1. 05 Nov, 2012 1 commit
    • fpizlo@apple.com's avatar
      Reduce the verbosity of referring to QNaN in JavaScriptCore · 3494d02f
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=101174
      
      Reviewed by Geoffrey Garen.
      
      Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
      std::numeric_limits<double>::quiet_NaN() with QNaN.
      
      * API/JSValueRef.cpp:
      (JSValueMakeNumber):
      (JSValueToNumber):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
      * jit/JITPropertyAccess.cpp:
      (JSC::JIT::emitFloatTypedArrayGetByVal):
      * runtime/CachedTranscendentalFunction.h:
      (JSC::CachedTranscendentalFunction::initialize):
      * runtime/DateConstructor.cpp:
      (JSC::constructDate):
      * runtime/DateInstanceCache.h:
      (JSC::DateInstanceData::DateInstanceData):
      (JSC::DateInstanceCache::reset):
      * runtime/ExceptionHelpers.cpp:
      (JSC::InterruptedExecutionError::defaultValue):
      (JSC::TerminatedExecutionError::defaultValue):
      * runtime/JSCell.h:
      (JSC::JSValue::getPrimitiveNumber):
      * runtime/JSDateMath.cpp:
      (JSC::parseDateFromNullTerminatedCharacters):
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      (JSC::JSGlobalData::resetDateCache):
      * runtime/JSGlobalObjectFunctions.cpp:
      (JSC::parseInt):
      (JSC::jsStrDecimalLiteral):
      (JSC::toDouble):
      (JSC::jsToNumber):
      (JSC::parseFloat):
      * runtime/JSValue.cpp:
      (JSC::JSValue::toNumberSlowCase):
      * runtime/JSValue.h:
      (JSC):
      * runtime/JSValueInlineMethods.h:
      (JSC::jsNaN):
      * runtime/MathObject.cpp:
      (JSC::mathProtoFuncMax):
      (JSC::mathProtoFuncMin):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133493 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      3494d02f
  2. 12 Oct, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      Copying collection shouldn't require O(live bytes) memory overhead · 02e39c7e
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=98792
      
      Reviewed by Filip Pizlo.
      
      Currently our copying collection occurs simultaneously with the marking phase. We'd like 
      to be able to reuse CopiedBlocks as soon as they become fully evacuated, but this is not 
      currently possible because we don't know the liveness statistics of each old CopiedBlock 
      until marking/copying has already finished. Instead, we have to allocate additional memory 
      from the OS to use as our working set of CopiedBlocks while copying. We then return the 
      fully evacuated old CopiedBlocks back to the block allocator, thus giving our copying phase 
      an O(live bytes) overhead.
      
      To fix this, we should instead split the copying phase apart from the marking phase. This 
      way we have full liveness data for each CopiedBlock during the copying phase so that we 
      can reuse them the instant they become fully evacuated. With the additional liveness data 
      that each CopiedBlock accumulates, we can add some additional heuristics to the collector. 
      For example, we can calculate our global Heap fragmentation and only choose to do a copying 
      phase if that fragmentation exceeds some limit. As another example, we can skip copying 
      blocks that are already above a particular fragmentation limit, which allows older objects 
      to coalesce into blocks that are rarely copied.
      
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * heap/CopiedBlock.h:
      (CopiedBlock):
      (JSC::CopiedBlock::CopiedBlock): Added support for tracking live bytes in a CopiedBlock in a 
      thread-safe fashion.
      (JSC::CopiedBlock::reportLiveBytes): Adds a number of live bytes to the block in a thread-safe 
      fashion using compare and swap.
      (JSC):
      (JSC::CopiedBlock::didSurviveGC): Called when a block survives a single GC without being 
      evacuated. This could be called for a couple reasons: (a) the block was pinned or (b) we 
      decided not to do any copying. A block can become pinned for a few reasons: (1) a pointer into 
      the block was found during the conservative scan. (2) the block was deemed full enough to 
      not warrant any copying. (3) The block is oversize and was found to be live. 
      (JSC::CopiedBlock::didEvacuateBytes): Called when some number of bytes are copied from this 
      block. If the number of live bytes ever hits zero, the block will return itself to the 
      BlockAllocator to be recycled.
      (JSC::CopiedBlock::canBeRecycled): Indicates that a block has no live bytes and can be 
      immediately recycled. This is used for blocks that are found to have zero live bytes at the 
      beginning of the copying phase.
      (JSC::CopiedBlock::shouldEvacuate): This function returns true if the current fragmentation 
      of the block is above our fragmentation threshold, and false otherwise.
      (JSC::CopiedBlock::isPinned): Added an accessor for the pinned flag
      (JSC::CopiedBlock::liveBytes): 
      * heap/CopiedSpace.cpp:
      (JSC::CopiedSpace::CopiedSpace):
      (JSC::CopiedSpace::doneFillingBlock): Changed so that we can exchange our filled block for a 
      fresh block. This avoids the situation where a thread returns its borrowed block, it's the last 
      borrowed block, so CopiedSpace thinks that copying has completed, and it starts doing all of the 
      copying phase cleanup. In actuality, the thread wanted another block after returning the current 
      block. So we allow the thread to atomically exchange its block for another block.
      (JSC::CopiedSpace::startedCopying): Added the calculation of global Heap fragmentation to 
      determine if the copying phase should commence. We include the MarkedSpace in our fragmentation 
      calculation by assuming that the MarkedSpace is 0% fragmented since we can reuse any currently 
      free memory in it (i.e. we ignore any internal fragmentation in the MarkedSpace). While we're 
      calculating the fragmentation of CopiedSpace, we also return any free blocks we find along the 
      way (meaning liveBytes() == 0).
      (JSC):
      (JSC::CopiedSpace::doneCopying): We still have to iterate over all the blocks, regardless of
      whether the copying phase took place or not so that we can reset all of the live bytes counters 
      and un-pin any pinned blocks.
      * heap/CopiedSpace.h:
      (CopiedSpace):
      (JSC::CopiedSpace::shouldDoCopyPhase):
      * heap/CopiedSpaceInlineMethods.h:
      (JSC::CopiedSpace::recycleEvacuatedBlock): This function is distinct from recycling a borrowed block 
      because a borrowed block hasn't been added to the CopiedSpace yet, but an evacuated block is still
      currently in CopiedSpace, so we have to make sure we properly remove all traces of the block from 
      CopiedSpace before returning it to BlockAllocator.
      (JSC::CopiedSpace::recycleBorrowedBlock): Renamed to indicate the distinction mentioned above.
      * heap/CopyVisitor.cpp: Added.
      (JSC):
      (JSC::CopyVisitor::CopyVisitor):
      (JSC::CopyVisitor::copyFromShared): Main function for any thread participating in the copying phase.
      Grabs chunks of MarkedBlocks from the shared list and copies the backing store of anybody who needs
      it until there are no more chunks to copy.
      * heap/CopyVisitor.h: Added.
      (JSC):
      (CopyVisitor):
      * heap/CopyVisitorInlineMethods.h: Added.
      (JSC):
      (GCCopyPhaseFunctor):
      (JSC::GCCopyPhaseFunctor::GCCopyPhaseFunctor):
      (JSC::GCCopyPhaseFunctor::operator()):
      (JSC::CopyVisitor::checkIfShouldCopy): We don't have to check shouldEvacuate() because all of those 
      checks are done during the marking phase.
      (JSC::CopyVisitor::allocateNewSpace): 
      (JSC::CopyVisitor::allocateNewSpaceSlow):
      (JSC::CopyVisitor::startCopying): Initialization function for a thread that is about to start copying.
      (JSC::CopyVisitor::doneCopying):
      (JSC::CopyVisitor::didCopy): This callback is called by an object that has just successfully copied its
      backing store. It indicates to the CopiedBlock that somebody has just finished evacuating some number of 
      bytes from it, and, if the CopiedBlock now has no more live bytes, can be recycled immediately.
      * heap/GCThread.cpp: Added.
      (JSC):
      (JSC::GCThread::GCThread): This is a new class that encapsulates a single thread responsible for participating 
      in a specific set of GC phases. Currently, that set of phases includes Mark, Copy, and Exit. Each thread 
      monitors a shared variable in its associated GCThreadSharedData. The main thread updates this m_currentPhase
      variable as collection progresses through the various phases. Parallel marking still works exactly like it 
      has. In other words, the "run loop" for each of the GC threads sits above any individual phase, thus keeping 
      the separate phases of the collector orthogonal.
      (JSC::GCThread::threadID):
      (JSC::GCThread::initializeThreadID):
      (JSC::GCThread::slotVisitor):
      (JSC::GCThread::copyVisitor):
      (JSC::GCThread::waitForNextPhase):
      (JSC::GCThread::gcThreadMain):
      (JSC::GCThread::gcThreadStartFunc):
      * heap/GCThread.h: Added.
      (JSC):
      (GCThread):
      * heap/GCThreadSharedData.cpp: The GCThreadSharedData now has a list of GCThread objects rather than raw 
      ThreadIdentifiers.
      (JSC::GCThreadSharedData::resetChildren):
      (JSC::GCThreadSharedData::childVisitCount):
      (JSC::GCThreadSharedData::GCThreadSharedData):
      (JSC::GCThreadSharedData::~GCThreadSharedData):
      (JSC::GCThreadSharedData::reset):
      (JSC::GCThreadSharedData::didStartMarking): Callback to let the GCThreadSharedData know that marking has 
      started and updates the m_currentPhase variable and notifies the GCThreads accordingly.
      (JSC::GCThreadSharedData::didFinishMarking): Ditto for finishing marking. 
      (JSC::GCThreadSharedData::didStartCopying): Ditto for starting the copying phase.
      (JSC::GCThreadSharedData::didFinishCopying): Ditto for finishing copying. 
      * heap/GCThreadSharedData.h:
      (JSC):
      (GCThreadSharedData):
      (JSC::GCThreadSharedData::getNextBlocksToCopy): Atomically gets the next chunk of work for a copying thread.
      * heap/Heap.cpp:
      (JSC::Heap::Heap):
      (JSC::Heap::markRoots):
      (JSC):
      (JSC::Heap::copyBackingStores): Responsible for setting up the copying phase, notifying the copying threads, 
      and doing any copying work if necessary.
      (JSC::Heap::collect):
      * heap/Heap.h:
      (Heap):
      (JSC):
      (JSC::CopyFunctor::CopyFunctor):
      (CopyFunctor):
      (JSC::CopyFunctor::operator()):
      * heap/IncrementalSweeper.cpp: Changed the incremental sweeper to have a reference to the list of MarkedBlocks 
      that need sweeping, since this now resides in the Heap so that it can be easily shared by the GCThreads.
      (JSC::IncrementalSweeper::IncrementalSweeper):
      (JSC::IncrementalSweeper::startSweeping):
      * heap/IncrementalSweeper.h:
      (JSC):
      (IncrementalSweeper):
      * heap/SlotVisitor.cpp:
      (JSC::SlotVisitor::setup):
      (JSC::SlotVisitor::drainFromShared): We no longer do any copying-related work here.
      (JSC):
      * heap/SlotVisitor.h:
      (SlotVisitor):
      * heap/SlotVisitorInlineMethods.h:
      (JSC):
      (JSC::SlotVisitor::copyLater): Notifies the CopiedBlock that there are some live bytes that may need 
      to be copied.
      * runtime/Butterfly.h:
      (JSC):
      (Butterfly):
      * runtime/ButterflyInlineMethods.h:
      (JSC::Butterfly::createUninitializedDuringCollection): Uses the new CopyVisitor.
      * runtime/ClassInfo.h:
      (MethodTable): Added new "virtual" function copyBackingStore to method table.
      (JSC):
      * runtime/JSCell.cpp:
      (JSC::JSCell::copyBackingStore): Default implementation that does nothing.
      (JSC):
      * runtime/JSCell.h:
      (JSC):
      (JSCell):
      * runtime/JSObject.cpp:
      (JSC::JSObject::copyButterfly): Does the actual copying of the butterfly.
      (JSC):
      (JSC::JSObject::visitButterfly): Calls copyLater for the butterfly.
      (JSC::JSObject::copyBackingStore): 
      * runtime/JSObject.h:
      (JSObject):
      (JSC::JSCell::methodTable):
      (JSC::JSCell::inherits):
      * runtime/Options.h: Added two new constants, minHeapUtilization and minCopiedBlockUtilization, 
      to govern the amount of fragmentation we allow before doing copying.
      (JSC):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131213 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      02e39c7e
  3. 09 Oct, 2012 1 commit
    • fpizlo@apple.com's avatar
      Typed arrays should not be 20x slower in the baseline JIT than in the DFG JIT · c14c8d32
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=98605
      
      Reviewed by Oliver Hunt and Gavin Barraclough.
      
      This adds typed array get_by_val/put_by_val patching to the baseline JIT. It's
      a big (~40%) win on benchmarks that have trouble staying in the DFG JIT. Even
      if we fix those benchmarks, this functionality gives us the insurance that we
      typically desire with all speculative optimizations: even if we bail to
      baseline, we're still reasonably performant.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * assembler/MacroAssembler.cpp: Added.
      (JSC):
      * assembler/MacroAssembler.h:
      (MacroAssembler):
      (JSC::MacroAssembler::patchableBranchPtr):
      * assembler/MacroAssemblerARMv7.h:
      (MacroAssemblerARMv7):
      (JSC::MacroAssemblerARMv7::moveDoubleToInts):
      (JSC::MacroAssemblerARMv7::moveIntsToDouble):
      (JSC::MacroAssemblerARMv7::patchableBranchPtr):
      * assembler/MacroAssemblerX86.h:
      (MacroAssemblerX86):
      (JSC::MacroAssemblerX86::moveDoubleToInts):
      (JSC::MacroAssemblerX86::moveIntsToDouble):
      * bytecode/ByValInfo.h:
      (JSC::hasOptimizableIndexingForClassInfo):
      (JSC):
      (JSC::hasOptimizableIndexing):
      (JSC::jitArrayModeForClassInfo):
      (JSC::jitArrayModeForStructure):
      (JSC::ByValInfo::ByValInfo):
      (ByValInfo):
      * dfg/DFGAssemblyHelpers.cpp:
      (DFG):
      * dfg/DFGAssemblyHelpers.h:
      (AssemblyHelpers):
      (JSC::DFG::AssemblyHelpers::boxDouble):
      (JSC::DFG::AssemblyHelpers::unboxDouble):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
      (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
      * dfg/DFGSpeculativeJIT.h:
      (SpeculativeJIT):
      * jit/JIT.h:
      (JIT):
      * jit/JITPropertyAccess.cpp:
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::emit_op_put_by_val):
      (JSC::JIT::privateCompileGetByVal):
      (JSC::JIT::privateCompilePutByVal):
      (JSC::JIT::emitIntTypedArrayGetByVal):
      (JSC):
      (JSC::JIT::emitFloatTypedArrayGetByVal):
      (JSC::JIT::emitIntTypedArrayPutByVal):
      (JSC::JIT::emitFloatTypedArrayPutByVal):
      * jit/JITPropertyAccess32_64.cpp:
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::emit_op_put_by_val):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * runtime/JSCell.h:
      * runtime/JSGlobalData.h:
      (JSGlobalData):
      (JSC::JSGlobalData::typedArrayDescriptor):
      * runtime/TypedArrayDescriptor.h: Added.
      (JSC):
      (JSC::TypedArrayDescriptor::TypedArrayDescriptor):
      (TypedArrayDescriptor):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130839 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c14c8d32
  4. 03 Oct, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      Delayed structure sweep can leak structures without bound · 30738a77
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=96546
      
      Reviewed by Geoffrey Garen.
      
      This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
      allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
      those objects with destructors and with immortal structures, and those objects with destructors that don't have 
      immortal structures. All of the objects of the third type (destructors without immortal structures) now 
      inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores 
      the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.
      
      Source/JavaScriptCore: 
      
      * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
      (JSC):
      (JSC::JSCallbackConstructor::JSCallbackConstructor):
      * API/JSCallbackConstructor.h:
      (JSCallbackConstructor):
      * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for 
      JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
      (JSC):
      (JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add 
      the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides 
      to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
      (JSC::::createStructure):
      * API/JSCallbackObject.h:
      (JSCallbackObject):
      (JSC):
      * API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
      (OpaqueJSClass::prototype):
      * API/JSObjectRef.cpp: Ditto.
      (JSObjectMake):
      (JSObjectGetPrivate):
      (JSObjectSetPrivate):
      (JSObjectGetPrivateProperty):
      (JSObjectSetPrivateProperty):
      (JSObjectDeletePrivateProperty):
      * API/JSValueRef.cpp: Ditto.
      (JSValueIsObjectOfClass):
      * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
      * JSCTypedArrayStubs.h:
      (JSC):
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
      (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
      (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
      * heap/Heap.cpp:
      (JSC):
      * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function 
      since it's always safe to sweep Structures now.
      (JSC::Heap::allocatorForObjectWithNormalDestructor): 
      (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
      (Heap):
      (JSC::Heap::allocateWithNormalDestructor):
      (JSC):
      (JSC::Heap::allocateWithImmortalStructureDestructor):
      * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the 
      IncrementalSweeper since it's always safe to sweep Structures now.
      (JSC::IncrementalSweeper::IncrementalSweeper):
      (JSC::IncrementalSweeper::sweepNextBlock):
      (JSC::IncrementalSweeper::startSweeping):
      (JSC::IncrementalSweeper::willFinishSweeping):
      (JSC):
      * heap/IncrementalSweeper.h:
      (IncrementalSweeper):
      * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add 
      tracking of the specific destructor type of allocator. 
      (JSC::MarkedAllocator::tryAllocateHelper):
      (JSC::MarkedAllocator::allocateBlock):
      * heap/MarkedAllocator.h:
      (JSC::MarkedAllocator::destructorType):
      (MarkedAllocator):
      (JSC::MarkedAllocator::MarkedAllocator):
      (JSC::MarkedAllocator::init):
      * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. 
      We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
      (JSC::MarkedBlock::create):
      (JSC::MarkedBlock::MarkedBlock):
      (JSC):
      (JSC::MarkedBlock::specializedSweep):
      (JSC::MarkedBlock::sweep):
      (JSC::MarkedBlock::sweepHelper):
      * heap/MarkedBlock.h:
      (JSC):
      (JSC::MarkedBlock::allocator):
      (JSC::MarkedBlock::destructorType):
      * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
      (JSC::MarkedSpace::MarkedSpace):
      (JSC::MarkedSpace::resetAllocators):
      (JSC::MarkedSpace::canonicalizeCellLivenessData):
      (JSC::MarkedSpace::isPagedOut):
      (JSC::MarkedSpace::freeBlock):
      * heap/MarkedSpace.h:
      (MarkedSpace):
      (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
      (JSC::MarkedSpace::normalDestructorAllocatorFor):
      (JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
      (JSC::MarkedSpace::allocateWithNormalDestructor):
      (JSC::MarkedSpace::forEachBlock):
      * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
      * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateJSFinalObject):
      (JSC::JIT::emitAllocateJSArray):
      * jsc.cpp: 
      (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from 
      JSDestructibleObject.
      * runtime/Arguments.cpp: Inherit from JSDestructibleObject.
      (JSC):
      * runtime/Arguments.h:
      (Arguments):
      (JSC::Arguments::Arguments):
      * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
      (JSC):
      * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
      (JSC):
      * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
      (JSC):
      (JSC::InternalFunction::InternalFunction):
      * runtime/InternalFunction.h:
      (InternalFunction):
      * runtime/JSCell.h: Added two static bools, needsDestruction and hasImmortalStructure, that classes can override 
      to indicate at compile time which part of the heap they should be allocated in.
      (JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
      * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be 
      accessed safely when the object is being destroyed.
      (JSC):
      (JSDestructibleObject):
      (JSC::JSDestructibleObject::classInfo):
      (JSC::JSDestructibleObject::JSDestructibleObject):
      (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
      * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all 
      of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
      (JSC::JSGlobalObject::reset):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one 
      for the m_rareData field when it's created.
      (JSC::JSGlobalObject::create):
      (JSC):
      * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
      (JSGlobalThis):
      (JSC::JSGlobalThis::JSGlobalThis):
      * runtime/JSPropertyNameIterator.h: Has an immortal Structure.
      (JSC):
      * runtime/JSScope.cpp:
      (JSC):
      * runtime/JSString.h: Has an immortal Structure.
      (JSC):
      * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
      (JSWrapperObject):
      (JSC::JSWrapperObject::JSWrapperObject):
      * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
      (JSC):
      * runtime/NameInstance.h: Inherit from JSDestructibleObject.
      (NameInstance):
      * runtime/RegExp.h: Has immortal Structure.
      (JSC):
      * runtime/RegExpObject.cpp: Inheritance cleanup.
      (JSC):
      * runtime/SparseArrayValueMap.h: Has immortal Structure.
      (JSC):
      * runtime/Structure.h: Has immortal Structure.
      (JSC):
      * runtime/StructureChain.h: Ditto.
      (JSC):
      * runtime/SymbolTable.h: Ditto.
      (SharedSymbolTable):
      (JSC):
      
      Source/WebCore: 
      
      No new tests.
      
      * ForwardingHeaders/runtime/JSDestructableObject.h: Added.
      * bindings/js/JSDOMWrapper.h: Inherits from JSDestructibleObject.
      (JSDOMWrapper):
      (WebCore::JSDOMWrapper::JSDOMWrapper):
      * bindings/scripts/CodeGeneratorJS.pm: Add finalizers to anything that inherits from JSGlobalObject,
      e.g. JSDOMWindow and JSWorkerContexts. For those classes we also need to define needsDestruction as true.
      (GenerateHeader):
      * bridge/objc/objc_runtime.h: Inherit from JSDestructibleObject.
      (ObjcFallbackObjectImp):
      * bridge/objc/objc_runtime.mm:
      (Bindings):
      (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
      * bridge/runtime_array.cpp: Use a finalizer so that JSArray isn't forced to inherit from JSDestructibleObject.
      (JSC):
      (JSC::RuntimeArray::destroy):
      * bridge/runtime_array.h:
      (JSC::RuntimeArray::create):
      (JSC):
      * bridge/runtime_object.cpp: Inherit from JSDestructibleObject.
      (Bindings):
      (JSC::Bindings::RuntimeObject::RuntimeObject):
      * bridge/runtime_object.h:
      (RuntimeObject):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130303 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      30738a77
  5. 21 Sep, 2012 1 commit
    • barraclough@apple.com's avatar
      instanceof should not get the prototype for non-default HasInstance · b46d57b4
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=68656
      
      Reviewed by Oliver Hunt.
      
      Source/JavaScriptCore: 
      
      Instanceof is currently implemented as a sequance of three opcodes:
          check_has_instance
          get_by_id(prototype)
          op_instanceof
      There are three interesting types of base value that instanceof can be applied to:
          (A) Objects supporting default instanceof behaviour (functions, other than those created with bind)
          (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions)
          (C) Values that do not respond to the [[HasInstance]] trap.
      Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are
      two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for
      hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly,
      this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec
      violation.
      
      The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving
      op_instanceof to handle only cases (A).
      
      * API/JSCallbackObject.h:
      (JSCallbackObject):
      * API/JSCallbackObjectFunctions.h:
      (JSC::::customHasInstance):
      * API/JSValueRef.cpp:
      (JSValueIsInstanceOfConstructor):
          - renamed hasInstance to customHasInstance
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dump):
          - added additional parameters to check_has_instance opcode
      * bytecode/Opcode.h:
      (JSC):
      (JSC::padOpcodeName):
          - added additional parameters to check_has_instance opcode
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitCheckHasInstance):
          - added additional parameters to check_has_instance opcode
      * bytecompiler/BytecodeGenerator.h:
      (BytecodeGenerator):
          - added additional parameters to check_has_instance opcode
      * bytecompiler/NodesCodegen.cpp:
      (JSC::InstanceOfNode::emitBytecode):
          - added additional parameters to check_has_instance opcode
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::parseBlock):
          - added additional parameters to check_has_instance opcode
      * interpreter/Interpreter.cpp:
      (JSC::isInvalidParamForIn):
      (JSC::Interpreter::privateExecute):
          - Add handling for non-default instanceof to op_check_has_instance
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitArrayProfilingSiteForBytecodeIndex):
          - Fixed no-LLInt no_DFG build
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_check_has_instance):
      (JSC::JIT::emitSlow_op_check_has_instance):
          - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
      (JSC::JIT::emit_op_instanceof):
      (JSC::JIT::emitSlow_op_instanceof):
          - no need to check for ImplementsDefaultHasInstance.
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_check_has_instance):
      (JSC::JIT::emitSlow_op_check_has_instance):
          - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
      (JSC::JIT::emit_op_instanceof):
      (JSC::JIT::emitSlow_op_instanceof):
          - no need to check for ImplementsDefaultHasInstance.
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * jit/JITStubs.h:
          - Add handling for non-default instanceof to op_check_has_instance
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
          - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
      * runtime/ClassInfo.h:
      (MethodTable):
      (JSC):
          - renamed hasInstance to customHasInstance
      * runtime/CommonSlowPaths.h:
      (CommonSlowPaths):
          - removed opInstanceOfSlow (this was whittled down to one function call!)
      * runtime/JSBoundFunction.cpp:
      (JSC::JSBoundFunction::customHasInstance):
      * runtime/JSBoundFunction.h:
      (JSBoundFunction):
          - renamed hasInstance to customHasInstance, reimplemented.
      * runtime/JSCell.cpp:
      (JSC::JSCell::customHasInstance):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSObject.cpp:
      (JSC::JSObject::hasInstance):
      (JSC):
      (JSC::JSObject::defaultHasInstance):
      * runtime/JSObject.h:
      (JSObject):
      
      LayoutTests: 
      
      * fast/js/function-bind-expected.txt:
          - check in passing result.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      b46d57b4
  6. 18 Sep, 2012 2 commits
    • mhahnenberg@apple.com's avatar
      Use WTF::HasTrivialDestructor instead of compiler-specific versions in JSC::NeedsDestructor · 53d40648
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=96980
      
      Reviewed by Benjamin Poulain.
      
      Source/JavaScriptCore:
      
      * runtime/JSCell.h:
      (JSC):
      (NeedsDestructor):
      
      Source/WTF:
      
      * wtf/TypeTraits.h:
      (WTF):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128900 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      53d40648
    • ossy@webkit.org's avatar
      Unreviewed, rolling out r128826 and r128813. · 7c7e4274
      ossy@webkit.org authored
      Source/JavaScriptCore:
      
      * API/JSCallbackConstructor.cpp:
      (JSC):
      (JSC::JSCallbackConstructor::JSCallbackConstructor):
      * API/JSCallbackConstructor.h:
      (JSCallbackConstructor):
      * API/JSCallbackObject.cpp:
      (JSC):
      (JSC::::createStructure):
      * API/JSCallbackObject.h:
      (JSC::JSCallbackObject::create):
      (JSCallbackObject):
      * API/JSClassRef.cpp:
      (OpaqueJSClass::prototype):
      * API/JSObjectRef.cpp:
      (JSObjectMake):
      (JSObjectGetPrivate):
      (JSObjectSetPrivate):
      (JSObjectGetPrivateProperty):
      (JSObjectSetPrivateProperty):
      (JSObjectDeletePrivateProperty):
      * API/JSValueRef.cpp:
      (JSValueIsObjectOfClass):
      * API/JSWeakObjectMapRefPrivate.cpp:
      * GNUmakefile.list.am:
      * JSCTypedArrayStubs.h:
      (JSC):
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
      (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
      * heap/Heap.cpp:
      (JSC::Heap::isSafeToSweepStructures):
      (JSC):
      * heap/Heap.h:
      (JSC::Heap::allocatorForObjectWithDestructor):
      (Heap):
      (JSC::Heap::allocateWithDestructor):
      (JSC::Heap::allocateStructure):
      (JSC):
      * heap/IncrementalSweeper.cpp:
      (JSC::IncrementalSweeper::IncrementalSweeper):
      (JSC::IncrementalSweeper::sweepNextBlock):
      (JSC::IncrementalSweeper::startSweeping):
      (JSC::IncrementalSweeper::willFinishSweeping):
      (JSC::IncrementalSweeper::structuresCanBeSwept):
      (JSC):
      * heap/IncrementalSweeper.h:
      (IncrementalSweeper):
      * heap/MarkedAllocator.cpp:
      (JSC::MarkedAllocator::tryAllocateHelper):
      (JSC::MarkedAllocator::allocateBlock):
      * heap/MarkedAllocator.h:
      (JSC::MarkedAllocator::cellsNeedDestruction):
      (JSC::MarkedAllocator::onlyContainsStructures):
      (MarkedAllocator):
      (JSC::MarkedAllocator::MarkedAllocator):
      (JSC::MarkedAllocator::init):
      * heap/MarkedBlock.cpp:
      (JSC::MarkedBlock::create):
      (JSC::MarkedBlock::MarkedBlock):
      (JSC):
      (JSC::MarkedBlock::specializedSweep):
      (JSC::MarkedBlock::sweep):
      (JSC::MarkedBlock::sweepHelper):
      * heap/MarkedBlock.h:
      (JSC):
      (MarkedBlock):
      (JSC::MarkedBlock::cellsNeedDestruction):
      (JSC::MarkedBlock::onlyContainsStructures):
      * heap/MarkedSpace.cpp:
      (JSC::MarkedSpace::MarkedSpace):
      (JSC::MarkedSpace::resetAllocators):
      (JSC::MarkedSpace::canonicalizeCellLivenessData):
      (JSC::MarkedSpace::isPagedOut):
      (JSC::MarkedSpace::freeBlock):
      * heap/MarkedSpace.h:
      (MarkedSpace):
      (Subspace):
      (JSC::MarkedSpace::allocatorFor):
      (JSC::MarkedSpace::destructorAllocatorFor):
      (JSC::MarkedSpace::allocateWithDestructor):
      (JSC::MarkedSpace::allocateStructure):
      (JSC::MarkedSpace::forEachBlock):
      * heap/SlotVisitor.cpp:
      * jit/JIT.h:
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateJSFinalObject):
      (JSC::JIT::emitAllocateJSArray):
      * jsc.cpp:
      (GlobalObject::create):
      * runtime/Arguments.cpp:
      (JSC):
      * runtime/Arguments.h:
      (Arguments):
      (JSC::Arguments::Arguments):
      * runtime/ErrorPrototype.cpp:
      (JSC):
      * runtime/Executable.h:
      * runtime/InternalFunction.cpp:
      (JSC):
      (JSC::InternalFunction::InternalFunction):
      * runtime/InternalFunction.h:
      (InternalFunction):
      * runtime/JSCell.h:
      (JSC):
      (JSC::allocateCell):
      * runtime/JSDestructibleObject.h: Removed.
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::reset):
      (JSC):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::createRareDataIfNeeded):
      (JSC::JSGlobalObject::create):
      * runtime/JSGlobalThis.h:
      (JSGlobalThis):
      (JSC::JSGlobalThis::JSGlobalThis):
      * runtime/JSPropertyNameIterator.h:
      * runtime/JSScope.cpp:
      (JSC):
      * runtime/JSString.h:
      (JSC):
      * runtime/JSWrapperObject.h:
      (JSWrapperObject):
      (JSC::JSWrapperObject::JSWrapperObject):
      * runtime/MathObject.cpp:
      (JSC):
      * runtime/NameInstance.h:
      (NameInstance):
      * runtime/RegExp.h:
      * runtime/RegExpObject.cpp:
      (JSC):
      * runtime/SparseArrayValueMap.h:
      * runtime/Structure.h:
      (JSC::Structure):
      (JSC::JSCell::classInfo):
      (JSC):
      * runtime/StructureChain.h:
      * runtime/SymbolTable.h:
      * testRegExp.cpp:
      (GlobalObject::create):
      
      Source/WebCore:
      
      * ForwardingHeaders/runtime/JSDestructibleObject.h: Removed.
      * bindings/js/JSDOMWrapper.h:
      (WebCore::JSDOMWrapper::JSDOMWrapper):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader):
      * bridge/objc/objc_runtime.h:
      (ObjcFallbackObjectImp):
      * bridge/objc/objc_runtime.mm:
      (Bindings):
      (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
      * bridge/runtime_array.cpp:
      (JSC):
      (JSC::RuntimeArray::destroy):
      * bridge/runtime_array.h:
      (JSC::RuntimeArray::create):
      * bridge/runtime_object.cpp:
      (Bindings):
      (JSC::Bindings::RuntimeObject::RuntimeObject):
      * bridge/runtime_object.h:
      (RuntimeObject):
      
      Source/WebKit2:
      
      * WebProcess/Plugins/Netscape/JSNPObject.cpp:
      (WebKit):
      (WebKit::JSNPObject::JSNPObject):
      * WebProcess/Plugins/Netscape/JSNPObject.h:
      (JSNPObject):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128851 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      7c7e4274
  7. 17 Sep, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      Delayed structure sweep can leak structures without bound · 013fd88d
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=96546
      
      Reviewed by Gavin Barraclough.
      
      This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
      allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
      those objects with destructors and with immortal structures, and those objects with destructors that don't have 
      immortal structures. All of the objects of the third type (destructors without immortal structures) now 
      inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores 
      the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.
      
