbstractValue::clobberStructures):
9788 (JSC::DFG::AbstractValue::isTop):
9789 (JSC::DFG::AbstractValue::set):
9790 (JSC::DFG::AbstractValue::merge):
9791 (JSC::DFG::AbstractValue::filter):
9792 (JSC::DFG::AbstractValue::validateIgnoringValue):
9793 (JSC::DFG::AbstractValue::validate):
9794 (JSC::DFG::AbstractValue::checkConsistency):
9795 (JSC::DFG::AbstractValue::dump):
9796 (AbstractValue):
9797 * dfg/DFGArgumentPosition.h:
9798 (JSC::DFG::ArgumentPosition::ArgumentPosition):
9799 (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
9800 (JSC::DFG::ArgumentPosition::prediction):
9801 (ArgumentPosition):
9802 * dfg/DFGArgumentsSimplificationPhase.cpp:
9803 (JSC::DFG::ArgumentsSimplificationPhase::run):
9804 * dfg/DFGByteCodeParser.cpp:
9805 (ByteCodeParser):
9806 (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
9807 (JSC::DFG::ByteCodeParser::getLocal):
9808 (JSC::DFG::ByteCodeParser::getArgument):
9809 (JSC::DFG::ByteCodeParser::addCall):
9810 (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
9811 (JSC::DFG::ByteCodeParser::getSpeculation):
9812 (InlineStackEntry):
9813 (JSC::DFG::ByteCodeParser::handleCall):
9814 (JSC::DFG::ByteCodeParser::handleIntrinsic):
9815 (JSC::DFG::ByteCodeParser::handleGetById):
9816 (JSC::DFG::ByteCodeParser::parseBlock):
9817 (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
9818 (JSC::DFG::ByteCodeParser::parse):
9819 * dfg/DFGCSEPhase.cpp:
9820 (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
9821 (JSC::DFG::CSEPhase::performNodeCSE):
9822 * dfg/DFGConstantFoldingPhase.cpp:
9823 (JSC::DFG::ConstantFoldingPhase::run):
9824 * dfg/DFGFixupPhase.cpp:
9825 (JSC::DFG::FixupPhase::fixupNode):
9826 (JSC::DFG::FixupPhase::fixDoubleEdge):
9827 * dfg/DFGGraph.cpp:
9828 (JSC::DFG::Graph::nameOfVariableAccessData):
9829 (JSC::DFG::Graph::dump):
9830 (JSC::DFG::Graph::predictArgumentTypes):
9831 * dfg/DFGGraph.h:
9832 (JSC::DFG::Graph::getJSConstantSpeculation):
9833 (JSC::DFG::Graph::isPredictedNumerical):
9834 (JSC::DFG::Graph::byValIsPure):
9835 * dfg/DFGJITCompiler.h:
9836 (JSC::DFG::JITCompiler::getSpeculation):
9837 * dfg/DFGNode.h:
9838 (JSC::DFG::Node::Node):
9839 (JSC::DFG::Node::getHeapPrediction):
9840 (JSC::DFG::Node::predictHeap):
9841 (JSC::DFG::Node::prediction):
9842 (JSC::DFG::Node::predict):
9843 (JSC::DFG::Node::shouldSpeculateInteger):
9844 (JSC::DFG::Node::shouldSpeculateDouble):
9845 (JSC::DFG::Node::shouldSpeculateNumber):
9846 (JSC::DFG::Node::shouldSpeculateBoolean):
9847 (JSC::DFG::Node::shouldSpeculateFinalObject):
9848 (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
9849 (JSC::DFG::Node::shouldSpeculateArray):
9850 (JSC::DFG::Node::shouldSpeculateArguments):
9851 (JSC::DFG::Node::shouldSpeculateInt8Array):
9852 (JSC::DFG::Node::shouldSpeculateInt16Array):
9853 (JSC::DFG::Node::shouldSpeculateInt32Array):
9854 (JSC::DFG::Node::shouldSpeculateUint8Array):
9855 (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
9856 (JSC::DFG::Node::shouldSpeculateUint16Array):
9857 (JSC::DFG::Node::shouldSpeculateUint32Array):
9858 (JSC::DFG::Node::shouldSpeculateFloat32Array):
9859 (JSC::DFG::Node::shouldSpeculateFloat64Array):
9860 (JSC::DFG::Node::shouldSpeculateArrayOrOther):
9861 (JSC::DFG::Node::shouldSpeculateObject):
9862 (JSC::DFG::Node::shouldSpeculateCell):
9863 (Node):
9864 * dfg/DFGPredictionPropagationPhase.cpp:
9865 (JSC::DFG::PredictionPropagationPhase::setPrediction):
9866 (JSC::DFG::PredictionPropagationPhase::mergePrediction):
9867 (JSC::DFG::PredictionPropagationPhase::propagate):
9868 (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
9869 * dfg/DFGSpeculativeJIT.cpp:
9870 (JSC::DFG::SpeculativeJIT::fillStorage):
9871 (JSC::DFG::SpeculativeJIT::writeBarrier):
9872 (JSC::DFG::GPRTemporary::GPRTemporary):
9873 (JSC::DFG::FPRTemporary::FPRTemporary):
9874 (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
9875 (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
9876 (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
9877 (JSC::DFG::SpeculativeJIT::compile):
9878 (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
9879 (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
9880 (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
9881 (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9882 (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
9883 (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
9884 (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
9885 (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
9886 (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
9887 (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
9888 (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
9889 (JSC::DFG::SpeculativeJIT::compileInstanceOf):
9890 (JSC::DFG::SpeculativeJIT::compileAdd):
9891 (JSC::DFG::SpeculativeJIT::compileArithSub):
9892 (JSC::DFG::SpeculativeJIT::compileArithNegate):
9893 (JSC::DFG::SpeculativeJIT::compileArithMul):
9894 (JSC::DFG::SpeculativeJIT::compileArithMod):
9895 (JSC::DFG::SpeculativeJIT::compare):
9896 (JSC::DFG::SpeculativeJIT::compileStrictEq):
9897 (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
9898 (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
9899 (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
9900 (JSC::DFG::SpeculativeJIT::compileRegExpExec):
9901 * dfg/DFGSpeculativeJIT.h:
9902 (DFG):
9903 (JSC::DFG::ValueSource::forSpeculation):
9904 (SpeculativeJIT):
9905 (GPRTemporary):
9906 (FPRTemporary):
9907 (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
9908 (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
9909 (JSC::DFG::SpecDoubleOperand::fpr):
9910 (JSC::DFG::SpecCellOperand::SpecCellOperand):
9911 (JSC::DFG::SpecCellOperand::~SpecCellOperand):
9912 (JSC::DFG::SpecCellOperand::gpr):
9913 (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
9914 (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
9915 (JSC::DFG::SpecBooleanOperand::gpr):
9916 * dfg/DFGSpeculativeJIT32_64.cpp:
9917 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9918 (JSC::DFG::SpeculativeJIT::fillSpecDouble):
9919 (JSC::DFG::SpeculativeJIT::fillSpecCell):
9920 (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
9921 (JSC::DFG::SpeculativeJIT::compileObjectEquality):
9922 (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
9923 (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
9924 (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
9925 (JSC::DFG::SpeculativeJIT::compileLogicalNot):
9926 (JSC::DFG::SpeculativeJIT::emitBranch):
9927 (JSC::DFG::SpeculativeJIT::compile):
9928 * dfg/DFGSpeculativeJIT64.cpp:
9929 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9930 (JSC::DFG::SpeculativeJIT::fillSpecDouble):
9931 (JSC::DFG::SpeculativeJIT::fillSpecCell):
9932 (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
9933 (JSC::DFG::SpeculativeJIT::compileObjectEquality):
9934 (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
9935 (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
9936 (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
9937 (JSC::DFG::SpeculativeJIT::compileLogicalNot):
9938 (JSC::DFG::SpeculativeJIT::emitBranch):
9939 (JSC::DFG::SpeculativeJIT::compile):
9940 * dfg/DFGVariableAccessData.h:
9941 (JSC::DFG::VariableAccessData::VariableAccessData):
9942 (JSC::DFG::VariableAccessData::predict):
9943 (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
9944 (JSC::DFG::VariableAccessData::prediction):
9945 (JSC::DFG::VariableAccessData::argumentAwarePrediction):
9946 (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
9947 (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
9948 (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
9949 (VariableAccessData):
9950
99512012-06-06 Filip Pizlo <fpizlo@apple.com>
9952
fpizlo@apple.com26af9b62012-06-07 00:49:34 +0000[diff] [blame]9953 Global object variable accesses should not require an extra load
9954 https://bugs.webkit.org/show_bug.cgi?id=88385
9955
9956 Reviewed by Gavin Barraclough and Geoffrey Garen.
9957
9958 Previously, if you wanted to access a global variable, you'd first have
9959 to load the register array from the appropriate global object and then
9960 either load or store at an offset to the register array. This is because
9961 JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
9962 designed with the pessimistic assumption that its register array may
9963 point into the call stack. This is never the case for global objects.
9964 Hence, even though the global object may add more registers at any time,
9965 it does not need to store them in a contiguous array. It can use a
9966 SegmentedVector or similar.
9967
9968 This patch refactors global objects and variable objects as follows:
9969
9970 - The functionality to track variables in an indexable array using a
9971 SymbolTable to map names to indices is moved into JSSymbolTableObject,
9972 which is now a supertype of JSVariableObject. JSVariableObject is now
9973 just a holder for a registers array and implements the registerAt()
9974 method that is left abstract in JSSymbolTableObject. Because all users
9975 of JSVariableObject know whether they are a JSStaticScopeObject,
9976 JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
9977 instead the utility methods that would call registerAt() are now
9978 template functions that require you to know statically what subtype of
9979 JSSymbolTableObject you're using (JSVariableObject or something else),
9980 so that registerAt() can be statically bound.
9981
9982 - A new class is added called JSSegmentedVariableObject, which only
9983 differs from JSVariableObject in how it allocates registers. It uses a
9984 SegmentedVector instead of manually managing a pointer to a contiguous
9985 slab of registers. This changes the interface somewhat; for example
9986 with JSVariableObject if you wanted to add a register you had to do
9987 it yourself since the JSVariableObject didn't know how the registers
9988 array ought to be allocated. With JSSegmentedVariableObject you can
9989 just call addRegisters(). JSSegmentedVariableObject preserves the
9990 invariant that once you get a pointer into a register, that pointer
9991 will continue to be valid so long as the JSSegmentedVariableObject is
9992 alive. This allows the JITs and interpreters to skip the extra load.
9993
9994 - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
9995 (and possibly forever) it is the only subtype of this new class.
9996
9997 - The bytecode format is changed so that get_global_var and
9998 put_global_var have a pointer to the register directly rather than
9999 having an index. A convenience method is provided in
10000 JSSegmentedVariableObject to get the index given a a pointer, which is
10001 used for assertions and debug dumps.
10002
10003 This appears to be a 1% across the board win.
10004
10005 * CMakeLists.txt:
10006 * GNUmakefile.list.am:
10007 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
10008 * JavaScriptCore.xcodeproj/project.pbxproj:
10009 * Target.pri:
10010 * bytecode/CodeBlock.cpp:
10011 (JSC::CodeBlock::dump):
10012 * bytecode/Instruction.h:
10013 (Instruction):
10014 (JSC::Instruction::Instruction):
10015 * bytecompiler/BytecodeGenerator.cpp:
10016 (JSC::ResolveResult::registerPointer):
10017 (JSC):
10018 (JSC::BytecodeGenerator::BytecodeGenerator):
10019 (JSC::BytecodeGenerator::retrieveLastUnaryOp):
10020 (JSC::BytecodeGenerator::resolve):
10021 (JSC::BytecodeGenerator::resolveConstDecl):
10022 (JSC::BytecodeGenerator::emitGetStaticVar):
10023 (JSC::BytecodeGenerator::emitPutStaticVar):
10024 * bytecompiler/BytecodeGenerator.h:
10025 (ResolveResult):
10026 (BytecodeGenerator):
10027 * dfg/DFGAssemblyHelpers.h:
10028 (AssemblyHelpers):
10029 * dfg/DFGByteCodeParser.cpp:
10030 (JSC::DFG::ByteCodeParser::parseBlock):
10031 * dfg/DFGCSEPhase.cpp:
10032 (JSC::DFG::CSEPhase::globalVarLoadElimination):
10033 (JSC::DFG::CSEPhase::globalVarStoreElimination):
10034 (JSC::DFG::CSEPhase::performNodeCSE):
10035 * dfg/DFGGraph.cpp:
10036 (JSC::DFG::Graph::dump):
10037 * dfg/DFGGraph.h:
10038 (JSC::DFG::Graph::globalObjectFor):
10039 (Graph):
10040 * dfg/DFGNode.h:
10041 (JSC::DFG::Node::hasVarNumber):
10042 (Node):
10043 (JSC::DFG::Node::hasRegisterPointer):
10044 (JSC::DFG::Node::registerPointer):
10045 * dfg/DFGSpeculativeJIT32_64.cpp:
10046 (JSC::DFG::SpeculativeJIT::compile):
10047 * dfg/DFGSpeculativeJIT64.cpp:
10048 (JSC::DFG::SpeculativeJIT::compile):
10049 * heap/Heap.h:
10050 (Heap):
10051 (JSC::Heap::isWriteBarrierEnabled):
10052 (JSC):
10053 * interpreter/Interpreter.cpp:
10054 (JSC::Interpreter::execute):
10055 (JSC::Interpreter::privateExecute):
10056 * jit/JITPropertyAccess.cpp:
10057 (JSC::JIT::emit_op_get_global_var):
10058 (JSC::JIT::emit_op_put_global_var):
10059 * jit/JITPropertyAccess32_64.cpp:
10060 (JSC::JIT::emit_op_get_global_var):
10061 (JSC::JIT::emit_op_put_global_var):
10062 * llint/LowLevelInterpreter32_64.asm:
10063 * llint/LowLevelInterpreter64.asm:
10064 * runtime/JSGlobalObject.cpp:
10065 (JSC):
10066 (JSC::JSGlobalObject::put):
10067 (JSC::JSGlobalObject::putDirectVirtual):
10068 (JSC::JSGlobalObject::defineOwnProperty):
10069 (JSC::JSGlobalObject::visitChildren):
10070 (JSC::JSGlobalObject::addStaticGlobals):
10071 (JSC::JSGlobalObject::getOwnPropertySlot):
10072 (JSC::JSGlobalObject::getOwnPropertyDescriptor):
10073 * runtime/JSGlobalObject.h:
10074 (JSGlobalObject):
10075 (JSC::JSGlobalObject::JSGlobalObject):
10076 (JSC):
10077 (JSC::JSGlobalObject::hasOwnPropertyForWrite):
10078 * runtime/JSSegmentedVariableObject.cpp: Added.
10079 (JSC):
10080 (JSC::JSSegmentedVariableObject::findRegisterIndex):
10081 (JSC::JSSegmentedVariableObject::addRegisters):
10082 (JSC::JSSegmentedVariableObject::visitChildren):
10083 * runtime/JSSegmentedVariableObject.h: Added.
10084 (JSC):
10085 (JSSegmentedVariableObject):
10086 (JSC::JSSegmentedVariableObject::registerAt):
10087 (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
10088 (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
10089 (JSC::JSSegmentedVariableObject::finishCreation):
10090 * runtime/JSStaticScopeObject.cpp:
10091 (JSC::JSStaticScopeObject::put):
10092 (JSC::JSStaticScopeObject::putDirectVirtual):
10093 (JSC::JSStaticScopeObject::getOwnPropertySlot):
10094 * runtime/JSSymbolTableObject.cpp: Added.
10095 (JSC):
10096 (JSC::JSSymbolTableObject::destroy):
10097 (JSC::JSSymbolTableObject::deleteProperty):
10098 (JSC::JSSymbolTableObject::getOwnPropertyNames):
10099 (JSC::JSSymbolTableObject::putDirectVirtual):
10100 (JSC::JSSymbolTableObject::isDynamicScope):
10101 * runtime/JSSymbolTableObject.h: Added.
10102 (JSC):
10103 (JSSymbolTableObject):
10104 (JSC::JSSymbolTableObject::symbolTable):
10105 (JSC::JSSymbolTableObject::JSSymbolTableObject):
10106 (JSC::JSSymbolTableObject::finishCreation):
10107 (JSC::symbolTableGet):
10108 (JSC::symbolTablePut):
10109 (JSC::symbolTablePutWithAttributes):
10110 * runtime/JSVariableObject.cpp:
10111 (JSC):
10112 * runtime/JSVariableObject.h:
10113 (JSVariableObject):
10114 (JSC::JSVariableObject::JSVariableObject):
10115 (JSC::JSVariableObject::finishCreation):
10116 (JSC):
10117 * runtime/WriteBarrier.h:
10118
101192012-06-06 Filip Pizlo <fpizlo@apple.com>
10120
fpizlo@apple.comd5547492012-06-07 00:23:36 +0000[diff] [blame]10121 DFG arguments access slow path should not crash if the arguments haven't been created
10122 https://bugs.webkit.org/show_bug.cgi?id=88471
10123
10124 Reviewed by Gavin Barraclough.
10125
10126 * dfg/DFGCCallHelpers.h:
10127 (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
10128 (CCallHelpers):
10129 * dfg/DFGOperations.cpp:
10130 * dfg/DFGOperations.h:
10131 * dfg/DFGSpeculativeJIT.h:
10132 (JSC::DFG::SpeculativeJIT::callOperation):
10133 * dfg/DFGSpeculativeJIT32_64.cpp:
10134 (JSC::DFG::SpeculativeJIT::compile):
10135 * dfg/DFGSpeculativeJIT64.cpp:
10136 (JSC::DFG::SpeculativeJIT::compile):
10137
msaboff@apple.com9d9eab62012-06-06 23:11:09 +0000[diff] [blame]101382012-06-06 Michael Saboff <msaboff@apple.com>
10139
10140 ENH: Add Logging to GC Marking Phase
10141 https://bugs.webkit.org/show_bug.cgi?id=88364
10142
10143 Reviewed by Filip Pizlo.
10144
10145 Log GC marking to stderr or a file. The logging in controlled
10146 with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
10147 If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
10148 logged to a file otherwise it is logged to stderr.
