1. 26 Sep, 2013 3 commits
    • commit-queue@webkit.org's avatar
      Unreviewed, rolling out r156474. · bf43ed96
      commit-queue@webkit.org authored
      http://trac.webkit.org/changeset/156474
      https://bugs.webkit.org/show_bug.cgi?id=121966
      
      Broke the builds. (Requested by xenon on #webkit).
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::registerName):
      (JSC::CodeBlock::dumpBytecode):
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::createActivation):
      (JSC::CodeBlock::nameForRegister):
      * bytecode/CodeBlock.h:
      (JSC::unmodifiedArgumentsRegister):
      (JSC::CodeBlock::isKnownNotImmediate):
      (JSC::CodeBlock::setThisRegister):
      (JSC::CodeBlock::thisRegister):
      (JSC::CodeBlock::setArgumentsRegister):
      (JSC::CodeBlock::argumentsRegister):
      (JSC::CodeBlock::uncheckedArgumentsRegister):
      (JSC::CodeBlock::setActivationRegister):
      (JSC::CodeBlock::activationRegister):
      (JSC::CodeBlock::uncheckedActivationRegister):
      (JSC::CodeBlock::usesArguments):
      (JSC::CodeBlock::isCaptured):
      * bytecode/Instruction.h:
      * bytecode/LazyOperandValueProfile.h:
      (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
      (JSC::LazyOperandValueProfileKey::operator!):
      (JSC::LazyOperandValueProfileKey::hash):
      (JSC::LazyOperandValueProfileKey::operand):
      (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
      (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
      * bytecode/MethodOfGettingAValueProfile.cpp:
      (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
      (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
      * bytecode/Operands.h:
      (JSC::localToOperand):
      (JSC::operandIsLocal):
      (JSC::operandToLocal):
      (JSC::operandIsArgument):
      (JSC::operandToArgument):
      (JSC::argumentToOperand):
      (JSC::Operands::operand):
      (JSC::Operands::hasOperand):
      (JSC::Operands::setOperand):
      (JSC::Operands::operandForIndex):
      (JSC::Operands::setOperandFirstTime):
      * bytecode/UnlinkedCodeBlock.cpp:
      (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
      * bytecode/UnlinkedCodeBlock.h:
      (JSC::UnlinkedCodeBlock::setThisRegister):
      (JSC::UnlinkedCodeBlock::setActivationRegister):
      (JSC::UnlinkedCodeBlock::setArgumentsRegister):
      (JSC::UnlinkedCodeBlock::usesArguments):
      (JSC::UnlinkedCodeBlock::argumentsRegister):
      (JSC::UnlinkedCodeBlock::usesGlobalObject):
      (JSC::UnlinkedCodeBlock::setGlobalObjectRegister):
      (JSC::UnlinkedCodeBlock::globalObjectRegister):
      (JSC::UnlinkedCodeBlock::thisRegister):
      (JSC::UnlinkedCodeBlock::activationRegister):
      * bytecode/ValueRecovery.h:
      (JSC::ValueRecovery::displacedInJSStack):
      (JSC::ValueRecovery::virtualRegister):
      (JSC::ValueRecovery::dumpInContext):
      * bytecode/VirtualRegister.h:
      (WTF::printInternal):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::generate):
      (JSC::BytecodeGenerator::addVar):
      (JSC::BytecodeGenerator::BytecodeGenerator):
      (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
      (JSC::BytecodeGenerator::newRegister):
      (JSC::BytecodeGenerator::emitLoadGlobalObject):
      (JSC::BytecodeGenerator::emitGetArgumentsLength):
      (JSC::BytecodeGenerator::emitGetArgumentByVal):
      (JSC::BytecodeGenerator::createArgumentsIfNecessary):
      (JSC::BytecodeGenerator::emitReturn):
      * bytecompiler/BytecodeGenerator.h:
      (JSC::BytecodeGenerator::registerFor):
      * bytecompiler/RegisterID.h:
      (JSC::RegisterID::RegisterID):
      (JSC::RegisterID::setIndex):
      (JSC::RegisterID::index):
      * debugger/DebuggerCallFrame.cpp:
      (JSC::DebuggerCallFrame::thisObject):
      * dfg/DFGAbstractHeap.h:
      (JSC::DFG::AbstractHeap::Payload::Payload):
      * dfg/DFGAbstractInterpreterInlines.h:
      (JSC::DFG::::executeEffects):
      (JSC::DFG::::clobberCapturedVars):
      * dfg/DFGArgumentPosition.h:
      (JSC::DFG::ArgumentPosition::dump):
      * dfg/DFGArgumentsSimplificationPhase.cpp:
      (JSC::DFG::ArgumentsSimplificationPhase::run):
      (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
      (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::newVariableAccessData):
      (JSC::DFG::ByteCodeParser::getDirect):
      (JSC::DFG::ByteCodeParser::get):
      (JSC::DFG::ByteCodeParser::setDirect):
      (JSC::DFG::ByteCodeParser::set):
      (JSC::DFG::ByteCodeParser::getLocal):
      (JSC::DFG::ByteCodeParser::setLocal):
      (JSC::DFG::ByteCodeParser::getArgument):
      (JSC::DFG::ByteCodeParser::setArgument):
      (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
      (JSC::DFG::ByteCodeParser::findArgumentPosition):
      (JSC::DFG::ByteCodeParser::flush):
      (JSC::DFG::ByteCodeParser::flushDirect):
      (JSC::DFG::ByteCodeParser::getToInt32):
      (JSC::DFG::ByteCodeParser::getThis):
      (JSC::DFG::ByteCodeParser::addCall):
      (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
      (JSC::DFG::ByteCodeParser::handleCall):
      (JSC::DFG::ByteCodeParser::emitFunctionChecks):
      (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
      (JSC::DFG::ByteCodeParser::handleInlining):
      (JSC::DFG::ByteCodeParser::handleMinMax):
      (JSC::DFG::ByteCodeParser::handleIntrinsic):
      (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
      (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
      (JSC::DFG::ByteCodeParser::handleGetByOffset):
      (JSC::DFG::ByteCodeParser::handleGetById):
      (JSC::DFG::ByteCodeParser::parseBlock):
      (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
      (JSC::DFG::ByteCodeParser::parse):
      * dfg/DFGCFGSimplificationPhase.cpp:
      * dfg/DFGCPSRethreadingPhase.cpp:
      (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
      (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
      (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
      * dfg/DFGCapabilities.cpp:
      (JSC::DFG::capabilityLevel):
      * dfg/DFGConstantFoldingPhase.cpp:
      (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
      * dfg/DFGFlushLivenessAnalysisPhase.cpp:
      (JSC::DFG::FlushLivenessAnalysisPhase::setForNode):
      * dfg/DFGGraph.cpp:
      (JSC::DFG::Graph::dump):
      * dfg/DFGGraph.h:
      (JSC::DFG::Graph::argumentsRegisterFor):
      (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
      (JSC::DFG::Graph::uncheckedActivationRegisterFor):
      (JSC::DFG::Graph::valueProfileFor):
      * dfg/DFGJITCode.cpp:
      (JSC::DFG::JITCode::reconstruct):
      * dfg/DFGNode.h:
      (JSC::DFG::Node::Node):
      (JSC::DFG::Node::convertToGetLocalUnlinked):
      (JSC::DFG::Node::hasVirtualRegister):
      (JSC::DFG::Node::virtualRegister):
      (JSC::DFG::Node::setVirtualRegister):
      * dfg/DFGOSREntry.cpp:
      (JSC::DFG::prepareOSREntry):
      * dfg/DFGOSREntrypointCreationPhase.cpp:
      (JSC::DFG::OSREntrypointCreationPhase::run):
      * dfg/DFGOSRExit.h:
      * dfg/DFGOSRExitCompiler32_64.cpp:
      (JSC::DFG::OSRExitCompiler::compileExit):
      * dfg/DFGOSRExitCompiler64.cpp:
      (JSC::DFG::OSRExitCompiler::compileExit):
      * dfg/DFGRegisterBank.h:
      (JSC::DFG::RegisterBank::tryAllocate):
      (JSC::DFG::RegisterBank::allocateSpecific):
      (JSC::DFG::RegisterBank::retain):
      (JSC::DFG::RegisterBank::isInUse):
      (JSC::DFG::RegisterBank::dump):
      (JSC::DFG::RegisterBank::releaseAtIndex):
      (JSC::DFG::RegisterBank::allocateInternal):
      (JSC::DFG::RegisterBank::MapEntry::MapEntry):
      * dfg/DFGScoreBoard.h:
      (JSC::DFG::ScoreBoard::allocate):
      (JSC::DFG::ScoreBoard::use):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
      (JSC::DFG::SpeculativeJIT::checkConsistency):
      (JSC::DFG::SpeculativeJIT::compileMovHint):
      (JSC::DFG::SpeculativeJIT::compileInlineStart):
      (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::allocate):
      (JSC::DFG::SpeculativeJIT::fprAllocate):
      (JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
      (JSC::DFG::SpeculativeJIT::flushRegisters):
      (JSC::DFG::SpeculativeJIT::isFlushed):
      (JSC::DFG::SpeculativeJIT::argumentSlot):
      (JSC::DFG::SpeculativeJIT::argumentTagSlot):
      (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
      (JSC::DFG::SpeculativeJIT::valueSourceForOperand):
      (JSC::DFG::SpeculativeJIT::setNodeForOperand):
      (JSC::DFG::SpeculativeJIT::valueSourceReferenceForOperand):
      (JSC::DFG::SpeculativeJIT::recordSetLocal):
      (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
      (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGValidate.cpp:
      (JSC::DFG::Validate::validate):
      (JSC::DFG::Validate::validateCPS):
      (JSC::DFG::Validate::checkOperand):
      (JSC::DFG::Validate::reportValidationContext):
      * dfg/DFGValueRecoveryOverride.h:
      (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
      * dfg/DFGVariableAccessData.h:
      (JSC::DFG::VariableAccessData::operand):
      (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
      (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
      (JSC::DFG::VariableAccessData::flushFormat):
      * dfg/DFGVariableEvent.h:
      (JSC::DFG::VariableEvent::spill):
      (JSC::DFG::VariableEvent::setLocal):
      * dfg/DFGVariableEventStream.cpp:
      (JSC::DFG::VariableEventStream::reconstruct):
      * dfg/DFGVirtualRegisterAllocationPhase.cpp:
      (JSC::DFG::VirtualRegisterAllocationPhase::run):
      * ftl/FTLExitArgumentForOperand.h:
      (JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
      (JSC::FTL::ExitArgumentForOperand::operand):
      * ftl/FTLLink.cpp:
      (JSC::FTL::link):
      * ftl/FTLLowerDFGToLLVM.cpp:
      (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
      (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
      (JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
      (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
      (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
      (JSC::FTL::LowerDFGToLLVM::observeMovHint):
      (JSC::FTL::LowerDFGToLLVM::addressFor):
      (JSC::FTL::LowerDFGToLLVM::payloadFor):
      (JSC::FTL::LowerDFGToLLVM::tagFor):
      * ftl/FTLOSREntry.cpp:
      (JSC::FTL::prepareOSREntry):
      * ftl/FTLOSRExit.cpp:
      (JSC::FTL::OSRExit::convertToForward):
      * ftl/FTLOSRExit.h:
      * ftl/FTLOSRExitCompiler.cpp:
      (JSC::FTL::compileStub):
      * interpreter/CallFrame.h:
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::dumpRegisters):
      (JSC::unwindCallFrame):
      (JSC::Interpreter::unwind):
      * jit/AssemblyHelpers.h:
      (JSC::AssemblyHelpers::addressFor):
      (JSC::AssemblyHelpers::tagFor):
      (JSC::AssemblyHelpers::payloadFor):
      (JSC::AssemblyHelpers::argumentsRegisterFor):
      * jit/JIT.h:
      * jit/JITCall.cpp:
      (JSC::JIT::compileLoadVarargs):
      * jit/JITInlines.h:
      (JSC::JIT::emitGetVirtualRegister):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_tear_off_arguments):
      (JSC::JIT::emit_op_get_pnames):
      (JSC::JIT::emit_op_enter):
      (JSC::JIT::emit_op_create_arguments):
      (JSC::JIT::emitSlow_op_get_argument_by_val):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_enter):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * profiler/ProfilerBytecodeSequence.cpp:
      (JSC::Profiler::BytecodeSequence::BytecodeSequence):
      * runtime/CommonSlowPaths.cpp:
      (JSC::SLOW_PATH_DECL):
      * runtime/JSActivation.cpp:
      (JSC::JSActivation::argumentsGetter):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      bf43ed96
    • msaboff@apple.com's avatar
      VirtualRegister should be a class · 1796ad0f
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121732
      
      Reviewed by Geoffrey Garen.
      
      This is a refactoring change.  Changed VirtualRegister from an enum to a class.
      Moved Operands::operandIsArgument(), operandToArgument(), argumentToOperand()
      and the similar functions for locals to VirtualRegister class.
      
      This is in preparation for changing the offset for the first local register from
      0 to -1.  This is needed since most native calling conventions have the architected
      frame pointer (e.g. %rbp for X86) point at the slot that stores the previous frame
      pointer.  Local values start below that address.
      