      Source/JavaScriptCore: 
      
      * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
      (JSC):
      (JSC::JSCallbackConstructor::JSCallbackConstructor):
      * API/JSCallbackConstructor.h:
      (JSCallbackConstructor):
      * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for 
      JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
      (JSC):
      (JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add 
      the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides 
      to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
      (JSC::::createStructure):
      * API/JSCallbackObject.h:
      (JSCallbackObject):
      (JSC):
      * API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
      (OpaqueJSClass::prototype):
      * API/JSObjectRef.cpp: Ditto.
      (JSObjectMake):
      (JSObjectGetPrivate):
      (JSObjectSetPrivate):
      (JSObjectGetPrivateProperty):
      (JSObjectSetPrivateProperty):
      (JSObjectDeletePrivateProperty):
      * API/JSValueRef.cpp: Ditto.
      (JSValueIsObjectOfClass):
      * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
      * JSCTypedArrayStubs.h:
      (JSC):
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
      (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
      (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
      * heap/Heap.cpp:
      (JSC):
      * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function 
      since it's always safe to sweep Structures now.
      (JSC::Heap::allocatorForObjectWithNormalDestructor): 
      (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
      (Heap):
      (JSC::Heap::allocateWithNormalDestructor):
      (JSC):
      (JSC::Heap::allocateWithImmortalStructureDestructor):
      * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the 
      IncrementalSweeper since it's always safe to sweep Structures now.
      (JSC::IncrementalSweeper::IncrementalSweeper):
      (JSC::IncrementalSweeper::sweepNextBlock):
      (JSC::IncrementalSweeper::startSweeping):
      (JSC::IncrementalSweeper::willFinishSweeping):
      (JSC):
      * heap/IncrementalSweeper.h:
      (IncrementalSweeper):
      * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add 
      tracking of the specific destructor type of allocator. 
      (JSC::MarkedAllocator::tryAllocateHelper):
      (JSC::MarkedAllocator::allocateBlock):
      * heap/MarkedAllocator.h:
      (JSC::MarkedAllocator::destructorType):
      (MarkedAllocator):
      (JSC::MarkedAllocator::MarkedAllocator):
      (JSC::MarkedAllocator::init):
      * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. 
      We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
      (JSC::MarkedBlock::create):
      (JSC::MarkedBlock::MarkedBlock):
      (JSC):
      (JSC::MarkedBlock::specializedSweep):
      (JSC::MarkedBlock::sweep):
      (JSC::MarkedBlock::sweepHelper):
      * heap/MarkedBlock.h:
      (JSC):
      (JSC::MarkedBlock::allocator):
      (JSC::MarkedBlock::destructorType):
      * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
      (JSC::MarkedSpace::MarkedSpace):
      (JSC::MarkedSpace::resetAllocators):
      (JSC::MarkedSpace::canonicalizeCellLivenessData):
      (JSC::MarkedSpace::isPagedOut):
      (JSC::MarkedSpace::freeBlock):
      * heap/MarkedSpace.h:
      (MarkedSpace):
      (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
      (JSC::MarkedSpace::normalDestructorAllocatorFor):
      (JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
      (JSC::MarkedSpace::allocateWithNormalDestructor):
      (JSC::MarkedSpace::forEachBlock):
      * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
      * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateJSFinalObject):
      (JSC::JIT::emitAllocateJSArray):
      * jsc.cpp: 
      (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from 
      JSDestructibleObject.
      * runtime/Arguments.cpp: Inherit from JSDestructibleObject.
      (JSC):
      * runtime/Arguments.h:
      (Arguments):
      (JSC::Arguments::Arguments):
      * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
      (JSC):
      * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
      (JSC):
      * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
      (JSC):
      (JSC::InternalFunction::InternalFunction):
      * runtime/InternalFunction.h:
      (InternalFunction):
      * runtime/JSCell.h: Added the NEEDS_DESTRUCTOR  macro to make it easier for classes to indicate that instead of being 
      allocated in a destructor MarkedAllocator that they will handle their destruction themselves through the 
      use of a finalizer.
      (JSC):
      (HasImmortalStructure): New template to help us determine at compile-time if a particular class 
      should be allocated in the immortal structure MarkedAllocator. The default value is false. In order 
      to be allocated in the immortal structure allocator, classes must specialize this template. Also added 
      a macro to make it easier for classes to specialize the template.
      (JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
      * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be 
      accessed safely when the object is being destroyed.
      (JSC):
      (JSDestructibleObject):
      (JSC::JSDestructibleObject::classInfo):
      (JSC::JSDestructibleObject::JSDestructibleObject):
      (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
      * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all 
      of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
      (JSC::JSGlobalObject::reset):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one 
      for the m_rareData field when it's created.
      (JSC::JSGlobalObject::create):
      (JSC):
      * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
      (JSGlobalThis):
      (JSC::JSGlobalThis::JSGlobalThis):
      * runtime/JSPropertyNameIterator.h: Has an immortal Structure.
      (JSC):
      * runtime/JSScope.cpp:
      (JSC):
      * runtime/JSString.h: Has an immortal Structure.
      (JSC):
      * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
      (JSWrapperObject):
      (JSC::JSWrapperObject::JSWrapperObject):
      * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
      (JSC):
      * runtime/NameInstance.h: Inherit from JSDestructibleObject.
      (NameInstance):
      * runtime/RegExp.h: Has immortal Structure.
      (JSC):
      * runtime/RegExpObject.cpp: Inheritance cleanup.
      (JSC):
      * runtime/SparseArrayValueMap.h: Has immortal Structure.
      (JSC):
      * runtime/Structure.h: Has immortal Structure.
      (JSC):
      * runtime/StructureChain.h: Ditto.
      (JSC):
      * runtime/SymbolTable.h: Ditto.
      (SharedSymbolTable):
      (JSC):
      
      Source/WebCore: 
      
      No new tests.
      
      * ForwardingHeaders/runtime/JSDestructableObject.h: Added.
      * bindings/js/JSDOMWrapper.h: Inherits from JSDestructibleObject.
      (JSDOMWrapper):
      (WebCore::JSDOMWrapper::JSDOMWrapper):
      * bindings/scripts/CodeGeneratorJS.pm: Add finalizers to anything that inherits from JSGlobalObject,
      e.g. JSDOMWindow and JSWorkerContexts. For those classes we also need to use the NEEDS_DESTRUCTOR macro.
      (GenerateHeader):
      * bridge/objc/objc_runtime.h: Inherit from JSDestructibleObject.
      (ObjcFallbackObjectImp):
      * bridge/objc/objc_runtime.mm:
      (Bindings):
      (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
      * bridge/runtime_array.cpp: Use a finalizer so that JSArray isn't forced to inherit from JSDestructibleObject.
      (JSC):
      (JSC::RuntimeArray::destroy):
      * bridge/runtime_array.h:
      (JSC::RuntimeArray::create):
      (JSC):
      * bridge/runtime_object.cpp: Inherit from JSDestructibleObject.
      (Bindings):
      (JSC::Bindings::RuntimeObject::RuntimeObject):
      * bridge/runtime_object.h:
      (RuntimeObject):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128813 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      013fd88d
  8. 12 Sep, 2012 1 commit
    • fpizlo@apple.com's avatar
      JSC should have property butterflies · d8dd0535
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=91933
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      This changes the JSC object model. Previously, all objects had fast lookup for
      named properties. Integer indexed properties were only fast if you used a
      JSArray. With this change, all objects have fast indexed properties. This is
      accomplished without any space overhead by using a bidirectional object layout,
      aka butterflies. Each JSObject has a m_butterfly pointer where previously it
      had a m_outOfLineStorage pointer. To the left of the location pointed to by
      m_butterfly, we place all named out-of-line properties. To the right, we place
      all indexed properties along with indexing meta-data. Though, some indexing
      meta-data is placed in the 8-byte word immediately left of the pointed-to
      location; this is in anticipation of the indexing meta-data being small enough
      in the common case that m_butterfly always points to the first indexed
      property.
              
      This is performance neutral, except on tests that use indexed properties on
      plain objects, where the speed-up is in excess of an order of magnitude.
              
      One notable aspect of what this change brings is that it allows indexing
      storage to morph over time. Currently this is only used to allow all non-array
      objects to start out without any indexed storage. But it could be used for
      some kinds of array type inference in the future.
      
      * API/JSCallbackObject.h:
      (JSCallbackObject):
      * API/JSCallbackObjectFunctions.h:
      (JSC::::getOwnPropertySlotByIndex):
      (JSC):
      (JSC::::getOwnNonIndexPropertyNames):
      * API/JSObjectRef.cpp:
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/ArrayProfile.h:
      (JSC):
      (JSC::arrayModeFromStructure):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitDirectPutById):
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::execute):
      * dfg/DFGAdjacencyList.h:
      (JSC::DFG::AdjacencyList::AdjacencyList):
      (AdjacencyList):
      * dfg/DFGArrayMode.cpp:
      (JSC::DFG::fromObserved):
      (JSC::DFG::modeAlreadyChecked):
      (JSC::DFG::modeToString):
      * dfg/DFGArrayMode.h:
      (DFG):
      (JSC::DFG::modeUsesButterfly):
      (JSC::DFG::modeIsJSArray):
      (JSC::DFG::isInBoundsAccess):
      (JSC::DFG::modeSupportsLength):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::handleGetByOffset):
      (JSC::DFG::ByteCodeParser::parseBlock):
      * dfg/DFGCSEPhase.cpp:
      (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
      (JSC::DFG::CSEPhase::performNodeCSE):
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::fixupNode):
      (JSC::DFG::FixupPhase::addNode):
      (FixupPhase):
      (JSC::DFG::FixupPhase::checkArray):
      * dfg/DFGGraph.h:
      (JSC::DFG::Graph::byValIsPure):
      * dfg/DFGNode.h:
      (JSC::DFG::Node::Node):
      (Node):
      * dfg/DFGNodeType.h:
      (DFG):
      * dfg/DFGOperations.cpp:
      (JSC::DFG::putByVal):
      * dfg/DFGOperations.h:
      * dfg/DFGPredictionPropagationPhase.cpp:
      (JSC::DFG::PredictionPropagationPhase::propagate):
      * dfg/DFGRepatch.cpp:
      (JSC::DFG::generateProtoChainAccessStub):
      (JSC::DFG::tryCacheGetByID):
      (JSC::DFG::tryBuildGetByIDList):
      (JSC::DFG::emitPutReplaceStub):
      (JSC::DFG::emitPutTransitionStub):
      (JSC::DFG::tryBuildPutByIdList):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::checkArray):
      (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
      (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
      (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
      (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::callOperation):
      (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedGetById):
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedGetById):
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGStructureCheckHoistingPhase.cpp:
      (JSC::DFG::StructureCheckHoistingPhase::run):
      * heap/CopiedSpace.h:
      (CopiedSpace):
      * jit/JIT.h:
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateBasicStorage):
      (JSC::JIT::emitAllocateJSArray):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_new_array):
      (JSC::JIT::emitSlow_op_new_array):
      * jit/JITPropertyAccess.cpp:
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::compileGetDirectOffset):
      (JSC::JIT::emit_op_put_by_val):
      (JSC::JIT::compileGetByIdHotPath):
      (JSC::JIT::emit_op_put_by_id):
      (JSC::JIT::compilePutDirectOffset):
      (JSC::JIT::privateCompilePatchGetArrayLength):
      * jit/JITPropertyAccess32_64.cpp:
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::emit_op_put_by_val):
      (JSC::JIT::compileGetByIdHotPath):
      (JSC::JIT::emit_op_put_by_id):
      (JSC::JIT::compilePutDirectOffset):
      (JSC::JIT::compileGetDirectOffset):
      (JSC::JIT::privateCompilePatchGetArrayLength):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * jsc.cpp:
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter.asm:
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/Arguments.cpp:
      (JSC::Arguments::deletePropertyByIndex):
      (JSC::Arguments::defineOwnProperty):
      * runtime/ArrayConstructor.cpp:
      * runtime/ArrayConventions.h: Added.
      (JSC):
      (JSC::isDenseEnoughForVector):
      (JSC::indexingHeaderForArray):
      (JSC::baseIndexingHeaderForArray):
      * runtime/ArrayPrototype.cpp:
      (JSC::ArrayPrototype::create):
      (JSC):
      (JSC::ArrayPrototype::ArrayPrototype):
      (JSC::arrayProtoFuncToString):
      (JSC::arrayProtoFuncJoin):
      (JSC::arrayProtoFuncSort):
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncMap):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncForEach):
      (JSC::arrayProtoFuncSome):
      (JSC::arrayProtoFuncReduce):
      (JSC::arrayProtoFuncReduceRight):
      * runtime/ArrayPrototype.h:
      (ArrayPrototype):
      (JSC::ArrayPrototype::createStructure):
      * runtime/ArrayStorage.h: Added.
      (JSC):
      (ArrayStorage):
      (JSC::ArrayStorage::ArrayStorage):
      (JSC::ArrayStorage::from):
      (JSC::ArrayStorage::butterfly):
      (JSC::ArrayStorage::indexingHeader):
      (JSC::ArrayStorage::length):
      (JSC::ArrayStorage::setLength):
      (JSC::ArrayStorage::vectorLength):
      (JSC::ArrayStorage::setVectorLength):
      (JSC::ArrayStorage::copyHeaderFromDuringGC):
      (JSC::ArrayStorage::inSparseMode):
      (JSC::ArrayStorage::lengthOffset):
      (JSC::ArrayStorage::vectorLengthOffset):
      (JSC::ArrayStorage::numValuesInVectorOffset):
      (JSC::ArrayStorage::vectorOffset):
      (JSC::ArrayStorage::indexBiasOffset):
      (JSC::ArrayStorage::sparseMapOffset):
      (JSC::ArrayStorage::sizeFor):
      * runtime/Butterfly.h: Added.
      (JSC):
      (Butterfly):
      (JSC::Butterfly::Butterfly):
      (JSC::Butterfly::totalSize):
      (JSC::Butterfly::fromBase):
      (JSC::Butterfly::offsetOfIndexingHeader):
      (JSC::Butterfly::offsetOfPublicLength):
      (JSC::Butterfly::offsetOfVectorLength):
      (JSC::Butterfly::indexingHeader):
      (JSC::Butterfly::propertyStorage):
      (JSC::Butterfly::indexingPayload):
      (JSC::Butterfly::arrayStorage):
      (JSC::Butterfly::offsetOfPropertyStorage):
      (JSC::Butterfly::indexOfPropertyStorage):
      (JSC::Butterfly::base):
      * runtime/ButterflyInlineMethods.h: Added.
      (JSC):
      (JSC::Butterfly::createUninitialized):
      (JSC::Butterfly::create):
      (JSC::Butterfly::createUninitializedDuringCollection):
      (JSC::Butterfly::base):
      (JSC::Butterfly::growPropertyStorage):
      (JSC::Butterfly::growArrayRight):
      (JSC::Butterfly::resizeArray):
      (JSC::Butterfly::unshift):
      (JSC::Butterfly::shift):
      * runtime/ClassInfo.h:
      (MethodTable):
      (JSC):
      * runtime/IndexingHeader.h: Added.
      (JSC):
      (IndexingHeader):
      (JSC::IndexingHeader::offsetOfIndexingHeader):
      (JSC::IndexingHeader::offsetOfPublicLength):
      (JSC::IndexingHeader::offsetOfVectorLength):
      (JSC::IndexingHeader::IndexingHeader):
      (JSC::IndexingHeader::vectorLength):
      (JSC::IndexingHeader::setVectorLength):
      (JSC::IndexingHeader::publicLength):
      (JSC::IndexingHeader::setPublicLength):
      (JSC::IndexingHeader::from):
      (JSC::IndexingHeader::fromEndOf):
      (JSC::IndexingHeader::propertyStorage):
      (JSC::IndexingHeader::arrayStorage):
      (JSC::IndexingHeader::butterfly):
      * runtime/IndexingHeaderInlineMethods.h: Added.
      (JSC):
      (JSC::IndexingHeader::preCapacity):
      (JSC::IndexingHeader::indexingPayloadSizeInBytes):
      * runtime/IndexingType.h: Added.
      (JSC):
      (JSC::hasIndexingHeader):
      * runtime/JSActivation.cpp:
      (JSC::JSActivation::JSActivation):
      (JSC::JSActivation::visitChildren):
      (JSC::JSActivation::getOwnNonIndexPropertyNames):
      * runtime/JSActivation.h:
      (JSActivation):
      (JSC::JSActivation::tearOff):
      * runtime/JSArray.cpp:
      (JSC):
      (JSC::createArrayButterflyInDictionaryIndexingMode):
      (JSC::JSArray::setLengthWritable):
      (JSC::JSArray::defineOwnProperty):
      (JSC::JSArray::getOwnPropertySlot):
      (JSC::JSArray::getOwnPropertyDescriptor):
      (JSC::JSArray::put):
      (JSC::JSArray::deleteProperty):
      (JSC::JSArray::getOwnNonIndexPropertyNames):
      (JSC::JSArray::unshiftCountSlowCase):
      (JSC::JSArray::setLength):
      (JSC::JSArray::pop):
      (JSC::JSArray::push):
      (JSC::JSArray::shiftCount):
      (JSC::JSArray::unshiftCount):
      (JSC::JSArray::sortNumeric):
      (JSC::JSArray::sort):
      (JSC::JSArray::fillArgList):
      (JSC::JSArray::copyToArguments):
      (JSC::JSArray::compactForSorting):
      * runtime/JSArray.h:
      (JSC):
      (JSArray):
      (JSC::JSArray::JSArray):
      (JSC::JSArray::length):
      (JSC::JSArray::createStructure):
      (JSC::JSArray::isLengthWritable):
      (JSC::createArrayButterfly):
      (JSC::JSArray::create):
      (JSC::JSArray::tryCreateUninitialized):
      * runtime/JSBoundFunction.cpp:
      (JSC::boundFunctionCall):
      (JSC::boundFunctionConstruct):
      (JSC::JSBoundFunction::finishCreation):
      * runtime/JSCell.cpp:
      (JSC::JSCell::getOwnNonIndexPropertyNames):
      (JSC):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSFunction.cpp:
      (JSC::JSFunction::getOwnPropertySlot):
      (JSC::JSFunction::getOwnPropertyDescriptor):
      (JSC::JSFunction::getOwnNonIndexPropertyNames):
      (JSC::JSFunction::defineOwnProperty):
      * runtime/JSFunction.h:
      (JSFunction):
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      * runtime/JSGlobalData.h:
      (JSGlobalData):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::reset):
      * runtime/JSONObject.cpp:
      (JSC::Stringifier::Holder::appendNextProperty):
      (JSC::Walker::walk):
      * runtime/JSObject.cpp:
      (JSC):
      (JSC::JSObject::visitButterfly):
      (JSC::JSObject::visitChildren):
      (JSC::JSFinalObject::visitChildren):
      (JSC::JSObject::getOwnPropertySlotByIndex):
      (JSC::JSObject::put):
      (JSC::JSObject::putByIndex):
      (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
      (JSC::JSObject::enterDictionaryIndexingMode):
      (JSC::JSObject::createArrayStorage):
      (JSC::JSObject::createInitialArrayStorage):
      (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
      (JSC::JSObject::putDirectAccessor):
      (JSC::JSObject::deleteProperty):
      (JSC::JSObject::deletePropertyByIndex):
      (JSC::JSObject::getOwnPropertyNames):
      (JSC::JSObject::getOwnNonIndexPropertyNames):
      (JSC::JSObject::preventExtensions):
      (JSC::JSObject::fillGetterPropertySlot):
      (JSC::JSObject::putIndexedDescriptor):
      (JSC::JSObject::defineOwnIndexedProperty):
      (JSC::JSObject::allocateSparseIndexMap):
      (JSC::JSObject::deallocateSparseIndexMap):
      (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
      (JSC::JSObject::putByIndexBeyondVectorLength):
      (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
      (JSC::JSObject::putDirectIndexBeyondVectorLength):
      (JSC::JSObject::getNewVectorLength):
      (JSC::JSObject::increaseVectorLength):
      (JSC::JSObject::checkIndexingConsistency):
      (JSC::JSObject::growOutOfLineStorage):
      (JSC::JSObject::getOwnPropertyDescriptor):
      (JSC::putDescriptor):
      (JSC::JSObject::putDirectMayBeIndex):
      (JSC::JSObject::defineOwnNonIndexProperty):
      (JSC::JSObject::defineOwnProperty):
      (JSC::JSObject::getOwnPropertySlotSlow):
      * runtime/JSObject.h:
      (JSC::JSObject::getArrayLength):
      (JSObject):
      (JSC::JSObject::getVectorLength):
      (JSC::JSObject::putDirectIndex):
      (JSC::JSObject::canGetIndexQuickly):
      (JSC::JSObject::getIndexQuickly):
      (JSC::JSObject::canSetIndexQuickly):
      (JSC::JSObject::setIndexQuickly):
      (JSC::JSObject::initializeIndex):
      (JSC::JSObject::completeInitialization):
      (JSC::JSObject::inSparseIndexingMode):
      (JSC::JSObject::butterfly):
      (JSC::JSObject::outOfLineStorage):
      (JSC::JSObject::offsetForLocation):
      (JSC::JSObject::indexingShouldBeSparse):
      (JSC::JSObject::butterflyOffset):
      (JSC::JSObject::butterflyAddress):
      (JSC::JSObject::arrayStorage):
      (JSC::JSObject::arrayStorageOrZero):
      (JSC::JSObject::ensureArrayStorage):
      (JSC::JSObject::checkIndexingConsistency):
      (JSC::JSNonFinalObject::JSNonFinalObject):
      (JSC):
      (JSC::JSObject::setButterfly):
      (JSC::JSObject::setButterflyWithoutChangingStructure):
      (JSC::JSObject::JSObject):
      (JSC::JSObject::inlineGetOwnPropertySlot):
      (JSC::JSObject::putDirectInternal):
      (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
      (JSC::JSObject::putDirectWithoutTransition):
      (JSC::offsetInButterfly):
      (JSC::offsetRelativeToPatchedStorage):
      (JSC::indexRelativeToBase):
      (JSC::offsetRelativeToBase):
      * runtime/JSPropertyNameIterator.cpp:
      (JSC::JSPropertyNameIterator::create):
      * runtime/JSSymbolTableObject.cpp:
      (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
      * runtime/JSSymbolTableObject.h:
      (JSSymbolTableObject):
      * runtime/JSTypeInfo.h:
      (JSC):
      (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
      (JSC::TypeInfo::overridesGetPropertyNames):
      * runtime/LiteralParser.cpp:
      (JSC::::parse):
      * runtime/ObjectConstructor.cpp:
      * runtime/ObjectPrototype.cpp:
      (JSC::ObjectPrototype::ObjectPrototype):
      (JSC):
      * runtime/ObjectPrototype.h:
      (ObjectPrototype):
      * runtime/PropertyOffset.h:
      (JSC::offsetInOutOfLineStorage):
      * runtime/PropertyStorage.h: Added.
      (JSC):
      * runtime/PutDirectIndexMode.h: Added.
      (JSC):
      * runtime/RegExpMatchesArray.cpp:
      (JSC::RegExpMatchesArray::RegExpMatchesArray):
      (JSC):
      (JSC::RegExpMatchesArray::create):
      (JSC::RegExpMatchesArray::finishCreation):
      * runtime/RegExpMatchesArray.h:
      (RegExpMatchesArray):
      (JSC::RegExpMatchesArray::createStructure):
      * runtime/RegExpObject.cpp:
      (JSC::RegExpObject::getOwnNonIndexPropertyNames):
      * runtime/RegExpObject.h:
      (RegExpObject):
      * runtime/Reject.h: Added.
      (JSC):
      (JSC::reject):
      * runtime/SparseArrayValueMap.cpp: Added.
      (JSC):
      * runtime/SparseArrayValueMap.h: Added.
      (JSC):
      (SparseArrayEntry):
      (JSC::SparseArrayEntry::SparseArrayEntry):
      (SparseArrayValueMap):
      (JSC::SparseArrayValueMap::sparseMode):
      (JSC::SparseArrayValueMap::setSparseMode):
      (JSC::SparseArrayValueMap::lengthIsReadOnly):
      (JSC::SparseArrayValueMap::setLengthIsReadOnly):
      (JSC::SparseArrayValueMap::find):
      (JSC::SparseArrayValueMap::remove):
      (JSC::SparseArrayValueMap::notFound):
      (JSC::SparseArrayValueMap::isEmpty):
      (JSC::SparseArrayValueMap::contains):
      (JSC::SparseArrayValueMap::size):
      (JSC::SparseArrayValueMap::begin):
      (JSC::SparseArrayValueMap::end):
      * runtime/SparseArrayValueMapInlineMethods.h: Added.
      (JSC):
      (JSC::SparseArrayValueMap::SparseArrayValueMap):
      (JSC::SparseArrayValueMap::~SparseArrayValueMap):
      (JSC::SparseArrayValueMap::finishCreation):
      (JSC::SparseArrayValueMap::create):
      (JSC::SparseArrayValueMap::destroy):
      (JSC::SparseArrayValueMap::createStructure):
      (JSC::SparseArrayValueMap::add):
      (JSC::SparseArrayValueMap::putEntry):
      (JSC::SparseArrayValueMap::putDirect):
      (JSC::SparseArrayEntry::get):
      (JSC::SparseArrayEntry::getNonSparseMode):
      (JSC::SparseArrayValueMap::visitChildren):
      * runtime/StorageBarrier.h: Removed.
      * runtime/StringObject.cpp:
      (JSC::StringObject::putByIndex):
      (JSC):
      (JSC::StringObject::deletePropertyByIndex):
      * runtime/StringObject.h:
      (StringObject):
      * runtime/StringPrototype.cpp:
      * runtime/Structure.cpp:
      (JSC::Structure::Structure):
      (JSC::Structure::materializePropertyMap):
      (JSC::Structure::nonPropertyTransition):
      (JSC):
      * runtime/Structure.h:
      (Structure):
      (JSC::Structure::indexingType):
      (JSC::Structure::indexingTypeIncludingHistory):
      (JSC::Structure::indexingTypeOffset):
      (JSC::Structure::create):
      * runtime/StructureTransitionTable.h:
      (JSC):
      (JSC::toAttributes):
      (JSC::newIndexingType):
      (JSC::StructureTransitionTable::Hash::hash):
      * tests/mozilla/js1_6/Array/regress-304828.js:
      
      Source/WebCore: 
      
      Teach the DOM that to intercept get/put on indexed properties, you now have
      to override getOwnPropertySlotByIndex and putByIndex.
      
      No new tests because no new behavior. One test was rebased because indexed
      property iteration order now matches other engines (indexed properties always
      come first).
      
      * bindings/js/ArrayValue.cpp:
      (WebCore::ArrayValue::get):
      * bindings/js/JSBlobCustom.cpp:
      (WebCore::JSBlobConstructor::constructJSBlob):
      * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
      (WebCore::JSCanvasRenderingContext2D::setWebkitLineDash):
      * bindings/js/JSDOMStringListCustom.cpp:
      (WebCore::toDOMStringList):
      * bindings/js/JSDOMStringMapCustom.cpp:
      (WebCore::JSDOMStringMap::deletePropertyByIndex):
      (WebCore):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::getOwnPropertySlot):
      (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
      (WebCore):
      (WebCore::JSDOMWindow::putByIndex):
      (WebCore::JSDOMWindow::deletePropertyByIndex):
      * bindings/js/JSDOMWindowShell.cpp:
      (WebCore::JSDOMWindowShell::getOwnPropertySlotByIndex):
      (WebCore):
      (WebCore::JSDOMWindowShell::putByIndex):
      (WebCore::JSDOMWindowShell::deletePropertyByIndex):
      * bindings/js/JSDOMWindowShell.h:
      (JSDOMWindowShell):
      * bindings/js/JSHistoryCustom.cpp:
      (WebCore::JSHistory::deletePropertyByIndex):
      (WebCore):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::populateContextMenuItems):
      * bindings/js/JSLocationCustom.cpp:
      (WebCore::JSLocation::deletePropertyByIndex):
      (WebCore):
      * bindings/js/JSStorageCustom.cpp:
      (WebCore::JSStorage::deletePropertyByIndex):
      (WebCore):
      * bindings/js/JSWebSocketCustom.cpp:
      (WebCore::JSWebSocketConstructor::constructJSWebSocket):
      * bindings/js/ScriptValue.cpp:
      (WebCore::jsToInspectorValue):
      * bindings/js/SerializedScriptValue.cpp:
      (WebCore::CloneSerializer::serialize):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader):
      (GenerateImplementation):
      * bridge/runtime_array.cpp:
      (JSC::RuntimeArray::RuntimeArray):
      * bridge/runtime_array.h:
      (JSC::RuntimeArray::createStructure):
      (RuntimeArray):
      
      LayoutTests: 
      
      Modify the JSON test to indicate that iterating over properties now returns
      indexed properties first. This is a behavior change that makes us more
      compliant with other implementations.
              
      Also check in new expected file for the edge cases of indexed property access
      with prototype accessors. This changeset introduces a known regression in that
      department, which is tracked here: https://bugs.webkit.org/show_bug.cgi?id=96596
      
      * fast/js/resources/JSON-stringify.js:
      * platform/mac/fast/js/primitive-property-access-edge-cases-expected.txt: Added.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128400 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      d8dd0535
  9. 11 Sep, 2012 1 commit
    • ggaren@apple.com's avatar
      JSActivation should inline allocate its registers, and eliminate · 06a8bb6e
      ggaren@apple.com authored
      'arguments' registers in the common case
      https://bugs.webkit.org/show_bug.cgi?id=96427
      
      Reviewed by Filip Pizlo.
      
      This cuts the size class for simple closures down to 64 bytes.
      
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::BytecodeGenerator): Set the usesNonStrictEval
      flag, which is new. Use a more specific test for whether a function
      uses 'arguments', so we can avoid allocating, initializing, and tearing
      off those registers in the common case. Distinguish between capturing
      arguments and not, so we can avoid allocating space for arguments in
      the torn-off object.
      
      We can make this even more general in the future, with some bytecode
      generator refactoring.
      
      (JSC::BytecodeGenerator::resolve): Updated for new interface.
      
      * bytecompiler/BytecodeGenerator.h:
      (BytecodeGenerator):
      (JSC::BytecodeGenerator::symbolTable): Updated some types.
      
      * heap/Heap.cpp:
      (JSC::Heap::isValidAllocation): Allow large allocations, now that they
      are both supported and used.
      
      * heap/Heap.h:
      (Heap): Added a new form of allocateCell that specifies the full size
      of the allocation, to allow for extra space on the end.
      
      * interpreter/CallFrame.h:
      (JSC::ExecState::argumentOffset):
      (JSC::ExecState::argumentOffsetIncludingThis):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::unwindCallFrame): Refactored this code to be more
      specific about tearing off 'arguments' vs activations. This is something
      I forgot in my last patch, and it is required now that we can have
      acitvations without 'arguments' registers.
      
      * runtime/Arguments.h:
      (JSC::Arguments::setRegisters): No need for setRegisters anymore because
      the activation object's storage doesn't change.
      
      * runtime/JSActivation.cpp:
      (JSC::JSActivation::JSActivation): Initialize our storage manually because
      it's not declared to the C++ compiler.
      
      (JSC::JSActivation::visitChildren): No copyAndAppend because our storage
      is not out-of-line anymore.
      
      (JSC::JSActivation::symbolTableGet):
      (JSC::JSActivation::symbolTablePut):
      (JSC::JSActivation::getOwnPropertyNames):
      (JSC::JSActivation::symbolTablePutWithAttributes):
      (JSC::JSActivation::getOwnPropertySlot):
      (JSC::JSActivation::getOwnPropertyDescriptor):
      (JSC::JSActivation::argumentsGetter): Refactored isTornOff() testing to
      avoid using a data member and to avoid hard-coding any offset assumptions.
      
      * runtime/JSActivation.h:
      (JSC):
      (JSActivation):
      (JSC::JSActivation::create):
      (JSC::JSActivation::isDynamicScope):
      (JSC::JSActivation::captureStart):
      (JSC::JSActivation::storageSize):
      (JSC::JSActivation::storageSizeInBytes):
      (JSC::JSActivation::registerOffset):
      (JSC::JSActivation::tearOff):
      (JSC::JSActivation::isTornOff):
      (JSC::JSActivation::storage):
      (JSC::JSActivation::allocationSize):
      (JSC::JSActivation::isValid): New helper functions for doing the math
      on our inline storage. Note that in the "AllOfTheThings" tear-off case,
      the number of things is not known at compile time, so we store the
      number in the argument count register. We can't just copy the raw contents
      of the register beacuse we need a value that is safe for precise marking,
      and the value in the register file has an invalid tag.
      
      * runtime/JSCell.h:
      (JSC::allocateCell): New function for allocating with extra storage
      on the end.
      
      * runtime/JSSymbolTableObject.h:
      (JSC::JSSymbolTableObject::JSSymbolTableObject):
      (JSC::JSSymbolTableObject::finishCreation):
      * runtime/JSVariableObject.h:
      (JSC::JSVariableObject::JSVariableObject):
      (JSVariableObject): Make it easier for subclasses to use their symbol
      tables during construction, by passing the table as a constructor argument.
      
      * runtime/SymbolTable.h:
      (JSC::SharedSymbolTable::usesNonStrictEval):
      (JSC::SharedSymbolTable::setUsesNonStrictEval):
      (SharedSymbolTable):
      (JSC::SharedSymbolTable::captureMode):
      (JSC::SharedSymbolTable::setCaptureMode):
      (JSC::SharedSymbolTable::captureStart):
      (JSC::SharedSymbolTable::setCaptureStart):
      (JSC::SharedSymbolTable::captureEnd):
      (JSC::SharedSymbolTable::setCaptureEnd):
      (JSC::SharedSymbolTable::parameterCountIncludingThis):
      (JSC::SharedSymbolTable::setParameterCountIncludingThis):
      (JSC::SharedSymbolTable::SharedSymbolTable): Added data members to more
      precisely describe what kind of capture is in play, and to avoid having
      data members in the activation. We expect N activations per symbol table,
      so this can be a big savings in heavy closure usage.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128260 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      06a8bb6e
  10. 10 Sep, 2012 2 commits
    • mhahnenberg@apple.com's avatar
      Remove m_classInfo from JSCell · bd52e3e5
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=96311
      
      Reviewed by Oliver Hunt.
      
      Now that no one is using the ClassInfo in JSCell, we can remove it for the greater good. This is a 1.5% win on v8v7 and
      a 1.7% win on kraken, and is an overall performance progression.
      
