ChangeLog-2013-04-24

2013-04-23  Filip Pizlo  <fpizlo@apple.com>

        DFG CFA filters CheckFunction in a really weird way, and assumes that the function's structure won't change
        https://bugs.webkit.org/show_bug.cgi?id=115077

        Reviewed by Oliver Hunt.
        
        The filtering did three things that are unusual:
        
        1) AbstractValue::filterByValue() assumed that the passed value's structure wouldn't change, in
           the sense that at it assumed it could use that value's *current* structure to do structure
           filtering. Filtering by structure only makes sense if you can prove that the given value will
           always have that structure (for example by either using a watchpoing or emitting code that
           checks that structure at run-time).
        
        2) AbstractValue::filterByValue() and the CheckFunction case in AbstractState::executeEffects()
           tried to invalidate the CFA based on whether the filtration led to an empty value. This is
           well-intentioned, but it's not how the CFA currently works. It's inconsistent with other
           parts of the CFA. We shouldn't introduce this feature into just one kind of filtration and
           not have it elsewhere.
        
        3) The attempt to detect when the value was empty was actually implemented incorrectly. It
           relied on AbstractValue::validate(). That method says that a concrete value does not belong
           to the abstract value if it has a different structure. This makes sense for the other place
           where AbstractValue::validate() is called: during OSR entry, where we are talking about a
           JSValue that we see *right now*. It doesn't make sense in the CFA, since in the CFA any
           value we observe in the code is a value whose structure may change when the code starts
           running, and so we cannot use the value's current structure to infer things about the code
           when it starts running.
        
        I fixed the above problems by (1) changing filterByValue() to not filter the structure, (2)
        changing filterByValue() and the CheckFunction case to not invalidate the CFA, and (3)
        making sure that nobody else was misusing AbstractValue::validate() (they weren't).

        * dfg/DFGAbstractState.cpp:
        (JSC::DFG::AbstractState::executeEffects):
        * dfg/DFGAbstractValue.h:
        (JSC::DFG::AbstractValue::filterByValue):

2013-04-23  Oliver Hunt  <oliver@apple.com>

        Default ParserError() initialiser doesn't initialise all fields
        https://bugs.webkit.org/show_bug.cgi?id=115074

        Reviewed by Joseph Pecoraro.

        Only the jsc command prompt depended on this, but we'll fix it to
        be on the safe side.

        * parser/ParserError.h:
        (JSC::ParserError::ParserError):

2013-04-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>

        Global constructors should be configurable and not enumerable
        https://bugs.webkit.org/show_bug.cgi?id=110573

        Reviewed by Geoffrey Garen.

        Update JSObject::deleteProperty() so that mark to set the property
        value to undefined if it is in static hashtable of properties. The
        previous code was not doing anything in this case and this meant
        we could not remove builtin DOMWindow properties such as
        "ProgressEvent" even if marked as Deletable.

        * runtime/JSObject.cpp:
        (JSC::JSObject::deleteProperty):
        * runtime/Lookup.h:
        (JSC):
        (JSC::putEntry):
        (JSC::lookupPut):

2013-04-23  Geoffrey Garen  <ggaren@apple.com>

        Filled out more cases of branch folding in bytecode when emitting
        expressions into a branching context
        https://bugs.webkit.org/show_bug.cgi?id=115057

        Reviewed by Filip Pizlo.

        This covers a few cases like:

            - while (true) { }
            - while (1) { }
            - if (x) break;
            - if (x) continue;
            - if (boolean_expr == boolean_const) { }
            - if (boolean_expr == 1_or_0) { }
            - if (bitop == 1_or_0) { }

        This also works, but will bring shame on your family:

            - while ("hello world") { }

        No change on the benchmarks we track, but a 2.5X speedup on a microbenchmark
        that uses these techniques.

        * JavaScriptCore.order: Order!

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::emitNewArray):
        (JSC::BytecodeGenerator::emitThrowReferenceError):
        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
        * bytecompiler/BytecodeGenerator.h:
        (JSC::BytecodeGenerator::shouldEmitDebugHooks): Updated ancillary code
        for interface simplifications.

        * bytecompiler/NodesCodegen.cpp:
        (JSC::ConstantNode::emitBytecodeInConditionContext): Constants can
        jump unconditionally when used within a condition context.

        (JSC::ConstantNode::emitBytecode):
        (JSC::StringNode::jsValue): Gave constants a common base class so I
        could implement their codegen just once.

        (JSC::BinaryOpNode::emitBytecodeInConditionContext):
        (JSC::canFoldToBranch):
        (JSC::BinaryOpNode::tryFoldToBranch): Fold (!/=)= and (!/=)== where
        appropriate. A lot of cases are not appropriate because of the surprising
        type conversion semantics of ==. For example, if (number == true) { } is
        not the same as if (number) { } because the former will up-convert true
        to number and then do numeric comparison.