      * bytecode/CodeBlock.cpp:
      * bytecode/CodeBlock.h:
      * bytecode/Instruction.h:
      * bytecode/LazyOperandValueProfile.h:
      * bytecode/MethodOfGettingAValueProfile.cpp:
      * bytecode/Operands.h:
      * bytecode/UnlinkedCodeBlock.cpp:
      * bytecode/UnlinkedCodeBlock.h:
      * bytecode/ValueRecovery.h:
      * bytecode/VirtualRegister.h:
      * bytecompiler/BytecodeGenerator.cpp:
      * bytecompiler/BytecodeGenerator.h:
      * bytecompiler/RegisterID.h:
      * debugger/DebuggerCallFrame.cpp:
      * dfg/DFGAbstractHeap.h:
      * dfg/DFGAbstractInterpreterInlines.h:
      * dfg/DFGArgumentPosition.h:
      * dfg/DFGArgumentsSimplificationPhase.cpp:
      * dfg/DFGByteCodeParser.cpp:
      * dfg/DFGCFGSimplificationPhase.cpp:
      * dfg/DFGCPSRethreadingPhase.cpp:
      * dfg/DFGCapabilities.cpp:
      * dfg/DFGConstantFoldingPhase.cpp:
      * dfg/DFGFlushLivenessAnalysisPhase.cpp:
      * dfg/DFGGraph.cpp:
      * dfg/DFGGraph.h:
      * dfg/DFGJITCode.cpp:
      * dfg/DFGNode.h:
      * dfg/DFGOSREntry.cpp:
      * dfg/DFGOSREntrypointCreationPhase.cpp:
      * dfg/DFGOSRExit.h:
      * dfg/DFGOSRExitCompiler32_64.cpp:
      * dfg/DFGOSRExitCompiler64.cpp:
      * dfg/DFGRegisterBank.h:
      * dfg/DFGScoreBoard.h:
      * dfg/DFGSpeculativeJIT.cpp:
      * dfg/DFGSpeculativeJIT.h:
      * dfg/DFGSpeculativeJIT64.cpp:
      * dfg/DFGValidate.cpp:
      * dfg/DFGValueRecoveryOverride.h:
      * dfg/DFGVariableAccessData.h:
      * dfg/DFGVariableEvent.h:
      * dfg/DFGVariableEventStream.cpp:
      * dfg/DFGVirtualRegisterAllocationPhase.cpp:
      * ftl/FTLExitArgumentForOperand.h:
      * ftl/FTLLink.cpp:
      * ftl/FTLLowerDFGToLLVM.cpp:
      * ftl/FTLOSREntry.cpp:
      * ftl/FTLOSRExit.cpp:
      * ftl/FTLOSRExit.h:
      * ftl/FTLOSRExitCompiler.cpp:
      * interpreter/CallFrame.h:
      * interpreter/Interpreter.cpp:
      * jit/AssemblyHelpers.h:
      * jit/JIT.h:
      * jit/JITCall.cpp:
      * jit/JITInlines.h:
      * jit/JITOpcodes.cpp:
      * jit/JITOpcodes32_64.cpp:
      * jit/JITStubs.cpp:
      * llint/LLIntSlowPaths.cpp:
      * profiler/ProfilerBytecodeSequence.cpp:
      * runtime/CommonSlowPaths.cpp:
      * runtime/JSActivation.cpp:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156474 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1796ad0f
    • mhahnenberg@apple.com's avatar
      op_to_this shouldn't use value profiling · c5684714
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121920
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore:
      
      Currently it's the only opcode that uses m_singletonValue, which is unnecessary. Our current plan is
      to remove m_singletonValue so that GenGC can have a simpler story for handling CodeBlocks/FunctionExecutables
      during nursery collections.
      
      This patch adds an inline cache for the Structure of to_this so it no longer depends on the ValueProfile's
      m_singletonValue. Since nobody uses m_singletonValue now, this patch also removes m_singletonValue from
      ValueProfile.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::finalizeUnconditionally):
      (JSC::CodeBlock::stronglyVisitStrongReferences):
      (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
      (JSC::CodeBlock::updateAllValueProfilePredictions):
      (JSC::CodeBlock::updateAllPredictions):
      (JSC::CodeBlock::shouldOptimizeNow):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::updateAllValueProfilePredictions):
      (JSC::CodeBlock::updateAllPredictions):
      * bytecode/LazyOperandValueProfile.cpp:
      (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
      * bytecode/LazyOperandValueProfile.h:
      * bytecode/ValueProfile.h:
      (JSC::ValueProfileBase::ValueProfileBase):
      (JSC::ValueProfileBase::briefDescription):
      (JSC::ValueProfileBase::dump):
      (JSC::ValueProfileBase::computeUpdatedPrediction):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::BytecodeGenerator):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::parseBlock):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_to_this):
      (JSC::JIT::emitSlow_op_to_this):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_to_this):
      (JSC::JIT::emitSlow_op_to_this):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/CommonSlowPaths.cpp:
      (JSC::SLOW_PATH_DECL):
      
      LayoutTests:
      
      Updated a couple tests that waited for two DFG compiles, but with this patch we
      don't do two compiles any more, so we don't want to wait forever.
      
      * js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js:
      * js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156468 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c5684714
  2. 24 Sep, 2013 2 commits
    • mhahnenberg@apple.com's avatar
      op_get_callee shouldn't use value profiling · 5f2e70b5
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121821
      
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore: 
      
      Currently it's one of the two opcodes that uses m_singletonValue, which is unnecessary. 
      Our current plan is to remove m_singletonValue so that GenGC can have a simpler story 
      for handling CodeBlocks/FunctionExecutables during nursery collections.
      
      Instead of using a ValueProfile op_get_callee now has a simple inline cache of the most 
      recent JSFunction that we saw.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::finalizeUnconditionally):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitCreateThis):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::parseBlock):
      * jit/JIT.cpp:
      (JSC::JIT::privateCompileSlowCases):
      * jit/JIT.h:
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_get_callee):
      (JSC::JIT::emitSlow_op_get_callee):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_get_callee):
      (JSC::JIT::emitSlow_op_get_callee):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/CommonSlowPaths.cpp:
      (JSC::SLOW_PATH_DECL):
      * runtime/CommonSlowPaths.h:
      
      LayoutTests: 
      
      Added two tests to make sure we didn't regress the performance of op_get_callee.
      
      * js/regress/get_callee_monomorphic-expected.txt: Added.
      * js/regress/get_callee_monomorphic.html: Added.
      * js/regress/get_callee_polymorphic-expected.txt: Added.
      * js/regress/get_callee_polymorphic.html: Added.
      * js/regress/script-tests/get_callee_monomorphic.js: Added.
      * js/regress/script-tests/get_callee_polymorphic.js: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156376 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      5f2e70b5
    • mark.lam@apple.com's avatar
      Change JSC debug hooks to pass a CallFrame* instead of a DebuggerCallFrame. · e72693dc
      mark.lam@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121867.
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      1. Removed the need for passing the line and column info to the debug hook
         callbacks. We now get the line and column info from the CallFrame.
      
      2. Simplify BytecodeGenerator::emitDebugHook() to only take 1 line number
         argument. The caller can determine whether to pass in the first or last
         line number of the block of source code as appropriate.
         Note: we still need to pass in the line and column info to emitDebugHook()
         because it uses this info to emit expression info which is later used by
         the StackVisitor to determine the line and column info for its "pc".
      
      3. Pass the exceptionValue explicitly to the exception() debug hook
         callback. It should not be embedded in the CallFrame / DebuggerCallFrame.
      
      4. Change the op_debug opcode size to 2 (from 5) since we've removing 3 arg
         values. Update the LLINT and JIT code to handle this.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpBytecode):
      (JSC::CodeBlock::CodeBlock):
      * bytecode/Opcode.h:
      (JSC::padOpcodeName):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::emitDebugHook):
      * bytecompiler/BytecodeGenerator.h:
      * bytecompiler/NodesCodegen.cpp:
      (JSC::ConstStatementNode::emitBytecode):
      (JSC::EmptyStatementNode::emitBytecode):
      (JSC::DebuggerStatementNode::emitBytecode):
      (JSC::ExprStatementNode::emitBytecode):
      (JSC::VarStatementNode::emitBytecode):
      (JSC::IfElseNode::emitBytecode):
      (JSC::DoWhileNode::emitBytecode):
      (JSC::WhileNode::emitBytecode):
      (JSC::ForNode::emitBytecode):
      (JSC::ForInNode::emitBytecode):
      (JSC::ContinueNode::emitBytecode):
      (JSC::BreakNode::emitBytecode):
      (JSC::ReturnNode::emitBytecode):
      (JSC::WithNode::emitBytecode):
      (JSC::SwitchNode::emitBytecode):
      (JSC::LabelNode::emitBytecode):
      (JSC::ThrowNode::emitBytecode):
      (JSC::TryNode::emitBytecode):
      (JSC::ProgramNode::emitBytecode):
      (JSC::EvalNode::emitBytecode):
      (JSC::FunctionBodyNode::emitBytecode):
      * debugger/Debugger.h:
      * debugger/DebuggerCallFrame.cpp:
      (JSC::LineAndColumnFunctor::operator()):
      (JSC::LineAndColumnFunctor::line):
      (JSC::LineAndColumnFunctor::column):
      (JSC::DebuggerCallFrame::DebuggerCallFrame):
      (JSC::DebuggerCallFrame::clear):
      * debugger/DebuggerCallFrame.h:
      (JSC::DebuggerCallFrame::line):
      (JSC::DebuggerCallFrame::column):
      * interpreter/Interpreter.cpp:
      (JSC::unwindCallFrame):
      (JSC::UnwindFunctor::UnwindFunctor):
      (JSC::UnwindFunctor::operator()):
      (JSC::Interpreter::unwind):
      (JSC::Interpreter::debug):
      * interpreter/Interpreter.h:
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_debug):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_debug):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter.asm:
      
      Source/WebCore: 
      
      No new tests.
      
      * bindings/js/ScriptDebugServer.cpp:
      (WebCore::ScriptDebugServer::createCallFrame):
      (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
      (WebCore::ScriptDebugServer::callEvent):
      (WebCore::ScriptDebugServer::atStatement):
      (WebCore::ScriptDebugServer::returnEvent):
      (WebCore::ScriptDebugServer::exception):
      (WebCore::ScriptDebugServer::willExecuteProgram):
      (WebCore::ScriptDebugServer::didExecuteProgram):
      (WebCore::ScriptDebugServer::didReachBreakpoint):
      * bindings/js/ScriptDebugServer.h:
      * bindings/js/WorkerScriptDebugServer.cpp:
      (WebCore::WorkerScriptDebugServer::willExecuteProgram):
      * bindings/js/WorkerScriptDebugServer.h:
      
      Source/WebKit/mac: 
      
      * WebView/WebScriptDebugDelegate.mm:
      (-[WebScriptCallFrame _initWithGlobalObject:debuggerCallFrame:exceptionValue:JSC::]):
      (-[WebScriptCallFrame exception]):
      * WebView/WebScriptDebugger.h:
      * WebView/WebScriptDebugger.mm:
      (WebScriptDebugger::exception):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156374 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e72693dc
  3. 23 Sep, 2013 1 commit
    • fpizlo@apple.com's avatar
      Never use ReturnPC for exception handling and quit using exception check... · 48a7bc89
      fpizlo@apple.com authored
      Never use ReturnPC for exception handling and quit using exception check indices as a lame replica of the CodeOrigin index
      https://bugs.webkit.org/show_bug.cgi?id=121734
      
      Reviewed by Mark Hahnenberg.
              
      Exception handling can deduce where the exception was thrown from by looking at the
      code origin that was stored into the call frame header. There is no need to pass any
      additional meta-data into the exception throwing logic. But the DFG was still doing it
      anyway.
              
      This removes all of the logic to pass extra meta-data into lookupExceptionHandler()
      and friends. It simplifies a lot of code.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::shrinkToFit):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::codeOrigins):
      (JSC::CodeBlock::hasCodeOrigins):
      (JSC::CodeBlock::canGetCodeOrigin):
      (JSC::CodeBlock::codeOrigin):
      * bytecode/CodeOrigin.h:
      (JSC::InlineCallFrame::InlineCallFrame):
      * bytecode/InlineCallFrameSet.cpp: Added.
      (JSC::InlineCallFrameSet::InlineCallFrameSet):
      (JSC::InlineCallFrameSet::~InlineCallFrameSet):
      (JSC::InlineCallFrameSet::add):
      (JSC::InlineCallFrameSet::shrinkToFit):
      * bytecode/InlineCallFrameSet.h: Added.
      (JSC::InlineCallFrameSet::isEmpty):
      (JSC::InlineCallFrameSet::size):
      (JSC::InlineCallFrameSet::at):
      * dfg/DFGArgumentsSimplificationPhase.cpp:
      (JSC::DFG::ArgumentsSimplificationPhase::run):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
      * dfg/DFGCommonData.cpp:
      (JSC::DFG::CommonData::addCodeOrigin):
      (JSC::DFG::CommonData::shrinkToFit):
      * dfg/DFGCommonData.h:
      * dfg/DFGDesiredWriteBarriers.cpp:
      (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
      (JSC::DFG::DesiredWriteBarrier::trigger):
      * dfg/DFGDesiredWriteBarriers.h:
      (JSC::DFG::DesiredWriteBarriers::add):
      (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameExecutable):
      (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameCallee):
      * dfg/DFGGraph.cpp:
      (JSC::DFG::Graph::Graph):
      * dfg/DFGGraph.h:
      * dfg/DFGJITCompiler.cpp:
      (JSC::DFG::JITCompiler::JITCompiler):
      (JSC::DFG::JITCompiler::compileExceptionHandlers):
      (JSC::DFG::JITCompiler::link):
      (JSC::DFG::JITCompiler::compileFunction):
      * dfg/DFGJITCompiler.h:
      (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
      (JSC::DFG::JITCompiler::exceptionCheck):
      (JSC::DFG::JITCompiler::fastExceptionCheck):
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGRepatch.cpp:
      (JSC::DFG::tryBuildGetByIDList):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
      (JSC::DFG::SpeculativeJIT::appendCallSetResult):
      (JSC::DFG::SpeculativeJIT::appendCall):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::emitCall):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::emitCall):
      * dfg/DFGVirtualRegisterAllocationPhase.cpp:
      (JSC::DFG::VirtualRegisterAllocationPhase::run):
      * ftl/FTLLowerDFGToLLVM.cpp:
      (JSC::FTL::LowerDFGToLLVM::callPreflight):
      * jit/AssemblyHelpers.h:
      (JSC::AssemblyHelpers::emitExceptionCheck):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      48a7bc89
  4. 22 Sep, 2013 1 commit
  5. 21 Sep, 2013 2 commits
    • fpizlo@apple.com's avatar
      Unreviewed, revert http://trac.webkit.org/changeset/156235. It won't work on Windows. · da4645e1
      fpizlo@apple.com authored
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CallLinkInfo.cpp:
      (JSC::CallLinkInfo::unlink):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::resetStubInternal):
      * bytecode/StructureStubInfo.h:
      * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
      (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
      (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
      * dfg/DFGJITCompiler.h:
      * dfg/DFGOSRExitCompiler.h:
      * dfg/DFGOperations.cpp:
      (JSC::DFG::operationPutByValInternal):
      * dfg/DFGOperations.h:
      (JSC::DFG::operationNewTypedArrayWithSizeForType):
      (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
      * dfg/DFGRegisterSet.h: Added.
      (JSC::DFG::RegisterSet::RegisterSet):
      (JSC::DFG::RegisterSet::asPOD):
      (JSC::DFG::RegisterSet::copyInfo):
      (JSC::DFG::RegisterSet::set):
      (JSC::DFG::RegisterSet::setGPRByIndex):
      (JSC::DFG::RegisterSet::clear):
      (JSC::DFG::RegisterSet::get):
      (JSC::DFG::RegisterSet::getGPRByIndex):
      (JSC::DFG::RegisterSet::getFreeGPR):
      (JSC::DFG::RegisterSet::setFPRByIndex):
      (JSC::DFG::RegisterSet::getFPRByIndex):
      (JSC::DFG::RegisterSet::setByIndex):
      (JSC::DFG::RegisterSet::getByIndex):
      (JSC::DFG::RegisterSet::numberOfSetGPRs):
      (JSC::DFG::RegisterSet::numberOfSetFPRs):
      (JSC::DFG::RegisterSet::numberOfSetRegisters):
      (JSC::DFG::RegisterSet::setBit):
      (JSC::DFG::RegisterSet::clearBit):
      (JSC::DFG::RegisterSet::getBit):
      * dfg/DFGRepatch.cpp: Added.
      (JSC::DFG::repatchCall):
      (JSC::DFG::repatchByIdSelfAccess):
      (JSC::DFG::addStructureTransitionCheck):
      (JSC::DFG::replaceWithJump):
      (JSC::DFG::emitRestoreScratch):
      (JSC::DFG::linkRestoreScratch):
      (JSC::DFG::generateProtoChainAccessStub):
      (JSC::DFG::tryCacheGetByID):
      (JSC::DFG::repatchGetByID):
      (JSC::DFG::getPolymorphicStructureList):
      (JSC::DFG::patchJumpToGetByIdStub):
      (JSC::DFG::tryBuildGetByIDList):
      (JSC::DFG::buildGetByIDList):
      (JSC::DFG::appropriateGenericPutByIdFunction):
      (JSC::DFG::appropriateListBuildingPutByIdFunction):
      (JSC::DFG::emitPutReplaceStub):
      (JSC::DFG::emitPutTransitionStub):
      (JSC::DFG::tryCachePutByID):
      (JSC::DFG::repatchPutByID):
      (JSC::DFG::tryBuildPutByIdList):
      (JSC::DFG::buildPutByIdList):
      (JSC::DFG::tryRepatchIn):
      (JSC::DFG::repatchIn):
      (JSC::DFG::linkSlowFor):
      (JSC::DFG::linkFor):
      (JSC::DFG::linkClosureCall):
      (JSC::DFG::resetGetByID):
      (JSC::DFG::resetPutByID):
      (JSC::DFG::resetIn):
      * dfg/DFGRepatch.h: Added.
      (JSC::DFG::resetGetByID):
      (JSC::DFG::resetPutByID):
      (JSC::DFG::resetIn):
      * dfg/DFGScratchRegisterAllocator.h: Added.
      (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
      (JSC::DFG::ScratchRegisterAllocator::lock):
      (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
      (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
      (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
      (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
      (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
      (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
      (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
      (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
      (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::writeBarrier):
      (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
      (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
      (JSC::DFG::SpeculativeJIT::compare):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::callOperation):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGThunks.cpp:
      (JSC::DFG::emitPointerValidation):
      (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
      (JSC::DFG::slowPathFor):
      (JSC::DFG::linkForThunkGenerator):
      (JSC::DFG::linkCallThunkGenerator):
      (JSC::DFG::linkConstructThunkGenerator):
      (JSC::DFG::linkClosureCallThunkGenerator):
      (JSC::DFG::virtualForThunkGenerator):
      (JSC::DFG::virtualCallThunkGenerator):
      (JSC::DFG::virtualConstructThunkGenerator):
      * dfg/DFGThunks.h:
      * ftl/FTLIntrinsicRepository.h:
      * ftl/FTLLowerDFGToLLVM.cpp:
      (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
      * ftl/FTLOSRExitCompiler.h:
      * jit/AssemblyHelpers.h:
      * jit/JIT.cpp:
      (JSC::JIT::linkFor):
      (JSC::JIT::linkSlowCall):
      * jit/JITCall.cpp:
      (JSC::JIT::compileCallEvalSlowCase):
      (JSC::JIT::compileOpCallSlowCase):
      (JSC::JIT::privateCompileClosureCall):
      * jit/JITCall32_64.cpp:
      (JSC::JIT::compileCallEvalSlowCase):
      (JSC::JIT::compileOpCallSlowCase):
      (JSC::JIT::privateCompileClosureCall):
      * jit/JITOperationWrappers.h: Removed.
      * jit/JITOperations.cpp: Removed.
      * jit/JITOperations.h: Removed.
      * jit/RegisterSet.h: Removed.
      * jit/Repatch.cpp: Removed.
      * jit/Repatch.h: Removed.
      * jit/ScratchRegisterAllocator.h: Removed.
      * jit/ThunkGenerators.cpp:
      (JSC::generateSlowCaseFor):
      (JSC::linkForGenerator):
      (JSC::linkCallGenerator):
      (JSC::linkConstructGenerator):
      (JSC::linkClosureCallGenerator):
      (JSC::virtualForGenerator):
      (JSC::virtualCallGenerator):
      (JSC::virtualConstructGenerator):
      * jit/ThunkGenerators.h:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      da4645e1
    • fpizlo@apple.com's avatar
      Move DFG inline caching logic into jit/ · 4513333c
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121749
      