10149
10150 When logging is enabled, the GC is built single threaded since the
10151 log output from the various threads isn't buffered and output in a
10152 thread safe manner.
10153
10154 * heap/Heap.cpp:
10155 (JSC::Heap::markRoots):
10156 * heap/MarkStack.cpp:
10157 (JSC::MarkStackThreadSharedData::resetChildren):
10158 (JSC::MarkStackThreadSharedData::childVisitCount):
10159 (JSC::MarkStackThreadSharedData::markingThreadMain):
10160 (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
10161 (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
10162 (JSC::MarkStackThreadSharedData::reset):
10163 * heap/MarkStack.h:
10164 (MarkStackThreadSharedData):
10165 (MarkStack):
10166 (JSC::MarkStack::sharedData):
10167 (JSC::MarkStack::resetChildCount):
10168 (JSC::MarkStack::childCount):
10169 (JSC::MarkStack::incrementChildCount):
10170 * runtime/JSArray.cpp:
10171 (JSC::JSArray::visitChildren):
10172 * runtime/JSCell.cpp:
10173 (JSC::JSCell::className):
10174 * runtime/JSCell.h:
10175 (JSCell):
10176 (JSC::JSCell::visitChildren):
10177 * runtime/JSString.cpp:
10178 (JSC::JSString::visitChildren):
10179 * runtime/JSString.h:
10180 (JSString):
10181 * runtime/Structure.h:
10182 (JSC::MarkStack::internalAppend):
10183
barraclough@apple.com799e44e2012-06-06 22:09:44 +0000[diff] [blame]101842012-06-06 Gavin Barraclough <barraclough@apple.com>
10185
10186 Assigning to a static property should not change iteration order
10187 https://bugs.webkit.org/show_bug.cgi?id=88401
10188
10189 Reviewed by Geoff Garen.
10190
10191 A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
10192 requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
10193
10194 Whilst it is not clear that this behavior really arises from the specification, it
10195 would seem like common sense to conform to this.
10196
10197 The problem here is that we allow properties in the structure to shadow those in the
10198 static table, and we iterate the properties in the structure first - which means that
10199 as values of existing properties are modified, their iteration order changes too.
10200
10201 The easy fix is to iterate the properties from the static table first. This has a
10202 further benefit, since it will mean that user added properties will come after those
10203 present in the static table (respected the expected insertion-order).
10204
10205 * runtime/JSObject.cpp:
10206 (JSC::JSObject::getOwnPropertyNames):
10207 - Iterate static properties first.
10208
wingo@igalia.combe8ecb92012-06-06 09:39:04 +0000[diff] [blame]102092012-06-06 Andy Wingo <wingo@igalia.com>
10210
wingo@igalia.comc2fb5ba2012-06-06 18:59:35 +0000[diff] [blame]10211 Ensure consistent order of evaluation in LLInt slow paths
10212 https://bugs.webkit.org/show_bug.cgi?id=88409
10213
10214 Reviewed by Geoffrey Garen.
10215
10216 * llint/LLIntSlowPaths.cpp:
10217 (slow_path_mul)
10218 (slow_path_sub)
10219 (slow_path_div)
10220 (slow_path_mod)
10221 (slow_path_lshift)
10222 (slow_path_rshift)
10223 (slow_path_urshift)
10224 (slow_path_bitand)
10225 (slow_path_bitor)
10226 (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
10227 multiple times without intervening sequence points. Fixes
10228 fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
10229 Linux, which reordered evaluation of the arguments to fmod.
10230
102312012-06-06 Andy Wingo <wingo@igalia.com>
10232
wingo@igalia.com4990fe82012-06-06 16:00:38 +0000[diff] [blame]10233 [GTK] Enable the LLInt
10234 https://bugs.webkit.org/show_bug.cgi?id=88315
10235
10236 Reviewed by Filip Pizlo.
10237
10238 * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
10239 LLIntAssembly.h.
10240 * GNUmakefile.list.am: Add offlineasm and llint files to the
10241 dist. Add LLInt source files to the build.
10242 * llint/LowLevelInterpreter.asm (crash): Generate a store of
10243 0xbbadbeef to a register, not to a constant. Otherwise, gas was
10244 failing to assemble result.
10245 * offlineasm/asm.rb (labelReference): Generate a
10246 SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
10247 through the PLT on ELF systems.
10248
102492012-06-06 Andy Wingo <wingo@igalia.com>
10250
wingo@igalia.combe8ecb92012-06-06 09:39:04 +0000[diff] [blame]10251 REGRESSION (r106478): None of the Paper.js JavaScript examples work
10252 https://bugs.webkit.org/show_bug.cgi?id=87158
10253
10254 Reviewed by Michael Saboff.
10255
10256 * bytecompiler/BytecodeGenerator.cpp:
10257 (JSC::BytecodeGenerator::resolve): If we have to bail out to
10258 dynamicResolve(), only skip static scopes from the head of the
10259 scope chain. Before, we were also skipping activations with
10260 direct eval as well, which was incorrect.
10261
mitz@apple.com115e6642012-06-06 07:37:05 +0000[diff] [blame]102622012-06-06 Dan Bernstein <mitz@apple.com>
10263
10264 Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
10265
10266 * dfg/DFGSpeculativeJIT.h:
10267 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
10268 * jit/JITInlineMethods.h:
10269 (JSC::JIT::emitAllocateBasicJSObject):
10270 * llint/LowLevelInterpreter.asm:
10271 * runtime/JSGlobalData.h:
10272 (JSGlobalData):
10273 * runtime/JSGlobalThis.cpp:
10274 (JSC::JSGlobalThis::setUnwrappedObject):
10275 * runtime/JSObject.cpp:
10276 (JSC::JSObject::visitChildren):
10277 (JSC::JSObject::createInheritorID):
10278 * runtime/JSObject.h:
10279 (JSObject):
10280 (JSC::JSObject::resetInheritorID):
10281 (JSC):
10282 (JSC::JSObject::offsetOfInheritorID):
10283 (JSC::JSObject::inheritorID):
10284
yuqiang.xian@intel.come8adde62012-06-06 05:25:54 +0000[diff] [blame]102852012-06-05 Yuqiang Xian <yuqiang.xian@intel.com>
10286
10287 Improve Math.round and Math.floor intrinsic
10288 https://bugs.webkit.org/show_bug.cgi?id=88314
10289
10290 Reviewed by Filip Pizlo.
10291
10292 Currently we call a native function from the JIT code to complete the
10293 "round" and "floor" operations. We could inline some fast paths
10294 especially for those positive values on the platforms where floating
10295 point truncation is supported.
10296 This brings 3% gain on Kraken, especially 32% on audio-oscillator,
10297 and slight win on SunSpider, measured on IA32.
10298
10299 * jit/ThunkGenerators.cpp:
10300 (JSC::floorThunkGenerator):
10301 (JSC):
10302 (JSC::roundThunkGenerator):
10303
barraclough@apple.comc48fc1b2012-06-06 05:08:45 +0000[diff] [blame]103042012-06-05 Gavin Barraclough <barraclough@apple.com>
10305
10306 Remove JSObject::m_inheritorID
10307 https://bugs.webkit.org/show_bug.cgi?id=88378
10308
10309 Reviewed by Geoff Garen.
10310
10311 This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
10312 and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
10313 Instead use a private named value in the object's property storage.
10314
10315 * dfg/DFGSpeculativeJIT.h:
10316 (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
10317 - No need m_inheritorID to initialize!
10318 * jit/JITInlineMethods.h:
10319 (JSC::JIT::emitAllocateBasicJSObject):
10320 - No need m_inheritorID to initialize!
10321 * llint/LowLevelInterpreter.asm:
10322 - No need m_inheritorID to initialize!
10323 * runtime/JSGlobalData.h:
10324 (JSGlobalData):
10325 - Added private name 'm_inheritorIDKey'.
10326 * runtime/JSGlobalThis.cpp:
10327 (JSC::JSGlobalThis::setUnwrappedObject):
10328 - resetInheritorID is now passed a JSGlobalData&.
10329 * runtime/JSObject.cpp:
10330 (JSC::JSObject::visitChildren):
10331 - No m_inheritorID to be marked.
10332 (JSC::JSObject::createInheritorID):
10333 - Store the newly created inheritorID in the property map.
10334 * runtime/JSObject.h:
10335 (JSC::JSObject::resetInheritorID):
10336 - Remove the inheritorID from property storage.
10337 (JSC::JSObject::inheritorID):
10338 - Read the inheritorID from property storage.
10339
fpizlo@apple.come7bee132012-06-05 21:32:18 +0000[diff] [blame]103402012-06-05 Filip Pizlo <fpizlo@apple.com>
10341
10342 DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
10343 https://bugs.webkit.org/show_bug.cgi?id=88362
10344
10345 Reviewed by Gavin Barraclough.
10346
10347 * dfg/DFGCFGSimplificationPhase.cpp:
10348 (JSC::DFG::CFGSimplificationPhase::fixPhis):
10349 (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10350
mhahnenberg@apple.com47c9c532012-06-05 20:38:21 +0000[diff] [blame]103512012-06-05 Mark Hahnenberg <mhahnenberg@apple.com>
10352
10353 Entry into JSC should CRASH() if the Heap is busy
10354 https://bugs.webkit.org/show_bug.cgi?id=88355
10355
10356 Reviewed by Geoffrey Garen.
10357
10358 Interpreter::execute() returns jsNull() right now if we try to enter it while
10359 the Heap is busy (e.g. with a collection), which is okay, but some code paths
10360 that call Interpreter::execute() allocate objects before checking if the Heap
10361 is busy. Attempting to execute JS code while the Heap is busy should not be
10362 allowed and should be enforced by a release-mode CRASH() to prevent vague,
10363 unhelpful backtraces later on if somebody makes a mistake. Normally, recursively
10364 executing JS code is okay, e.g. for evals, but it should not occur during a
10365 Heap allocation or collection because the Heap is not guaranteed to be in a
10366 consistent state (especially during collections). We are protected from
10367 executing JS on the same Heap concurrently on two separate threads because
10368 they must each take a JSLock first. However, we are not protected from reentrant
10369 execution of JS on the same thread because JSLock allows reentrancy. Therefore,
10370 we should fail early if we detect an entrance into JS code while the Heap is busy.
10371
10372 * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field
10373 at the beginning of collection and then unsets it at the end so that it is set at all
10374 times throughout the duration of a collection rather than sporadically during various
10375 phases. There is no reason to unset during a collection because our collector does
10376 not currently support running additional JS between the phases of a collection.
10377 (JSC::Heap::getConservativeRegisterRoots):
10378 (JSC::Heap::markRoots):
10379 (JSC::Heap::collect):
10380 * interpreter/Interpreter.cpp:
10381 (JSC::Interpreter::execute): Crash if the Heap is busy.
10382 * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call
10383 Interpreter::execute() because we do some allocation prior to calling execute() which
10384 could cause Heap corruption if, for example, that allocation caused a collection.
10385 (JSC::evaluate):
10386
commit-queue@webkit.org3401b2d2012-06-05 11:32:22 +0000[diff] [blame]103872012-06-05 Dongwoo Im <dw.im@samsung.com>
10388
10389 Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
10390 https://bugs.webkit.org/show_bug.cgi?id=73176
10391
10392 Reviewed by Adam Barth.
10393
10394 Two more APIs are added in Custom Scheme Handler specification.
10395 http://dev.w3.org/html5/spec/Overview.html#custom-handlers
10396 One is 'isProtocolHandlerRegistered' to query whether the specific URL
10397 is registered or not.
10398 The other is 'unregisterProtocolHandler' to remove the registered URL.
10399
10400 * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
10401
fpizlo@apple.com9cce18d2012-06-05 06:40:48 +0000[diff] [blame]104022012-06-04 Filip Pizlo <fpizlo@apple.com>
10403
10404 DFG CFG simplification should correct the variables at the head of the predecessor block
10405 https://bugs.webkit.org/show_bug.cgi?id=88284
10406
10407 Reviewed by Geoffrey Garen.
10408
10409 * dfg/DFGCFGSimplificationPhase.cpp:
10410 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10411
ggaren@apple.com825cc102012-06-05 03:17:15 +0000[diff] [blame]104122012-06-04 Geoffrey Garen <ggaren@apple.com>
10413
10414 Unreviewed.
10415
10416 Rolled out r119364 because it's still causing crashes (when running
10417 v8-earley in release builds of DRT)
10418
10419 This time for sure!
10420
10421 * heap/Heap.cpp:
10422 (JSC::Heap::collect):
10423 * heap/MarkedBlock.cpp:
10424 (JSC::MarkedBlock::sweep):
10425 * heap/MarkedBlock.h:
10426 (JSC::MarkedBlock::resetAllocator):
10427 (JSC):
10428 * heap/MarkedSpace.cpp:
10429 (JSC::ResetAllocator::operator()):
10430 (JSC):
10431 (JSC::MarkedSpace::resetAllocators):
10432 (JSC::MarkedSpace::sweepWeakSets):
10433 * heap/MarkedSpace.h:
10434 (MarkedSpace):
10435 * heap/WeakBlock.cpp:
10436 (JSC::WeakBlock::sweep):
10437 * heap/WeakSet.cpp:
10438 (JSC::WeakSet::sweep):
10439 (JSC::WeakSet::tryFindAllocator):
10440 * heap/WeakSet.h:
10441 (JSC::WeakSet::shrink):
10442
fpizlo@apple.com9cd38a62012-06-05 00:28:49 +0000[diff] [blame]104432012-06-04 Filip Pizlo <fpizlo@apple.com>
10444
10445 DFG arguments simplification should have rationalized handling of TearOffArguments
10446 https://bugs.webkit.org/show_bug.cgi?id=88206
10447
10448 Reviewed by Geoffrey Garen.
10449
10450 - Accesses to the unmodified arguments register ought to have the same effect on
10451 alias/escape analysis of arguments as accesses to the mutable arguments register.
10452
10453 - The existence of TearOffArguments should not get in the way of arguments aliasing.
10454
10455 - TearOffArguments should be eliminated if CreateArguments is eliminated.
10456
10457 * dfg/DFGArgumentsSimplificationPhase.cpp:
10458 (JSC::DFG::ArgumentsSimplificationPhase::run):
10459 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
10460
barraclough@apple.com282d26a2012-06-05 00:00:17 +0000[diff] [blame]104612012-06-04 Gavin Barraclough <barraclough@apple.com>
10462
10463 Remove enabledProfilerReference
10464 https://bugs.webkit.org/show_bug.cgi?id=88258
10465
10466 Reviewed by Michael Saboff.
10467
10468 Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
10469 via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
10470 reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
10471 unused void* instead), since this is an intrusive change better handled in a separate patch.
10472
10473 * interpreter/Interpreter.cpp:
10474 (JSC::Interpreter::throwException):
10475 (JSC::Interpreter::execute):
10476 (JSC::Interpreter::executeCall):
10477 (JSC::Interpreter::executeConstruct):
10478 (JSC::Interpreter::privateExecute):
10479 * jit/JITCode.h:
10480 (JSC::JITCode::execute):
10481 - Don't pass Profiler** to JIT code.
10482 * jit/JITOpcodes.cpp:
10483 (JSC::JIT::emit_op_profile_will_call):
10484 (JSC::JIT::emit_op_profile_did_call):
10485 * jit/JITOpcodes32_64.cpp:
10486 (JSC::JIT::emit_op_profile_will_call):
10487 (JSC::JIT::emit_op_profile_did_call):
10488 * jit/JITStubs.cpp:
10489 (JSC):
10490 (JSC::ctiTrampoline):
10491 (JSC::ctiVMThrowTrampoline):
10492 (JSC::ctiOpThrowNotCaught):
10493 (JSC::JITThunks::JITThunks):
10494 (JSC::DEFINE_STUB_FUNCTION):
10495 - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
10496 - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
10497 * jit/JITStubs.h:
10498 (JITStackFrame):
10499 (JSC):
10500 - Renamed enabledProfilerReference to unusedX.
10501 * llint/LLIntSlowPaths.cpp:
10502 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
10503 * llint/LowLevelInterpreter.asm:
10504 * profiler/Profiler.cpp:
10505 (JSC):
10506 (JSC::Profiler::startProfiling):
10507 (JSC::Profiler::stopProfiling):
10508 * profiler/Profiler.h:
10509 (Profiler):
10510 - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
10511 * runtime/JSGlobalData.cpp:
10512 (JSC::JSGlobalData::JSGlobalData):
10513 * runtime/JSGlobalData.h:
10514 (JSC):
10515 (JSC::JSGlobalData::enabledProfiler):
10516 (JSGlobalData):
10517 - Added m_enabledProfiler, enabledProfiler().
10518 * runtime/JSGlobalObject.cpp:
10519 (JSC::JSGlobalObject::~JSGlobalObject):
10520
fpizlo@apple.com3d579cc2012-06-04 23:27:34 +0000[diff] [blame]105212012-06-04 Filip Pizlo <fpizlo@apple.com>
10522
fpizlo@apple.com477ce382012-06-04 23:32:57 +0000[diff] [blame]10523 get_argument_by_val should be profiled everywhere
10524 https://bugs.webkit.org/show_bug.cgi?id=88205
10525
10526 Reviewed by Geoffrey Garen.
10527
10528 * jit/JITOpcodes32_64.cpp:
10529 (JSC::JIT::emitSlow_op_get_argument_by_val):
10530 * llint/LLIntSlowPaths.cpp:
10531 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
10532
105332012-06-04 Filip Pizlo <fpizlo@apple.com>
10534
fpizlo@apple.com3d579cc2012-06-04 23:27:34 +0000[diff] [blame]10535 DFG arguments simplification takes unkindly to direct accesses to the arguments register
10536 https://bugs.webkit.org/show_bug.cgi?id=88261
10537
10538 Reviewed by Geoffrey Garen.
10539
10540 Fixed arguments simplification for direct accesses to the arguments register, which may
10541 arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
10542 by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
10543 simplification, like realizing that it needs to bail if there is a direct assignment to
10544 the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
10545 fixed CSE's handling of store elimination of captured locals in the presence of a
10546 GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
10547 tail if the Flush it removes is the last operation on a local in a basic block.
10548
10549 * bytecode/CodeBlock.cpp:
10550 (JSC::CodeBlock::dump):
10551 * dfg/DFGArgumentsSimplificationPhase.cpp:
10552 (JSC::DFG::ArgumentsSimplificationPhase::run):
10553 (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
10554 * dfg/DFGCSEPhase.cpp:
10555 (JSC::DFG::CSEPhase::run):
10556 (JSC::DFG::CSEPhase::setLocalStoreElimination):
10557 (JSC::DFG::CSEPhase::performNodeCSE):
10558 (CSEPhase):
10559 * dfg/DFGDriver.cpp:
10560 (JSC::DFG::compile):
10561
andersca@apple.comea6c6b22012-06-04 21:56:32 +0000[diff] [blame]105622012-06-04 Anders Carlsson <andersca@apple.com>
10563
10564 Fix a struct/class mismatch.
10565
10566 * heap/Handle.h:
10567 (Handle):
10568
ddkilzer@apple.comba58a612012-06-04 14:55:26 +0000[diff] [blame]105692012-06-04 David Kilzer <ddkilzer@apple.com>
10570
10571 BUILD FIX: FeatureDefines.xcconfig should match across projects
10572
10573 * Configurations/FeatureDefines.xcconfig:
10574 - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
10575
ggaren@apple.com02dec622012-06-03 21:16:55 +0000[diff] [blame]105762012-06-02 Geoffrey Garen <ggaren@apple.com>
10577
10578 Weak pointer finalization should be lazy
10579 https://bugs.webkit.org/show_bug.cgi?id=87599
10580
10581 Reviewed by Sam Weinig.
10582
10583 This time for sure!
10584
10585 * heap/Heap.cpp:
10586 (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
10587
10588 * heap/MarkedBlock.cpp:
10589 (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
10590 destructors -- this is our last chance to run weak set finalizers before
10591 we recycle our memory.
10592
10593 * heap/MarkedBlock.h:
10594 (JSC::MarkedBlock::resetAllocator):
10595 * heap/MarkedSpace.cpp:
10596 (JSC::MarkedSpace::resetAllocators):
10597 * heap/MarkedSpace.h:
10598 (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
10599 It will happen automatically when a weak set is swept. It's simpler to
10600 have only one canonical way for this to happen, and it wasn't buying
10601 us anything to do it eagerly.
10602
10603 * heap/WeakBlock.cpp:
10604 (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
10605 the sweep would be a no-op. If even one finalizer is pending, we need to
10606 run it, since we won't get another chance.
10607
10608 * heap/WeakSet.cpp:
10609 (JSC::WeakSet::sweep): This loop can be simpler now that
10610 WeakBlock::sweep() does what we mean.
10611
10612 Reset our allocator after a sweep because this is the optimal time to
10613 start trying to recycle old weak pointers.
10614
10615 (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
10616 allocator because we've swept already, and forcing a new sweep would be
10617 wasteful.
10618
10619 * heap/WeakSet.h:
10620 (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
10621 because the shrink may have removed the block the allocator was going to
10622 allocate out of.
10623
fpizlo@apple.comb80bc2a32012-06-02 22:58:48 +0000[diff] [blame]106242012-06-02 Filip Pizlo <fpizlo@apple.com>
10625
fpizlo@apple.come0c200c2012-06-03 00:41:08 +0000[diff] [blame]10626 If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
10627 shouldn't revert all the way to GetById/GetByIdFlush
10628 https://bugs.webkit.org/show_bug.cgi?id=88176
10629
10630 Reviewed by Geoffrey Garen.
10631
10632 Refactored the code so that the op_method_check case of the parser gracefully falls
10633 through to all of the goodness of the normal op_get_by_id case.
10634
10635 * dfg/DFGByteCodeParser.cpp:
10636 (ByteCodeParser):
10637 (JSC::DFG::ByteCodeParser::handleGetById):
10638 (DFG):
10639 (JSC::DFG::ByteCodeParser::parseBlock):
10640
106412012-06-02 Filip Pizlo <fpizlo@apple.com>
10642
fpizlo@apple.comb80bc2a32012-06-02 22:58:48 +0000[diff] [blame]10643 DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
10644 https://bugs.webkit.org/show_bug.cgi?id=87929
10645
10646 Reviewed by Geoffrey Garen.
10647
10648 Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
10649
10650 This required a bunch of changes:
10651
10652 - The obvious change is making CSE essentially ignore whether or not the set of
10653 operations between the Flush and the SetLocal can exit, and instead focus on whether or
10654 not that set of operations can clobber the world or access local variables. This code
10655 is now refactored to return a set of flags indicating any of these events, and the CSE
10656 decides what to do based on those flags. If the set of operations is non-clobbering
10657 and non-accessing, then the Flush is turned into a Phantom on the child of the
10658 SetLocal. This expands the liveness of the relevant variable but virtually guarantees
10659 that it will be register allocated and not flushed to the stack. So, yeah, this patch
10660 is a lot of work to save a few stores to the stack.
10661
10662 - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
10663 it was a no-op if you were holding onto a CFA abstract state. But this would make the
10664 CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
10665 constant folding phase into something more broad; it now fixes up
10666 CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
10667 no-ops.
10668
10669 - Arguments simplification was previously relying on this very strange PhantomArguments
10670 node, which had two different meanings: for normal execution it meant the empty value
10671 but for OSR exit it meant that the arguments should be reified. This produces problems
10672 when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
10673 triggering reification of arguments without having initialized the arguments registers
10674 to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
10675 namely, arguments reification on OSR exit. Hence, this patch changes arguments
10676 simplification to change SetLocal of CreateArguments on the arguments registers to be
10677 a SetLocal of Empty.
10678
10679 - Argument value recoveries were previously derived from the value source of the
10680 arguments at the InlineStart. But that relies on all SetLocals to arguments having
10681 been flushed. It's possible that we could have elided the SetLocal to the arguments
10682 at the callsite because there were subsequent SetLocals to the arguments inside of the
10683 callee, in which case the InlineStart would get the wrong information. Hence, this
10684 patch changes argument value recovery computation to operate over the ArgumentPositions
10685 directly.
10686
10687 - But that doesn't actually work, because previously, there was no way to link an
10688 InlineStart back to the corresponding ArgumentPositions, at least not without some
10689 ugliness. So this patch instates the rule that the m_argumentPositions vector consists
10690 of disjoint subsequences such that each subsequence corresponds to an inline callsite
10691 and can be identified by its first index, and within each subsequence are the
10692 ArgumentPositions of all of the arguments ordered by argument index. This required
10693 flipping the order in which ArgumentPositions are added to the vector, and giving
10694 InlineStart an operand that indicates the start of that inline callsite's
10695 ArgumentPosition subsequence.
10696
10697 - This patch also revealed a nasty bug in the reification of arguments in inline call
10698 frames on OSR exit. Since the reification was happening after the values of virtual
10699 registers were recovered, the value recoveries of the inline arguments were wrong.
10700 Hence using operationCreateInlinedArguments is wrong. For example a value recovery
10701 might say that you have to box a double, but if we had already boxed it then boxing
10702 it a second time will result in garbage. The specific case of this bug was this patch
10703 uncovered was that now it is possible for an inline call frame to not have any valid
10704 value recoveries for any inline arguments, if the optimization elides all argument
10705 flushes, while at the same time optimizing away arguments creation. Then OSR exit
10706 would try to recover the arguments using the inline call frame, which had bogus
10707 information, and humorous crashes would ensue. This patch fixes this issue by moving
10708 arguments reification to after call frame reification, so that arguments reification
10709 can always use operationCreateArguments instead of operationCreateInlinedArguments.
10710
10711 - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
10712 broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
10713 but didn't know that there could alternatively be a Phantom in place of the Flush.
10714 This patch fixes that by augmenting the forward speculation check logic.
10715
10716 - Finally, in the process of having fun with all of the above, I realized that my DFG
10717 validation was not actually running on every phase like I had originally designed it
10718 to. In fact it was only running just after bytecode parsing. I initially tried to
10719 make it run in every phase but found that this causes some tests to timeout
10720 (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
10721 release mode validation never runs, (ii) in debug mode validation will run just
10722 after parsing and just before the backend, and (iii) it's possible with a simple
10723 switch to enable validation to run on every phase.
10724
10725 Luckily all of the above issues were already covered by the 77 or so DFG-specific
10726 layout tests. Hence, this patch does not introduce any new tests despite being so
10727 meaty.
10728
10729 * dfg/DFGAbstractState.cpp:
10730 (JSC::DFG::AbstractState::execute):
10731 * dfg/DFGArgumentPosition.h:
10732 (JSC::DFG::ArgumentPosition::prediction):
10733 (JSC::DFG::ArgumentPosition::doubleFormatState):
10734 (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
10735 (ArgumentPosition):
10736 * dfg/DFGArgumentsSimplificationPhase.cpp:
10737 (JSC::DFG::ArgumentsSimplificationPhase::run):
10738 * dfg/DFGByteCodeParser.cpp:
10739 (JSC::DFG::ByteCodeParser::handleInlining):
10740 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10741 * dfg/DFGCSEPhase.cpp:
10742 (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
10743 (SetLocalStoreEliminationResult):
10744 (JSC::DFG::CSEPhase::setLocalStoreElimination):
10745 (JSC::DFG::CSEPhase::performNodeCSE):
10746 * dfg/DFGCommon.h:
10747 * dfg/DFGConstantFoldingPhase.cpp:
10748 (JSC::DFG::ConstantFoldingPhase::run):
10749 * dfg/DFGDriver.cpp:
10750 (JSC::DFG::compile):
10751 * dfg/DFGNode.h:
10752 (Node):
10753 (JSC::DFG::Node::hasArgumentPositionStart):
10754 (JSC::DFG::Node::argumentPositionStart):
10755 * dfg/DFGOSRExitCompiler32_64.cpp:
10756 (JSC::DFG::OSRExitCompiler::compileExit):
10757 * dfg/DFGOSRExitCompiler64.cpp:
10758 (JSC::DFG::OSRExitCompiler::compileExit):
10759 * dfg/DFGPhase.cpp:
10760 (DFG):
10761 * dfg/DFGPhase.h:
10762 (Phase):
10763 * dfg/DFGSpeculativeJIT.cpp:
10764 (JSC::DFG::SpeculativeJIT::compile):
10765 * dfg/DFGSpeculativeJIT.h:
10766 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
10767 * dfg/DFGSpeculativeJIT32_64.cpp:
10768 (JSC::DFG::SpeculativeJIT::compile):
10769 * dfg/DFGSpeculativeJIT64.cpp:
10770 (JSC::DFG::SpeculativeJIT::compile):
10771
ggaren@apple.com32eb24b2012-06-02 22:49:05 +0000[diff] [blame]107722012-06-02 Geoffrey Garen <ggaren@apple.com>
10773
10774 DOM string cache should hash pointers, not characters
10775 https://bugs.webkit.org/show_bug.cgi?id=88175
10776
10777 Reviewed by Phil Pizlo and Sam Weinig.
10778
10779 * heap/Weak.h:
10780 (JSC::weakAdd):
10781 (JSC::weakRemove): Made these function templates slightly more generic
10782 to accommodate new client types.
10783
fpizlo@apple.comcc5b61b2012-06-01 21:32:45 +0000[diff] [blame]107842012-06-01 Filip Pizlo <fpizlo@apple.com>
10785
fpizlo@apple.coma4754892012-06-02 00:22:31 +0000[diff] [blame]10786 DFG CFA should know that PutByVal can clobber the world
10787 https://bugs.webkit.org/show_bug.cgi?id=88155
10788
10789 Reviewed by Gavin Barraclough.
10790
10791 * dfg/DFGAbstractState.cpp:
10792 (JSC::DFG::AbstractState::execute):
10793
107942012-06-01 Filip Pizlo <fpizlo@apple.com>
10795
fpizlo@apple.com8e537cd2012-06-01 23:54:36 +0000[diff] [blame]10796 DFG CFA should mark basic blocks as having constants if local accesses yield constants
10797 https://bugs.webkit.org/show_bug.cgi?id=88153
10798
10799 Reviewed by Gavin Barraclough.
10800
10801 * dfg/DFGAbstractState.cpp:
10802 (JSC::DFG::AbstractState::execute):
10803
108042012-06-01 Filip Pizlo <fpizlo@apple.com>
10805
fpizlo@apple.comacc9dd22012-06-01 23:47:28 +0000[diff] [blame]10806 DFG arguments simplification phase uses a node.codeOrigin after appending a node
10807 https://bugs.webkit.org/show_bug.cgi?id=88151
10808
10809 Reviewed by Geoffrey Garen.
10810
10811 The right thing to do is to save the CodeOrigin before appending to the graph.
10812
10813 * dfg/DFGArgumentsSimplificationPhase.cpp:
10814 (JSC::DFG::ArgumentsSimplificationPhase::run):
10815
108162012-06-01 Filip Pizlo <fpizlo@apple.com>
10817
fpizlo@apple.com4f337c22012-06-01 23:18:59 +0000[diff] [blame]10818 DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
10819 a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
10820 https://bugs.webkit.org/show_bug.cgi?id=88146
10821
10822 Reviewed by Gavin Barraclough.
10823
10824 * dfg/DFGSpeculativeJIT.cpp:
10825 (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
10826
108272012-06-01 Filip Pizlo <fpizlo@apple.com>
10828
fpizlo@apple.comafc07412012-06-01 22:44:43 +0000[diff] [blame]10829 DFG constant folding search for the last local access skips the immediately previous local access
10830 https://bugs.webkit.org/show_bug.cgi?id=88141
10831
10832 Reviewed by Michael Saboff.
10833
10834 If you use a loop in the style of:
10835
10836 for (i = start; i--;)
10837
10838 then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
10839 Hence the following is probably wrong:
10840
10841 for (i = start - 1; i--;)
10842
10843 * dfg/DFGConstantFoldingPhase.cpp:
10844 (JSC::DFG::ConstantFoldingPhase::run):
10845
108462012-06-01 Filip Pizlo <fpizlo@apple.com>
10847
fpizlo@apple.comcc5b61b2012-06-01 21:32:45 +0000[diff] [blame]10848 DFG constant folding should be OK with GetLocal of captured variables having a constant
10849 https://bugs.webkit.org/show_bug.cgi?id=88137
10850
10851 Reviewed by Gavin Barraclough.
10852
10853 * dfg/DFGConstantFoldingPhase.cpp:
10854 (JSC::DFG::ConstantFoldingPhase::run):
10855
mhahnenberg@apple.com016c5782012-06-01 00:02:09 +0000[diff] [blame]108562012-05-31 Mark Hahnenberg <mhahnenberg@apple.com>
10857
10858 JSGlobalObject does not mark m_privateNameStructure
10859 https://bugs.webkit.org/show_bug.cgi?id=88023
10860
10861 Rubber stamped by Gavin Barraclough.
10862
10863 * runtime/JSGlobalObject.cpp:
10864 (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get
10865 inadvertently garbage collected.
10866
arv@chromium.org31fddbc2012-05-31 18:00:03 +0000[diff] [blame]108672012-05-31 Erik Arvidsson <arv@chromium.org>
10868
10869 Make DOM Exceptions Errors
10870 https://bugs.webkit.org/show_bug.cgi?id=85078
10871
10872 Reviewed by Oliver Hunt.
10873
10874 WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
10875
10876 For JSC we have access to the Error.prototype from the binding code.
10877
10878 For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
10879 set the prototype as needed.