        (JSC::singleStatement):
        (JSC::IfElseNode::tryFoldBreakAndContinue):
        (JSC::IfElseNode::emitBytecode):
        (JSC::ContinueNode::trivialTarget):
        (JSC::BreakNode::trivialTarget): Fold "if (expression) break" and
        "if (expression) continue" into direct jumps from expression.

        * parser/ASTBuilder.h:
        (ASTBuilder):
        (JSC::ASTBuilder::createIfStatement):
        * parser/NodeConstructors.h:
        (JSC::ConstantNode::ConstantNode):
        (JSC):
        (JSC::NullNode::NullNode):
        (JSC::BooleanNode::BooleanNode):
        (JSC::NumberNode::NumberNode):
        (JSC::StringNode::StringNode):
        (JSC::IfElseNode::IfElseNode):
        * parser/Nodes.h:
        (JSC::ExpressionNode::isConstant):
        (JSC::ExpressionNode::isBoolean):
        (JSC::StatementNode::isBreak):
        (JSC::StatementNode::isContinue):
        (ConstantNode):
        (JSC::ConstantNode::isPure):
        (JSC::ConstantNode::isConstant):
        (NullNode):
        (JSC::NullNode::jsValue):
        (JSC::BooleanNode::value):
        (JSC::BooleanNode::isBoolean):
        (JSC::BooleanNode::jsValue):
        (JSC::NumberNode::value):
        (NumberNode):
        (JSC::NumberNode::jsValue):
        (StringNode):
        (BinaryOpNode):
        (IfElseNode):
        (ContinueNode):
        (JSC::ContinueNode::isContinue):
        (BreakNode):
        (JSC::BreakNode::isBreak):
        * parser/Parser.cpp:
        (JSC::::parseIfStatement):
        * parser/ResultType.h:
        (JSC::ResultType::definitelyIsBoolean):
        (ResultType):
        * runtime/JSCJSValueInlines.h:
        (JSC::JSValue::pureToBoolean):
        * runtime/JSCell.h:
        * runtime/JSCellInlines.h:
        (JSC::JSCell::pureToBoolean): Updated for interface changes above.

2013-04-23  Mark Lam  <mark.lam@apple.com>

        Simplify the baseline JIT loop hint call site.
        https://bugs.webkit.org/show_bug.cgi?id=115052.

        Reviewed by Geoffrey Garen.

        Moved the watchdog timer check after the JIT optimization check. This
        ensures that the JIT opimization counter is incremented on every loop
        hint even if the watchdog timer fires.

        Removed the code that allows the JIT OSR to happen if the watchdog
        timer fires but does not result in a termination. It is extremely rare
        that the JIT optimization counter would trigger an OSR on the same pass
        as when the watchdog timer fire. If it does happen, we'll simply hold
        off on servicing the watchdog timer until the next pass (because it's
        not time critical).

        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):

2013-04-23  Roger Fong  <roger_fong@apple.com>

        AppleWin build fix.

        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:

2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>

        Objective-C API: Update public header documentation
        https://bugs.webkit.org/show_bug.cgi?id=114841

        Reviewed by Geoffrey Garen.

        Added documentation for the newly added object lifetime-related stuff.

        * API/JSManagedValue.h:
        * API/JSVirtualMachine.h:

2013-04-22  Mark Lam  <mark.lam@apple.com>

        Fix a typo in MacroAssemblerARMv7.h.
        https://bugs.webkit.org/show_bug.cgi?id=115011.

        Reviewed by Geoffrey Garen.

        * assembler/ARMAssembler.h: Fix a comment.
        * assembler/ARMv7Assembler.h: Added some comments.
        * assembler/MacroAssemblerARMv7.h:
          - ARMAssembler::PL should be ARMv7Assembler::ConditionPL.

2013-04-22  Julien Brianceau  <jbrianceau@nds.com>

        Add branchAdd32 missing implementation in SH4 base JIT.
        This should fix SH4 build, broken since r148893.
        https://bugs.webkit.org/show_bug.cgi?id=114993.

        Reviewed by Oliver Hunt.

        * assembler/MacroAssemblerSH4.h:
        (JSC::MacroAssemblerSH4::branchAdd32):
        (MacroAssemblerSH4):

2013-04-22  Benjamin Poulain  <bpoulain@apple.com>

        Windows build fix after r148921

        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:

2013-04-22  Benjamin Poulain  <benjamin@webkit.org>

        Remove the memory instrumentation code
        https://bugs.webkit.org/show_bug.cgi?id=114931

        Reviewed by Andreas Kling.

        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:

2013-04-22  Mark Lam  <mark.lam@apple.com>

        Fix broken 32-bit build to green the bots.
        https://bugs.webkit.org/show_bug.cgi?id=114968.

        Unreviewed.

        Basically, I moved a JIT::emit_op_loop_hint() and JIT::emitSlow_op_loop_hint()
        into common code where they belong, instead of the 64-bit specific section.