      Rubber stamped by Sam Weinig.
              
      We want to get rid of the baseline JIT's inline caching machinery and have it use the
      DFG's instead. But before we do that we need to move the DFG's inline caching machine
      out from behind its ENABLE(DFG_JIT) guards and make it available to the whole system.
      This patch does that:
              
      - dfg/DFGRepatch becomes jit/Repatch.
              
      - The thunks used by the DFG IC go into jit/ThunkGenerators, instead of dfg/DFGThunks.
              
      - The operations used by the DFG IC go into jit/JITOperations, instead of
        dfg/DFGOperations.
              
      - The old JIT's thunk generators for calls are renamed to reduce confusion. Previously
        it was easy to know which generators belong to which JIT because the old JIT used
        JSC::virtualCallBlah and the DFG used JSC::DFG::virtualCallBlah, but that's not the
        case anymore. Note that the old JIT's thunk generators will die in a future patch.
              
      No functional changes beyond those moves.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CallLinkInfo.cpp:
      (JSC::CallLinkInfo::unlink):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::resetStubInternal):
      * bytecode/StructureStubInfo.h:
      * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
      (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
      (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
      * dfg/DFGJITCompiler.h:
      * dfg/DFGOSRExitCompiler.h:
      * dfg/DFGOperations.cpp:
      (JSC::DFG::operationPutByValInternal):
      * dfg/DFGOperations.h:
      (JSC::DFG::operationNewTypedArrayWithSizeForType):
      (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
      * dfg/DFGRegisterSet.h: Removed.
      * dfg/DFGRepatch.cpp: Removed.
      * dfg/DFGRepatch.h: Removed.
      * dfg/DFGScratchRegisterAllocator.h: Removed.
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
      (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
      (JSC::DFG::SpeculativeJIT::compare):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::callOperation):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::cachedPutById):
      (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
      (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
      (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGThunks.cpp:
      * dfg/DFGThunks.h:
      * ftl/FTLIntrinsicRepository.h:
      * ftl/FTLLowerDFGToLLVM.cpp:
      (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
      * jit/AssemblyHelpers.h:
      (JSC::AssemblyHelpers::writeBarrier):
      * jit/JIT.cpp:
      (JSC::JIT::linkFor):
      (JSC::JIT::linkSlowCall):
      * jit/JITCall.cpp:
      (JSC::JIT::compileCallEval):
      (JSC::JIT::compileCallEvalSlowCase):
      (JSC::JIT::compileOpCallSlowCase):
      (JSC::JIT::privateCompileClosureCall):
      * jit/JITCall32_64.cpp:
      (JSC::JIT::compileCallEvalSlowCase):
      (JSC::JIT::compileOpCallSlowCase):
      (JSC::JIT::privateCompileClosureCall):
      * jit/JITOperationWrappers.h: Added.
      * jit/JITOperations.cpp: Added.
      * jit/JITOperations.h: Added.
      * jit/RegisterSet.h: Added.
      (JSC::RegisterSet::RegisterSet):
      (JSC::RegisterSet::asPOD):
      (JSC::RegisterSet::copyInfo):
      (JSC::RegisterSet::set):
      (JSC::RegisterSet::setGPRByIndex):
      (JSC::RegisterSet::clear):
      (JSC::RegisterSet::get):
      (JSC::RegisterSet::getGPRByIndex):
      (JSC::RegisterSet::getFreeGPR):
      (JSC::RegisterSet::setFPRByIndex):
      (JSC::RegisterSet::getFPRByIndex):
      (JSC::RegisterSet::setByIndex):
      (JSC::RegisterSet::getByIndex):
      (JSC::RegisterSet::numberOfSetGPRs):
      (JSC::RegisterSet::numberOfSetFPRs):
      (JSC::RegisterSet::numberOfSetRegisters):
      (JSC::RegisterSet::setBit):
      (JSC::RegisterSet::clearBit):
      (JSC::RegisterSet::getBit):
      * jit/Repatch.cpp: Added.
      (JSC::repatchCall):
      (JSC::repatchByIdSelfAccess):
      (JSC::addStructureTransitionCheck):
      (JSC::replaceWithJump):
      (JSC::emitRestoreScratch):
      (JSC::linkRestoreScratch):
      (JSC::generateProtoChainAccessStub):
      (JSC::tryCacheGetByID):
      (JSC::repatchGetByID):
      (JSC::getPolymorphicStructureList):
      (JSC::patchJumpToGetByIdStub):
      (JSC::tryBuildGetByIDList):
      (JSC::buildGetByIDList):
      (JSC::appropriateGenericPutByIdFunction):
      (JSC::appropriateListBuildingPutByIdFunction):
      (JSC::emitPutReplaceStub):
      (JSC::emitPutTransitionStub):
      (JSC::tryCachePutByID):
      (JSC::repatchPutByID):
      (JSC::tryBuildPutByIdList):
      (JSC::buildPutByIdList):
      (JSC::tryRepatchIn):
      (JSC::repatchIn):
      (JSC::linkSlowFor):
      (JSC::linkFor):
      (JSC::linkClosureCall):
      (JSC::resetGetByID):
      (JSC::resetPutByID):
      (JSC::resetIn):
      * jit/Repatch.h: Added.
      (JSC::resetGetByID):
      (JSC::resetPutByID):
      (JSC::resetIn):
      * jit/ScratchRegisterAllocator.h: Added.
      (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
      (JSC::ScratchRegisterAllocator::lock):
      (JSC::ScratchRegisterAllocator::allocateScratch):
      (JSC::ScratchRegisterAllocator::allocateScratchGPR):
      (JSC::ScratchRegisterAllocator::allocateScratchFPR):
      (JSC::ScratchRegisterAllocator::didReuseRegisters):
      (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
      (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
      (JSC::ScratchRegisterAllocator::desiredScratchBufferSize):
      (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
      (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
      * jit/ThunkGenerators.cpp:
      (JSC::oldStyleGenerateSlowCaseFor):
      (JSC::oldStyleLinkForGenerator):
      (JSC::oldStyleLinkCallGenerator):
      (JSC::oldStyleLinkConstructGenerator):
      (JSC::oldStyleLinkClosureCallGenerator):
      (JSC::oldStyleVirtualForGenerator):
      (JSC::oldStyleVirtualCallGenerator):
      (JSC::oldStyleVirtualConstructGenerator):
      (JSC::emitPointerValidation):
      (JSC::throwExceptionFromCallSlowPathGenerator):
      (JSC::slowPathFor):
      (JSC::linkForThunkGenerator):
      (JSC::linkCallThunkGenerator):
      (JSC::linkConstructThunkGenerator):
      (JSC::linkClosureCallThunkGenerator):
      (JSC::virtualForThunkGenerator):
      (JSC::virtualCallThunkGenerator):
      (JSC::virtualConstructThunkGenerator):
      * jit/ThunkGenerators.h:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      4513333c
  6. 20 Sep, 2013 1 commit
    • fpizlo@apple.com's avatar
      Move CCallHelpers and AssemblyHelpers into jit/ and have JSInterfaceJIT use them · cd8eb2c1
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121637
      
      Rubber stamped by Michael Saboff.
              
      Also moved GPRInfo/FPRInfo into jit/. Rolling back in after fixing JIT-only build
      and tests.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/ValueRecovery.h:
      (JSC::ValueRecovery::dumpInContext):
      * dfg/DFGAssemblyHelpers.cpp: Removed.
      * dfg/DFGAssemblyHelpers.h: Removed.
      * dfg/DFGBinarySwitch.h:
      * dfg/DFGByteCodeParser.cpp:
      * dfg/DFGCCallHelpers.h: Removed.
      * dfg/DFGDisassembler.cpp:
      * dfg/DFGFPRInfo.h: Removed.
      * dfg/DFGGPRInfo.h: Removed.
      * dfg/DFGGraph.cpp:
      * dfg/DFGGraph.h:
      * dfg/DFGJITCompiler.h:
      * dfg/DFGOSRExit.cpp:
      * dfg/DFGOSRExit.h:
      * dfg/DFGOSRExitCompiler.h:
      * dfg/DFGOSRExitCompilerCommon.h:
      * dfg/DFGRegisterBank.h:
      * dfg/DFGRegisterSet.h:
      * dfg/DFGRepatch.cpp:
      * dfg/DFGSilentRegisterSavePlan.h:
      * dfg/DFGThunks.cpp:
      * dfg/DFGVariableEvent.cpp:
      * ftl/FTLCArgumentGetter.h:
      (JSC::FTL::CArgumentGetter::CArgumentGetter):
      (JSC::FTL::CArgumentGetter::loadNext8):
      (JSC::FTL::CArgumentGetter::loadNext32):
      (JSC::FTL::CArgumentGetter::loadNext64):
      (JSC::FTL::CArgumentGetter::loadNextPtr):
      (JSC::FTL::CArgumentGetter::loadNextDouble):
      * ftl/FTLCompile.cpp:
      * ftl/FTLExitThunkGenerator.h:
      * ftl/FTLLink.cpp:
      * ftl/FTLThunks.cpp:
      * jit/AssemblyHelpers.cpp: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp.
      * jit/AssemblyHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h.
      (JSC::AssemblyHelpers::AssemblyHelpers):
      (JSC::AssemblyHelpers::debugCall):
      * jit/CCallHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGCCallHelpers.h.
      * jit/FPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGFPRInfo.h.
      (WTF::printInternal):
      * jit/GPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGGPRInfo.h.
      (WTF::printInternal):
      * jit/JIT.cpp:
      (JSC::JIT::JIT):
      * jit/JIT.h:
      * jit/JITPropertyAccess.cpp:
      (JSC::JIT::stringGetByValStubGenerator):
      * jit/JITPropertyAccess32_64.cpp:
      (JSC::JIT::stringGetByValStubGenerator):
      * jit/JSInterfaceJIT.h:
      (JSC::JSInterfaceJIT::JSInterfaceJIT):
      * jit/SpecializedThunkJIT.h:
      (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
      (JSC::SpecializedThunkJIT::finalize):
      * jit/ThunkGenerators.cpp:
      (JSC::linkForGenerator):
      (JSC::virtualForGenerator):
      (JSC::stringLengthTrampolineGenerator):
      (JSC::nativeForGenerator):
      (JSC::arityFixup):
      (JSC::charCodeAtThunkGenerator):
      (JSC::charAtThunkGenerator):
      (JSC::fromCharCodeThunkGenerator):
      (JSC::sqrtThunkGenerator):
      (JSC::floorThunkGenerator):
      (JSC::ceilThunkGenerator):
      (JSC::roundThunkGenerator):
      (JSC::expThunkGenerator):
      (JSC::logThunkGenerator):
      (JSC::absThunkGenerator):
      (JSC::powThunkGenerator):
      (JSC::imulThunkGenerator):
      * llint/LLIntThunks.cpp:
      (JSC::LLInt::generateThunkWithJumpTo):
      * runtime/JSCJSValue.h:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156184 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      cd8eb2c1
  7. 19 Sep, 2013 1 commit
    • fpizlo@apple.com's avatar
      Remove some of the tautologies in DFGRepatch function naming. · 6d59f9e2
      fpizlo@apple.com authored
      Rubber stamped by Mark Hahnenberg.
              