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Had to rearrange the order of when we take things off the free list
      and when we store the Structure in the object because we would clobber the free list otherwise. This made it not okay for
      the structure argument and the scratch register to alias one another. Also removed the store of the ClassInfo pointer in the
      object. Yay!
      (SpeculativeJIT):
      * dfg/DFGSpeculativeJIT32_64.cpp: Since it's no longer okay for for the scratch register and structure register to alias
      one another as stated above, had to add an extra temporary for passing the Structure.
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp: Ditto.
      (JSC::DFG::SpeculativeJIT::compile):
      * jit/JITInlineMethods.h:
      (JSC::JIT::emitAllocateBasicJSObject): Similar changes to DFG's inline allocation except that it removed the object from
      the free list first, so no changes were necessary there.
      * llint/LowLevelInterpreter.asm: Change the constants for amount of inline storage to match PropertyOffset.h and remove
      the store of the ClassInfo pointer during inline allocation.
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/JSCell.h: Remove the m_classInfo field and associated methods.
      (JSCell):
      * runtime/JSObject.h:
      (JSObject):
      * runtime/PropertyOffset.h: Expand the number of inline storage properties to take up the extra space that we're freeing
      with the removal of the ClassInfo pointer.
      (JSC):
      * runtime/Structure.h:
      (JSC):
      (JSC::JSCell::JSCell):
      (JSC::JSCell::finishCreation):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128146 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      bd52e3e5
    • mhahnenberg@apple.com's avatar
      Combine MarkStack and SlotVisitor into single class · a57e6716
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=96043
      
      Reviewed by Geoff Garen.
      
      Move all of MarkStack into SlotVisitor. The remaining stuff in MarkStack.cpp actually has to do 
      with MarkStack management/allocation. Cleaned up a few of the header files while I was at it.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      * dfg/DFGCommon.h:
      * heap/GCThreadSharedData.cpp:
      * heap/GCThreadSharedData.h:
      (GCThreadSharedData):
      * heap/HeapRootVisitor.h:
      * heap/MarkStack.cpp:
      (JSC):
      * heap/MarkStack.h:
      (JSC):
      (MarkStackSegment):
      (JSC::MarkStackSegment::data):
      (JSC::MarkStackSegment::capacityFromSize):
      (JSC::MarkStackSegment::sizeFromCapacity):
      (MarkStackSegmentAllocator):
      (MarkStackArray):
      * heap/MarkStackInlineMethods.h:
      (JSC::MarkStackArray::postIncTop):
      (JSC):
      (JSC::MarkStackArray::preDecTop):
      (JSC::MarkStackArray::setTopForFullSegment):
      (JSC::MarkStackArray::setTopForEmptySegment):
      (JSC::MarkStackArray::top):
      (JSC::MarkStackArray::validatePrevious):
      (JSC::MarkStackArray::append):
      (JSC::MarkStackArray::canRemoveLast):
      (JSC::MarkStackArray::removeLast):
      (JSC::MarkStackArray::isEmpty):
      (JSC::MarkStackArray::size):
      * heap/SlotVisitor.cpp: Added.
      (JSC):
      (JSC::SlotVisitor::SlotVisitor):
      (JSC::SlotVisitor::~SlotVisitor):
      (JSC::SlotVisitor::setup):
      (JSC::SlotVisitor::reset):
      (JSC::SlotVisitor::append):
      (JSC::visitChildren):
      (JSC::SlotVisitor::donateKnownParallel):
      (JSC::SlotVisitor::drain):
      (JSC::SlotVisitor::drainFromShared):
      (JSC::SlotVisitor::mergeOpaqueRoots):
      (JSC::SlotVisitor::startCopying):
      (JSC::SlotVisitor::allocateNewSpaceSlow):
      (JSC::SlotVisitor::allocateNewSpaceOrPin):
      (JSC::JSString::tryHashConstLock):
      (JSC::JSString::releaseHashConstLock):
      (JSC::JSString::shouldTryHashConst):
      (JSC::SlotVisitor::internalAppend):
      (JSC::SlotVisitor::copyAndAppend):
      (JSC::SlotVisitor::doneCopying):
      (JSC::SlotVisitor::harvestWeakReferences):
      (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
      (JSC::SlotVisitor::validate):
      * heap/SlotVisitor.h:
      (JSC):
      (SlotVisitor):
      (JSC::SlotVisitor::sharedData):
      (JSC::SlotVisitor::isEmpty):
      (JSC::SlotVisitor::visitCount):
      (JSC::SlotVisitor::resetChildCount):
      (JSC::SlotVisitor::childCount):
      (JSC::SlotVisitor::incrementChildCount):
      (ParallelModeEnabler):
      (JSC::ParallelModeEnabler::ParallelModeEnabler):
      (JSC::ParallelModeEnabler::~ParallelModeEnabler):
      * heap/SlotVisitorInlineMethods.h:
      (JSC::SlotVisitor::append):
      (JSC):
      (JSC::SlotVisitor::appendUnbarrieredPointer):
      (JSC::SlotVisitor::appendUnbarrieredValue):
      (JSC::SlotVisitor::internalAppend):
      (JSC::SlotVisitor::addWeakReferenceHarvester):
      (JSC::SlotVisitor::addUnconditionalFinalizer):
      (JSC::SlotVisitor::addOpaqueRoot):
      (JSC::SlotVisitor::containsOpaqueRoot):
      (JSC::SlotVisitor::opaqueRootCount):
      (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary):
      (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable):
      (JSC::SlotVisitor::donate):
      (JSC::SlotVisitor::donateAndDrain):
      * jit/JITWriteBarrier.h:
      (JSC::SlotVisitor::append):
      * jit/JumpReplacementWatchpoint.cpp:
      * runtime/JSCell.h:
      * runtime/Structure.h:
      (JSC::SlotVisitor::internalAppend):
      * runtime/WriteBarrier.h:
      (JSC):
      (JSC::SlotVisitor::append):
      (JSC::SlotVisitor::appendValues):
      * yarr/YarrJIT.cpp:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      a57e6716
  11. 30 Aug, 2012 1 commit
    • benjamin@webkit.org's avatar
      Replace JSC::UString by WTF::String · cff06e46
      benjamin@webkit.org authored
      https://bugs.webkit.org/show_bug.cgi?id=95271
      
      Patch by Benjamin Poulain <bpoulain@apple.com> on 2012-08-30
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      Having JSC::UString and WTF::String increase the complexity of working on WebKit, and
      add useless conversions in the bindings. It also cause some code bloat.
      
      The performance advantages of UString have been ported over in previous patches. This patch
      is the last step: getting rid of UString.
      
      In addition to the simplified code, this also reduce the binary size by 15kb on x86_64.
      
      * API/OpaqueJSString.cpp:
      (OpaqueJSString::ustring):
      * runtime/Identifier.h:
      (JSC::Identifier::ustring):
      To avoid changing everything at once, the function named ustring() were kept as is. They
      will be renamed in a follow up patch.
      
      * runtime/JSString.h:
      (JSC::JSString::string):
      (JSC::JSValue::toWTFString):
      (JSC::inlineJSValueNotStringtoString):
      (JSC::JSValue::toWTFStringInline):
      Since JSValue::toString() already exist (and return the JSString), the direct accessor is renamed
      to ::toWTFString(). We may change ::string() to ::jsString() and ::toWTFString() to ::toString()
      in the future.
      
      * runtime/StringPrototype.cpp:
      (JSC::substituteBackreferencesSlow): Replace the use of UString::getCharacters<>() by String::getCharactersWithUpconvert<>().
      
      Source/WebCore: 
      
      Update the code to use String instead of UString.
      
      On x86_64, this reduces the binary size by 22kb.
      
      Since it is no longer possible to differenciate JSC::jsString() and WebCore::jsString() by the input
      types, WebCore::jsString() is renated to WebCore::jsStringWithCache().
      
      Since the cache is using a PtrHash, JSC::jsString() is used in place of the old WebCore::jsString() when
      the string is generated locally. This is because the cache can never match in those cases.
      
      Source/WebKit/blackberry: 
      
      Replace UString by String.
      
      * WebCoreSupport/ClientExtension.cpp:
      * WebCoreSupport/PagePopupBlackBerry.cpp:
      (WebCore::PagePopupBlackBerry::installDomFunction):
      
      Source/WebKit/efl: 
      
      Replace UString by String.
      
      * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
      (DumpRenderTreeSupportEfl::sendWebIntentResponse):
      * ewk/ewk_frame.cpp:
      (ewk_frame_script_execute):
      
      Source/WebKit/gtk: 
      
      Replace UString by String.
      
      * gdom/ConvertToGCharPrivate.h:
      (copyAsGchar):
      
      Source/WebKit/mac: 
      
      Get rid of UString, replace it by String, and simplify the code when possible.
      
      On x86_64, this reduces the binary size by 7kb.
      
      * Plugins/Hosted/NetscapePluginHostProxy.mm:
      (identifierFromIdentifierRep):
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray):
      (WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
      * Plugins/Hosted/ProxyInstance.mm:
      (WebKit::ProxyRuntimeMethod::create):
      (WebKit::ProxyRuntimeMethod::finishCreation):
      (WebKit::ProxyInstance::getPropertyNames):
      (WebKit::ProxyInstance::methodsNamed):
      (WebKit::ProxyInstance::fieldNamed):
      * WebView/WebFrame.mm:
      (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
      (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
      * WebView/WebScriptDebugDelegate.mm:
      (-[WebScriptCallFrame functionName]):
      (-[WebScriptCallFrame evaluateWebScript:]):
      * WebView/WebScriptDebugger.h:
      (WTF):
      (JSC):
      (WebScriptDebugger):
      * WebView/WebScriptDebugger.mm:
      (toNSURL):
      (WebScriptDebugger::sourceParsed):
      * WebView/WebView.mm:
      (aeDescFromJSValue):
      
      Source/WebKit/qt: 
      
      Replace UString by String.
      
      * Api/qwebelement.cpp:
      (QWebElement::evaluateJavaScript):
      
      Source/WebKit/win: 
      
      Replace UString by String.
      
      * WebFrame.cpp:
      (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):
      * WebView.cpp:
      (WebView::stringByEvaluatingJavaScriptFromString):
      
      Source/WebKit/wx: 
      
      Update the #includes to use the correct types.
      
      * WebFrame.cpp:
      * WebView.cpp:
      
      Source/WebKit2: 
      
      Update to code to switch from UString to String.
      
      * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
      (WebKit::JSNPMethod::finishCreation):
      * WebProcess/Plugins/Netscape/JSNPMethod.h:
      (WebKit::JSNPMethod::create):
      (JSNPMethod):
      * WebProcess/Plugins/Netscape/JSNPObject.cpp:
      (WebKit::npIdentifierFromIdentifier):
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::evaluate):
      (WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):
      
      Source/WTF: 
      
      * wtf/Platform.h: Useless edit to force a full build. This is needed for some bots for some reason.
      * wtf/text/WTFString.h: Export a symbol that was exported on UString and needed in WebCore.
      
      Add String::getCharactersWithUpconvert<>(), which is similar to String::getCharacters<>() but with the same
      behaviors as UString::getCharacters<>().
      
      String::getCharactersWithUpconvert<>() is useful when manipulating multiple strings, it allow writting code
      using 16bits characters if any of the input String is not 8bit.
      
      Tools: 
      
      Get rid of UString.
      
      * DumpRenderTree/efl/WorkQueueItemEfl.cpp:
      * gdb/webkit.py:
      (WTFStringPrinter.to_string):
      (JSCIdentifierPrinter.to_string):
      (JSCJSStringPrinter.to_string):
      (add_pretty_printers):
      
      Websites/webkit.org: 
      
      Update the coding style to avoid mentioning a class that no longer exist.
      
      * coding/coding-style.html:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@127191 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      cff06e46
  12. 25 Aug, 2012 1 commit
    • ggaren@apple.com's avatar
      Don't use malloc / destructors for activation objects · 47e224a6
      ggaren@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=94897
      
      Reviewed by Oliver Hunt.
      
      65% faster on v8-real-earley.
      
      Lots of boilerplate here, but the jist is this:
      
      (1) Use CopiedSpace instead of malloc to allocate the activation's
      backing store.
      
      (2) Use MarkedSpace instead of ref-counting to allocate the symbol table.
      
      (3) ==> No more destructor.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::stronglyVisitStrongReferences):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::symbolTable):
      (CodeBlock):
      (JSC::GlobalCodeBlock::GlobalCodeBlock):
      (JSC::FunctionCodeBlock::FunctionCodeBlock):
      (FunctionCodeBlock): SymbolTable is a GC object now, so it gets a write
      barrier and visit calls instead of ref-counting. I changed all CodeBlocks
      to use shared symbol tables because the distinction between shared and
      unshared hurt my head.
      
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::resolve):
      (JSC::BytecodeGenerator::resolveConstDecl):
      (JSC::BytecodeGenerator::emitPutStaticVar):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::parseBlock):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile): Sometimes, a period just wants
      to be an arrow. And then C++ is there to accommodate.
      
      * jit/JITDriver.h:
      (JSC::jitCompileFunctionIfAppropriate):
      * runtime/Arguments.h:
      (ArgumentsData):
      (JSC::Arguments::setRegisters):
      (Arguments):
      (JSC::Arguments::argument):
      (JSC::Arguments::finishCreation):
      * runtime/Executable.cpp:
      (JSC::FunctionExecutable::FunctionExecutable):
      (JSC::ProgramExecutable::compileInternal):
      (JSC::FunctionExecutable::compileForCallInternal):
      (JSC::FunctionExecutable::compileForConstructInternal):
      (JSC::FunctionExecutable::visitChildren):
      * runtime/Executable.h:
      (JSC::FunctionExecutable::symbolTable):
      (FunctionExecutable):
      * runtime/ExecutionHarness.h:
      (JSC::prepareFunctionForExecution): I changed from WriteBarrier to
      WriteBarrierBase so activations could reuse StorageBarrier and PropertyStorage.
      
      * runtime/JSActivation.cpp:
      (JSC::JSActivation::JSActivation):
      (JSC::JSActivation::finishCreation): Allocate the symbol table here,
      after we're fully constructed, to avoid GC during initialization.
      
      (JSC::JSActivation::visitChildren):
      (JSC::JSActivation::symbolTableGet):
      (JSC::JSActivation::symbolTablePut):
      (JSC::JSActivation::getOwnPropertyNames):
      (JSC::JSActivation::symbolTablePutWithAttributes):
      * runtime/JSActivation.h:
      (JSC::JSActivation::create):
      (JSActivation):
      (JSC::JSActivation::registerOffset):
      (JSC):
      (JSC::JSActivation::registerArraySize):
      (JSC::JSActivation::registerArraySizeInBytes):
      (JSC::JSActivation::tearOff): Tear-off zero-initializes all uncopied
      registers. This makes it safe to copyAndAppend the full buffer in
      visitChildren, without any extra checks.
      
      * runtime/JSCell.h:
      (JSCell): Moved a shared default set of flags into this base class, so
      I could use it in a few places.
      
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      * runtime/JSGlobalData.h:
      (JSGlobalData): New structure for symbol tables.
      
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::JSGlobalObject):
      (JSC::JSGlobalObject::addStaticGlobals):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::symbolTableHasProperty): We don't need an inline
      symbol table -- JSSymbolTableObject will GC allocate one for us.
      
      * runtime/JSObject.h:
      (JSObject):
      * runtime/JSSegmentedVariableObject.h:
      (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
      * runtime/JSStaticScopeObject.cpp:
      (JSC):
      (JSC::JSStaticScopeObject::visitChildren): NULL check our register store
      because finishCreation allocates an object now, so we may get marked
      before we've assigned to our register store.
      
      * runtime/JSStaticScopeObject.h:
      (JSC::JSStaticScopeObject::finishCreation):
      (JSC::JSStaticScopeObject::JSStaticScopeObject):
      (JSStaticScopeObject): No more destructor for this object, either, since
      it no longer embeds a hash table.
      
      * runtime/JSSymbolTableObject.cpp:
      (JSC::JSSymbolTableObject::visitChildren):
      (JSC::JSSymbolTableObject::deleteProperty):
      (JSC::JSSymbolTableObject::getOwnPropertyNames):
      * runtime/JSSymbolTableObject.h:
      (JSC::JSSymbolTableObject::symbolTable):
      (JSSymbolTableObject):
      (JSC::JSSymbolTableObject::JSSymbolTableObject):
      (JSC::JSSymbolTableObject::finishCreation):
      (JSC::symbolTableGet):
      (JSC::symbolTablePut):
      (JSC::symbolTablePutWithAttributes): SymbolTableObject allocates a symbol
      table automatically if one isn't provided. (Activations provide their
      own, which they get from compiled code.)
      
      * runtime/JSVariableObject.cpp:
      (JSC):
      * runtime/JSVariableObject.h:
      (JSC::JSVariableObject::registerAt):
      (JSC::JSVariableObject::addressOfRegisters):
      (JSVariableObject):
      (JSC::JSVariableObject::JSVariableObject):
      (JSC::JSVariableObject::finishCreation): Removed a bunch of obsolete code.
      Activations manage their registers directly now.
      
      * runtime/StorageBarrier.h:
      (StorageBarrier):
      (JSC::StorageBarrier::operator!):
      
      * runtime/SymbolTable.cpp:
      (JSC):
      (JSC::SharedSymbolTable::destroy):
      * runtime/SymbolTable.h:
      (JSC::SharedSymbolTable::create):
      (SharedSymbolTable):
      (JSC::SharedSymbolTable::createStructure):
      (JSC::SharedSymbolTable::SharedSymbolTable): Boilerplat code to
      make shared symbol table GC-allocated.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126695 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      47e224a6
  13. 23 Aug, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      Change behavior of MasqueradesAsUndefined to better accommodate DFG changes · 3b9069ce
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=93884
      
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
      masquerade as undefined within frame B, but it will continue to masquerade in frame A. 
      
      There are two primary changes that are taking place here. One is to thread the ExecState* through  
      JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's  
      JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two  
      are distinct, then the object cannot MasqueradeAsUndefined. 
      
      The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined 
      flag in the Structure is checked. For C++ code, this check has been factored into its own function in  
      Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has  
      had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed  
      through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers 
      that are MasqueradesAsUndefined.
      
      * API/JSValueRef.cpp:
      (JSValueToBoolean):
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      * bytecode/Watchpoint.h:
      (WatchpointSet):
      * debugger/DebuggerCallFrame.h:
      (JSC::DebuggerCallFrame::callFrame):
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::execute):
      * dfg/DFGCFGSimplificationPhase.cpp:
      (JSC::DFG::CFGSimplificationPhase::run):
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncSome):
      * runtime/BooleanConstructor.cpp:
      (JSC::constructBoolean):
      (JSC::callBooleanConstructor):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::JSGlobalObject):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
      * runtime/JSString.h:
      (JSC::JSCell::toBoolean):
      (JSC::JSValue::toBoolean):
      * runtime/JSValue.h:
      * runtime/ObjectConstructor.cpp:
      (JSC::toPropertyDescriptor):
      * runtime/Operations.cpp:
      (JSC::jsTypeStringForValue):
      (JSC::jsIsObjectType):
      * runtime/Operations.h:
      (JSC):
      (JSC::JSValue::equalSlowCaseInline):
      * runtime/RegExpConstructor.cpp:
      (JSC::setRegExpConstructorMultiline):
      * runtime/RegExpPrototype.cpp:
      (JSC::regExpProtoFuncToString):
      * runtime/Structure.h:
      (Structure):
      (JSC::Structure::globalObjectOffset):
      (JSC::Structure::masqueradesAsUndefined):
      (JSC):
      
      Source/WebCore: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
      masquerade as undefined within frame B, but it will continue to masquerade in frame A. 
      
      Test: fast/js/document-all-between-frames.html
      
      All of the changes in WebCore are simply passing the additional ExecState argument to JSValue::toBoolean. 
      
      * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
      (WebCore::JSSQLStatementErrorCallback::handleEvent):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::addEventListener):
      (WebCore::JSDOMWindow::removeEventListener):
      * bindings/js/JSDataViewCustom.cpp:
      (WebCore::getDataViewMember):
      * bindings/js/JSDeviceMotionEventCustom.cpp:
      (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
      * bindings/js/JSDeviceOrientationEventCustom.cpp:
      (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
      * bindings/js/JSDictionary.cpp:
      (WebCore::JSDictionary::convertValue):
      * bindings/js/JSHTMLCanvasElementCustom.cpp:
      (WebCore::JSHTMLCanvasElement::getContext):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::populateContextMenuItems):
      * bindings/js/JSMessageEventCustom.cpp:
      (WebCore::handleInitMessageEvent):
      * bindings/js/JSWebGLRenderingContextCustom.cpp:
      (WebCore::dataFunctionMatrix):
      * bindings/js/JSXMLHttpRequestCustom.cpp:
      (WebCore::JSXMLHttpRequest::open):
      * bindings/js/JavaScriptCallFrame.cpp:
      (WebCore::JavaScriptCallFrame::exec):
      (WebCore):
      * bindings/js/JavaScriptCallFrame.h:
      (JavaScriptCallFrame):
      * bindings/js/ScriptDebugServer.cpp:
      (WebCore::ScriptDebugServer::hasBreakpoint):
      * bindings/js/SerializedScriptValue.cpp:
      (WebCore::CloneSerializer::dumpIfTerminal):
      * bindings/scripts/CodeGeneratorJS.pm: Also add the custom create function for MasqueradesAsUndefined JS DOM wrappers. 
      (GenerateEventListenerCall):
      (GenerateHeader):
      (JSValueToNative):
      * bindings/scripts/test/JS/JSTestEventTarget.cpp:
      (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
      (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
      * bindings/scripts/test/JS/JSTestEventTarget.h:
      (WebCore::JSTestEventTarget::create):
      * bindings/scripts/test/JS/JSTestObj.cpp:
      (WebCore::setJSTestObjCreate):
      (WebCore::setJSTestObjReflectedBooleanAttr):
      (WebCore::setJSTestObjReflectedCustomBooleanAttr):
      (WebCore::jsTestObjPrototypeFunctionAddEventListener):
      (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
      * bridge/c/c_utility.cpp:
      (JSC::Bindings::convertValueToNPVariant):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::convertValueToJObject):
      * bridge/qt/qt_runtime.cpp:
      (JSC::Bindings::convertValueToQVariant):
      
      Source/WebKit/mac: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
      masquerade as undefined within frame B, but it will continue to masquerade in frame A. 
      
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray): Passing ExecState to toBoolean call.
      
      Source/WebKit2: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
      masquerade as undefined within frame B, but it will continue to masquerade in frame A.
      
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant): Passing ExecState to toBoolean call.
      
      LayoutTests: 
      
      Added a test that uses a variety of ways of checking whether something is correctly 
      masquerading as undefined (or not) in a subframe.
      
      * fast/js/document-all-between-frames-expected.txt: Added.
      * fast/js/document-all-between-frames.html: Added.
      * fast/js/resources/document-all-between-frames-subframe.html: Added.
      * platform/chromium/TestExpectations: Chromium treats document.all differently, so skip our new test.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126494 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      3b9069ce
  14. 15 Aug, 2012 2 commits
    • commit-queue@webkit.org's avatar
      Unreviewed, rolling out r125687. · 45974062
      commit-queue@webkit.org authored
      http://trac.webkit.org/changeset/125687
      https://bugs.webkit.org/show_bug.cgi?id=94147
      
      It broke the whole world (Requested by Ossy_night on #webkit).
      
      Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-08-15
      
      Source/JavaScriptCore:
      
      * API/JSValueRef.cpp:
      (JSValueToBoolean):
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      * bytecode/Watchpoint.h:
      (WatchpointSet):
      * debugger/DebuggerCallFrame.h:
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::execute):
      * dfg/DFGCFGSimplificationPhase.cpp:
      (JSC::DFG::CFGSimplificationPhase::run):
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncSome):
      * runtime/BooleanConstructor.cpp:
      (JSC::constructBoolean):
      (JSC::callBooleanConstructor):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::JSGlobalObject):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      * runtime/JSString.h:
      (JSC::JSCell::toBoolean):
      (JSC::JSValue::toBoolean):
      * runtime/JSValue.h:
      * runtime/ObjectConstructor.cpp:
      (JSC::toPropertyDescriptor):
      * runtime/Operations.cpp:
      (JSC::jsTypeStringForValue):
      (JSC::jsIsObjectType):
      * runtime/Operations.h:
      (JSC):
      (JSC::JSValue::equalSlowCaseInline):
      * runtime/RegExpConstructor.cpp:
      (JSC::setRegExpConstructorMultiline):
      * runtime/RegExpPrototype.cpp:
      (JSC::regExpProtoFuncToString):
      * runtime/Structure.h:
      
      Source/WebCore:
      
      * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
      (WebCore::JSSQLStatementErrorCallback::handleEvent):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::addEventListener):
      (WebCore::JSDOMWindow::removeEventListener):
      * bindings/js/JSDataViewCustom.cpp:
      (WebCore::getDataViewMember):
      * bindings/js/JSDeviceMotionEventCustom.cpp:
      (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
      * bindings/js/JSDeviceOrientationEventCustom.cpp:
      (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
      * bindings/js/JSDictionary.cpp:
      (WebCore::JSDictionary::convertValue):
      * bindings/js/JSDirectoryEntryCustom.cpp:
      (WebCore::JSDirectoryEntry::getFile):
      (WebCore::JSDirectoryEntry::getDirectory):
      * bindings/js/JSDirectoryEntrySyncCustom.cpp:
      (WebCore::getFlags):
      * bindings/js/JSHTMLCanvasElementCustom.cpp:
      (WebCore::JSHTMLCanvasElement::getContext):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::populateContextMenuItems):
      * bindings/js/JSMessageEventCustom.cpp:
      (WebCore::handleInitMessageEvent):
      * bindings/js/JSWebGLRenderingContextCustom.cpp:
      (WebCore::dataFunctionMatrix):
      * bindings/js/JSXMLHttpRequestCustom.cpp:
      (WebCore::JSXMLHttpRequest::open):
      * bindings/js/JavaScriptCallFrame.cpp:
      * bindings/js/JavaScriptCallFrame.h:
      (JavaScriptCallFrame):
      * bindings/js/ScriptDebugServer.cpp:
      (WebCore::ScriptDebugServer::hasBreakpoint):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateEventListenerCall):
      (GenerateHeader):
      (JSValueToNative):
      * bindings/scripts/test/JS/JSTestEventTarget.cpp:
      (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
      (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
      * bindings/scripts/test/JS/JSTestEventTarget.h:
      (WebCore::JSTestEventTarget::create):
      * bindings/scripts/test/JS/JSTestObj.cpp:
      (WebCore::setJSTestObjCreate):
      (WebCore::setJSTestObjReflectedBooleanAttr):
      (WebCore::setJSTestObjReflectedCustomBooleanAttr):
      (WebCore::jsTestObjPrototypeFunctionAddEventListener):
      (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
      * bridge/c/c_utility.cpp:
      (JSC::Bindings::convertValueToNPVariant):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::convertValueToJObject):
      * bridge/qt/qt_runtime.cpp:
      (JSC::Bindings::convertValueToQVariant):
      
      Source/WebKit/mac:
      
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray):
      
      Source/WebKit2:
      
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
      
      LayoutTests:
      
      * fast/js/document-all-between-frames-expected.txt: Removed.
      * fast/js/document-all-between-frames.html: Removed.
      * fast/js/resources/document-all-between-frames-subframe.html: Removed.
      * platform/chromium/TestExpectations:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125711 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      45974062
    • mhahnenberg@apple.com's avatar
      Change behavior of MasqueradesAsUndefined to better accommodate DFG changes · 35d5455b
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=93884
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
      masquerade as undefined within frame B, but it will continue to masquerade in frame A.
      
      There are two primary changes that are taking place here. One is to thread the ExecState* through 
      JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's 
      JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two 
      are distinct, then the object cannot MasqueradeAsUndefined.
      
      The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined
      flag in the Structure is checked. For C++ code, this check has been factored into its own function in 
      Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has 
      had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed 
      through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers
      that are MasqueradesAsUndefined.
      
      * API/JSValueRef.cpp:
      (JSValueToBoolean):
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      * bytecode/Watchpoint.h:
      (WatchpointSet):
      * debugger/DebuggerCallFrame.h:
      (JSC::DebuggerCallFrame::callFrame):
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::execute):
      * dfg/DFGCFGSimplificationPhase.cpp:
      (JSC::DFG::CFGSimplificationPhase::run):
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::compile):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_is_undefined):
      (JSC::JIT::emit_op_jeq_null):
      (JSC::JIT::emit_op_jneq_null):
      (JSC::JIT::emit_op_eq_null):
      (JSC::JIT::emit_op_neq_null):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncSome):
      * runtime/BooleanConstructor.cpp:
      (JSC::constructBoolean):
      (JSC::callBooleanConstructor):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::JSGlobalObject):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
      * runtime/JSString.h:
      (JSC::JSCell::toBoolean):
      (JSC::JSValue::toBoolean):
      * runtime/JSValue.h:
      * runtime/ObjectConstructor.cpp:
      (JSC::toPropertyDescriptor):
      * runtime/Operations.cpp:
      (JSC::jsTypeStringForValue):
      (JSC::jsIsObjectType):
      * runtime/Operations.h:
      (JSC):
      (JSC::JSValue::equalSlowCaseInline):
      * runtime/RegExpConstructor.cpp:
      (JSC::setRegExpConstructorMultiline):
      * runtime/RegExpPrototype.cpp:
      (JSC::regExpProtoFuncToString):
      * runtime/Structure.h:
      (Structure):
      (JSC::Structure::globalObjectOffset):
      (JSC::Structure::masqueradesAsUndefined):
      (JSC):
      
      Source/WebCore: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
      masquerade as undefined within frame B, but it will continue to masquerade in frame A.
      
      Test: fast/js/document-all-between-frames.html
      
      All of the changes in WebCore are simply passing the additional ExecState argument to JSValue::toBoolean.
      
      * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
      (WebCore::JSSQLStatementErrorCallback::handleEvent):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::addEventListener):
      (WebCore::JSDOMWindow::removeEventListener):
      * bindings/js/JSDataViewCustom.cpp:
      (WebCore::getDataViewMember):
      * bindings/js/JSDeviceMotionEventCustom.cpp:
      (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
      * bindings/js/JSDeviceOrientationEventCustom.cpp:
      (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
      * bindings/js/JSDictionary.cpp:
      (WebCore::JSDictionary::convertValue):
      * bindings/js/JSDirectoryEntryCustom.cpp:
      (WebCore::JSDirectoryEntry::getFile):
      (WebCore::JSDirectoryEntry::getDirectory):
      * bindings/js/JSDirectoryEntrySyncCustom.cpp:
      (WebCore::getFlags):
      * bindings/js/JSHTMLCanvasElementCustom.cpp:
      (WebCore::JSHTMLCanvasElement::getContext):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::populateContextMenuItems):
      * bindings/js/JSMessageEventCustom.cpp:
      (WebCore::handleInitMessageEvent):
      * bindings/js/JSWebGLRenderingContextCustom.cpp:
      (WebCore::dataFunctionMatrix):
      * bindings/js/JSXMLHttpRequestCustom.cpp:
      (WebCore::JSXMLHttpRequest::open):
      * bindings/js/JavaScriptCallFrame.cpp:
      (WebCore::JavaScriptCallFrame::exec):
      (WebCore):
      * bindings/js/JavaScriptCallFrame.h:
      (JavaScriptCallFrame):
      * bindings/js/ScriptDebugServer.cpp:
      (WebCore::ScriptDebugServer::hasBreakpoint):
      * bindings/scripts/CodeGeneratorJS.pm: Also add the custom create function for MasqueradesAsUndefined JS DOM wrappers.
      (GenerateEventListenerCall):
      (GenerateHeader):
      (JSValueToNative):
      * bindings/scripts/test/JS/JSTestEventTarget.cpp:
      (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
      (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
      * bindings/scripts/test/JS/JSTestEventTarget.h:
      (WebCore::JSTestEventTarget::create):
      * bindings/scripts/test/JS/JSTestObj.cpp:
      (WebCore::setJSTestObjCreate):
      (WebCore::setJSTestObjReflectedBooleanAttr):
      (WebCore::setJSTestObjReflectedCustomBooleanAttr):
      (WebCore::jsTestObjPrototypeFunctionAddEventListener):
      (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
      * bridge/c/c_utility.cpp:
      (JSC::Bindings::convertValueToNPVariant):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::convertValueToJObject):
      * bridge/qt/qt_runtime.cpp:
      (JSC::Bindings::convertValueToQVariant):
      
      Source/WebKit/mac: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
      masquerade as undefined within frame B, but it will continue to masquerade in frame A.
      
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray): Passing ExecState to toBoolean call.
      
      Source/WebKit2: 
      
      With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
      MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
      we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
      objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
      For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
      masquerade as undefined within frame B, but it will continue to masquerade in frame A.
      
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant): Passing ExecState to toBoolean call.
      
      LayoutTests: 
      
      Added a test that uses a variety of ways of checking whether something is correctly 
      masquerading as undefined (or not) in a subframe.
      
      * fast/js/document-all-between-frames-expected.txt: Added.
      * fast/js/document-all-between-frames.html: Added.
      * fast/js/resources/document-all-between-frames-subframe.html: Added.
      * platform/chromium/TestExpectations: Chromium treats document.all differently, so skip our new test.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125687 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      35d5455b
  15. 01 Aug, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      C++ code should get ClassInfo from the Structure · f19f935f
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=92892
      
      Reviewed by Geoffrey Garen.
      
      In our march to remove ClassInfo from our JSCell object headers, we can switch 
      C++ code over to grabbing the ClassInfo from the Structure since it is finally 
      safe to do so now that Structure access is safe during finalization/destruction. 
      The remaining JIT code changes can be done in a separate patch.
      
      * heap/MarkedBlock.cpp:
      (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more 
      since the Structure should still be valid at this point.
      * heap/WeakSetInlines.h:
      (JSC::WeakBlock::finalize): Ditto.
      * runtime/JSCell.h:
      (JSC):
      * runtime/Structure.h:
      (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be 
      inline. Use a different method of getting the JSCell's Structure based on 
      whether we're in GC_VALIDATION mode or not, since always using get() will cause 
      infinite recursion in GC_VALIDATION mode.
      (JSC):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124355 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      f19f935f
  16. 06 Jun, 2012 1 commit
    • msaboff@apple.com's avatar
      ENH: Add Logging to GC Marking Phase · 9d9eab6c
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=88364
      
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore: 
      
      Log GC marking to stderr or a file.  The logging in controlled
      with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
      If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
      logged to a file otherwise it is logged to stderr.
      