        Also fixed some SH4 assertions failures which were also caused by
        https://bugs.webkit.org/show_bug.cgi?id=114963. Thanks to Julien Brianceau
        for pointing this out.

        * assembler/MacroAssemblerSH4.h:
        (JSC::MacroAssemblerSH4::branchAdd32):
        * jit/JITOpcodes.cpp:
        (JSC):
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):

2013-04-22  Oliver Hunt  <oliver@apple.com>

        Perform null check before trying to use the result of readline()

        RS=Gavin

        * jsc.cpp:
        (runInteractive):

2013-04-22  Oliver Hunt  <oliver@apple.com>

        Fix assertions to account for new Vector layout

        RS=Gavin

        * llint/LLIntData.cpp:
        (JSC::LLInt::Data::performAssertions):

2013-04-22  Mark Lam  <mark.lam@apple.com>

        Change baseline JIT watchdog timer check to use the proper fast slow path
        infrastructure.
        https://bugs.webkit.org/show_bug.cgi?id=114963.

        Reviewed by Oliver Hunt.

        Edit: The PositiveOrZero condition is added because it is needed for
        the JIT optimization check. Previously, the JIT check branches around
        the slow path if the test result is 'Signed' i.e. negative. Since we
        now need to test for a condition that branches to the slow path (not
        around it), we need the complement of 'Signed / Negative' i.e. Positive
        or zero.

        SH4 parts contributed by Julien Brianceau.

        * assembler/ARMAssembler.h:
        * assembler/MacroAssemblerARM.h:
        * assembler/MacroAssemblerARMv7.h:
        * assembler/MacroAssemblerMIPS.h:
        (JSC::MacroAssemblerMIPS::branchAdd32):
        * assembler/MacroAssemblerSH4.h:
        (JSC::MacroAssemblerSH4::branchAdd32):
        * assembler/MacroAssemblerX86Common.h:
        * assembler/SH4Assembler.h:
        * jit/JIT.cpp:
        (JSC::JIT::emitEnterOptimizationCheck):
        (JSC::JIT::privateCompileSlowCases):
        * jit/JIT.h:
        (JSC::JIT::emitEnterOptimizationCheck):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_loop_hint):
        (JSC::JIT::emitSlow_op_loop_hint):
        (JSC::JIT::emit_op_enter):
        * jit/JITOpcodes32_64.cpp:
        (JSC::JIT::emit_op_enter):

2013-04-22  Andreas Kling  <akling@apple.com>

        Shrink baseline size of WTF::Vector on 64-bit by switching to unsigned capacity and size.
        <http://webkit.org/b/97268>
        <rdar://problem/12376519>

        Reviewed by Sam Weinig.

        Update LLInt WTF::Vector offset constants to match the new memory layout.

        * llint/LowLevelInterpreter.asm:

2013-04-21  Oliver Hunt  <oliver@apple.com>

        JS Lexer and Parser should be more informative when they encounter errors
        https://bugs.webkit.org/show_bug.cgi?id=114924

        Reviewed by Filip Pizlo.

        Add new tokens to represent the various ways that parsing and lexing have failed.
        This gives us the ability to produce better error messages in some cases,
        and to indicate whether or not the failure was due to invalid source, or simply
        early termination.

        The jsc prompt now makes use of this so that you can write functions that
        are more than one line long.

        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::generate):
        * jsc.cpp:
        (stringFromUTF):
        (jscSource):
        (runInteractive):
        * parser/Lexer.cpp:
        (JSC::::parseFourDigitUnicodeHex):
        (JSC::::parseIdentifierSlowCase):
        (JSC::::parseString):
        (JSC::::parseStringSlowCase):
        (JSC::::lex):
        * parser/Lexer.h:
        (UnicodeHexValue):
        (JSC::Lexer::UnicodeHexValue::UnicodeHexValue):
        (JSC::Lexer::UnicodeHexValue::valueType):
        (JSC::Lexer::UnicodeHexValue::isValid):
        (JSC::Lexer::UnicodeHexValue::value):
        (Lexer):
        * parser/Parser.h:
        (JSC::Parser::getTokenName):
        (JSC::Parser::updateErrorMessageSpecialCase):
        (JSC::::parse):
        * parser/ParserError.h:
        (ParserError):
        (JSC::ParserError::ParserError):
        * parser/ParserTokens.h:
        * runtime/Completion.cpp:
        (JSC):
        (JSC::checkSyntax):
        * runtime/Completion.h:
        (JSC):

2013-04-21  Mark Lam  <mark.lam@apple.com>

        Refactor identical inline functions in JSVALUE64 and JSVALUE32_64 sections
        out into the common section.
        https://bugs.webkit.org/show_bug.cgi?id=114910.

        Reviewed by Filip Pizlo.

        * dfg/DFGSpeculativeJIT.h:
        (SpeculativeJIT):
        (JSC::DFG::SpeculativeJIT::callOperation):

2013-04-20  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        LLint should be able to use x87 instead of SSE for floating pointer
        https://bugs.webkit.org/show_bug.cgi?id=112239

        Reviewed by Filip Pizlo.