      For example change DFG::dfgLinkFor() to be DFG::linkFor().
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::resetStubInternal):
      * dfg/DFGOperations.cpp:
      * dfg/DFGRepatch.cpp:
      (JSC::DFG::repatchCall):
      (JSC::DFG::repatchByIdSelfAccess):
      (JSC::DFG::tryCacheGetByID):
      (JSC::DFG::repatchGetByID):
      (JSC::DFG::buildGetByIDList):
      (JSC::DFG::tryCachePutByID):
      (JSC::DFG::repatchPutByID):
      (JSC::DFG::buildPutByIdList):
      (JSC::DFG::repatchIn):
      (JSC::DFG::linkFor):
      (JSC::DFG::linkSlowFor):
      (JSC::DFG::linkClosureCall):
      (JSC::DFG::resetGetByID):
      (JSC::DFG::resetPutByID):
      (JSC::DFG::resetIn):
      * dfg/DFGRepatch.h:
      (JSC::DFG::resetGetByID):
      (JSC::DFG::resetPutByID):
      (JSC::DFG::resetIn):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156124 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6d59f9e2
  8. 18 Sep, 2013 1 commit
    • mhahnenberg@apple.com's avatar
      Rename OperationInProgress to HeapOperation and move it out of Heap.h into its own header · ba01f6dd
      mhahnenberg@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121534
      
      Reviewed by Geoffrey Garen.
      
      OperationInProgress is a silly name. 
      
      Many parts of the Heap would like to know what HeapOperation is currently underway, but 
      since they are included in Heap.h they can't directly reference HeapOperation if it also 
      lives in Heap.h. The simplest thing to do is to give HeapOperation its own header. While 
      a bit overkill, it simplifies including it wherever its needed.
      
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
      (JSC::CodeBlock::updateAllValueProfilePredictions):
      (JSC::CodeBlock::updateAllPredictions):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::updateAllValueProfilePredictions):
      (JSC::CodeBlock::updateAllPredictions):
      * bytecode/LazyOperandValueProfile.cpp:
      (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
      * bytecode/LazyOperandValueProfile.h:
      * bytecode/ValueProfile.h:
      (JSC::ValueProfileBase::computeUpdatedPrediction):
      * heap/Heap.h:
      * heap/HeapOperation.h: Added.
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@156050 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      ba01f6dd
  9. 13 Sep, 2013 2 commits
    • fpizlo@apple.com's avatar
      DFG AI assumes that ToThis can never return non-object if it is passed an... · 018818de
      fpizlo@apple.com authored
      DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
      https://bugs.webkit.org/show_bug.cgi?id=121330
      
      Source/JavaScriptCore: 
      
      Reviewed by Mark Hahnenberg and Oliver Hunt.
              
      Also print whether a function is strict mode in debug dumps.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpAssumingJITType):
      * bytecode/CodeOrigin.cpp:
      (JSC::InlineCallFrame::dumpInContext):
      * dfg/DFGAbstractInterpreterInlines.h:
      (JSC::DFG::::executeEffects):
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      
      Tools: 
      
      Reviewed by Mark Hahnenberg and Oliver Hunt.
      
      We should run tests even if they don't have expected files yet.
              
      * Scripts/run-layout-jsc:
      
      LayoutTests: 
      
      Reviewed by Mark Hahnenberg and Oliver Hunt.
      
      * js/dfg-strict-mode-to-this-expected.txt: Added.
      * js/dfg-strict-mode-to-this.html: Added.
      * js/jsc-test-list:
      * js/script-tests/dfg-strict-mode-to-this.js: Added.
      (thingy.bar):
      (thingy.foo):
      (thingy):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155730 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      018818de
    • msaboff@apple.com's avatar
      fourthTier: Change JSStack to grow from high to low addresses · b70e41bc
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=118758
      
      Reviewed by Oliver Hunt.
      
      Changed the JSC stack to grow down.  Effectively the JSC stack frame is flipped from
      what it was.  See JSStack.h for the new offsets.  Changed JSStack begin() and end()
      to be getBaseOfStack() and getLimitOfStack().  Most of the changes are address or offset
      calculation changes.  Decoupled a local register ordinal (loop variable or array index)
      from the offset into the callFrame using localToOperand() and the inverse operandToLocal().
      
      * assembler/MacroAssembler.h:
      (JSC::MacroAssembler::trustedImm32ForShift):
      (JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index
      * assembler/MacroAssemblerX86_64.h:
      (JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index
      * assembler/X86Assembler.h:
      (JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpBytecode):
      * bytecode/CodeBlock.h:
      (JSC::unmodifiedArgumentsRegister):
      (JSC::CodeBlock::isCaptured):
      * bytecode/CodeOrigin.h:
      (JSC::CodeOrigin::stackOffset):
      * bytecode/Operands.h:
      (JSC::localToOperand):
      (JSC::operandIsLocal):
      (JSC::operandToLocal):
      (JSC::operandIsArgument):
      (JSC::operandToArgument):
      (JSC::argumentToOperand):
      * bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in
      31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC::BytecodeGenerator::addVar):
      (JSC::BytecodeGenerator::BytecodeGenerator):
      (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
      (JSC::BytecodeGenerator::newRegister):
      (JSC::BytecodeGenerator::emitNewArray):
      * bytecompiler/BytecodeGenerator.h:
      (JSC::CallArguments::registerOffset):
      * bytecompiler/NodesCodegen.cpp:
      (JSC::CallArguments::CallArguments):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
      (JSC::DFG::ByteCodeParser::addCall):
      (JSC::DFG::ByteCodeParser::handleCall):
      (JSC::DFG::ByteCodeParser::handleInlining):
      (JSC::DFG::ByteCodeParser::parseBlock):
      (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
      * dfg/DFGJITCompiler.cpp:
      (JSC::DFG::JITCompiler::compileFunction):
      * dfg/DFGOSREntry.cpp:
      (JSC::DFG::prepareOSREntry):
      * dfg/DFGOSRExitCompiler32_64.cpp:
      (JSC::DFG::OSRExitCompiler::compileExit):
      * dfg/DFGOSRExitCompiler64.cpp:
      (JSC::DFG::OSRExitCompiler::compileExit):
      * dfg/DFGOperations.cpp:
      * dfg/DFGScoreBoard.h:
      (JSC::DFG::ScoreBoard::allocate):
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::callFrameSlot):
      (JSC::DFG::SpeculativeJIT::argumentSlot):
      (JSC::DFG::SpeculativeJIT::callFrameTagSlot):
      (JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
      (JSC::DFG::SpeculativeJIT::argumentTagSlot):
      (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::emitCall):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::emitCall):
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGValidate.cpp:
      (JSC::DFG::Validate::reportValidationContext):
      * ftl/FTLLink.cpp:
      (JSC::FTL::link):
      * heap/ConservativeRoots.cpp:
      (JSC::ConservativeRoots::genericAddSpan):
      * interpreter/CallFrame.cpp:
      (JSC::CallFrame::frameExtentInternal):
      * interpreter/CallFrame.h:
      (JSC::ExecState::init):
      (JSC::ExecState::argumentOffset):
      (JSC::ExecState::argumentOffsetIncludingThis):
      (JSC::ExecState::argIndexForRegister):
      * interpreter/Interpreter.cpp:
      (JSC::loadVarargs):
      (JSC::Interpreter::dumpRegisters):
      * interpreter/JSStack.cpp:
      (JSC::JSStack::JSStack):
      (JSC::JSStack::~JSStack):
      (JSC::JSStack::growSlowCase):
      (JSC::JSStack::gatherConservativeRoots):
      (JSC::JSStack::releaseExcessCapacity):
      (JSC::JSStack::disableErrorStackReserve):
      * interpreter/JSStack.h:
      (JSC::JSStack::getBaseOfStack):
      (JSC::JSStack::getLimitOfStack):
      (JSC::JSStack::size):
      (JSC::JSStack::end):
      (JSC::JSStack::containsAddress):
      (JSC::JSStack::lowAddress):
      (JSC::JSStack::highAddress):
      (JSC::JSStack::reservationEnd):
      (JSC::JSStack::shrink):
      (JSC::JSStack::grow):
      * interpreter/JSStackInlines.h:
      (JSC::JSStack::getTopOfFrame):
      (JSC::JSStack::pushFrame):
      (JSC::JSStack::popFrame):
      (JSC::JSStack::installTrapsAfterFrame):
      * interpreter/StackVisitor.cpp:
      (JSC::inlinedFrameOffset):
      (JSC::StackVisitor::readInlinedFrame):
      * jit/JIT.cpp:
      (JSC::JIT::privateCompile):
      * jit/JITCall.cpp:
      (JSC::JIT::compileLoadVarargs):
      (JSC::JIT::compileOpCall):
      * jit/JITCall32_64.cpp:
      (JSC::JIT::compileLoadVarargs):
      (JSC::JIT::compileOpCall):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_create_activation):
      (JSC::JIT::emit_op_get_argument_by_val):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_get_argument_by_val):
      * jit/JITStubs.cpp:
      (JSC::throwExceptionFromOpCall):
      (JSC::DEFINE_STUB_FUNCTION):
      * jit/ThunkGenerators.cpp:
      (JSC::arityFixup):
      * llint/LLIntData.cpp:
      (JSC::LLInt::Data::performAssertions):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      (JSC::LLInt::genericCall):
      * llint/LowLevelInterpreter.asm:
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      * runtime/ArgList.cpp:
      (JSC::ArgList::getSlice):
      (JSC::MarkedArgumentBuffer::slowAppend):
      * runtime/ArgList.h:
      (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
      (JSC::MarkedArgumentBuffer::slotFor):
      (JSC::MarkedArgumentBuffer::mallocBase):
      (JSC::ArgList::at):
      * runtime/Arguments.cpp:
      (JSC::Arguments::tearOff):
      * runtime/ArrayConstructor.cpp:
      (JSC::constructArrayWithSizeQuirk):
      * runtime/CommonSlowPaths.cpp:
      (JSC::SLOW_PATH_DECL):
      * runtime/JSActivation.h:
      (JSC::JSActivation::registersOffset):
      (JSC::JSActivation::tearOff):
      (JSC::JSActivation::isValidIndex):
      * runtime/JSArray.h:
      (JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.
      * runtime/JSGlobalObject.cpp:
      (JSC::JSGlobalObject::globalExec):
      * runtime/JSGlobalObject.h:
      (JSC::constructArrayNegativeIndexed):
      * runtime/JSString.h:
      * runtime/Operations.h:
      (JSC::jsStringFromRegisterArray):
      * runtime/SymbolTable.h:
      (JSC::SharedSymbolTable::captureCount):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155711 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      b70e41bc
  10. 09 Sep, 2013 1 commit
    • msaboff@apple.com's avatar
      Add local to/from operand helpers similar to argument to/from operand2 · 1a5f13c8
      msaboff@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=121056
      
      Reviewed by Geoffrey Garen.
      
      Added localToOperand(), operandToLocal() and operandIsLocal() to Operands.h, very similar to
      argumentToOperand(), et al.  Used the new helpers everywhere where an index into a data
      structure is intended instead of the actual virtual register offset.  When the stack is
      changed to grow down, local register offsets can be negative.  Also added the helper
      DFG::SpeculativeJIT::generationInfoFromVirtualRegister() for the common case accessing 
      m_generationInfo[operandToLocal(val)].
      
      * bytecode/CodeBlock.cpp:
      * bytecode/CodeBlock.h:
      * bytecode/Operands.h:
      (JSC::localToOperand):
      (JSC::operandIsLocal):
      (JSC::operandToLocal):
      * bytecompiler/BytecodeGenerator.h:
      * dfg/DFGAbstractInterpreterInlines.h:
      * dfg/DFGByteCodeParser.cpp:
      * dfg/DFGCFGSimplificationPhase.cpp:
      * dfg/DFGCPSRethreadingPhase.cpp:
      * dfg/DFGOSREntry.cpp:
      * dfg/DFGOSRExitCompiler32_64.cpp:
      * dfg/DFGOSRExitCompiler64.cpp:
      * dfg/DFGScoreBoard.h:
      * dfg/DFGSpeculativeJIT.cpp:
      * dfg/DFGSpeculativeJIT.h:
      (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      * dfg/DFGSpeculativeJIT64.cpp:
      * dfg/DFGValidate.cpp:
      * dfg/DFGVariableEventStream.cpp:
      * dfg/DFGVirtualRegisterAllocationPhase.cpp:
      * jit/JITInlines.h:
      * jit/JITOpcodes.cpp:
      * jit/JITOpcodes32_64.cpp:
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1a5f13c8
  11. 05 Sep, 2013 1 commit
    • msaboff@apple.com's avatar
      Cleanup formatting of byte code debug output · c580864f
      msaboff@apple.com authored
      Source/JavaScriptCore/ChangeLog
      
      Rubber stamped by Filip Pizlo.
      
      Put the formatting of the byte code offset and operation into one common function to
      simplify and unify formatting.  Changed CodeBlock::registerName() to return
      "thist" for argument register 0, "argN" for other argument registers and "locN" for
      local registers.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::registerName):
      (JSC::CodeBlock::printUnaryOp):
      (JSC::CodeBlock::printBinaryOp):
      (JSC::CodeBlock::printConditionalJump):
      (JSC::CodeBlock::printGetByIdOp):
      (JSC::CodeBlock::printCallOp):
      (JSC::CodeBlock::printPutByIdOp):
      (JSC::CodeBlock::dumpBytecode):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::printLocationAndOp):
      (JSC::CodeBlock::printLocationOpAndRegisterOperand):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155159 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c580864f
  12. 04 Sep, 2013 1 commit
    • fpizlo@apple.com's avatar
      The DFG should be able to tier-up and OSR enter into the FTL · 532f1e51
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=112838
      
      Source/JavaScriptCore: 
      
      Reviewed by Mark Hahnenberg.
              
      This adds the ability for the DFG to tier-up into the FTL. This works in both
      of the expected tier-up modes:
              
      Replacement: frequently called functions eventually have their entrypoint
      replaced with one that goes into FTL-compiled code. Note, this will be a
      slow-down for now since we don't yet have LLVM calling convention integration.
              
      OSR entry: code stuck in hot loops gets OSR'd into the FTL from the DFG.
              
      This means that if the DFG detects that a function is an FTL candidate, it
      inserts execution counting code similar to the kind that the baseline JIT
      would use. If you trip on a loop count in a loop header that is an OSR
      candidate (it's not an inlined loop), we do OSR; otherwise we do replacement.
      OSR almost always also implies future replacement.
              