10880
10881 Updated test: fast/dom/DOMException/prototype-object.html
10882
10883 * JavaScriptCore.xcodeproj/project.pbxproj:
10884 * runtime/JSGlobalObject.cpp:
10885 (JSC::JSGlobalObject::reset):
10886 * runtime/JSGlobalObject.h:
10887 (JSC):
10888 (JSGlobalObject):
10889 (JSC::JSGlobalObject::errorPrototype):
10890
wingo@igalia.com8de6a8a2012-05-31 17:28:21 +0000[diff] [blame]108912012-05-31 Andy Wingo <wingo@igalia.com>
10892
10893 Fix reference to unset variable in debug mode
10894 https://bugs.webkit.org/show_bug.cgi?id=87981
10895
10896 Reviewed by Geoffrey Garen.
10897
10898 * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
10899 Initialize m_size in debug mode, as we check it later in an assert.
10900
mhahnenberg@apple.comeb39abc2012-05-31 03:04:00 +0000[diff] [blame]109012012-05-30 Mark Hahnenberg <mhahnenberg@apple.com>
10902
10903 Heap should sweep incrementally
10904 https://bugs.webkit.org/show_bug.cgi?id=85429
10905
10906 We shouldn't have to wait for the opportunistic GC timer to fire in order
10907 to call object destructors. Instead, we should incrementally sweep some
10908 subset of the blocks requiring sweeping periodically. We tie this sweeping
10909 to a timer rather than to collections because we want to reclaim this memory
10910 even if we stop allocating. This way, our memory usage scales smoothly with
10911 actual use, regardless of whether we've recently done an opportunistic GC or not.
10912
10913 Reviewed by Geoffrey Garen.
10914
10915 * CMakeLists.txt:
10916 * GNUmakefile.list.am:
10917 * JavaScriptCore.gypi:
10918 * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
10919 * JavaScriptCore.xcodeproj/project.pbxproj:
10920 * Target.pri:
10921 * heap/Heap.cpp:
10922 (JSC::Heap::Heap):
10923 (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
10924 which we will switch over to being done during incremental sweeping too as soon as
10925 all finalizers can be run lazily (and, by extension, incrementally).
10926 (JSC::Heap::sweeper):
10927 (JSC):
10928 * heap/Heap.h:
10929 (JSC):
10930 (Heap):
10931 * heap/IncrementalSweeper.cpp: Added.
10932 (JSC):
10933 (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to
10934 GCActivityCallback. It is tied to a run-loop based timer that fires periodically based
10935 on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do
10936 anything if the platform doesn't support CoreFoundation.
10937 (JSC::IncrementalSweeper::IncrementalSweeper):
10938 (JSC::IncrementalSweeper::~IncrementalSweeper):
10939 (JSC::IncrementalSweeper::create):
10940 (JSC::IncrementalSweeper::scheduleTimer):
10941 (JSC::IncrementalSweeper::cancelTimer):
10942 (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken
10943 during the last collection, checking to see which blocks need sweeping. If it successfully
10944 gets to the end of the blocks that need sweeping then it cancels the timer.
10945 (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in
10946 a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
10947 * heap/IncrementalSweeper.h: Added.
10948 (JSC):
10949 (IncrementalSweeper):
10950 * heap/MarkedBlock.h:
10951 (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping
10952 to be usable and to run any destructors that need to be run.
10953
paroga@webkit.orgecd0fb62012-05-31 01:38:17 +0000[diff] [blame]109542012-05-30 Patrick Gansterer <paroga@webkit.org>
10955
10956 [WINCE] Fix JSString after r115516.
10957 https://bugs.webkit.org/show_bug.cgi?id=87892
10958
10959 Reviewed by Geoffrey Garen.
10960
10961 r115516 splitted JSString into two classes, with addition nested classes.
10962 Add a workaround for the WinCE compiler since it can't resolve the friend class
10963 declerations corretly and denies the access to protected members of JSString.
10964
10965 * runtime/JSString.h:
10966 (JSC::JSRopeString::RopeBuilder::append):
10967 (JSC::JSRopeString::append):
10968 (JSRopeString):
10969
oliver@apple.com3c996382012-05-30 23:47:27 +0000[diff] [blame]109702012-05-30 Oliver Hunt <oliver@apple.com>
10971
10972 Really provide error information with the inspector disabled
10973 https://bugs.webkit.org/show_bug.cgi?id=87910
10974
10975 Reviewed by Filip Pizlo.
10976
10977 Don't bother checking for anything other than pre-existing error info.
10978 In the absence of complete line number information you'll only get the
10979 line a function starts on, but at least it's something.
10980
10981 * interpreter/Interpreter.cpp:
10982 (JSC::Interpreter::throwException):
10983
fpizlo@apple.com074918c2012-05-30 20:18:00 +0000[diff] [blame]109842012-05-30 Filip Pizlo <fpizlo@apple.com>
10985
fpizlo@apple.com5673fe62012-05-30 23:09:45 +0000[diff] [blame]10986 LLInt broken on x86-32 with JIT turned off
10987 https://bugs.webkit.org/show_bug.cgi?id=87906
10988
10989 Reviewed by Geoffrey Garen.
10990
10991 Fixed the code to not clobber registers that contain important things, like the call frame.
10992
10993 * llint/LowLevelInterpreter32_64.asm:
10994
109952012-05-30 Filip Pizlo <fpizlo@apple.com>
10996
fpizlo@apple.com074918c2012-05-30 20:18:00 +0000[diff] [blame]10997 ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
10998 https://bugs.webkit.org/show_bug.cgi?id=87887
10999
fpizlo@apple.comd55e8152012-05-30 21:04:23 +0000[diff] [blame]11000 Reviewed by Darin Adler.
11001
11002 Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
11003
11004 * parser/Nodes.h:
11005 (JSC::ScopeNode::sourceID):
11006 * parser/SourceCode.h:
11007 (JSC::SourceCode::providerID):
11008 (SourceCode):
11009 * parser/SourceProvider.h:
11010 (SourceProvider):
11011 (JSC::SourceProvider::asID):
11012 * runtime/Executable.h:
11013 (JSC::ScriptExecutable::sourceID):
11014
110152012-05-30 Filip Pizlo <fpizlo@apple.com>
11016
11017 ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
11018 https://bugs.webkit.org/show_bug.cgi?id=87887
11019
fpizlo@apple.com074918c2012-05-30 20:18:00 +0000[diff] [blame]11020 Reviewed by Geoffrey Garen.
11021
11022 * parser/SourceProvider.h:
11023 (JSC::SourceProvider::asID):
11024
oliver@apple.comc55314a2012-05-30 19:45:20 +0000[diff] [blame]110252012-05-30 Oliver Hunt <oliver@apple.com>
11026
11027 DFG does not correctly handle exceptions caught in the LLInt
11028 https://bugs.webkit.org/show_bug.cgi?id=87885
11029
11030 Reviewed by Filip Pizlo.
11031
11032 Make the DFG use genericThrow, rather than reimplementing a small portion of it.
11033 Also make the LLInt slow paths validate that their PC is correct.
11034
11035 * dfg/DFGOperations.cpp:
11036 * llint/LLIntSlowPaths.cpp:
11037 (LLInt):
11038
fpizlo@apple.com75824e82012-05-30 17:02:49 +0000[diff] [blame]110392012-05-29 Filip Pizlo <fpizlo@apple.com>
11040
11041 DFG CFA should infer types and values of captured variables
11042 https://bugs.webkit.org/show_bug.cgi?id=87813
11043
11044 Reviewed by Gavin Barraclough.
11045
11046 Slight speed-up in V8/earley-boyer (~1%).
11047
11048 * bytecode/CodeBlock.h:
11049 (JSC::CodeBlock::argumentsAreCaptured):
11050 (JSC::CodeBlock::argumentIsCaptured):
11051 (CodeBlock):
11052 * dfg/DFGAbstractState.cpp:
11053 (DFG):
11054 (JSC::DFG::AbstractState::beginBasicBlock):
11055 (JSC::DFG::AbstractState::initialize):
11056 (JSC::DFG::AbstractState::endBasicBlock):
11057 (JSC::DFG::AbstractState::execute):
11058 (JSC::DFG::AbstractState::clobberWorld):
11059 (JSC::DFG::AbstractState::clobberStructures):
11060 (JSC::DFG::AbstractState::mergeStateAtTail):
11061 (JSC::DFG::AbstractState::merge):
11062 (JSC::DFG::AbstractState::mergeToSuccessors):
11063 * dfg/DFGAbstractState.h:
11064 (JSC::DFG::AbstractState::variables):
11065 (AbstractState):
11066 * dfg/DFGSpeculativeJIT32_64.cpp:
11067 (JSC::DFG::SpeculativeJIT::compile):
11068 * dfg/DFGSpeculativeJIT64.cpp:
11069 (JSC::DFG::SpeculativeJIT::compile):
11070
paroga@webkit.orge373ab72012-05-30 16:44:03 +0000[diff] [blame]110712012-05-30 Patrick Gansterer <paroga@webkit.org>
11072
11073 Unreviewed. Build fix for !ENABLE(JIT) after r117823.
11074
11075 * bytecode/CodeBlock.cpp:
11076 (JSC::CodeBlock::dump):
11077
commit-queue@webkit.org4ac40e0d2012-05-30 07:17:05 +0000[diff] [blame]110782012-05-30 Sheriff Bot <webkit.review.bot@gmail.com>
11079
11080 Unreviewed, rolling out r118868.
11081 http://trac.webkit.org/changeset/118868
11082 https://bugs.webkit.org/show_bug.cgi?id=87828
11083
11084 introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
11085 on #webkit).
11086
11087 * heap/Heap.cpp:
11088 (JSC::Heap::collect):
11089 * heap/MarkedBlock.cpp:
11090 (JSC::MarkedBlock::sweep):
11091 * heap/MarkedBlock.h:
11092 (JSC::MarkedBlock::sweepWeakSet):
11093 (JSC):
11094 * heap/MarkedSpace.cpp:
11095 (JSC::SweepWeakSet::operator()):
11096 (JSC):
11097 (JSC::MarkedSpace::sweepWeakSets):
11098 * heap/MarkedSpace.h:
11099 (MarkedSpace):
11100
ggaren@apple.com15344ae2012-05-30 01:05:35 +0000[diff] [blame]111012012-05-29 Geoffrey Garen <ggaren@apple.com>
11102
11103 Rolled back in r118646, now that
11104 https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
11105
11106 http://trac.webkit.org/changeset/118646
11107 https://bugs.webkit.org/show_bug.cgi?id=87599
11108
11109 * heap/Heap.cpp:
11110 (JSC::Heap::collect):
11111 * heap/MarkedBlock.cpp:
11112 (JSC::MarkedBlock::sweep):
11113 * heap/MarkedBlock.h:
11114 (JSC):
11115 * heap/MarkedSpace.cpp:
11116 (JSC):
11117 * heap/MarkedSpace.h:
11118 (MarkedSpace):
11119
fpizlo@apple.com4c0875e2012-05-29 23:43:16 +0000[diff] [blame]111202012-05-29 Filip Pizlo <fpizlo@apple.com>
11121
11122 DFG should keep captured variables alive until the (inline) return.
11123 https://bugs.webkit.org/show_bug.cgi?id=87205
11124
11125 Reviewed by Gavin Barraclough.
11126
11127 Changes the way we do flushing for captured variables and arguments. Instead of flushing
11128 each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
11129 whatever was live in the variable previously, and a return will cause a Flush of all
11130 captured variables and all arguments.
11131
11132 * dfg/DFGByteCodeParser.cpp:
11133 (JSC::DFG::ByteCodeParser::setDirect):
11134 (JSC::DFG::ByteCodeParser::set):
11135 (JSC::DFG::ByteCodeParser::setLocal):
11136 (JSC::DFG::ByteCodeParser::getArgument):
11137 (JSC::DFG::ByteCodeParser::setArgument):
11138 (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
11139 (ByteCodeParser):
11140 (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
11141 (JSC::DFG::ByteCodeParser::findArgumentPosition):
11142 (JSC::DFG::ByteCodeParser::flush):
11143 (JSC::DFG::ByteCodeParser::flushDirect):
11144 (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
11145 (JSC::DFG::ByteCodeParser::handleInlining):
11146 (JSC::DFG::ByteCodeParser::parseBlock):
11147 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
11148 * dfg/DFGCSEPhase.cpp:
11149 (JSC::DFG::CSEPhase::setLocalStoreElimination):
11150 (JSC::DFG::CSEPhase::performNodeCSE):
11151 * dfg/DFGSpeculativeJIT.cpp:
11152 (JSC::DFG::SpeculativeJIT::compile):
11153 * dfg/DFGSpeculativeJIT.h:
11154 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
11155
ggaren@apple.com7cc57362012-05-29 23:40:26 +0000[diff] [blame]111562012-05-29 Geoffrey Garen <ggaren@apple.com>
11157
11158 WeakGCMap should be lazy-finalization-safe
11159 https://bugs.webkit.org/show_bug.cgi?id=87784
11160
11161 Reviewed by Darin Adler.
11162
11163 * runtime/WeakGCMap.h:
11164 (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
11165 not Weak<T>, we need to verify manually that the WeakImpl is live before
11166 we return its payload.
11167
mhahnenberg@apple.com7ea7e8f2012-05-29 18:38:14 +0000[diff] [blame]111682012-05-29 Mark Hahnenberg <mhahnenberg@apple.com>
11169
11170 CopiedSpace::doneCopying could start another collection
11171 https://bugs.webkit.org/show_bug.cgi?id=86538
11172
11173 Reviewed by Geoffrey Garen.
11174
11175 It's possible that if we don't have anything at the head of to-space
11176 after a collection and the BlockAllocator doesn't have any fresh blocks
11177 to give us right now we could start another collection while still in
11178 the middle of the first collection when we call CopiedSpace::addNewBlock().
11179
11180 One way to resolve this would be to have Heap::shouldCollect() check that
11181 m_operationInProgress is NoOperation. This would prevent the path in
11182 getFreshBlock() that starts the collection if we're already in the middle of one.
11183
11184 I could not come up with a test case to reproduce this crash on ToT.
11185
11186 * heap/Heap.h:
11187 (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
11188 of a collection, i.e. the current operation should be NoOperation.
11189
commit-queue@webkit.orgd5058402012-05-29 14:44:38 +0000[diff] [blame]111902012-05-29 David Barr <davidbarr@chromium.org>
11191
11192 Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
11193 https://bugs.webkit.org/show_bug.cgi?id=87685
11194
11195 Reviewed by Eric Seidel.
11196
11197 Add a configuration option for CSS image-resolution support, disabling it by default.
11198
11199 * Configurations/FeatureDefines.xcconfig:
11200
commit-queue@webkit.org10c0df22012-05-29 03:24:49 +0000[diff] [blame]112012012-05-28 Sheriff Bot <webkit.review.bot@gmail.com>
11202
11203 Unreviewed, rolling out r118646.
11204 http://trac.webkit.org/changeset/118646
11205 https://bugs.webkit.org/show_bug.cgi?id=87691
11206
11207 broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
11208
11209 * heap/Heap.cpp:
11210 (JSC::Heap::collect):
11211 * heap/MarkedBlock.cpp:
11212 (JSC::MarkedBlock::sweep):
11213 * heap/MarkedBlock.h:
11214 (JSC::MarkedBlock::sweepWeakSet):
11215 (JSC):
11216 * heap/MarkedSpace.cpp:
11217 (JSC::SweepWeakSet::operator()):
11218 (JSC):
11219 (JSC::MarkedSpace::sweepWeakSets):
11220 * heap/MarkedSpace.h:
11221 (MarkedSpace):
11222
fpizlo@apple.com26ece8e2012-05-29 02:43:30 +0000[diff] [blame]112232012-05-28 Filip Pizlo <fpizlo@apple.com>
11224
11225 DFG should not generate code for code that the CFA proves to be unreachable
11226 https://bugs.webkit.org/show_bug.cgi?id=87682
11227
11228 Reviewed by Sam Weinig.
11229
11230 This also fixes a small performance bug where CFA was not marking blocks
11231 as having constants (and hence not triggering constant folding) if the only
11232 constants were on GetLocals.
11233
11234 And fixing that bug revealed another bug: constant folding was assuming that
11235 a GetLocal must be the first access to a local in a basic block. This isn't
11236 true. The first access may be a Flush. This patch fixes that issue using the
11237 safest approach possible, since we don't need to be clever for something that
11238 only happens in one of our benchmarks.
11239
11240 * dfg/DFGAbstractState.cpp:
11241 (JSC::DFG::AbstractState::execute):
11242 * dfg/DFGConstantFoldingPhase.cpp:
11243 (JSC::DFG::ConstantFoldingPhase::run):
11244 * dfg/DFGJITCompiler.h:
11245 (JSC::DFG::JITCompiler::noticeOSREntry):
11246 * dfg/DFGSpeculativeJIT.cpp:
11247 (JSC::DFG::SpeculativeJIT::compile):
11248
carlosgc@webkit.orgb69727c2012-05-28 10:21:31 +0000[diff] [blame]112492012-05-28 Carlos Garcia Campos <cgarcia@igalia.com>
11250
11251 Unreviewed. Fix make distcheck.
11252
11253 * GNUmakefile.list.am: Add missing header file.