        Implements LLInt floating point operations in x87, to ensure we support
        x86 without SSE2.

        X86 (except 64bit) now defaults to using x87 instructions in order to
        support all 32bit x86 back to i686. The implementation uses the fucomi
        instruction from i686 which sets the new minimum.

        The FPU registers must always be empty on entering or exiting a function.
        We make sure to only use two X87 registers, and they are always emptied
        before calling deeper functions or returning from the LLInt.

        * jit/JITStubs.cpp:
        (JSC): Empty FPU registers before exiting.
        * llint/LowLevelInterpreter32_64.asm:
        * llint/LowLevelInterpreter64.asm:
        * offlineasm/instructions.rb:
        * offlineasm/x86.rb:

2013-04-19  Roger Fong  <roger_fong@apple.com>

        Remove uses of WebKit_Source from AppleWin build in JavaScriptCore.

        * JavaScriptCore.vcxproj/JavaScriptCore.make:
        * JavaScriptCore.vcxproj/build-generated-files.sh:
        * JavaScriptCore.vcxproj/copy-files.cmd:
        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:

2013-04-19  Benjamin Poulain  <bpoulain@apple.com>

        Rename JSStringJoiner::build() to join()
        https://bugs.webkit.org/show_bug.cgi?id=114845

        Reviewed by Geoffrey Garen.

        The method name build() came from StringBuilder history. It does not make much
        sense on the StringJoiner.

        * runtime/ArrayPrototype.cpp:
        (JSC::arrayProtoFuncToString):
        (JSC::arrayProtoFuncToLocaleString):
        (JSC::arrayProtoFuncJoin):
        * runtime/JSStringJoiner.cpp:
        (JSC::JSStringJoiner::join):
        * runtime/JSStringJoiner.h:
        (JSStringJoiner):

2013-04-19  Roger Fong  <roger_fong@apple.com>

        Unreviewed. WebKit_Source is incorrectly set.

        * JavaScriptCore.vcxproj/JavaScriptCore.make:

2013-04-19  Martin Robinson  <mrobinson@igalia.com>

        [GTK] JSCore.gir.in has a few problems
        https://bugs.webkit.org/show_bug.cgi?id=114710

        Reviewed by Philippe Normand.

        * GNUmakefile.am: Add the gobject introspection steps for JavaScriptCore here,
        because they are shared between WebKit1 and WebKit2.
        * JavaScriptCore.gir.in: Added. Moved from the WebKit1 directory. Now written
        as foreign interfaces and referencing the javascriptcoregtk library.

2013-04-18  Benjamin Poulain  <bpoulain@apple.com>

        Use StringJoiner to create the JSString of arrayProtoFuncToString
        https://bugs.webkit.org/show_bug.cgi?id=114779

        Reviewed by Geoffrey Garen.

        The function arrayProtoFuncToString was just a glorified JSStringJoiner.
        This patch replaces it by JSStringJoiner to simplify the code and enjoy any optimization
        made on JSStringJoiner.

        For some reason, this makes the execution 3.4% faster, despite having almost identical code.

        * runtime/ArrayPrototype.cpp:
        (JSC::arrayProtoFuncToString):

2013-04-18  Oliver Hunt  <oliver@apple.com>

        StackFrame::column() returning bogus value
        https://bugs.webkit.org/show_bug.cgi?id=114840

        Reviewed by Gavin Barraclough.

        Don't add one part of the expression offset to the other part of the expression.
        Make StackFrame::toString() include the column info.

        * interpreter/Interpreter.cpp:
        (JSC::StackFrame::expressionInfo):
        (JSC::StackFrame::toString):

2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>

        Crash beneath JSC::JIT::privateCompileSlowCases @ stephenrdonaldson.com
        https://bugs.webkit.org/show_bug.cgi?id=114774

        Reviewed by Geoffrey Garen.

        We're not linking up all of the slow cases in the baseline JIT when compiling put_to_base.

        * jit/JITOpcodes.cpp:
        (JSC::JIT::emitSlow_op_put_to_base):

2013-04-18  Mark Lam  <mark.lam@apple.com>

        Interpreter entry points should throw the TerminatedExecutionException from the caller frame.
        https://bugs.webkit.org/show_bug.cgi?id=114816.

        Reviewed by Oliver Hunt.

        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::execute):
        (JSC::Interpreter::executeCall):
        (JSC::Interpreter::executeConstruct):

2013-04-18  Gabor Rapcsanyi  <rgabor@webkit.org>

        LLInt ARM backend should not use the d8 register as scratch register
        https://bugs.webkit.org/show_bug.cgi?id=114811

        Reviewed by Filip Pizlo.

        The d8 register must preserved across function calls and should
        not used as scratch register. Changing it to d6.