      OSR entry into the FTL is really cool. It uses a specialized FTL compile of
      the code, where early in the DFG pipeline we replace the original root block
      with an OSR entrypoint block that jumps to the pre-header of the hot loop.
      The OSR entrypoint loads all live state at the loop pre-header using loads
      from a scratch buffer, which gets populated by the runtime's OSR entry
      preparation code (FTL::prepareOSREntry()). This approach appears to work well
      with all of our subsequent optimizations, including prediction propagation,
      CFA, and LICM. LLVM seems happy with it, too. Best of all, it works naturally
      with concurrent compilation: when we hit the tier-up trigger we spawn a
      compilation plan at the bytecode index from which we triggered; once the
      compilation finishes the next trigger will try to enter, at that bytecode
      index. If it can't - for example because the code has moved on to another
      loop - then we just try again. Loops that get hot enough for OSR entry (about
      25,000 iterations) will probably still be running when a concurrent compile
      finishes, so this doesn't appear to be a big problem.
              
      This immediately gives us a 70% speed-up on imaging-gaussian-blur. We could
      get a bigger speed-up by adding some more intelligence and tweaking LLVM to
      compile code faster. Those things will happen eventually but this is a good
      start. Probably this code will see more tuning as we get more coverage in the
      FTL JIT, but I'll worry about that in future patches.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::hasOptimizedReplacement):
      (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
      * bytecode/CodeBlock.h:
      * dfg/DFGAbstractInterpreterInlines.h:
      (JSC::DFG::::executeEffects):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::parseBlock):
      (JSC::DFG::ByteCodeParser::parse):
      * dfg/DFGCFGSimplificationPhase.cpp:
      (JSC::DFG::CFGSimplificationPhase::run):
      * dfg/DFGClobberize.h:
      (JSC::DFG::clobberize):
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compileImpl):
      (JSC::DFG::compile):
      * dfg/DFGDriver.h:
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::fixupNode):
      * dfg/DFGGraph.cpp:
      (JSC::DFG::Graph::dump):
      (JSC::DFG::Graph::killBlockAndItsContents):
      (JSC::DFG::Graph::killUnreachableBlocks):
      * dfg/DFGGraph.h:
      * dfg/DFGInPlaceAbstractState.cpp:
      (JSC::DFG::InPlaceAbstractState::initialize):
      * dfg/DFGJITCode.cpp:
      (JSC::DFG::JITCode::reconstruct):
      (JSC::DFG::JITCode::checkIfOptimizationThresholdReached):
      (JSC::DFG::JITCode::optimizeNextInvocation):
      (JSC::DFG::JITCode::dontOptimizeAnytimeSoon):
      (JSC::DFG::JITCode::optimizeAfterWarmUp):
      (JSC::DFG::JITCode::optimizeSoon):
      (JSC::DFG::JITCode::forceOptimizationSlowPathConcurrently):
      (JSC::DFG::JITCode::setOptimizationThresholdBasedOnCompilationResult):
      * dfg/DFGJITCode.h:
      * dfg/DFGJITFinalizer.cpp:
      (JSC::DFG::JITFinalizer::finalize):
      (JSC::DFG::JITFinalizer::finalizeFunction):
      (JSC::DFG::JITFinalizer::finalizeCommon):
      * dfg/DFGLoopPreHeaderCreationPhase.cpp:
      (JSC::DFG::createPreHeader):
      (JSC::DFG::LoopPreHeaderCreationPhase::run):
      * dfg/DFGLoopPreHeaderCreationPhase.h:
      * dfg/DFGNode.h:
      (JSC::DFG::Node::hasUnlinkedLocal):
      (JSC::DFG::Node::unlinkedLocal):
      * dfg/DFGNodeType.h:
      * dfg/DFGOSREntry.cpp:
      (JSC::DFG::prepareOSREntry):
      * dfg/DFGOSREntrypointCreationPhase.cpp: Added.
      (JSC::DFG::OSREntrypointCreationPhase::OSREntrypointCreationPhase):
      (JSC::DFG::OSREntrypointCreationPhase::run):
      (JSC::DFG::performOSREntrypointCreation):
      * dfg/DFGOSREntrypointCreationPhase.h: Added.
      * dfg/DFGOperations.cpp:
      * dfg/DFGOperations.h:
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::compileInThread):
      (JSC::DFG::Plan::compileInThreadImpl):
      * dfg/DFGPlan.h:
      * dfg/DFGPredictionInjectionPhase.cpp:
      (JSC::DFG::PredictionInjectionPhase::run):
      * dfg/DFGPredictionPropagationPhase.cpp:
      (JSC::DFG::PredictionPropagationPhase::propagate):
      * dfg/DFGSafeToExecute.h:
      (JSC::DFG::safeToExecute):
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGTierUpCheckInjectionPhase.cpp: Added.
      (JSC::DFG::TierUpCheckInjectionPhase::TierUpCheckInjectionPhase):
      (JSC::DFG::TierUpCheckInjectionPhase::run):
      (JSC::DFG::performTierUpCheckInjection):
      * dfg/DFGTierUpCheckInjectionPhase.h: Added.
      * dfg/DFGToFTLDeferredCompilationCallback.cpp: Added.
      (JSC::DFG::ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback):
      (JSC::DFG::ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback):
      (JSC::DFG::ToFTLDeferredCompilationCallback::create):
      (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
      (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
      * dfg/DFGToFTLDeferredCompilationCallback.h: Added.
      * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp: Added.
      (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
      (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::~ToFTLForOSREntryDeferredCompilationCallback):
      (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::create):
      (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
      (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
      * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h: Added.
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::globalWorklist):
      * dfg/DFGWorklist.h:
      * ftl/FTLCapabilities.cpp:
      (JSC::FTL::canCompile):
      * ftl/FTLCapabilities.h:
      * ftl/FTLForOSREntryJITCode.cpp: Added.
      (JSC::FTL::ForOSREntryJITCode::ForOSREntryJITCode):
      (JSC::FTL::ForOSREntryJITCode::~ForOSREntryJITCode):
      (JSC::FTL::ForOSREntryJITCode::ftlForOSREntry):
      (JSC::FTL::ForOSREntryJITCode::initializeEntryBuffer):
      * ftl/FTLForOSREntryJITCode.h: Added.
      (JSC::FTL::ForOSREntryJITCode::entryBuffer):
      (JSC::FTL::ForOSREntryJITCode::setBytecodeIndex):
      (JSC::FTL::ForOSREntryJITCode::bytecodeIndex):
      (JSC::FTL::ForOSREntryJITCode::countEntryFailure):
      (JSC::FTL::ForOSREntryJITCode::entryFailureCount):
      * ftl/FTLJITFinalizer.cpp:
      (JSC::FTL::JITFinalizer::finalizeFunction):
      * ftl/FTLLink.cpp:
      (JSC::FTL::link):
      * ftl/FTLLowerDFGToLLVM.cpp:
      (JSC::FTL::LowerDFGToLLVM::compileBlock):
      (JSC::FTL::LowerDFGToLLVM::compileNode):
      (JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
      (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
      (JSC::FTL::LowerDFGToLLVM::addWeakReference):
      * ftl/FTLOSREntry.cpp: Added.
      (JSC::FTL::prepareOSREntry):
      * ftl/FTLOSREntry.h: Added.
      * ftl/FTLOutput.h:
      (JSC::FTL::Output::crashNonTerminal):
      (JSC::FTL::Output::crash):
      * ftl/FTLState.cpp:
      (JSC::FTL::State::State):
      * interpreter/Register.h:
      (JSC::Register::unboxedDouble):
      * jit/JIT.cpp:
      (JSC::JIT::emitEnterOptimizationCheck):
      * jit/JITCode.cpp:
      (JSC::JITCode::ftlForOSREntry):
      * jit/JITCode.h:
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::newReplacementCodeBlockFor):
      * runtime/Options.h:
      * runtime/VM.cpp:
      (JSC::VM::ensureWorklist):
      * runtime/VM.h:
      
      LayoutTests: 
      
      Reviewed by Mark Hahnenberg.
              
      Fix marsaglia to check the result instead of printing, and add a second
      version that relies on OSR entry.
      
      * fast/js/regress/marsaglia-osr-entry-expected.txt: Added.
      * fast/js/regress/marsaglia-osr-entry.html: Added.
      * fast/js/regress/script-tests/marsaglia-osr-entry.js: Added.
      (marsaglia):
      * fast/js/regress/script-tests/marsaglia.js:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155023 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      532f1e51
  13. 03 Sep, 2013 2 commits
    • fpizlo@apple.com's avatar
      CodeBlock memory cost reporting should be rationalized · 7c084e07
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120615
      
      Source/JavaScriptCore: 
      
      Reviewed by Darin Adler.
              
      Report the size of the instruction stream, and then remind the GC that we're
      using memory when we trace.
              
      This is a slight slow-down on some JSBench tests because it makes us GC a
      bit more frequently. But I think it's well worth it; if we really want those
      tests to GC less frequently then we can achieve that through other kinds of
      tuning. It's better that the GC knows that CodeBlocks do in fact use memory;
      what it does with that information is a somewhat orthogonal question.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::visitAggregate):
      
      Source/WTF: 
      
      Reviewed by Darin Adler.
      
      * wtf/RefCountedArray.h:
      (WTF::RefCountedArray::refCount):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155021 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      7c084e07
    • fpizlo@apple.com's avatar
      CodeBlock::jettison() should be implicit · 195d7b84
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120567
      
      Reviewed by Oliver Hunt.
              
      This is a risky change from a performance standpoint, but I believe it's
      necessary. This makes all CodeBlocks get swept by GC. Nobody but the GC
      can delete CodeBlocks because the GC always holds a reference to them.
      Once a CodeBlock reaches just one reference (i.e. the one from the GC)
      then the GC will free it only if it's not on the stack.
              
      This allows me to get rid of the jettisoning logic. We need this for FTL
      tier-up. Well; we don't need it, but it will help prevent a lot of bugs.
      Previously, if you wanted to to replace one code block with another, you
      had to remember to tell the GC that the previous code block is
      "jettisoned". We would need to do this when tiering up from DFG to FTL
      and when dealing with DFG-to-FTL OSR entry code blocks. There are a lot
      of permutations here - tiering up to the FTL, OSR entering into the FTL,
      deciding that an OSR entry code block is not relevant anymore - just to
      name a few. In each of these cases we'd have to jettison the previous
      code block. It smells like a huge source of future bugs.
              
      So I made jettisoning implicit by making the GC always watch out for a
      CodeBlock being owned solely by the GC.
              
      This change is performance neutral.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::~CodeBlock):
      (JSC::CodeBlock::visitAggregate):
      (JSC::CodeBlock::jettison):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::setJITCode):
      (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
      (JSC::CodeBlockSet::mark):
      * dfg/DFGCommonData.h:
      (JSC::DFG::CommonData::CommonData):
      * heap/CodeBlockSet.cpp: Added.
      (JSC::CodeBlockSet::CodeBlockSet):
      (JSC::CodeBlockSet::~CodeBlockSet):
      (JSC::CodeBlockSet::add):
      (JSC::CodeBlockSet::clearMarks):
      (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
      (JSC::CodeBlockSet::traceMarked):
      * heap/CodeBlockSet.h: Added.
      * heap/ConservativeRoots.cpp:
      (JSC::ConservativeRoots::add):
      * heap/ConservativeRoots.h:
      * heap/DFGCodeBlocks.cpp: Removed.
      * heap/DFGCodeBlocks.h: Removed.
      * heap/Heap.cpp:
      (JSC::Heap::markRoots):
      (JSC::Heap::deleteAllCompiledCode):
      (JSC::Heap::deleteUnmarkedCompiledCode):
      * heap/Heap.h:
      * interpreter/JSStack.cpp:
      (JSC::JSStack::gatherConservativeRoots):
      * interpreter/JSStack.h:
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::installCode):
      * runtime/Executable.h:
      * runtime/VM.h:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154986 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      195d7b84
  14. 31 Aug, 2013 1 commit
    • fpizlo@apple.com's avatar
      CodeBlock refactoring broke profile dumping · 669223d4
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120551
      
      Reviewed by Michael Saboff.
              
      Fix the bug, and did a big clean-up of how Executable returns CodeBlocks. A lot
      of the problems we have with code like CodeBlock::baselineVersion() is that we
      were trying *way too hard* to side-step the fact that Executable can't return a
      CodeBlock*. Previously it could only return CodeBlock&, so if it didn't have a
      CodeBlock yet, you were screwed. And if you didn't know, or weren't sure, if it
      did have a CodeBlock, you were really going to have a bad time. Also it really
      bugs me that the methods were called generatedBytecode(). In all other contexts
      if you ask for a CodeBlock, then method to call is codeBlock(). So I made all
      of those changes.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::baselineVersion):
      (JSC::ProgramCodeBlock::replacement):
      (JSC::EvalCodeBlock::replacement):
      (JSC::FunctionCodeBlock::replacement):
      (JSC::CodeBlock::globalObjectFor):
      * bytecode/CodeOrigin.cpp:
      (JSC::InlineCallFrame::hash):
      * dfg/DFGOperations.cpp:
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::execute):
      (JSC::Interpreter::executeCall):
      (JSC::Interpreter::executeConstruct):
      (JSC::Interpreter::prepareForRepeatCall):
      * jit/JITCode.h:
      (JSC::JITCode::isExecutableScript):
      (JSC::JITCode::isLowerTier):
      * jit/JITStubs.cpp:
      (JSC::lazyLinkFor):
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::traceFunctionPrologue):
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      (JSC::LLInt::setUpCall):
      * runtime/ArrayPrototype.cpp:
      (JSC::isNumericCompareFunction):
      * runtime/CommonSlowPaths.h:
      (JSC::CommonSlowPaths::arityCheckFor):
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::installCode):
      * runtime/Executable.h:
      (JSC::EvalExecutable::codeBlock):
      (JSC::ProgramExecutable::codeBlock):
      (JSC::FunctionExecutable::eitherCodeBlock):
      (JSC::FunctionExecutable::codeBlockForCall):
      (JSC::FunctionExecutable::codeBlockForConstruct):
      (JSC::FunctionExecutable::codeBlockFor):
      * runtime/FunctionExecutableDump.cpp:
      (JSC::FunctionExecutableDump::dump):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154935 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      669223d4
  15. 29 Aug, 2013 6 commits
    • akling@apple.com's avatar
      CodeBlock: LLIntCallLinkInfo vector can be sized-to-fit at creation. · 8b46ebcf
      akling@apple.com authored
      <https://webkit.org/b/120487>
      
      Reviewed by Oliver Hunt.
      
      CodeBlock::m_llintCallLinkInfos never changes size after creation, so make it a Vector
      instead of a SegmentedVector. Use resizeToFit() instead of grow() since we know the
      exact amount of space needed.
      
      * bytecode/CodeBlock.h:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::shrinkToFit):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154863 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      8b46ebcf
    • fpizlo@apple.com's avatar
      Teach DFG::Worklist and its clients that it may be reused for different kinds of compilations · 6931c476
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120489
      
      Reviewed by Geoffrey Garen.
              
      If the baseline JIT hits an OSR entry trigger into the DFG and we already have a
      DFG compilation but we've also started one or more FTL compilations, then we
      shouldn't get confused. Previously we would have gotten confused because we would
      see an in-process deferred compile (the FTL compile) and also an optimized
      replacement (the DFG code).
              
      If the baseline JIT hits an OSR entry trigger into the DFG and we previously
      did two things in this order: triggered a tier-up compilation from the DFG into
      the FTL, and then jettisoned the DFG code because it exited a bunch, then we
      shouldn't be confused by the presence of an in-process deferred compile (the FTL
      compile). Previously we would have waited for that compile to finish; but the more
      sensible thing to do is to let it complete and then invalidate it, while at the
      same time enqueueing a DFG compile to create a new, more valid, DFG code block.
              
      If the DFG JIT hits a loop OSR entry trigger (into the FTL) and it has already
      triggered an FTL compile for replacement, then it should fire off a second compile
      instead of thinking that it can wait for that one to finish. Or vice-versa. We
      need to allow for two FTL compiles to be enqueued at the same time (one for
      replacement and one for OSR entry in a loop).
              
      Then there's also the problem that DFG::compile() is almost certainly going to be
      the hook for triggering both DFG compiles and the two kinds of FTL compiles, but
      right now there is no way to tell it which one you want.
              
      This fixes these problems and removes a bunch of potential confusion by making the
      key for a compile in the DFG::Worklist be a CompilationMode (one of DFGMode,
      FTLMode, or FTLForOSREntryMode). That mode is also passed to DFG::compile().
              
      Awkwardly, this still leaves us in a no DFG->FTL tier-up situation - so
      DFG::compile() is always passed DFGMode and then it might do an FTL compile if
      possible. Fixing that is a bigger issue for a later changeset.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::checkIfOptimizationThresholdReached):
      * dfg/DFGCompilationKey.cpp: Added.
      (JSC::DFG::CompilationKey::dump):
      * dfg/DFGCompilationKey.h: Added.
      (JSC::DFG::CompilationKey::CompilationKey):
      (JSC::DFG::CompilationKey::operator!):
      (JSC::DFG::CompilationKey::isHashTableDeletedValue):
      (JSC::DFG::CompilationKey::profiledBlock):
      (JSC::DFG::CompilationKey::mode):
      (JSC::DFG::CompilationKey::operator==):
      (JSC::DFG::CompilationKey::hash):
      (JSC::DFG::CompilationKeyHash::hash):
      (JSC::DFG::CompilationKeyHash::equal):
      * dfg/DFGCompilationMode.cpp: Added.
      (WTF::printInternal):
      * dfg/DFGCompilationMode.h: Added.
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compileImpl):
      (JSC::DFG::compile):
      * dfg/DFGDriver.h:
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::key):
      * dfg/DFGPlan.h:
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::Worklist::enqueue):
      (JSC::DFG::Worklist::compilationState):
      (JSC::DFG::Worklist::completeAllReadyPlansForVM):
      (JSC::DFG::Worklist::runThread):
      * dfg/DFGWorklist.h:
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154854 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      6931c476
    • fpizlo@apple.com's avatar
      CodeBlock's magic for scaling tier-up thresholds should be more reusable · e5b68643
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120486
      
      Reviewed by Oliver Hunt.
              
      Removed the counterValueForBlah() methods and exposed the reusable scaling logic
      as a adjustedCounterValue() method.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::adjustedCounterValue):
      (JSC::CodeBlock::optimizeAfterWarmUp):
      (JSC::CodeBlock::optimizeAfterLongWarmUp):
      (JSC::CodeBlock::optimizeSoon):
      * bytecode/CodeBlock.h:
      * dfg/DFGOSRExitCompilerCommon.cpp:
      (JSC::DFG::handleExitCounts):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154837 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e5b68643
    • fpizlo@apple.com's avatar
      CodeBlock::prepareForExecution() is silly · 1342e7a8
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120453
      
      Reviewed by Oliver Hunt.
              
      Instead of saying:
              
          codeBlock->prepareForExecution(stuff, BaselineJIT, more stuff)
              
      we should just say:
              
          JIT::compile(stuff, codeBlock, more stuff);
              
      And similarly for the LLInt and DFG.
              
      This kills a bunch of code, since CodeBlock::prepareForExecution() is just a
      wrapper that uses the JITType argument to call into the appropriate execution
      engine, which is what the user wanted to do in the first place.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      * bytecode/CodeBlock.h:
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compileImpl):
      (JSC::DFG::compile):
      * dfg/DFGDriver.h:
      (JSC::DFG::tryCompile):
      * dfg/DFGOSRExitPreparation.cpp:
      (JSC::DFG::prepareCodeOriginForOSRExit):
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::globalWorklist):
      * dfg/DFGWorklist.h:
      * jit/JIT.cpp:
      (JSC::JIT::privateCompile):
      * jit/JIT.h:
      (JSC::JIT::compile):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntEntrypoint.cpp: Copied from Source/JavaScriptCore/llint/LLIntEntrypoints.cpp.
      (JSC::LLInt::setFunctionEntrypoint):
      (JSC::LLInt::setEvalEntrypoint):
      (JSC::LLInt::setProgramEntrypoint):
      (JSC::LLInt::setEntrypoint):
      * llint/LLIntEntrypoint.h: Copied from Source/JavaScriptCore/llint/LLIntEntrypoints.h.
      * llint/LLIntEntrypoints.cpp: Removed.
      * llint/LLIntEntrypoints.h: Removed.
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::jitCompileAndSetHeuristics):
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::prepareForExecutionImpl):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154833 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      1342e7a8
    • fpizlo@apple.com's avatar
      CodeBlock compilation and installation should be simplified and rationalized · 62b6af85
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120326
      
      Reviewed by Oliver Hunt.
              
      Rolling r154804 back in after fixing no-LLInt build.
              
      Previously Executable owned the code for generating JIT code; you always had
      to go through Executable. But often you also had to go through CodeBlock,
      because ScriptExecutable couldn't have virtual methods, but CodeBlock could.
      So you'd ask CodeBlock to do something, which would dispatch through a
      virtual method that would select the appropriate Executable subtype's method.
      This all meant that the same code would often be duplicated, because most of
      the work needed to compile something was identical regardless of code type.
      But then we tried to fix this, by having templatized helpers in
      ExecutionHarness.h and JITDriver.h. The result was that if you wanted to find
      out what happened when you asked for something to be compiled, you'd go on a
      wild ride that started with CodeBlock, touched upon Executable, and then
      ricocheted into either ExecutionHarness or JITDriver (likely both).
              
      Another awkwardness was that for concurrent compiles, the DFG::Worklist had
      super-special inside knowledge of what JITStubs.cpp's cti_optimize would have
      done once the compilation finished.
              
      Also, most of the DFG JIT drivers assumed that they couldn't install the
      JITCode into the CodeBlock directly - instead they would return it via a
      reference, which happened to be a reference to the JITCode pointer in
      Executable. This was super weird.
              
      Finally, there was no notion of compiling code into a special CodeBlock that
      wasn't used for handling calls into an Executable. I'd like this for FTL OSR
      entry.
              
      This patch solves these problems by reducing all of that complexity into just
      three primitives:
              
      - Executable::newCodeBlock(). This gives you a new code block, either for call
        or for construct, and either to serve as the baseline code or the optimized
        code. The new code block is then owned by the caller; Executable doesn't
        register it anywhere. The new code block has no JITCode and isn't callable,
        but it has all of the bytecode.
              
      - CodeBlock::prepareForExecution(). This takes the CodeBlock's bytecode and
        produces a JITCode, and then installs the JITCode into the CodeBlock. This
        method takes a JITType, and always compiles with that JIT. If you ask for
        JITCode::InterpreterThunk then you'll get JITCode that just points to the
        LLInt entrypoints. Once this returns, it is possible to call into the
        CodeBlock if you do so manually - but the Executable still won't know about
        it so JS calls to that Executable will still be routed to whatever CodeBlock
        is associated with the Executable.
              
      - Executable::installCode(). This takes a CodeBlock and makes it the code-for-
        entry for that Executable. This involves unlinking the Executable's last
        CodeBlock, if there was one. This also tells the GC about any effect on
        memory usage and does a bunch of weird data structure rewiring, since
        Executable caches some of CodeBlock's fields for the benefit of virtual call
        fast paths.
              
      This functionality is then wrapped around three convenience methods:
              
      - Executable::prepareForExecution(). If there is no code block for that
        Executable, then one is created (newCodeBlock()), compiled
        (CodeBlock::prepareForExecution()) and installed (installCode()).
              
      - CodeBlock::newReplacement(). Asks the Executable for a new CodeBlock that
        can serve as an optimized replacement of the current one.
              
      - CodeBlock::install(). Asks the Executable to install this code block.
              
      This patch allows me to kill *a lot* of code and to remove a lot of
      specializations for functions vs. not-functions, and a lot of places where we
      pass around JITCode references and such. ExecutionHarness and JITDriver are
      both gone. Overall this patch has more red than green.
              
      It also allows me to work on FTL OSR entry and tier-up:
              
      - FTL tier-up: this will involve DFGOperations.cpp asking the DFG::Worklist
        to do some compilation, but it will require the DFG::Worklist to do
        something different than what JITStubs.cpp would want, once the compilation
        finishes. This patch introduces a callback mechanism for that purpose.
              
      - FTL OSR entry: this will involve creating a special auto-jettisoned
        CodeBlock that is used only for FTL OSR entry. The new set of primitives
        allows for this: Executable can vend you a fresh new CodeBlock, and you can
        ask that CodeBlock to compile itself with any JIT of your choosing. Or you
        can take that CodeBlock and compile it yourself. Previously the act of
        producing a CodeBlock-for-optimization and the act of compiling code for it
        were tightly coupled; now you can separate them and you can create such
        auto-jettisoned CodeBlocks that are used for a one-shot OSR entry.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::unlinkIncomingCalls):
      (JSC::CodeBlock::prepareForExecutionImpl):
      (JSC::CodeBlock::prepareForExecution):
      (JSC::CodeBlock::prepareForExecutionAsynchronously):
      (JSC::CodeBlock::install):
      (JSC::CodeBlock::newReplacement):
      (JSC::FunctionCodeBlock::jettisonImpl):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::hasBaselineJITProfiling):
      * bytecode/DeferredCompilationCallback.cpp: Added.
      (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
      (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
      * bytecode/DeferredCompilationCallback.h: Added.
      * dfg/DFGDriver.cpp:
      (JSC::DFG::tryCompile):
      * dfg/DFGDriver.h:
      (JSC::DFG::tryCompile):
      * dfg/DFGFailedFinalizer.cpp:
      (JSC::DFG::FailedFinalizer::finalize):
      (JSC::DFG::FailedFinalizer::finalizeFunction):
      * dfg/DFGFailedFinalizer.h:
      * dfg/DFGFinalizer.h:
      * dfg/DFGJITFinalizer.cpp:
      (JSC::DFG::JITFinalizer::finalize):
      (JSC::DFG::JITFinalizer::finalizeFunction):
      * dfg/DFGJITFinalizer.h:
      * dfg/DFGOSRExitPreparation.cpp:
      (JSC::DFG::prepareCodeOriginForOSRExit):
      * dfg/DFGOperations.cpp:
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::compileInThreadImpl):
      (JSC::DFG::Plan::notifyReady):
      (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
      (JSC::DFG::Plan::finalizeAndNotifyCallback):
      * dfg/DFGPlan.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::Worklist::completeAllReadyPlansForVM):
      (JSC::DFG::Worklist::runThread):
      * ftl/FTLJITFinalizer.cpp:
      (JSC::FTL::JITFinalizer::finalize):
      (JSC::FTL::JITFinalizer::finalizeFunction):
      * ftl/FTLJITFinalizer.h:
      * heap/Heap.h:
      (JSC::Heap::isDeferred):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::execute):
      (JSC::Interpreter::executeCall):
      (JSC::Interpreter::executeConstruct):
      (JSC::Interpreter::prepareForRepeatCall):
      * jit/JITDriver.h: Removed.
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC::jitCompileFor):
      (JSC::lazyLinkFor):
      * jit/JITToDFGDeferredCompilationCallback.cpp: Added.
      (JSC::JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback):
      (JSC::JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback):
      (JSC::JITToDFGDeferredCompilationCallback::create):
      (JSC::JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
      (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
      * jit/JITToDFGDeferredCompilationCallback.h: Added.
      * llint/LLIntEntrypoints.cpp:
      (JSC::LLInt::setFunctionEntrypoint):
      (JSC::LLInt::setEvalEntrypoint):
      (JSC::LLInt::setProgramEntrypoint):
      * llint/LLIntEntrypoints.h:
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::jitCompileAndSetHeuristics):
      (JSC::LLInt::setUpCall):
      * runtime/ArrayPrototype.cpp:
      (JSC::isNumericCompareFunction):
      * runtime/CommonSlowPaths.cpp:
      * runtime/CompilationResult.cpp:
      (WTF::printInternal):
      * runtime/CompilationResult.h:
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::installCode):
      (JSC::ScriptExecutable::newCodeBlockFor):
      (JSC::ScriptExecutable::newReplacementCodeBlockFor):
      (JSC::ScriptExecutable::prepareForExecutionImpl):
      * runtime/Executable.h:
      (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
      (JSC::ExecutableBase::offsetOfNumParametersFor):
      (JSC::ScriptExecutable::prepareForExecution):
      (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
      * runtime/ExecutionHarness.h: Removed.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154824 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      62b6af85
    • commit-queue@webkit.org's avatar
      Unreviewed, rolling out r154804. · ea1f9022
      commit-queue@webkit.org authored
      http://trac.webkit.org/changeset/154804
      https://bugs.webkit.org/show_bug.cgi?id=120477
      
      Broke Windows build (assumes LLInt features not enabled on
      this build) (Requested by bfulgham on #webkit).
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::linkIncomingCall):
      (JSC::CodeBlock::unlinkIncomingCalls):
      (JSC::CodeBlock::reoptimize):
      (JSC::ProgramCodeBlock::replacement):
      (JSC::EvalCodeBlock::replacement):
      (JSC::FunctionCodeBlock::replacement):
      (JSC::ProgramCodeBlock::compileOptimized):
      (JSC::ProgramCodeBlock::replaceWithDeferredOptimizedCode):
      (JSC::EvalCodeBlock::compileOptimized):
      (JSC::EvalCodeBlock::replaceWithDeferredOptimizedCode):
      (JSC::FunctionCodeBlock::compileOptimized):
      (JSC::FunctionCodeBlock::replaceWithDeferredOptimizedCode):
      (JSC::ProgramCodeBlock::jitCompileImpl):
      (JSC::EvalCodeBlock::jitCompileImpl):
      (JSC::FunctionCodeBlock::jitCompileImpl):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::jitType):
      (JSC::CodeBlock::jitCompile):
      * bytecode/DeferredCompilationCallback.cpp: Removed.
      * bytecode/DeferredCompilationCallback.h: Removed.
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compile):
      (JSC::DFG::tryCompile):
      (JSC::DFG::tryCompileFunction):
      (JSC::DFG::tryFinalizePlan):
      * dfg/DFGDriver.h:
      (JSC::DFG::tryCompile):
      (JSC::DFG::tryCompileFunction):
      (JSC::DFG::tryFinalizePlan):
      * dfg/DFGFailedFinalizer.cpp:
      (JSC::DFG::FailedFinalizer::finalize):
      (JSC::DFG::FailedFinalizer::finalizeFunction):
      * dfg/DFGFailedFinalizer.h:
      * dfg/DFGFinalizer.h:
      * dfg/DFGJITFinalizer.cpp:
      (JSC::DFG::JITFinalizer::finalize):
      (JSC::DFG::JITFinalizer::finalizeFunction):
      * dfg/DFGJITFinalizer.h:
      * dfg/DFGOSRExitPreparation.cpp:
      (JSC::DFG::prepareCodeOriginForOSRExit):
      * dfg/DFGOperations.cpp:
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::compileInThreadImpl):
      (JSC::DFG::Plan::finalize):
      * dfg/DFGPlan.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::Worklist::completeAllReadyPlansForVM):
      (JSC::DFG::Worklist::runThread):
      * ftl/FTLJITFinalizer.cpp:
      (JSC::FTL::JITFinalizer::finalize):
      (JSC::FTL::JITFinalizer::finalizeFunction):
      * ftl/FTLJITFinalizer.h:
      * heap/Heap.h:
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::execute):
      (JSC::Interpreter::executeCall):
      (JSC::Interpreter::executeConstruct):
      (JSC::Interpreter::prepareForRepeatCall):
      * jit/JITDriver.h: Added.
      (JSC::jitCompileIfAppropriateImpl):
      (JSC::jitCompileFunctionIfAppropriateImpl):
      (JSC::jitCompileIfAppropriate):
      (JSC::jitCompileFunctionIfAppropriate):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC::jitCompileFor):
      (JSC::lazyLinkFor):
      * jit/JITToDFGDeferredCompilationCallback.cpp: Removed.
      * jit/JITToDFGDeferredCompilationCallback.h: Removed.
      * llint/LLIntEntrypoints.cpp:
      (JSC::LLInt::getFunctionEntrypoint):
      (JSC::LLInt::getEvalEntrypoint):
      (JSC::LLInt::getProgramEntrypoint):
      * llint/LLIntEntrypoints.h:
      (JSC::LLInt::getEntrypoint):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::jitCompileAndSetHeuristics):
      (JSC::LLInt::setUpCall):
      * runtime/ArrayPrototype.cpp:
      (JSC::isNumericCompareFunction):
      * runtime/CommonSlowPaths.cpp:
      * runtime/CompilationResult.cpp:
      (WTF::printInternal):
      * runtime/CompilationResult.h:
      * runtime/Executable.cpp:
      (JSC::EvalExecutable::compileOptimized):
      (JSC::EvalExecutable::jitCompile):
      (JSC::EvalExecutable::compileInternal):
      (JSC::EvalExecutable::replaceWithDeferredOptimizedCode):
      (JSC::ProgramExecutable::compileOptimized):
      (JSC::ProgramExecutable::jitCompile):
      (JSC::ProgramExecutable::compileInternal):
      (JSC::ProgramExecutable::replaceWithDeferredOptimizedCode):
      (JSC::FunctionExecutable::compileOptimizedForCall):
      (JSC::FunctionExecutable::compileOptimizedForConstruct):
      (JSC::FunctionExecutable::jitCompileForCall):
      (JSC::FunctionExecutable::jitCompileForConstruct):
      (JSC::FunctionExecutable::produceCodeBlockFor):
      (JSC::FunctionExecutable::compileForCallInternal):
      (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForCall):
      (JSC::FunctionExecutable::compileForConstructInternal):
      (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForConstruct):
      * runtime/Executable.h:
      (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
      (JSC::ExecutableBase::offsetOfNumParametersFor):
      (JSC::ExecutableBase::catchRoutineFor):
      (JSC::EvalExecutable::compile):
      (JSC::ProgramExecutable::compile):
      (JSC::FunctionExecutable::compileForCall):
      (JSC::FunctionExecutable::compileForConstruct):
      (JSC::FunctionExecutable::compileFor):
      (JSC::FunctionExecutable::compileOptimizedFor):
      (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeFor):
      (JSC::FunctionExecutable::jitCompileFor):
      * runtime/ExecutionHarness.h: Added.
      (JSC::prepareForExecutionImpl):
      (JSC::prepareFunctionForExecutionImpl):
      (JSC::installOptimizedCode):
      (JSC::prepareForExecution):
      (JSC::prepareFunctionForExecution):
      (JSC::replaceWithDeferredOptimizedCode):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154814 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      ea1f9022
  16. 28 Aug, 2013 1 commit
    • fpizlo@apple.com's avatar
      CodeBlock compilation and installation should be simplified and rationalized · 4ea262e2
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=120326
      
      Reviewed by Oliver Hunt.
              
      Previously Executable owned the code for generating JIT code; you always had
      to go through Executable. But often you also had to go through CodeBlock,
      because ScriptExecutable couldn't have virtual methods, but CodeBlock could.
      So you'd ask CodeBlock to do something, which would dispatch through a
      virtual method that would select the appropriate Executable subtype's method.
      This all meant that the same code would often be duplicated, because most of
      the work needed to compile something was identical regardless of code type.
      But then we tried to fix this, by having templatized helpers in
      ExecutionHarness.h and JITDriver.h. The result was that if you wanted to find
      out what happened when you asked for something to be compiled, you'd go on a
      wild ride that started with CodeBlock, touched upon Executable, and then
      ricocheted into either ExecutionHarness or JITDriver (likely both).
              
      Another awkwardness was that for concurrent compiles, the DFG::Worklist had
      super-special inside knowledge of what JITStubs.cpp's cti_optimize would have
      done once the compilation finished.
              
      Also, most of the DFG JIT drivers assumed that they couldn't install the
      JITCode into the CodeBlock directly - instead they would return it via a
      reference, which happened to be a reference to the JITCode pointer in
      Executable. This was super weird.
              
      Finally, there was no notion of compiling code into a special CodeBlock that
      wasn't used for handling calls into an Executable. I'd like this for FTL OSR
      entry.
              
      This patch solves these problems by reducing all of that complexity into just
      three primitives:
              
      - Executable::newCodeBlock(). This gives you a new code block, either for call
        or for construct, and either to serve as the baseline code or the optimized
        code. The new code block is then owned by the caller; Executable doesn't
        register it anywhere. The new code block has no JITCode and isn't callable,
        but it has all of the bytecode.
              
      - CodeBlock::prepareForExecution(). This takes the CodeBlock's bytecode and
        produces a JITCode, and then installs the JITCode into the CodeBlock. This
        method takes a JITType, and always compiles with that JIT. If you ask for
        JITCode::InterpreterThunk then you'll get JITCode that just points to the
        LLInt entrypoints. Once this returns, it is possible to call into the
        CodeBlock if you do so manually - but the Executable still won't know about
        it so JS calls to that Executable will still be routed to whatever CodeBlock
        is associated with the Executable.
              
      - Executable::installCode(). This takes a CodeBlock and makes it the code-for-
        entry for that Executable. This involves unlinking the Executable's last
        CodeBlock, if there was one. This also tells the GC about any effect on
        memory usage and does a bunch of weird data structure rewiring, since
        Executable caches some of CodeBlock's fields for the benefit of virtual call
        fast paths.
              
      This functionality is then wrapped around three convenience methods:
              
      - Executable::prepareForExecution(). If there is no code block for that
        Executable, then one is created (newCodeBlock()), compiled
        (CodeBlock::prepareForExecution()) and installed (installCode()).
              
      - CodeBlock::newReplacement(). Asks the Executable for a new CodeBlock that
        can serve as an optimized replacement of the current one.
              
      - CodeBlock::install(). Asks the Executable to install this code block.
              
      This patch allows me to kill *a lot* of code and to remove a lot of
      specializations for functions vs. not-functions, and a lot of places where we
      pass around JITCode references and such. ExecutionHarness and JITDriver are
      both gone. Overall this patch has more red than green.
              
      It also allows me to work on FTL OSR entry and tier-up:
              
      - FTL tier-up: this will involve DFGOperations.cpp asking the DFG::Worklist
        to do some compilation, but it will require the DFG::Worklist to do
        something different than what JITStubs.cpp would want, once the compilation
        finishes. This patch introduces a callback mechanism for that purpose.
              
      - FTL OSR entry: this will involve creating a special auto-jettisoned
        CodeBlock that is used only for FTL OSR entry. The new set of primitives
        allows for this: Executable can vend you a fresh new CodeBlock, and you can
        ask that CodeBlock to compile itself with any JIT of your choosing. Or you
        can take that CodeBlock and compile it yourself. Previously the act of
        producing a CodeBlock-for-optimization and the act of compiling code for it
        were tightly coupled; now you can separate them and you can create such
        auto-jettisoned CodeBlocks that are used for a one-shot OSR entry.
      
      * CMakeLists.txt:
      * GNUmakefile.list.am:
      * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * Target.pri:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::prepareForExecution):
      (JSC::CodeBlock::install):
      (JSC::CodeBlock::newReplacement):
      (JSC::FunctionCodeBlock::jettisonImpl):
      (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::hasBaselineJITProfiling):
      * bytecode/DeferredCompilationCallback.cpp: Added.
      (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
      (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
      * bytecode/DeferredCompilationCallback.h: Added.
      * dfg/DFGDriver.cpp:
      (JSC::DFG::tryCompile):
      * dfg/DFGDriver.h:
      (JSC::DFG::tryCompile):
      * dfg/DFGFailedFinalizer.cpp:
      (JSC::DFG::FailedFinalizer::finalize):
      (JSC::DFG::FailedFinalizer::finalizeFunction):
      * dfg/DFGFailedFinalizer.h:
      * dfg/DFGFinalizer.h:
      * dfg/DFGJITFinalizer.cpp:
      (JSC::DFG::JITFinalizer::finalize):
      (JSC::DFG::JITFinalizer::finalizeFunction):
      * dfg/DFGJITFinalizer.h:
      * dfg/DFGOSRExitPreparation.cpp:
      (JSC::DFG::prepareCodeOriginForOSRExit):
      * dfg/DFGOperations.cpp:
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::compileInThreadImpl):
      (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
      (JSC::DFG::Plan::finalizeAndNotifyCallback):
      * dfg/DFGPlan.h:
      * dfg/DFGWorklist.cpp:
      (JSC::DFG::Worklist::completeAllReadyPlansForVM):
      * ftl/FTLJITFinalizer.cpp:
      (JSC::FTL::JITFinalizer::finalize):
      (JSC::FTL::JITFinalizer::finalizeFunction):
      * ftl/FTLJITFinalizer.h:
      * heap/Heap.h:
      (JSC::Heap::isDeferred):
      * interpreter/Interpreter.cpp:
      (JSC::Interpreter::execute):
      (JSC::Interpreter::executeCall):
      (JSC::Interpreter::executeConstruct):
      (JSC::Interpreter::prepareForRepeatCall):
      * jit/JITDriver.h: Removed.
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      (JSC::jitCompileFor):
      (JSC::lazyLinkFor):
      * jit/JITToDFGDeferredCompilationCallback.cpp: Added.
      (JSC::JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback):
      (JSC::JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback):
      (JSC::JITToDFGDeferredCompilationCallback::create):
      (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
      * jit/JITToDFGDeferredCompilationCallback.h: Added.
      * llint/LLIntEntrypoints.cpp:
      (JSC::LLInt::setFunctionEntrypoint):
      (JSC::LLInt::setEvalEntrypoint):
      (JSC::LLInt::setProgramEntrypoint):
      * llint/LLIntEntrypoints.h:
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::jitCompileAndSetHeuristics):
      (JSC::LLInt::setUpCall):
      * runtime/ArrayPrototype.cpp:
      (JSC::isNumericCompareFunction):
      * runtime/CommonSlowPaths.cpp:
      * runtime/CompilationResult.cpp:
      (WTF::printInternal):
      * runtime/CompilationResult.h:
      * runtime/Executable.cpp:
      (JSC::ScriptExecutable::installCode):
      (JSC::ScriptExecutable::newCodeBlockFor):
      (JSC::ScriptExecutable::newReplacementCodeBlockFor):
      (JSC::ScriptExecutable::prepareForExecutionImpl):
      * runtime/Executable.h:
      (JSC::ScriptExecutable::prepareForExecution):
      (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
      * runtime/ExecutionHarness.h: Removed.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154804 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      4ea262e2
  17. 15 Aug, 2013 2 commits
    • mhahnenberg@apple.com's avatar
      <https://webkit.org/b/119833> Concurrent compilation thread should not trigger WriteBarriers · 941ab380
      mhahnenberg@apple.com authored
      Reviewed by Oliver Hunt.
      
      The concurrent compilation thread should interact minimally with the Heap, including not
      triggering WriteBarriers. This is a prerequisite for generational GC.
      
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::addOrFindConstant):
      (JSC::CodeBlock::findConstant):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::addConstantLazily):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::getJSConstantForValue):
      (JSC::DFG::ByteCodeParser::constantUndefined):
      (JSC::DFG::ByteCodeParser::constantNull):
      (JSC::DFG::ByteCodeParser::one):
      (JSC::DFG::ByteCodeParser::constantNaN):
      (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
      * dfg/DFGCommonData.cpp:
      (JSC::DFG::CommonData::notifyCompilingStructureTransition):
      * dfg/DFGCommonData.h:
      * dfg/DFGDesiredTransitions.cpp: Added.
      (JSC::DFG::DesiredTransition::DesiredTransition):
      (JSC::DFG::DesiredTransition::reallyAdd):
      (JSC::DFG::DesiredTransitions::DesiredTransitions):
      (JSC::DFG::DesiredTransitions::~DesiredTransitions):
      (JSC::DFG::DesiredTransitions::addLazily):
      (JSC::DFG::DesiredTransitions::reallyAdd):
      * dfg/DFGDesiredTransitions.h: Added.
      * dfg/DFGDesiredWeakReferences.cpp: Added.
      (JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
      (JSC::DFG::DesiredWeakReferences::~DesiredWeakReferences):
      (JSC::DFG::DesiredWeakReferences::addLazily):
      (JSC::DFG::DesiredWeakReferences::reallyAdd):
      * dfg/DFGDesiredWeakReferences.h: Added.
      * dfg/DFGDesiredWriteBarriers.cpp: Added.
      (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
      (JSC::DFG::DesiredWriteBarrier::trigger):
      (JSC::DFG::DesiredWriteBarriers::DesiredWriteBarriers):
      (JSC::DFG::DesiredWriteBarriers::~DesiredWriteBarriers):
      (JSC::DFG::DesiredWriteBarriers::addImpl):
      (JSC::DFG::DesiredWriteBarriers::trigger):
      * dfg/DFGDesiredWriteBarriers.h: Added.
      (JSC::DFG::DesiredWriteBarriers::add):
      (JSC::DFG::initializeLazyWriteBarrier):
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::truncateConstantToInt32):
      * dfg/DFGGraph.h:
      (JSC::DFG::Graph::convertToConstant):
      * dfg/DFGJITCompiler.h:
      (JSC::DFG::JITCompiler::addWeakReference):
      * dfg/DFGPlan.cpp:
      (JSC::DFG::Plan::Plan):
      (JSC::DFG::Plan::reallyAdd):
      * dfg/DFGPlan.h:
      * dfg/DFGSpeculativeJIT32_64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::compile):
      * runtime/WriteBarrier.h:
      (JSC::WriteBarrierBase::set):
      (JSC::WriteBarrier::WriteBarrier):
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154162 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      941ab380
    • oliver@apple.com's avatar
      <https://webkit.org/b/119830> Assigning to a readonly global results in DFG byte code parse failure · 0053edb3
      oliver@apple.com authored
      Reviewed by Filip Pizlo.
      