      When logging is enabled, the GC is built single threaded since the
      log output from the various threads isn't buffered and output in a
      thread safe manner.
      
      * heap/Heap.cpp:
      (JSC::Heap::markRoots):
      * heap/MarkStack.cpp:
      (JSC::MarkStackThreadSharedData::resetChildren):
      (JSC::MarkStackThreadSharedData::childVisitCount):
      (JSC::MarkStackThreadSharedData::markingThreadMain):
      (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
      (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
      (JSC::MarkStackThreadSharedData::reset):
      * heap/MarkStack.h:
      (MarkStackThreadSharedData):
      (MarkStack):
      (JSC::MarkStack::sharedData):
      (JSC::MarkStack::resetChildCount):
      (JSC::MarkStack::childCount):
      (JSC::MarkStack::incrementChildCount):
      * runtime/JSArray.cpp:
      (JSC::JSArray::visitChildren):
      * runtime/JSCell.cpp:
      (JSC::JSCell::className):
      * runtime/JSCell.h:
      (JSCell):
      (JSC::JSCell::visitChildren):
      * runtime/JSString.cpp:
      (JSC::JSString::visitChildren):
      * runtime/JSString.h:
      (JSString):
      * runtime/Structure.h:
      (JSC::MarkStack::internalAppend):
      
      Source/WTF: 
      
      * wtf/DataLog.cpp:
      (WTF::dataLogString): Additional method to support GC Mark logging.
      * wtf/DataLog.h:
      * wtf/Platform.h: New ENABLE_OBJECT_MARK_LOGGING flag macro.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@119633 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      9d9eab6c
  17. 18 May, 2012 1 commit
    • fpizlo@apple.com's avatar
      DFG should have control flow graph simplification · 79c51ee1
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=84553
      
      Source/JavaScriptCore: 
      
      Reviewed by Oliver Hunt.
              
      Merged r115512 from dfgopt.
      
      This change gives the DFG the ability to simplify the control flow graph
      as part of an optimization fixpoint that includes CSE, CFA, and constant
      folding. This required a number of interesting changes including:
              
      - Solidifying the set of invariants that the DFG obeys. For example, the
        head and tail of each basic block must advertise the set of live locals
        and the set of available locals, respectively. It must do so by
        referring to the first access to the local in the block (for head) and
        the last one (for tail). This patch introduces the start of a
        validation step that may be turned on even with asserts disabled. To
        ensure that these invariants are preserved, I had to remove the
        redundant phi elimination phase. For now I just remove the call, but in
        the future we will probably remove it entirely unless we find a use for
        it.
              
      - Making it easier to get the boolean version of a JSValue. This is a
        pure operation, but we previously did not treat it as such.
              
      - Fixing the merging and filtering of AbstractValues that correspond to
        concrete JSValues. This was previously broken and was limiting the
        effect of running constant folding. Fixing this meant that I had to
        change how constant folding eliminates GetLocal nodes, so as to ensure
        that the resulting graph still obeys DFG rules.
              
      - Introducing simplified getters for some of the things that DFG phases
        want to know about, like the Nth child of a node (now just
        graph.child(...) if you don't care about performance too much) or
        getting successors of a basic block.
              
      The current CFG simplifier can handle almost all of the cases that it
      ought to handle; the noteworthy one that is not yet handled is removing
      basic blocks that just have jumps. To do this right we need to be able
      to remove jump-only blocks that also perform keep-alive on some values.
      To make this work, we need to be able to hoist the keep-alive into (or
      just above) a Branch. This is not fundamentally difficult but I opted to
      let this patch omit this optimization. We can handle this later.
              
      This is a big win on programs that include inline functions that are
      often called with constant arguments. Of course, SunSpider, V8, and
      Kraken don't count. Those benchmarks are completely neutral with this
      change.
      
      * API/JSValueRef.cpp:
      (JSValueToBoolean):
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::dfgOSREntryDataForBytecodeIndex):
      * bytecode/Operands.h:
      (JSC::Operands::setOperandFirstTime):
      (Operands):
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::initialize):
      (JSC::DFG::AbstractState::execute):
      (JSC::DFG::AbstractState::mergeStateAtTail):
      (JSC::DFG::AbstractState::mergeToSuccessors):
      * dfg/DFGAbstractValue.h:
      (JSC::DFG::AbstractValue::isClear):
      (JSC::DFG::AbstractValue::operator!=):
      (JSC::DFG::AbstractValue::merge):
      (JSC::DFG::AbstractValue::filter):
      (JSC::DFG::AbstractValue::validateIgnoringValue):
      (AbstractValue):
      * dfg/DFGAdjacencyList.h:
      (JSC::DFG::AdjacencyList::child):
      (JSC::DFG::AdjacencyList::setChild):
      (AdjacencyList):
      * dfg/DFGBasicBlock.h:
      (JSC::DFG::BasicBlock::~BasicBlock):
      (BasicBlock):
      (JSC::DFG::BasicBlock::numNodes):
      (JSC::DFG::BasicBlock::nodeIndex):
      (JSC::DFG::BasicBlock::isPhiIndex):
      (JSC::DFG::BasicBlock::isInPhis):
      (JSC::DFG::BasicBlock::isInBlock):
      * dfg/DFGByteCodeParser.cpp:
      (ByteCodeParser):
      (DFG):
      (JSC::DFG::ByteCodeParser::parse):
      * dfg/DFGCFAPhase.cpp:
      (JSC::DFG::CFAPhase::run):
      (JSC::DFG::CFAPhase::performBlockCFA):
      (JSC::DFG::performCFA):
      * dfg/DFGCFAPhase.h:
      (DFG):
      * dfg/DFGCFGSimplificationPhase.cpp: Added.
      (DFG):
      (CFGSimplificationPhase):
      (JSC::DFG::CFGSimplificationPhase::CFGSimplificationPhase):
      (JSC::DFG::CFGSimplificationPhase::run):
      (JSC::DFG::CFGSimplificationPhase::killUnreachable):
      (JSC::DFG::CFGSimplificationPhase::findOperandSource):
      (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
      (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
      (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
      (JSC::DFG::CFGSimplificationPhase::fixPhis):
      (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
      (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
      (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
      (OperandSubstitution):
      (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
      (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
      (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
      (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
      (JSC::DFG::performCFGSimplification):
      * dfg/DFGCFGSimplificationPhase.h: Added.
      (DFG):
      * dfg/DFGCSEPhase.cpp:
      (JSC::DFG::CSEPhase::run):
      (CSEPhase):
      (JSC::DFG::CSEPhase::impureCSE):
      (JSC::DFG::CSEPhase::globalVarLoadElimination):
      (JSC::DFG::CSEPhase::getByValLoadElimination):
      (JSC::DFG::CSEPhase::checkStructureLoadElimination):
      (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
      (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
      (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
      (JSC::DFG::CSEPhase::performNodeCSE):
      (JSC::DFG::CSEPhase::performBlockCSE):
      (JSC::DFG::performCSE):
      * dfg/DFGCSEPhase.h:
      (DFG):
      * dfg/DFGCommon.h:
      * dfg/DFGConstantFoldingPhase.cpp:
      (JSC::DFG::ConstantFoldingPhase::run):
      (JSC::DFG::performConstantFolding):
      * dfg/DFGConstantFoldingPhase.h:
      (DFG):
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compile):
      * dfg/DFGEdge.h:
      (Edge):
      (JSC::DFG::Edge::operator UnspecifiedBoolType*):
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::run):
      (JSC::DFG::FixupPhase::fixupBlock):
      (JSC::DFG::performFixup):
      * dfg/DFGFixupPhase.h:
      (DFG):
      * dfg/DFGGraph.cpp:
      (JSC::DFG::Graph::dump):
      (JSC::DFG::Graph::handleSuccessor):
      (DFG):
      (JSC::DFG::Graph::determineReachability):
      (JSC::DFG::Graph::resetReachability):
      * dfg/DFGGraph.h:
      (JSC::DFG::Graph::deref):
      (JSC::DFG::Graph::changeIndex):
      (Graph):
      (JSC::DFG::Graph::changeEdge):
      (JSC::DFG::Graph::numSuccessors):
      (JSC::DFG::Graph::successor):
      (JSC::DFG::Graph::successorForCondition):
      (JSC::DFG::Graph::isPredictedNumerical):
      (JSC::DFG::Graph::byValIsPure):
      (JSC::DFG::Graph::clobbersWorld):
      (JSC::DFG::Graph::numChildren):
      (JSC::DFG::Graph::child):
      * dfg/DFGNode.h:
      (JSC::DFG::Node::convertToConstant):
      (JSC::DFG::Node::numSuccessors):
      (Node):
      (JSC::DFG::Node::successor):
      (JSC::DFG::Node::successorForCondition):
      * dfg/DFGNodeType.h:
      (DFG):
      * dfg/DFGOSREntry.cpp:
      (JSC::DFG::prepareOSREntry):
      * dfg/DFGOperations.cpp:
      * dfg/DFGPhase.cpp:
      (JSC::DFG::Phase::endPhase):
      * dfg/DFGPhase.h:
      (JSC::DFG::runPhase):
      * dfg/DFGPredictionPropagationPhase.cpp:
      (JSC::DFG::PredictionPropagationPhase::run):
      (JSC::DFG::performPredictionPropagation):
      * dfg/DFGPredictionPropagationPhase.h:
      (DFG):
      * dfg/DFGRedundantPhiEliminationPhase.cpp:
      (JSC::DFG::RedundantPhiEliminationPhase::run):
      (JSC::DFG::performRedundantPhiElimination):
      * dfg/DFGRedundantPhiEliminationPhase.h:
      (DFG):
      * dfg/DFGScoreBoard.h:
      (JSC::DFG::ScoreBoard::use):
      (ScoreBoard):
      (JSC::DFG::ScoreBoard::useIfHasResult):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
      (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
      (JSC::DFG::SpeculativeJIT::compile):
      (JSC::DFG::SpeculativeJIT::createOSREntries):
      (JSC::DFG::SpeculativeJIT::linkOSREntries):
      (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
      (JSC::DFG::SpeculativeJIT::compileRegExpExec):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::nextBlock):
      (SpeculativeJIT):
      (JSC::DFG::SpeculativeJIT::use):
      (JSC::DFG::SpeculativeJIT::jump):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
      (JSC::DFG::SpeculativeJIT::emitBranch):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
      (JSC::DFG::SpeculativeJIT::emitBranch):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGValidate.cpp: Added.
      (DFG):
      (Validate):
      (JSC::DFG::Validate::Validate):
      (JSC::DFG::Validate::validate):
      (JSC::DFG::Validate::reportValidationContext):
      (JSC::DFG::Validate::dumpData):
      (JSC::DFG::Validate::dumpGraphIfAppropriate):
      (JSC::DFG::validate):
      * dfg/DFGValidate.h: Added.
      (DFG):
      (JSC::DFG::validate):
      * dfg/DFGVirtualRegisterAllocationPhase.cpp:
      (JSC::DFG::VirtualRegisterAllocationPhase::run):
      (JSC::DFG::performVirtualRegisterAllocation):
      * dfg/DFGVirtualRegisterAllocationPhase.h:
      (DFG):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncSome):
      * runtime/BooleanConstructor.cpp:
      (JSC::constructBoolean):
      (JSC::callBooleanConstructor):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSObject.cpp:
      (JSC):
      * runtime/JSObject.h:
      * runtime/JSString.cpp:
      (JSC::JSString::toBoolean):
      * runtime/JSString.h:
      (JSString):
      (JSC::JSCell::toBoolean):
      (JSC::JSValue::toBoolean):
      * runtime/JSValue.h:
      * runtime/ObjectConstructor.cpp:
      (JSC::toPropertyDescriptor):
      * runtime/RegExpConstructor.cpp:
      (JSC::setRegExpConstructorMultiline):
      * runtime/RegExpPrototype.cpp:
      (JSC::regExpProtoFuncToString):
      
      Source/WebCore: 
      
      Reviewed by Oliver Hunt.
      
      Merged r115512 from dfgopt.
      
      JSValue::toBoolean(ExecState*) -> JSValue::toBoolean()
              
      No new tests, because no new behavior.
      
      * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
      (WebCore::JSSQLStatementErrorCallback::handleEvent):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::addEventListener):
      (WebCore::JSDOMWindow::removeEventListener):
      * bindings/js/JSDataViewCustom.cpp:
      (WebCore::getDataViewMember):
      * bindings/js/JSDeviceMotionEventCustom.cpp:
      (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
      * bindings/js/JSDeviceOrientationEventCustom.cpp:
      (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
      * bindings/js/JSDictionary.cpp:
      (WebCore::JSDictionary::convertValue):
      * bindings/js/JSDirectoryEntryCustom.cpp:
      (WebCore::JSDirectoryEntry::getFile):
      (WebCore::JSDirectoryEntry::getDirectory):
      * bindings/js/JSDirectoryEntrySyncCustom.cpp:
      (WebCore::getFlags):
      * bindings/js/JSHTMLCanvasElementCustom.cpp:
      (WebCore::JSHTMLCanvasElement::getContext):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::JSInspectorFrontendHost::showContextMenu):
      * bindings/js/JSMessageEventCustom.cpp:
      (WebCore::handleInitMessageEvent):
      * bindings/js/JSWebGLRenderingContextCustom.cpp:
      (WebCore::dataFunctionMatrix):
      * bindings/js/JSXMLHttpRequestCustom.cpp:
      (WebCore::JSXMLHttpRequest::open):
      * bindings/js/ScriptDebugServer.cpp:
      (WebCore::ScriptDebugServer::hasBreakpoint):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateEventListenerCall):
      (GenerateImplementation):
      (JSValueToNative):
      * bridge/c/c_utility.cpp:
      (JSC::Bindings::convertValueToNPVariant):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::convertValueToJObject):
      
      Source/WebKit/mac: 
      
      Reviewed by Oliver Hunt.
              
      Merged r115512 from dfgopt.
      
      JSValue::toBoolean(ExecState*) -> JSValue::toBoolean()
              
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray):
      
      Source/WebKit2: 
      
      Reviewed by Oliver Hunt.
      
      Merged r115512 from dfgopt.
      
      JSValue::toBoolean(ExecState*) -> JSValue::toBoolean()
              
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@117646 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      79c51ee1
  18. 11 May, 2012 1 commit
    • barraclough@apple.com's avatar
      Introduce PropertyName class · 38d3c75b
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=86241
      
      Reviewed by Geoff Garen.
      
      Replace 'const Identifier&' arguments to functions accessing object properties with a new 'PropertyName' type.
      This change paves the way to allow for properties keyed by values that are not Identifiers.
      
      This change is largely a mechanical find & replace.
      It also changes JSFunction's constructor to take a UString& instead of an Identifier&
      (since in some cases we can no longer guarantee that we'lll have an Identifier), and
      unifies Identifier's methods to obtain array indices onto PropertyName.
      
      The new PropertyName class retains the ability to support .impl() and .ustring(), but
      in a future patch we may need to rework this, since not all PropertyNames should be
      equal based on their string representation.
      
      Source/JavaScriptCore: 
      
      * API/JSCallbackFunction.cpp:
      (JSC::JSCallbackFunction::finishCreation):
      * API/JSCallbackFunction.h:
      (JSCallbackFunction):
      (JSC::JSCallbackFunction::create):
      * API/JSCallbackObject.h:
      (JSCallbackObject):
      * API/JSCallbackObjectFunctions.h:
      (JSC::::getOwnPropertySlot):
      (JSC::::getOwnPropertyDescriptor):
      (JSC::::put):
      (JSC::::deleteProperty):
      (JSC::::getStaticValue):
      (JSC::::staticFunctionGetter):
      (JSC::::callbackGetter):
      * API/JSObjectRef.cpp:
      (JSObjectMakeFunctionWithCallback):
      * JSCTypedArrayStubs.h:
      (JSC):
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * debugger/DebuggerActivation.cpp:
      (JSC::DebuggerActivation::getOwnPropertySlot):
      (JSC::DebuggerActivation::put):
      (JSC::DebuggerActivation::putDirectVirtual):
      (JSC::DebuggerActivation::deleteProperty):
      (JSC::DebuggerActivation::getOwnPropertyDescriptor):
      (JSC::DebuggerActivation::defineOwnProperty):
      * debugger/DebuggerActivation.h:
      (DebuggerActivation):
      * jsc.cpp:
      (GlobalObject::addFunction):
      (GlobalObject::addConstructableFunction):
      * runtime/Arguments.cpp:
      (JSC::Arguments::getOwnPropertySlot):
      (JSC::Arguments::getOwnPropertyDescriptor):
      (JSC::Arguments::put):
      (JSC::Arguments::deleteProperty):
      (JSC::Arguments::defineOwnProperty):
      * runtime/Arguments.h:
      (Arguments):
      * runtime/ArrayConstructor.cpp:
      (JSC::ArrayConstructor::finishCreation):
      (JSC::ArrayConstructor::getOwnPropertySlot):
      (JSC::ArrayConstructor::getOwnPropertyDescriptor):
      * runtime/ArrayConstructor.h:
      (ArrayConstructor):
      * runtime/ArrayPrototype.cpp:
      (JSC::ArrayPrototype::getOwnPropertySlot):
      (JSC::ArrayPrototype::getOwnPropertyDescriptor):
      (JSC::putProperty):
      * runtime/ArrayPrototype.h:
      (ArrayPrototype):
      * runtime/BooleanConstructor.cpp:
      (JSC::BooleanConstructor::finishCreation):
      * runtime/BooleanPrototype.cpp:
      (JSC::BooleanPrototype::getOwnPropertySlot):
      (JSC::BooleanPrototype::getOwnPropertyDescriptor):
      * runtime/BooleanPrototype.h:
      (BooleanPrototype):
      * runtime/ClassInfo.h:
      (MethodTable):
      * runtime/DateConstructor.cpp:
      (JSC::DateConstructor::finishCreation):
      (JSC::DateConstructor::getOwnPropertySlot):
      (JSC::DateConstructor::getOwnPropertyDescriptor):
      * runtime/DateConstructor.h:
      (DateConstructor):
      * runtime/DatePrototype.cpp:
      (JSC::DatePrototype::getOwnPropertySlot):
      (JSC::DatePrototype::getOwnPropertyDescriptor):
      * runtime/DatePrototype.h:
      (DatePrototype):
      * runtime/Error.h:
      (JSC::StrictModeTypeErrorFunction::create):
      * runtime/ErrorConstructor.cpp:
      (JSC::ErrorConstructor::finishCreation):
      * runtime/ErrorPrototype.cpp:
      (JSC::ErrorPrototype::getOwnPropertySlot):
      (JSC::ErrorPrototype::getOwnPropertyDescriptor):
      * runtime/ErrorPrototype.h:
      (ErrorPrototype):
      * runtime/FunctionConstructor.cpp:
      (JSC::FunctionConstructor::finishCreation):
      * runtime/FunctionPrototype.cpp:
      (JSC::FunctionPrototype::finishCreation):
      (JSC::FunctionPrototype::addFunctionProperties):
      (JSC::functionProtoFuncBind):
      * runtime/FunctionPrototype.h:
      (JSC::FunctionPrototype::create):
      (FunctionPrototype):
      * runtime/Identifier.cpp:
      (JSC):
      * runtime/Identifier.h:
      (Identifier):
      * runtime/InternalFunction.cpp:
      (JSC::InternalFunction::finishCreation):
      * runtime/InternalFunction.h:
      (InternalFunction):
      * runtime/JSActivation.cpp:
      (JSC::JSActivation::symbolTableGet):
      (JSC::JSActivation::symbolTablePut):
      (JSC::JSActivation::symbolTablePutWithAttributes):
      (JSC::JSActivation::getOwnPropertySlot):
      (JSC::JSActivation::put):
      (JSC::JSActivation::putDirectVirtual):
      (JSC::JSActivation::deleteProperty):
      (JSC::JSActivation::argumentsGetter):
      * runtime/JSActivation.h:
      (JSActivation):
      * runtime/JSArray.cpp:
      (JSC::JSArray::defineOwnProperty):
      (JSC::JSArray::getOwnPropertySlot):
      (JSC::JSArray::getOwnPropertyDescriptor):
      (JSC::JSArray::put):
      (JSC::JSArray::deleteProperty):
      * runtime/JSArray.h:
      (JSArray):
      (JSC):
      * runtime/JSBoundFunction.cpp:
      (JSC::JSBoundFunction::create):
      (JSC::JSBoundFunction::finishCreation):
      * runtime/JSBoundFunction.h:
      (JSBoundFunction):
      * runtime/JSCell.cpp:
      (JSC::JSCell::getOwnPropertySlot):
      (JSC::JSCell::put):
      (JSC::JSCell::deleteProperty):
      (JSC::JSCell::putDirectVirtual):
      (JSC::JSCell::defineOwnProperty):
      (JSC::JSCell::getOwnPropertyDescriptor):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSFunction.cpp:
      (JSC::JSFunction::create):
      (JSC::JSFunction::finishCreation):
      (JSC::JSFunction::argumentsGetter):
      (JSC::JSFunction::callerGetter):
      (JSC::JSFunction::lengthGetter):
      (JSC::JSFunction::getOwnPropertySlot):
      (JSC::JSFunction::getOwnPropertyDescriptor):
      (JSC::JSFunction::put):
      (JSC::JSFunction::deleteProperty):
      (JSC::JSFunction::defineOwnProperty):
      (JSC::getCalculatedDisplayName):
      * runtime/JSFunction.h:
      (JSFunction):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::put):
      (JSC::JSGlobalObject::putDirectVirtual):
      (JSC::JSGlobalObject::defineOwnProperty):
      (JSC::JSGlobalObject::reset):
      (JSC::JSGlobalObject::createThrowTypeError):
      (JSC::JSGlobalObject::getOwnPropertySlot):
      (JSC::JSGlobalObject::getOwnPropertyDescriptor):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      (JSC::JSGlobalObject::hasOwnPropertyForWrite):
      (JSC::JSGlobalObject::symbolTableHasProperty):
      * runtime/JSNotAnObject.cpp:
      (JSC::JSNotAnObject::getOwnPropertySlot):
      (JSC::JSNotAnObject::getOwnPropertyDescriptor):
      (JSC::JSNotAnObject::put):
      (JSC::JSNotAnObject::deleteProperty):
      * runtime/JSNotAnObject.h:
      (JSNotAnObject):
      * runtime/JSONObject.cpp:
      (JSC::JSONObject::getOwnPropertySlot):
      (JSC::JSONObject::getOwnPropertyDescriptor):
      * runtime/JSONObject.h:
      (JSONObject):
      * runtime/JSObject.cpp:
      (JSC::JSObject::put):
      (JSC::JSObject::putDirectVirtual):
      (JSC::JSObject::putDirectAccessor):
      (JSC::JSObject::hasProperty):
      (JSC::JSObject::deleteProperty):
      (JSC::JSObject::hasOwnProperty):
      (JSC::callDefaultValueFunction):
      (JSC::JSObject::findPropertyHashEntry):
      (JSC::JSObject::getPropertySpecificValue):
      (JSC::JSObject::removeDirect):
      (JSC::JSObject::getOwnPropertyDescriptor):
      (JSC::JSObject::getPropertyDescriptor):
      (JSC::putDescriptor):
      (JSC::JSObject::defineOwnProperty):
      * runtime/JSObject.h:
      (JSObject):
      (JSC::JSObject::getDirect):
      (JSC::JSObject::getDirectLocation):
      (JSC::JSObject::inlineGetOwnPropertySlot):
      (JSC::JSObject::getOwnPropertySlot):
      (JSC::JSCell::fastGetOwnPropertySlot):
      (JSC::JSObject::getPropertySlot):
      (JSC::JSObject::get):
      (JSC::JSObject::putDirectInternal):
      (JSC::JSObject::putOwnDataProperty):
      (JSC::JSObject::putDirect):
      (JSC::JSObject::putDirectWithoutTransition):
      (JSC::JSValue::get):
      (JSC::JSValue::put):
      * runtime/JSStaticScopeObject.cpp:
      (JSC::JSStaticScopeObject::put):
      (JSC::JSStaticScopeObject::putDirectVirtual):
      (JSC::JSStaticScopeObject::getOwnPropertySlot):
      * runtime/JSStaticScopeObject.h:
      (JSStaticScopeObject):
      * runtime/JSString.cpp:
      (JSC::JSString::getOwnPropertySlot):
      (JSC::JSString::getStringPropertyDescriptor):
      * runtime/JSString.h:
      (JSString):
      (JSC::JSString::getStringPropertySlot):
      * runtime/JSValue.cpp:
      (JSC::JSValue::putToPrimitive):
      * runtime/JSValue.h:
      (JSC):
      (JSValue):
      * runtime/JSVariableObject.cpp:
      (JSC::JSVariableObject::deleteProperty):
      (JSC::JSVariableObject::symbolTableGet):
      (JSC::JSVariableObject::putDirectVirtual):
      * runtime/JSVariableObject.h:
      (JSVariableObject):
      (JSC::JSVariableObject::symbolTableGet):
      (JSC::JSVariableObject::symbolTablePut):
      (JSC::JSVariableObject::symbolTablePutWithAttributes):
      * runtime/Lookup.cpp:
      (JSC::setUpStaticFunctionSlot):
      * runtime/Lookup.h:
      (JSC::HashTable::entry):
      (JSC):
      (JSC::getStaticPropertySlot):
      (JSC::getStaticPropertyDescriptor):
      (JSC::getStaticFunctionSlot):
      (JSC::getStaticFunctionDescriptor):
      (JSC::getStaticValueSlot):
      (JSC::getStaticValueDescriptor):
      (JSC::lookupPut):
      * runtime/MathObject.cpp:
      (JSC::MathObject::getOwnPropertySlot):
      (JSC::MathObject::getOwnPropertyDescriptor):
      * runtime/MathObject.h:
      (MathObject):
      * runtime/NativeErrorConstructor.h:
      (JSC::NativeErrorConstructor::finishCreation):
      * runtime/NumberConstructor.cpp:
      (JSC):
      (JSC::NumberConstructor::finishCreation):
      (JSC::NumberConstructor::getOwnPropertySlot):
      (JSC::NumberConstructor::getOwnPropertyDescriptor):
      (JSC::NumberConstructor::put):
      (JSC::numberConstructorNaNValue):
      (JSC::numberConstructorNegInfinity):
      (JSC::numberConstructorPosInfinity):
      (JSC::numberConstructorMaxValue):
      (JSC::numberConstructorMinValue):
      * runtime/NumberConstructor.h:
      (NumberConstructor):
      * runtime/NumberPrototype.cpp:
      (JSC::NumberPrototype::getOwnPropertySlot):
      (JSC::NumberPrototype::getOwnPropertyDescriptor):
      * runtime/NumberPrototype.h:
      (NumberPrototype):
      * runtime/ObjectConstructor.cpp:
      (JSC::ObjectConstructor::finishCreation):
      (JSC::ObjectConstructor::getOwnPropertySlot):
      (JSC::ObjectConstructor::getOwnPropertyDescriptor):
      * runtime/ObjectConstructor.h:
      (ObjectConstructor):
      * runtime/ObjectPrototype.cpp:
      (JSC::ObjectPrototype::put):
      (JSC::ObjectPrototype::defineOwnProperty):
      (JSC::ObjectPrototype::getOwnPropertySlot):
      (JSC::ObjectPrototype::getOwnPropertyDescriptor):
      * runtime/ObjectPrototype.h:
      (ObjectPrototype):
      * runtime/PropertySlot.h:
      (PropertySlot):
      (JSC::PropertySlot::getValue):
      * runtime/RegExpConstructor.cpp:
      (JSC):
      (JSC::RegExpConstructor::finishCreation):
      (JSC::RegExpConstructor::getOwnPropertySlot):
      (JSC::RegExpConstructor::getOwnPropertyDescriptor):
      (JSC::regExpConstructorDollar1):
      (JSC::regExpConstructorDollar2):
      (JSC::regExpConstructorDollar3):
      (JSC::regExpConstructorDollar4):
      (JSC::regExpConstructorDollar5):
      (JSC::regExpConstructorDollar6):
      (JSC::regExpConstructorDollar7):
      (JSC::regExpConstructorDollar8):
      (JSC::regExpConstructorDollar9):
      (JSC::regExpConstructorInput):
      (JSC::regExpConstructorMultiline):
      (JSC::regExpConstructorLastMatch):
      (JSC::regExpConstructorLastParen):
      (JSC::regExpConstructorLeftContext):
      (JSC::regExpConstructorRightContext):
      (JSC::RegExpConstructor::put):
      * runtime/RegExpConstructor.h:
      (RegExpConstructor):
      * runtime/RegExpMatchesArray.h:
      (JSC::RegExpMatchesArray::getOwnPropertySlot):
      (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
      (JSC::RegExpMatchesArray::put):
      (JSC::RegExpMatchesArray::deleteProperty):
      (JSC::RegExpMatchesArray::defineOwnProperty):
      * runtime/RegExpObject.cpp:
      (JSC):
      (JSC::RegExpObject::getOwnPropertySlot):
      (JSC::RegExpObject::getOwnPropertyDescriptor):
      (JSC::RegExpObject::deleteProperty):
      (JSC::RegExpObject::defineOwnProperty):
      (JSC::regExpObjectGlobal):
      (JSC::regExpObjectIgnoreCase):
      (JSC::regExpObjectMultiline):
      (JSC::regExpObjectSource):
      (JSC::RegExpObject::put):
      * runtime/RegExpObject.h:
      (RegExpObject):
      * runtime/RegExpPrototype.cpp:
      (JSC::RegExpPrototype::getOwnPropertySlot):
      (JSC::RegExpPrototype::getOwnPropertyDescriptor):
      * runtime/RegExpPrototype.h:
      (RegExpPrototype):
      * runtime/StrictEvalActivation.cpp:
      (JSC::StrictEvalActivation::deleteProperty):
      * runtime/StrictEvalActivation.h:
      (StrictEvalActivation):
      * runtime/StringConstructor.cpp:
      (JSC::StringConstructor::finishCreation):
      (JSC::StringConstructor::getOwnPropertySlot):
      (JSC::StringConstructor::getOwnPropertyDescriptor):
      * runtime/StringConstructor.h:
      (StringConstructor):
      * runtime/StringObject.cpp:
      (JSC::StringObject::getOwnPropertySlot):
      (JSC::StringObject::getOwnPropertyDescriptor):
      (JSC::StringObject::put):
      (JSC::StringObject::defineOwnProperty):
      (JSC::StringObject::deleteProperty):
      * runtime/StringObject.h:
      (StringObject):
      * runtime/StringPrototype.cpp:
      (JSC::StringPrototype::getOwnPropertySlot):
      (JSC::StringPrototype::getOwnPropertyDescriptor):
      * runtime/StringPrototype.h:
      (StringPrototype):
      * runtime/Structure.cpp:
      (JSC::Structure::despecifyDictionaryFunction):
      (JSC::Structure::addPropertyTransitionToExistingStructure):
      (JSC::Structure::addPropertyTransition):
      (JSC::Structure::removePropertyTransition):
      (JSC::Structure::despecifyFunctionTransition):
      (JSC::Structure::attributeChangeTransition):
      (JSC::Structure::addPropertyWithoutTransition):
      (JSC::Structure::removePropertyWithoutTransition):
      (JSC::Structure::get):
      (JSC::Structure::despecifyFunction):
      (JSC::Structure::putSpecificValue):
      (JSC::Structure::remove):
      * runtime/Structure.h:
      (Structure):
      (JSC::Structure::get):
      
      Source/WebCore: 
      
      * WebCore.exp.in:
      * bindings/js/JSCSSStyleDeclarationCustom.cpp:
      (WebCore::cssPropertyIDForJSCSSPropertyName):
      (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate):
      (WebCore::JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate):
      (WebCore::JSCSSStyleDeclaration::putDelegate):
      * bindings/js/JSDOMBinding.cpp:
      (WebCore::findAtomicString):
      (WebCore::objectToStringFunctionGetter):
      * bindings/js/JSDOMBinding.h:
      (WebCore):
      (WebCore::propertyNameToString):
      (WebCore::propertyNameToAtomicString):
      * bindings/js/JSDOMMimeTypeArrayCustom.cpp:
      (WebCore::JSDOMMimeTypeArray::canGetItemsForName):
      (WebCore::JSDOMMimeTypeArray::nameGetter):
      * bindings/js/JSDOMPluginArrayCustom.cpp:
      (WebCore::JSDOMPluginArray::canGetItemsForName):
      (WebCore::JSDOMPluginArray::nameGetter):
      * bindings/js/JSDOMPluginCustom.cpp:
      (WebCore::JSDOMPlugin::canGetItemsForName):
      (WebCore::JSDOMPlugin::nameGetter):
      * bindings/js/JSDOMStringMapCustom.cpp:
      (WebCore::JSDOMStringMap::canGetItemsForName):
      (WebCore::JSDOMStringMap::nameGetter):
      (WebCore::JSDOMStringMap::deleteProperty):
      (WebCore::JSDOMStringMap::putDelegate):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::nonCachingStaticFunctionGetter):
      (WebCore::childFrameGetter):
      (WebCore::namedItemGetter):
      (WebCore::JSDOMWindow::getOwnPropertySlot):
      (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
      (WebCore::JSDOMWindow::put):
      (WebCore::JSDOMWindow::deleteProperty):
      (WebCore::JSDOMWindow::defineOwnProperty):
      * bindings/js/JSDOMWindowShell.cpp:
      (WebCore::JSDOMWindowShell::getOwnPropertySlot):
      (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
      (WebCore::JSDOMWindowShell::put):
      (WebCore::JSDOMWindowShell::putDirectVirtual):
      (WebCore::JSDOMWindowShell::defineOwnProperty):
      (WebCore::JSDOMWindowShell::deleteProperty):
      * bindings/js/JSDOMWindowShell.h:
      (JSDOMWindowShell):
      * bindings/js/JSHTMLAllCollectionCustom.cpp:
      (WebCore::getNamedItems):
      (WebCore::callHTMLAllCollection):
      (WebCore::JSHTMLAllCollection::canGetItemsForName):
      (WebCore::JSHTMLAllCollection::nameGetter):
      (WebCore::JSHTMLAllCollection::item):
      * bindings/js/JSHTMLAppletElementCustom.cpp:
      (WebCore::JSHTMLAppletElement::getOwnPropertySlotDelegate):
      (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
      (WebCore::JSHTMLAppletElement::putDelegate):
      * bindings/js/JSHTMLCollectionCustom.cpp:
      (WebCore::getNamedItems):
      (WebCore::JSHTMLCollection::canGetItemsForName):
      (WebCore::JSHTMLCollection::nameGetter):
      * bindings/js/JSHTMLDocumentCustom.cpp:
      (WebCore::JSHTMLDocument::canGetItemsForName):
      (WebCore::JSHTMLDocument::nameGetter):
      * bindings/js/JSHTMLEmbedElementCustom.cpp:
      (WebCore::JSHTMLEmbedElement::getOwnPropertySlotDelegate):
      (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
      (WebCore::JSHTMLEmbedElement::putDelegate):
      * bindings/js/JSHTMLFormElementCustom.cpp:
      (WebCore::JSHTMLFormElement::canGetItemsForName):
      (WebCore::JSHTMLFormElement::nameGetter):
      * bindings/js/JSHTMLFrameSetElementCustom.cpp:
      (WebCore::JSHTMLFrameSetElement::canGetItemsForName):
      (WebCore::JSHTMLFrameSetElement::nameGetter):
      * bindings/js/JSHTMLObjectElementCustom.cpp:
      (WebCore::JSHTMLObjectElement::getOwnPropertySlotDelegate):
      (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
      (WebCore::JSHTMLObjectElement::putDelegate):
      * bindings/js/JSHistoryCustom.cpp:
      (WebCore::nonCachingStaticBackFunctionGetter):
      (WebCore::nonCachingStaticForwardFunctionGetter):
      (WebCore::nonCachingStaticGoFunctionGetter):
      (WebCore::JSHistory::getOwnPropertySlotDelegate):
      (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
      (WebCore::JSHistory::putDelegate):
      (WebCore::JSHistory::deleteProperty):
      * bindings/js/JSLocationCustom.cpp:
      (WebCore::nonCachingStaticReplaceFunctionGetter):
      (WebCore::nonCachingStaticReloadFunctionGetter):
      (WebCore::nonCachingStaticAssignFunctionGetter):
      (WebCore::JSLocation::getOwnPropertySlotDelegate):
      (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
      (WebCore::JSLocation::putDelegate):
      (WebCore::JSLocation::deleteProperty):
      (WebCore::JSLocation::defineOwnProperty):
      (WebCore::JSLocationPrototype::putDelegate):
      (WebCore::JSLocationPrototype::defineOwnProperty):
      * bindings/js/JSNamedNodeMapCustom.cpp:
      (WebCore::JSNamedNodeMap::canGetItemsForName):
      (WebCore::JSNamedNodeMap::nameGetter):
      * bindings/js/JSNodeListCustom.cpp:
      (WebCore::JSNodeList::canGetItemsForName):
      (WebCore::JSNodeList::nameGetter):
      * bindings/js/JSPluginElementFunctions.cpp:
      (WebCore::runtimeObjectPropertyGetter):
      (WebCore::runtimeObjectCustomGetOwnPropertySlot):
      (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
      (WebCore::runtimeObjectCustomPut):
      * bindings/js/JSPluginElementFunctions.h:
      (WebCore):
      * bindings/js/JSStorageCustom.cpp:
      (WebCore::JSStorage::canGetItemsForName):
      (WebCore::JSStorage::nameGetter):
      (WebCore::JSStorage::deleteProperty):
      (WebCore::JSStorage::putDelegate):
      * bindings/js/JSStyleSheetListCustom.cpp:
      (WebCore::JSStyleSheetList::canGetItemsForName):
      (WebCore::JSStyleSheetList::nameGetter):
      * bindings/js/JSWorkerContextCustom.cpp:
      (WebCore::JSWorkerContext::getOwnPropertySlotDelegate):
      (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateGetOwnPropertySlotBody):
      (GenerateGetOwnPropertyDescriptorBody):
      (GenerateHeader):
      (GenerateImplementation):
      (GenerateConstructorDeclaration):
      (GenerateConstructorDefinition):
      * bridge/c/c_class.cpp:
      (JSC::Bindings::CClass::methodsNamed):
      (JSC::Bindings::CClass::fieldNamed):
      * bridge/c/c_class.h:
      (CClass):
      * bridge/c/c_instance.cpp:
      (JSC::Bindings::CRuntimeMethod::create):
      (JSC::Bindings::CRuntimeMethod::finishCreation):
      (JSC::Bindings::CInstance::getMethod):
      * bridge/c/c_instance.h:
      (CInstance):
      * bridge/jni/jsc/JavaClassJSC.cpp:
      (JavaClass::methodsNamed):
      (JavaClass::fieldNamed):
      * bridge/jni/jsc/JavaClassJSC.h:
      (JavaClass):
      * bridge/jni/jsc/JavaInstanceJSC.cpp:
      (JavaRuntimeMethod::create):
      (JavaRuntimeMethod::finishCreation):
      * bridge/jni/jsc/JavaInstanceJSC.h:
      (JavaInstance):
      * bridge/jsc/BridgeJSC.h:
      (Class):
      (JSC::Bindings::Class::fallbackObject):
      (JSC::Bindings::Instance::setValueOfUndefinedField):
      (Instance):
      (JSC::Bindings::Instance::getOwnPropertySlot):
      (JSC::Bindings::Instance::getOwnPropertyDescriptor):
      (JSC::Bindings::Instance::put):
      * bridge/objc/objc_class.h:
      (ObjcClass):
      * bridge/objc/objc_class.mm:
      (JSC::Bindings::ObjcClass::methodsNamed):
      (JSC::Bindings::ObjcClass::fieldNamed):
      (JSC::Bindings::ObjcClass::fallbackObject):
      * bridge/objc/objc_instance.h:
      (ObjcInstance):
      * bridge/objc/objc_instance.mm:
      (ObjCRuntimeMethod::create):
      (ObjCRuntimeMethod::finishCreation):
      (ObjcInstance::setValueOfUndefinedField):
      (ObjcInstance::getValueOfUndefinedField):
      * bridge/objc/objc_runtime.h:
      (JSC::Bindings::ObjcFallbackObjectImp::create):
      (JSC::Bindings::ObjcFallbackObjectImp::propertyName):
      (ObjcFallbackObjectImp):
      * bridge/objc/objc_runtime.mm:
      (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
      (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertySlot):
      (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
      (JSC::Bindings::ObjcFallbackObjectImp::put):
      (JSC::Bindings::callObjCFallbackObject):
      (JSC::Bindings::ObjcFallbackObjectImp::deleteProperty):
      (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
      * bridge/runtime_array.cpp:
      (JSC::RuntimeArray::lengthGetter):
      (JSC::RuntimeArray::getOwnPropertySlot):
      (JSC::RuntimeArray::getOwnPropertyDescriptor):
      (JSC::RuntimeArray::put):
      (JSC::RuntimeArray::deleteProperty):
      * bridge/runtime_array.h:
      (RuntimeArray):
      * bridge/runtime_method.cpp:
      (JSC::RuntimeMethod::finishCreation):
      (JSC::RuntimeMethod::lengthGetter):
      (JSC::RuntimeMethod::getOwnPropertySlot):
      (JSC::RuntimeMethod::getOwnPropertyDescriptor):
      * bridge/runtime_method.h:
      (JSC::RuntimeMethod::create):
      (RuntimeMethod):
      * bridge/runtime_object.cpp:
      (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
      (JSC::Bindings::RuntimeObject::fieldGetter):
      (JSC::Bindings::RuntimeObject::methodGetter):
      (JSC::Bindings::RuntimeObject::getOwnPropertySlot):
      (JSC::Bindings::RuntimeObject::getOwnPropertyDescriptor):
      (JSC::Bindings::RuntimeObject::put):
      (JSC::Bindings::RuntimeObject::deleteProperty):
      * bridge/runtime_object.h:
      (RuntimeObject):
      
      Source/WebKit/mac: 
      
      * Plugins/Hosted/ProxyInstance.h:
      (ProxyInstance):
      * Plugins/Hosted/ProxyInstance.mm:
      (ProxyClass):
      (WebKit::ProxyClass::methodsNamed):
      (WebKit::ProxyClass::fieldNamed):
      (WebKit::ProxyRuntimeMethod::create):
      (WebKit::ProxyRuntimeMethod::finishCreation):
      (WebKit::ProxyInstance::getMethod):
      (WebKit::ProxyInstance::methodsNamed):
      (WebKit::ProxyInstance::fieldNamed):
      
      Source/WebKit2: 
      
      * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
      (WebKit::JSNPMethod::finishCreation):
      * WebProcess/Plugins/Netscape/JSNPMethod.h:
      (WebKit::JSNPMethod::create):
      (JSNPMethod):
      * WebProcess/Plugins/Netscape/JSNPObject.cpp:
      (WebKit::npIdentifierFromIdentifier):
      (WebKit::JSNPObject::getOwnPropertySlot):
      (WebKit::JSNPObject::getOwnPropertyDescriptor):
      (WebKit::JSNPObject::put):
      (WebKit::JSNPObject::deleteProperty):
      (WebKit::JSNPObject::propertyGetter):
      (WebKit::JSNPObject::methodGetter):
      * WebProcess/Plugins/Netscape/JSNPObject.h:
      (JSNPObject):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@116828 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      38d3c75b
  19. 27 Apr, 2012 1 commit
    • msaboff@apple.com's avatar
      Memory wasted in JSString for non-rope strings · 6e74e92d
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=84907
      
      Reviewed by Geoffrey Garen.
      
      Split JSString into two classes, JSString as a base class that does not
      include the fibers of a Rope, and a subclass JSRopeString that has the
      rope functionality.  Both classes "share" the same ClassInfo.  Added
      a bool to JSString to indicate that the string was allocated as a JSRopeString
      to properly handle visiting the fiber children when the rope is resolved and
      the JSRopeString appears as a JSString.  Didn't change the interface of JSString
      to require any JIT changes.
      
      As part of this change, removed "cellSize" from ClassInfo since both classes
      share the same ClassInfo, but have different sizes.  The only use I could find
      for cellSize was an ASSERT in allocateCell().
      
      This appears to be neutral on performance tests.
      
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Changed JSString::resolveRope
              to JSRopeString::resolveRope
      * runtime/ClassInfo.h:
      (JSC):
      (ClassInfo):
      * runtime/JSCell.h:
      (JSC::allocateCell):
      * runtime/JSString.cpp:
      (JSC::JSRopeString::RopeBuilder::expand):
      (JSC::JSString::visitChildren):
      (JSC):
      (JSC::JSRopeString::visitFibers):
      (JSC::JSRopeString::resolveRope):
      (JSC::JSRopeString::resolveRopeSlowCase8):
      (JSC::JSRopeString::resolveRopeSlowCase):
      (JSC::JSRopeString::outOfMemory):
      (JSC::JSRopeString::getIndexSlowCase):
      * runtime/JSString.h:
      (JSC):
      (JSString):
      (JSC::JSString::finishCreation):
      (JSC::JSString::create):
      (JSC::JSString::isRope):
      (JSC::JSString::is8Bit):
      (JSRopeString):
      (RopeBuilder):
      (JSC::JSRopeString::RopeBuilder::RopeBuilder):
      (JSC::JSRopeString::RopeBuilder::append):
      (JSC::JSRopeString::RopeBuilder::release):
      (JSC::JSRopeString::RopeBuilder::length):
      (JSC::JSRopeString::JSRopeString):
      (JSC::JSRopeString::finishCreation):
      (JSC::JSRopeString::createNull):
      (JSC::JSRopeString::create):
      (JSC::JSString::value):
      (JSC::JSString::tryGetValue):
      (JSC::JSString::getIndex):
      (JSC::jsStringBuilder):
      * runtime/Operations.h:
      (JSC::jsString):
      (JSC::jsStringFromArguments):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@115516 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6e74e92d
  20. 05 Apr, 2012 1 commit
    • oliver@apple.com's avatar
      Replace static_cast with jsCast when casting JSCell subclasses in JSC · 0c59caf6
      oliver@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=83307
      
      Reviewed by Gavin Barraclough.
      
      Replace all usage of static_cast<JSCell subtype*> with jsCast<> in JavaScriptCore.
      This results in assertions when unsafe casts are performed, but simply leaves
      a static_cast<> in release builds.
      
      * API/APICast.h:
      (toJS):
      * API/JSCallbackConstructor.cpp:
      (JSC::constructJSCallback):
      * API/JSCallbackFunction.cpp:
      (JSC::JSCallbackFunction::call):
      * API/JSCallbackObjectFunctions.h:
      (JSC::::asCallbackObject):
      (JSC::::finishCreation):
      (JSC::::construct):
      (JSC::::call):
      * API/JSObjectRef.cpp:
      (JSObjectGetPrivate):
      (JSObjectSetPrivate):
      (JSObjectGetPrivateProperty):
      (JSObjectSetPrivateProperty):
      (JSObjectDeletePrivateProperty):
      * API/JSValueRef.cpp:
      (JSValueIsObjectOfClass):
      * API/JSWeakObjectMapRefPrivate.cpp:
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::resolve):
      (JSC::BytecodeGenerator::resolveConstDecl):
      * debugger/DebuggerActivation.cpp:
      (JSC::DebuggerActivation::finishCreation):
      * dfg/DFGOperations.cpp:
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::execute):
      (JSC::Interpreter::privateExecute):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * runtime/Executable.h:
      (JSC::isHostFunction):
      * runtime/JSActivation.h:
      (JSC::asActivation):
      * runtime/JSArray.cpp:
      (JSC::JSArray::defineOwnProperty):
      * runtime/JSArray.h:
      (JSC::asArray):
      * runtime/JSBoundFunction.cpp:
      (JSC::boundFunctionCall):
      (JSC::boundFunctionConstruct):
      * runtime/JSByteArray.h:
      (JSC::asByteArray):
      * runtime/JSCell.cpp:
      (JSC::JSCell::toObject):
      * runtime/JSCell.h:
      (JSC::jsCast):
      * runtime/JSGlobalObject.h:
      (JSC::asGlobalObject):
      * runtime/JSGlobalObjectFunctions.cpp:
      (JSC::globalFuncEval):
      * runtime/JSObject.cpp:
      (JSC::JSObject::setPrototypeWithCycleCheck):
      (JSC::JSObject::allowsAccessFrom):
      (JSC::JSObject::toThisObject):
      (JSC::JSObject::unwrappedObject):
      * runtime/JSObject.h:
      (JSC::asObject):
      * runtime/JSPropertyNameIterator.h:
      (JSC::Register::propertyNameIterator):
      * runtime/JSString.h:
      (JSC::asString):
      (JSC::JSValue::toString):
      * runtime/StringPrototype.cpp:
      (JSC::stringProtoFuncSubstr):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113363 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      0c59caf6
  21. 03 Apr, 2012 1 commit
    • ggaren@apple.com's avatar
      First step toward incremental Weak<T> finalization · 76215811
      ggaren@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=82670
      
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore: 
      
      This patch implements a Weak<T> heap that is compatible with incremental
      finalization, while making as few behavior changes as possible. The behavior
      changes it makes are:
      
      (*) Weak<T>'s raw JSValue no longer reverts to JSValue() automatically --
      instead, a separate flag indicates that the JSValue is no longer valid.
      (This is required so that the JSValue can be preserved for later finalization.)
      Objects dealing with WeakImpls directly must change to check the flag.
      
      (*) Weak<T> is no longer a subclass of Handle<T>.
      
      (*) DOM GC performance is different -- 9% faster in the geometric mean,
      but 15% slower in one specific case:
              gc-dom1.html: 6%  faster
              gc-dom2.html: 23% faster
              gc-dom3.html: 17% faster
              gc-dom4.html: 15% *slower*
      
      The key features of this new heap are:
      
      (*) Each block knows its own state, independent of any other blocks.
      
      (*) Each block caches its own sweep result.
      
      (*) The heap visits dead Weak<T>s at the end of GC. (It doesn't
      mark them yet, since that would be a behavior change.)
      
      * API/JSCallbackObject.cpp:
      (JSC::JSCallbackObjectData::finalize):
      * API/JSCallbackObjectFunctions.h:
      (JSC::::init): Updated to use the new WeakHeap API.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.gypi:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri: Paid the build system tax since I added some new files.
      
      * heap/Handle.h: Made WeakBlock a friend and exposed slot() as public,
      so we can keep passing a Handle<T> to finalizers, to avoid more surface
      area change in this patch. A follow-up patch should change the type we
      pass to finalizers.
      
      * heap/HandleHeap.cpp:
      (JSC):
      (JSC::HandleHeap::writeBarrier):
      (JSC::HandleHeap::isLiveNode):
      * heap/HandleHeap.h:
      (JSC):
      (HandleHeap):
      (Node):
      (JSC::HandleHeap::Node::Node): Removed all code related to Weak<T>, since
      we have a separate WeakHeap now.
      
      * heap/Heap.cpp:
      (JSC::Heap::Heap): Removed m_extraCost because extra cost is accounted
      for through our watermark now. Removed m_waterMark because it was unused.
      
      (JSC::Heap::destroy): Updated for addition of WeakHeap.
      
      (JSC::Heap::reportExtraMemoryCostSlowCase): Changed from using its own
      variable to participating in the watermark strategy. I wanted to standardize
      WeakHeap and all other Heap clients on this strategy, to make sure it's
      accurate.
       
      (JSC::Heap::markRoots): Updated for addition of WeakHeap. Added WeakHeap
      dead visit pass, as explained above.
      
      (JSC::Heap::collect):
      (JSC::Heap::resetAllocators): Updated for addition of WeakHeap.
      
      (JSC::Heap::addFinalizer):
      (JSC::Heap::FinalizerOwner::finalize): Updated for new Weak<T> API.
      
      * heap/Heap.h:
      (JSC::Heap::weakHeap):
      (Heap):
      (JSC::Heap::addToWaterMark): Added a way to participate in the watermarking
      strategy, since this is the best way for WeakHeap to report its memory
      cost. (I plan to update this in a follow-up patch to make it more accurate,
      but for now it is not less accurate than it used to be.)
      
      * heap/MarkedSpace.cpp:
      (JSC::MarkedSpace::MarkedSpace):
      (JSC::MarkedSpace::resetAllocators):
      * heap/MarkedSpace.h:
      (MarkedSpace):
      (JSC::MarkedSpace::addToWaterMark):
      (JSC::MarkedSpace::didConsumeFreeList): Removed m_nurseryWaterMark because
      it was unused, and I didn't want to update WeakHeap to keep an usused
      variable working. Added API for above.
      
      * heap/PassWeak.h:
      (JSC):
      (WeakImplAccessor):
      (PassWeak):
      (JSC::::operator):
      (JSC::::get):
      (JSC::::was):
      (JSC::::PassWeak):
      (JSC::::~PassWeak):
      (JSC::UnspecifiedBoolType):
      (JSC::::leakImpl):
      (JSC::adoptWeak):
      * heap/Strong.h:
      (JSC::Strong::operator!):
      (Strong):
      (JSC::Strong::operator UnspecifiedBoolType*):
      (JSC::Strong::get):
      * heap/Weak.h:
      (Weak):
      (JSC::::Weak):
      (JSC):
      (JSC::::isHashTableDeletedValue):
      (JSC::::~Weak):
      (JSC::::swap):
      (JSC::=):
      (JSC::::operator):
      (JSC::UnspecifiedBoolType):
      (JSC::::release):
      (JSC::::clear):
      (JSC::::hashTableDeletedValue): Lots of code changes here, but they boil
      down to two things:
      
      (*) Allocate WeakImpls from the WeakHeap instead of Handles from the HandleHeap.
      
      (*) Explicitly check WeakImpl::state() for non-liveness before returning
      a value (explained above).
      
      These files implement the new Weak<T> heap behavior described above:
      
      * heap/WeakBlock.cpp: Added.
      * heap/WeakBlock.h: Added.
      * heap/WeakHandleOwner.cpp: Added.
      * heap/WeakHandleOwner.h: Added.
      * heap/WeakHeap.cpp: Added.
      * heap/WeakHeap.h: Added.
      * heap/WeakImpl.h: Added.
      
      One interesting difference from the old heap is that we don't allow
      clients to overwrite a WeakImpl after allocating it, and we don't recycle
      WeakImpls prior to garbage collection. This is required for lazy finalization,
      but it will also help us esablish a useful invariant in the future: allocating
      a WeakImpl will be a binding contract to run a finalizer at some point in the
      future, even if the WeakImpl is later deallocated.
      
      * jit/JITStubs.cpp:
      (JSC::JITThunks::hostFunctionStub): Check the Weak<T> for ! instead of
      its JSValue, since that's our API contract now, and the JSValue might
      be stale.
      
      * runtime/JSCell.h:
      (JSC::jsCast): Allow casting NULL pointers because it's useful and harmless.
      
      * runtime/Structure.cpp:
      (JSC::StructureTransitionTable::add): I can't remember why I did this.
      
      * runtime/StructureTransitionTable.h:
      * runtime/WeakGCMap.h: I had to update these classes because they allocate
      and deallocate weak pointers manually. They should probably stop doing that.
      
      Source/WebCore: 
      
      Updated WebCore for Weak<T> API changes.
      
      * bindings/js/DOMWrapperWorld.cpp:
      (WebCore::JSStringOwner::finalize): We're not allowed to get() a dead Weak<T>
      anymore, so use the debug-only was() helper function instead.
      
      * bindings/js/JSDOMBinding.h:
      (WebCore::uncacheWrapper): Ditto.
      
      * bindings/js/JSNodeCustom.h:
      (WebCore::setInlineCachedWrapper):
      (WebCore::clearInlineCachedWrapper): We're not allowed to get() a dead
      Weak<T>, so I had to push down these ASSERTs into ScriptWrappable.
      
      * bindings/js/JSNodeFilterCondition.cpp:
      (WebCore::JSNodeFilterCondition::acceptNode): Updated for non-Handle-ness
      of Weak<T>.
      
      * bindings/js/ScriptWrappable.h:
      (WebCore::ScriptWrappable::setWrapper):
      (WebCore::ScriptWrappable::clearWrapper): Use was(), as above.
      
      Source/WebKit2: 
      
      Updated for API change.
      
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::finalize):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      76215811
  22. 22 Mar, 2012 1 commit
    • barraclough@apple.com's avatar
      Add JSValue::isFunction · 484a9d31
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=81935
      
      Reviewed by Geoff Garen.
      
      This would be useful in the WebCore bindings code.
      Also, remove asFunction, replace with jsCast<JSFunction*>.
      
      Source/JavaScriptCore: 
      
      * API/JSContextRef.cpp:
      * debugger/Debugger.cpp:
      * debugger/DebuggerCallFrame.cpp:
      (JSC::DebuggerCallFrame::functionName):
      * dfg/DFGGraph.h:
      (JSC::DFG::Graph::valueOfFunctionConstant):
      * dfg/DFGOperations.cpp:
      * interpreter/CallFrame.cpp:
      (JSC::CallFrame::isInlineCallFrameSlow):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC::jitCompileFor):
      (JSC::lazyLinkFor):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::traceFunctionPrologue):
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      (JSC::LLInt::setUpCall):
      * runtime/Arguments.h:
      (JSC::Arguments::finishCreation):
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncMap):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncForEach):
      (JSC::arrayProtoFuncSome):
      (JSC::arrayProtoFuncReduce):
      (JSC::arrayProtoFuncReduceRight):
      * runtime/CommonSlowPaths.h:
      (JSC::CommonSlowPaths::arityCheckFor):
      * runtime/Executable.h:
      (JSC::FunctionExecutable::compileFor):
      (JSC::FunctionExecutable::compileOptimizedFor):
      * runtime/FunctionPrototype.cpp:
      (JSC::functionProtoFuncToString):
      * runtime/JSArray.cpp:
      (JSC::JSArray::sort):
      * runtime/JSFunction.cpp:
      (JSC::JSFunction::argumentsGetter):
      (JSC::JSFunction::callerGetter):
      (JSC::JSFunction::lengthGetter):
      * runtime/JSFunction.h:
      (JSC):
      (JSC::asJSFunction):
      (JSC::JSValue::isFunction):
      * runtime/JSGlobalData.cpp:
      (WTF::Recompiler::operator()):
      (JSC::JSGlobalData::releaseExecutableMemory):
      * runtime/JSValue.h:
      * runtime/StringPrototype.cpp:
      (JSC::replaceUsingRegExpSearch):
      
      Source/WebCore: 
      
      * bindings/js/JSInjectedScriptHostCustom.cpp:
      (WebCore::JSInjectedScriptHost::functionDetails):
      * bindings/js/ScriptCallStackFactory.cpp:
      (WebCore::createScriptCallStack):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@111739 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      484a9d31
  23. 16 Mar, 2012 1 commit
    • msaboff@apple.com's avatar
      Improve diagnostic benefit of JSGlobalData::m_isInitializingObject · 18292eb3
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=81244
      
      Rubber stamped by Filip Pizlo.
      
      Changed type and name of JSGlobalData::m_isInitializingObject to
      ClassInfo* and m_initializingObjectClass.
      Changed JSGlobalData::setInitializingObject to
      JSGlobalData::setInitializingObjectClass.  This pointer can be used within 
      the debugger to determine what type of object is being initialized.
              
      * runtime/JSCell.h:
      (JSC::JSCell::finishCreation):
      (JSC::allocateCell):
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      * runtime/JSGlobalData.h:
      (JSGlobalData):
      (JSC::JSGlobalData::isInitializingObject):
      (JSC::JSGlobalData::setInitializingObjectClass):
      * runtime/Structure.h:
      (JSC::JSCell::finishCreation):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@111013 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      18292eb3
  24. 06 Mar, 2012 1 commit
    • barraclough@apple.com's avatar
      putByIndex should throw in strict mode · b1db28d8
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=80335
      
      Reviewed by Filip Pizlo.
      
      Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
      
      Source/JavaScriptCore: 
      
      This is a largely mechanical change, simply adding an extra parameter to a number
      of functions. Some call sites need perform additional exception checks, and
      operationPutByValBeyondArrayBounds needs to know whether it is strict or not.
      
      This patch doesn't fix a missing throw from some cases of shift/unshift (this is
      an existing bug), I'll follow up with a third patch to handle that.
      
      * API/JSObjectRef.cpp:
      (JSObjectSetPropertyAtIndex):
      * JSCTypedArrayStubs.h:
      (JSC):
      * dfg/DFGOperations.cpp:
      (JSC::DFG::putByVal):
      * dfg/DFGOperations.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::privateExecute):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * jsc.cpp:
      (GlobalObject::finishCreation):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * runtime/Arguments.cpp:
      (JSC::Arguments::putByIndex):
      * runtime/Arguments.h:
      (Arguments):
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncPush):
      (JSC::arrayProtoFuncReverse):
      (JSC::arrayProtoFuncShift):
      (JSC::arrayProtoFuncSort):
      (JSC::arrayProtoFuncSplice):
      (JSC::arrayProtoFuncUnShift):
      * runtime/ClassInfo.h:
      (MethodTable):
      * runtime/JSArray.cpp:
      (JSC::SparseArrayValueMap::put):
      (JSC::JSArray::put):
      (JSC::JSArray::putByIndex):
      (JSC::JSArray::putByIndexBeyondVectorLength):
      (JSC::JSArray::push):
      (JSC::JSArray::shiftCount):
      (JSC::JSArray::unshiftCount):
      * runtime/JSArray.h:
      (SparseArrayValueMap):
      (JSArray):
      * runtime/JSByteArray.cpp:
      (JSC::JSByteArray::putByIndex):
      * runtime/JSByteArray.h:
      (JSByteArray):
      * runtime/JSCell.cpp:
      (JSC::JSCell::putByIndex):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSNotAnObject.cpp:
      (JSC::JSNotAnObject::putByIndex):
      * runtime/JSNotAnObject.h:
      (JSNotAnObject):
      * runtime/JSONObject.cpp:
      (JSC::Walker::walk):
      * runtime/JSObject.cpp:
      (JSC::JSObject::putByIndex):
      * runtime/JSObject.h:
      (JSC::JSValue::putByIndex):
      * runtime/RegExpConstructor.cpp:
      (JSC::RegExpMatchesArray::fillArrayInstance):
      * runtime/RegExpMatchesArray.h:
      (JSC::RegExpMatchesArray::putByIndex):
      * runtime/StringPrototype.cpp:
      (JSC::stringProtoFuncSplit):
      
      Source/WebCore: 
      
      * bindings/js/SerializedScriptValue.cpp:
      (WebCore::CloneDeserializer::putProperty):
      * bindings/objc/WebScriptObject.mm:
      (-[WebScriptObject setWebScriptValueAtIndex:value:]):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader):
      (GenerateImplementation):
      * bridge/NP_jsobject.cpp:
      (_NPN_SetProperty):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::setSlot):
      * bridge/runtime_array.cpp:
      (JSC::RuntimeArray::putByIndex):
      * bridge/runtime_array.h:
      (RuntimeArray):
      
      Source/WebKit/mac: 
      
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::setProperty):
      
      Source/WebKit2: 
      
      * WebProcess/Plugins/Netscape/NPJSObject.cpp:
      (WebKit::NPJSObject::setProperty):
      
      LayoutTests: 
      
      * fast/js/Object-defineProperty-expected.txt:
      * fast/js/mozilla/strict/15.4.4.12-expected.txt:
      * fast/js/mozilla/strict/15.4.4.13-expected.txt:
      * fast/js/mozilla/strict/15.4.4.8-expected.txt:
      * fast/js/mozilla/strict/15.4.4.9-expected.txt:
      * fast/js/mozilla/strict/15.5.5.2-expected.txt:
      * fast/js/mozilla/strict/8.12.5-expected.txt:
      * fast/js/preventExtensions-expected.txt:
      * fast/js/primitive-property-access-edge-cases-expected.txt:
          - Checking in passing test results.
      * fast/js/script-tests/Object-defineProperty.js:
          - Added test cases for putting to numeric properties where property is read-only,
            length is read-only, or property is accessor with missing set function.
      * fast/js/script-tests/preventExtensions.js:
          - Added test case, putting numeric property to non-extensible array.
      * fast/js/script-tests/primitive-property-access-edge-cases.js:
          - Enabled test cases for putting numeric properties to primitive strings.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@109866 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      b1db28d8
  25. 21 Feb, 2012 2 commits
    • fpizlo@apple.com's avatar
      JSC should be a triple-tier VM · 7bbcaab7
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=75812
      <rdar://problem/10079694>
      
      Source/JavaScriptCore: 
      
      Reviewed by Gavin Barraclough.
              
      Implemented an interpreter that uses the JIT's calling convention. This
      interpreter is called LLInt, or the Low Level Interpreter. JSC will now
      will start by executing code in LLInt and will only tier up to the old
      JIT after the code is proven hot.
              
      LLInt is written in a modified form of our macro assembly. This new macro
      assembly is compiled by an offline assembler (see offlineasm), which
      implements many modern conveniences such as a Turing-complete CPS-based
      macro language and direct access to relevant C++ type information
      (basically offsets of fields and sizes of structs/classes).
              
      Code executing in LLInt appears to the rest of the JSC world "as if" it
      were executing in the old JIT. Hence, things like exception handling and
      cross-execution-engine calls just work and require pretty much no
      additional overhead.
              
      This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
      V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
      V8, and Kraken, but appear to get a double-digit improvement on real-world
      websites due to a huge reduction in the amount of JIT'ing.
              
      * CMakeLists.txt:
      * GNUmakefile.am:
      * GNUmakefile.list.am:
      * JavaScriptCore.pri:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
      * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * assembler/LinkBuffer.h:
      * assembler/MacroAssemblerCodeRef.h:
      (MacroAssemblerCodePtr):
      (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
      * bytecode/BytecodeConventions.h: Added.
      * bytecode/CallLinkStatus.cpp:
      (JSC::CallLinkStatus::computeFromLLInt):
      (JSC):
      (JSC::CallLinkStatus::computeFor):
      * bytecode/CallLinkStatus.h:
      (JSC::CallLinkStatus::isSet):
      (JSC::CallLinkStatus::operator!):
      (CallLinkStatus):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dump):
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::~CodeBlock):
      (JSC::CodeBlock::finalizeUnconditionally):
      (JSC::CodeBlock::stronglyVisitStrongReferences):
      (JSC):
      (JSC::CodeBlock::unlinkCalls):
      (JSC::CodeBlock::unlinkIncomingCalls):
      (JSC::CodeBlock::bytecodeOffset):
      (JSC::ProgramCodeBlock::jettison):
      (JSC::EvalCodeBlock::jettison):
      (JSC::FunctionCodeBlock::jettison):
      (JSC::ProgramCodeBlock::jitCompileImpl):
      (JSC::EvalCodeBlock::jitCompileImpl):
      (JSC::FunctionCodeBlock::jitCompileImpl):
      * bytecode/CodeBlock.h:
      (JSC):
      (CodeBlock):
      (JSC::CodeBlock::baselineVersion):
      (JSC::CodeBlock::linkIncomingCall):
      (JSC::CodeBlock::bytecodeOffset):
      (JSC::CodeBlock::jitCompile):
      (JSC::CodeBlock::hasOptimizedReplacement):
      (JSC::CodeBlock::addPropertyAccessInstruction):
      (JSC::CodeBlock::addGlobalResolveInstruction):
      (JSC::CodeBlock::addLLIntCallLinkInfo):
      (JSC::CodeBlock::addGlobalResolveInfo):
      (JSC::CodeBlock::numberOfMethodCallLinkInfos):
      (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
      (JSC::CodeBlock::likelyToTakeSlowCase):
      (JSC::CodeBlock::couldTakeSlowCase):
      (JSC::CodeBlock::likelyToTakeSpecialFastCase):
      (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
      (JSC::CodeBlock::likelyToTakeAnySlowCase):
      (JSC::CodeBlock::addFrequentExitSite):
      (JSC::CodeBlock::dontJITAnytimeSoon):
      (JSC::CodeBlock::jitAfterWarmUp):
      (JSC::CodeBlock::jitSoon):
      (JSC::CodeBlock::llintExecuteCounter):
      (ProgramCodeBlock):
      (EvalCodeBlock):
      (FunctionCodeBlock):
      * bytecode/GetByIdStatus.cpp:
      (JSC::GetByIdStatus::computeFromLLInt):
      (JSC):
      (JSC::GetByIdStatus::computeFor):
      * bytecode/GetByIdStatus.h:
      (JSC::GetByIdStatus::GetByIdStatus):
      (JSC::GetByIdStatus::wasSeenInJIT):
      (GetByIdStatus):
      * bytecode/Instruction.h:
      (JSC):
      (JSC::Instruction::Instruction):
      (Instruction):
      * bytecode/LLIntCallLinkInfo.h: Added.
      (JSC):
      (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
      (LLIntCallLinkInfo):
      (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
      (JSC::LLIntCallLinkInfo::isLinked):
      (JSC::LLIntCallLinkInfo::unlink):
      * bytecode/MethodCallLinkStatus.cpp:
      (JSC::MethodCallLinkStatus::computeFor):
      * bytecode/Opcode.cpp:
      (JSC):
      * bytecode/Opcode.h:
      (JSC):
      (JSC::padOpcodeName):
      * bytecode/PutByIdStatus.cpp:
      (JSC::PutByIdStatus::computeFromLLInt):
      (JSC):
      (JSC::PutByIdStatus::computeFor):
      * bytecode/PutByIdStatus.h:
      (PutByIdStatus):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitResolve):
      (JSC::BytecodeGenerator::emitResolveWithBase):
      (JSC::BytecodeGenerator::emitGetById):
      (JSC::BytecodeGenerator::emitPutById):
      (JSC::BytecodeGenerator::emitDirectPutById):
      (JSC::BytecodeGenerator::emitCall):
      (JSC::BytecodeGenerator::emitConstruct):
      (JSC::BytecodeGenerator::emitCatch):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
      (JSC::DFG::ByteCodeParser::handleInlining):
      (JSC::DFG::ByteCodeParser::parseBlock):
      * dfg/DFGCapabilities.h:
      (JSC::DFG::canCompileOpcode):
      * dfg/DFGOSRExitCompiler.cpp:
      * dfg/DFGOperations.cpp:
      * heap/Heap.h:
      (JSC):
      (JSC::Heap::firstAllocatorWithoutDestructors):
      (Heap):
      * heap/MarkStack.cpp:
      (JSC::visitChildren):
      * heap/MarkedAllocator.h:
      (JSC):
      (MarkedAllocator):
      * heap/MarkedSpace.h:
      (JSC):
      (MarkedSpace):
      (JSC::MarkedSpace::firstAllocator):
      * interpreter/CallFrame.cpp:
      (JSC):
      (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
      (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
      (JSC::CallFrame::currentVPC):
      (JSC::CallFrame::setCurrentVPC):
      (JSC::CallFrame::trueCallerFrame):
      * interpreter/CallFrame.h:
      (JSC::ExecState::hasReturnPC):
      (JSC::ExecState::clearReturnPC):
      (ExecState):
      (JSC::ExecState::bytecodeOffsetForNonDFGCode):
      (JSC::ExecState::currentVPC):
      (JSC::ExecState::setCurrentVPC):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::Interpreter):
      (JSC::Interpreter::~Interpreter):
      (JSC):
      (JSC::Interpreter::initialize):
      (JSC::Interpreter::isOpcode):
      (JSC::Interpreter::unwindCallFrame):
      (JSC::getCallerInfo):
      (JSC::Interpreter::privateExecute):
      (JSC::Interpreter::retrieveLastCaller):
      * interpreter/Interpreter.h:
      (JSC):
      (Interpreter):
      (JSC::Interpreter::getOpcode):
      (JSC::Interpreter::getOpcodeID):
      (JSC::Interpreter::classicEnabled):
      * interpreter/RegisterFile.h:
      (JSC):
      (RegisterFile):
      * jit/ExecutableAllocator.h:
      (JSC):
      * jit/HostCallReturnValue.cpp: Added.
      (JSC):
      (JSC::getHostCallReturnValueWithExecState):
      * jit/HostCallReturnValue.h: Added.
      (JSC):
      (JSC::initializeHostCallReturnValue):
      * jit/JIT.cpp:
      (JSC::JIT::privateCompileMainPass):
      (JSC::JIT::privateCompileSlowCases):
      (JSC::JIT::privateCompile):
      * jit/JITCode.h:
      (JSC::JITCode::isOptimizingJIT):
      (JITCode):
      (JSC::JITCode::isBaselineCode):
      (JSC::JITCode::JITCode):
      * jit/JITDriver.h:
      (JSC::jitCompileIfAppropriate):
      (JSC::jitCompileFunctionIfAppropriate):
      * jit/JITExceptions.cpp:
      (JSC::jitThrow):
      * jit/JITInlineMethods.h:
      (JSC::JIT::updateTopCallFrame):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC):
      * jit/JITStubs.h:
      (JSC):
      * jit/JSInterfaceJIT.h:
      * llint: Added.
      * llint/LLIntCommon.h: Added.
      * llint/LLIntData.cpp: Added.
      (LLInt):
      (JSC::LLInt::Data::Data):
      (JSC::LLInt::Data::performAssertions):
      (JSC::LLInt::Data::~Data):
      * llint/LLIntData.h: Added.
      (JSC):
      (LLInt):
      (Data):
      (JSC::LLInt::Data::exceptionInstructions):
      (JSC::LLInt::Data::opcodeMap):
      (JSC::LLInt::Data::performAssertions):
      * llint/LLIntEntrypoints.cpp: Added.
      (LLInt):
      (JSC::LLInt::getFunctionEntrypoint):
      (JSC::LLInt::getEvalEntrypoint):
      (JSC::LLInt::getProgramEntrypoint):
      * llint/LLIntEntrypoints.h: Added.
      (JSC):
      (LLInt):
      (JSC::LLInt::getEntrypoint):
      * llint/LLIntExceptions.cpp: Added.
      (LLInt):
      (JSC::LLInt::interpreterThrowInCaller):
      (JSC::LLInt::returnToThrowForThrownException):
      (JSC::LLInt::returnToThrow):
      (JSC::LLInt::callToThrow):
      * llint/LLIntExceptions.h: Added.
      (JSC):
      (LLInt):
      * llint/LLIntOfflineAsmConfig.h: Added.
      * llint/LLIntOffsetsExtractor.cpp: Added.
      (JSC):
      (LLIntOffsetsExtractor):
      (JSC::LLIntOffsetsExtractor::dummy):
      (main):
      * llint/LLIntSlowPaths.cpp: Added.
      (LLInt):
      (JSC::LLInt::llint_trace_operand):
      (JSC::LLInt::llint_trace_value):
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      (JSC::LLInt::traceFunctionPrologue):
      (JSC::LLInt::shouldJIT):
      (JSC::LLInt::entryOSR):
      (JSC::LLInt::resolveGlobal):
      (JSC::LLInt::getByVal):
      (JSC::LLInt::handleHostCall):
      (JSC::LLInt::setUpCall):
      (JSC::LLInt::genericCall):
      * llint/LLIntSlowPaths.h: Added.
      (JSC):
      (LLInt):
      * llint/LLIntThunks.cpp: Added.
      (LLInt):
      (JSC::LLInt::generateThunkWithJumpTo):
      (JSC::LLInt::functionForCallEntryThunkGenerator):
      (JSC::LLInt::functionForConstructEntryThunkGenerator):
      (JSC::LLInt::functionForCallArityCheckThunkGenerator):
      (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
      (JSC::LLInt::evalEntryThunkGenerator):
      (JSC::LLInt::programEntryThunkGenerator):
      * llint/LLIntThunks.h: Added.
      (JSC):
      (LLInt):
      * llint/LowLevelInterpreter.asm: Added.
      * llint/LowLevelInterpreter.cpp: Added.
      * llint/LowLevelInterpreter.h: Added.
      * offlineasm: Added.
      * offlineasm/armv7.rb: Added.
      * offlineasm/asm.rb: Added.
      * offlineasm/ast.rb: Added.
      * offlineasm/backends.rb: Added.
      * offlineasm/generate_offset_extractor.rb: Added.
      * offlineasm/instructions.rb: Added.
      * offlineasm/offset_extractor_constants.rb: Added.
      * offlineasm/offsets.rb: Added.
      * offlineasm/opt.rb: Added.
      * offlineasm/parser.rb: Added.
      * offlineasm/registers.rb: Added.
      * offlineasm/self_hash.rb: Added.
      * offlineasm/settings.rb: Added.
      * offlineasm/transform.rb: Added.
      * offlineasm/x86.rb: Added.
      * runtime/CodeSpecializationKind.h: Added.
      (JSC):
      * runtime/CommonSlowPaths.h:
      (JSC::CommonSlowPaths::arityCheckFor):
      (CommonSlowPaths):
      * runtime/Executable.cpp:
      (JSC::jettisonCodeBlock):
      (JSC):
      (JSC::EvalExecutable::jitCompile):
      (JSC::samplingDescription):
      (JSC::EvalExecutable::compileInternal):
      (JSC::ProgramExecutable::jitCompile):
      (JSC::ProgramExecutable::compileInternal):
      (JSC::FunctionExecutable::baselineCodeBlockFor):
      (JSC::FunctionExecutable::jitCompileForCall):
      (JSC::FunctionExecutable::jitCompileForConstruct):
      (JSC::FunctionExecutable::compileForCallInternal):
      (JSC::FunctionExecutable::compileForConstructInternal):
      * runtime/Executable.h:
      (JSC):
      (EvalExecutable):
      (ProgramExecutable):
      (FunctionExecutable):
      (JSC::FunctionExecutable::jitCompileFor):
      * runtime/ExecutionHarness.h: Added.
      (JSC):
      (JSC::prepareForExecution):
      (JSC::prepareFunctionForExecution):
      * runtime/JSArray.h:
      (JSC):
      (JSArray):
      * runtime/JSCell.h:
      (JSC):
      (JSCell):
      * runtime/JSFunction.h:
      (JSC):
      (JSFunction):
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      * runtime/JSGlobalData.h:
      (JSC):
      (JSGlobalData):
      * runtime/JSGlobalObject.h:
      (JSC):
      (JSGlobalObject):
      * runtime/JSObject.h:
      (JSC):
      (JSObject):
      (JSFinalObject):
      * runtime/JSPropertyNameIterator.h:
      (JSC):
      (JSPropertyNameIterator):
      * runtime/JSString.h:
      (JSC):
      (JSString):
      * runtime/JSTypeInfo.h:
      (JSC):
      (TypeInfo):
      * runtime/JSValue.cpp:
      (JSC::JSValue::description):
      * runtime/JSValue.h:
      (LLInt):
      (JSValue):
      * runtime/JSVariableObject.h:
      (JSC):
      (JSVariableObject):
      * runtime/Options.cpp:
      (Options):
      (JSC::Options::initializeOptions):
      * runtime/Options.h:
      (Options):
      * runtime/ScopeChain.h:
      (JSC):
      (ScopeChainNode):
      * runtime/Structure.cpp:
      (JSC::Structure::addPropertyTransition):
      * runtime/Structure.h:
      (JSC):
      (Structure):
      * runtime/StructureChain.h:
      (JSC):
      (StructureChain):
      * wtf/InlineASM.h:
      * wtf/Platform.h:
      * wtf/SentinelLinkedList.h:
      (SentinelLinkedList):
      (WTF::SentinelLinkedList::isEmpty):
      * wtf/text/StringImpl.h:
      (JSC):
      (StringImpl):
      
      Source/WebCore: 
      
      Reviewed by Gavin Barraclough.
              
      No new tests, because there is no change in behavior.
      
      * CMakeLists.txt:
      
      Source/WebKit: 
      
      Reviewed by Gavin Barraclough.
      
      Changed EFL's build system to include a new directory in JavaScriptCore.
              
      * CMakeLists.txt:
      
      Tools: 
      
      Reviewed by Gavin Barraclough.
      
      Changed EFL's build system to include a new directory in JavaScriptCore.
      
      * DumpRenderTree/efl/CMakeLists.txt:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108444 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      7bbcaab7
    • aroben@apple.com's avatar
      Roll out r108309, r108323, and r108326 · e089d623
      aroben@apple.com authored
      They broke the 32-bit Lion build.
      
      Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
      
      Source/JavaScriptCore:
      
      * CMakeLists.txt:
      * GNUmakefile.am:
      * GNUmakefile.list.am:
      * JavaScriptCore.pri:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
      * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * assembler/LinkBuffer.h:
      * assembler/MacroAssemblerCodeRef.h:
      * bytecode/BytecodeConventions.h: Removed.
      * bytecode/CallLinkStatus.cpp:
      * bytecode/CallLinkStatus.h:
      * bytecode/CodeBlock.cpp:
      * bytecode/CodeBlock.h:
      * bytecode/GetByIdStatus.cpp:
      * bytecode/GetByIdStatus.h:
      * bytecode/Instruction.h:
      * bytecode/LLIntCallLinkInfo.h: Removed.
      * bytecode/MethodCallLinkStatus.cpp:
      * bytecode/Opcode.cpp:
      * bytecode/Opcode.h:
      * bytecode/PutByIdStatus.cpp:
      * bytecode/PutByIdStatus.h:
      * bytecompiler/BytecodeGenerator.cpp:
      * dfg/DFGByteCodeParser.cpp:
      * dfg/DFGCapabilities.h:
      * dfg/DFGOSRExitCompiler.cpp:
      * dfg/DFGOperations.cpp:
      * heap/Heap.h:
      * heap/MarkStack.cpp:
      * heap/MarkedAllocator.h:
      * heap/MarkedSpace.h:
      * interpreter/CallFrame.cpp:
      * interpreter/CallFrame.h:
      * interpreter/Interpreter.cpp:
      * interpreter/Interpreter.h:
      * interpreter/RegisterFile.h:
      * jit/ExecutableAllocator.h:
      * jit/HostCallReturnValue.cpp: Removed.
      * jit/HostCallReturnValue.h: Removed.
      * jit/JIT.cpp:
      * jit/JITCode.h:
      * jit/JITDriver.h:
      * jit/JITExceptions.cpp:
      * jit/JITInlineMethods.h:
      * jit/JITStubs.cpp:
      * jit/JITStubs.h:
      * jit/JSInterfaceJIT.h:
      * llint/LLIntCommon.h: Removed.
      * llint/LLIntData.cpp: Removed.
      * llint/LLIntData.h: Removed.
      * llint/LLIntEntrypoints.cpp: Removed.
      * llint/LLIntEntrypoints.h: Removed.
      * llint/LLIntExceptions.cpp: Removed.
      * llint/LLIntExceptions.h: Removed.
      * llint/LLIntOfflineAsmConfig.h: Removed.
      * llint/LLIntOffsetsExtractor.cpp: Removed.
      * llint/LLIntSlowPaths.cpp: Removed.
      * llint/LLIntSlowPaths.h: Removed.
      * llint/LLIntThunks.cpp: Removed.
      * llint/LLIntThunks.h: Removed.
      * llint/LowLevelInterpreter.asm: Removed.
      * llint/LowLevelInterpreter.cpp: Removed.
      * llint/LowLevelInterpreter.h: Removed.
      * offlineasm/armv7.rb: Removed.
      * offlineasm/asm.rb: Removed.
      * offlineasm/ast.rb: Removed.
      * offlineasm/backends.rb: Removed.
      * offlineasm/generate_offset_extractor.rb: Removed.
      * offlineasm/instructions.rb: Removed.
      * offlineasm/offset_extractor_constants.rb: Removed.
      * offlineasm/offsets.rb: Removed.
      * offlineasm/opt.rb: Removed.
      * offlineasm/parser.rb: Removed.
      * offlineasm/registers.rb: Removed.
      * offlineasm/self_hash.rb: Removed.
      * offlineasm/settings.rb: Removed.
      * offlineasm/transform.rb: Removed.
      * offlineasm/x86.rb: Removed.
      * runtime/CodeSpecializationKind.h: Removed.
      * runtime/CommonSlowPaths.h:
      * runtime/Executable.cpp:
      * runtime/Executable.h:
      * runtime/ExecutionHarness.h: Removed.
      * runtime/JSArray.h:
      * runtime/JSCell.h:
      * runtime/JSFunction.h:
      * runtime/JSGlobalData.cpp:
      * runtime/JSGlobalData.h:
      * runtime/JSGlobalObject.h:
      * runtime/JSObject.h:
      * runtime/JSPropertyNameIterator.h:
      * runtime/JSString.h:
      * runtime/JSTypeInfo.h:
      * runtime/JSValue.cpp:
      * runtime/JSValue.h:
      * runtime/JSVariableObject.h:
      * runtime/Options.cpp:
      * runtime/Options.h:
      * runtime/ScopeChain.h:
      * runtime/Structure.cpp:
      * runtime/Structure.h:
      * runtime/StructureChain.h:
      * wtf/InlineASM.h:
      * wtf/Platform.h:
      * wtf/SentinelLinkedList.h:
      * wtf/text/StringImpl.h:
      
      Source/WebCore:
      
      * CMakeLists.txt:
      
      Source/WebKit:
      
      * CMakeLists.txt:
      
      Tools:
      
      * DumpRenderTree/efl/CMakeLists.txt:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108358 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e089d623
  26. 20 Feb, 2012 1 commit
    • fpizlo@apple.com's avatar
      JSC should be a triple-tier VM · 091129f4
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=75812
      <rdar://problem/10079694>
      
      Source/JavaScriptCore: 
      
      Reviewed by Gavin Barraclough.
              
      Implemented an interpreter that uses the JIT's calling convention. This
      interpreter is called LLInt, or the Low Level Interpreter. JSC will now
      will start by executing code in LLInt and will only tier up to the old
      JIT after the code is proven hot.
              
      LLInt is written in a modified form of our macro assembly. This new macro
      assembly is compiled by an offline assembler (see offlineasm), which
      implements many modern conveniences such as a Turing-complete CPS-based
      macro language and direct access to relevant C++ type information
      (basically offsets of fields and sizes of structs/classes).
              
      Code executing in LLInt appears to the rest of the JSC world "as if" it
      were executing in the old JIT. Hence, things like exception handling and
      cross-execution-engine calls just work and require pretty much no
      additional overhead.
              
      This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
      V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
      V8, and Kraken, but appear to get a double-digit improvement on real-world
      websites due to a huge reduction in the amount of JIT'ing.
              
      * CMakeLists.txt:
      * GNUmakefile.am:
      * GNUmakefile.list.am:
      * JavaScriptCore.pri:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
      * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * assembler/LinkBuffer.h:
      * assembler/MacroAssemblerCodeRef.h:
      (MacroAssemblerCodePtr):
      (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
      * bytecode/BytecodeConventions.h: Added.
      * bytecode/CallLinkStatus.cpp:
      (JSC::CallLinkStatus::computeFromLLInt):
      (JSC):
      (JSC::CallLinkStatus::computeFor):
      * bytecode/CallLinkStatus.h:
      (JSC::CallLinkStatus::isSet):
      (JSC::CallLinkStatus::operator!):
      (CallLinkStatus):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dump):
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::~CodeBlock):
      (JSC::CodeBlock::finalizeUnconditionally):
      (JSC::CodeBlock::stronglyVisitStrongReferences):
      (JSC):
      (JSC::CodeBlock::unlinkCalls):
      (JSC::CodeBlock::unlinkIncomingCalls):
      (JSC::CodeBlock::bytecodeOffset):
      (JSC::ProgramCodeBlock::jettison):
      (JSC::EvalCodeBlock::jettison):
      (JSC::FunctionCodeBlock::jettison):
      (JSC::ProgramCodeBlock::jitCompileImpl):
      (JSC::EvalCodeBlock::jitCompileImpl):
      (JSC::FunctionCodeBlock::jitCompileImpl):
      * bytecode/CodeBlock.h:
      (JSC):
      (CodeBlock):
      (JSC::CodeBlock::baselineVersion):
      (JSC::CodeBlock::linkIncomingCall):
      (JSC::CodeBlock::bytecodeOffset):
      (JSC::CodeBlock::jitCompile):
      (JSC::CodeBlock::hasOptimizedReplacement):
      (JSC::CodeBlock::addPropertyAccessInstruction):
      (JSC::CodeBlock::addGlobalResolveInstruction):
      (JSC::CodeBlock::addLLIntCallLinkInfo):
      (JSC::CodeBlock::addGlobalResolveInfo):
      (JSC::CodeBlock::numberOfMethodCallLinkInfos):
      (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
      (JSC::CodeBlock::likelyToTakeSlowCase):
      (JSC::CodeBlock::couldTakeSlowCase):
      (JSC::CodeBlock::likelyToTakeSpecialFastCase):
      (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
      (JSC::CodeBlock::likelyToTakeAnySlowCase):
      (JSC::CodeBlock::addFrequentExitSite):
      (JSC::CodeBlock::dontJITAnytimeSoon):
      (JSC::CodeBlock::jitAfterWarmUp):
      (JSC::CodeBlock::jitSoon):
      (JSC::CodeBlock::llintExecuteCounter):
      (ProgramCodeBlock):
      (EvalCodeBlock):
      (FunctionCodeBlock):
      * bytecode/GetByIdStatus.cpp:
      (JSC::GetByIdStatus::computeFromLLInt):
      (JSC):
      (JSC::GetByIdStatus::computeFor):
      * bytecode/GetByIdStatus.h:
      (JSC::GetByIdStatus::GetByIdStatus):
      (JSC::GetByIdStatus::wasSeenInJIT):
      (GetByIdStatus):
      * bytecode/Instruction.h:
      (JSC):
      (JSC::Instruction::Instruction):
      (Instruction):
      * bytecode/LLIntCallLinkInfo.h: Added.
      (JSC):
      (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
      (LLIntCallLinkInfo):
      (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
      (JSC::LLIntCallLinkInfo::isLinked):
      (JSC::LLIntCallLinkInfo::unlink):
      * bytecode/MethodCallLinkStatus.cpp:
      (JSC::MethodCallLinkStatus::computeFor):
      * bytecode/Opcode.cpp:
      (JSC):
      * bytecode/Opcode.h:
      (JSC):
      (JSC::padOpcodeName):
      * bytecode/PutByIdStatus.cpp:
      (JSC::PutByIdStatus::computeFromLLInt):
      (JSC):
      (JSC::PutByIdStatus::computeFor):
      * bytecode/PutByIdStatus.h:
      (PutByIdStatus):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitResolve):
      (JSC::BytecodeGenerator::emitResolveWithBase):
      (JSC::BytecodeGenerator::emitGetById):
      (JSC::BytecodeGenerator::emitPutById):
      (JSC::BytecodeGenerator::emitDirectPutById):
      (JSC::BytecodeGenerator::emitCall):
      (JSC::BytecodeGenerator::emitConstruct):
      (JSC::BytecodeGenerator::emitCatch):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
      (JSC::DFG::ByteCodeParser::handleInlining):
      (JSC::DFG::ByteCodeParser::parseBlock):
      * dfg/DFGCapabilities.h:
      (JSC::DFG::canCompileOpcode):
      * dfg/DFGOSRExitCompiler.cpp:
      * dfg/DFGOperations.cpp:
      * heap/Heap.h:
      (JSC):
      (JSC::Heap::firstAllocatorWithoutDestructors):
      (Heap):
      * heap/MarkStack.cpp:
      (JSC::visitChildren):
      * heap/MarkedAllocator.h:
      (JSC):
      (MarkedAllocator):
      * heap/MarkedSpace.h:
      (JSC):
      (MarkedSpace):
      (JSC::MarkedSpace::firstAllocator):
      * interpreter/CallFrame.cpp:
      (JSC):
      (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
      (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
      (JSC::CallFrame::currentVPC):
      (JSC::CallFrame::setCurrentVPC):
      (JSC::CallFrame::trueCallerFrame):
      * interpreter/CallFrame.h:
      (JSC::ExecState::hasReturnPC):
      (JSC::ExecState::clearReturnPC):
      (ExecState):
      (JSC::ExecState::bytecodeOffsetForNonDFGCode):
      (JSC::ExecState::currentVPC):
      (JSC::ExecState::setCurrentVPC):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::Interpreter):
      (JSC::Interpreter::~Interpreter):
      (JSC):
      (JSC::Interpreter::initialize):
      (JSC::Interpreter::isOpcode):
      (JSC::Interpreter::unwindCallFrame):
      (JSC::getCallerInfo):
      (JSC::Interpreter::privateExecute):
      (JSC::Interpreter::retrieveLastCaller):
      * interpreter/Interpreter.h:
      (JSC):
      (Interpreter):
      (JSC::Interpreter::getOpcode):
      (JSC::Interpreter::getOpcodeID):
      (JSC::Interpreter::classicEnabled):
      * interpreter/RegisterFile.h:
      (JSC):
      (RegisterFile):
      * jit/ExecutableAllocator.h:
      (JSC):
      * jit/HostCallReturnValue.cpp: Added.
      (JSC):
      (JSC::getHostCallReturnValueWithExecState):
      * jit/HostCallReturnValue.h: Added.
      (JSC):
      (JSC::initializeHostCallReturnValue):
      * jit/JIT.cpp:
      (JSC::JIT::privateCompileMainPass):
      (JSC::JIT::privateCompileSlowCases):
      (JSC::JIT::privateCompile):
      * jit/JITCode.h:
      (JSC::JITCode::isOptimizingJIT):
      (JITCode):
      (JSC::JITCode::isBaselineCode):
      (JSC::JITCode::JITCode):
      * jit/JITDriver.h:
      (JSC::jitCompileIfAppropriate):
      (JSC::jitCompileFunctionIfAppropriate):
      * jit/JITExceptions.cpp:
      (JSC::jitThrow):
      * jit/JITInlineMethods.h:
      (JSC::JIT::updateTopCallFrame):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC):
      * jit/JITStubs.h:
      (JSC):
      * jit/JSInterfaceJIT.h:
      * llint: Added.
      * llint/LLIntCommon.h: Added.
      * llint/LLIntData.cpp: Added.
      (LLInt):
      (JSC::LLInt::Data::Data):
      (JSC::LLInt::Data::performAssertions):
      (JSC::LLInt::Data::~Data):
      * llint/LLIntData.h: Added.
      (JSC):
      (LLInt):
      (Data):
      (JSC::LLInt::Data::exceptionInstructions):
      (JSC::LLInt::Data::opcodeMap):
      (JSC::LLInt::Data::performAssertions):
      * llint/LLIntEntrypoints.cpp: Added.
      (LLInt):
      (JSC::LLInt::getFunctionEntrypoint):
      (JSC::LLInt::getEvalEntrypoint):
      (JSC::LLInt::getProgramEntrypoint):
      * llint/LLIntEntrypoints.h: Added.
      (JSC):
      (LLInt):
      (JSC::LLInt::getEntrypoint):
      * llint/LLIntExceptions.cpp: Added.
      (LLInt):
      (JSC::LLInt::interpreterThrowInCaller):
      (JSC::LLInt::returnToThrowForThrownException):
      (JSC::LLInt::returnToThrow):
      (JSC::LLInt::callToThrow):
      * llint/LLIntExceptions.h: Added.
      (JSC):
      (LLInt):
      * llint/LLIntOfflineAsmConfig.h: Added.
      * llint/LLIntOffsetsExtractor.cpp: Added.
      (JSC):
      (LLIntOffsetsExtractor):
      (JSC::LLIntOffsetsExtractor::dummy):
      (main):
      * llint/LLIntSlowPaths.cpp: Added.
      (LLInt):
      (JSC::LLInt::llint_trace_operand):
      (JSC::LLInt::llint_trace_value):
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      (JSC::LLInt::traceFunctionPrologue):
      (JSC::LLInt::shouldJIT):
      (JSC::LLInt::entryOSR):
      (JSC::LLInt::resolveGlobal):
      (JSC::LLInt::getByVal):
      (JSC::LLInt::handleHostCall):
      (JSC::LLInt::setUpCall):
      (JSC::LLInt::genericCall):
      * llint/LLIntSlowPaths.h: Added.
      (JSC):
      (LLInt):
      * llint/LLIntThunks.cpp: Added.
      (LLInt):
      (JSC::LLInt::generateThunkWithJumpTo):
      (JSC::LLInt::functionForCallEntryThunkGenerator):
      (JSC::LLInt::functionForConstructEntryThunkGenerator):
      (JSC::LLInt::functionForCallArityCheckThunkGenerator):
      (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
      (JSC::LLInt::evalEntryThunkGenerator):
      (JSC::LLInt::programEntryThunkGenerator):
      * llint/LLIntThunks.h: Added.
      (JSC):
      (LLInt):
      * llint/LowLevelInterpreter.asm: Added.
      * llint/LowLevelInterpreter.cpp: Added.
      * llint/LowLevelInterpreter.h: Added.
      * offlineasm: Added.
      * offlineasm/armv7.rb: Added.
      * offlineasm/asm.rb: Added.
      * offlineasm/ast.rb: Added.
      * offlineasm/backends.rb: Added.
      * offlineasm/generate_offset_extractor.rb: Added.
      * offlineasm/instructions.rb: Added.
      * offlineasm/offset_extractor_constants.rb: Added.
      * offlineasm/offsets.rb: Added.
      * offlineasm/opt.rb: Added.
      * offlineasm/parser.rb: Added.
      * offlineasm/registers.rb: Added.
      * offlineasm/self_hash.rb: Added.
      * offlineasm/settings.rb: Added.
      * offlineasm/transform.rb: Added.
      * offlineasm/x86.rb: Added.
      * runtime/CodeSpecializationKind.h: Added.
      (JSC):
      * runtime/CommonSlowPaths.h:
      (JSC::CommonSlowPaths::arityCheckFor):
      (CommonSlowPaths):
      * runtime/Executable.cpp:
      (JSC::jettisonCodeBlock):
      (JSC):
      (JSC::EvalExecutable::jitCompile):
      (JSC::samplingDescription):
      (JSC::EvalExecutable::compileInternal):
      (JSC::ProgramExecutable::jitCompile):
      (JSC::ProgramExecutable::compileInternal):
      (JSC::FunctionExecutable::baselineCodeBlockFor):
      (JSC::FunctionExecutable::jitCompileForCall):
      (JSC::FunctionExecutable::jitCompileForConstruct):
      (JSC::FunctionExecutable::compileForCallInternal):
      (JSC::FunctionExecutable::compileForConstructInternal):
      * runtime/Executable.h:
      (JSC):
      (EvalExecutable):
      (ProgramExecutable):
      (FunctionExecutable):
      (JSC::FunctionExecutable::jitCompileFor):
      * runtime/ExecutionHarness.h: Added.
      (JSC):
      (JSC::prepareForExecution):
      (JSC::prepareFunctionForExecution):
      * runtime/JSArray.h:
      (JSC):
      (JSArray):
      * runtime/JSCell.h:
      (JSC):
      (JSCell):
      * runtime/JSFunction.h:
      (JSC):
      (JSFunction):
      * runtime/JSGlobalData.cpp:
      (JSC::JSGlobalData::JSGlobalData):
      * runtime/JSGlobalData.h:
      (JSC):
      (JSGlobalData):
      * runtime/JSGlobalObject.h:
      (JSC):
      (JSGlobalObject):
      * runtime/JSObject.h:
      (JSC):
      (JSObject):
      (JSFinalObject):
      * runtime/JSPropertyNameIterator.h:
      (JSC):
      (JSPropertyNameIterator):
      * runtime/JSString.h:
      (JSC):
      (JSString):
      * runtime/JSTypeInfo.h:
      (JSC):
      (TypeInfo):
      * runtime/JSValue.cpp:
      (JSC::JSValue::description):
      * runtime/JSValue.h:
      (LLInt):
      (JSValue):
      * runtime/JSVariableObject.h:
      (JSC):
      (JSVariableObject):
      * runtime/Options.cpp:
      (Options):
      (JSC::Options::initializeOptions):
      * runtime/Options.h:
      (Options):
      * runtime/ScopeChain.h:
      (JSC):
      (ScopeChainNode):
      * runtime/Structure.cpp:
      (JSC::Structure::addPropertyTransition):
      * runtime/Structure.h:
      (JSC):
      (Structure):
      * runtime/StructureChain.h:
      (JSC):
      (StructureChain):
      * wtf/InlineASM.h:
      * wtf/Platform.h:
      * wtf/SentinelLinkedList.h:
      (SentinelLinkedList):
      (WTF::SentinelLinkedList::isEmpty):
      * wtf/text/StringImpl.h:
      (JSC):
      (StringImpl):
      
      Source/WebCore: 
      
      Reviewed by Gavin Barraclough.
              
      No new tests, because there is no change in behavior.
      
      * CMakeLists.txt:
      
      Source/WebKit: 
      
      Reviewed by Gavin Barraclough.
      
      Changed EFL's build system to include a new directory in JavaScriptCore.
              
      * CMakeLists.txt:
      
      Tools: 
      
      Reviewed by Gavin Barraclough.
      
      Changed EFL's build system to include a new directory in JavaScriptCore.
      
      * DumpRenderTree/efl/CMakeLists.txt:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108309 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      091129f4
  27. 13 Feb, 2012 1 commit
    • barraclough@apple.com's avatar
      https://bugs.webkit.org/show_bug.cgi?id=78434 · 2441d33f
      barraclough@apple.com authored
      Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
      
      Source/JavaScriptCore: 
      
      * parser/Parser.cpp:
      (JSC::::parseFunctionInfo):
      * runtime/ClassInfo.h:
      (MethodTable):
      (JSC):
      * runtime/JSCell.cpp:
      (JSC):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::reset):
      * runtime/JSGlobalObjectFunctions.cpp:
      (JSC):
      * runtime/JSGlobalObjectFunctions.h:
      (JSC):
      * runtime/JSObject.cpp:
      (JSC::JSObject::put):
      (JSC):
      (JSC::JSObject::putDirectAccessor):
      (JSC::JSObject::defineOwnProperty):
      * runtime/JSObject.h:
      (JSC::JSObject::inlineGetOwnPropertySlot):
      (JSC::JSValue::get):
      * runtime/JSString.cpp:
      (JSC::JSString::getOwnPropertySlot):
      * runtime/JSValue.h:
      (JSValue):
      * runtime/ObjectConstructor.cpp:
      (JSC::objectConstructorGetPrototypeOf):
      * runtime/Structure.cpp:
      (JSC::Structure::Structure):
      * runtime/Structure.h:
      (JSC::Structure::setHasGetterSetterProperties):
      (Structure):
      
      Source/WebCore: 
      
      * bindings/js/JSDOMWindowBase.cpp:
      (WebCore):
      * bindings/js/JSDOMWindowBase.h:
      (JSDOMWindowBase):
      
      LayoutTests: 
      
      * fast/js/Object-getOwnPropertyNames-expected.txt:
      * fast/js/cyclic-prototypes-expected.txt:
      * fast/js/parser-syntax-check-expected.txt:
      * fast/js/preventExtensions-expected.txt:
      * fast/js/prototypes-expected.txt:
      * fast/js/script-tests/Object-getOwnPropertyNames.js:
      * fast/js/script-tests/cyclic-prototypes.js:
      * fast/js/script-tests/parser-syntax-check.js:
      * fast/js/script-tests/preventExtensions.js:
      * fast/js/script-tests/prototypes.js:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107544 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      2441d33f
  28. 11 Feb, 2012 1 commit
    • barraclough@apple.com's avatar
      Move special __proto__ property to Object.prototype · 1b59d1e9
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=78409
      
      Reviewed by Oliver Hunt.
      
      Re-implement this as a regular accessor property.  This has three key benefits:
      1) It makes it possible for objects to be given properties named __proto__.
      2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
      3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
      
      Source/JavaScriptCore: 
      
      * parser/Parser.cpp:
      (JSC::::parseFunctionInfo):
          - No need to prohibit functions named __proto__.
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::reset):
          - Add __proto__ accessor to Object.prototype.
      * runtime/JSGlobalObjectFunctions.cpp:
      (JSC::globalFuncProtoGetter):
      (JSC::globalFuncProtoSetter):
          - Definition of the __proto__ accessor functions.
      * runtime/JSGlobalObjectFunctions.h:
          - Declaration of the __proto__ accessor functions.
      * runtime/JSObject.cpp:
      (JSC::JSObject::put):
          - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
      (JSC::JSObject::putDirectAccessor):
          - Track on the structure whether an object contains accessors other than one for __proto__.
      (JSC::JSObject::defineOwnProperty):
          - No need to prohibit definition of own properties named __proto__.
      * runtime/JSObject.h:
      (JSC::JSObject::inlineGetOwnPropertySlot):
          - Remove the special handling for __proto__.
      (JSC::JSValue::get):
          - Remove the special handling for __proto__.
      * runtime/JSString.cpp:
      (JSC::JSString::getOwnPropertySlot):
          - Remove the special handling for __proto__.
      * runtime/JSValue.h:
      (JSValue):
          - Made synthesizePrototype public (this may be needed by the __proto__ getter).
      * runtime/ObjectConstructor.cpp:
      (JSC::objectConstructorGetPrototypeOf):
          - Perform the security check & call prototype() directly.
      * runtime/Structure.cpp:
      (JSC::Structure::Structure):
          - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
      * runtime/Structure.h:
      (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
      (JSC::Structure::setHasGetterSetterProperties):
      (Structure):
          - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
      
      Source/WebCore: 
      
      * bindings/js/JSDOMWindowBase.cpp:
      (WebCore::JSDOMWindowBase::allowsAccessFrom):
      (WebCore):
          - expose allowsAccessFrom check to JSC.
      * bindings/js/JSDOMWindowBase.h:
      (JSDOMWindowBase):
          - expose allowsAccessFrom check to JSC.
      
      LayoutTests: 
      
      * fast/js/Object-getOwnPropertyNames-expected.txt:
      * fast/js/cyclic-prototypes-expected.txt:
      * fast/js/parser-syntax-check-expected.txt:
      * fast/js/preventExtensions-expected.txt:
      * fast/js/prototypes-expected.txt:
          - Update results
      * fast/js/script-tests/Object-getOwnPropertyNames.js:
          - __proto__ is now a property of Object Prototype.
      * fast/js/script-tests/cyclic-prototypes.js:
          - setting an object's prototype to null removes __proto__ setter, future usage won't set prototype.
      * fast/js/script-tests/parser-syntax-check.js:
          - Allow functions named __proto__
      * fast/js/script-tests/preventExtensions.js:
          - Setting __proto__ should not throw.
      * fast/js/script-tests/prototypes.js:
          - Objects may contained own properties named __proto__, add new test cases.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107498 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1b59d1e9
  29. 10 Feb, 2012 1 commit
    • mhahnenberg@apple.com's avatar
      Split MarkedSpace into destructor and destructor-free subspaces · c2748329
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=77761
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Switched over to use destructor-free space.
      * heap/Heap.h:
      (JSC::Heap::allocatorForObjectWithoutDestructor): Added to give clients (e.g. the JIT) the ability to 
      pick which subspace they want to allocate out of.
      (JSC::Heap::allocatorForObjectWithDestructor): Ditto.
      (Heap):
      (JSC::Heap::allocateWithDestructor): Added private function for CellAllocator to use.
      (JSC):
      (JSC::Heap::allocateWithoutDestructor): Ditto.
      * heap/MarkedAllocator.cpp: Added the cellsNeedDestruction flag to allocators so that they can allocate 
      their MarkedBlocks correctly.
      (JSC::MarkedAllocator::allocateBlock):
      * heap/MarkedAllocator.h:
      (JSC::MarkedAllocator::cellsNeedDestruction):
      (MarkedAllocator):
      (JSC::MarkedAllocator::MarkedAllocator):
      (JSC):
      (JSC::MarkedAllocator::init): Replaced custom set functions, which were only used upon initialization, with
      an init function that does all of that stuff in fewer lines.
      * heap/MarkedBlock.cpp:
      (JSC::MarkedBlock::create):
      (JSC::MarkedBlock::recycle):
      (JSC::MarkedBlock::MarkedBlock):
      (JSC::MarkedBlock::callDestructor): Templatized, along with specializedSweep and sweepHelper, to make 
      checking the m_cellsNeedDestructor flag faster and cleaner looking.
      (JSC):
      (JSC::MarkedBlock::specializedSweep):
      (JSC::MarkedBlock::sweep):
      (JSC::MarkedBlock::sweepHelper):
      * heap/MarkedBlock.h:
      (MarkedBlock):
      (JSC::MarkedBlock::cellsNeedDestruction):
      (JSC):
      * heap/MarkedSpace.cpp:
      (JSC::MarkedSpace::MarkedSpace):
      (JSC::MarkedSpace::resetAllocators):
      (JSC::MarkedSpace::canonicalizeCellLivenessData):
      (JSC::TakeIfUnmarked::operator()):
      * heap/MarkedSpace.h:
      (MarkedSpace):
      (Subspace):
      (JSC::MarkedSpace::allocatorFor): Needed function to differentiate between the two broad subspaces of 
      allocators.
      (JSC):
      (JSC::MarkedSpace::destructorAllocatorFor): Ditto.
      (JSC::MarkedSpace::allocateWithoutDestructor): Ditto.
      (JSC::MarkedSpace::allocateWithDestructor): Ditto.
      (JSC::MarkedSpace::forEachBlock):
      * jit/JIT.h:
      * jit/JITInlineMethods.h: Modified to use the proper allocator for JSFinalObjects and others.
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateJSFinalObject):
      (JSC::JIT::emitAllocateJSFunction):
      * runtime/JSArray.cpp:
      (JSC):
      * runtime/JSArray.h:
      (JSArray):
      (JSC::JSArray::create):
      (JSC):
      (JSC::JSArray::tryCreateUninitialized):
      * runtime/JSCell.h:
      (JSCell):
      (JSC):
      (NeedsDestructor): Template struct that calculates at compile time whether the class in question requires 
      destruction or not using the compiler type trait __has_trivial_destructor. allocateCell then checks this 
      constant to decide whether to allocate in the destructor or destructor-free parts of the heap.
      (JSC::allocateCell): 
      * runtime/JSFunction.cpp:
      (JSC):
      * runtime/JSFunction.h:
      (JSFunction):
      * runtime/JSObject.cpp:
      (JSC):
      * runtime/JSObject.h:
      (JSNonFinalObject):
      (JSC):
      (JSFinalObject):
      (JSC::JSFinalObject::create):
      
      Source/WebCore: 
      
      No new tests.
      
      * bindings/js/JSDOMWindowShell.cpp: Removed old operator new, which was just used in the create
      function so that we can use allocateCell instead.
      (WebCore):
      * bindings/js/JSDOMWindowShell.h:
      (WebCore::JSDOMWindowShell::create):
      (JSDOMWindowShell):
      * bindings/scripts/CodeGeneratorJS.pm: Added destructor back to root JS DOM nodes (e.g. JSNode, etc)
      because their destroy functions need to be called, so we don't want the NeedsDestructor struct to 
      think they don't need destruction due to having empty/trivial destructors.
      Removed ASSERT_HAS_TRIVIAL_DESTRUCTOR from all JS DOM wrapper auto-generated objects because their 
      ancestors now have non-trivial destructors. 
      (GenerateHeader):
      (GenerateImplementation):
      (GenerateConstructorDefinition):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107445 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c2748329
  30. 06 Feb, 2012 1 commit
    • barraclough@apple.com's avatar
      Remove JSObject defineGetter/defineSetter lookupGetter/lookupSetter · 81aa89f0
      barraclough@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=77451
      
      Reviewed by Sam Weinig.
      
      These can now all be implemented in terms of defineOwnProperty & getPropertyDescriptor.
      Also remove initializeGetterSetterProperty, since this is equivalent to putDirectAccessor.
      
      Source/JavaScriptCore: 
      
      * JavaScriptCore.exp:
      * debugger/DebuggerActivation.cpp:
      (JSC::DebuggerActivation::defineOwnProperty):
      * debugger/DebuggerActivation.h:
      (DebuggerActivation):
      * runtime/ClassInfo.h:
      (MethodTable):
      (JSC):
      * runtime/JSBoundFunction.cpp:
      (JSC::JSBoundFunction::finishCreation):
      * runtime/JSCell.cpp:
      (JSC):
      * runtime/JSCell.h:
      (JSCell):
      * runtime/JSFunction.cpp:
      (JSC::JSFunction::getOwnPropertySlot):
      (JSC::JSFunction::getOwnPropertyDescriptor):
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::defineOwnProperty):
      (JSC):
      * runtime/JSGlobalObject.h:
      (JSGlobalObject):
      * runtime/JSObject.cpp:
      (JSC):
      * runtime/JSObject.h:
      (JSObject):
      * runtime/ObjectPrototype.cpp:
      (JSC::objectProtoFuncDefineGetter):
      (JSC::objectProtoFuncDefineSetter):
      (JSC::objectProtoFuncLookupGetter):
      (JSC::objectProtoFuncLookupSetter):
      
      Source/WebCore: 
      
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore):
      (WebCore::JSDOMWindow::defineOwnProperty):
      * bindings/js/JSDOMWindowShell.cpp:
      (WebCore):
      * bindings/js/JSDOMWindowShell.h:
      (JSDOMWindowShell):
      * bindings/js/JSLocationCustom.cpp:
      (WebCore::JSLocation::defineOwnProperty):
      (WebCore::JSLocationPrototype::defineOwnProperty):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader):
      * page/DOMWindow.idl:
      * page/Location.idl:
      
      Source/WebKit/qt: 
      
      * Api/qwebframe.cpp:
      (QWebFramePrivate::addQtSenderToGlobalObject):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@106783 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      81aa89f0
  31. 24 Jan, 2012 1 commit
    • ggaren@apple.com's avatar
      JSValue::toString() should return a JSString* instead of a UString · 64be5e90
      ggaren@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=76861
      
      ../JavaScriptCore: 
      
      Reviewed by Gavin Barraclough.
              
      This makes the common case -- toString() on a string -- faster and
      inline-able. (Not a measureable speedup, but we can now remove a bunch
      of duplicate hand-rolled code for this optimization.)
              
      This also clarifies the boundary between "C++ strings" and "JS strings".
              
      In all cases other than true, false, null, undefined, and multi-digit
      numbers, the JS runtime was just retrieving a UString from a JSString,
      so returning a JSString* is strictly better. In the other cases, we can
      optimize to avoid creating a new JSString if we care to, but it doesn't
      seem to be a big deal.
      
      * JavaScriptCore.exp: Export!
              
      * jsc.cpp:
      (functionPrint):
      (functionDebug):
      (functionRun):
      (functionLoad):
      (functionCheckSyntax):
      (runWithScripts):
      (runInteractive):
      * API/JSValueRef.cpp:
      (JSValueToStringCopy):
      * bytecode/CodeBlock.cpp:
      (JSC::valueToSourceString): Call value() after calling toString(), to
      convert from "JS string" (JSString*) to "C++ string" (UString), since
      toString() no longer returns a "C++ string".
      
      * dfg/DFGOperations.cpp:
      (JSC::DFG::operationValueAddNotNumber):
      * jit/JITStubs.cpp:
      (op_add): Updated for removal of toPrimitiveString():
      all '+' operands can use toString(), except for object operands, which
      need to take a slow path to call toPrimitive().
      
      * runtime/ArrayPrototype.cpp:
      (JSC::arrayProtoFuncToString):
      (JSC::arrayProtoFuncToLocaleString):
      (JSC::arrayProtoFuncJoin):
      (JSC::arrayProtoFuncPush):
      * runtime/CommonSlowPaths.h:
      (JSC::CommonSlowPaths::opIn):
      * runtime/DateConstructor.cpp:
      (JSC::dateParse):
      * runtime/DatePrototype.cpp:
      (JSC::formatLocaleDate): Call value() after calling toString(), as above.
      
      * runtime/ErrorInstance.h:
      (JSC::ErrorInstance::create): Simplified down to one canonical create()
      function, to make string handling easier.
      
      * runtime/ErrorPrototype.cpp:
      (JSC::errorProtoFuncToString):
      * runtime/ExceptionHelpers.cpp:
      (JSC::createInvalidParamError):
      (JSC::createNotAConstructorError):
      (JSC::createNotAFunctionError):
      (JSC::createNotAnObjectError):
      * runtime/FunctionConstructor.cpp:
      (JSC::constructFunctionSkippingEvalEnabledCheck):
      * runtime/FunctionPrototype.cpp:
      (JSC::functionProtoFuncBind):
      * runtime/JSArray.cpp:
      (JSC::JSArray::sort): Call value() after calling toString(), as above.
      
      * runtime/JSCell.cpp:
      * runtime/JSCell.h: Removed JSCell::toString() because JSValue does this
      job now. Doing it in JSCell is slower (requires extra type checking), and
      creates the misimpression that language-defined toString() behavior is
      an implementation detail of JSCell.
              
      * runtime/JSGlobalObjectFunctions.cpp:
      (JSC::encode):
      (JSC::decode):
      (JSC::globalFuncEval):
      (JSC::globalFuncParseInt):
      (JSC::globalFuncParseFloat):
      (JSC::globalFuncEscape):
      (JSC::globalFuncUnescape): Call value() after calling toString(), as above.
      
      * runtime/JSONObject.cpp:
      (JSC::unwrapBoxedPrimitive):
      (JSC::Stringifier::Stringifier):
      (JSC::JSONProtoFuncParse): Removed some manual optimization that toString()
      takes care of.
      
      * runtime/JSObject.cpp:
      (JSC::JSObject::toString):
      * runtime/JSObject.h: Updated to return JSString*.
      
      * runtime/JSString.cpp:
      * runtime/JSString.h:
      (JSC::JSValue::toString): Removed, since I removed JSCell::toString().
      
      * runtime/JSValue.cpp:
      (JSC::JSValue::toStringSlowCase): Removed toPrimitiveString(), and re-
      spawned toStringSlowCase() from its zombie corpse, since toPrimitiveString()
      basically did what we want all the time. (Note that the toPrimitive()
      preference changes from NoPreference to PreferString, because that's
      how ToString is defined in the language. op_add does not want this behavior.)
      
      * runtime/NumberPrototype.cpp:
      (JSC::numberProtoFuncToString):
      (JSC::numberProtoFuncToLocaleString): A little simpler, now that toString()
      returns a JSString*.
      
      * runtime/ObjectConstructor.cpp:
      (JSC::objectConstructorGetOwnPropertyDescriptor):
      (JSC::objectConstructorDefineProperty):
      * runtime/ObjectPrototype.cpp:
      (JSC::objectProtoFuncHasOwnProperty):
      (JSC::objectProtoFuncDefineGetter):
      (JSC::objectProtoFuncDefineSetter):
      (JSC::objectProtoFuncLookupGetter):
      (JSC::objectProtoFuncLookupSetter):
      (JSC::objectProtoFuncPropertyIsEnumerable): More calls to value(), as above.
      
      * runtime/Operations.cpp:
      (JSC::jsAddSlowCase): Need to check for object before taking the toString()
      fast path becuase adding an object to a string requires calling toPrimitive()
      on the object, not toString(). (They differ in their preferred conversion
      type.)
      
      * runtime/Operations.h:
      (JSC::jsString):
      (JSC::jsStringFromArguments): This code gets simpler, now that toString()
      does the right thing.
      
      (JSC::jsAdd): Now checks for object, just like jsAddSlowCase().
      
      * runtime/RegExpConstructor.cpp:
      (JSC::setRegExpConstructorInput):
      (JSC::constructRegExp):
      * runtime/RegExpObject.cpp:
      (JSC::RegExpObject::match):
      * runtime/RegExpPrototype.cpp:
      (JSC::regExpProtoFuncCompile):
      (JSC::regExpProtoFuncToString): More calls to value(), as above.
      
      * runtime/StringConstructor.cpp:
      (JSC::constructWithStringConstructor):
      (JSC::callStringConstructor): This code gets simpler, now that toString()
      does the right thing.
      
      * runtime/StringPrototype.cpp:
      (JSC::replaceUsingRegExpSearch):
      (JSC::replaceUsingStringSearch):
      (JSC::stringProtoFuncReplace):
      (JSC::stringProtoFuncCharAt):
      (JSC::stringProtoFuncCharCodeAt):
      (JSC::stringProtoFuncConcat):
      (JSC::stringProtoFuncIndexOf):
      (JSC::stringProtoFuncLastIndexOf):
      (JSC::stringProtoFuncMatch):
      (JSC::stringProtoFuncSearch):
      (JSC::stringProtoFuncSlice):
      (JSC::stringProtoFuncSplit):
      (JSC::stringProtoFuncSubstr):
      (JSC::stringProtoFuncSubstring):
      (JSC::stringProtoFuncToLowerCase):
      (JSC::stringProtoFuncToUpperCase):
      (JSC::stringProtoFuncLocaleCompare):
      (JSC::stringProtoFuncBig):
      (JSC::stringProtoFuncSmall):
      (JSC::stringProtoFuncBlink):
      (JSC::stringProtoFuncBold):
      (JSC::stringProtoFuncFixed):
      (JSC::stringProtoFuncItalics):
      (JSC::stringProtoFuncStrike):
      (JSC::stringProtoFuncSub):
      (JSC::stringProtoFuncSup):
      (JSC::stringProtoFuncFontcolor):
      (JSC::stringProtoFuncFontsize):
      (JSC::stringProtoFuncAnchor):
      (JSC::stringProtoFuncLink):
      (JSC::trimString): Some of this code gets simpler, now that toString()
      does the right thing. More calls to value(), as above.
      
      ../JavaScriptGlue: 
      
      Reviewed by Gavin Barraclough.
      
      * JSUtils.cpp:
      (KJSValueToCFTypeInternal):
      
      ../WebCore: 
      
      Reviewed by Gavin Barraclough.
      
      Mechanical changes to call value() after calling toString(), to
      convert from "JS string" (JSString*) to "C++ string" (UString), since
      toString() no longer returns a "C++ string".
      
      * bindings/js/IDBBindingUtilities.cpp:
      (WebCore::createIDBKeyFromValue):
      * bindings/js/JSCSSStyleDeclarationCustom.cpp:
      (WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
      * bindings/js/JSClipboardCustom.cpp:
      (WebCore::JSClipboard::clearData):
      (WebCore::JSClipboard::getData):
      * bindings/js/JSCustomXPathNSResolver.cpp:
      (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
      * bindings/js/JSDOMBinding.cpp:
      (WebCore::valueToStringWithNullCheck):
      (WebCore::valueToStringWithUndefinedOrNullCheck):
      (WebCore::reportException):
      * bindings/js/JSDOMFormDataCustom.cpp:
      (WebCore::JSDOMFormData::append):
      * bindings/js/JSDOMStringMapCustom.cpp:
      (WebCore::JSDOMStringMap::putDelegate):
      * bindings/js/JSDOMWindowCustom.cpp:
      (WebCore::JSDOMWindow::setLocation):
      (WebCore::JSDOMWindow::open):
      (WebCore::JSDOMWindow::addEventListener):
      (WebCore::JSDOMWindow::removeEventListener):
      * bindings/js/JSDeviceMotionEventCustom.cpp:
      (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
      * bindings/js/JSDeviceOrientationEventCustom.cpp:
      (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
      * bindings/js/JSDictionary.cpp:
      (WebCore::JSDictionary::convertValue):
      * bindings/js/JSDocumentCustom.cpp:
      (WebCore::JSDocument::setLocation):
      * bindings/js/JSEventListener.cpp:
      (WebCore::JSEventListener::handleEvent):
      * bindings/js/JSHTMLAllCollectionCustom.cpp:
      (WebCore::callHTMLAllCollection):
      (WebCore::JSHTMLAllCollection::item):
      (WebCore::JSHTMLAllCollection::namedItem):
      * bindings/js/JSHTMLCanvasElementCustom.cpp:
      (WebCore::JSHTMLCanvasElement::getContext):
      * bindings/js/JSHTMLCollectionCustom.cpp:
      (WebCore::JSHTMLCollection::item):
      (WebCore::JSHTMLCollection::namedItem):
      * bindings/js/JSHTMLDocumentCustom.cpp:
      (WebCore::documentWrite):
      * bindings/js/JSHTMLInputElementCustom.cpp:
      (WebCore::JSHTMLInputElement::setSelectionDirection):
      (WebCore::JSHTMLInputElement::setSelectionRange):
      * bindings/js/JSInspectorFrontendHostCustom.cpp:
      (WebCore::JSInspectorFrontendHost::showContextMenu):
      * bindings/js/JSJavaScriptCallFrameCustom.cpp:
      (WebCore::JSJavaScriptCallFrame::evaluate):
      * bindings/js/JSLocationCustom.cpp:
      (WebCore::JSLocation::setHref):
      (WebCore::JSLocation::setProtocol):
      (WebCore::JSLocation::setHost):
      (WebCore::JSLocation::setHostname):
      (WebCore::JSLocation::setPort):
      (WebCore::JSLocation::setPathname):
      (WebCore::JSLocation::setSearch):
      (WebCore::JSLocation::setHash):
      (WebCore::JSLocation::replace):
      (WebCore::JSLocation::assign):
      * bindings/js/JSMessageEventCustom.cpp:
      (WebCore::handleInitMessageEvent):
      * bindings/js/JSSQLTransactionCustom.cpp:
      (WebCore::JSSQLTransaction::executeSql):
      * bindings/js/JSSQLTransactionSyncCustom.cpp:
      (WebCore::JSSQLTransactionSync::executeSql):
      * bindings/js/JSSharedWorkerCustom.cpp:
      (WebCore::JSSharedWorkerConstructor::constructJSSharedWorker):
      * bindings/js/JSStorageCustom.cpp:
      (WebCore::JSStorage::putDelegate):
      * bindings/js/JSWebGLRenderingContextCustom.cpp:
      (WebCore::JSWebGLRenderingContext::getExtension):
      * bindings/js/JSWebSocketCustom.cpp:
      (WebCore::JSWebSocketConstructor::constructJSWebSocket):
      (WebCore::JSWebSocket::send):
      (WebCore::JSWebSocket::close):
      * bindings/js/JSWorkerContextCustom.cpp:
      (WebCore::JSWorkerContext::importScripts):
      * bindings/js/JSWorkerCustom.cpp:
      (WebCore::JSWorkerConstructor::constructJSWorker):
      * bindings/js/JSXMLHttpRequestCustom.cpp:
      (WebCore::JSXMLHttpRequest::open):
      (WebCore::JSXMLHttpRequest::send):
      * bindings/js/JSXSLTProcessorCustom.cpp:
      (WebCore::JSXSLTProcessor::setParameter):
      (WebCore::JSXSLTProcessor::getParameter):
      (WebCore::JSXSLTProcessor::removeParameter):
      * bindings/js/ScheduledAction.cpp:
      (WebCore::ScheduledAction::create):
      * bindings/js/ScriptEventListener.cpp:
      (WebCore::eventListenerHandlerBody):
      * bindings/js/ScriptValue.cpp:
      (WebCore::ScriptValue::toString):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateEventListenerCall):
      (JSValueToNative):
      (GenerateConstructorDefinition):
      * bridge/c/c_utility.cpp:
      (JSC::Bindings::convertValueToNPVariant):
      * bridge/jni/jni_jsobject.mm:
      (JavaJSObject::convertValueToJObject):
      * bridge/jni/jsc/JNIUtilityPrivate.cpp:
      (JSC::Bindings::convertArrayInstanceToJavaArray):
      (JSC::Bindings::convertValueToJValue):
      * bridge/jni/jsc/JavaFieldJSC.cpp:
      (JavaField::dispatchValueFromInstance):
      (JavaField::valueFromInstance):
      (JavaField::dispatchSetValueToInstance):
      (JavaField::setValueToInstance):
      * bridge/jni/jsc/JavaInstanceJSC.cpp:
      (JavaInstance::invokeMethod):
      * testing/js/JSInternalsCustom.cpp:
      (WebCore::JSInternals::setUserPreferredLanguages):
      
      ../WebKit/mac: 
      
      Reviewed by Gavin Barraclough.
      
      Mechanical changes to call value() after calling toString(), to
      convert from "JS string" (JSString*) to "C++ string" (UString), since
      toString() no longer returns a "C++ string".
      
      * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
      (WebKit::NetscapePluginInstanceProxy::addValueToArray):
      * WebView/WebFrame.mm:
      (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
      (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
      
      ../WebKit2: 
      
      Reviewed by Gavin Barraclough.
      
      Mechanical changes to call value() after calling toString(), to
      convert from "JS string" (JSString*) to "C++ string" (UString), since
      toString() no longer returns a "C++ string".
      
      * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
      (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      64be5e90
  32. 17 Jan, 2012 1 commit
    • caio.oliveira@openbossa.org's avatar
      Uint8ClampedArray support · 992fc376
      caio.oliveira@openbossa.org authored
      https://bugs.webkit.org/show_bug.cgi?id=74455
      
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore:
      
      * GNUmakefile.list.am:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * bytecode/PredictedType.cpp:
      (JSC::predictionToString):
      (JSC::predictionFromClassInfo):
      * bytecode/PredictedType.h:
      (JSC::isUint8ClampedArrayPrediction):
      (JSC::isActionableMutableArrayPrediction):
      * dfg/DFGAbstractState.cpp:
      (JSC::DFG::AbstractState::initialize):
      (JSC::DFG::AbstractState::execute):
      * dfg/DFGNode.h:
      (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
      * dfg/DFGPropagator.cpp:
      (JSC::DFG::Propagator::propagateNodePredictions):
      (JSC::DFG::Propagator::fixupNode):
      (JSC::DFG::Propagator::performNodeCSE):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
      (JSC::DFG::clampDoubleToByte):
      (JSC::DFG::compileClampIntegerToByte):
      (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
      (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
      (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
      * dfg/DFGSpeculativeJIT.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * runtime/JSCell.h:
      * runtime/JSGlobalData.h:
      * wtf/Forward.h:
      * wtf/Uint8Array.h:
      * wtf/Uint8ClampedArray.h: Added.
      (WTF::Uint8ClampedArray::set):
      (WTF::Uint8ClampedArray::create):
      (WTF::Uint8ClampedArray::Uint8ClampedArray):
      (WTF::Uint8ClampedArray::subarray):
      
      Source/WebCore:
      
      Test: fast/js/dfg-uint8clampedarray.html
      
      * CMakeLists.txt:
      * DerivedSources.cpp:
      * DerivedSources.make:
      * DerivedSources.pri:
      * ForwardingHeaders/wtf/Uint8ClampedArray.h: Added.
      * GNUmakefile.list.am:
      * Target.pri:
      * UseJSC.cmake:
      * WebCore.xcodeproj/project.pbxproj:
      * bindings/js/JSBindingsAllInOne.cpp:
      * bindings/js/JSDOMWindowCustom.cpp:
      * bindings/js/JSUint8ClampedArrayCustom.cpp: Added.
      (WebCore::JSUint8ClampedArray::indexSetter):
      (WebCore::toJS):
      (WebCore::JSUint8ClampedArray::set):
      (WebCore::JSUint8ClampedArrayConstructor::constructJSUint8ClampedArray):
      * bindings/scripts/CodeGeneratorJS.pm:
      (IsTypedArrayType):
      (GenerateHeader):
      * html/canvas/Uint8ClampedArray.idl: Added.
      * page/DOMWindow.idl:
      
      Source/WTF:
      
      * WTF.pro:
      
      LayoutTests:
      
      * fast/canvas/webgl/array-unit-tests-expected.txt:
      * fast/canvas/webgl/array-unit-tests.html:
      * fast/dom/Window/script-tests/window-property-descriptors.js:
      * fast/dom/Window/window-properties.html:
      * fast/dom/script-tests/constructed-objects-prototypes.js:
      (constructorPropertiesOnWindow):
      * fast/dom/script-tests/prototype-inheritance-2.js:
      (constructorNamesForWindow):
      * fast/js/dfg-uint8clampedarray-expected.txt: Added.
      * fast/js/dfg-uint8clampedarray.html: Added.
      * fast/js/script-tests/dfg-uint8clampedarray.js: Added.
      (getter1):
      (setter1):
      (getter2):
      (setter2):
      (getter3):
      (setter3):
      (getter4):
      (setter4):
      (getters.getter1.a):
      (.a):
      (setters.setter1.a):
      (safeGetter):
      (safeSetter):
      * fast/js/script-tests/global-constructors.js:
      * platform/chromium/fast/canvas/webgl/array-unit-tests-expected.txt: Copied from LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt.
      * platform/chromium/test_expectations.txt:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105217 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      992fc376
  33. 13 Jan, 2012 1 commit
    • morrita@google.com's avatar
      JavaScriptCore: Mark all exported symbols in the header file automatically. · f0dd2d91
      morrita@google.com authored
      https://bugs.webkit.org/show_bug.cgi?id=72855
      
      Reviewed by Darin Adler.
      
      Added WTF_EXPORT_PRIVATE and JS_EXPORT_PRIVATE based on JavaScriptCore.exp files.
      The change is generated by a tool calledListExportables (https://github.com/omo/ListExportables)
      
      * API/OpaqueJSString.h:
      * bytecode/CodeBlock.h:
      * bytecode/SamplingTool.h:
      * debugger/Debugger.h:
      * debugger/DebuggerActivation.h:
      * debugger/DebuggerCallFrame.h:
      * heap/AllocationSpace.h:
      * heap/HandleHeap.h:
      * heap/Heap.h:
      * heap/MachineStackMarker.h:
      * heap/MarkStack.h:
      * heap/VTableSpectrum.h:
      * heap/WriteBarrierSupport.h:
      * parser/Nodes.h:
      * parser/ParserArena.h:
      * profiler/Profile.h:
      * runtime/ArgList.h:
      * runtime/CallData.h:
      * runtime/Completion.h:
      * runtime/ConstructData.h:
      * runtime/DateInstance.h:
      * runtime/Error.h:
      * runtime/ExceptionHelpers.h:
      * runtime/FunctionConstructor.h:
      * runtime/Identifier.h:
      * runtime/InitializeThreading.h:
      * runtime/InternalFunction.h:
      * runtime/JSArray.h:
      * runtime/JSByteArray.h:
      * runtime/JSCell.h:
      * runtime/JSFunction.h:
      * runtime/JSGlobalData.cpp:
      * runtime/JSGlobalData.h:
      * runtime/JSGlobalObject.h:
      * runtime/JSGlobalThis.h:
      * runtime/JSLock.h:
      * runtime/JSObject.h:
      * runtime/JSString.h:
      * runtime/JSValue.h:
      * runtime/JSVariableObject.h:
      * runtime/Lookup.h:
      * runtime/MemoryStatistics.h:
      * runtime/ObjectPrototype.h:
      * runtime/Options.h:
      * runtime/PropertyDescriptor.h:
      * runtime/PropertyNameArray.h:
      * runtime/PropertySlot.h:
      * runtime/RegExp.h:
      * runtime/RegExpObject.h:
      * runtime/SamplingCounter.h:
      * runtime/SmallStrings.h:
      * runtime/StringObject.h:
      * runtime/Structure.h:
      * runtime/TimeoutChecker.h:
      * runtime/UString.h:
      * runtime/WriteBarrier.h:
      * wtf/ArrayBufferView.h:
      * wtf/ByteArray.h:
      * wtf/CryptographicallyRandomNumber.h:
      * wtf/CurrentTime.h:
      * wtf/DateMath.h:
      * wtf/DecimalNumber.h:
      * wtf/FastMalloc.cpp:
      * wtf/FastMalloc.h:
      * wtf/MD5.h:
      * wtf/MainThread.h:
      * wtf/MetaAllocator.h:
      * wtf/MetaAllocatorHandle.h:
      * wtf/OSAllocator.h:
      * wtf/PageBlock.h:
      * wtf/RandomNumber.h:
      * wtf/RefCountedLeakCounter.h:
      * wtf/SHA1.h:
      * wtf/Threading.cpp:
      * wtf/Threading.h:
      * wtf/ThreadingPrimitives.h:
      * wtf/WTFThreadData.h:
      * wtf/dtoa.h:
      * wtf/text/AtomicString.h:
      * wtf/text/CString.h:
      * wtf/text/StringBuilder.h:
      * wtf/text/StringImpl.h:
      * wtf/text/WTFString.h:
      * wtf/unicode/Collator.h:
      * wtf/unicode/UTF8.h:
      * yarr/Yarr.h:
      * yarr/YarrPattern.h:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104900 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      f0dd2d91
  34. 12 Jan, 2012 1 commit
  35. 19 Dec, 2011 1 commit
    • ggaren@apple.com's avatar
      Placement new does an unnecessary NULL check · 215589e0
      ggaren@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=74676
      
      Reviewed by Sam Weinig.
      
      Source/JavaScriptCore: 
      
      We can define our own version, which skips the NULL check.
              
      Not a measurable speedup, but code inspection shows better code generated,
      and I believe this is a step toward turning off -fomit-frame-pointer.
      
      * API/JSCallbackConstructor.h:
      (JSC::JSCallbackConstructor::create):
      * API/JSCallbackFunction.h:
      (JSC::JSCallbackFunction::create): Use the NotNull version of placement
      new to skip the NULL check.
      
      * API/JSCallbackObject.h: Removed a conflicting, unnecessaray placement new.
      
      (JSC::JSCallbackObject::create):
      * debugger/DebuggerActivation.h:
      (JSC::DebuggerActivation::create):
      * heap/HandleHeap.cpp:
      (JSC::HandleHeap::grow):
      * heap/HandleHeap.h:
      (JSC::HandleHeap::allocate):
      * heap/MarkedBlock.cpp:
      (JSC::MarkedBlock::create):
      (JSC::MarkedBlock::recycle):
      * jit/JITCode.h:
      (JSC::JITCode::clear):
      * jsc.cpp:
      (GlobalObject::create):
      * profiler/CallIdentifier.h:
      * runtime/Arguments.h:
      (JSC::Arguments::create):
      * runtime/ArrayConstructor.h:
      (JSC::ArrayConstructor::create):
      * runtime/ArrayPrototype.h:
      (JSC::ArrayPrototype::create):
      * runtime/BooleanConstructor.h:
      (JSC::BooleanConstructor::create):
      * runtime/BooleanObject.h:
      (JSC::BooleanObject::create):
      * runtime/BooleanPrototype.h:
      (JSC::BooleanPrototype::create):
      * runtime/DateConstructor.h:
      (JSC::DateConstructor::create):
      * runtime/DateInstance.h:
      (JSC::DateInstance::create):
      * runtime/DatePrototype.h:
      (JSC::DatePrototype::create):
      * runtime/Error.h:
      (JSC::StrictModeTypeErrorFunction::create):
      * runtime/ErrorConstructor.h:
      (JSC::ErrorConstructor::create):
      * runtime/ErrorInstance.h:
      (JSC::ErrorInstance::create):
      * runtime/ErrorPrototype.h:
      (JSC::ErrorPrototype::create):
      * runtime/ExceptionHelpers.h:
      (JSC::InterruptedExecutionError::create):
      (JSC::TerminatedExecutionError::create):
      * runtime/Executable.h:
      (JSC::NativeExecutable::create):
      (JSC::EvalExecutable::create):
      (JSC::ProgramExecutable::create):
      (JSC::FunctionExecutable::create):
      * runtime/FunctionConstructor.h:
      (JSC::FunctionConstructor::create):
      * runtime/FunctionPrototype.h:
      (JSC::FunctionPrototype::create):
      * runtime/GetterSetter.h:
      (JSC::GetterSetter::create):
      * runtime/JSAPIValueWrapper.h:
      (JSC::JSAPIValueWrapper::create):
      * runtime/JSActivation.h:
      (JSC::JSActivation::create):
      * runtime/JSArray.h:
      (JSC::JSArray::create):
      * runtime/JSBoundFunction.cpp:
      (JSC::JSBoundFunction::create):
      * runtime/JSByteArray.h:
      (JSC::JSByteArray::create): Use the NotNull version of placement
      new to skip the NULL check.
      
      * runtime/JSCell.h: Removed a conflicting, unnecessaray placement new.
      
      * runtime/JSFunction.cpp:
      (JSC::JSFunction::create):
      * runtime/JSFunction.h:
      (JSC::JSFunction::create):
      * runtime/JSGlobalObject.h:
      (JSC::JSGlobalObject::create):
      * runtime/JSGlobalThis.h:
      (JSC::JSGlobalThis::create):
      * runtime/JSNotAnObject.h:
      (JSC::JSNotAnObject::create):
      * runtime/JSONObject.h:
      (JSC::JSONObject::create):
      * runtime/JSObject.h:
      (JSC::JSFinalObject::create):
      * runtime/JSPropertyNameIterator.cpp:
      (JSC::JSPropertyNameIterator::create):
      * runtime/JSPropertyNameIterator.h:
      (JSC::JSPropertyNameIterator::create):
      * runtime/JSStaticScopeObject.h:
      (JSC::JSStaticScopeObject::create):
      * runtime/JSString.cpp:
      (JSC::StringObject::create):
      * runtime/JSString.h:
      (JSC::RopeBuilder::createNull):
      (JSC::RopeBuilder::create):
      (JSC::RopeBuilder::createHasOtherOwner):
      * runtime/MathObject.h:
      (JSC::MathObject::create):
      * runtime/NativeErrorConstructor.h:
      (JSC::NativeErrorConstructor::create):
      * runtime/NativeErrorPrototype.h:
      (JSC::NativeErrorPrototype::create):
      * runtime/NumberConstructor.h:
      (JSC::NumberConstructor::create):
      * runtime/NumberObject.h:
      (JSC::NumberObject::create):
      * runtime/NumberPrototype.h:
      (JSC::NumberPrototype::create):
      * runtime/ObjectConstructor.h:
      (JSC::ObjectConstructor::create):
      * runtime/ObjectPrototype.h:
      (JSC::ObjectPrototype::create):
      * runtime/RegExp.cpp:
      (JSC::RegExp::createWithoutCaching):
      * runtime/RegExpConstructor.h:
      (JSC::RegExpConstructor::create):
      * runtime/RegExpMatchesArray.h:
      (JSC::RegExpMatchesArray::create):
      * runtime/RegExpObject.h:
      (JSC::RegExpObject::create):
      * runtime/RegExpPrototype.h:
      (JSC::RegExpPrototype::create):
      * runtime/ScopeChain.h:
      (JSC::ScopeChainNode::create):
      * runtime/StrictEvalActivation.h:
      (JSC::StrictEvalActivation::create):
      * runtime/StringConstructor.h:
      (JSC::StringConstructor::create):
      * runtime/StringObject.h:
      (JSC::StringObject::create):
      * runtime/StringPrototype.h:
      (JSC::StringPrototype::create):
      * runtime/Structure.h:
      (JSC::Structure::create):
      (JSC::Structure::createStructure):
      * runtime/StructureChain.h:
      (JSC::StructureChain::create):
      * testRegExp.cpp:
      (GlobalObject::create):
      * wtf/BitVector.cpp:
      (WTF::BitVector::OutOfLineBits::create): Use the NotNull version of placement
      new to skip the NULL check.
      
      * wtf/BumpPointerAllocator.h:
      (WTF::BumpPointerPool::create): Standardized spacing to make grep easier.
      
      * wtf/ByteArray.cpp:
      (WTF::ByteArray::create):
      * wtf/Deque.h:
      (WTF::::append):
      (WTF::::prepend): Use NotNull, as above.
      
      * wtf/FastAllocBase.h: Added a placement new, since this class would otherwise
      hide the name of the global placement new.
      
      (WTF::fastNew): Standardized spacing. Most of these functions don't need
      NotNull, since they check for NULL, and the optimizer can see that.
      
      * wtf/HashTable.h:
      * wtf/HashTraits.h:
      (WTF::SimpleClassHashTraits::constructDeletedValue):
      * wtf/MetaAllocator.cpp:
      (WTF::MetaAllocator::allocFreeSpaceNode): NotNull, as above.
      
      * wtf/StdLibExtras.h:
      (throw): This is our NotNull placement new. Declaring that we throw is
      the C++ way to say that operator new will not return NULL.
      
      * wtf/ThreadSpecific.h:
      (WTF::T):
      * wtf/Vector.h:
      (WTF::::append):
      (WTF::::tryAppend):
      (WTF::::uncheckedAppend):
      (WTF::::insert):
      * wtf/text/AtomicStringHash.h:
      * wtf/text/StringImpl.cpp:
      (WTF::StringImpl::createUninitialized):
      (WTF::StringImpl::reallocate):
      * wtf/text/StringImpl.h:
      (WTF::StringImpl::tryCreateUninitialized):
      * wtf/text/StringStatics.cpp:
      (WTF::AtomicString::init): Use NotNull, as above.
      
      * yarr/YarrInterpreter.cpp:
      (JSC::Yarr::Interpreter::allocDisjunctionContext):
      (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
      (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext): Standardized
      spacing for easy grep.
      
      Source/WebCore: 
      
      * bindings/js/JSImageConstructor.h:
      (WebCore::JSImageConstructor::create):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader):
      (GenerateConstructorDeclaration):
      * bridge/c/CRuntimeObject.h:
      (JSC::Bindings::CRuntimeObject::create):
      * bridge/c/c_instance.cpp:
      (JSC::Bindings::CRuntimeMethod::create):
      * bridge/jni/jsc/JavaInstanceJSC.cpp:
      (JavaRuntimeMethod::create):
      * bridge/jni/jsc/JavaRuntimeObject.h:
      (JSC::Bindings::JavaRuntimeObject::create):
      * bridge/objc/ObjCRuntimeObject.h:
      (JSC::Bindings::ObjCRuntimeObject::create):
      * bridge/objc/objc_instance.mm:
      (ObjCRuntimeMethod::create):
      * bridge/objc/objc_runtime.h:
      (JSC::Bindings::ObjcFallbackObjectImp::create):
      * bridge/runtime_array.h:
      (JSC::RuntimeArray::create):
      * bridge/runtime_method.h:
      (JSC::RuntimeMethod::create):
      * bridge/runtime_object.h:
      (JSC::Bindings::RuntimeObject::create):
      * dom/Document.h:
      (WebCore::FormElementKeyHashTraits::constructDeletedValue): Use NotNull
      placement new, as in JavaScriptCore.
      
      * platform/PODArena.h:
      (WebCore::PODArena::allocateObject): No need to check for NULL explicitly,
      since that's the built-in behavior of placement new.
      
      * platform/graphics/FontCache.cpp:
      (WebCore::FontDataCacheKeyTraits::constructDeletedValue):
      * platform/graphics/IntRectHash.h:
      * platform/graphics/IntSizeHash.h: More NotNull.
      
      * rendering/RenderObject.h: Declaring that we throw is the C++ way to say
      that operator new will not return NULL.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      215589e0
  36. 16 Dec, 2011 1 commit
    • mhahnenberg@apple.com's avatar
      De-virtualize destructors · c58d54d7
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=74331
      
      Reviewed by Geoffrey Garen.
      
      .: 
      
      * Source/autotools/symbols.filter: Removed symbol no longer present.
      
      Source/JavaScriptCore: 
      
      This is a megapatch which frees us from the chains of virtual destructors.
      
      In order to remove the virtual destructors, which are the last of the virtual 
      functions, from the JSCell hierarchy, we need to add the ClassInfo pointer to 
      the cell rather than to the structure because in order to be able to lazily call 
      the static destroy() functions that will replace the virtual destructors, we 
      need to be able to access the ClassInfo without the danger of the object's 
      Structure being collected before the object itself.
      
      After adding the ClassInfo to the cell, we can then begin to remove our use 
      of vptrs for optimizations within the JIT and the GC.  When we have removed 
      all of the stored vptrs from JSGlobalData, we can then also remove all of 
      the related VPtrStealingHack code.
      
      The replacement for virtual destructors will be to add a static destroy function 
      pointer to the MethodTable stored in ClassInfo.  Any subclass of JSCell that has 
      a non-trivial destructor will require its own static destroy function to static 
      call its corresponding destructor, which will now be non-virtual.  In future 
      patches we will slowly move away from destructors altogether as we make more and 
      more objects backed by GC memory rather than malloc-ed memory.  The GC will now 
      call the static destroy method rather than the virtual destructor.
      
      As we go through the hierarchy and add static destroy functions to classes, 
      we will also add a new assert, ASSERT_HAS_TRIVIAL_DESTRUCTOR, to those classes 
      to which it applies.  The future goal is to eventually have every class have that assert.
      
      * API/JSCallbackConstructor.cpp:
      (JSC::JSCallbackConstructor::destroy): Add a destroy function to statically call 
      ~JSCallbackConstructor because it has some extra destruction logic.
      * API/JSCallbackConstructor.h:
      * API/JSCallbackFunction.cpp: Add trivial destructor assert for JSCallbackFunction.
      * API/JSCallbackObject.cpp: Add a destroy function to statically call ~JSCallbackObject 
      because it has a member OwnPtr that needs destruction.
      (JSC::::destroy):
      * API/JSCallbackObject.h:
      * JavaScriptCore.exp: Add/remove necessary symbols for JSC.
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Same for Windows symbols.
      * debugger/DebuggerActivation.cpp: DebuggerActivation, for some strange reason, didn't 
      have its own ClassInfo despite the fact that it overrides a number of MethodTable 
      methods.  Added the ClassInfo, along with an assertion that its destructor is trivial.
      * debugger/DebuggerActivation.h:
      * dfg/DFGOperations.cpp: Remove global data first argument to isJSArray, isJSByteArray, 
      isJSString, as it is no longer necessary.
      (JSC::DFG::putByVal):
      * dfg/DFGRepatch.cpp:  Ditto.  Also remove uses of jsArrayVPtr in favor of using the 
      JSArray ClassInfo pointer.
      (JSC::DFG::tryCacheGetByID):
      * dfg/DFGSpeculativeJIT.cpp:  Replace uses of the old vptrs with new ClassInfo 
      comparisons since we don't have vptrs anymore.
      (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
      (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
      (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
      (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
      (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
      (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
      (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
      (JSC::DFG::SpeculativeJIT::compare):
      (JSC::DFG::SpeculativeJIT::compileStrictEq):
      (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
      * dfg/DFGSpeculativeJIT.h: Ditto.
      (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
      * dfg/DFGSpeculativeJIT32_64.cpp: Ditto.
      (JSC::DFG::SpeculativeJIT::compileObjectEquality):
      (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
      (JSC::DFG::SpeculativeJIT::compileLogicalNot):
      (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
      (JSC::DFG::SpeculativeJIT::emitBranch):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp: Ditto.
      (JSC::DFG::SpeculativeJIT::compileObjectEquality):
      (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
      (JSC::DFG::SpeculativeJIT::compileLogicalNot):
      (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
      (JSC::DFG::SpeculativeJIT::emitBranch):
      (JSC::DFG::SpeculativeJIT::compile):
      * heap/Heap.cpp: Remove all uses of vptrs in GC optimizations and replace them with 
      ClassInfo comparisons.
      (JSC::Heap::Heap):
      * heap/MarkStack.cpp: Ditto.
      (JSC::MarkStackThreadSharedData::markingThreadMain):
      (JSC::visitChildren):
      (JSC::SlotVisitor::drain):
      * heap/MarkStack.h: Ditto.
      (JSC::MarkStack::MarkStack):
      * heap/MarkedBlock.cpp: Ditto.
      (JSC::MarkedBlock::callDestructor):
      (JSC::MarkedBlock::specializedSweep):
      * heap/MarkedBlock.h: Ditto.
      * heap/SlotVisitor.h: Ditto.
      (JSC::SlotVisitor::SlotVisitor):
      * heap/VTableSpectrum.cpp: Now that we don't have vptrs, we can't count them.  
      We'll have to rename this class and make it use ClassInfo ptrs in a future patch.
      (JSC::VTableSpectrum::count):
      * interpreter/Interpreter.cpp: Remove all global data arguments from isJSArray, 
      etc. functions.
      (JSC::loadVarargs):
      (JSC::Interpreter::tryCacheGetByID):
      (JSC::Interpreter::privateExecute):
      * jit/JIT.h: Remove vptr argument from emitAllocateBasicJSObject 
      * jit/JITInlineMethods.h: Remove vptr planting, and add ClassInfo planting, 
      remove all vtable related code.
      (JSC::JIT::emitLoadCharacterString):
      (JSC::JIT::emitAllocateBasicJSObject):
      (JSC::JIT::emitAllocateJSFinalObject):
      (JSC::JIT::emitAllocateJSFunction):
      * jit/JITOpcodes.cpp: Replace vptr related branch code with corresponding ClassInfo.
      (JSC::JIT::privateCompileCTIMachineTrampolines):
      (JSC::JIT::emit_op_to_primitive):
      (JSC::JIT::emit_op_convert_this):
      * jit/JITOpcodes32_64.cpp: Ditto.
      (JSC::JIT::privateCompileCTIMachineTrampolines):
      (JSC::JIT::emit_op_to_primitive):
      (JSC::JIT::emitSlow_op_eq):
      (JSC::JIT::emitSlow_op_neq):
      (JSC::JIT::compileOpStrictEq):
      (JSC::JIT::emit_op_convert_this):
      * jit/JITPropertyAccess.cpp: Ditto.
      (JSC::JIT::stringGetByValStubGenerator):
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::emitSlow_op_get_by_val):
      (JSC::JIT::emit_op_put_by_val):
      (JSC::JIT::privateCompilePutByIdTransition):
      (JSC::JIT::privateCompilePatchGetArrayLength):
      * jit/JITPropertyAccess32_64.cpp: Ditto.
      (JSC::JIT::stringGetByValStubGenerator):
      (JSC::JIT::emit_op_get_by_val):
      (JSC::JIT::emitSlow_op_get_by_val):
      (JSC::JIT::emit_op_put_by_val):
      (JSC::JIT::privateCompilePatchGetArrayLength):
      * jit/JITStubs.cpp: Remove global data argument from isJSString, etc.
      (JSC::JITThunks::tryCacheGetByID):
      (JSC::DEFINE_STUB_FUNCTION):
      * jit/SpecializedThunkJIT.h: Replace vptr related stuff with ClassInfo stuff.
      (JSC::SpecializedThunkJIT::loadJSStringArgument):
      * runtime/ArrayConstructor.cpp: Add trivial destructor assert.
      * runtime/ArrayPrototype.cpp: Remove global data argument from isJSArray.
      (JSC::arrayProtoFuncToString):
      (JSC::arrayProtoFuncJoin):
      (JSC::arrayProtoFuncPop):
      (JSC::arrayProtoFuncPush):
      (JSC::arrayProtoFuncShift):
      (JSC::arrayProtoFuncSplice):
      (JSC::arrayProtoFuncUnShift):
      (JSC::arrayProtoFuncFilter):
      (JSC::arrayProtoFuncMap):
      (JSC::arrayProtoFuncEvery):
      (JSC::arrayProtoFuncForEach):
      (JSC::arrayProtoFuncSome):
      (JSC::arrayProtoFuncReduce):
      (JSC::arrayProtoFuncReduceRight):
      * runtime/BooleanConstructor.cpp: Add trivial destructor assert.
      * runtime/BooleanObject.cpp: Ditto.
      * runtime/BooleanPrototype.cpp: Ditto.
      * runtime/ClassInfo.h: Add destroy function pointer to MethodTable.
      * runtime/DateConstructor.cpp: Add trivial destructor assert.
      * runtime/DateInstance.cpp: Add destroy function for DateInstance because it has a RefPtr 
      that needs destruction.
      (JSC::DateInstance::destroy):
      * runtime/DateInstance.h:
      * runtime/Error.cpp: Ditto (because of UString member).
      (JSC::StrictModeTypeErrorFunction::destroy):
      * runtime/Error.h:
      * runtime/ErrorConstructor.cpp: Add trivial destructor assert.
      * runtime/ErrorInstance.cpp: Ditto.
      * runtime/ExceptionHelpers.cpp: Ditto.
      * runtime/Executable.cpp: Add destroy functions for ExecutableBase and subclasses.
      (JSC::ExecutableBase::destroy):
      (JSC::NativeExecutable::destroy):
      (JSC::ScriptExecutable::destroy):
      (JSC::EvalExecutable::destroy):
      (JSC::ProgramExecutable::destroy):
      (JSC::FunctionExecutable::destroy):
      * runtime/Executable.h:
      * runtime/FunctionConstructor.cpp: Add trivial destructor assert.
      * runtime/FunctionPrototype.cpp: Ditto. Also remove global data first arg from isJSArray.
      (JSC::functionProtoFuncApply):
      * runtime/GetterSetter.cpp: Ditto.
      * runtime/InitializeThreading.cpp: Remove call to JSGlobalData::storeVPtrs since it no 
      longer exists.
      (JSC::initializeThreadingOnce):
      * runtime/InternalFunction.cpp: Remove vtableAnchor function, add trivial destructor assert, 
      remove first arg from isJSString.
      (JSC::InternalFunction::displayName):
      * runtime/InternalFunction.h: Remove VPtrStealingHack.
      * runtime/JSAPIValueWrapper.cpp: Add trivial destructor assert.
      * runtime/JSArray.cpp: Add static destroy to call ~JSArray.  Replace vptr checks in 
      destructor with ClassInfo checks.
      (JSC::JSArray::~JSArray):
      (JSC::JSArray::destroy):
      * runtime/JSArray.h: Remove VPtrStealingHack.  Remove globalData argument from isJSArray 
      and change them to check the ClassInfo rather than the vptrs.
      (JSC::isJSArray):
      * runtime/JSBoundFunction.cpp: Add trival destructor assert. Remove first arg from isJSArray.
      (JSC::boundFunctionCall):
      (JSC::boundFunctionConstruct):
      * runtime/JSByteArray.cpp: Add static destroy function, replace vptr checks with ClassInfo checks.
      (JSC::JSByteArray::~JSByteArray):
      (JSC::JSByteArray::destroy):
      * runtime/JSByteArray.h: Remove VPtrStealingHack code.
      (JSC::isJSByteArray):
      * runtime/JSCell.cpp: Add trivial destructor assert.  Add static destroy function.
      (JSC::JSCell::destroy):
      * runtime/JSCell.h: Remove VPtrStealingHack code.  Add function for returning the offset 
      of the ClassInfo pointer in the object for use by the JIT.  Add the ClassInfo pointer to 
      the JSCell itself, and grab it from the Structure.  Remove the vptr and setVPtr functions, 
      as they are no longer used.  Add a validatedClassInfo function to JSCell for any clients 
      that want to verify, while in Debug mode, that the ClassInfo contained in the cell is the 
      same one as that contained in the Structure.  This isn't used too often, because most of 
      the places where we compare the ClassInfo to things can be called during destruction.  
      Since the Structure is unreliable during the phase when destructors are being called, 
      we can't call validatedClassInfo.
      (JSC::JSCell::classInfoOffset):
      (JSC::JSCell::structure):
      (JSC::JSCell::classInfo):
      * runtime/JSFunction.cpp: Remove VPtrStealingHack code.  Add static destroy, remove vtableAnchor, 
      remove first arg from call to isJSString.
      (JSC::JSFunction::destroy):
      (JSC::JSFunction::displayName):
      * runtime/JSFunction.h: 
      * runtime/JSGlobalData.cpp: Remove all VPtr stealing code and storage, including storeVPtrs, 
      as these vptrs are no longer needed in the codebase.
      * runtime/JSGlobalData.h:
      (JSC::TypedArrayDescriptor::TypedArrayDescriptor): Changed the TypedArrayDescriptor to use 
      ClassInfo rather than the vptr.
      * runtime/JSGlobalObject.cpp: Add static destroy function.
      (JSC::JSGlobalObject::destroy):
      * runtime/JSGlobalObject.h:
      * runtime/JSGlobalThis.cpp: Add trivial destructor assert.
      * runtime/JSNotAnObject.cpp: Ditto.
      * runtime/JSONObject.cpp: Ditto. Remove first arg from isJSArray calls.
      (JSC::Stringifier::Holder::appendNextProperty):
      (JSC::Walker::walk):
      * runtime/JSObject.cpp: 
      (JSC::JSFinalObject::destroy):
      (JSC::JSNonFinalObject::destroy):
      (JSC::JSObject::destroy):
      * runtime/JSObject.h: Add trivial destructor assert for JSObject, remove vtableAnchor 
      from JSNonFinalObject and JSFinalObject, add static destroy for JSFinalObject and 
      JSNonFinalObject, add isJSFinalObject utility function similar to isJSArray, remove all VPtrStealingHack code.
      (JSC::JSObject::finishCreation):
      (JSC::JSNonFinalObject::finishCreation):
      (JSC::JSFinalObject::finishCreation):
      (JSC::isJSFinalObject):
      * runtime/JSPropertyNameIterator.cpp: Add static destroy.
      (JSC::JSPropertyNameIterator::destroy):
      * runtime/JSPropertyNameIterator.h:
      * runtime/JSStaticScopeObject.cpp: Ditto.
      (JSC::JSStaticScopeObject::destroy):
      * runtime/JSStaticScopeObject.h: Ditto. 
      * runtime/JSString.cpp:
      (JSC::JSString::destroy):
      * runtime/JSString.h: Ditto. Remove VPtrStealingHack code. Also remove fixupVPtr code, 
      since we no longer need to fixup vptrs.
      (JSC::jsSingleCharacterString):
      (JSC::jsSingleCharacterSubstring):
      (JSC::jsNontrivialString):
      (JSC::jsString):
      (JSC::jsSubstring8):
      (JSC::jsSubstring):
      (JSC::jsOwnedString):
      (JSC::jsStringBuilder):
      (JSC::isJSString):
      * runtime/JSVariableObject.cpp: 
      (JSC::JSVariableObject::destroy):
      * runtime/JSVariableObject.h: Ditto.
      * runtime/JSWrapperObject.cpp:
      * runtime/JSWrapperObject.h: Add trivial destructor assert.
      * runtime/MathObject.cpp: Ditto.
      * runtime/NativeErrorConstructor.cpp: Ditto.
      * runtime/NumberConstructor.cpp: Ditto.
      * runtime/NumberObject.cpp: Ditto.
      * runtime/NumberPrototype.cpp: Ditto.
      * runtime/ObjectConstructor.cpp: Ditto.
      * runtime/ObjectPrototype.cpp: Ditto.
      * runtime/Operations.h: Remove calls to fixupVPtr, remove first arg to isJSString.
      (JSC::jsString):
      (JSC::jsLess):
      (JSC::jsLessEq):
      * runtime/RegExp.cpp: Add static destroy.
      (JSC::RegExp::destroy):
      * runtime/RegExp.h:
      * runtime/RegExpConstructor.cpp: Add static destroy for RegExpConstructor and RegExpMatchesArray.
      (JSC::RegExpConstructor::destroy):
      (JSC::RegExpMatchesArray::destroy):
      * runtime/RegExpConstructor.h:
      * runtime/RegExpMatchesArray.h:
      * runtime/RegExpObject.cpp: Add static destroy.
      (JSC::RegExpObject::destroy):
      * runtime/RegExpObject.h:
      * runtime/ScopeChain.cpp: Add trivial destructor assert.
      * runtime/ScopeChain.h:
      * runtime/StrictEvalActivation.cpp: Ditto.
      * runtime/StringConstructor.cpp:
      * runtime/StringObject.cpp: Ditto. Remove vtableAnchor.
      * runtime/StringObject.h:
      * runtime/StringPrototype.cpp: Ditto.
      * runtime/Structure.cpp: Add static destroy.
      (JSC::Structure::destroy):
      * runtime/Structure.h: Move JSCell::finishCreation and JSCell constructor into Structure.h 
      because they need to have the full Structure type to access the ClassInfo to store in the JSCell.
      (JSC::JSCell::setStructure):
      (JSC::JSCell::validatedClassInfo):
      (JSC::JSCell::JSCell):
      (JSC::JSCell::finishCreation):
      * runtime/StructureChain.cpp: Add static destroy.
      (JSC::StructureChain::destroy):
      * runtime/StructureChain.h:
      * wtf/Assertions.h: Add new assertion ASSERT_HAS_TRIVIAL_DESTRUCTOR, which uses clangs 
      ability to tell us when a class has a trivial destructor. We will use this assert 
      more in future patches as we move toward having all JSC objects backed by GC memory, 
      which means moving away from using destructors/finalizers.
      
      Source/JavaScriptGlue: 
      
      * UserObjectImp.cpp: Add static destroy function.
      (UserObjectImp::destroy):
      * UserObjectImp.h:
      
      Source/WebCore: 
      
      No new tests.
      
      Doing everything here that was done to the JSCell hierarchy in JavaScriptCore. 
      See the ChangeLog for this commit for a more in-depth description.
      
      * WebCore.exp.in: Add/remove symbols.
      * bindings/js/JSCanvasRenderingContext2DCustom.cpp: Remove first arg from isJSArray call.
      (WebCore::JSCanvasRenderingContext2D::setWebkitLineDash):
      * bindings/js/JSDOMBinding.cpp: Add trival destructor assert for DOMConstructorObject 
      and DOMConstructorWithDocument.
      * bindings/js/JSDOMGlobalObject.cpp: Add static destroy.  Add implementation for 
      scriptExecutionContext that dispatches to different functions in subclasses 
      depending on our current ClassInfo.  We do this so that we can get rid of the 
      virtual-ness of scriptExecutionContext, because any virtual functions will throw 
      off the layout of the object and we'll crash at runtime.
      (WebCore::JSDOMGlobalObject::destroy):
      (WebCore::JSDOMGlobalObject::scriptExecutionContext):
      * bindings/js/JSDOMGlobalObject.h:
      * bindings/js/JSDOMWindowBase.cpp: Add static destroy.
      (WebCore::JSDOMWindowBase::destroy):
      * bindings/js/JSDOMWindowBase.h: De-virtualize scriptExecutionContext.
      * bindings/js/JSDOMWindowShell.cpp: Add static destroy.
      (WebCore::JSDOMWindowShell::destroy):
      * bindings/js/JSDOMWindowShell.h:
      * bindings/js/JSDOMWrapper.cpp: Add trivial destructor assert.
      * bindings/js/JSDOMWrapper.h: Add a ClassInfo to JSDOMWrapper since it now overrides 
      a MethodTable function. Remove vtableAnchor virtual function.
      * bindings/js/JSImageConstructor.cpp: Add trivial destructor assert.
      * bindings/js/JSNodeCustom.cpp: Change implementation of pushEventHandlerScope so that 
      it dispatches to the correct function depending on the 
      identity of the class as specified by the ClassInfo.  
      See JSDOMGlobalObject::scriptExecutionContext for explanation.
      (WebCore::JSNode::pushEventHandlerScope):
      * bindings/js/JSWebSocketCustom.cpp: Remove first arg to isJSArray call.
      (WebCore::JSWebSocketConstructor::constructJSWebSocket):
      * bindings/js/JSWorkerContextBase.cpp: Add static destroy.
      (WebCore::JSWorkerContextBase::destroy):
      * bindings/js/JSWorkerContextBase.h: 
      * bindings/js/ScriptValue.cpp: Remove first arg to isJSArray call.
      (WebCore::jsToInspectorValue): 
      * bindings/js/SerializedScriptValue.cpp: Ditto.
      (WebCore::CloneSerializer::isArray):
      (WebCore::CloneSerializer::getSparseIndex):
      * bindings/scripts/CodeGeneratorJS.pm:
      (GenerateHeader): Remove virtual-ness of any custom pushEventHandlerScope (see 
      JSNodeCustom::pushEventHandlerScope for explanation).  Remove virtual toBoolean 
      for anybody who masquerades as undefined, since our JSObject implementation handles 
      this based on the TypeInfo in the Structure. Add trivial destructor assert for any 
      class other than DOMWindow or WorkerContexts.
      (GenerateImplementation): Change ClassInfo definitions to use Base::s_info, since 
      typing the parent class more than once is duplication of information and increases 
      the likelihood of mistakes.  Pass ClassInfo to TypeArrayDescriptors instead of vptr. 
      (GenerateConstructorDefinition): Add trivial destructor assert for all generated constructors.
      * bridge/c/CRuntimeObject.cpp: Remove empty virtual destructor.
      * bridge/c/CRuntimeObject.h: 
      * bridge/jni/jsc/JavaRuntimeObject.cpp: Ditto.
      * bridge/jni/jsc/JavaRuntimeObject.h: 
      * bridge/objc/ObjCRuntimeObject.h: Ditto.
      * bridge/objc/ObjCRuntimeObject.mm:
      * bridge/objc/objc_runtime.h: Add static destroy for ObjcFallbackObjectImp. De-virtualize 
      toBoolean in the short term.  Need longer term fix.
      * bridge/objc/objc_runtime.mm:
      (JSC::Bindings::ObjcFallbackObjectImp::destroy):
      * bridge/qt/qt_runtime.cpp: Add static destroy to QtRuntimeMethod.
      (JSC::Bindings::QtRuntimeMethod::destroy):
      * bridge/qt/qt_runtime.h: De-virtualize ~QtRuntimeMethod.
      * bridge/runtime_array.cpp: De-virtualize destructor. Add static destroy.
      (JSC::RuntimeArray::destroy):
      * bridge/runtime_array.h:
      * bridge/runtime_method.cpp: Remove vtableAnchor. Add static destroy.
      (JSC::RuntimeMethod::destroy):
      * bridge/runtime_method.h:
      * bridge/runtime_object.cpp: Add static destroy.
      (JSC::Bindings::RuntimeObject::destroy):
      * bridge/runtime_object.h:
      
      Source/WebKit/mac: 
      
      * Plugins/Hosted/ProxyRuntimeObject.h: Remove empty virtual destructor.
      * Plugins/Hosted/ProxyRuntimeObject.mm:
      
      Source/WebKit2: 
      
      * WebProcess/Plugins/Netscape/JSNPMethod.cpp: Add trivial destructor assert.
      * WebProcess/Plugins/Netscape/JSNPObject.cpp: Add static destroy.
      (WebKit::JSNPObject::destroy):
      * WebProcess/Plugins/Netscape/JSNPObject.h:
      * win/WebKit2.def: Add/remove necessary symbols.
      * win/WebKit2CFLite.def: Ditto.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103083 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c58d54d7