        * offlineasm/arm.rb:

2013-04-18  Geoffrey Garen  <ggaren@apple.com>

        Removed HeapTimer::synchronize
        https://bugs.webkit.org/show_bug.cgi?id=114832

        Reviewed by Mark Hahnenberg.

        HeapTimer::synchronize was a flawed attempt to make HeapTimer thread-safe.
        Instead, we use proper locking now.

        This is a slight API change, since the GC timer will now only fire in the
        run loop that created the JS VM, even if another run loop later executes
        some JS.

        * API/APIShims.h:
        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
        * heap/HeapTimer.cpp:
        (JSC):
        * heap/HeapTimer.h:
        (HeapTimer):

2013-04-17  Geoffrey Garen  <ggaren@apple.com>

        Renamed JSGlobalData to VM
        https://bugs.webkit.org/show_bug.cgi?id=114777

        Reviewed by Phil Pizlo.

        * API/APICast.h:
        (JSC):
        (toJS):
        (toRef):
        * API/APIShims.h:
        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
        (APIEntryShimWithoutLock):
        (JSC::APIEntryShim::APIEntryShim):
        (APIEntryShim):
        (JSC::APIEntryShim::~APIEntryShim):
        (JSC::APICallbackShim::APICallbackShim):
        (JSC::APICallbackShim::~APICallbackShim):
        (APICallbackShim):
        * API/JSAPIWrapperObject.h:
        (JSAPIWrapperObject):
        * API/JSAPIWrapperObject.mm:
        (JSC::::createStructure):
        (JSC::JSAPIWrapperObject::JSAPIWrapperObject):
        (JSC::JSAPIWrapperObject::finishCreation):
        (JSC::JSAPIWrapperObject::visitChildren):
        * API/JSBase.cpp:
        (JSGarbageCollect):
        (JSReportExtraMemoryCost):
        (JSSynchronousGarbageCollectForDebugging):
        * API/JSCallbackConstructor.cpp:
        (JSC::JSCallbackConstructor::JSCallbackConstructor):
        (JSC::JSCallbackConstructor::finishCreation):
        * API/JSCallbackConstructor.h:
        (JSC::JSCallbackConstructor::createStructure):
        * API/JSCallbackFunction.cpp:
        (JSC::JSCallbackFunction::finishCreation):
        (JSC::JSCallbackFunction::create):
        * API/JSCallbackFunction.h:
        (JSCallbackFunction):
        (JSC::JSCallbackFunction::createStructure):
        * API/JSCallbackObject.cpp:
        (JSC::::create):
        (JSC::::createStructure):
        * API/JSCallbackObject.h:
        (JSC::JSCallbackObjectData::setPrivateProperty):
        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
        (JSCallbackObject):
        (JSC::JSCallbackObject::setPrivateProperty):
        * API/JSCallbackObjectFunctions.h:
        (JSC::::JSCallbackObject):
        (JSC::::finishCreation):
        (JSC::::put):
        (JSC::::staticFunctionGetter):
        * API/JSClassRef.cpp:
        (OpaqueJSClassContextData::OpaqueJSClassContextData):
        (OpaqueJSClass::contextData):
        (OpaqueJSClass::prototype):
        * API/JSClassRef.h:
        (OpaqueJSClassContextData):
        * API/JSContext.mm:
        (-[JSContext setException:]):
        (-[JSContext initWithGlobalContextRef:]):
        (+[JSContext contextWithGlobalContextRef:]):
        * API/JSContextRef.cpp:
        (JSContextGroupCreate):
        (JSContextGroupRelease):
        (JSGlobalContextCreate):
        (JSGlobalContextCreateInGroup):
        (JSGlobalContextRetain):
        (JSGlobalContextRelease):
        (JSContextGetGroup):
        (JSContextCreateBacktrace):
        * API/JSObjectRef.cpp:
        (JSObjectMake):
        (JSObjectMakeConstructor):
        (JSObjectMakeFunction):
        (JSObjectSetPrototype):
        (JSObjectHasProperty):
        (JSObjectGetProperty):
        (JSObjectSetProperty):
        (JSObjectDeleteProperty):
        (JSObjectGetPrivateProperty):
        (JSObjectSetPrivateProperty):
        (JSObjectDeletePrivateProperty):
        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
        (OpaqueJSPropertyNameArray):
        (JSObjectCopyPropertyNames):
        (JSPropertyNameArrayRelease):
        (JSPropertyNameAccumulatorAddName):
        * API/JSScriptRef.cpp:
        (OpaqueJSScript::create):
        (OpaqueJSScript::vm):
        (OpaqueJSScript::OpaqueJSScript):
        (OpaqueJSScript):
        (parseScript):
        * API/JSVirtualMachine.mm:
        (scanExternalObjectGraph):