      Source/JavaScriptCore:
      
      Make sure dfgCapabilities doesn't report a Dynamic put as
      being compilable when we don't actually support it.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpBytecode):
      * dfg/DFGCapabilities.cpp:
      (JSC::DFG::capabilityLevel):
      
      LayoutTests:
      
      Add a test
      
      * fast/js/dfg-put-to-readonly-property-expected.txt: Added.
      * fast/js/dfg-put-to-readonly-property.html: Added.
      * fast/js/script-tests/dfg-put-to-readonly-property.js: Added.
      (foo):
      (bar):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154120 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      0053edb3
  18. 12 Aug, 2013 1 commit
    • oliver@apple.com's avatar
      Stop making unnecessary copy of CodeBlock Identifier Vector · 9b652768
      oliver@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=119702
      
      Reviewed by Michael Saboff.
      
      Make CodeBlock simply use a separate Vector for additional Identifiers
      and use the UnlinkedCodeBlock for the initial set of identifiers.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::printGetByIdOp):
      (JSC::dumpStructure):
      (JSC::dumpChain):
      (JSC::CodeBlock::printGetByIdCacheStatus):
      (JSC::CodeBlock::printPutByIdOp):
      (JSC::CodeBlock::dumpBytecode):
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::shrinkToFit):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::numberOfIdentifiers):
      (JSC::CodeBlock::numberOfAdditionalIdentifiers):
      (JSC::CodeBlock::addAdditionalIdentifier):
      (JSC::CodeBlock::identifier):
      * dfg/DFGDesiredIdentifiers.cpp:
      (JSC::DFG::DesiredIdentifiers::reallyAdd):
      * jit/JIT.h:
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emitSlow_op_get_arguments_length):
      * jit/JITPropertyAccess.cpp:
      (JSC::JIT::emit_op_get_by_id):
      (JSC::JIT::compileGetByIdHotPath):
      (JSC::JIT::emitSlow_op_get_by_id):
      (JSC::JIT::compileGetByIdSlowCase):
      (JSC::JIT::emitSlow_op_put_by_id):
      * jit/JITPropertyAccess32_64.cpp:
      (JSC::JIT::emit_op_get_by_id):
      (JSC::JIT::compileGetByIdHotPath):
      (JSC::JIT::compileGetByIdSlowCase):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153962 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      9b652768
  19. 06 Aug, 2013 1 commit
    • fpizlo@apple.com's avatar
      DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray,... · ed63054a
      fpizlo@apple.com authored
      DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray, and SpeculativeJIT 64-bit should not try to coerce integer constants to double constants
      https://bugs.webkit.org/show_bug.cgi?id=119528
      
      Reviewed by Geoffrey Garen.
      
      Source/JavaScriptCore: 
      
      Either of the two fixes would solve the crash I saw. Basically, for best performance, we want the DFG register allocator to track double uses and non-double
      uses of a node separately, and we accomplish this by inserting Int32ToDouble nodes in the FixupPhase. But even if FixupPhase fails to do this, we still want
      the DFG register allocator to do the right thing: if it encounters a double use of an integer, it should perform a conversion and preserve the original
      format of the value (namely, that it was an integer). For constants, the best format to preserve is None, so that future integer uses rematerialize the int
      from scratch. This only affects the 64-bit backend; the 32-bit backend was already doing the right thing.
      
      This also fixes some more debug dumping code, and adds some stronger assertions for integer arrays.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::finalizeUnconditionally):
      * dfg/DFGDriver.cpp:
      (JSC::DFG::compile):
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::fixupNode):
      * dfg/DFGGraph.cpp:
      (JSC::DFG::Graph::dump):
      * dfg/DFGSpeculativeJIT64.cpp:
      (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
      * runtime/JSObject.h:
      (JSC::JSObject::getIndexQuickly):
      (JSC::JSObject::tryGetIndexQuickly):
      
      LayoutTests: 
      
      * fast/js/dfg-new-array-double-const-then-int-const.html: Added.
      * fast/js/dfg-new-array-double-const-then-int-const-expected.txt: Added.
      * fast/js/jsc-test-list:
      * fast/js/script-tests/dfg-new-array-double-const-then-int-const.js: Added.
      (bar):
      (foo):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153778 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      ed63054a
  20. 02 Aug, 2013 1 commit
  21. 30 Jul, 2013 1 commit
    • carlosgc@webkit.org's avatar
      Unreviewed. Fix make distcheck. · 13f6daf2
      carlosgc@webkit.org authored
      Source/JavaScriptCore:
      
      * GNUmakefile.list.am: Add missing files to compilation.
      * bytecode/CodeBlock.cpp: Add a ENABLE(FTL_JIT) #if block to
      include FTL header files not included in the compilation.
      * dfg/DFGDriver.cpp: Ditto.
      * dfg/DFGPlan.cpp: Ditto.
      
      Source/ThirdParty/ANGLE:
      
      * GNUmakefile.am: Add missing header files to compilation.
      
      Source/WebCore:
      
      * GNUmakefile.list.am: Add missing header file to compilation.
      
      Source/WebKit2:
      
      * GNUmakefile.list.am: Add missing header file to compilation.
      
      Source/WTF:
      
      * GNUmakefile.list.am: Add missing files to compilation.
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153460 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      13f6daf2
  22. 26 Jul, 2013 1 commit
    • fpizlo@apple.com's avatar
      REGRESSION: Crash when opening a message on Gmail · b61a0434
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=119105
      
      Source/JavaScriptCore: 
      
      Reviewed by Oliver Hunt and Mark Hahnenberg.
              
      - GetById patching in the DFG needs to be more disciplined about how it derives the
        slow path.
              
      - Fix some dumping code thread safety issues.
      
      * bytecode/CallLinkStatus.cpp:
      (JSC::CallLinkStatus::dump):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpBytecode):
      * dfg/DFGRepatch.cpp:
      (JSC::DFG::getPolymorphicStructureList):
      (JSC::DFG::tryBuildGetByIDList):
      
      LayoutTests: 
      
      Reviewed by Oliver Hunt and Mark Hahnenberg.
      
      * fast/js/dfg-get-by-id-unset-then-proto-less-warmup.html: Added.
      * fast/js/dfg-get-by-id-unset-then-proto-more-warmup.html: Added.
      * fast/js/dfg-get-by-id-unset-then-proto.html: Added.
      * fast/js/jsc-test-list
      * fast/js/script-tests/dfg-get-by-id-unset-then-proto-less-warmup.js: Added.
      (foo):
      (Blah):
      * fast/js/script-tests/dfg-get-by-id-unset-then-proto-more-warmup.js: Added.
      (foo):
      (Blah):
      * fast/js/script-tests/dfg-get-by-id-unset-then-proto.js: Added.
      (foo):
      (Blah):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      b61a0434
  23. 25 Jul, 2013 2 commits
  24. 24 Jul, 2013 4 commits
    • oliver@apple.com's avatar
      fourthTier: each DFG node that relies on other nodes to do their type checks... · 83d2d02a
      oliver@apple.com authored
      fourthTier: each DFG node that relies on other nodes to do their type checks should be able to tell you if those type checks happened
      https://bugs.webkit.org/show_bug.cgi?id=118866
      
      Reviewed by Sam Weinig.
      
      Adds a safeToExecute() method that takes a node and an abstract state and tells you
      if the node will run without crashing under that state.
      
      * JavaScriptCore.xcodeproj/project.pbxproj:
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::CodeBlock):
      * dfg/DFGCFAPhase.cpp:
      (CFAPhase):
      (JSC::DFG::CFAPhase::CFAPhase):
      (JSC::DFG::CFAPhase::run):
      (JSC::DFG::CFAPhase::performBlockCFA):
      (JSC::DFG::CFAPhase::performForwardCFA):
      * dfg/DFGSafeToExecute.h: Added.
      (DFG):
      (SafeToExecuteEdge):
      (JSC::DFG::SafeToExecuteEdge::SafeToExecuteEdge):
      (JSC::DFG::SafeToExecuteEdge::operator()):
      (JSC::DFG::SafeToExecuteEdge::result):
      (JSC::DFG::safeToExecute):
      * dfg/DFGStructureAbstractValue.h:
      (JSC::DFG::StructureAbstractValue::isValidOffset):
      (StructureAbstractValue):
      * runtime/Options.h:
      (JSC):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153290 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      83d2d02a
    • oliver@apple.com's avatar
      fourthTier: DFG shouldn't create CheckStructures for array accesses except if... · 58cdc336
      oliver@apple.com authored
      fourthTier: DFG shouldn't create CheckStructures for array accesses except if the ArrayMode implies an original array access
      https://bugs.webkit.org/show_bug.cgi?id=118867
      
      Reviewed by Mark Hahnenberg.
      
      This allows us to kill off a bunch of code in the parser, in fixup, and to simplify
      ArrayProfile.
      
      It also makes it easier to ask any array-using node how to create its type check.
      
      Doing this required fixing a bug in LowLevelInterpreter64, where it was storing into
      an array profile, thinking that it was storing into a value profile. Reshuffling the
      fields in ArrayProfile revealed this.
      
      * bytecode/ArrayProfile.cpp:
      (JSC::ArrayProfile::computeUpdatedPrediction):
      (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
      * bytecode/ArrayProfile.h:
      (JSC::ArrayProfile::ArrayProfile):
      (ArrayProfile):
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::updateAllArrayPredictions):
      (JSC::CodeBlock::updateAllPredictions):
      * bytecode/CodeBlock.h:
      (CodeBlock):
      (JSC::CodeBlock::updateAllArrayPredictions):
      * dfg/DFGArrayMode.h:
      (ArrayMode):
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::getArrayModeConsideringSlowPath):
      (JSC::DFG::ByteCodeParser::parseBlock):
      * dfg/DFGFixupPhase.cpp:
      (JSC::DFG::FixupPhase::fixupNode):
      (FixupPhase):
      (JSC::DFG::FixupPhase::checkArray):
      (JSC::DFG::FixupPhase::blessArrayOperation):
      * llint/LowLevelInterpreter64.asm:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      58cdc336
    • oliver@apple.com's avatar
      fourthTier: GC's put_by_id transition fixpoint should converge more quickly · c0a31d7e
      oliver@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=117912
      
      Reviewed by Mark Hahnenberg.
      
      This was a rookie mistake. The GC does a classic forward data flow fixpoint. These work well so long as you
      iterate the program in program order, or at least something close to program order. Because I enjoy reverse
      loops ("while (n--) blah"), I ended up iterating in *reverse* of program order which ensured worst-case
      pathologies every single time. And unsurprisingly, this slowed down a program, namely pdfjs.
      
      Flipping the loops to iterate forward fixes a 90% regression in Octane/pdfjs and is otherwise neutral.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::propagateTransitions):
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153243 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      c0a31d7e
    • oliver@apple.com's avatar
      fourthTier: There should only be one table of SimpleJumpTables · a14cea5d
      oliver@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=117856
      
      Reviewed by Geoffrey Garen.
      
      Having multiple tables of SimpleJumpTables just means we have to duplicate a
      ton of code. This patch deduplicates all of it.
      
      * bytecode/CodeBlock.cpp:
      (JSC::CodeBlock::dumpBytecode):
      (JSC):
      (JSC::CodeBlock::CodeBlock):
      (JSC::CodeBlock::shrinkToFit):
      * bytecode/CodeBlock.h:
      (JSC::CodeBlock::numberOfSwitchJumpTables):
      (JSC::CodeBlock::addSwitchJumpTable):
      (JSC::CodeBlock::switchJumpTable):
      (JSC::CodeBlock::clearSwitchJumpTables):
      (RareData):
      * bytecode/PreciseJumpTargets.cpp:
      (JSC):
      (JSC::computePreciseJumpTargets):
      * bytecode/UnlinkedCodeBlock.h:
      (JSC::UnlinkedCodeBlock::shrinkToFit):
      (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables):
      (JSC::UnlinkedCodeBlock::addSwitchJumpTable):
      (JSC::UnlinkedCodeBlock::switchJumpTable):
      (RareData):
      * bytecompiler/BytecodeGenerator.cpp:
      (JSC):
      (JSC::prepareJumpTableForSwitch):
      (JSC::BytecodeGenerator::endSwitch):
      * dfg/DFGByteCodeParser.cpp:
      (InlineStackEntry):
      (JSC::DFG::ByteCodeParser::parseBlock):
      (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
      * dfg/DFGJITCompiler.cpp:
      (JSC::DFG::JITCompiler::link):
      * dfg/DFGJITCompiler.h:
      (JITCompiler):
      * dfg/DFGOperations.cpp:
      * dfg/DFGSpeculativeJIT.cpp:
      (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
      (DFG):
      (JSC::DFG::SpeculativeJIT::emitSwitchImm):
      (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):
      * dfg/DFGSpeculativeJIT.h:
      (SpeculativeJIT):
      * ftl/FTLLink.cpp:
      (JSC::FTL::link):
      * jit/JITOpcodes.cpp:
      (JSC::JIT::emit_op_switch_imm):
      (JSC::JIT::emit_op_switch_char):
      * jit/JITOpcodes32_64.cpp:
      (JSC::JIT::emit_op_switch_imm):
      (JSC::JIT::emit_op_switch_char):
      * jit/JITStubs.cpp:
      (JSC::DEFINE_STUB_FUNCTION):
      * llint/LLIntSlowPaths.cpp:
      (JSC::LLInt::LLINT_SLOW_PATH_DECL):
      * llint/LowLevelInterpreter32_64.asm:
      * llint/LowLevelInterpreter64.asm:
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      a14cea5d