11254
ggaren@apple.comb816d752012-05-28 04:56:01 +0000[diff] [blame]112552012-05-27 Geoffrey Garen <ggaren@apple.com>
11256
11257 Weak pointer finalization should be lazy
11258 https://bugs.webkit.org/show_bug.cgi?id=87599
11259
11260 Reviewed by Darin Adler.
11261
11262 * heap/Heap.cpp:
11263 (JSC::Heap::collect): Don't force immediate finalization -- it will
11264 happen lazily.
11265
11266 * heap/MarkedBlock.cpp:
11267 (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
11268 block. The weak set may not have been swept yet, and this is our last
11269 chance to run weak finalizers before we recycle the memory they reference.
11270
11271 * heap/MarkedBlock.h:
11272 * heap/MarkedSpace.cpp:
11273 (JSC::MarkedBlock::sweepWeakSets):
11274 * heap/MarkedSpace.h:
11275 (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
11276 now.
11277
ggaren@apple.com72da8112012-05-26 22:40:46 +0000[diff] [blame]112782012-05-26 Geoffrey Garen <ggaren@apple.com>
11279
11280 WebKit should be lazy-finalization-safe (esp. the DOM) v2
11281 https://bugs.webkit.org/show_bug.cgi?id=87581
11282
11283 Reviewed by Oliver Hunt.
11284
11285 * heap/MarkedBlock.cpp:
11286 (JSC::MarkedBlock::callDestructor):
11287 * heap/WeakBlock.h:
11288 * heap/WeakSetInlines.h:
11289 (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
11290 it's not valid to access GC pointers like the Structure pointer during
11291 finalization. We NULL out the structure pointer in debug builds to try
11292 to make this programming mistake more obvious.
11293
11294 * API/JSCallbackConstructor.cpp:
11295 (JSC::JSCallbackConstructor::destroy):
11296 * API/JSCallbackObject.cpp:
11297 (JSC::::destroy):
11298 (JSC::JSCallbackObjectData::finalize):
11299 * runtime/Arguments.cpp:
11300 (JSC::Arguments::destroy):
11301 * runtime/DateInstance.cpp:
11302 (JSC::DateInstance::destroy):
11303 * runtime/Error.cpp:
11304 (JSC::StrictModeTypeErrorFunction::destroy):
11305 * runtime/Executable.cpp:
11306 (JSC::ExecutableBase::destroy):
11307 (JSC::NativeExecutable::destroy):
11308 (JSC::ScriptExecutable::destroy):
11309 (JSC::EvalExecutable::destroy):
11310 (JSC::ProgramExecutable::destroy):
11311 (JSC::FunctionExecutable::destroy):
11312 * runtime/JSGlobalObject.cpp:
11313 (JSC::JSGlobalObject::destroy):
11314 * runtime/JSPropertyNameIterator.cpp:
11315 (JSC::JSPropertyNameIterator::destroy):
11316 * runtime/JSStaticScopeObject.cpp:
11317 (JSC::JSStaticScopeObject::destroy):
11318 * runtime/JSString.cpp:
11319 (JSC::JSString::destroy):
11320 * runtime/JSVariableObject.cpp:
11321 (JSC::JSVariableObject::destroy):
11322 * runtime/NameInstance.cpp:
11323 (JSC::NameInstance::destroy):
11324 * runtime/RegExp.cpp:
11325 (JSC::RegExp::destroy):
11326 * runtime/RegExpConstructor.cpp:
11327 (JSC::RegExpConstructor::destroy):
11328 * runtime/Structure.cpp:
11329 (JSC::Structure::destroy):
11330 * runtime/StructureChain.cpp:
11331 (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
11332 jsCast does Structure-based validation, and our Structure is not guaranteed
11333 to be alive when we get finalized.
11334
fpizlo@apple.com7e0f6502012-05-25 22:45:57 +0000[diff] [blame]113352012-05-22 Filip Pizlo <fpizlo@apple.com>
11336
fpizlo@apple.com190f5252012-05-25 23:00:26 +0000[diff] [blame]11337 DFG CSE should eliminate redundant WeakJSConstants
11338 https://bugs.webkit.org/show_bug.cgi?id=87179
11339
11340 Reviewed by Gavin Barraclough.
11341
11342 Merged r118141 from dfgopt.
11343
11344 * dfg/DFGCSEPhase.cpp:
11345 (JSC::DFG::CSEPhase::weakConstantCSE):
11346 (CSEPhase):
11347 (JSC::DFG::CSEPhase::performNodeCSE):
11348 * dfg/DFGNode.h:
11349 (JSC::DFG::Node::weakConstant):
11350
113512012-05-22 Filip Pizlo <fpizlo@apple.com>
11352
fpizlo@apple.com7e0f6502012-05-25 22:45:57 +0000[diff] [blame]11353 DFG CSE should do redundant store elimination
11354 https://bugs.webkit.org/show_bug.cgi?id=87161
11355
11356 Reviewed by Oliver Hunt.
11357
11358 Merge r118138 from dfgopt.
11359
11360 This patch adds redundant store elimination. For example, consider this
11361 code:
11362
11363 o.x = 42;
11364 o.x = 84;
11365
11366 If o.x is speculated to be a well-behaved field, the first assignment is
11367 unnecessary, since the second just overwrites it. We would like to
11368 eliminate the first assignment in these cases. The need for this
11369 optimization arises mostly from stores that our runtime requires. For
11370 example:
11371
11372 o = {f:1, g:2, h:3};
11373
11374 This will have four assignments to the structure for the newly created
11375 object - one assignment for the empty structure, one for {f}, one for
11376 {f, g}, and one for {f, g, h}. We would like to only have the last of
11377 those assigments in this case.
11378
11379 Intriguingly, doing so for captured variables breaks the way arguments
11380 simplification used to work. Consider that prior to either arguments
11381 simplification or store elimination we will have IR that looks like:
11382
11383 a: SetLocal(r0, Empty)
11384 b: SetLocal(r1, Empty)
11385 c: GetLocal(r0)
11386 d: CreateArguments(@c)
11387 e: SetLocal(r0, @d)
11388 f: SetLocal(r1, @d)
11389
11390 Then redundant store elimination will eliminate the stores that
11391 initialize the arguments registers to Empty, but then arguments
11392 simplification eliminates the stores that initialize the arguments to
11393 the newly created arguments - and at this point we no longer have any
11394 stores to the arguments register, leading to hilarious crashes. This
11395 patch therefore changes arguments simplification to replace
11396 CreateArguments with JSConstant(Empty) rather than eliminating the
11397 SetLocals. But this revealed bugs where arguments simplification was
11398 being overzealous, so I fixed those bugs.
11399
11400 This is a minor speed-up on V8/early and a handful of other tests.
11401
11402 * bytecode/CodeBlock.h:
11403 (JSC::CodeBlock::uncheckedActivationRegister):
11404 * dfg/DFGAbstractState.cpp:
11405 (JSC::DFG::AbstractState::execute):
11406 * dfg/DFGArgumentsSimplificationPhase.cpp:
11407 (JSC::DFG::ArgumentsSimplificationPhase::run):
11408 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
11409 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
11410 (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
11411 * dfg/DFGCSEPhase.cpp:
11412 (JSC::DFG::CSEPhase::globalVarStoreElimination):
11413 (CSEPhase):
11414 (JSC::DFG::CSEPhase::putStructureStoreElimination):
11415 (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
11416 (JSC::DFG::CSEPhase::setLocalStoreElimination):
11417 (JSC::DFG::CSEPhase::setReplacement):
11418 (JSC::DFG::CSEPhase::eliminate):
11419 (JSC::DFG::CSEPhase::performNodeCSE):
11420 * dfg/DFGGraph.h:
11421 (JSC::DFG::Graph::uncheckedActivationRegisterFor):
11422 (Graph):
11423 * dfg/DFGNode.h:
11424 (JSC::DFG::Node::isPhantomArguments):
11425 (Node):
11426 (JSC::DFG::Node::hasConstant):
11427 (JSC::DFG::Node::valueOfJSConstant):
11428 (JSC::DFG::Node::hasStructureTransitionData):
11429 * dfg/DFGNodeType.h:
11430 (DFG):
11431 * dfg/DFGPredictionPropagationPhase.cpp:
11432 (JSC::DFG::PredictionPropagationPhase::propagate):
11433 * dfg/DFGSpeculativeJIT.cpp:
11434 (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
11435 * dfg/DFGSpeculativeJIT32_64.cpp:
11436 (JSC::DFG::SpeculativeJIT::compile):
11437 * dfg/DFGSpeculativeJIT64.cpp:
11438 (JSC::DFG::SpeculativeJIT::compile):
11439
fpizlo@apple.com016fd682012-05-25 20:19:55 +0000[diff] [blame]114402012-05-21 Filip Pizlo <fpizlo@apple.com>
11441
11442 DFG ConvertThis should just be a CheckStructure if the structure is known
11443 https://bugs.webkit.org/show_bug.cgi?id=87057
11444
11445 Reviewed by Gavin Barraclough.
11446
11447 Merged r118021 from dfgopt.
11448
11449 This gives ValueProfile the ability to track singleton values - i.e. profiling
11450 sites that always see the same value.
11451
11452 That is then used to profile the structure in op_convert_this.
11453
11454 This is then used to optimize op_convert_this into a CheckStructure if the
11455 structure is always the same.
11456
11457 That then results in better CSE in inlined code that uses 'this', since
11458 previously we couldn't CSE accesses on 'this' from different inline call frames.
11459
11460 Also fixed a bug where we were unnecessarily flushing 'this'.
11461
11462 * bytecode/CodeBlock.cpp:
11463 (JSC::CodeBlock::dump):
11464 (JSC::CodeBlock::stronglyVisitStrongReferences):
11465 * bytecode/LazyOperandValueProfile.cpp:
11466 (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
11467 * bytecode/LazyOperandValueProfile.h:
11468 (CompressedLazyOperandValueProfileHolder):
11469 * bytecode/Opcode.h:
11470 (JSC):
11471 (JSC::padOpcodeName):
11472 * bytecode/ValueProfile.h:
11473 (JSC::ValueProfileBase::ValueProfileBase):
11474 (JSC::ValueProfileBase::dump):
11475 (JSC::ValueProfileBase::computeUpdatedPrediction):
11476 (ValueProfileBase):
11477 * bytecompiler/BytecodeGenerator.cpp:
11478 (JSC::BytecodeGenerator::BytecodeGenerator):
11479 * dfg/DFGByteCodeParser.cpp:
11480 (JSC::DFG::ByteCodeParser::setArgument):
11481 (JSC::DFG::ByteCodeParser::parseBlock):
11482 * jit/JITOpcodes.cpp:
11483 (JSC::JIT::emit_op_convert_this):
11484 (JSC::JIT::emitSlow_op_convert_this):
11485 * jit/JITOpcodes32_64.cpp:
11486 (JSC::JIT::emit_op_convert_this):
11487 (JSC::JIT::emitSlow_op_convert_this):
11488 * llint/LLIntSlowPaths.cpp:
11489 (JSC::LLInt::LLINT_SLOW_PATH_DECL):
11490 * llint/LowLevelInterpreter32_64.asm:
11491 * llint/LowLevelInterpreter64.asm:
11492 * runtime/JSValue.h:
11493 (JSValue):
11494 * runtime/Structure.h:
11495 (JSC::JSValue::structureOrUndefined):
11496 (JSC):
11497
timothy_horton@apple.com3f03ac12012-05-25 06:53:27 +0000[diff] [blame]114982012-05-24 Tim Horton <timothy_horton@apple.com>
11499
11500 Add feature defines for web-facing parts of CSS Regions and Exclusions
11501 https://bugs.webkit.org/show_bug.cgi?id=87442
11502 <rdar://problem/10887709>
11503
11504 Reviewed by Dan Bernstein.
11505
11506 * Configurations/FeatureDefines.xcconfig:
11507
ggaren@apple.com9e1789f2012-05-25 06:52:00 +0000[diff] [blame]115082012-05-24 Geoffrey Garen <ggaren@apple.com>
11509
11510 WebKit should be lazy-finalization-safe (esp. the DOM)
11511 https://bugs.webkit.org/show_bug.cgi?id=87456
11512
11513 Reviewed by Filip Pizlo.
11514
11515 Lazy finalization adds one twist to weak pointer use:
11516
11517 A HashMap of weak pointers may contain logically null entries.
11518 (Weak pointers behave as-if null once their payloads die.)
11519 Insertion must not assume that a pre-existing entry is
11520 necessarily valid, and iteration must not assume that all
11521 entries can be dereferenced.
11522
11523 (Previously, I thought that it also added a second twist:
11524
11525 A demand-allocated weak pointer may replace a dead payload
11526 before the payload's finalizer runs. In that case, when the
11527 payload's finalizer runs, the payload has already been
11528 overwritten, and the finalizer should not clear the payload,
11529 which now points to something new.
11530
11531 But that's not the case here, since we cancel the old payload's
11532 finalizer when we over-write it. I've added ASSERTs to verify this
11533 assumption, in case it ever changes.)
11534
11535 * API/JSClassRef.cpp:
11536 (OpaqueJSClass::prototype): No need to specify null; that's the default.
11537
11538 * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
11539
11540 * heap/PassWeak.h:
11541 (WeakImplAccessor::was): This is no longer a debug-only function, since
11542 it's required to reason about lazily finalized pointers.
11543
11544 * heap/Weak.h:
11545 (JSC::weakAdd):
11546 (JSC::weakRemove):
11547 (JSC::weakClear): Added these helper functions for the common idioms of
11548 what clients want to do in their weak pointer finalizers.
11549
11550 * jit/JITStubs.cpp:
11551 (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
11552 would return NULL for a "zombie" executable weak pointer that was waiting
11553 for finalization (item (2)), and finalizing a dead executable weak pointer
11554 would potentially destroy a new, live one (item (1)).
11555
11556 * runtime/RegExpCache.cpp:
11557 (JSC::RegExpCache::lookupOrCreate):
11558 (JSC::RegExpCache::finalize): Ditto.
11559
11560 (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
11561 item (2).)
11562
11563 * runtime/Structure.cpp:
11564 (JSC::StructureTransitionTable::contains):
11565 (JSC::StructureTransitionTable::add): Use get and set instead of add and
11566 contains, since add and contains are not compatible with lazy finalization.
11567
11568 * runtime/WeakGCMap.h:
11569 (WeakGCMap):
11570 (JSC::WeakGCMap::clear):
11571 (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
11572 lazy finalization because I didn't feel like making it compatible, and I had
11573 no way to test it.
11574
fpizlo@apple.com0b9b37a2012-05-25 03:29:18 +0000[diff] [blame]115752012-05-24 Filip Pizlo <fpizlo@apple.com>
11576
fpizlo@apple.com9d899a42012-05-25 05:41:03 +0000[diff] [blame]11577 REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
11578 https://bugs.webkit.org/show_bug.cgi?id=87327
11579
11580 Reviewed by Geoffrey Garen.
11581
11582 If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
11583 set containing >=2 elements, you're going to have a bad time.
11584
11585 That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
11586 to save space and speed up convergence. So filtering has no effect in this case, which made
11587 the code think that the abstract value was proving that the structure check was unnecessary.
11588 The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
11589 right thingies for TOP and >=2 elements.
11590
11591 * dfg/DFGAbstractState.cpp:
11592 (JSC::DFG::AbstractState::execute):
11593 * dfg/DFGSpeculativeJIT32_64.cpp:
11594 (JSC::DFG::SpeculativeJIT::compile):
11595 * dfg/DFGSpeculativeJIT64.cpp:
11596 (JSC::DFG::SpeculativeJIT::compile):
11597
115982012-05-24 Filip Pizlo <fpizlo@apple.com>
11599
fpizlo@apple.com0b9b37a2012-05-25 03:29:18 +0000[diff] [blame]11600 new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
11601 https://bugs.webkit.org/show_bug.cgi?id=87378
11602
11603 Reviewed by Gavin Barraclough.
11604
11605 - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
11606 badness.
11607
11608 - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
11609
11610 * dfg/DFGByteCodeParser.cpp:
11611 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
11612 * dfg/DFGCSEPhase.cpp:
11613 (JSC::DFG::CSEPhase::CSEPhase):
11614 (CSEPhase):
11615 (JSC::DFG::performCSE):
11616 * dfg/DFGCSEPhase.h:
11617 (DFG):
11618 * dfg/DFGCommon.h:
11619 * dfg/DFGDriver.cpp:
11620 (JSC::DFG::compile):
11621 * dfg/DFGGraph.cpp:
11622 (JSC::DFG::Graph::resetExitStates):
11623 (DFG):
11624 * dfg/DFGGraph.h:
11625 (Graph):
11626 * dfg/DFGPhase.h:
11627 (DFG):
11628 (JSC::DFG::runPhase):
11629
ggaren@apple.com39281e22012-05-24 21:18:10 +0000[diff] [blame]116302012-05-24 Geoffrey Garen <ggaren@apple.com>
11631
11632 Made WeakSet per-block instead of per-heap
11633 https://bugs.webkit.org/show_bug.cgi?id=87401
11634
11635 Reviewed by Oliver Hunt.
11636
11637 This allows us fast access to the set of all weak pointers for a block,
11638 which is a step toward lazy finalization.
11639
11640 No performance change.
11641
11642 * heap/Heap.cpp:
11643 (JSC::Heap::Heap):
11644 (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
11645 it's per-block now.
11646
11647 (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
11648 since it knows how to iterate all blocks.
11649
11650 (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
11651 doesn't mark anything.
11652
11653 Make sure to reset allocators after shrinking, since shrinking may
11654 deallocate the current allocator.
11655
11656 * heap/Heap.h:
11657 (Heap): No more per-heap weak set, since it's per-block now.
11658
11659 * heap/MarkedBlock.cpp:
11660 (JSC::MarkedBlock::MarkedBlock):
11661 * heap/MarkedBlock.h:
11662 (MarkedBlock):
11663 (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
11664 here from the heap, so the heap doesn't need to know about our internal
11665 data structures like our weak set.
11666
11667 (JSC::MarkedBlock::heap):
11668 (JSC::MarkedBlock::weakSet):
11669 (JSC::MarkedBlock::shrink):
11670 (JSC::MarkedBlock::resetAllocator):
11671 (JSC::MarkedBlock::visitWeakSet):
11672 (JSC::MarkedBlock::reapWeakSet):
11673 (JSC::MarkedBlock::sweepWeakSet):
11674 * heap/MarkedSpace.cpp:
11675 (JSC::VisitWeakSet::VisitWeakSet):
11676 (JSC::VisitWeakSet::operator()):
11677 (VisitWeakSet):
11678 (JSC):
11679 (JSC::ReapWeakSet::operator()):
11680 (JSC::SweepWeakSet::operator()):
11681 (JSC::LastChanceToFinalize::operator()):
11682 (JSC::MarkedSpace::lastChanceToFinalize):
11683 (JSC::ResetAllocator::operator()):
11684 (JSC::MarkedSpace::resetAllocators):
11685 (JSC::MarkedSpace::visitWeakSets):
11686 (JSC::MarkedSpace::reapWeakSets):
11687 (JSC::MarkedSpace::sweepWeakSets):
11688 (JSC::Shrink::operator()):
11689 (JSC::MarkedSpace::shrink):
11690 * heap/MarkedSpace.h:
11691 (MarkedSpace): Make sure to account for our weak sets when sweeping,
11692 shrinking, etc.
11693
11694 * heap/WeakSet.cpp:
11695 (JSC):
11696 * heap/WeakSet.h:
11697 (WeakSet):
11698 (JSC::WeakSet::heap):
11699 (JSC):
11700 (JSC::WeakSet::lastChanceToFinalize):
11701 (JSC::WeakSet::visit):
11702 (JSC::WeakSet::reap):
11703 (JSC::WeakSet::shrink):
11704 (JSC::WeakSet::resetAllocator): Inlined some things since they're called
11705 once per block now instead of once per heap.
11706
11707 * heap/WeakSetInlines.h:
11708 (JSC::WeakSet::allocate): Use the per-block weak set since there is no
11709 per-heap weak set anymore.
11710
barraclough@apple.comefdbf472012-05-24 21:14:07 +0000[diff] [blame]117112012-05-24 Gavin Barraclough <barraclough@apple.com>
11712
barraclough@apple.com8ca6a7a2012-05-24 21:17:38 +0000[diff] [blame]11713 Fix arm build
11714
11715 Rubber stamped by Geoff Garen
11716
11717 * dfg/DFGGPRInfo.h:
11718 (GPRInfo):
11719
117202012-05-24 Gavin Barraclough <barraclough@apple.com>
11721
barraclough@apple.comefdbf472012-05-24 21:14:07 +0000[diff] [blame]11722 Move cacheFlush from ExecutableAllocator to Assembler classes
11723 https://bugs.webkit.org/show_bug.cgi?id=87420
11724
11725 Reviewed by Oliver Hunt.
11726
11727 Makes more sense there, & remove a pile of #ifdefs.
11728
11729 * assembler/ARMAssembler.cpp:
11730 (JSC):
11731 (JSC::ARMAssembler::cacheFlush):
11732 * assembler/ARMAssembler.h:
11733 (ARMAssembler):
11734 (JSC::ARMAssembler::cacheFlush):
11735 * assembler/ARMv7Assembler.h:
11736 (JSC::ARMv7Assembler::relinkJump):
11737 (JSC::ARMv7Assembler::cacheFlush):
11738 (ARMv7Assembler):
11739 (JSC::ARMv7Assembler::setInt32):
11740 (JSC::ARMv7Assembler::setUInt7ForLoad):
11741 * assembler/AbstractMacroAssembler.h:
11742 (JSC::AbstractMacroAssembler::cacheFlush):
11743 * assembler/LinkBuffer.h:
11744 (JSC::LinkBuffer::performFinalization):
11745 * assembler/MIPSAssembler.h:
11746 (JSC::MIPSAssembler::relinkJump):
11747 (JSC::MIPSAssembler::relinkCall):
11748 (JSC::MIPSAssembler::repatchInt32):
11749 (JSC::MIPSAssembler::cacheFlush):
11750 (MIPSAssembler):
11751 * assembler/SH4Assembler.h:
11752 (JSC::SH4Assembler::repatchCompact):
11753 (JSC::SH4Assembler::cacheFlush):
11754 (SH4Assembler):
11755 * assembler/X86Assembler.h:
11756 (X86Assembler):
11757 (JSC::X86Assembler::cacheFlush):
11758 * jit/ExecutableAllocator.cpp:
11759 (JSC):
11760 * jit/ExecutableAllocator.h:
11761 (ExecutableAllocator):
11762
commit-queue@webkit.org2c8bcde2012-05-24 20:01:53 +0000[diff] [blame]117632012-05-24 John Mellor <johnme@chromium.org>
11764
11765 Font Boosting: Add compile flag and runtime setting
11766 https://bugs.webkit.org/show_bug.cgi?id=87394
11767
11768 Reviewed by Adam Barth.
11769
11770 Add ENABLE_FONT_BOOSTING.
11771
11772 * Configurations/FeatureDefines.xcconfig:
11773
commit-queue@webkit.orgd553c622012-05-24 10:50:40 +0000[diff] [blame]117742012-05-24 Allan Sandfeld Jensen <allan.jensen@nokia.com>
11775
11776 cti_vm_throw gets kicked out by gcc 4.6 -flto
11777 https://bugs.webkit.org/show_bug.cgi?id=56088
11778
11779 Reviewed by Darin Adler.
11780
11781 Add REFERENCED_FROM_ASM to functions only referenced from assembler.
11782
11783 * dfg/DFGOperations.cpp:
11784 * jit/HostCallReturnValue.h:
11785 * jit/JITStubs.h:
11786 * jit/ThunkGenerators.cpp:
11787
fpizlo@apple.com36f14462012-05-24 07:35:05 +0000[diff] [blame]117882012-05-24 Filip Pizlo <fpizlo@apple.com>
11789
11790 Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
11791 https://bugs.webkit.org/show_bug.cgi?id=87350
11792
11793 Reviewed by Maciej Stachowiak.
11794
11795 The dfgopt branch introduced the notion of a local variable being killed because it was aliased
11796 to the Arguments object as in cases like:
11797
11798 var a = arguments;
11799 return a.length;
11800
11801 This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
11802 OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
11803 dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
11804 ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
11805 them as variables that need arguments reification.
11806
11807 This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
11808 end up being treated as reified arguments objects, while variables that are dead but not aliased to
11809 arguments are treated as tip of tree would have treated them (initialize to Undefined).
11810
11811 * dfg/DFGSpeculativeJIT.cpp:
11812 (JSC::DFG::SpeculativeJIT::compile):
11813
ossy@webkit.orgbc0d6372012-05-24 07:05:31 +0000[diff] [blame]118142012-05-24 Csaba Osztrogonác <ossy@webkit.org>
11815
11816 Unreviewed 32 bit buildfix after r118325.
11817
11818 * dfg/DFGSpeculativeJIT32_64.cpp:
11819 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
11820
fpizlo@apple.comd96eb4e2012-05-24 06:58:52 +0000[diff] [blame]118212012-05-23 Filip Pizlo <fpizlo@apple.com>
11822
fpizlo@apple.comb3ac2422012-05-24 07:00:24 +0000[diff] [blame]11823 DFG operationTearOffActivation should return after handling the null activation case
11824 https://bugs.webkit.org/show_bug.cgi?id=87348
11825 <rdar://problem/11522295>
11826
11827 Reviewed by Oliver Hunt.
11828
11829 * dfg/DFGOperations.cpp:
11830
118312012-05-23 Filip Pizlo <fpizlo@apple.com>
11832
fpizlo@apple.comd96eb4e2012-05-24 06:58:52 +0000[diff] [blame]11833 Unreviewed, merge the arguments fix in r118138 to get bots green.
11834
11835 * dfg/DFGArgumentsSimplificationPhase.cpp:
11836 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
11837
fpizlo@apple.comb9c94622012-05-24 05:51:05 +0000[diff] [blame]118382012-05-20 Filip Pizlo <fpizlo@apple.com>
11839
fpizlo@apple.com91b2c682012-05-24 06:24:36 +0000[diff] [blame]11840 DFG CFA should record if a node can OSR exit
11841 https://bugs.webkit.org/show_bug.cgi?id=86905
11842
11843 Reviewed by Oliver Hunt.
11844
11845 Merged r117931 from dfgopt.
11846
11847 Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
11848 This ought to aid any backwards analyses that need to know when a
11849 backward flow merge might happen due to a side exit.
11850
11851 Also added assertions into speculationCheck() that ensure that we did not
11852 mark a node as non-exiting and then promptly compile in an exit. This
11853 helped catch some minor bugs where we were doing unnecessary speculation
11854 checks.
11855
11856 This is a perf-neutral change. The speculation checks that this removes
11857 were not on hot paths of major benchmarks.
11858
11859 * bytecode/PredictedType.h:
11860 (JSC):
11861 (JSC::isAnyPrediction):
11862 * dfg/DFGAbstractState.cpp:
11863 (JSC::DFG::AbstractState::execute):
11864 * dfg/DFGAbstractState.h:
11865 (JSC::DFG::AbstractState::speculateInt32Unary):
11866 (AbstractState):
11867 (JSC::DFG::AbstractState::speculateNumberUnary):
11868 (JSC::DFG::AbstractState::speculateBooleanUnary):
11869 (JSC::DFG::AbstractState::speculateInt32Binary):
11870 (JSC::DFG::AbstractState::speculateNumberBinary):
11871 * dfg/DFGNode.h:
11872 (JSC::DFG::Node::mergeFlags):
11873 (JSC::DFG::Node::filterFlags):
11874 (Node):
11875 (JSC::DFG::Node::setCanExit):
11876 (JSC::DFG::Node::canExit):
11877 * dfg/DFGNodeFlags.cpp:
11878 (JSC::DFG::nodeFlagsAsString):
11879 * dfg/DFGNodeFlags.h:
11880 (DFG):
11881 * dfg/DFGSpeculativeJIT.cpp:
11882 (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
11883 (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
11884 (JSC::DFG::SpeculativeJIT::compileValueToInt32):
11885 * dfg/DFGSpeculativeJIT.h:
11886 (JSC::DFG::SpeculativeJIT::speculationCheck):
11887 (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
11888 (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
11889 (SpeculativeJIT):
11890 * dfg/DFGSpeculativeJIT32_64.cpp:
11891 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
11892 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
11893 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
11894 (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
11895 (JSC::DFG::SpeculativeJIT::compile):
11896 * dfg/DFGSpeculativeJIT64.cpp:
11897 (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
11898 (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
11899 (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
11900 (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
11901 (JSC::DFG::SpeculativeJIT::compile):
11902
119032012-05-20 Filip Pizlo <fpizlo@apple.com>
11904
fpizlo@apple.comb9c94622012-05-24 05:51:05 +0000[diff] [blame]11905 DFG should not do unnecessary indirections when storing to objects
11906 https://bugs.webkit.org/show_bug.cgi?id=86959
11907
11908 Reviewed by Oliver Hunt.
11909
11910 Merged r117819 from dfgopt.
11911
11912 * dfg/DFGByteCodeParser.cpp:
11913 (JSC::DFG::ByteCodeParser::parseBlock):
11914 * dfg/DFGCSEPhase.cpp:
11915 (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
11916 * dfg/DFGSpeculativeJIT32_64.cpp:
11917 (JSC::DFG::SpeculativeJIT::compile):
11918 * dfg/DFGSpeculativeJIT64.cpp:
11919 (JSC::DFG::SpeculativeJIT::compile):
11920
fpizlo@apple.com9a548f12012-05-24 05:33:09 +0000[diff] [blame]119212012-05-17 Filip Pizlo <fpizlo@apple.com>
11922
11923 DFG should optimize aliased uses of the Arguments object of the current call frame
11924 https://bugs.webkit.org/show_bug.cgi?id=86552
11925
11926 Reviewed by Geoff Garen.
11927
11928 Merged r117542 and r117543 from dfgopt.
11929
11930 Performs must-alias and escape analysis on uses of CreateArguments, and if
11931 a variable is must-aliased to CreateArguments and does not escape, then we
11932 turn all uses of that variable into direct arguments accesses.
11933
11934 36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
11935
11936 * bytecode/CodeBlock.h:
11937 (JSC::CodeBlock::uncheckedArgumentsRegister):
11938 * bytecode/ValueRecovery.h:
11939 (JSC::ValueRecovery::argumentsThatWereNotCreated):
11940 (ValueRecovery):
11941 (JSC::ValueRecovery::dump):
11942 * dfg/DFGAbstractState.cpp:
11943 (JSC::DFG::AbstractState::execute):
11944 * dfg/DFGAdjacencyList.h:
11945 (AdjacencyList):
11946 (JSC::DFG::AdjacencyList::removeEdgeFromBag):
11947 * dfg/DFGArgumentsSimplificationPhase.cpp:
11948 (JSC::DFG::ArgumentsSimplificationPhase::run):
11949 (ArgumentsSimplificationPhase):
11950 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
11951 (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
11952 (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
11953 (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
11954 (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
11955 * dfg/DFGAssemblyHelpers.h:
11956 (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
11957 (AssemblyHelpers):
11958 * dfg/DFGByteCodeParser.cpp:
11959 (JSC::DFG::ByteCodeParser::parseBlock):
11960 * dfg/DFGCFGSimplificationPhase.cpp:
11961 (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
11962 * dfg/DFGGPRInfo.h:
11963 (GPRInfo):
11964 * dfg/DFGGraph.cpp:
11965 (JSC::DFG::Graph::collectGarbage):
11966 (DFG):
11967 * dfg/DFGGraph.h:
11968 (Graph):
11969 (JSC::DFG::Graph::executableFor):
11970 (JSC::DFG::Graph::argumentsRegisterFor):
11971 (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
11972 (JSC::DFG::Graph::clobbersWorld):
11973 * dfg/DFGNode.h:
11974 (JSC::DFG::Node::hasHeapPrediction):
11975 * dfg/DFGNodeType.h:
11976 (DFG):
11977 * dfg/DFGOSRExitCompiler.cpp:
11978 * dfg/DFGOSRExitCompiler.h:
11979 (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
11980 (OSRExitCompiler):
11981 * dfg/DFGOSRExitCompiler32_64.cpp:
11982 (JSC::DFG::OSRExitCompiler::compileExit):
11983 * dfg/DFGOSRExitCompiler64.cpp:
11984 (JSC::DFG::OSRExitCompiler::compileExit):
11985 * dfg/DFGOperations.cpp:
11986 * dfg/DFGPredictionPropagationPhase.cpp:
11987 (JSC::DFG::PredictionPropagationPhase::propagate):
11988 * dfg/DFGSpeculativeJIT.cpp:
11989 (JSC::DFG::ValueSource::dump):
11990 (JSC::DFG::SpeculativeJIT::compile):
11991 (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
11992 * dfg/DFGSpeculativeJIT.h:
11993 * dfg/DFGSpeculativeJIT32_64.cpp:
11994 (JSC::DFG::SpeculativeJIT::compile):
11995 * dfg/DFGSpeculativeJIT64.cpp:
11996 (JSC::DFG::SpeculativeJIT::compile):
11997 * dfg/DFGVariableAccessData.h:
11998 (JSC::DFG::VariableAccessData::VariableAccessData):
11999 (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
12000 (VariableAccessData):
12001 (JSC::DFG::VariableAccessData::isArgumentsAlias):
12002 * jit/JITOpcodes.cpp:
12003 (JSC::JIT::emitSlow_op_get_argument_by_val):
12004
fpizlo@apple.comdb7ba192012-05-24 02:28:52 +0000[diff] [blame]120052012-05-23 Filip Pizlo <fpizlo@apple.com>
12006
fpizlo@apple.comae3413b2012-05-24 02:34:09 +0000[diff] [blame]12007 DFGCapabilities should not try to get an arguments register from code blocks that don't have one
12008 https://bugs.webkit.org/show_bug.cgi?id=87332
12009
12010 Reviewed by Andy Estes.
12011
12012 * dfg/DFGCapabilities.h:
12013 (JSC::DFG::canInlineOpcode):
12014
120152012-05-23 Filip Pizlo <fpizlo@apple.com>
12016
fpizlo@apple.comdb7ba192012-05-24 02:28:52 +0000[diff] [blame]12017 DFG should have sparse conditional constant propagation
12018 https://bugs.webkit.org/show_bug.cgi?id=86580
12019
12020 Reviewed by Oliver Hunt.
12021
12022 Merged r117370 from dfgopt.
12023
12024 This enhances CFA so that if it suspects at any point during the fixpoint that a
12025 branch will only go one way, then it only propagates in that one way.
12026
12027 This vastly increases the opportunities for CFG simplification. For example, it
12028 enables us to evaporate this loop:
12029
12030 for (var i = 0; i < 1; ++i) doThings(i);
12031
12032 As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
12033
12034 - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
12035 That's not true; we also fixup Phis that are dead.
12036
12037 - GetLocal fixup was assuming that it's only necessary to rewire links to a
12038 GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
12039 because the GetLocal may not be rewirable (first block has no GetLocal for r42
12040 but second block does have a GetLocal), in which case it will refer to a Phi
12041 in the second block. We need it to refer to a Phi from the first block to
12042 ensure that subsequent transformations work.
12043
12044 - Tail operand fixup was ignoring the fact that Phis in successors may contain
12045 references to the children of our tail variables. Hence, successor Phi child
12046 substitution needs to use the original second block variable table as its
12047 prior, rather than trying to reconstruct the prior later (since by that point
12048 the children of the second block's tail variables will have been fixed up, so
12049 we will not know what the prior would have been).
12050
12051 * dfg/DFGAbstractState.cpp:
12052 (JSC::DFG::AbstractState::beginBasicBlock):
12053 (JSC::DFG::AbstractState::endBasicBlock):
12054 (JSC::DFG::AbstractState::reset):
12055 (JSC::DFG::AbstractState::execute):
12056 (JSC::DFG::AbstractState::mergeToSuccessors):
12057 * dfg/DFGAbstractState.h:
12058 (JSC::DFG::AbstractState::branchDirectionToString):
12059 (AbstractState):
12060 * dfg/DFGCFGSimplificationPhase.cpp:
12061 (JSC::DFG::CFGSimplificationPhase::run):
12062 (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
12063 (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
12064 (OperandSubstitution):
12065 (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
12066 (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
12067 (CFGSimplificationPhase):
12068 (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
12069 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
12070 * dfg/DFGGraph.h:
12071 (JSC::DFG::Graph::changeEdge):
12072
ojan@chromium.org959e4a22012-05-24 02:03:04 +0000[diff] [blame]120732012-05-23 Ojan Vafai <ojan@chromium.org>
12074
12075 add back the ability to disable flexbox
12076 https://bugs.webkit.org/show_bug.cgi?id=87147
12077
12078 Reviewed by Tony Chang.
12079
12080 * Configurations/FeatureDefines.xcconfig:
12081
fpizlo@apple.com9b928722012-05-24 00:18:55 +0000[diff] [blame]120822012-05-23 Filip Pizlo <fpizlo@apple.com>
12083
fpizlo@apple.com16faaea2012-05-24 01:04:55 +0000[diff] [blame]12084 Unreviewed, fix Windows build.
12085
12086 * bytecode/CodeBlock.h:
12087 * dfg/DFGCapabilities.h:
12088 (JSC::DFG::canCompileOpcode):
12089 (JSC::DFG::canCompileOpcodes):
12090 * dfg/DFGCommon.h:
12091 (DFG):
12092
120932012-05-23 Filip Pizlo <fpizlo@apple.com>
12094
fpizlo@apple.com9b928722012-05-24 00:18:55 +0000[diff] [blame]12095 DFG should optimize inlined uses of arguments.length and arguments[i]
12096 https://bugs.webkit.org/show_bug.cgi?id=86327
12097
12098 Reviewed by Gavin Barraclough.
12099
12100 Merged r117017 from dfgopt.
12101
12102 Turns inlined uses of arguments.length into a constant.
12103
12104 Turns inlined uses of arguments[constant] into a direct reference to the
12105 argument.
12106
12107 Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
12108 arguments.length and arguments[i] are aliased. I'll leave the aliasing
12109 optimizations to a later patch.
12110
12111 * CMakeLists.txt:
12112 * GNUmakefile.list.am:
12113 * JavaScriptCore.xcodeproj/project.pbxproj:
12114 * Target.pri:
12115 * bytecode/DFGExitProfile.h:
12116 (FrequentExitSite):
12117 (JSC::DFG::FrequentExitSite::FrequentExitSite):
12118 (JSC::DFG::QueryableExitProfile::hasExitSite):
12119 (QueryableExitProfile):
12120 * dfg/DFGAbstractState.cpp:
12121 (JSC::DFG::AbstractState::execute):
12122 * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
12123 (DFG):
12124 (ArgumentsSimplificationPhase):
12125 (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
12126 (JSC::DFG::ArgumentsSimplificationPhase::run):
12127 (JSC::DFG::performArgumentsSimplification):
12128 * dfg/DFGArgumentsSimplificationPhase.h: Added.
12129 (DFG):
12130 * dfg/DFGAssemblyHelpers.cpp:
12131 (JSC::DFG::AssemblyHelpers::executableFor):
12132 (DFG):
12133 * dfg/DFGAssemblyHelpers.h:
12134 (AssemblyHelpers):
12135 * dfg/DFGByteCodeParser.cpp:
12136 (JSC::DFG::ByteCodeParser::parseBlock):
12137 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
12138 * dfg/DFGCSEPhase.cpp:
12139 (JSC::DFG::CSEPhase::getLocalLoadElimination):
12140 (JSC::DFG::CSEPhase::performNodeCSE):
12141 * dfg/DFGDriver.cpp:
12142 (JSC::DFG::compile):
12143 * dfg/DFGGraph.h:
12144 (JSC::DFG::Graph::Graph):
12145 (JSC::DFG::Graph::executableFor):
12146 (Graph):
12147 (JSC::DFG::Graph::clobbersWorld):
12148 * dfg/DFGNode.h:
12149 (JSC::DFG::Node::convertToConstant):
12150 (JSC::DFG::Node::convertToGetLocalUnlinked):
12151 (Node):
12152 (JSC::DFG::Node::unlinkedLocal):
12153 * dfg/DFGNodeType.h:
12154 (DFG):
12155 * dfg/DFGOSRExit.cpp:
12156 (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
12157 * dfg/DFGPredictionPropagationPhase.cpp:
12158 (JSC::DFG::PredictionPropagationPhase::propagate):
12159 * dfg/DFGSpeculativeJIT32_64.cpp:
12160 (JSC::DFG::SpeculativeJIT::compile):
12161 * dfg/DFGSpeculativeJIT64.cpp:
12162 (JSC::DFG::SpeculativeJIT::compile):
12163
fpizlo@apple.com5e3852d2012-05-24 00:05:21 +0000[diff] [blame]121642012-05-13 Filip Pizlo <fpizlo@apple.com>
12165
12166 DFG should be able to optimize foo.apply(bar, arguments)
12167 https://bugs.webkit.org/show_bug.cgi?id=86306
12168
12169 Reviewed by Gavin Barraclough.
12170
12171 Merge r116912 from dfgopt.
12172
12173 Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
12174
12175 Also includes a bunch of bug fixes that were made necessary by the increased
12176 pressure on the CFG simplifier.
12177
12178 This is a 1-2% win on V8.
12179
12180 * bytecode/CodeBlock.cpp:
12181 (JSC::CodeBlock::printCallOp):
12182 (JSC::CodeBlock::CodeBlock):
12183 (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
12184 (JSC::EvalCodeBlock::canCompileWithDFGInternal):
12185 (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
12186 * bytecode/CodeBlock.h:
12187 (CodeBlock):
12188 (JSC::CodeBlock::canCompileWithDFG):
12189 (JSC::CodeBlock::canCompileWithDFGState):
12190 (ProgramCodeBlock):
12191 (EvalCodeBlock):
12192 (FunctionCodeBlock):
12193 * dfg/DFGAbstractState.cpp:
12194 (JSC::DFG::AbstractState::execute):
12195 * dfg/DFGByteCodeParser.cpp:
12196 (JSC::DFG::ByteCodeParser::parseBlock):
12197 (JSC::DFG::ByteCodeParser::processPhiStack):
12198 (JSC::DFG::ByteCodeParser::parse):
12199 * dfg/DFGCFGSimplificationPhase.cpp:
12200 (JSC::DFG::CFGSimplificationPhase::run):
12201 (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
12202 (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
12203 (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
12204 * dfg/DFGCSEPhase.cpp:
12205 (JSC::DFG::CSEPhase::getLocalLoadElimination):
12206 (CSEPhase):
12207 (JSC::DFG::CSEPhase::setReplacement):
12208 (JSC::DFG::CSEPhase::performNodeCSE):
12209 * dfg/DFGCapabilities.cpp:
12210 (JSC::DFG::debugFail):
12211 (DFG):
12212 (JSC::DFG::canHandleOpcodes):
12213 (JSC::DFG::canCompileOpcodes):
12214 (JSC::DFG::canInlineOpcodes):
12215 * dfg/DFGCapabilities.h:
12216 (JSC::DFG::canCompileOpcode):
12217 (JSC::DFG::canInlineOpcode):
12218 (DFG):
12219 (JSC::DFG::canCompileOpcodes):
12220 (JSC::DFG::canCompileEval):
12221 (JSC::DFG::canCompileProgram):
12222 (JSC::DFG::canCompileFunctionForCall):
12223 (JSC::DFG::canCompileFunctionForConstruct):
12224 * dfg/DFGCommon.h:
12225 * dfg/DFGGraph.cpp:
12226 (JSC::DFG::Graph::dump):
12227 * dfg/DFGNodeType.h:
12228 (DFG):
12229 * dfg/DFGPredictionPropagationPhase.cpp:
12230 (JSC::DFG::PredictionPropagationPhase::propagate):
12231 * dfg/DFGSpeculativeJIT32_64.cpp:
12232 (JSC::DFG::SpeculativeJIT::compile):
12233 * dfg/DFGSpeculativeJIT64.cpp:
12234 (JSC::DFG::SpeculativeJIT::emitCall):
12235 (JSC::DFG::SpeculativeJIT::compile):
12236 * dfg/DFGValidate.cpp:
12237 (Validate):
12238 (JSC::DFG::Validate::validate):
12239 (JSC::DFG::Validate::checkOperand):
12240 (JSC::DFG::Validate::reportValidationContext):
12241 * jit/JIT.cpp:
12242 (JSC::JIT::emitOptimizationCheck):
12243 (JSC::JIT::privateCompileSlowCases):
12244 (JSC::JIT::privateCompile):
12245 * jit/JIT.h:
12246 * jit/JITArithmetic.cpp:
12247 (JSC::JIT::compileBinaryArithOp):
12248 * jit/JITPropertyAccess.cpp:
12249 (JSC::JIT::privateCompilePutByIdTransition):
12250 * jit/JITPropertyAccess32_64.cpp:
12251 (JSC::JIT::privateCompilePutByIdTransition):
12252 * tools/CodeProfile.cpp:
12253 (JSC::CodeProfile::sample):
12254
ggaren@apple.com7070d422012-05-23 23:55:27 +0000[diff] [blame]122552012-05-23 Geoffrey Garen <ggaren@apple.com>
12256
12257 Refactored WeakBlock to use malloc, clarify behavior
12258 https://bugs.webkit.org/show_bug.cgi?id=87318
12259
12260 Reviewed by Filip Pizlo.
12261
12262 We want to use malloc so we can make these smaller than 4KB,
12263 since an individual MarkedBlock will usually have fewer than
12264 4KB worth of weak pointers.
12265
12266 * heap/Heap.cpp:
12267 (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
12268 we no longer need to distinguish from "visitDeadWeakImpls".
12269
12270 Renamed "visitDeadWeakImpls" to "reap" because we're not actually
12271 doing any visiting -- we're just tagging things as dead.
12272
12273 * heap/WeakBlock.cpp:
12274 (JSC::WeakBlock::create):
12275 (JSC::WeakBlock::destroy):
12276 (JSC::WeakBlock::WeakBlock): Malloc!
12277
12278 (JSC::WeakBlock::visit):
12279 (JSC::WeakBlock::reap): Renamed as above.
12280
12281 * heap/WeakBlock.h:
12282 (WeakBlock): Reduced to 3KB, as explained above.
12283
12284 * heap/WeakSet.cpp:
12285 (JSC::WeakSet::visit):
12286 (JSC::WeakSet::reap):
12287 * heap/WeakSet.h:
12288 (WeakSet): Updated for renames, and to match WebKit style.
12289
fpizlo@apple.com11e2f372012-05-23 22:25:21 +0000[diff] [blame]122902012-05-23 Filip Pizlo <fpizlo@apple.com>
12291
fpizlo@apple.combc96e8f2012-05-23 23:12:59 +0000[diff] [blame]12292 Use after free in JSC::DFG::ByteCodeParser::processPhiStack
12293 https://bugs.webkit.org/show_bug.cgi?id=87312
12294 <rdar://problem/11518848>
12295
12296 Reviewed by Oliver Hunt.
12297
12298 * dfg/DFGByteCodeParser.cpp:
12299 (JSC::DFG::ByteCodeParser::processPhiStack):
12300 (JSC::DFG::ByteCodeParser::parse):
12301
123022012-05-23 Filip Pizlo <fpizlo@apple.com>
12303
fpizlo@apple.com11e2f372012-05-23 22:25:21 +0000[diff] [blame]12304 It should be possible to make C function calls from DFG code on ARM in debug mode
12305 https://bugs.webkit.org/show_bug.cgi?id=87313
12306
12307 Reviewed by Gavin Barraclough.
12308
12309 * dfg/DFGSpeculativeJIT.h:
12310 (SpeculativeJIT):
12311
fpizlo@apple.comc6446112012-05-23 20:52:42 +0000[diff] [blame]123122012-05-11 Filip Pizlo <fpizlo@apple.com>
12313
12314 DFG should be able to inline functions that use arguments reflectively
12315 https://bugs.webkit.org/show_bug.cgi?id=86132
12316
12317 Reviewed by Oliver Hunt.
12318
12319 Merged r116838 from dfgopt.
12320
12321 This turns on inlining of functions that use arguments reflectively, but it
12322 does not do any of the obvious optimizations that this exposes. I'll save that
12323 for another patch - the important thing for now is that this contains all of
12324 the plumbing necessary to make this kind of inlining sound even in bizarro
12325 cases like an inline callee escaping the arguments object to parts of the
12326 inline caller where the arguments are otherwise dead. Or even more fun cases
12327 like where you've inlined to an inline stack that is three-deep, and the
12328 function on top of the inline stack reflectively accesses the arguments of a
12329 function that is in the middle of the inline stack. Any subsequent
12330 optimizations that we do for the obvious cases of arguments usage in inline
12331 functions will have to take care not to break the baseline functionality that
12332 this patch plumbs together.
12333
12334 * bytecode/CodeBlock.cpp:
12335 (JSC::CodeBlock::printCallOp):
12336 (JSC::CodeBlock::dump):
12337 * bytecode/CodeBlock.h:
12338 * dfg/DFGAssemblyHelpers.h:
12339 (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
12340 (AssemblyHelpers):
12341 * dfg/DFGByteCodeParser.cpp:
12342 (InlineStackEntry):
12343 (JSC::DFG::ByteCodeParser::handleCall):
12344 (JSC::DFG::ByteCodeParser::handleInlining):
12345 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
12346 (JSC::DFG::ByteCodeParser::parse):
12347 * dfg/DFGCCallHelpers.h:
12348 (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
12349 (CCallHelpers):
12350 * dfg/DFGCapabilities.h:
12351 (JSC::DFG::canInlineOpcode):
12352 * dfg/DFGDriver.cpp:
12353 (JSC::DFG::compile):
12354 * dfg/DFGFixupPhase.cpp:
12355 (JSC::DFG::FixupPhase::fixupNode):
12356 * dfg/DFGOperations.cpp:
12357 * dfg/DFGOperations.h:
12358 * dfg/DFGSpeculativeJIT.h:
12359 (JSC::DFG::SpeculativeJIT::callOperation):
12360 * dfg/DFGSpeculativeJIT32_64.cpp:
12361 (JSC::DFG::SpeculativeJIT::compile):
12362 * dfg/DFGSpeculativeJIT64.cpp:
12363 (JSC::DFG::SpeculativeJIT::compile):
12364 * interpreter/CallFrame.cpp:
12365 (JSC):
12366 (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
12367 * interpreter/CallFrame.h:
12368 (ExecState):
12369 (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
12370 * interpreter/Interpreter.cpp:
12371 (JSC::Interpreter::retrieveArgumentsFromVMCode):
12372 * runtime/Arguments.cpp:
12373 (JSC::Arguments::tearOff):
12374 (JSC):
12375 (JSC::Arguments::tearOffForInlineCallFrame):
12376 * runtime/Arguments.h:
12377 (Arguments):
12378 (JSC::Arguments::create):
12379 (JSC::Arguments::finishCreation):
12380 (JSC):
12381
fpizlo@apple.comfe244b02012-05-23 20:51:21 +0000[diff] [blame]123822012-05-23 Filip Pizlo <fpizlo@apple.com>
12383
12384 Every OSR exit on ARM results in a crash
12385 https://bugs.webkit.org/show_bug.cgi?id=87307
12386
12387 Reviewed by Geoffrey Garen.
12388
12389 * dfg/DFGThunks.cpp:
12390 (JSC::DFG::osrExitGenerationThunkGenerator):
12391
ggaren@apple.com96fa0e72012-05-23 20:47:46 +0000[diff] [blame]123922012-05-23 Geoffrey Garen <ggaren@apple.com>
12393
12394 Refactored heap tear-down to use normal value semantics (i.e., destructors)
12395 https://bugs.webkit.org/show_bug.cgi?id=87302
12396
12397 Reviewed by Oliver Hunt.
12398
12399 This is a step toward incremental DOM finalization.
12400
12401 * heap/CopiedSpace.cpp:
12402 (JSC::CopiedSpace::~CopiedSpace):
12403 * heap/CopiedSpace.h:
12404 (CopiedSpace): Just use our destructor, instead of relying on the heap
12405 to send us a special message at a special time.
12406
12407 * heap/Heap.cpp:
12408 (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
12409
12410 (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
12411 destructors do this work automatically now.
12412
12413 (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
12414 sub-objects, and assume it does the right thing. This improves encapsulation,
12415 so we can add items requiring finalization to our sub-objects.
12416
12417 * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
12418
12419 * heap/MarkedSpace.cpp:
12420 (Take):
12421 (JSC):
12422 (JSC::Take::Take):
12423 (JSC::Take::operator()):
12424 (JSC::Take::returnValue): Moved to the top of the file so it can be used
12425 in another function.
12426
12427 (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
12428 destructor should.
12429
12430 (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
12431 since it pertains to our internal implementation details.
12432
12433 * heap/MarkedSpace.h:
12434 (MarkedSpace):
12435 * heap/WeakBlock.cpp:
12436 (JSC::WeakBlock::lastChanceToFinalize):
12437 * heap/WeakBlock.h:
12438 (WeakBlock):
12439 * heap/WeakSet.cpp:
12440 (JSC::WeakSet::lastChanceToFinalize):
12441 * heap/WeakSet.h:
12442 (WeakSet): Stop using a special freeAllBlocks() callback and just implement
12443 lastChanceToFinalize.
12444
ggaren@apple.comd6376d22012-05-23 18:29:55 +0000[diff] [blame]124452011-05-22 Geoffrey Garen <ggaren@apple.com>
12446
12447 Encapsulated some calculations for whether portions of the heap are empty
12448 https://bugs.webkit.org/show_bug.cgi?id=87210
12449
12450 Reviewed by Gavin Barraclough.
12451
12452 This is a step toward incremental DOM finalization.
12453
12454 * heap/Heap.cpp:
12455 (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
12456 implicitly on all blocks thinking they're empty. In future, we may
12457 choose to tear down the heap without first setting all data structures
12458 to "empty".
12459
12460 * heap/MarkedBlock.h:
12461 (JSC::MarkedBlock::isEmpty):
12462 (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
12463 in preparation for making it check for outstanding finalizers in addition
12464 to marked cells.
12465
12466 * heap/MarkedSpace.cpp:
12467 (Take):
12468 (JSC::Take::Take):
12469 (JSC::Take::operator()):
12470 (JSC::Take::returnValue):
12471 (JSC::MarkedSpace::shrink):
12472 (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
12473 a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
12474
12475 * heap/WeakBlock.cpp:
12476 (JSC::WeakBlock::WeakBlock):
12477 (JSC::WeakBlock::visitLiveWeakImpls):
12478 (JSC::WeakBlock::visitDeadWeakImpls):
12479 * heap/WeakBlock.h:
12480 (WeakBlock):
12481 (JSC::WeakBlock::isEmpty):
12482 * heap/WeakSet.cpp:
12483 (JSC::WeakSet::sweep):
12484 (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
12485 its implementation.
12486
vestbo@webkit.orgb1f6e922012-05-23 10:50:53 +0000[diff] [blame]124872012-05-23 Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
12488
12489 [Qt] Remove references to $$QT_SOURCE_TREE
12490
12491 With a modularized Qt, it's ambigious. What we really want is qtbase,
12492 which qtcore is a proxy for (we assume it will always live in qtbase).
12493
12494 Reviewed by Tor Arne Vestbø.
12495
12496 * JavaScriptCore.pri:
12497 * Target.pri:
12498
fpizlo@apple.comb6b454cd2012-05-23 07:53:44 +0000[diff] [blame]124992012-05-09 Filip Pizlo <fpizlo@apple.com>
12500
12501 DFG should allow inlining in case of certain arity mismatches
12502 https://bugs.webkit.org/show_bug.cgi?id=86059
12503
12504 Reviewed by Geoff Garen.
fpizlo@apple.comb92907c2012-05-23 07:55:12 +0000[diff] [blame]12505
12506 Merge r116620 from dfgopt.
fpizlo@apple.comb6b454cd2012-05-23 07:53:44 +0000[diff] [blame]12507
12508 * dfg/DFGByteCodeParser.cpp:
12509 (JSC::DFG::ByteCodeParser::handleInlining):
12510
fpizlo@apple.com6d4456e2012-05-23 03:48:52 +0000[diff] [blame]125112012-05-08 Filip Pizlo <fpizlo@apple.com>
12512
fpizlo@apple.com1688cc12012-05-23 07:29:02 +0000[diff] [blame]12513 DFG variable capture analysis should work even if the variables arose through inlining
12514 https://bugs.webkit.org/show_bug.cgi?id=85945
12515
12516 Reviewed by Oliver Hunt.
12517
12518 Merged r116555 from dfgopt.
12519
12520 This just changes how the DFG queries whether a variable is captured. It does not
12521 change any user-visible behavior.
12522
12523 As part of this change, I further solidified the policy that the CFA behaves in an
12524 undefined way for captured locals and queries about their values will not yield
12525 reliable results. This will likely be changed in the future, but for now it makes
12526 sense.
12527
12528 One fun part about this change is that it recognizes that the same variable may
12529 be both captured and not, at the same time, because their live interval spans
12530 inlining boundaries. This only happens in the case of arguments to functions that
12531 capture their arguments, and this change treats them with just the right touch of
12532 conservatism: they will be treated as if captured by the caller as well as the
12533 callee.
12534
12535 Finally, this also adds captured variable reasoning to the InlineCallFrame, which
12536 I thought might be useful for later tooling.
12537
12538 This is perf-neutral, since it does it does not make the DFG take advantage of this
12539 new functionality in any way. In particular, it is still the case that the DFG will
12540 not inline functions that use arguments reflectively or that create activations.
12541
12542 * bytecode/CodeBlock.h:
12543 (CodeBlock):
12544 (JSC::CodeBlock::needsActivation):
12545 (JSC::CodeBlock::argumentIsCaptured):
12546 (JSC::CodeBlock::localIsCaptured):
12547 (JSC::CodeBlock::isCaptured):
12548 * bytecode/CodeOrigin.h:
12549 (InlineCallFrame):
12550 * dfg/DFGAbstractState.cpp:
12551 (JSC::DFG::AbstractState::initialize):
12552 (JSC::DFG::AbstractState::endBasicBlock):
12553 (JSC::DFG::AbstractState::execute):
12554 (JSC::DFG::AbstractState::merge):
12555 * dfg/DFGByteCodeParser.cpp:
12556 (JSC::DFG::ByteCodeParser::newVariableAccessData):
12557 (JSC::DFG::ByteCodeParser::getLocal):
12558 (JSC::DFG::ByteCodeParser::setLocal):
12559 (JSC::DFG::ByteCodeParser::getArgument):
12560 (JSC::DFG::ByteCodeParser::setArgument):
12561 (JSC::DFG::ByteCodeParser::flushArgument):
12562 (JSC::DFG::ByteCodeParser::parseBlock):
12563 (JSC::DFG::ByteCodeParser::processPhiStack):
12564 (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
12565 (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
12566 * dfg/DFGCFGSimplificationPhase.cpp:
12567 (CFGSimplificationPhase):
12568 (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
12569 (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
12570 (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
12571 * dfg/DFGCommon.h:
12572 * dfg/DFGFixupPhase.cpp:
12573 (JSC::DFG::FixupPhase::fixupNode):
12574 * dfg/DFGGraph.cpp:
12575 (JSC::DFG::Graph::nameOfVariableAccessData):
12576 * dfg/DFGGraph.h:
12577 (JSC::DFG::Graph::needsActivation):
12578 (JSC::DFG::Graph::usesArguments):
12579 * dfg/DFGPredictionPropagationPhase.cpp:
12580 (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
12581 * dfg/DFGSpeculativeJIT.cpp:
12582 (JSC::DFG::SpeculativeJIT::compile):
12583 * dfg/DFGSpeculativeJIT32_64.cpp:
12584 (JSC::DFG::SpeculativeJIT::compile):
12585 * dfg/DFGSpeculativeJIT64.cpp:
12586 (JSC::DFG::SpeculativeJIT::compile):
12587 * dfg/DFGVariableAccessData.h:
12588 (JSC::DFG::VariableAccessData::VariableAccessData):
12589 (JSC::DFG::VariableAccessData::mergeIsCaptured):
12590 (VariableAccessData):
12591 (JSC::DFG::VariableAccessData::isCaptured):
12592
125932012-05-08 Filip Pizlo <fpizlo@apple.com>
12594
fpizlo@apple.com6d4456e2012-05-23 03:48:52 +0000[diff] [blame]12595 DFG should support op_get_argument_by_val and op_get_arguments_length
12596 https://bugs.webkit.org/show_bug.cgi?id=85911
12597
12598 Reviewed by Oliver Hunt.
12599
12600 Merged r116467 from dfgopt.
12601
12602 This adds a simple and relatively conservative implementation of op_get_argument_by_val
12603 and op_get_arguments_length. We can optimize these later. For now it's great to have
12604 the additional coverage.
12605
12606 This patch appears to be perf-neutral.
12607
12608 * dfg/DFGAbstractState.cpp:
12609 (JSC::DFG::AbstractState::execute):
12610 * dfg/DFGAssemblyHelpers.h:
12611 (JSC::DFG::AssemblyHelpers::addressFor):
12612 (JSC::DFG::AssemblyHelpers::tagFor):
12613 (JSC::DFG::AssemblyHelpers::payloadFor):
12614 * dfg/DFGByteCodeParser.cpp:
12615 (JSC::DFG::ByteCodeParser::parseBlock):
12616 * dfg/DFGCapabilities.h:
12617 (JSC::DFG::canCompileOpcode):
12618 (JSC::DFG::canInlineOpcode):
12619 * dfg/DFGNode.h:
12620 (JSC::DFG::Node::hasHeapPrediction):
12621 * dfg/DFGNodeType.h:
12622 (DFG):
12623 * dfg/DFGOperations.cpp:
12624 * dfg/DFGOperations.h:
12625 * dfg/DFGPredictionPropagationPhase.cpp:
12626 (JSC::DFG::PredictionPropagationPhase::propagate):
12627 * dfg/DFGSpeculativeJIT.h:
12628 (JSC::DFG::SpeculativeJIT::callOperation):
12629 (SpeculativeJIT):
12630 * dfg/DFGSpeculativeJIT32_64.cpp:
12631 (JSC::DFG::SpeculativeJIT::compile):
12632 * dfg/DFGSpeculativeJIT64.cpp:
12633 (JSC::DFG::SpeculativeJIT::compile):
12634 * jit/JITOpcodes.cpp:
12635 (JSC::JIT::emit_op_get_argument_by_val):
12636 * jit/JITOpcodes32_64.cpp:
12637 (JSC::JIT::emit_op_get_argument_by_val):
12638 * llint/LowLevelInterpreter32_64.asm:
12639 * llint/LowLevelInterpreter64.asm:
12640
fpizlo@apple.com15c03c72012-05-23 02:34:13 +0000[diff] [blame]126412012-05-07 Filip Pizlo <fpizlo@apple.com>
12642
12643 DFG should support op_tear_off_arguments
12644 https://bugs.webkit.org/show_bug.cgi?id=85847
12645
12646 Reviewed by Michael Saboff.
12647
12648 Merged r116378 from dfgopt.
12649
12650 * dfg/DFGAbstractState.cpp:
12651 (JSC::DFG::AbstractState::execute):
12652 * dfg/DFGByteCodeParser.cpp:
12653 (JSC::DFG::ByteCodeParser::parseBlock):
12654 * dfg/DFGCapabilities.h:
12655 (JSC::DFG::canCompileOpcode):
12656 (JSC::DFG::canInlineOpcode):
12657 * dfg/DFGNodeType.h:
12658 (DFG):
12659 * dfg/DFGOperations.cpp:
12660 * dfg/DFGOperations.h:
12661 * dfg/DFGPredictionPropagationPhase.cpp:
12662 (JSC::DFG::PredictionPropagationPhase::propagate):
12663 * dfg/DFGSpeculativeJIT.h:
12664 (SpeculativeJIT):
12665 (JSC::DFG::SpeculativeJIT::callOperation):
12666 * dfg/DFGSpeculativeJIT32_64.cpp:
12667 (JSC::DFG::SpeculativeJIT::compile):
12668 * dfg/DFGSpeculativeJIT64.cpp:
12669 (JSC::DFG::SpeculativeJIT::compile):
12670
mhahnenberg@apple.com3041bc12012-05-23 01:28:03 +0000[diff] [blame]126712012-05-22 Mark Hahnenberg <mhahnenberg@apple.com>
12672
12673 CopiedSpace::contains doesn't check for oversize blocks
12674 https://bugs.webkit.org/show_bug.cgi?id=87180
12675
12676 Reviewed by Geoffrey Garen.
12677
12678 When doing a conservative scan we use CopiedSpace::contains to determine if a particular
12679 address points into the CopiedSpace. Currently contains() only checks if the address
12680 points to a block in to-space, which means that pointers to oversize blocks may not get scanned.
12681
12682 * heap/CopiedSpace.cpp:
12683 (JSC::CopiedSpace::tryAllocateOversize):
12684 (JSC::CopiedSpace::tryReallocateOversize):
12685 (JSC::CopiedSpace::doneFillingBlock):
12686 (JSC::CopiedSpace::doneCopying):
12687 * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are
12688 in a single hash set and bloom filter for membership testing.
12689 (CopiedSpace):
12690 * heap/CopiedSpaceInlineMethods.h:
12691 (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
12692 only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in
12693 CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
12694 if it's in CopiedSpace so that check isn't typed out twice.
12695 (JSC):
12696 (JSC::CopiedSpace::startedCopying):
12697 (JSC::CopiedSpace::addNewBlock):
12698
ggaren@apple.coma68a6502012-05-22 23:59:51 +0000[diff] [blame]126992012-05-22 Geoffrey Garen <ggaren@apple.com>
12700
12701 CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
12702 https://bugs.webkit.org/show_bug.cgi?id=87172
12703
12704 Reviewed by Oliver Hunt and Phil Pizlo.
12705
12706 This enables MarkedBlock to own non-trivial sub-objects that require
12707 destruction. It also fixes a FIXME about casting a CopiedBlock to a
12708 MarkedBlock at destroy time.
12709
12710 CopiedBlock and MarkedBlock now accept an allocation chunk at create
12711 time and return it at destroy time. Their client is expected to
12712 allocate, recycle, and destroy these chunks.
12713
12714 * heap/BlockAllocator.cpp:
12715 (JSC::BlockAllocator::releaseFreeBlocks):
12716 (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
12717 because we expect that to be called before a block is put on our free
12718 list now. Do manually deallocate our allocation chunk because that's
12719 our job now.
12720
12721 * heap/BlockAllocator.h:
12722 (BlockAllocator):
12723 (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
12724 cleaner abstraction because only one object does all the VM allocation
12725 and deallocation. Caching is an implementation detail.
12726
12727 (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
12728 instead of a block because we now expect the block to have been destroyed
12729 before we recycle its memory. For convenience, we still use the HeapBlock
12730 class as our linked list node. This is OK because HeapBlock is a POD type.
12731
12732 * heap/CopiedBlock.h:
12733 (CopiedBlock):
12734 (JSC::CopiedBlock::create):
12735 (JSC::CopiedBlock::destroy):
12736 (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
12737 to match MarkedBlock.
12738
12739 * heap/CopiedSpace.cpp:
12740 (JSC::CopiedSpace::tryAllocateOversize):
12741 (JSC::CopiedSpace::tryReallocateOversize):
12742 (JSC::CopiedSpace::doneCopying):
12743 (JSC::CopiedSpace::getFreshBlock):
12744 (JSC::CopiedSpace::freeAllBlocks):
12745 * heap/CopiedSpaceInlineMethods.h:
12746 (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
12747 returning a block to the BlockAllocator. Otherwise, our destructors
12748 won't run. (If we get this wrong now, we'll get a compile error.)
12749
12750 * heap/HeapBlock.h:
12751 (JSC::HeapBlock::HeapBlock): const!
12752
12753 * heap/MarkedAllocator.cpp:
12754 (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
12755 create and recycle -- MarkedBlock always accepts memory allocated by
12756 its client now.
12757
12758 * heap/MarkedBlock.cpp:
12759 (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
12760 passed already-allocated memory, to clarify the responsibility for VM
12761 recycling.
12762
12763 (JSC::MarkedBlock::destroy): Do run our destructor before giving back
12764 our VM -- that is the whole point of this patch.
12765
12766 (JSC::MarkedBlock::MarkedBlock):
12767 * heap/MarkedBlock.h:
12768 (MarkedBlock):
12769 * heap/MarkedSpace.cpp: const!
12770
12771 (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
12772 returning a block to the BlockAllocator. Otherwise, our destructors
12773 won't run. (If we get this wrong now, we'll get a compile error.)
12774
simon.fraser@apple.com9bd2c702012-05-22 20:37:14 +0000[diff] [blame]12775== Rolled over to ChangeLog-2012-05-22 ==