        * API/JSVirtualMachineInternal.h:
        (JSC):
        * API/JSWrapperMap.mm:
        (makeWrapper):
        * API/ObjCCallbackFunction.h:
        (JSC::ObjCCallbackFunction::createStructure):
        * API/ObjCCallbackFunction.mm:
        (JSC::ObjCCallbackFunction::create):
        * API/OpaqueJSString.cpp:
        (OpaqueJSString::identifier):
        * API/OpaqueJSString.h:
        (JSC):
        (OpaqueJSString):
        * GNUmakefile.list.am:
        * JSCTypedArrayStubs.h:
        (JSC):
        * JavaScriptCore.order:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
        * JavaScriptCore.xcodeproj/project.pbxproj:
        * KeywordLookupGenerator.py:
        (Trie.printSubTreeAsC):
        * Target.pri:
        * assembler/ARMAssembler.cpp:
        (JSC::ARMAssembler::executableCopy):
        * assembler/ARMAssembler.h:
        (ARMAssembler):
        * assembler/AssemblerBuffer.h:
        (JSC::AssemblerBuffer::executableCopy):
        * assembler/AssemblerBufferWithConstantPool.h:
        (JSC::AssemblerBufferWithConstantPool::executableCopy):
        * assembler/LinkBuffer.cpp:
        (JSC::LinkBuffer::linkCode):
        * assembler/LinkBuffer.h:
        (JSC):
        (JSC::LinkBuffer::LinkBuffer):
        (LinkBuffer):
        * assembler/MIPSAssembler.h:
        (JSC::MIPSAssembler::executableCopy):
        * assembler/SH4Assembler.h:
        (JSC::SH4Assembler::executableCopy):
        * assembler/X86Assembler.h:
        (JSC::X86Assembler::executableCopy):
        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
        * bytecode/CallLinkInfo.cpp:
        (JSC::CallLinkInfo::unlink):
        * bytecode/CallLinkInfo.h:
        (CallLinkInfo):
        * bytecode/CodeBlock.cpp:
        (JSC::dumpStructure):
        (JSC::CodeBlock::printStructures):
        (JSC::CodeBlock::CodeBlock):
        (JSC::CodeBlock::~CodeBlock):
        (JSC::CodeBlock::visitStructures):
        (JSC::CodeBlock::finalizeUnconditionally):
        (JSC::CodeBlock::createActivation):
        (JSC::CodeBlock::unlinkCalls):
        (JSC::CodeBlock::unlinkIncomingCalls):
        (JSC::CodeBlock::findClosureCallForReturnPC):
        (JSC::ProgramCodeBlock::jettisonImpl):
        (JSC::EvalCodeBlock::jettisonImpl):
        (JSC::FunctionCodeBlock::jettisonImpl):
        (JSC::CodeBlock::predictedMachineCodeSize):
        (JSC::CodeBlock::usesOpcode):
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::appendWeakReference):
        (JSC::CodeBlock::appendWeakReferenceTransition):
        (JSC::CodeBlock::setJITCode):
        (JSC::CodeBlock::setGlobalData):
        (JSC::CodeBlock::vm):
        (JSC::CodeBlock::valueProfileForBytecodeOffset):
        (JSC::CodeBlock::addConstant):
        (JSC::CodeBlock::setConstantRegisters):
        (CodeBlock):
        (JSC::CodeBlock::WeakReferenceTransition::WeakReferenceTransition):
        * bytecode/EvalCodeCache.h:
        (JSC::EvalCodeCache::getSlow):
        * bytecode/GetByIdStatus.cpp:
        (JSC::GetByIdStatus::computeFromLLInt):
        (JSC::GetByIdStatus::computeForChain):
        (JSC::GetByIdStatus::computeFor):
        * bytecode/GetByIdStatus.h:
        (GetByIdStatus):
        * bytecode/Instruction.h:
        (JSC::Instruction::Instruction):
        * bytecode/ObjectAllocationProfile.h:
        (JSC::ObjectAllocationProfile::initialize):
        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
        * bytecode/PolymorphicAccessStructureList.h:
        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
        * bytecode/PolymorphicPutByIdList.h:
        (JSC::PutByIdAccess::transition):
        (JSC::PutByIdAccess::replace):
        * bytecode/PreciseJumpTargets.cpp:
        (JSC::computePreciseJumpTargets):
        * bytecode/PutByIdStatus.cpp:
        (JSC::PutByIdStatus::computeFromLLInt):
        (JSC::PutByIdStatus::computeFor):
        * bytecode/PutByIdStatus.h:
        (JSC):
        (PutByIdStatus):
        * bytecode/ResolveGlobalStatus.cpp:
        (JSC::computeForStructure):
        * bytecode/SamplingTool.cpp:
        (JSC::SamplingTool::notifyOfScope):
        * bytecode/SamplingTool.h:
        (JSC::ScriptSampleRecord::ScriptSampleRecord):
        (SamplingTool):
        * bytecode/StructureStubInfo.h:
        (JSC::StructureStubInfo::initGetByIdSelf):
        (JSC::StructureStubInfo::initGetByIdProto):
        (JSC::StructureStubInfo::initGetByIdChain):
        (JSC::StructureStubInfo::initPutByIdTransition):
        (JSC::StructureStubInfo::initPutByIdReplace):
        * bytecode/UnlinkedCodeBlock.cpp:
        (JSC::generateFunctionCodeBlock):
        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
        (JSC::UnlinkedFunctionExecutable::link):
        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
        * bytecode/UnlinkedCodeBlock.h:
        (JSC::UnlinkedFunctionExecutable::create):
        (UnlinkedFunctionExecutable):
        (JSC::UnlinkedFunctionExecutable::finishCreation):
        (JSC::UnlinkedFunctionExecutable::createStructure):
        (JSC::UnlinkedCodeBlock::addRegExp):
        (JSC::UnlinkedCodeBlock::addConstant):
        (JSC::UnlinkedCodeBlock::addFunctionDecl):
        (JSC::UnlinkedCodeBlock::addFunctionExpr):
        (JSC::UnlinkedCodeBlock::vm):
        (UnlinkedCodeBlock):
        (JSC::UnlinkedCodeBlock::finishCreation):
        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
        (JSC::UnlinkedProgramCodeBlock::create):
        (JSC::UnlinkedProgramCodeBlock::addFunctionDeclaration):
        (JSC::UnlinkedProgramCodeBlock::UnlinkedProgramCodeBlock):
        (JSC::UnlinkedProgramCodeBlock::createStructure):
        (JSC::UnlinkedEvalCodeBlock::create):
        (JSC::UnlinkedEvalCodeBlock::UnlinkedEvalCodeBlock):
        (JSC::UnlinkedEvalCodeBlock::createStructure):
        (JSC::UnlinkedFunctionCodeBlock::create):
        (JSC::UnlinkedFunctionCodeBlock::UnlinkedFunctionCodeBlock):
        (JSC::UnlinkedFunctionCodeBlock::createStructure):
        * bytecompiler/BytecodeGenerator.cpp:
        (JSC::BytecodeGenerator::BytecodeGenerator):
        (JSC::BytecodeGenerator::addConstant):
        (JSC::BytecodeGenerator::emitLoad):
        (JSC::BytecodeGenerator::emitDirectPutById):
        (JSC::BytecodeGenerator::addStringConstant):
        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
        (JSC::BytecodeGenerator::emitThrowReferenceError):
        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
        * bytecompiler/BytecodeGenerator.h:
        (BytecodeGenerator):
        (JSC::BytecodeGenerator::vm):
        (JSC::BytecodeGenerator::propertyNames):
        (JSC::BytecodeGenerator::makeFunction):
        * bytecompiler/NodesCodegen.cpp:
        (JSC::RegExpNode::emitBytecode):
        (JSC::ArrayNode::toArgumentList):
        (JSC::ApplyFunctionCallDotNode::emitBytecode):
        (JSC::InstanceOfNode::emitBytecode):
        * debugger/Debugger.cpp:
        (JSC::Debugger::recompileAllJSFunctions):
        (JSC::evaluateInGlobalCallFrame):
        * debugger/Debugger.h:
        (JSC):
        * debugger/DebuggerActivation.cpp:
        (JSC::DebuggerActivation::DebuggerActivation):
        (JSC::DebuggerActivation::finishCreation):
        * debugger/DebuggerActivation.h:
        (JSC::DebuggerActivation::create):
        (JSC::DebuggerActivation::createStructure):
        (DebuggerActivation):
        * debugger/DebuggerCallFrame.cpp:
        (JSC::DebuggerCallFrame::evaluate):
        * dfg/DFGAbstractState.cpp:
        (JSC::DFG::AbstractState::executeEffects):
        * dfg/DFGAssemblyHelpers.h:
        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
        (JSC::DFG::AssemblyHelpers::vm):
        (JSC::DFG::AssemblyHelpers::debugCall):
        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
        (AssemblyHelpers):
        * dfg/DFGByteCodeParser.cpp:
        (JSC::DFG::ByteCodeParser::ByteCodeParser):
        (ByteCodeParser):
        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
        (JSC::DFG::ByteCodeParser::parseBlock):
        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
        (JSC::DFG::ByteCodeParser::parseCodeBlock):
        * dfg/DFGByteCodeParser.h:
        (JSC):
        * dfg/DFGCCallHelpers.h:
        (JSC::DFG::CCallHelpers::CCallHelpers):
        * dfg/DFGCapabilities.cpp:
        (JSC::DFG::canHandleOpcodes):
        * dfg/DFGConstantFoldingPhase.cpp:
        (JSC::DFG::ConstantFoldingPhase::foldConstants):
        * dfg/DFGDisassembler.cpp:
        (JSC::DFG::Disassembler::reportToProfiler):
        * dfg/DFGDriver.cpp:
        (JSC::DFG::compile):
        * dfg/DFGDriver.h:
        (JSC):
        * dfg/DFGFixupPhase.cpp:
        (JSC::DFG::FixupPhase::fixupNode):
        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
        * dfg/DFGGraph.cpp:
        (JSC::DFG::Graph::Graph):
        * dfg/DFGGraph.h:
        (Graph):
        * dfg/DFGJITCompiler.cpp:
        (JSC::DFG::JITCompiler::JITCompiler):
        (JSC::DFG::JITCompiler::linkOSRExits):
        (JSC::DFG::JITCompiler::link):
        (JSC::DFG::JITCompiler::compile):
        (JSC::DFG::JITCompiler::compileFunction):
        * dfg/DFGJITCompiler.h:
        (JSC):
        * dfg/DFGOSREntry.cpp:
        (JSC::DFG::prepareOSREntry):
        * dfg/DFGOSRExitCompiler.cpp:
        * dfg/DFGOSRExitCompiler32_64.cpp:
        (JSC::DFG::OSRExitCompiler::compileExit):
        * dfg/DFGOSRExitCompiler64.cpp:
        (JSC::DFG::OSRExitCompiler::compileExit):
        * dfg/DFGOperations.cpp:
        (JSC::DFG::putByVal):
        (JSC::DFG::operationPutByValInternal):
        (JSC::getHostCallReturnValueWithExecState):
        * dfg/DFGPhase.h:
        (JSC::DFG::Phase::vm):
        * dfg/DFGRepatch.cpp:
        (JSC::DFG::generateProtoChainAccessStub):
        (JSC::DFG::tryCacheGetByID):
        (JSC::DFG::tryBuildGetByIDList):
        (JSC::DFG::tryBuildGetByIDProtoList):
        (JSC::DFG::emitPutReplaceStub):
        (JSC::DFG::emitPutTransitionStub):
        (JSC::DFG::tryCachePutByID):
        (JSC::DFG::tryBuildPutByIdList):
        (JSC::DFG::linkSlowFor):
        (JSC::DFG::dfgLinkFor):
        (JSC::DFG::dfgLinkSlowFor):
        (JSC::DFG::dfgLinkClosureCall):
        * dfg/DFGSpeculativeJIT.cpp:
        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
        (JSC::DFG::SpeculativeJIT::compileMakeRope):
        (JSC::DFG::SpeculativeJIT::compileStringEquality):
        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
        (JSC::DFG::SpeculativeJIT::speculateObject):
        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
        (JSC::DFG::SpeculativeJIT::speculateString):
        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
        * dfg/DFGSpeculativeJIT.h:
        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
        * dfg/DFGSpeculativeJIT32_64.cpp:
        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGSpeculativeJIT64.cpp:
        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
        (JSC::DFG::SpeculativeJIT::compile):
        * dfg/DFGThunks.cpp:
        (JSC::DFG::osrExitGenerationThunkGenerator):
        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
        (JSC::DFG::slowPathFor):
        (JSC::DFG::linkForThunkGenerator):
        (JSC::DFG::linkCallThunkGenerator):
        (JSC::DFG::linkConstructThunkGenerator):
        (JSC::DFG::linkClosureCallThunkGenerator):
        (JSC::DFG::virtualForThunkGenerator):
        (JSC::DFG::virtualCallThunkGenerator):
        (JSC::DFG::virtualConstructThunkGenerator):
        * dfg/DFGThunks.h:
        (JSC):
        (DFG):
        * heap/BlockAllocator.h:
        (JSC):
        * heap/CopiedSpace.cpp:
        (JSC::CopiedSpace::tryAllocateSlowCase):
        (JSC::CopiedSpace::tryReallocate):
        * heap/CopiedSpaceInlines.h:
        (JSC::CopiedSpace::tryAllocate):
        * heap/GCThreadSharedData.cpp:
        (JSC::GCThreadSharedData::GCThreadSharedData):
        (JSC::GCThreadSharedData::reset):
        * heap/GCThreadSharedData.h:
        (JSC):
        (GCThreadSharedData):
        * heap/HandleSet.cpp:
        (JSC::HandleSet::HandleSet):
        (JSC::HandleSet::~HandleSet):
        (JSC::HandleSet::grow):
        * heap/HandleSet.h:
        (JSC):
        (HandleSet):
        (JSC::HandleSet::vm):
        * heap/Heap.cpp:
        (JSC::Heap::Heap):
        (JSC):
        (JSC::Heap::lastChanceToFinalize):
        (JSC::Heap::protect):
        (JSC::Heap::unprotect):
        (JSC::Heap::stack):
        (JSC::Heap::getConservativeRegisterRoots):
        (JSC::Heap::markRoots):
        (JSC::Heap::deleteAllCompiledCode):
        (JSC::Heap::collect):
        (JSC::Heap::isValidAllocation):
        * heap/Heap.h:
        (JSC):
        (Heap):
        (JSC::Heap::vm):
        * heap/HeapTimer.cpp:
        (JSC::HeapTimer::HeapTimer):
        (JSC::HeapTimer::timerDidFire):
        (JSC::HeapTimer::timerEvent):
        * heap/HeapTimer.h: