2022-01-25 Yusuke Suzuki [JSC] Wasm module import should be done in sync when WebAssembly.instantiate gets module https://bugs.webkit.org/show_bug.cgi?id=235506 Reviewed by Saam Barati. According to the spec, module imports need to be done synchronously when WebAssembly.instantiate is called with a wasm module[1]. To align our implementation to this behavior, we split WebAssemblyModuleRecord::initializeImportsAndExports into WebAssemblyModuleRecord::initializeImports and WebAssemblyModuleRecord::initializeExports. The former does not require CalleeGroups so we can execute before compiling CalleeGroups. [1]: https://webassembly.github.io/spec/js-api/#asynchronously-instantiate-a-webassembly-module * runtime/AbstractModuleRecord.cpp: (JSC::AbstractModuleRecord::evaluate): * wasm/WasmInstance.h: (JSC::Wasm::Instance::setOwner): (JSC::Wasm::Instance::finalizeCreation): Deleted. * wasm/WasmModuleInformation.h: (JSC::Wasm::ModuleInformation::hasMemoryImport const): * wasm/js/JSWebAssembly.cpp: (JSC::instantiate): (JSC::resolve): Deleted. * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance): (JSC::JSWebAssemblyInstance::initializeImports): (JSC::JSWebAssemblyInstance::finalizeCreation): * wasm/js/JSWebAssemblyInstance.h: * wasm/js/WebAssemblyInstanceConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImports): (JSC::WebAssemblyModuleRecord::initializeExports): (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): Deleted. * wasm/js/WebAssemblyModuleRecord.h: 2022-01-24 Mark Lam Rename Vector and FixedVector::findMatching to findIf to match stl naming. https://bugs.webkit.org/show_bug.cgi?id=234864 rdar://87424746 Reviewed by Yusuke Suzuki. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayPatternNode::emitDirectBinding): 2022-01-24 Yusuke Suzuki [JSC] Enable Array#groupBy and Array#groupByToMap https://bugs.webkit.org/show_bug.cgi?id=235549 Reviewed by Ross Kirsling. * runtime/OptionsList.h: 2022-01-24 Cameron McCormack Remove VM::stringCache https://bugs.webkit.org/show_bug.cgi?id=235536 Reviewed by Sam Weinig. We consult VM::stringCache when creating a JSString, but since bug 142115 we never insert anything into it. Removing this results in almost-significant improvements in the VueJS, Vanilla-ES2015, and jQuery sub-tests of Speedometer 2 (of 0.5-2%, 0.03 <= p <= 0.05), and an almost significant 0.2% improvement in the overall score (p = 0.06). * runtime/JSString.cpp: (JSC::jsStringWithCacheSlowCase): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: 2022-01-24 Diego Pino Garcia Unreviewed, fix non-unified build after r288458 * runtime/DeferredWorkTimer.h: 2022-01-24 Patrick Angle Web Inspector: [Flexbox] Add instrumentation/protocol bits for flex layout containers https://bugs.webkit.org/show_bug.cgi?id=235454 Reviewed by Devin Rousso. * inspector/protocol/CSS.json: 2022-01-24 Mikhail R. Gadelha [JSC][32bit] Fix regexp crash on ARMv7 https://bugs.webkit.org/show_bug.cgi?id=234476 Reviewed by Yusuke Suzuki. This patch fixes several regexp crashes on ARMv7 due to an incorrect offset to retrieve the 5th argument from the stack: in ARMv7, only 4 arguments are passed via registers r0-r3i, and any other argument is placed on the stack, however, YarrJIT was trying to get the 5th arg from a fixed offset, so because the generateEnter() method pushed register into the stack, the offset was wrong. This patch fixes how the offset is calculated for MIPS and ARMv7. This patch also introduces some small changes: 1. Added static_asserts that the YarrJIT calls do indeed have 5 arguments and that the 5th argument has the type that we expect (MatchingContextHolder*). 2. Removed an unnecessary pointer from the MatchingContextHolder constructor. 3. Fixed some warnings in the YarrJIT code here and there. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileRegExpTestInline): * runtime/RegExpInlines.h: (JSC::RegExp::matchInline): * yarr/YarrJIT.cpp: * yarr/YarrMatchingContextHolder.h: (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): 2022-01-24 Yusuke Suzuki [JSC] Support import assertion syntax https://bugs.webkit.org/show_bug.cgi?id=235312 Reviewed by Ross Kirsling. This patch adds syntax support for import assertion[1]. This does not add the actual feature propagating import assertion to the module request yet. [1]: https://github.com/tc39/proposal-import-assertions * bytecompiler/NodesCodegen.cpp: (JSC::ImportNode::emitBytecode): * parser/ASTBuilder.h: (JSC::ASTBuilder::createImportExpr): (JSC::ASTBuilder::createImportAssertionList): (JSC::ASTBuilder::appendImportAssertion): (JSC::ASTBuilder::createImportDeclaration): (JSC::ASTBuilder::createExportAllDeclaration): (JSC::ASTBuilder::createExportNamedDeclaration): * parser/NodeConstructors.h: (JSC::ImportNode::ImportNode): (JSC::ImportDeclarationNode::ImportDeclarationNode): (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode): (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode): * parser/Nodes.h: * parser/Parser.cpp: (JSC::Parser::parseImportAssertions): (JSC::Parser::parseImportDeclaration): (JSC::Parser::parseExportDeclaration): (JSC::Parser::parseMemberExpression): * parser/Parser.h: * parser/SyntaxChecker.h: (JSC::SyntaxChecker::createImportExpr): (JSC::SyntaxChecker::createImportAssertionList): (JSC::SyntaxChecker::appendImportAssertion): (JSC::SyntaxChecker::createImportDeclaration): (JSC::SyntaxChecker::createExportAllDeclaration): (JSC::SyntaxChecker::createExportNamedDeclaration): * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/OptionsList.h: 2022-01-24 Mark Lam Add FixedVector::clear(), contains(), find(), and findMatching(). https://bugs.webkit.org/show_bug.cgi?id=234855 Reviewed by Yusuke Suzuki. Use FixedVector instead of Vector in DeferredWorkTimer::TicketData now that the needed APIs have been added. * runtime/DeferredWorkTimer.h: 2022-01-24 Joseph Griego [Shadow Realms] Use WebCore module loaders for shadow realm importValue https://bugs.webkit.org/show_bug.cgi?id=234155 Reviewed by Darin Adler. Add hook for creating the new realm object for shadow realms, since importValue requires the cooperation of the module loading logic to work right. * API/JSAPIGlobalObject.cpp: * jsc.cpp: * runtime/JSGlobalObject.cpp: * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::deriveShadowRealmGlobalObject): * runtime/ShadowRealmConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmObject.cpp: (JSC::ShadowRealmObject::create): * runtime/ShadowRealmObject.h: 2022-01-21 Commit Queue Unreviewed, reverting r288400. https://bugs.webkit.org/show_bug.cgi?id=235470 broke ARM64E build Reverted changeset: "[JSC][32bit] Fix regexp crash on ARMv7" https://bugs.webkit.org/show_bug.cgi?id=234476 https://commits.webkit.org/r288400 2022-01-21 Mikhail R. Gadelha [JSC][32bit] Fix regexp crash on ARMv7 https://bugs.webkit.org/show_bug.cgi?id=234476 Reviewed by Yusuke Suzuki. This patch fixes several regexp crashes on ARMv7 due to an incorrect offset to retrieve the 5th argument from the stack: in ARMv7, only 4 arguments are passed via registers r0-r3i, and any other argument is placed on the stack, however, YarrJIT was trying to get the 5th arg from a fixed offset, so because the generateEnter() method pushed register into the stack, the offset was wrong. This patch fixes how the offset is calculated for MIPS and ARMv7. This patch also introduces some small changes: 1. Added static_asserts that the YarrJIT calls do indeed have 5 arguments and that the 5th argument has the type that we expect (MatchingContextHolder*). 2. Removed an unnecessary pointer from the MatchingContextHolder constructor. 3. Fixed some warnings in the YarrJIT code here and there. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileRegExpTestInline): * runtime/RegExpInlines.h: (JSC::RegExp::matchInline): * yarr/YarrJIT.cpp: * yarr/YarrMatchingContextHolder.h: (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): 2022-01-21 Yusuke Suzuki Unreviewed, follow-up after r288066 https://bugs.webkit.org/show_bug.cgi?id=235271 * runtime/DatePrototype.cpp: (JSC::applyToNumberToOtherwiseIgnoredArguments): (JSC::fillStructuresUsingDateArgs): (JSC::setNewValueFromTimeArgs): (JSC::setNewValueFromDateArgs): (JSC::applyToNumbersToTrashedArguments): Deleted. 2022-01-21 Mike Gorse Build failure with g++ 12: std::exchange undefined https://bugs.webkit.org/show_bug.cgi?id=235445 Reviewed by Michael Catanzaro. * API/JSRetainPtr.h: Include 2022-01-21 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 branch-testing operations https://bugs.webkit.org/show_bug.cgi?id=235442 Reviewed by Yusuke Suzuki. Implement MacroAssemblerRISCV64 branch-testing operations. The branching instructions being intentionally simple in RISC-V, and with no status register, scratch register has to be used to hold the testing result and perform a branch based on its value. This will disallow use of these implementations from Air, but that has to be address inside Air itself. When performing tests for values that are smaller than 64 bits in width, the tested value is zero-extended or, when necessary, loaded as an unsigned value, to impose zeroed upper bits that eliminate masking values that are too wide or get sign-extended when used as immediates. Post-masking, these shorter-width values still have to be sign-extended to accommodate branch instructions that are used when testing signedness. The test result value is then passed on, along with the desired condition, to the new branchTestFinalize() helper method that finally generates the appropriate branch. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::branchTest8): (JSC::MacroAssemblerRISCV64::branchTest16): (JSC::MacroAssemblerRISCV64::branchTest32): (JSC::MacroAssemblerRISCV64::branchTest64): (JSC::MacroAssemblerRISCV64::branchPtr): (JSC::MacroAssemblerRISCV64::branchTestFinalize): 2022-01-21 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 operations for bitfield, zero-counting, byte-swapping operations https://bugs.webkit.org/show_bug.cgi?id=235439 Reviewed by Yusuke Suzuki. Add MacroAssemblerRISCV64 implementations that cover unsigned bitfield, leading-zero, trailing-zero and byte-swapping operations. All these operations are not supported in base RISC-V specifications. There are extensions currently being ratified that will introduce more useful instructions, but until then more verbose implementations will have to be used. For the unsigned bitfield operations, the desired result is achieved through shifting and masking. Scratch registers are only needed in case of the mask immediate being too large, but that will be properly handled by the higher-level JITs. For other operations covered in this patch we have to use scratch registers and custom loops to implement the necessary behavior. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::extractUnsignedBitfield32): (JSC::MacroAssemblerRISCV64::extractUnsignedBitfield64): (JSC::MacroAssemblerRISCV64::insertUnsignedBitfieldInZero32): (JSC::MacroAssemblerRISCV64::insertUnsignedBitfieldInZero64): (JSC::MacroAssemblerRISCV64::countLeadingZeros32): (JSC::MacroAssemblerRISCV64::countLeadingZeros64): (JSC::MacroAssemblerRISCV64::countTrailingZeros32): (JSC::MacroAssemblerRISCV64::countTrailingZeros64): (JSC::MacroAssemblerRISCV64::byteSwap16): (JSC::MacroAssemblerRISCV64::byteSwap32): (JSC::MacroAssemblerRISCV64::byteSwap64): 2022-01-21 Alex Christensen Fix build when using Visual Studio 2022 https://bugs.webkit.org/show_bug.cgi?id=235440 Reviewed by Antti Koivisto. It doesn't like having a switch with a default but no cases. This is cleaner with if statements anyways. Also make members const because I can. * jit/JITCode.cpp: (JSC::JITCode::calleeSaveRegisters const): * jit/JITCode.h: 2022-01-21 Lauro Moura [CMake] Cannot link libTestRunnerInjectedBundle.so in non unified build https://bugs.webkit.org/show_bug.cgi?id=226088 Reviewed by Adrian Perez de Castro. * wasm/js/JSWebAssemblyModule.h: Add missing header 2022-01-20 Pablo Saavedra Non-unified build fails due to forward declaration in JavaScriptCore/jit/JITStubRoutine.h https://bugs.webkit.org/show_bug.cgi?id=235409 Unreviewed non-unified build fix. * jit/JITStubRoutine.h: 2022-01-20 Joseph Griego [JSC] Add section directive in MacroAssemblerX86Common asm blocks https://bugs.webkit.org/show_bug.cgi?id=235406 Reviewed by Yusuke Suzuki. These asm blocks aren't in a function body so they need a .text directive to prevent them from being included in some arbitrary section (say, an inline function's section) by happenstance, which was happening in the WPE build without UnifiedSources. * assembler/MacroAssemblerX86Common.cpp: 2022-01-19 Yusuke Suzuki [JSC] Implement Temporal.Now.instant() https://bugs.webkit.org/show_bug.cgi?id=234836 Reviewed by Ross Kirsling. This patch implements Temporal.Now.instant() since Temporal.Instant is now implemented. It returns an instant which represents current wall time. * runtime/ISO8601.cpp: (JSC::ISO8601::ExactTime::now): * runtime/ISO8601.h: * runtime/TemporalNow.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2022-01-19 Yusuke Suzuki [JSC] Fix non-JIT Windows LLInt https://bugs.webkit.org/show_bug.cgi?id=235388 Reviewed by Mark Lam. We should implement cCall3 which calls llint_link_call etc. from LLInt code. This implementation needs to work on Windows too, so it requires stack modification. While we do not have a problem on JIT Windows build, it is required for non JIT Windows build. (If JIT is enabled, LLInt is fine. But if JIT is entirely disabled, this change is required.) * llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_link_call): (JSC::LLInt::llint_virtual_call): * llint/LLIntSlowPaths.h: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/cloop.rb: * offlineasm/instructions.rb: 2022-01-19 Saam Barati Update ARM64EHash https://bugs.webkit.org/show_bug.cgi?id=235192 Reviewed by Mark Lam. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * assembler/AssemblerBuffer.h: (JSC::ARM64EHash::ARM64EHash): (JSC::ARM64EHash::~ARM64EHash): (JSC::ARM64EHash::allocatePinForCurrentThreadAndInitializeHash): (JSC::ARM64EHash::deallocatePinForCurrentThread): (JSC::ARM64EHash::update): (JSC::ARM64EHash::pin): (JSC::ARM64EHash::currentHash): (JSC::ARM64EHash::setUpdatedHash): (JSC::AssemblerBuffer::AssemblerBuffer): (JSC::AssemblerBuffer::arm64eHash): (JSC::AssemblerBuffer::putIntegralUnchecked): (JSC::ARM64EHash::bitsForDiversifier): Deleted. * assembler/LinkBuffer.cpp: (JSC::LinkBuffer::copyCompactAndLinkCode): (JSC::LinkBuffer::allocate): * assembler/SecureARM64EHashPins.cpp: Added. (JSC::WriteToJITRegionScope::WriteToJITRegionScope): (JSC::WriteToJITRegionScope::~WriteToJITRegionScope): (JSC::ValidateNonReentrancyScope::ValidateNonReentrancyScope): (JSC::ValidateNonReentrancyScope::~ValidateNonReentrancyScope): (JSC::allocateInExecutableMemory): (JSC::SecureARM64EHashPins::Page::Page): (JSC::initializePage): (JSC::SecureARM64EHashPins::metadata): (JSC::SecureARM64EHashPins::initializeAtStartup): (JSC::SecureARM64EHashPins::allocatePinForCurrentThreadImpl): (JSC::SecureARM64EHashPins::allocatePinForCurrentThread): (JSC::SecureARM64EHashPins::deallocatePinForCurrentThread): * assembler/SecureARM64EHashPins.h: Added. (JSC::SecureARM64EHashPins::firstPage): * assembler/SecureARM64EHashPinsInlines.h: Added. (JSC::SecureARM64EHashPins::keyForCurrentThread): (JSC::SecureARM64EHashPins::forEachPage): (JSC::SecureARM64EHashPins::forEachEntry): (JSC::SecureARM64EHashPins::findFirstEntry): (JSC::SecureARM64EHashPins::pinForCurrentThread): * heap/MarkedBlock.h: * heap/MarkedSpace.h: * heap/SlotVisitor.h: * jit/BaselineJITPlan.cpp: (JSC::BaselineJITPlan::BaselineJITPlan): (JSC::BaselineJITPlan::compileInThreadImpl): * jit/ExecutableAllocator.cpp: * parser/Parser.h: * runtime/InitializeThreading.cpp: (JSC::initialize): * runtime/IterationStatus.h: Removed. * runtime/JSCConfig.h: * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::parseAndCompileAir): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::parseAndCompileB3): * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::compileFunction): 2022-01-19 Yusuke Suzuki [JSC] Fix YarrJIT backtrackCharacterClassNonGreedy breakpoint https://bugs.webkit.org/show_bug.cgi?id=235348 Reviewed by Michael Saboff. YarrJIT's backtrackCharacterClassNonGreedy breakpoint is actually reachable. We should subtract index (since it is already incremented), and go to the normal nonGreedyFailures path. * yarr/YarrJIT.cpp: 2022-01-19 Michael Catanzaro Fix -Wreturn-type and -Wunused-parameter warnings, January 2022 edition https://bugs.webkit.org/show_bug.cgi?id=235336 Reviewed by Adrian Perez de Castro. * wasm/WasmCompilationMode.h: (JSC::Wasm::isOSREntry): (JSC::Wasm::isAnyBBQ): (JSC::Wasm::isAnyOMG): 2022-01-18 Yusuke Suzuki [JSC] Remove Wasm::Table's m_mask https://bugs.webkit.org/show_bug.cgi?id=235329 Reviewed by Mark Lam. This patch removes m_mask in Wasm::Table. The mask is removed in the other places, but forgot removing that in Wasm::Table. * wasm/WasmTable.cpp: (JSC::Wasm::Table::setLength): (JSC::Wasm::Table::clear): (JSC::Wasm::Table::set): (JSC::Wasm::Table::get const): (JSC::Wasm::FuncRefTable::setFunction): (JSC::Wasm::FuncRefTable::function const): (JSC::Wasm::FuncRefTable::instance const): * wasm/WasmTable.h: (JSC::Wasm::Table::offsetOfLength): (JSC::Wasm::Table::offsetOfMask): Deleted. (JSC::Wasm::Table::mask const): Deleted. 2022-01-18 Alex Christensen Use c++2a instead of gnu++2a for Cocoa builds https://bugs.webkit.org/show_bug.cgi?id=234936 Reviewed by Sam Weinig. * Configurations/Base.xcconfig: * Configurations/JavaScriptCore.xcconfig: * DerivedSources.make: 2022-01-18 Adrian Perez de Castro Non-unified build fails due to missing header in WasmCalleeGroup.cpp Unreviewed non-unified build fix. * wasm/WasmCalleeGroup.cpp: Add missing inclusion of the LinkBuffer.h header. 2022-01-16 Lauro Moura Fix C++20 build warnings with GCC https://bugs.webkit.org/show_bug.cgi?id=235023 Reviewed by Alex Christensen. Mostly related to deprecating operations between enums of different types and not capturing this by default in lambdas. * assembler/X86Assembler.h: Casting enums to same type. (JSC::X86Assembler::cmovcc): (JSC::X86Assembler::jccRel32): (JSC::X86Assembler::setccOpcode): * b3/B3CheckSpecial.cpp: Capture this in lambda. (JSC::B3::CheckSpecial::generate): * b3/B3Type.cpp: Replace is_pod_v is is_standard_layout_v and is_trivial_v * bytecode/AccessCase.cpp: Capture this in lambda. (JSC::AccessCase::generateImpl): * bytecode/CallLinkInfo.cpp: Ditto. (JSC::OptimizingCallLinkInfo::emitDirectFastPath): (JSC::OptimizingCallLinkInfo::emitDirectTailCallFastPath): (JSC::OptimizingCallLinkInfo::initializeDirectCall): * dfg/DFGSpeculativeJIT.cpp: Ditto. * dfg/DFGSpeculativeJIT64.cpp: Ditto. (JSC::DFG::SpeculativeJIT::compile): * jit/ICStats.h: Cast enums to same type. (JSC::ICEvent::hash const): * jit/JITArithmetic.cpp: Capture this in lambda. (JSC::JIT::emitMathICSlow): * jit/JITSizeStatistics.cpp: Ditto. (JSC::JITSizeStatistics::markEnd): * runtime/VM.cpp: Ditto. (JSC::VM::deleteAllLinkedCode): (JSC::VM::deleteAllCode): (JSC::VM::shrinkFootprintWhenIdle): * wasm/WasmAirIRGenerator.cpp: Ditto. (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::addTableGet): (JSC::Wasm::AirIRGenerator::addTableSet): (JSC::Wasm::AirIRGenerator::addTableInit): (JSC::Wasm::AirIRGenerator::addTableFill): (JSC::Wasm::AirIRGenerator::addTableCopy): (JSC::Wasm::AirIRGenerator::addMemoryFill): (JSC::Wasm::AirIRGenerator::addMemoryCopy): (JSC::Wasm::AirIRGenerator::addMemoryInit): (JSC::Wasm::AirIRGenerator::emitCheckAndPreparePointer): (JSC::Wasm::AirIRGenerator::emitAtomicLoadOp): (JSC::Wasm::AirIRGenerator::emitAtomicStoreOp): (JSC::Wasm::AirIRGenerator::emitAtomicBinaryRMWOp): (JSC::Wasm::AirIRGenerator::emitAtomicCompareExchange): (JSC::Wasm::AirIRGenerator::atomicWait): (JSC::Wasm::AirIRGenerator::atomicNotify): (JSC::Wasm::AirIRGenerator::emitEntryTierUpCheck): (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addCallIndirect): (JSC::Wasm::AirIRGenerator::addCallRef): (JSC::Wasm::AirIRGenerator::emitChecksForModOrDiv): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): (JSC::Wasm::AirIRGenerator::addOp): * wasm/WasmB3IRGenerator.cpp: Ditto. (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::B3IRGenerator::addTableGet): (JSC::Wasm::B3IRGenerator::addTableSet): (JSC::Wasm::B3IRGenerator::addTableInit): (JSC::Wasm::B3IRGenerator::addTableFill): (JSC::Wasm::B3IRGenerator::addTableCopy): (JSC::Wasm::B3IRGenerator::emitIndirectCall): (JSC::Wasm::B3IRGenerator::addMemoryFill): (JSC::Wasm::B3IRGenerator::addMemoryInit): (JSC::Wasm::B3IRGenerator::addMemoryCopy): (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffsetForAtomicOps): (JSC::Wasm::B3IRGenerator::atomicWait): (JSC::Wasm::B3IRGenerator::atomicNotify): (JSC::Wasm::B3IRGenerator::emitEntryTierUpCheck): (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): (JSC::Wasm::B3IRGenerator::addCall): (JSC::Wasm::B3IRGenerator::addCallIndirect): (JSC::Wasm::B3IRGenerator::addCallRef): (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): * yarr/YarrJIT.cpp: Ditto. 2022-01-15 Yusuke Suzuki [JSC] Fix Date functions' argument coercion https://bugs.webkit.org/show_bug.cgi?id=235271 Reviewed by Alexey Shvayka. Even if the input Date is NaN or the result looks like NaN, we need to coerce passed arguments to Number[1] since it has observable side effect. [1]: https://github.com/tc39/ecma262/pull/2136 * runtime/DatePrototype.cpp: (JSC::applyToNumbersToTrashedArguments): (JSC::fillStructuresUsingTimeArgs): (JSC::fillStructuresUsingDateArgs): (JSC::setNewValueFromTimeArgs): (JSC::setNewValueFromDateArgs): 2022-01-15 Yusuke Suzuki [JSC] Fix misc issues in WebAssembly.Exception https://bugs.webkit.org/show_bug.cgi?id=235261 Reviewed by Alexey Shvayka. 1. Add @toStringTag to WebAssembly.Exception.prototype. 2. Add argument count check for WebAssembly.Exception methods (since it is specified in WebIDL and these methods do not have optional parameters). * wasm/js/WebAssemblyExceptionPrototype.cpp: (JSC::WebAssemblyExceptionPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): 2022-01-15 Yusuke Suzuki [JSC] Fix misc WebAssembly.Table issues https://bugs.webkit.org/show_bug.cgi?id=235262 Reviewed by Alexey Shvayka. * wasm/js/WebAssemblyTablePrototype.cpp: 2022-01-14 Yusuke Suzuki and Mikhail R. Gadelha [JSC] Fix Linux 64bit compilation https://bugs.webkit.org/show_bug.cgi?id=235232 Reviewed by Saam Barati. Define PAS_BMALLOC in all projects since JavaScriptCore includes some files which can require this macro variable. Previously, JSDollarVM.cpp includes these files first, then at that time, we can define PAS_BMALLOC. However, after enabling jit-heap, these files are included before JSDollarVM.cpp and include pas_config.h without PAS_BMALLOC definition, which later causes the problem when including pas_lock.h since non PAS_BMALLOC libpas requires darwin specific locking. Since defining PAS_BMALLOC does not matter to whether using libpas or not, this patch just defines it globally. And for Apple ports, we define this when we define BENABLE_LIBPAS. * tools/JSDollarVM.cpp: 2022-01-14 Yusuke Suzuki [JSC] Fix WebAssembly.Global's typename for "anyfunc" https://bugs.webkit.org/show_bug.cgi?id=235105 Reviewed by Keith Miller. We should return "anyfunc" string instead of "funcref" according to the spec[1,2]. [1]: https://webassembly.github.io/spec/js-api/#globals [2]: https://webassembly.github.io/spec/js-api/#tables * wasm/js/JSWebAssemblyGlobal.cpp: (JSC::JSWebAssemblyGlobal::type): * wasm/js/JSWebAssemblyTable.cpp: (JSC::JSWebAssemblyTable::type): 2022-01-14 Mark Lam JSStringJoiner's constructor should take a size_t length. https://bugs.webkit.org/show_bug.cgi?id=235217 rdar://87538657 Reviewed by Yusuke Suzuki. Also removed an unnecessary exception check in JSStringJoiner::append(). This is because appendWithoutSideEffects() cannot throw any exceptions. * runtime/JSStringJoiner.h: (JSC::JSStringJoiner::JSStringJoiner): (JSC::JSStringJoiner::append): 2022-01-14 Alexey Shvayka JSArray::fastSlice() should not convert the source from CoW https://bugs.webkit.org/show_bug.cgi?id=234990 Reviewed by Yusuke Suzuki. Since we aren't modifying the source array in fastSlice() nor its slow path, there is no reason to convert it from CopyOnWrite. * runtime/JSArray.cpp: (JSC::JSArray::fastSlice): 2022-01-14 Saam Barati Make isJITPC fast https://bugs.webkit.org/show_bug.cgi?id=235241 Reviewed by Yusuke Suzuki. Make it an inlined function, and stop tagging g_jscConfig.startExecutableMemory and g_jscConfig.endExecutableMemory, since they're in the Config page, and not mutable after it's frozen. * jit/ExecutableAllocator.cpp: (JSC::initializeJITPageReservation): (JSC::isJITPC): Deleted. * jit/ExecutableAllocator.h: (JSC::isJITPC): 2022-01-14 Saam Barati Use IRC for Wasm, and Briggs for JS on ARM64 https://bugs.webkit.org/show_bug.cgi?id=235235 Reviewed by Yusuke Suzuki and Robin Morisset. When I turned on IRC for everything in r287218, we saw some regressions on iOS on JetStream2. So, this patch makes it so JS code on arm64 goes back to using Briggs, and Wasm will use IRC. * b3/air/AirAllocateRegistersByGraphColoring.cpp: * b3/air/AirCode.h: (JSC::B3::Air::Code::setForceIRCRegisterAllocation): (JSC::B3::Air::Code::forceIRCRegisterAllocation): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::parseAndCompileB3): 2022-01-13 Zan Dobersek [RISCV64] riscv64 backend should lower offlineasm instructions https://bugs.webkit.org/show_bug.cgi?id=234952 Reviewed by Yusuke Suzuki. In the riscv64 offlineasm backend, instead of handling higher-level offlineasm instructions with different operand combinations and manually juggling temp registers, use the approach of aggressively lowering these opcodes into sequences of RISC-V instructions. Addresses and immediate values are lowered into usable forms where necessary. Different lowering phases handle any offlineasm instruction so that the resulting opcodes can be, with accompanying operands, used trivially to construct the RISC-V assembly. Lowered RISC-V opcodes use the 'rv_' prefix so that they can be easily diassociated from any offlineasm opcode that might share the same name. The prefix is removed when the assembly is finally generated. * offlineasm/riscv64.rb: 2022-01-13 Saam Barati Link Wasm code on the same thread that JITs https://bugs.webkit.org/show_bug.cgi?id=235201 Reviewed by Yusuke Suzuki and Mark Lam. This is preparing us for the changes that'll be needed by https://bugs.webkit.org/show_bug.cgi?id=235192. It should also be a small perf improvement, as we're now linking in parallel instead of doing it after all compilations have finished. * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::parseAndCompileB3): * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::prepareImpl): (JSC::Wasm::BBQPlan::compileFunction): (JSC::Wasm::BBQPlan::didCompleteCompilation): (JSC::Wasm::BBQPlan::initializeCallees): * wasm/WasmBBQPlan.h: 2022-01-13 Elliott Williams [XCBuild] Add "product dependencies" which influence workspace build order https://bugs.webkit.org/show_bug.cgi?id=235094 Some ancillary targets (e.g. script-only targets like Derived Sources) do not have implicit dependencies visible to Xcode. In workspace builds, we need to give XCBuild additional information to ensure that they always run after their dependencies. This patch adds "Product Dependencies" phases, which are Copy Files phases that copy the _product_ of another dependency. The product names are also added to EXCLUDED_SOURCE_FILE_NAMES, making the actual copy a no-op, but these phases give XCBuild enough metadata to infer the relationship between targets. For example, JavaScriptCore's "Generate Unified Sources" target depends on headers from WTF, so it lists libWTF.a in its Product Dependencies. Xcode sees the relationship between the target doing the copy (Generate Unified Sources) and the target which produces the product (WTF) and schedules them accordingly. Because these dependencies are _implicit_ and the copy phases are no-ops, they do not influence command-line or production builds where each project is built separately. Reviewed by Alexey Proskuryakov. * Configurations/Base.xcconfig: Add EXCLUDED_SOURCE_FILE_NAMES * Configurations/JavaScriptCore.xcconfig: Inherit EXCLUDED_SOURCE_FILE_NAMES * JavaScriptCore.xcodeproj/project.pbxproj: Add Product Dependencies 2022-01-13 Tim Horton Fix a few Objective-C object leaks due to early returns in `init` https://bugs.webkit.org/show_bug.cgi?id=235162 Reviewed by Wenson Hsieh. * API/JSValue.mm: (-[JSValue initWithValue:inContext:]): 2022-01-12 Mark Lam [Re-landing] Update hashThreadState() to exclude __opaque_flags. https://bugs.webkit.org/show_bug.cgi?id=235081 rdar://86282584 Reviewed by Keith Miller. Removed some unused code. * runtime/MachineContext.h: (JSC::MachineContext::stackPointer): (JSC::MachineContext::framePointer): (JSC::MachineContext::instructionPointer): (JSC::MachineContext::linkRegister): (JSC::MachineContext::setStackPointer): Deleted. (JSC::MachineContext::setFramePointer): Deleted. (JSC::MachineContext::setLinkRegister): Deleted. 2022-01-12 Commit Queue Unreviewed, reverting r287912. https://bugs.webkit.org/show_bug.cgi?id=235164 ARM64/ARM64E Speedometer2 50% regression, probably breaking something Reverted changeset: "[RISCV64] riscv64 backend should lower offlineasm instructions" https://bugs.webkit.org/show_bug.cgi?id=234952 https://commits.webkit.org/r287912 2022-01-12 Commit Queue Unreviewed, reverting r287908. https://bugs.webkit.org/show_bug.cgi?id=235156 Broke M1 Monterey JSC Reverted changeset: "Update hashThreadState() to exclude __opaque_flags." https://bugs.webkit.org/show_bug.cgi?id=235081 https://commits.webkit.org/r287908 2022-01-11 Zan Dobersek [RISCV64] riscv64 backend should lower offlineasm instructions https://bugs.webkit.org/show_bug.cgi?id=234952 Reviewed by Yusuke Suzuki. In the riscv64 offlineasm backend, instead of handling higher-level offlineasm instructions with different operand combinations and manually juggling temp registers, use the approach of aggressively lowering these opcodes into sequences of RISC-V instructions. Addresses and immediate values are lowered into usable forms where necessary. Different lowering phases handle any offlineasm instruction so that the resulting opcodes can be, with accompanying operands, used trivially to construct the RISC-V assembly. Lowered RISC-V opcodes use the 'rv_' prefix so that they can be easily diassociated from any offlineasm opcode that might share the same name. The prefix is removed when the assembly is finally generated. * offlineasm/risc.rb: Also handle branch-on-arithmetic opcodes in the riscvLowerMisplacedAddress lowering phase. * offlineasm/riscv64.rb: 2022-01-11 Mark Lam Update hashThreadState() to exclude __opaque_flags. https://bugs.webkit.org/show_bug.cgi?id=235081 rdar://86282584 Reviewed by Keith Miller. Removed some unused code. * runtime/MachineContext.h: (JSC::MachineContext::stackPointer): (JSC::MachineContext::framePointer): (JSC::MachineContext::instructionPointer): (JSC::MachineContext::linkRegister): (JSC::MachineContext::setStackPointer): Deleted. (JSC::MachineContext::setFramePointer): Deleted. (JSC::MachineContext::setLinkRegister): Deleted. 2022-01-11 Asumu Takikawa [Wasm] Unify memory import handling in module loader and JS cases https://bugs.webkit.org/show_bug.cgi?id=234116 Reviewed by Yusuke Suzuki. Moves the memory import handling code to the Wasm module record and use the strategy used by the module loader to handle memory in all cases. * wasm/WasmModule.cpp: (JSC::Wasm::Module::copyInitialCalleeGroupToAllMemoryModes): * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::finalizeCreation): (JSC::JSWebAssemblyInstance::tryCreate): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): 2022-01-11 Yusuke Suzuki [JSC] Fix kind of error thrown by wasm module creation https://bugs.webkit.org/show_bug.cgi?id=235082 Reviewed by Michael Saboff. It should throw WebAssembly.CompileError instead of WebAssembly.LinkError. This fixes occasional failure in wasm imports-oom.js test. * wasm/js/JSWebAssemblyModule.cpp: (JSC::JSWebAssemblyModule::createStub): 2022-01-11 Adrian Perez de Castro Non-unified build fixes, early January 2022 edition https://bugs.webkit.org/show_bug.cgi?id=235013 Unreviewed non-unified build fixes. * wasm/js/JSWebAssemblyModule.cpp: Add missing JSWebAssemblyLinkError.h header. * wasm/js/JSWebAssemblyModule.h: Add missing forward declaration for the JSC::OptimizingCallLinkInfo type. 2022-01-10 Saam Barati Allow loop tier up to the Air tier https://bugs.webkit.org/show_bug.cgi?id=234587 Reviewed by Yusuke Suzuki. This patch adds loop tier up from LLInt -> Air. To implement this, we use EntrySwitch to point at each loop header, making each loop an entrypoint. This is unlike BBQ->OMG tier up, where we compile a special OSR entry OMG callee. This seems like a good architecture for the Air tier, since we might end up with slightly worse throughput, but we won't need a different compilation for loops vs call entrypoints. This patch also fixes a bug in Air's O0 register allocation where it didn't properly account for all named registers in an instruction. There was a silly bug where we asked each arg if it were a temp, instead of asking the Inst for each of its temps, since an Arg can be an address but still use temps. * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp: (JSC::B3::Air::GenerateAndAllocateRegisters::generate): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitLoad): (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::finalizeEntrypoints): (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addLoop): (JSC::Wasm::parseAndCompileAir): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::parseAndCompileB3): (JSC::Wasm::parseAndCompile): Deleted. * wasm/WasmB3IRGenerator.h: * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::prepareImpl): (JSC::Wasm::BBQPlan::work): (JSC::Wasm::BBQPlan::compileFunction): (JSC::Wasm::BBQPlan::didCompleteCompilation): (JSC::Wasm::BBQPlan::initializeCallees): * wasm/WasmBBQPlan.h: * wasm/WasmCallee.h: * wasm/WasmCalleeGroup.h: * wasm/WasmFormat.h: * wasm/WasmIRGeneratorHelpers.h: (JSC::Wasm::computeExceptionHandlerAndLoopEntrypointLocations): (JSC::Wasm::computeExceptionHandlerLocations): * wasm/WasmLLIntPlan.cpp: (JSC::Wasm::LLIntPlan::didCompleteCompilation): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmOSREntryPlan.cpp: (JSC::Wasm::OSREntryPlan::work): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::WASM_SLOW_PATH_DECL): * wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper): 2022-01-10 Alex Christensen Start using C++20 https://bugs.webkit.org/show_bug.cgi?id=233963 Reviewed by Yusuke Suzuki. * Configurations/Base.xcconfig: * Configurations/JavaScriptCore.xcconfig: * DerivedSources.make: * heap/Heap.cpp: (JSC::Heap::addCoreConstraints): * runtime/CachedTypes.cpp: * runtime/LiteralParser.h: * shell/PlatformPlayStation.cmake: 2022-01-10 Elliott Williams postprocess-headers.sh: Avoid redundant processing to speed up incremental Xcode builds https://bugs.webkit.org/show_bug.cgi?id=234941 Reviewed by Jonathan Bedard. On builds made with the legacy build system (currently any CLI build for Apple platforms), postprocess-headers.sh always runs, even when no headers have been copied. PBXBuild doesn't have the necessary granularity to let us avoid running it when there are no headers to copy, however, this patch improves execution time by only running the postprocess rule when a header has changed since the last time it ran. This change reduces JavaScriptCore's null build time from ~18.3s to ~5.32s. * postprocess-headers.sh: Added timestamp check 2022-01-09 Sam Weinig Remove support for Direct2D https://bugs.webkit.org/show_bug.cgi?id=234999 Reviewed by Darin Adler. Direct2D and FTW have not been building for over a year. It is time to remove them. * PlatformFTW.cmake: Removed. 2022-01-07 Saam Barati Unreviewed. Appease an assertion that was broken by r287801 by slightly refactoring code so we don't clobber the same named register twice. * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp: (JSC::B3::Air::GenerateAndAllocateRegisters::generate): 2022-01-07 Saam Barati Add support for Wasm exceptions in the Air generator https://bugs.webkit.org/show_bug.cgi?id=231211 Reviewed by Filip Pizlo. This patch adds support to Air for Wasm exceptions. The implementation is very similar to how we implement it in the B3 Wasm tier. This patch shares code with the B3 tier where it can. This patch also fixes a bug where you the early clobbered registers of a patchpoint could prevent the prior instruction from register allocating. For example, you can have the instructions I1, I2. Where I2 clobbers the entire register file. It doesn't mean I1 shouldn't be able to allocate registers. Instead, the clobber should occur after I1 executes. This patch fixes the issue. * JavaScriptCore.xcodeproj/project.pbxproj: * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp: (JSC::B3::Air::GenerateAndAllocateRegisters::generate): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::ControlData::ControlData): (JSC::Wasm::AirIRGenerator::ControlData::isTry): (JSC::Wasm::AirIRGenerator::ControlData::isCatch): (JSC::Wasm::AirIRGenerator::ControlData::convertTryToCatch): (JSC::Wasm::AirIRGenerator::ControlData::convertTryToCatchAll): (JSC::Wasm::AirIRGenerator::ControlData::tryStart const): (JSC::Wasm::AirIRGenerator::ControlData::tryEnd const): (JSC::Wasm::AirIRGenerator::ControlData::tryDepth const): (JSC::Wasm::AirIRGenerator::ControlData::catchKind const): (JSC::Wasm::AirIRGenerator::ControlData::exception const): (JSC::Wasm::AirIRGenerator::emitCallPatchpoint): (JSC::Wasm::AirIRGenerator::addStackMap): (JSC::Wasm::AirIRGenerator::takeStackmaps): (JSC::Wasm::AirIRGenerator::takeExceptionHandlers): (JSC::Wasm::AirIRGenerator::newTmp): (JSC::Wasm::AirIRGenerator::emitPatchpoint): (JSC::Wasm::AirIRGenerator::emitLoad): (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::finalizeEntrypoints): (JSC::Wasm::AirIRGenerator::forEachLiveValue): (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addTry): (JSC::Wasm::AirIRGenerator::addCatch): (JSC::Wasm::AirIRGenerator::addCatchAll): (JSC::Wasm::AirIRGenerator::addCatchToUnreachable): (JSC::Wasm::AirIRGenerator::addCatchAllToUnreachable): (JSC::Wasm::AirIRGenerator::emitCatchImpl): (JSC::Wasm::AirIRGenerator::addDelegate): (JSC::Wasm::AirIRGenerator::addDelegateToUnreachable): (JSC::Wasm::AirIRGenerator::addThrow): (JSC::Wasm::AirIRGenerator::addRethrow): (JSC::Wasm::AirIRGenerator::addEndToUnreachable): (JSC::Wasm::AirIRGenerator::addCall): (JSC::Wasm::AirIRGenerator::emitIndirectCall): (JSC::Wasm::parseAndCompileAir): (JSC::Wasm::AirIRGenerator::preparePatchpointForExceptions): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::insertEntrySwitch): (JSC::Wasm::B3IRGenerator::emitCatchImpl): (JSC::Wasm::B3IRGenerator::addThrow): (JSC::Wasm::B3IRGenerator::addRethrow): (JSC::Wasm::PatchpointExceptionHandle::generate const): Deleted. (JSC::Wasm::buildEntryBufferForCatch): Deleted. (JSC::Wasm::computeExceptionHandlerLocations): Deleted. * wasm/WasmB3IRGenerator.h: * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::compileFunction): * wasm/WasmIRGeneratorHelpers.h: Added. (JSC::Wasm::PatchpointExceptionHandle::generate const): (JSC::Wasm::computeExceptionHandlerLocations): (JSC::Wasm::emitRethrowImpl): (JSC::Wasm::emitThrowImpl): (JSC::Wasm::buildEntryBufferForCatch): (JSC::Wasm::emitCatchPrologueShared): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::finalize): * wasm/WasmModuleInformation.h: * wasm/WasmOMGPlan.cpp: * wasm/WasmOSREntryPlan.cpp: * wasm/WasmStreamingParser.cpp: (JSC::Wasm::StreamingParser::parseCodeSectionSize): 2022-01-07 Alexey Shvayka Expand the set of objects we take JSArray::fastSlice() path for https://bugs.webkit.org/show_bug.cgi?id=234539 Reviewed by Yusuke Suzuki. Currently, Array.prototype's slice() / splice() methods take a fast path only for JSArray source objects. With this change, gcSafeMemcpy-based path is taken for any object with ordinary getOwnPropertySlotByIndex() method, which speeds up the common case of `[].slice.call(arguments)` by 140% (in strict mode only, see ClonedArguments). Also, once is https://webkit.org/b/234538 resolved, calling Array.prototype.slice() on a static NodeList, which is a common idiom to acquire map() / filter() methods, will become faster as well. This patch was thoroughly evaluated to be spec-perfect and memory-safe: - indexing mode check and holesMustForwardToPrototype() guarantee that there are no observable userland code to be invoked; - fastSlice() signature is upgraded to uint64_t so `nullptr` is returned in case of large "length", resulting in a RangeError being thrown on the slow path; - to handle the case of source array being shrinked after "length" lookup (see r175420), OOB read check is moved to JSArray::fastSlice() and refined to rely on vectorLength() so the double "length" lookup is avoided (added a test for this). All this (and more) is well covered by the test262 suite. This change improves Speedometer2/EmberJS-Debug-TodoMVC score by 0.5%: although the test is slow on its own, `[].slice.call(arguments)` is performed ~56k times per run. * runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSArray.cpp: (JSC::JSArray::fastSlice): * runtime/JSArray.h: 2022-01-07 Tim Horton Adopt linkedOnOrAfter() in more places https://bugs.webkit.org/show_bug.cgi?id=234951 Reviewed by Wenson Hsieh. * API/JSWrapperMap.mm: (supportsInitMethodConstructors): * API/tests/testapi.cpp: (TestAPI::promiseDrainDoesNotEatExceptions): * API/tests/testapi.mm: (testMicrotaskWithFunction): * runtime/JSLock.cpp: (JSC::JSLock::willReleaseLock): * runtime/ObjectPrototype.cpp: (JSC::isPokerBros): Adopt linkedOnOrAfter. 2022-01-07 Alex Christensen Unreviewed, reverting r287698. Broke an internal build Reverted changeset: "Start using C++20" https://bugs.webkit.org/show_bug.cgi?id=233963 https://commits.webkit.org/r287698 2022-01-07 Yusuke Suzuki [JSC] Clean up StructureStubInfo https://bugs.webkit.org/show_bug.cgi?id=234943 Reviewed by Saam Barati. Use std::unique_ptr instead of raw pointer. * bytecode/CheckPrivateBrandStatus.cpp: (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/DeleteByStatus.cpp: (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InstanceOfStatus.cpp: (JSC::InstanceOfStatus::computeForStubInfo): * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * bytecode/SetPrivateBrandStatus.cpp: (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::deref): (JSC::StructureStubInfo::aboutToDie): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::visitAggregateImpl): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::summary const): (JSC::StructureStubInfo::containsPC const): (JSC::StructureStubInfo::~StructureStubInfo): Deleted. * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfCodePtr): (JSC::StructureStubInfo::offsetOfDoneLocation): (JSC::StructureStubInfo::offsetOfSlowPathStartLocation): (JSC::StructureStubInfo::offsetOfSlowOperation): (JSC::StructureStubInfo::offsetOfCountdown): 2022-01-06 Saam Barati preparePatchpointForExceptions needs to handle tuples https://bugs.webkit.org/show_bug.cgi?id=234909 Reviewed by Yusuke Suzuki. We got the offsets wrong when building a stackmap in B3IRGenerator for exception sites. We need to index into StackmapGenerationParams differently from indexing into the patchpoint's children. StackmapGenerationParams reserves its first N entries for the N return values. The patchpoint's children contains no results though, so we don't need to account for the number of return values when indexing into the children() vector of the PatchpointValue. To make this code simpler, we keep track of the number of live values we need when throwing. These values are both at the end of StackmapGenerationParams and at the end of the children() vector. So we just look at the last "number of live values" in both vectors to get the correct ValueRep and correct type. The code for calls also didn't account for the fact that call arguments will be appended after the live values we're building into a stackmap. This patch fixes that code to always put the live values last. * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::PatchpointExceptionHandle::generate const): (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions): 2022-01-06 Alex Christensen Start using C++20 https://bugs.webkit.org/show_bug.cgi?id=233963 Reviewed by Yusuke Suzuki. * Configurations/Base.xcconfig: * Configurations/JavaScriptCore.xcconfig: * DerivedSources.make: * heap/Heap.cpp: (JSC::Heap::addCoreConstraints): * runtime/CachedTypes.cpp: * runtime/LiteralParser.h: * shell/PlatformPlayStation.cmake: 2022-01-04 Yusuke Suzuki [JSC] Remove m_calleeSaveRegisters from CodeBlock::JITData and rename it to BaselineJITData https://bugs.webkit.org/show_bug.cgi?id=234555 Reviewed by Saam Barati. This patch removes m_calleeSaveRegisters from CodeBlock::JITData, and moving it to each JITCode. This is reasonable since m_calleeSaveRegisters information belongs to JITCode, not CodeBlock. And in LLInt, Baseline, and DFG cases, m_calleeSaveRegisters is the same. So we do not have this field in these JITCode. Only FTL can have m_calleeSaveRegisters. By removing m_calleeSaveRegisters from CodeBlock::JITData, now it only includes Baseline JIT related data. So this patch renames CodeBlock::JITData to BaselineJITData. We also use TrailingArray for BaselineJITData so that we can remove one level indirection when loading JITConstantPool from JITData. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::~CodeBlock): (JSC::CodeBlock::propagateTransitions): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::getICStatusMap): (JSC::CodeBlock::findStubInfo): (JSC::CodeBlock::resetBaselineJITData): (JSC::CodeBlock::stronglyVisitStrongReferences): (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): (JSC::CodeBlock::findPC): (JSC::CodeBlock::ensureJITDataSlow): Deleted. (JSC::CodeBlock::setCalleeSaveRegisters): Deleted. (JSC::CodeBlock::resetJITData): Deleted. (JSC::CodeBlock::calleeSaveRegisters const): Deleted. * bytecode/CodeBlock.h: (JSC::CodeBlock::offsetOfBaselineJITData): (JSC::CodeBlock::baselineJITData): (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): (JSC::CodeBlock::JITData::offsetOfJITConstantPool): Deleted. (JSC::CodeBlock::ensureJITData): Deleted. (JSC::CodeBlock::offsetOfJITData): Deleted. (JSC::CodeBlock::baselineJITConstantPool): Deleted. * bytecode/Repatch.cpp: (JSC::linkPolymorphicCall): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::emitRestoreCalleeSaves): (JSC::DFG::JITCompiler::emitSaveCalleeSaves): * dfg/DFGOSREntry.cpp: (JSC::DFG::prepareOSREntry): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::calleeSaveSlot): (JSC::DFG::reifyInlinedCallFrames): (JSC::DFG::adjustAndJumpToTarget): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::compileInThreadImpl): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGStackLayoutPhase.cpp: (JSC::DFG::StackLayoutPhase::run): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLJITCode.h: (JSC::FTL::JITCode::calleeSaveRegisters const): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): * interpreter/StackVisitor.cpp: (JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::executableFor): (JSC::AssemblyHelpers::emitSaveOrCopyLLIntBaselineCalleeSavesFor): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitSaveThenMaterializeTagRegisters): (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): Deleted. (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor): Deleted. (JSC::AssemblyHelpers::emitSaveCalleeSaves): Deleted. (JSC::AssemblyHelpers::emitRestoreCalleeSaves): Deleted. * jit/BaselineJITCode.h: * jit/CallFrameShuffleData.cpp: * jit/CallFrameShuffleData.h: * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters): (JSC::JIT::emitSaveCalleeSaves): (JSC::JIT::compileAndLinkWithoutFinalizing): * jit/JIT.h: * jit/JITCode.cpp: (JSC::JITCode::calleeSaveRegisters const): * jit/JITCode.h: * jit/JITInlines.h: (JSC::JIT::loadConstant): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_catch): * jit/RegisterAtOffsetList.cpp: (JSC::RegisterAtOffsetList::dfgCalleeSaveRegisters): * jit/RegisterAtOffsetList.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * tools/VMInspector.cpp: (JSC::VMInspector::dumpRegisters): 2022-01-04 Stephan Szabo [PlayStation] Fix non-ninja build of zydis https://bugs.webkit.org/show_bug.cgi?id=234854 Unreviewed build fix * PlatformPlayStation.cmake: Set Zycore.c as CXX 2022-01-04 Yusuke Suzuki [JSC] Remove JSWebAssemblyCalleeGroup cell https://bugs.webkit.org/show_bug.cgi?id=234780 Reviewed by Saam Barati. This cell is not observable to users. And this cell just holds Wasm-to-JS stubs, but it is the same to all memory modes. Thus, we should just generate it in VM-linked Wasm::Module (it means, we should have it in JSWebAssemblyModule), and we do not need to have / allocate JSWebAssemblyCalleeGroup cell. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * heap/Heap.cpp: (JSC::Heap::Heap): (JSC::Heap::finalizeUnconditionalFinalizers): (JSC::Heap::deleteAllCodeBlocks): * heap/Heap.h: * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * wasm/WasmBinding.h: * wasm/js/JSWebAssemblyCalleeGroup.cpp: Removed. * wasm/js/JSWebAssemblyCalleeGroup.h: Removed. * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::visitChildrenImpl): (JSC::JSWebAssemblyInstance::finalizeCreation): * wasm/js/JSWebAssemblyInstance.h: * wasm/js/JSWebAssemblyModule.cpp: (JSC::JSWebAssemblyModule::createStub): (JSC::JSWebAssemblyModule::visitChildrenImpl): (JSC::JSWebAssemblyModule::clearJSCallICs): (JSC::JSWebAssemblyModule::finalizeUnconditionally): (JSC::JSWebAssemblyModule::generateWasmToJSStubs): (JSC::JSWebAssemblyModule::calleeGroup): Deleted. (JSC::JSWebAssemblyModule::setCalleeGroup): Deleted. * wasm/js/JSWebAssemblyModule.h: * wasm/js/WebAssemblyModuleConstructor.cpp: * wasm/js/WebAssemblyWrapperFunction.h: 2022-01-04 Yusuke Suzuki WebAssembly i32.atomic.wait timeout value incorrectly interpreted by factor 1000 https://bugs.webkit.org/show_bug.cgi?id=234833 Reviewed by Michael Saboff. Wasm atomics' timeout should be interpreted as nanoseconds. * wasm/WasmOperations.cpp: (JSC::Wasm::wait): 2022-01-03 Yusuke Suzuki Unreviewed, fix build failure https://bugs.webkit.org/show_bug.cgi?id=232723 * runtime/ArrayPrototype.cpp: (JSC::toLocaleString): 2022-01-03 Yusuke Suzuki Array.prototype.toLocaleString does not respect deletion of Object.prototype.toLocaleString https://bugs.webkit.org/show_bug.cgi?id=232723 Reviewed by Alexey Shvayka. This patch implements ECMA402 Array.prototype.toLocaleString[1]. The new implementation invokes "toLocaleString" method for each elements. [1]: https://tc39.es/ecma402/#sup-array.prototype.tolocalestring * runtime/ArrayPrototype.cpp: (JSC::toLocaleString): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::slowJoin): 2022-01-03 Yusuke Suzuki [JSC] Fix Intl.PluralRules.selectRange input validation https://bugs.webkit.org/show_bug.cgi?id=234817 Reviewed by Alexey Shvayka. Add specified argument validation[1] to Intl.PluralRules.selectRange. [1]: https://tc39.es/proposal-intl-numberformat-v3/out/pluralrules/proposed.html#sec-intl.pluralrules.prototype.selectrange * runtime/IntlPluralRules.cpp: (JSC::IntlPluralRules::selectRange const): * runtime/IntlPluralRulesPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2022-01-03 Yusuke Suzuki [JSC] Update UCD to Unicode 14.0.0 https://bugs.webkit.org/show_bug.cgi?id=234811 Reviewed by Sam Weinig. This is yearly update of UCD data. * ucd/CaseFolding.txt: * ucd/DerivedBinaryProperties.txt: * ucd/DerivedCoreProperties.txt: * ucd/DerivedNormalizationProps.txt: * ucd/PropList.txt: * ucd/PropertyAliases.txt: * ucd/PropertyValueAliases.txt: * ucd/ScriptExtensions.txt: * ucd/Scripts.txt: * ucd/UnicodeData.txt: * ucd/emoji-data.txt: * yarr/generateYarrUnicodePropertyTables.py: 2022-01-03 Yusuke Suzuki [JSC] Read-modify-write operation's second put-to-scope should not throw error if binding does not exist https://bugs.webkit.org/show_bug.cgi?id=234813 Reviewed by Alexey Shvayka. This patch fixes a bug throwing RefereceError when read-modify-write's read operation removes binding from object. Throwing error should happen only when evaluating it under strict mode. * bytecompiler/NodesCodegen.cpp: (JSC::PostfixNode::emitResolve): (JSC::PrefixNode::emitResolve): (JSC::ReadModifyResolveNode::emitBytecode): (JSC::ShortCircuitReadModifyResolveNode::emitBytecode): 2022-01-03 Yusuke Suzuki [JSC] Fix length of Intl.NumberFormat.formatRange and Intl.PluralRules.selectRange https://bugs.webkit.org/show_bug.cgi?id=234806 Reviewed by Alexey Shvayka. These length's numbers are wrong. This patch fixes them. * runtime/IntlNumberFormatPrototype.cpp: (JSC::IntlNumberFormatPrototype::finishCreation): * runtime/IntlPluralRulesPrototype.cpp: (JSC::IntlPluralRulesPrototype::finishCreation): 2022-01-02 Yusuke Suzuki [JSC] Use emitPutProperty / emitGetPropertyValue consistently to handle private names in edge cases https://bugs.webkit.org/show_bug.cgi?id=234794 Reviewed by Alexey Shvayka. This patch consistently uses emitPutProperty / emitGetPropertyValue so that we handle private names in edge cases. * bytecompiler/NodesCodegen.cpp: (JSC::TaggedTemplateNode::emitBytecode): (JSC::ForInNode::emitLoopHeader): (JSC::ForOfNode::emitBytecode): (JSC::AssignmentElementNode::bindValue const): 2022-01-02 Zan Dobersek Remove unused AbstractMacroAssembler::repatchJumpToNop() function https://bugs.webkit.org/show_bug.cgi?id=234777 Reviewed by Yusuke Suzuki. Remove the unused AbstractMacroAssembler::repatchJumpToNop() function, along with the underlying relinkJumpToNop() functions on ISA-specific assembler classes. * assembler/ARM64Assembler.h: (JSC::ARM64Assembler::relinkJumpToNop): Deleted. * assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::relinkJumpToNop): Deleted. * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::repatchJumpToNop): Deleted. * assembler/MIPSAssembler.h: (JSC::MIPSAssembler::relinkJumpToNop): Deleted. * assembler/RISCV64Assembler.h: (JSC::RISCV64Assembler::relinkJumpToNop): Deleted. * assembler/X86Assembler.h: (JSC::X86Assembler::relinkJumpToNop): Deleted. 2022-01-02 Zan Dobersek [RISCV64] Make DFG, FTL, B3, WASM buildable on CPU(RISCV64) https://bugs.webkit.org/show_bug.cgi?id=234775 Reviewed by Yusuke Suzuki. Enable building DFG, FTL, B3 and WASM subsystems on 64-bit RISC-V. Necessary guards and missing bits are added to make things buildable, but actual enabling of these features at build-time is left for later. Even when enabled at build-time in the future, there'll likey be open issues that will require disabling different features at run-time. MacroAssemblerRISCV64::setCarry() no-op method is added for now. Carry flag retrieval isn't exactly possible on RISC-V, so the uses of it will have to be addressed some other way. The patchpointScratchRegister value is defined for CPU(RISCV64). As on ARM64, the value matches MacroAssemblerRISCV64::dataTempRegister. In B3, we follow ARM64 in the pinned extended-offset-address use and stack argument lowering. in WASM, we can again mirror ARM64 around LLInt callee registers and slots as well as executing the epilogue of a OSR-entry callee. * assembler/MacroAssembler.h: Provide lea64() for CPU(RISCV64) as well. * assembler/MacroAssemblerRISCV64.h: * b3/B3Common.cpp: (JSC::B3::pinnedExtendedOffsetAddrRegister): * b3/air/AirLowerStackArgs.cpp: (JSC::B3::Air::lowerStackArgs): * jit/GPRInfo.h: * wasm/WasmCallee.cpp: (JSC::Wasm::LLIntCallee::calleeSaveRegisters): * wasm/WasmLLIntPlan.cpp: (JSC::Wasm::LLIntPlan::didCompleteCompilation): * wasm/WasmOperations.cpp: (JSC::Wasm::doOSREntry): 2022-01-02 Zan Dobersek [RISCV64] Enable building LLInt WebAssembly via the riscv64 offlineasm backend https://bugs.webkit.org/show_bug.cgi?id=234776 Reviewed by Yusuke Suzuki. Sprinkle RISCV64 conditions around WebAssembly.asm as appropriate. For division, we can reuse the divi(s)/divq(s) instructions already available in offlineasm. RISC-V additionally provides remainder instructions, so the necessary offlineasm instructions are added and used for RISCV64. In the offlineasm riscv64 backend, the division and remainder instruction handling is improved to properly cover signed and unsigned variants. For other instructions used in LLint WebAssembly implementation like left or right rotation, trailing- or leading-zero counting, order-based floating-point comparison, load-reserved and store-conditional operations, the riscv64WASMPlaceholder helper is used to generate an ebreak instruction that will halt the program at runtime but will not throw a build-time error. Proper implementations will be provided once WebAssembly support on RISCV64 is taken up. * llint/WebAssembly.asm: * offlineasm/instructions.rb: * offlineasm/riscv64.rb: 2022-01-02 Zan Dobersek [RISCV64] Get testmasm building for CPU(RISCV64) https://bugs.webkit.org/show_bug.cgi?id=234774 Reviewed by Yusuke Suzuki. Add missing MacroAssemblerRISCV64 methods used in testmasm. Placeholders are used for now, proper implementations will be introduced later. In testmasm itself, we avoid testing the condition-flags register values since, like on MIPS, that register isn't available on RISC-V. * assembler/MacroAssemblerRISCV64.h: * assembler/testmasm.cpp: (JSC::testProbeModifiesStackPointer): (JSC::testProbeModifiesStackValues): 2021-12-31 Yusuke Suzuki [JSC] Replace UDIS86 with Zydis https://bugs.webkit.org/show_bug.cgi?id=234765 Reviewed by Michael Saboff. UDIS86 is not updated from 2014. Since it is missing relatively new SIMD opcodes, we cannot disassemble these opcodes when implementing Wasm SIMD. This patch replaces UDIS86 with Zydis, which is actively developed and used in SpiderMonkey too. It is under MIT license. This patch imports Zydis v3.2.1. 1. Import header and C files of Zydis and Zycore in a flattened manner. 2. Add directory names to the files (e.g. `Zydis/Decoder.c` => `ZydisDecoder.c`) to make it easy to build in JSC build. 3. Replace header includes from `#include ` to `#include "ZydisXXX.h"`. 4. Fix compile errors with our stricter compiler flags. 5. Remove Zycore API files and ZycoreArgParse.[hc] since they are not used. We didn't add files to Sources.txt since unified builds do not support C files currently. 2022-01-01 Jeff Miller Update user-visible copyright strings to include 2022 https://bugs.webkit.org/show_bug.cgi?id=234263 Reviewed by Anders Carlsson. * Info.plist: 2021-12-30 Adrian Perez de Castro Non-unified build fixes, end-of-year 2021 edition https://bugs.webkit.org/show_bug.cgi?id=234755 Unreviewed non-unified build fixes. * runtime/DeferredWorkTimer.h: Add missing JSCast.h header. 2021-12-28 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 operations for floating-point branches https://bugs.webkit.org/show_bug.cgi?id=234631 Reviewed by Yusuke Suzuki. Add the floating-point branching operation implementations in MacroAssemblerRISCV64. Unordered status of values is determined through the fclass instruction and then handled as appropriate for the desired condition. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::branchFloat): (JSC::MacroAssemblerRISCV64::branchDouble): (JSC::MacroAssemblerRISCV64::branchDoubleNonZero): (JSC::MacroAssemblerRISCV64::branchDoubleZeroOrNaN): (JSC::MacroAssemblerRISCV64::branchTruncateDoubleToInt32): (JSC::MacroAssemblerRISCV64::branchConvertDoubleToInt32): (JSC::MacroAssemblerRISCV64::branchFP): 2021-12-28 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 operations for testing, comparison https://bugs.webkit.org/show_bug.cgi?id=234630 Reviewed by Yusuke Suzuki. Add MacroAssemblerRISCV64 implementations for the different variants of compare and test instructions. For comparisons, the implementations set up the two values in separate registers and perform the comparison per the inquired relation, writing out the result into the destination register. For tests, the two values are set up and put through the bitwise AND, with the result evaluated and the destination register filled out according to the inquired result condition. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::compare8): (JSC::MacroAssemblerRISCV64::compare32): (JSC::MacroAssemblerRISCV64::compare64): (JSC::MacroAssemblerRISCV64::test8): (JSC::MacroAssemblerRISCV64::test32): (JSC::MacroAssemblerRISCV64::test64): (JSC::MacroAssemblerRISCV64::compareFinalize): (JSC::MacroAssemblerRISCV64::testFinalize): 2021-12-28 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 operations with patchable elements https://bugs.webkit.org/show_bug.cgi?id=234635 Reviewed by Yusuke Suzuki. Add MacroAssemblerRISCV64 implementations for operations that generate patchable code sections. This covers moves, stores and branches. For moves and stores of pointer values, the patchable section is achieved by generating a immediate loader instruction sequence with all the placeholder instructions (nops) included. Some methods that had their noop implementations provided until now have been removed since they are not necessary anymore. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::moveWithPatch): (JSC::MacroAssemblerRISCV64::storePtrWithPatch): (JSC::MacroAssemblerRISCV64::branch32WithPatch): (JSC::MacroAssemblerRISCV64::branchPtrWithPatch): (JSC::MacroAssemblerRISCV64::patchableBranch64): 2021-12-28 Zan Dobersek [RISCV64] Enable signal-based VM traps for CPU(RISCV64) https://bugs.webkit.org/show_bug.cgi?id=234719 Reviewed by Yusuke Suzuki. Enable signal-based VM traps on RISCV64. On Linux, this depends on generating a SIGSEGV or SIGBUS signal. The former can be generated through a simple storage instruction that sources the address from the zero register. This storage instruction is generated on the desired location through the RISCV64Assembler::replaceWithVMHalt() method. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::replaceWithVMHalt): * assembler/RISCV64Assembler.h: (JSC::RISCV64Assembler::replaceWithVMHalt): 2021-12-28 Zan Dobersek [RISCV64] Define HAVE_MACHINE_CONTEXT, provide mcontext_t accessors for CPU(RISCV64) https://bugs.webkit.org/show_bug.cgi?id=234718 Reviewed by Yusuke Suzuki. Define HAVE_MACHINE_CONTEXT for RISCV64. In the MachineContext.h header, CPU(RISCV64)-specific accessors into the mcontext_t struct are also provided. * runtime/MachineContext.h: (JSC::MachineContext::stackPointerImpl): (JSC::MachineContext::framePointerImpl): (JSC::MachineContext::instructionPointerImpl): (JSC::MachineContext::argumentPointer<1>): (JSC::MachineContext::llintInstructionPointer): 2021-12-27 Yusuke Suzuki Consider merging Wasm::FunctionCodeBlock and Wasm::LLIntCallee https://bugs.webkit.org/show_bug.cgi?id=203691 Reviewed by Filip Pizlo. This patch merges Wasm::FunctionCodeBlock into Wasm::LLIntCallee since both are one-on-one and what they want to represent are the same. We change Wasm::FunctionCodeBlock to Wasm::FunctionCodeBlockGenerator so that we can use FixedVector in Wasm::LLIntCallee which makes Wasm::LLIntCallee small, and this is similar to what JS side is doing (UnlinkedCodeBlockGenerator). * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/BytecodeDumper.cpp: (JSC::Wasm::BytecodeDumper::dumpBlock): (JSC::Wasm::BytecodeDumper::dumpConstants): (JSC::Wasm::BytecodeDumper::constantName const): * bytecode/BytecodeDumper.h: * interpreter/Interpreter.cpp: (JSC::CatchInfo::CatchInfo): * llint/LLIntOffsetsExtractor.cpp: * llint/WebAssembly.asm: * wasm/WasmCallee.cpp: (JSC::Wasm::LLIntCallee::LLIntCallee): (JSC::Wasm::LLIntCallee::outOfLineJumpOffset): (JSC::Wasm::LLIntCallee::outOfLineJumpTarget): (JSC::Wasm::LLIntCallee::linkExceptionHandlers): Deleted. * wasm/WasmCallee.h: (JSC::Wasm::Callee::llintFunctionCodeBlock const): Deleted. * wasm/WasmFunctionCodeBlockGenerator.cpp: Renamed from Source/JavaScriptCore/wasm/WasmFunctionCodeBlock.cpp. (JSC::Wasm::FunctionCodeBlockGenerator::setInstructions): (JSC::Wasm::FunctionCodeBlockGenerator::addOutOfLineJumpTarget): (JSC::Wasm::FunctionCodeBlockGenerator::outOfLineJumpOffset): (JSC::Wasm::FunctionCodeBlockGenerator::addSignature): (JSC::Wasm::FunctionCodeBlockGenerator::addJumpTable): (JSC::Wasm::FunctionCodeBlockGenerator::numberOfJumpTables const): * wasm/WasmFunctionCodeBlockGenerator.h: Renamed from Source/JavaScriptCore/wasm/WasmFunctionCodeBlock.h. (JSC::Wasm::FunctionCodeBlockGenerator::FunctionCodeBlockGenerator): (JSC::Wasm::FunctionCodeBlockGenerator::tierUpCounter): * wasm/WasmGeneratorTraits.h: * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::parseAndCompileBytecode): (JSC::Wasm::LLIntGenerator::LLIntGenerator): (JSC::Wasm::LLIntGenerator::finalize): (JSC::Wasm::LLIntGenerator::addLoop): (JSC::Wasm::LLIntGenerator::addSwitch): * wasm/WasmLLIntGenerator.h: * wasm/WasmLLIntPlan.cpp: (JSC::Wasm::LLIntPlan::compileFunction): (JSC::Wasm::LLIntPlan::didCompleteCompilation): * wasm/WasmLLIntPlan.h: * wasm/WasmLLIntTierUpCounter.h: (JSC::Wasm::LLIntTierUpCounter::LLIntTierUpCounter): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::shouldJIT): (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::WASM_SLOW_PATH_DECL): (JSC::LLInt::doWasmCallIndirect): (JSC::LLInt::doWasmCallRef): 2021-12-26 Yusuke Suzuki [JSC] Use SlowPathReturnType instead of EncodedMatchResult https://bugs.webkit.org/show_bug.cgi?id=234686 Reviewed by Filip Pizlo. This patch replaces YarrJIT's EncodedMatchResult with SlowPathReturnType so that CCallHelpers can handle it correctly. * runtime/MatchResult.h: (JSC::MatchResult::MatchResult): (JSC::MatchResult::failed): * runtime/SlowPathReturnType.h: (JSC::decodeResult): * yarr/YarrJIT.h: 2021-12-23 Mark Lam Make DeferredWorkTimer::addPendingWork() return a Ticket. https://bugs.webkit.org/show_bug.cgi?id=234628 rdar://84260429 Reviewed by Yusuke Suzuki. 1. Make Ticket a unique token instead of the JSObject* target object. The Ticket is now a pointer to the TicketData in the pending work list. 2. Instead of taking a Ticket argument, DeferredWorkTimer::addPendingWork() now takes a JSObject* `target` argument explicitly, and returns the Ticket for the added TicketData instead. All the relevant DeferredWorkTimer APIS already take a Ticket as an argument. This ensures that addPendingWork() is called before we start doing work with these APIs (especially scheduleWorkSoon()). 3. Previously, addPendingWork() will only save one instance of TicketData for a given JSObject* key. With this patch, we'll register a new TicketData instance for every call to addPendingWork(), and return a unique Ticket for it. This is needed because it may be possible for 2 different clients to call addPendingWork() and scheduleWorkSoon() with the same target JSObject* but with different sets of dependencies. Secondly, even is the both sets of dependencies are identical, a client may call addPendingWork() and scheduleWorkSoon() with the same JSObject* target more than once because it intended to schedule more than 1 task to run. Note that DeferredWorkTimer::doWork() consumes the corresponding TicketData (i.e. removes it from the m_pendingTickets list) for each task as it is run. To ensure that the dependencies for each task is protected, we'll either need to ref count the TicketData for the same target object (and hold off on removing it from the list), or we'll need to register a different TicketData instance for each task. Ref counting can solve the second issue above, but does not solve the first. So, this patch goes with the more generic solution to allow each task to have its own TicketData instance (and, its own unique Ticket). 4. Previously, if the client cancels pending work, we would remove the TicketData immediately from the m_pendingTickets list. This opens up an opportunity for the same TicketData memory to be re-allocated by another client. This, in turn, would make the Ticket token not unique and potentially allow a cancelled ticket to be reused before DeferredWorkTimer::doWork() is called. This patch changes DeferredWorkTimer::cancelPendingWork() to only clear the contents of the TicketData instead. TicketData::scriptExecutionOwner being null is used as an indication that the ticket has been cancelled. Since the TicketData itself is not "freed" yet, all TicketData will remain unique until DeferredWorkTimer::doWork(). Consequently, DeferredWorkTimer::doWork() will now check for cancelled tickets and remove them from the m_pendingTickets list. 5. JSFinalizationRegistry was previously calling DeferredWorkTimer::hasPendingWork() to check if it has already scheduled a task, so as not to reschedule again until after the previously scheduled task has been run. This does not play nice with the new Ticket API, because this hasPendingWork() check needs to be done before calling addPendingWork(), and hence, the Ticket is not available yet. Fortunately, JSFinalizationRegistry should know if it has already scheduled a task itself. This patch adds a m_hasAlreadyScheduledWork flag to JSFinalizationRegistry that can be used for this check instead. * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * runtime/DeferredWorkTimer.cpp: (JSC::DeferredWorkTimer::TicketData::TicketData): (JSC::DeferredWorkTimer::TicketData::vm): (JSC::DeferredWorkTimer::TicketData::cancel): (JSC::DeferredWorkTimer::doWork): (JSC::DeferredWorkTimer::addPendingWork): (JSC::DeferredWorkTimer::hasPendingWork): (JSC::DeferredWorkTimer::hasDependancyInPendingWork): (JSC::DeferredWorkTimer::cancelPendingWork): * runtime/DeferredWorkTimer.h: (JSC::DeferredWorkTimer::TicketData::target): * runtime/JSFinalizationRegistry.cpp: (JSC::JSFinalizationRegistry::finalizeUnconditionally): * runtime/JSFinalizationRegistry.h: * wasm/WasmStreamingCompiler.cpp: (JSC::Wasm::StreamingCompiler::StreamingCompiler): (JSC::Wasm::StreamingCompiler::~StreamingCompiler): (JSC::Wasm::StreamingCompiler::didComplete): (JSC::Wasm::StreamingCompiler::fail): (JSC::Wasm::StreamingCompiler::cancel): * wasm/WasmStreamingCompiler.h: * wasm/js/JSWebAssembly.cpp: (JSC::JSWebAssembly::webAssemblyModuleValidateAsync): (JSC::instantiate): (JSC::compileAndInstantiate): (JSC::JSWebAssembly::webAssemblyModuleInstantinateAsync): 2021-12-22 Saam Barati LLInt should loop OSR into BBQ and BBQ should loop OSR into OMG https://bugs.webkit.org/show_bug.cgi?id=234542 Reviewed by Yusuke Suzuki. It's a startup perf improvement on some Wasm benchmarks I'm running to have Wasm LLInt do loop OSR entry into BBQ instead of OMG. This improves this benchmark by 5%. There is probably more perf to be had here. Currently, we're just OSR entering into B3 BBQ O1. However, in the future, we should just compile a single Air BBQ Callee that allows for OSR entry at loop boundaries. Maybe we can model this using EntrySwitch without any real harm to throughput. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * assembler/MacroAssemblerCodeRef.cpp: (JSC::shouldDumpDisassemblyFor): * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::parseAndCompile): * wasm/WasmCallee.h: (JSC::Wasm::Callee::setOSREntryCallee): Deleted. * wasm/WasmCalleeGroup.h: * wasm/WasmCompilationMode.cpp: (JSC::Wasm::makeString): * wasm/WasmCompilationMode.h: (JSC::Wasm::isOSREntry): (JSC::Wasm::isAnyBBQ): (JSC::Wasm::isAnyOMG): * wasm/WasmOMGForOSREntryPlan.cpp: Removed. * wasm/WasmOMGForOSREntryPlan.h: Removed. * wasm/WasmOSREntryPlan.cpp: Copied from Source/JavaScriptCore/wasm/WasmOMGForOSREntryPlan.cpp. (JSC::Wasm::OSREntryPlan::OSREntryPlan): (JSC::Wasm::OSREntryPlan::work): (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan): Deleted. (JSC::Wasm::OMGForOSREntryPlan::work): Deleted. * wasm/WasmOSREntryPlan.h: Copied from Source/JavaScriptCore/wasm/WasmOMGForOSREntryPlan.h. * wasm/WasmOperations.cpp: (JSC::Wasm::doOSREntry): (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::updateCallSitesToCallUs): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::WASM_SLOW_PATH_DECL): 2021-12-22 Alex Christensen Fix compiling with pickier compiler https://bugs.webkit.org/show_bug.cgi?id=234593 Reviewed by Brady Eidson. * API/tests/Regress141275.mm: (-[JSTEvaluator initWithScript:]): * API/tests/testapi.mm: (checkModuleWasRejected): 2021-12-22 Zan Dobersek [RISCV64] Add RISCV64 support in YARR https://bugs.webkit.org/show_bug.cgi?id=234547 Reviewed by Yusuke Suzuki. Add RISCV64 support to YARR. This covers providing the required register and immediate defitinitions, as well as also enabling codepaths shared with other 64-bit architectures. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::load16): YARR JIT also requires a load16() overload that loads from an ExtendedAddress. * yarr/YarrJIT.cpp: * yarr/YarrJITRegisters.h: 2021-12-22 Zan Dobersek [RISCV64] Fix RISCV64Assembler::ImmediateDecomposition in debug builds https://bugs.webkit.org/show_bug.cgi?id=234594 Unreviewed, fix the RISCV64Assembler::ImmediateDecomposition constructor to build in debug mode (fixing the assert) as well as run properly in that mode (performing manual sign-extension on the lower 12 bits of the IImmediate value as required for this type of immediates). * assembler/RISCV64Assembler.h: (JSC::RISCV64Instructions::ImmediateDecomposition::ImmediateDecomposition): 2021-12-21 Zan Dobersek [RISCV64] Add or enable missing CPU(RISCV64) codepaths in baseline JIT https://bugs.webkit.org/show_bug.cgi?id=234551 Reviewed by Yusuke Suzuki. Sprinkle the necessary CPU(RISCV64) build guards as well as additional RISCV64-specific codepaths encapsualted by those build guards in the baseline JIT code. In many cases we can align with the code that ARM64 is already using. In InlineAccess, the byte-sizes for access and replacement operations are based on a mix of educated guessing and aggressive testing. In baseline JIT, we can usually adopt what ARM64 already does since the similarities are big enough. * bytecode/InlineAccess.h: The sizes here are based on the estimated count of necessary instructions for access or replacement, and were tested with the enabled crash-inducing fallback in linkCodeInline(). (JSC::InlineAccess::sizeForPropertyAccess): (JSC::InlineAccess::sizeForPropertyReplace): (JSC::InlineAccess::sizeForLengthAccess): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitLoadStructure): (JSC::AssemblyHelpers::debugCall): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitSaveThenMaterializeTagRegisters): (JSC::AssemblyHelpers::emitRestoreSavedTagRegisters): (JSC::AssemblyHelpers::prologueStackPointerDelta): (JSC::AssemblyHelpers::emitFunctionPrologue): (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame): (JSC::AssemblyHelpers::emitFunctionEpilogue): (JSC::AssemblyHelpers::preserveReturnAddressAfterCall): (JSC::AssemblyHelpers::restoreReturnAddressBeforeReturn): * jit/CCallHelpers.h: (JSC::CCallHelpers::prepareForTailCallSlow): * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::prepareForTailCall): * jit/JITPropertyAccess.cpp: (JSC::JIT::slow_op_resolve_scopeGenerator): (JSC::JIT::slow_op_get_from_scopeGenerator): * jit/RegisterSet.cpp: (JSC::RegisterSet::macroScratchRegisters): (JSC::RegisterSet::dfgCalleeSaveRegisters): (JSC::RegisterSet::ftlCalleeSaveRegisters): * jit/ThunkGenerators.cpp: (JSC::popThunkStackPreservesAndHandleExceptionGenerator): 2021-12-21 Zan Dobersek [RISCV64] Add missing MacroAssemblerRISCV64 floating-point rounding, comparison methods https://bugs.webkit.org/show_bug.cgi?id=234475 Reviewed by Yusuke Suzuki. Add missing MacroAssemblerRISCV64 methods that cover floating-point rounding and comparison operations. Manually detecting NaN values is possible by classifying floating-point values, and subsequently rounding operation or different comparison conditions have to be handled appropriately. Single-precision and double-precision implementations can neatly be handled in singular templated helper methods, and precision-specific codepaths can be determined at compile-time. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::ceilFloat): (JSC::MacroAssemblerRISCV64::ceilDouble): (JSC::MacroAssemblerRISCV64::floorFloat): (JSC::MacroAssemblerRISCV64::floorDouble): (JSC::MacroAssemblerRISCV64::roundTowardNearestIntFloat): (JSC::MacroAssemblerRISCV64::roundTowardNearestIntDouble): (JSC::MacroAssemblerRISCV64::roundTowardZeroFloat): (JSC::MacroAssemblerRISCV64::roundTowardZeroDouble): (JSC::MacroAssemblerRISCV64::compareFloat): (JSC::MacroAssemblerRISCV64::compareDouble): (JSC::MacroAssemblerRISCV64::roundFP): (JSC::MacroAssemblerRISCV64::compareFP): 2021-12-21 Carlos Garcia Campos CSP: Include the sample in eval violation reports https://bugs.webkit.org/show_bug.cgi?id=234390 Reviewed by Kate Cheney. * interpreter/Interpreter.cpp: (JSC::eval): Pass the code to reportViolationForUnsafeEval(). * runtime/DirectEvalExecutable.cpp: (JSC::DirectEvalExecutable::create): Ditto. * runtime/FunctionConstructor.cpp: (JSC::stringifyFunction): Helper function with the code to stringify function to be called also for the csp violation report. (JSC::constructFunction): Call stringifyFunction() to get the code for reportViolationForUnsafeEval(). (JSC::constructFunctionSkippingEvalEnabledCheck): Use stringifyFunction(). * runtime/IndirectEvalExecutable.cpp: (JSC::IndirectEvalExecutable::createImpl): Pass the code to reportViolationForUnsafeEval(). * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::reportViolationForUnsafeEval): Add string parameter for the code sample. * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): Pass the code to reportViolationForUnsafeEval(). 2021-12-21 Zan Dobersek [RISCV64] Add basic MacroAssemblerRISCV64 branching methods https://bugs.webkit.org/show_bug.cgi?id=234474 Reviewed by Yusuke Suzuki. Add MacroAssemblerRISCV64 implementations for the basic branching methods. RelationalCondition enum values are aliased to the branching condition values in RISCV64Assembler. The makeBranch() helper method is added that generates the final branching instruction for the given condition and the two registers holding values for the comparison and returns the Jump object based on the label constructed at the location of the branching placeholder. Branching methods essentially consist of preparing the two registers and calling the makeBranch() method. For 8-bit and 32-bit comparisons the compared values have to be sign-extended into the scratch registers because the branching instructions don't operate on partial values. This might cause friction in higher JIT levels where the use of scratch registers is disallowed. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::invert): (JSC::MacroAssemblerRISCV64::branch8): (JSC::MacroAssemblerRISCV64::branch32): (JSC::MacroAssemblerRISCV64::branch64): (JSC::MacroAssemblerRISCV64::branch32WithUnalignedHalfWords): (JSC::MacroAssemblerRISCV64::makeBranch): 2021-12-21 Geza Lore [JSC][ARMv7] Minor code size improvements https://bugs.webkit.org/show_bug.cgi?id=234387 Reviewed by Yusuke Suzuki. A few mew code size improvements to ARMv7/Thumb-2 - Use ldrd/strd in mode places (via AssemblyHelpers:loadValue and AssemblyHelpers::storeValue) - Use BIC immediate instruction instead of AND where appropriate - Use a 2-byte ADDS instead of a 4-byte CMN when possible. This applies very often as it handles testing JSValue tags. - Use addressTempRegister in branch32 Overall saving of about 3.5% code size on JetStream2, according to --dumpLinkBufferStats. * assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::bic): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::and32): (JSC::MacroAssemblerARMv7::storePair32): (JSC::MacroAssemblerARMv7::compare32AndSetFlags): (JSC::MacroAssemblerARMv7::branch32): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::storePair32): * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::fillJSValue): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::storeValue): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_mov): 2021-12-19 Ross Kirsling [JSC] OpPow should have a "small int exponent" fast path at lower tiers https://bugs.webkit.org/show_bug.cgi?id=234408 Reviewed by Yusuke Suzuki. DFG has an ArithPow fast path which just multiplies in a loop when the exponent is an int between 0 and 1000; this can be done at lower tiers too. Implementing this at LLInt gives the following speedup with JIT disabled: Before After pow-int-int 193.7180+-0.4897 ^ 100.3569+-1.9804 ^ definitely 1.9303x faster pow-double-int 194.0744+-0.7998 ^ 100.0346+-0.8655 ^ definitely 1.9401x faster 193.8824+-0.4667 ^ 100.0964+-0.9922 ^ definitely 1.9370x faster Implementing this at Baseline gives similar results with DFG disabled: Before After pow-int-int 195.6251+-0.9577 ^ 99.9627+-0.3307 ^ definitely 1.9570x faster pow-double-int 196.1975+-0.9307 ^ 101.0056+-0.3124 ^ definitely 1.9424x faster 195.8786+-0.5883 ^ 100.4767+-0.2333 ^ definitely 1.9495x faster Results are neutral otherwise. * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_op_pow): (JSC::JIT::emitSlow_op_pow): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-12-18 Mikhail R. Gadelha [JSC][32bit] Fix undefined behavior causing miscompilation with clang 13 on ARM https://bugs.webkit.org/show_bug.cgi?id=234399 Reviewed by Yusuke Suzuki. Compiling JSC with clang 13 on ARMv7 on linux was broken because clang was marking the constant Infinity as poison during constant folding, if either -O2 or -O3 were used, causing the constant to not being initialized. This patch removes the undefined behaviour by preventing the static_cast to int32_t if the double is either inf or NaN. * runtime/MathCommon.h: (JSC::canBeInt32): (JSC::canBeStrictInt32): 2021-12-18 Yusuke Suzuki [JSC] Do not allocate m_bbqCallee and m_omgCallee until it becomes necessary https://bugs.webkit.org/show_bug.cgi?id=234457 Reviewed by Saam Barati. WebAssembly memory import will require initializing both Wasm::CalleeGroup. So, we should shrink memory size of Wasm::CalleeGroup as much as possible to avoid memory regression. This patch allocates m_bbqCallee and m_omgCallee only when it becomes available. * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::work): * wasm/WasmCalleeGroup.cpp: (JSC::Wasm::CalleeGroup::CalleeGroup): * wasm/WasmCalleeGroup.h: (JSC::Wasm::CalleeGroup::compilationFinished): Deleted. (JSC::Wasm::CalleeGroup::runnable): Deleted. (JSC::Wasm::CalleeGroup::errorMessage): Deleted. (JSC::Wasm::CalleeGroup::functionImportCount const): Deleted. (JSC::Wasm::CalleeGroup::embedderEntrypointCalleeFromFunctionIndexSpace): Deleted. (JSC::Wasm::CalleeGroup::wasmEntrypointCalleeFromFunctionIndexSpace): Deleted. (JSC::Wasm::CalleeGroup::wasmBBQCalleeFromFunctionIndexSpace): Deleted. (JSC::Wasm::CalleeGroup::entrypointLoadLocationFromFunctionIndexSpace): Deleted. (JSC::Wasm::CalleeGroup::wasmToWasmExitStub): Deleted. (JSC::Wasm::CalleeGroup::mode const): Deleted. * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::updateCallSitesToCallUs): * wasm/WasmPlan.h: 2021-12-17 Yusuke Suzuki [WTF] Introduce TrailingArray https://bugs.webkit.org/show_bug.cgi?id=234201 Reviewed by Darin Adler. Use ThreadSafeRefCountedFixedVector in ObjectPropertyConditionSet and Wasm::LLIntCallees. * bytecode/CodeBlock.h: (JSC::CodeBlock::baselineJITConstantPool): * bytecode/ObjectPropertyConditionSet.cpp: (JSC::ObjectPropertyConditionSet::mergedWith const): (JSC::ObjectPropertyConditionSet::dumpInContext const): (JSC::ObjectPropertyConditionSet::isValidAndWatchable const): * bytecode/ObjectPropertyConditionSet.h: (JSC::ObjectPropertyConditionSet::invalid): (JSC::ObjectPropertyConditionSet::create): (JSC::ObjectPropertyConditionSet::isValid const): (JSC::ObjectPropertyConditionSet::size const): (JSC::ObjectPropertyConditionSet::begin const): (JSC::ObjectPropertyConditionSet::end const): (JSC::ObjectPropertyConditionSet::ObjectPropertyConditionSet): Deleted. (JSC::ObjectPropertyConditionSet::releaseRawPointer): Deleted. (JSC::ObjectPropertyConditionSet::adoptRawPointer): Deleted. (JSC::ObjectPropertyConditionSet::fromRawPointer): Deleted. (JSC::ObjectPropertyConditionSet::Data::Data): Deleted. * jit/JIT.cpp: (JSC::JIT::compileAndLinkWithoutFinalizing): * jit/JITInlines.h: (JSC::JIT::loadConstant): * llint/LLIntOffsetsExtractor.cpp: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * wasm/WasmCallee.h: (JSC::Wasm::LLIntCallees::create): Deleted. (JSC::Wasm::LLIntCallees::at const): Deleted. (JSC::Wasm::LLIntCallees::data const): Deleted. (JSC::Wasm::LLIntCallees::LLIntCallees): Deleted. * wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::create): (JSC::Wasm::CodeBlock::CodeBlock): * wasm/WasmCodeBlock.h: * wasm/WasmModule.cpp: (JSC::Wasm::Module::Module): (JSC::Wasm::Module::getOrCreateCodeBlock): * wasm/WasmModule.h: 2021-12-17 Saam Barati Use IRC by default on arm64 https://bugs.webkit.org/show_bug.cgi?id=234449 Reviewed by Yusuke Suzuki. I'm seeing a Wasm perf improvement on some benchmarks of ~12% by switching from Briggs to IRC. Let's make IRC the default on arm64. * b3/air/AirAllocateRegistersByGraphColoring.cpp: * b3/air/AirAllocateRegistersByGraphColoring.h: (JSC::B3::Air::useIRC): Deleted. 2021-12-17 Saam Barati Support WasmAddress in B3 CSE https://bugs.webkit.org/show_bug.cgi?id=234051 Reviewed by Filip Pizlo and Yusuke Suzuki. This patch adds support in B3's CSE phase to handle WasmAddressValue computations. The reason this can't partake in pure CSE is that WasmAddressValue reads pinned. To support this, we keep track of which blocks write pinned. If we're trying to replace a value V2 with V1 because it appears there is a redundancy, we check if any paths from V1 to V2 write pinned. If none do, we proceed with the replacement. * b3/B3EliminateCommonSubexpressions.cpp: 2021-12-17 Zan Dobersek [RISCV64] Implement linking and patching support in RISCV64Assembler https://bugs.webkit.org/show_bug.cgi?id=234398 Reviewed by Yusuke Suzuki. Populate RISCV64Assembler class with the necessary implementations and facilities to support linking and patching operations. Implementations of different methods in MacroAssemblerRISCV64 covering calls, jumps and patches are also added. Helper structs are added in the RISCV64Assembler class that cover linking of jumps, calls or branches and patching of pointer values. Relevant methods are also implemented to utilize these helpers. RISCV64Assembler also gains helper methods that generate placeholders for the specific type of linking or patching. The passed-in functor is then invoked, enabling the user (MacroAssemblerRISCV64 implementation) to additionally generate the desired instruction sequence that utilizes the given placeholder. In MacroAssemblerRISCV64, different noop methods covering jumps, calls, linking and patching are replaced with the appropriate implementations. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::readCallTarget): (JSC::MacroAssemblerRISCV64::replaceWithJump): (JSC::MacroAssemblerRISCV64::startOfBranchPtrWithPatchOnRegister): (JSC::MacroAssemblerRISCV64::revertJumpReplacementToBranchPtrWithPatch): (JSC::MacroAssemblerRISCV64::linkCall): (JSC::MacroAssemblerRISCV64::repatchCall): (JSC::MacroAssemblerRISCV64::jump): (JSC::MacroAssemblerRISCV64::farJump): (JSC::MacroAssemblerRISCV64::nearCall): (JSC::MacroAssemblerRISCV64::nearTailCall): (JSC::MacroAssemblerRISCV64::threadSafePatchableNearCall): (JSC::MacroAssemblerRISCV64::ret): (JSC::MacroAssemblerRISCV64::call): (JSC::MacroAssemblerRISCV64::callOperation): (JSC::MacroAssemblerRISCV64::startOfPatchableBranchPtrWithPatchOnAddress): Deleted. (JSC::MacroAssemblerRISCV64::startOfPatchableBranch32WithPatchOnAddress): Deleted. (JSC::MacroAssemblerRISCV64::revertJumpReplacementToPatchableBranchPtrWithPatch): Deleted. (JSC::MacroAssemblerRISCV64::revertJumpReplacementToPatchableBranch32WithPatch): Deleted. * assembler/RISCV64Assembler.h: (JSC::RISCV64Instructions::ImmediateBase::immediateMask): (JSC::RISCV64Instructions::ImmediateBase::v): (JSC::RISCV64Instructions::ImmediateDecomposition::ImmediateDecomposition): (JSC::RISCV64Assembler::getDifferenceBetweenLabels): (JSC::RISCV64Assembler::getCallReturnOffset): (JSC::RISCV64Assembler::labelIgnoringWatchpoints): (JSC::RISCV64Assembler::labelForWatchpoint): (JSC::RISCV64Assembler::label): (JSC::RISCV64Assembler::linkJump): (JSC::RISCV64Assembler::linkCall): (JSC::RISCV64Assembler::linkPointer): (JSC::RISCV64Assembler::maxJumpReplacementSize): (JSC::RISCV64Assembler::patchableJumpSize): (JSC::RISCV64Assembler::repatchPointer): (JSC::RISCV64Assembler::relinkJump): (JSC::RISCV64Assembler::relinkJumpToNop): (JSC::RISCV64Assembler::relinkCall): (JSC::RISCV64Assembler::replaceWithJump): (JSC::RISCV64Assembler::revertJumpReplacementToPatch): (JSC::RISCV64Assembler::readCallTarget): (JSC::RISCV64Assembler::cacheFlush): (JSC::RISCV64Assembler::fillNops): (JSC::RISCV64Assembler::jumpPlaceholder): (JSC::RISCV64Assembler::branchPlaceholder): (JSC::RISCV64Assembler::pointerCallPlaceholder): (JSC::RISCV64Assembler::nearCallPlaceholder): (JSC::RISCV64Assembler::LinkJumpOrCallImpl::apply): (JSC::RISCV64Assembler::LinkJumpImpl::placeholderInsn): (JSC::RISCV64Assembler::LinkJumpImpl::generatePlaceholder): (JSC::RISCV64Assembler::LinkCallImpl::placeholderInsn): (JSC::RISCV64Assembler::LinkCallImpl::generatePlaceholder): (JSC::RISCV64Assembler::LinkBranchImpl::placeholderInsn): (JSC::RISCV64Assembler::LinkBranchImpl::generatePlaceholder): (JSC::RISCV64Assembler::LinkBranchImpl::apply): (JSC::RISCV64Assembler::PatchPointerImpl::placeholderInsn): (JSC::RISCV64Assembler::PatchPointerImpl::generatePlaceholder): (JSC::RISCV64Assembler::PatchPointerImpl::apply): (JSC::RISCV64Assembler::PatchPointerImpl::read): 2021-12-16 Saam Barati Use arm64's fmax/fmin instructions in Wasm https://bugs.webkit.org/show_bug.cgi?id=234367 Reviewed by Keith Miller. This patch adds support in B3 for FMax and FMin. We use this for Wasm's f32/64 min/max operations. On arm64, we select the arm64 fmin/fmax instructions for these B3 opcodes. On x86, we lower these to control flow to calculate the result inside of lower macros. This speeds up Wasm programs that make heavy usage of min/max. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::floatMax): (JSC::MacroAssemblerARM64::floatMin): (JSC::MacroAssemblerARM64::doubleMax): (JSC::MacroAssemblerARM64::doubleMin): * b3/B3Common.h: (JSC::B3::fMax): (JSC::B3::fMin): * b3/B3ConstDoubleValue.cpp: (JSC::B3::ConstDoubleValue::fMinConstant const): (JSC::B3::ConstDoubleValue::fMaxConstant const): * b3/B3ConstDoubleValue.h: * b3/B3ConstFloatValue.cpp: (JSC::B3::ConstFloatValue::fMinConstant const): (JSC::B3::ConstFloatValue::fMaxConstant const): * b3/B3ConstFloatValue.h: * b3/B3LowerMacros.cpp: * b3/B3LowerToAir.cpp: * b3/B3Opcode.cpp: (WTF::printInternal): * b3/B3Opcode.h: * b3/B3ReduceStrength.cpp: * b3/B3Validate.cpp: * b3/B3Value.cpp: (JSC::B3::Value::fMinConstant const): (JSC::B3::Value::fMaxConstant const): (JSC::B3::Value::effects const): (JSC::B3::Value::key const): (JSC::B3::Value::typeFor): * b3/B3Value.h: * b3/B3ValueInlines.h: * b3/B3ValueKey.cpp: (JSC::B3::ValueKey::materialize const): * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_1.cpp: (run): * b3/testb3_7.cpp: (testFMaxMin): (testFloatMaxMin): (testDoubleMaxMin): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::addFloatingPointMinOrMax): (JSC::Wasm::AirIRGenerator::addOp): * wasm/wasm.json: 2021-12-16 Caitlin Potter [JSC] only emit pointer validation for ARM64E https://bugs.webkit.org/show_bug.cgi?id=234402 Reviewed by Yusuke Suzuki and Mark Lam. JIT thunks no longer emit `push ; pop ;` on non-ARM64E arches with the emitPointerValidation macro. * jit/ThunkGenerators.cpp: (JSC::emitPointerValidation): 2021-12-16 Michael Saboff Create symlinks pointing to alternate root framework locations https://bugs.webkit.org/show_bug.cgi?id=234374 Reviewed by Filip Pizlo. Added build variables and build step to create symlinks pointing to the alternate build locations from the current framework install location. * Configurations/JavaScriptCore.xcconfig: * JavaScriptCore.xcodeproj/project.pbxproj: * Scripts/create-symlink-to-altroot.sh: Added. 2021-12-16 Devin Rousso Implement Array.prototype.groupBy and Array.prototype.groupByToMap https://bugs.webkit.org/show_bug.cgi?id=234327 Reviewed by Yusuke Suzuki. Implement new Array Grouping proposal , which just reached Stage 3. `Array.prototype.groupBy`/`Array.prototype.groupByToMap` will return a `{}`/`Map` where each value in the array is put into a "bucket" keyed by the return value of the provoded callback. ```js const array = [1, 2, 3, 4]; array.groupBy(n => n % 2 ? "odd" : "even") // { odd: [1, 3], even: [2, 4] } array.groupByToMap(n => n % 2 ? "odd" : "even") // new Map([["odd", [1, 3]], ["even", [2, 4]]) ``` * builtins/ArrayPrototype.js: (groupBy): Added. (groupByToMap): Added. * runtime/ArrayPrototype.cpp: (JSC::ArrayPrototype::finishCreation): * bytecode/BytecodeIntrinsicRegistry.h: * bytecompiler/NodesCodegen.cpp: (JSC::BytecodeIntrinsicNode::emit_intrinsic_toPropertyKey): Added. Allow `@toPropertyKey` to be used in builtins to convert a value to a property key. This is used to avoid converting the return value of the callback given to `groupBy` more than once. * builtins/BuiltinNames.h: * bytecode/LinkTimeConstant.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): Allow `@Map` to be used in builtins to create a primordial `Map` instance. This is used to avoid side effects when creating and populating the `Map` returned by `groupByToMap`. * runtime/OptionsList.h: Add `useArrayGroupByMethod` option. 2021-12-15 Yusuke Suzuki Rename Wasm::CodeBlock to Wasm::CalleeGroup https://bugs.webkit.org/show_bug.cgi?id=203694 Reviewed by Mark Lam. This is not a CodeBlock. And the name causes confusion with JSC::CodeBlock, which is not at all related. This patch renames it to Wasm::CalleeGroup. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * heap/Heap.cpp: (JSC::Heap::Heap): (JSC::Heap::finalizeUnconditionalFinalizers): (JSC::Heap::deleteAllCodeBlocks): * heap/Heap.h: (JSC::Heap::forEachCodeBlockSpace): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::BBQPlan): (JSC::Wasm::BBQPlan::work): * wasm/WasmBBQPlan.h: * wasm/WasmCalleeGroup.cpp: Renamed from Source/JavaScriptCore/wasm/WasmCodeBlock.cpp. (JSC::Wasm::CalleeGroup::create): (JSC::Wasm::CalleeGroup::createFromExisting): (JSC::Wasm::CalleeGroup::CalleeGroup): (JSC::Wasm::CalleeGroup::~CalleeGroup): (JSC::Wasm::CalleeGroup::waitUntilFinished): (JSC::Wasm::CalleeGroup::compileAsync): (JSC::Wasm::CalleeGroup::isSafeToRun): (JSC::Wasm::CalleeGroup::setCompilationFinished): * wasm/WasmCalleeGroup.h: Renamed from Source/JavaScriptCore/wasm/WasmCodeBlock.h. * wasm/WasmInstance.cpp: (JSC::Wasm::Instance::initElementSegment): * wasm/WasmInstance.h: (JSC::Wasm::Instance::calleeGroup const): (JSC::Wasm::Instance::isImportFunction const): (JSC::Wasm::Instance::codeBlock const): Deleted. * wasm/WasmMachineThreads.h: * wasm/WasmModule.cpp: (JSC::Wasm::Module::getOrCreateCalleeGroup): (JSC::Wasm::Module::compileSync): (JSC::Wasm::Module::compileAsync): (JSC::Wasm::Module::copyInitialCalleeGroupToAllMemoryModes): (JSC::Wasm::Module::getOrCreateCodeBlock): Deleted. (JSC::Wasm::Module::copyInitialCodeBlockToAllMemoryModes): Deleted. * wasm/WasmModule.h: (JSC::Wasm::Module::calleeGroupFor): (JSC::Wasm::Module::codeBlockFor): Deleted. * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan): (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGForOSREntryPlan.h: * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::OMGPlan): (JSC::Wasm::OMGPlan::work): * wasm/WasmOMGPlan.h: * wasm/WasmOperations.cpp: (JSC::Wasm::triggerOMGReplacementCompile): (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::updateCallSitesToCallUs): * wasm/WasmPlan.h: * wasm/WasmSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::doWasmCall): * wasm/js/JSWebAssembly.cpp: (JSC::resolve): (JSC::instantiate): * wasm/js/JSWebAssemblyCalleeGroup.cpp: Renamed from Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.cpp. (JSC::JSWebAssemblyCalleeGroup::create): (JSC::JSWebAssemblyCalleeGroup::JSWebAssemblyCalleeGroup): (JSC::JSWebAssemblyCalleeGroup::finishCreation): (JSC::JSWebAssemblyCalleeGroup::destroy): (JSC::JSWebAssemblyCalleeGroup::clearJSCallICs): (JSC::JSWebAssemblyCalleeGroup::visitChildrenImpl): (JSC::JSWebAssemblyCalleeGroup::finalizeUnconditionally): * wasm/js/JSWebAssemblyCalleeGroup.h: Renamed from Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h. * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::visitChildrenImpl): (JSC::JSWebAssemblyInstance::finalizeCreation): * wasm/js/JSWebAssemblyInstance.h: * wasm/js/JSWebAssemblyModule.cpp: (JSC::JSWebAssemblyModule::calleeGroup): (JSC::JSWebAssemblyModule::setCalleeGroup): (JSC::JSWebAssemblyModule::visitChildrenImpl): (JSC::JSWebAssemblyModule::codeBlock): Deleted. (JSC::JSWebAssemblyModule::setCodeBlock): Deleted. * wasm/js/JSWebAssemblyModule.h: * wasm/js/WebAssemblyFunction.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): * wasm/js/WebAssemblyWrapperFunction.h: 2021-12-15 Joseph Griego [Shadow Realms] Wrapped functions must only throw TypeError from calling realm https://bugs.webkit.org/show_bug.cgi?id=234357 Reviewed by Yusuke Suzuki. This wrapping logic already exists for ShadowRealm.prototype.evaluate but not for calls to wrapped functions. at present, this requires some awkward manouvering to actually throw a typeerror from the shadow realm, since the wrapper code always runs in the incubating realm. Hopefully we can make this less messy soon by replacing this implementation with one more integrated with the runtime. This case wasn't covered by existing JSC or test262 tests; added coverage both upstream in t262 and in this patch. * builtins/ShadowRealmPrototype.js: (wrapped): (globalPrivate.wrap): 2021-12-14 Ross Kirsling [JSC] OpInstanceofCustom should be in CommonSlowPaths https://bugs.webkit.org/show_bug.cgi?id=234316 Reviewed by Alexey Shvayka. No tier has a fast path for OpInstanceofCustom and this is unlikely to change anytime soon. As such, we should not be having LLInt and Baseline implement *separate* slow paths for this operation; this patch straightforwardly makes use of CommonSlowPaths instead. * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): * jit/JIT.h: * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_instanceof_custom): Deleted. (JSC::JIT::emitSlow_op_instanceof_custom): Deleted. * llint/LLIntSlowPaths.cpp: * llint/LLIntSlowPaths.h: * llint/LowLevelInterpreter.asm: * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/CommonSlowPaths.h: 2021-12-14 Jean-Yves Avenard Rename SharedBuffer classes. https://bugs.webkit.org/show_bug.cgi?id=233677 rdar://problem/85963900 Reviewed by Youenn Fablet. SharedBuffer are renamed FragmentedSharedBuffer and ContiguousSharedBuffer to SharedBuffer to better reflect their actual types. * runtime/ArrayBuffer.h: 2021-12-13 Saam Barati WasmB3IRGenerator should estimate static execution counts https://bugs.webkit.org/show_bug.cgi?id=234284 Reviewed by Filip Pizlo. This enables the register allocator to make better decisions. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * b3/B3BasicBlock.h: (JSC::B3::BasicBlock::setFrequency): * b3/B3EstimateStaticExecutionCounts.cpp: Added. (JSC::B3::estimateStaticExecutionCounts): * b3/B3EstimateStaticExecutionCounts.h: Added. * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::parseAndCompile): 2021-12-13 Brady Eidson Teach webpushtool to register and "host" the daemon. https://bugs.webkit.org/show_bug.cgi?id=234265 Reviewed by Tim Horton. * inspector/ConsoleMessage.h: Remove `using JSC::MessageType` because it makes it hard for others to also have a `MessageType` type. * inspector/JSGlobalObjectConsoleClient.h: * runtime/ConsoleTypes.h: 2021-12-13 Saam Barati Roll back r286345, r286387, r286471, r286667, r286849 https://bugs.webkit.org/show_bug.cgi?id=234268 Reviewed by Mark Lam. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::AccessCase): (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::dump const): (JSC::AccessCase::propagateTransitions const): (JSC::AccessCase::generateWithGuard): (JSC::AccessCase::canBeShared): * bytecode/AccessCase.h: (JSC::AccessCase::structure const): (JSC::AccessCase::newStructure const): (JSC::AccessCase::hash const): (JSC::AccessCase::AccessCase): * bytecode/ArrayProfile.cpp: (JSC::ArrayProfile::computeUpdatedPrediction): * bytecode/ArrayProfile.h: * bytecode/CheckPrivateBrandStatus.cpp: (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::propagateTransitions): (JSC::CodeBlock::determineLiveness): (JSC::CodeBlock::finalizeLLIntInlineCaches): (JSC::CodeBlock::stronglyVisitWeakReferences): * bytecode/DeleteByStatus.cpp: (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadata::GetByIdModeMetadata): (JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeFromLLInt): (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/InstanceOfStatus.cpp: (JSC::InstanceOfStatus::computeForStubInfo): * bytecode/InternalFunctionAllocationProfile.h: (JSC::InternalFunctionAllocationProfile::offsetOfStructure): (JSC::InternalFunctionAllocationProfile::structure): (JSC::InternalFunctionAllocationProfile::clear): (JSC::InternalFunctionAllocationProfile::visitAggregate): (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase): (JSC::InternalFunctionAllocationProfile::offsetOfStructureID): Deleted. * bytecode/PolyProtoAccessChain.cpp: (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const): * bytecode/PolyProtoAccessChain.h: * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::visitWeak const): * bytecode/PutByIdFlags.h: * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeFromLLInt): (JSC::PutByStatus::computeForStubInfo): * bytecode/SetPrivateBrandStatus.cpp: (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/SpeculatedType.cpp: (JSC::speculationFromCell): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::deref): (JSC::StructureStubInfo::aboutToDie): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitAggregateImpl): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::summary const): (JSC::StructureStubInfo::containsPC const): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfByIdSelfOffset): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): (JSC::StructureStubInfo::inlineAccessBaseStructure): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID): Deleted. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::branchWeakStructure): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::finalize): * dfg/DFGSpeculativeJIT.cpp: * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined): (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined): (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther): (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch): (JSC::DFG::SpeculativeJIT::emitUntypedBranch): (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise): (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * heap/AbstractSlotVisitor.h: * heap/AbstractSlotVisitorInlines.h: * heap/Heap.cpp: (JSC::Heap::Heap): (JSC::Heap::runEndPhase): * heap/Heap.h: (JSC::Heap::structureIDTable): * heap/IsoAlignedMemoryAllocator.cpp: (JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator): (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator): (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory): (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory): (JSC::IsoAlignedMemoryAllocator::tryMallocBlock): Deleted. (JSC::IsoAlignedMemoryAllocator::freeBlock): Deleted. (JSC::IsoAlignedMemoryAllocator::commitBlock): Deleted. (JSC::IsoAlignedMemoryAllocator::decommitBlock): Deleted. * heap/IsoAlignedMemoryAllocator.h: * heap/IsoMemoryAllocatorBase.cpp: Removed. * heap/IsoMemoryAllocatorBase.h: Removed. * heap/IsoSubspace.cpp: (JSC::IsoSubspace::IsoSubspace): (JSC::IsoSubspace::tryAllocateFromLowerTier): * heap/IsoSubspace.h: * heap/PreciseAllocation.cpp: (JSC::PreciseAllocation::createForLowerTier): (JSC::PreciseAllocation::tryCreateForLowerTier): Deleted. * heap/PreciseAllocation.h: * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * heap/SlotVisitor.h: * heap/SlotVisitorInlines.h: * heap/StructureAlignedMemoryAllocator.cpp: Removed. * heap/StructureAlignedMemoryAllocator.h: Removed. * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): (JSC::AssemblyHelpers::emitLoadStructure): (JSC::AssemblyHelpers::emitLoadPrototype): (JSC::AssemblyHelpers::emitRandomThunk): (JSC::AssemblyHelpers::emitConvertValueToBoolean): (JSC::AssemblyHelpers::branchIfValue): (JSC::AssemblyHelpers::emitNonNullDecodeStructureID): Deleted. * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchStructure): (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly): * jit/GCAwareJITStubRoutine.cpp: (JSC::PolymorphicAccessJITStubRoutine::computeHash): * jit/JITInlineCacheGenerator.cpp: (JSC::generateGetByIdInlineAccess): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_get_prototype_of): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_property_enumerator): * jit/JITStubRoutine.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::performLLIntGetByID): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: * runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/BigIntPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/BooleanPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/DatePrototype.cpp: (JSC::formateDateInstance): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ErrorInstance.cpp: (JSC::ErrorInstance::sanitizedMessageString): (JSC::ErrorInstance::sanitizedNameString): (JSC::ErrorInstance::sanitizedToString): * runtime/ErrorPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/FunctionExecutable.cpp: (JSC::FunctionExecutable::visitChildrenImpl): * runtime/FunctionExecutable.h: * runtime/FunctionPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/FunctionRareData.cpp: (JSC::FunctionRareData::visitChildrenImpl): * runtime/FunctionRareData.h: * runtime/HasOwnPropertyCache.h: * runtime/InitializeThreading.cpp: (JSC::initialize): * runtime/JSCConfig.h: * runtime/JSCJSValue.cpp: (JSC::JSValue::dumpInContextAssumingStructure const): (JSC::JSValue::dumpForBacktrace const): * runtime/JSCell.cpp: (JSC::JSCell::toObjectSlow const): * runtime/JSCell.h: (JSC::JSCell::clearStructure): * runtime/JSCellInlines.h: (JSC::JSCell::structure const): (JSC::JSCell::setStructure): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: * runtime/JSObject.cpp: (JSC::JSObject::visitButterflyImpl): (JSC::JSObject::createInitialUndecided): (JSC::JSObject::createInitialInt32): (JSC::JSObject::createInitialDouble): (JSC::JSObject::createInitialContiguous): (JSC::JSObject::createArrayStorage): (JSC::JSObject::convertUndecidedToArrayStorage): (JSC::JSObject::convertInt32ToArrayStorage): (JSC::JSObject::convertDoubleToArrayStorage): (JSC::JSObject::convertContiguousToArrayStorage): (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition): (JSC::JSObject::putDirectNonIndexAccessorWithoutTransition): * runtime/JSObject.h: (JSC::JSObject::nukeStructureAndSetButterfly): (JSC::JSObject::getPropertySlot): * runtime/JSObjectInlines.h: (JSC::JSObject::getPropertySlot): (JSC::JSObject::getNonIndexPropertySlot): (JSC::JSObject::putDirectWithoutTransition): (JSC::JSObject::putDirectInternal): * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator): (JSC::JSPropertyNameEnumerator::visitChildrenImpl): * runtime/JSPropertyNameEnumerator.h: * runtime/NumberPrototype.cpp: (JSC::toThisNumber): * runtime/ObjectPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::objectPrototypeToString): * runtime/RegExpPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/StringPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/Structure.cpp: (JSC::Structure::Structure): (JSC::Structure::~Structure): (JSC::Structure::flattenDictionaryStructure): (JSC::Structure::dump const): (JSC::Structure::canCachePropertyNameEnumerator const): * runtime/Structure.h: (JSC::Structure::id const): * runtime/StructureChain.cpp: (JSC::StructureChain::create): (JSC::StructureChain::visitChildrenImpl): * runtime/StructureID.h: Removed. * runtime/StructureIDBlob.h: (JSC::StructureIDBlob::StructureIDBlob): * runtime/StructureIDTable.cpp: Added. (JSC::StructureIDTable::StructureIDTable): (JSC::StructureIDTable::makeFreeListFromRange): (JSC::StructureIDTable::resize): (JSC::StructureIDTable::flushOldTables): (JSC::StructureIDTable::allocateID): (JSC::StructureIDTable::deallocateID): * runtime/StructureIDTable.h: Added. (JSC::nukedStructureIDBit): (JSC::nuke): (JSC::isNuked): (JSC::decontaminate): (JSC::StructureIDTable::base): (JSC::StructureIDTable::size const): (JSC::StructureIDTable::table const): (JSC::StructureIDTable::decode): (JSC::StructureIDTable::encode): (JSC::StructureIDTable::get): (JSC::StructureIDTable::tryGet): (JSC::StructureIDTable::validate): (JSC::StructureIDTable::deallocateID): (JSC::StructureIDTable::allocateID): (JSC::StructureIDTable::flushOldTables): * runtime/StructureRareData.cpp: (JSC::StructureRareData::StructureRareData): * runtime/StructureRareData.h: * runtime/StructureRareDataInlines.h: (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint): * runtime/SymbolPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TypeProfilerLog.cpp: (JSC::TypeProfilerLog::processLogEntries): (JSC::TypeProfilerLog::visit): * runtime/VM.h: (JSC::VM::getStructure): (JSC::VM::tryGetStructure): * runtime/WriteBarrier.h: (JSC::WriteBarrierStructureID::WriteBarrierStructureID): Deleted. (JSC::WriteBarrierStructureID::get const): Deleted. (JSC::WriteBarrierStructureID::operator* const): Deleted. (JSC::WriteBarrierStructureID::operator-> const): Deleted. (JSC::WriteBarrierStructureID::clear): Deleted. (JSC::WriteBarrierStructureID::operator bool const): Deleted. (JSC::WriteBarrierStructureID::operator! const): Deleted. (JSC::WriteBarrierStructureID::setWithoutWriteBarrier): Deleted. (JSC::WriteBarrierStructureID::unvalidatedGet const): Deleted. (JSC::WriteBarrierStructureID::value const): Deleted. * runtime/WriteBarrierInlines.h: (JSC::WriteBarrierStructureID::set): Deleted. (JSC::WriteBarrierStructureID::setMayBeNull): Deleted. (JSC::WriteBarrierStructureID::setEarlyValue): Deleted. * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateJSCell): * tools/Integrity.cpp: * tools/Integrity.h: * tools/IntegrityInlines.h: (JSC::Integrity::auditStructureID): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): (JSC::JSDollarVM::visitChildrenImpl): * tools/JSDollarVM.h: * wasm/js/WebAssemblyFunction.cpp: (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * wasm/js/WebAssemblyGlobalPrototype.cpp: (JSC::getGlobal): 2021-12-13 Yusuke Suzuki [JSC] Use FixedVector for wasm exception in Wasm::Instance https://bugs.webkit.org/show_bug.cgi?id=234224 Reviewed by Saam Barati. Since we know # of exception tags when instantiating Wasm::Instance, we can use FixedVector instead of Vector. This is the same to Table, Functions etc. We also remove Wasm::Tag::m_id. Since we do not copy Wasm::Tag and we always allocate Wasm::Tag from heap, we can just use pointer comparison. Then, we do not need to have this m_id. * wasm/WasmInstance.cpp: (JSC::Wasm::Instance::Instance): (JSC::Wasm::Instance::setTag): (JSC::Wasm::Instance::addTag): Deleted. * wasm/WasmInstance.h: * wasm/WasmModuleInformation.h: (JSC::Wasm::ModuleInformation::internalExceptionCount const): * wasm/WasmTag.cpp: * wasm/WasmTag.h: (JSC::Wasm::Tag::create): Deleted. (JSC::Wasm::Tag::parameterCount const): Deleted. (JSC::Wasm::Tag::parameter const): Deleted. (JSC::Wasm::Tag::operator== const): Deleted. (JSC::Wasm::Tag::operator!= const): Deleted. (JSC::Wasm::Tag::signature const): Deleted. (JSC::Wasm::Tag::Tag): Deleted. * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): 2021-12-13 waddlesplash ExecutableAllocator: Do not store things in g_config when USE(SYSTEM_MALLOC). https://bugs.webkit.org/show_bug.cgi?id=232165 Reviewed by Yusuke Suzuki. Following r281910 two additional slots were added to g_config in order to store these pointers for use in bmalloc and Gigacage. However, when USE(SYSTEM_MALLOC) is enabled, there are no slots reserved for Gigacage, and so this collided with g_wtfConfig and overwrote data there instead. This should fix crashes seen on Haiku, which enables USE(SYSTEM_MALLOC). * jit/ExecutableAllocator.cpp: (JSC::initializeJITPageReservation): 2021-12-13 Elliott Williams Deployment target for macOS 11+ does not follow minor version bumps https://bugs.webkit.org/show_bug.cgi?id=233906 Reviewed by Alexey Proskuryakov. * Configurations/DebugRelease.xcconfig: 2021-12-13 Adrian Perez de Castro Unreviewed build fix after r286936 * wasm/WasmOSREntryData.h: Replace wrong inclusion of wtf/Vector.h (unused) with the correct wtf/FixedVector.h one. * wasm/WasmTierUpCount.h: Add missing WasmOSREntryData.h inclusion. 2021-12-13 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 implementations for trivial floating-point-register operations https://bugs.webkit.org/show_bug.cgi?id=234223 Reviewed by Yusuke Suzuki. Add implementations for the trivial floating-point register operations in MacroAssemblerRISCV64. This covers moves, loads, stores, arithmetics, basic conversion and truncation and the lightweight logical operations. The two floating-point temporary registers needed in some operations are listed. The rounding and comparison operations are left for later as they require a more complex implementation due to the necessary manual NaN checks. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::swap): (JSC::MacroAssemblerRISCV64::moveZeroToFloat): (JSC::MacroAssemblerRISCV64::moveZeroToDouble): (JSC::MacroAssemblerRISCV64::moveFloat): (JSC::MacroAssemblerRISCV64::moveFloatTo32): (JSC::MacroAssemblerRISCV64::move32ToFloat): (JSC::MacroAssemblerRISCV64::moveDouble): (JSC::MacroAssemblerRISCV64::moveDoubleTo64): (JSC::MacroAssemblerRISCV64::move64ToDouble): (JSC::MacroAssemblerRISCV64::loadFloat): (JSC::MacroAssemblerRISCV64::loadDouble): (JSC::MacroAssemblerRISCV64::storeFloat): (JSC::MacroAssemblerRISCV64::storeDouble): (JSC::MacroAssemblerRISCV64::addFloat): (JSC::MacroAssemblerRISCV64::addDouble): (JSC::MacroAssemblerRISCV64::subFloat): (JSC::MacroAssemblerRISCV64::subDouble): (JSC::MacroAssemblerRISCV64::mulFloat): (JSC::MacroAssemblerRISCV64::mulDouble): (JSC::MacroAssemblerRISCV64::divFloat): (JSC::MacroAssemblerRISCV64::divDouble): (JSC::MacroAssemblerRISCV64::sqrtFloat): (JSC::MacroAssemblerRISCV64::sqrtDouble): (JSC::MacroAssemblerRISCV64::absFloat): (JSC::MacroAssemblerRISCV64::absDouble): (JSC::MacroAssemblerRISCV64::andFloat): (JSC::MacroAssemblerRISCV64::andDouble): (JSC::MacroAssemblerRISCV64::orFloat): (JSC::MacroAssemblerRISCV64::orDouble): (JSC::MacroAssemblerRISCV64::negateFloat): (JSC::MacroAssemblerRISCV64::negateDouble): (JSC::MacroAssemblerRISCV64::convertInt32ToFloat): (JSC::MacroAssemblerRISCV64::convertInt32ToDouble): (JSC::MacroAssemblerRISCV64::convertInt64ToFloat): (JSC::MacroAssemblerRISCV64::convertInt64ToDouble): (JSC::MacroAssemblerRISCV64::convertUInt64ToFloat): (JSC::MacroAssemblerRISCV64::convertUInt64ToDouble): (JSC::MacroAssemblerRISCV64::convertFloatToDouble): (JSC::MacroAssemblerRISCV64::convertDoubleToFloat): (JSC::MacroAssemblerRISCV64::truncateFloatToInt32): (JSC::MacroAssemblerRISCV64::truncateFloatToUint32): (JSC::MacroAssemblerRISCV64::truncateFloatToInt64): (JSC::MacroAssemblerRISCV64::truncateFloatToUint64): (JSC::MacroAssemblerRISCV64::truncateDoubleToInt32): (JSC::MacroAssemblerRISCV64::truncateDoubleToUint32): (JSC::MacroAssemblerRISCV64::truncateDoubleToInt64): (JSC::MacroAssemblerRISCV64::truncateDoubleToUint64): 2021-12-12 Zan Dobersek [RISCV64] Add MacroAssemblerRISCV64 implementations for trivial general-purpose-register operations https://bugs.webkit.org/show_bug.cgi?id=233992 Reviewed by Yusuke Suzuki. Add implementations for the trivial general-purpose-register operations in MacroAssemblerRISCV64. This covers non-patchable loads and stores, shifts, logical operations, zero- and sign-extensions, moves and swaps, stack operations as well as miscellaneous operations like aborts, breakpoints and nops. The loadImmediate helper methods are added to handle loading of different types of immediate values. This should replace move() calls when a sign-extended immediate load is desired, whereas move() for a 32-bit immediate is expected to perform no sign extension. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::add32): (JSC::MacroAssemblerRISCV64::add64): (JSC::MacroAssemblerRISCV64::sub32): (JSC::MacroAssemblerRISCV64::mul32): (JSC::MacroAssemblerRISCV64::lshift32): (JSC::MacroAssemblerRISCV64::lshift64): (JSC::MacroAssemblerRISCV64::rshift32): (JSC::MacroAssemblerRISCV64::rshift64): (JSC::MacroAssemblerRISCV64::urshift32): (JSC::MacroAssemblerRISCV64::urshift64): (JSC::MacroAssemblerRISCV64::load8): (JSC::MacroAssemblerRISCV64::load8SignedExtendTo32): (JSC::MacroAssemblerRISCV64::load16): (JSC::MacroAssemblerRISCV64::load16Unaligned): (JSC::MacroAssemblerRISCV64::load16SignedExtendTo32): (JSC::MacroAssemblerRISCV64::load32): (JSC::MacroAssemblerRISCV64::load32WithUnalignedHalfWords): (JSC::MacroAssemblerRISCV64::load64): (JSC::MacroAssemblerRISCV64::loadPair32): (JSC::MacroAssemblerRISCV64::store8): (JSC::MacroAssemblerRISCV64::store16): (JSC::MacroAssemblerRISCV64::store32): (JSC::MacroAssemblerRISCV64::store64): (JSC::MacroAssemblerRISCV64::storePair32): (JSC::MacroAssemblerRISCV64::zeroExtend8To32): (JSC::MacroAssemblerRISCV64::zeroExtend16To32): (JSC::MacroAssemblerRISCV64::zeroExtend32ToWord): (JSC::MacroAssemblerRISCV64::signExtend8To32): (JSC::MacroAssemblerRISCV64::signExtend16To32): (JSC::MacroAssemblerRISCV64::signExtend32ToPtr): (JSC::MacroAssemblerRISCV64::and32): (JSC::MacroAssemblerRISCV64::and64): (JSC::MacroAssemblerRISCV64::or8): (JSC::MacroAssemblerRISCV64::or16): (JSC::MacroAssemblerRISCV64::or32): (JSC::MacroAssemblerRISCV64::or64): (JSC::MacroAssemblerRISCV64::xor32): (JSC::MacroAssemblerRISCV64::xor64): (JSC::MacroAssemblerRISCV64::not32): (JSC::MacroAssemblerRISCV64::not64): (JSC::MacroAssemblerRISCV64::neg32): (JSC::MacroAssemblerRISCV64::neg64): (JSC::MacroAssemblerRISCV64::move): (JSC::MacroAssemblerRISCV64::swap): (JSC::MacroAssemblerRISCV64::push): (JSC::MacroAssemblerRISCV64::pushPair): (JSC::MacroAssemblerRISCV64::pop): (JSC::MacroAssemblerRISCV64::popPair): (JSC::MacroAssemblerRISCV64::abortWithReason): (JSC::MacroAssemblerRISCV64::breakpoint): (JSC::MacroAssemblerRISCV64::nop): (JSC::MacroAssemblerRISCV64::loadImmediate): 2021-12-12 Yusuke Suzuki [JSC] Use FixedVector to shrink some of Wasm data structures https://bugs.webkit.org/show_bug.cgi?id=234206 Reviewed by Saam Barati. We can use FixedVector to shrink some of Wasm data structures including Wasm::Callee. * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::PatchpointExceptionHandle::generate const): (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): * wasm/WasmCallee.cpp: (JSC::Wasm::LLIntCallee::linkExceptionHandlers): (JSC::Wasm::OptimizingJITCallee::linkExceptionHandlers): (JSC::Wasm::OptimizingJITCallee::stackmap const): * wasm/WasmCallee.h: (JSC::Wasm::Callee::hasExceptionHandlers const): (JSC::Wasm::JITCallee::wasmToWasmCallsites): (JSC::Wasm::OptimizingJITCallee::OptimizingJITCallee): * wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::CodeBlock): * wasm/WasmCodeBlock.h: * wasm/WasmHandlerInfo.cpp: (JSC::Wasm::HandlerInfo::handlerForIndex): * wasm/WasmHandlerInfo.h: * wasm/WasmOSREntryData.h: (JSC::Wasm::OSREntryData::OSREntryData): (JSC::Wasm::OSREntryData::values): (JSC::Wasm::OSREntryValue::OSREntryValue): Deleted. (JSC::Wasm::OSREntryValue::type const): Deleted. * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::updateCallSitesToCallUs): * wasm/WasmTierUpCount.cpp: (JSC::Wasm::TierUpCount::addOSREntryData): * wasm/WasmTierUpCount.h: * wasm/js/JSWebAssemblyCodeBlock.cpp: (JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock): * wasm/js/JSWebAssemblyCodeBlock.h: 2021-12-11 Saam Barati Teach the sampling profiler how to display origin data for B3 Wasm https://bugs.webkit.org/show_bug.cgi?id=234097 Reviewed by Yusuke Suzuki. This teaches the SamplingProfiler how to gather origin data for Wasm. We reuse the PCToCodeOriginMap from JS, and store the wasm function offset data inside of CodeOrigin's BytecodeIndex. For now, this patch is only doing this for B3, because the Air backend doesn't currently generate filled in OpcodeOrigin data. We'll fix that in: https://bugs.webkit.org/show_bug.cgi?id=234182 Also, this capability isn't yet supported in Web Inspector. We'll want to do that in a future change as we improve Web Inspector's ability to debug Wasm code. When that time comes, we'll have to generate the PCToCodeOriginMap based on debugging info, and not just 'useSamplingProfiler' JSC option. The data now shows up like this for hottest bytecodes: Hottest bytecodes as 524 '.wasm-function[2373]:OMG:0x21a' 414 '.wasm-function[2363]:OMG:0x1ae' 395 '.wasm-function[2373]:OMG:0x418' 354 '.wasm-function[2373]:OMG:0x34f' 270 '.wasm-function[2373]:OMG:0x352' 256 '.wasm-function[2363]:OMG:0x152' * ftl/FTLCompile.cpp: (JSC::FTL::compile): * jit/PCToCodeOriginMap.cpp: (JSC::PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder): * jit/PCToCodeOriginMap.h: * runtime/SamplingProfiler.cpp: (JSC::FrameWalker::recordJITFrame): (JSC::SamplingProfiler::processUnverifiedStackTraces): (JSC::SamplingProfiler::reportTopBytecodes): * runtime/SamplingProfiler.h: * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::origin): (JSC::Wasm::parseAndCompileAir): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::parseAndCompile): (JSC::Wasm::computePCToCodeOriginMap): * wasm/WasmB3IRGenerator.h: (): Deleted. * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::work): (JSC::Wasm::BBQPlan::didCompleteCompilation): (JSC::Wasm::BBQPlan::initializeCallees): * wasm/WasmCalleeRegistry.h: (JSC::Wasm::CalleeRegistry::unregisterCallee): (JSC::Wasm::CalleeRegistry::addPCToCodeOriginMap): (JSC::Wasm::CalleeRegistry::WTF_REQUIRES_LOCK): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmOpcodeOrigin.h: (JSC::Wasm::OpcodeOrigin::OpcodeOrigin): 2021-12-11 Mark Lam Automatically forbid JS execution when we throw a TerminationException. https://bugs.webkit.org/show_bug.cgi?id=234188 Reviewed by Yusuke Suzuki. For Worker threads, we throw a TerminationException when Worker.terminate() is called. Once the TerminationException is thrown, we expect to completely unwind out of any JS frames on the stack, and we also expect the client to never call into JS again. Previously, WebCore will call VM:setExecutionForbidden() to flag that we should not re-enter the VM anymore. On JSC side, this executionForbidden() is used to prevent micro-tasks from firing. On WebCore side, it is used to prevent many things from running, including firing events. Previously, we reply on WebCore side to catch the TerminationException, determine that it is the TerminationException, and then call VM:setExecutionForbidden(). This is tedious and error prone as there may be places in WebCore that should call VM:setExecutionForbidden() but is missed. This has been the source of some bugs with the handling of the Worker termination in the past. In this patch, we change VM to setExecutionForbidden() immediately when we throw the TerminationException, but only if VM::m_executionForbiddenOnTermination is set. Currently, we'll only set VM:m_executionForbiddenOnTermination for Workers because for legacy reasons, other clients of JSC has the ability to re-enter the VM after a TerminationException unwinds out (which is ok to do when used under some controlled conditions). Until we can determine that it is safe to adopt this "execution forbidden on termination" behavior universally, we'll adopt it only for workers. In a subsequent patch, we can also look into removing all the places in WebCore that checks for TerminationException in order to call VM:setExecutionForbidden(). We'll leave those in place for now though they should be redundant after this patch. Also add some ASSERTs to document invariants regarding states used in the handing of TerminationException. * runtime/VM.cpp: (JSC::VM::setException): (JSC::VM::throwTerminationException): * runtime/VM.h: (JSC::VM::forbidExecutionOnTermination): 2021-12-10 Yusuke Suzuki [JSC] Wasm catch thunk should be JIT code to use ExceptionHandlerPtrTag https://bugs.webkit.org/show_bug.cgi?id=234183 Reviewed by Tadeu Zagallo. ExceptionHandlerPtrTag is only usable for JITCode. Thus, we should not tag wasm catch LLInt code with it. This patch fixes it by using trampoline. This is the same to normal LLInt's handleCatchThunk. * assembler/JITOperationList.cpp: (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt): * llint/LLIntExceptions.cpp: (JSC::LLInt::handleWasmCatch): (JSC::LLInt::handleWasmCatchAll): * llint/LLIntThunks.cpp: (JSC::LLInt::handleWasmCatchThunk): (JSC::LLInt::handleWasmCatchAllThunk): * llint/LLIntThunks.h: 2021-12-10 Michael Saboff https://bugs.webkit.org/show_bug.cgi?id=234173 Update Install Paths for build system changes Reviewed by Yusuke Suzuki. Updated install paths for changes in the build system that use a system path prefix. * Configurations/Base.xcconfig: 2021-12-10 Mikhail R. Gadelha [JSC][32bit] Add callee save registers for MIPS https://bugs.webkit.org/show_bug.cgi?id=233766 Reviewed by Mark Lam. This patch enables callee save registers for mips, which fixes an assertion violation from the call frame shufflers in some tests if jsc was built with assertions enabled (either debug or release+assert mode). * jit/RegisterSet.cpp: (JSC::RegisterSet::llintBaselineCalleeSaveRegisters): (JSC::RegisterSet::dfgCalleeSaveRegisters): 2021-12-10 Yusuke Suzuki [JSC] isTaggedJSCCodePtrImpl does not have proper implementation for JITCage & JITCode combination https://bugs.webkit.org/show_bug.cgi?id=234186 Reviewed by Mark Lam. If JITCage is enabled and target code is JITCode, we should use tagJSCCodePtrImpl. * runtime/JSCPtrTag.h: (JSC::isTaggedJSCCodePtrImpl): 2021-12-10 Don Olmstead Add FileSystem function to read a file at a path https://bugs.webkit.org/show_bug.cgi?id=234103 Reviewed by Alex Christensen. Use FileSystem::readEntireFile. * inspector/remote/socket/RemoteInspectorSocket.cpp: (Inspector::RemoteInspector::backendCommands const): 2021-12-10 Tadeu Zagallo Remove Mac-specific ARM64EHash implementation https://bugs.webkit.org/show_bug.cgi?id=234150 Reviewed by Saam Barati. Currently we have a weaker implementation of ARM64EHash on mac, but we measured it and it's not any faster than the stricter version we use on iOS. We are removing the mac-specific version and switching it to use the stricter version. * assembler/AssemblerBuffer.h: 2021-12-10 Adrian Perez de Castro Non-unified build fixes, mid December 2021 edition https://bugs.webkit.org/show_bug.cgi?id=234106 Unreviewed non-unified build fixes. * wasm/js/WasmToJS.h: Remove unneeded forward declaration of CallLinkInfo, add forward declaration of OptimizingCallLinkInfo. 2021-12-09 Alex Christensen Prepare for transition to C++20 https://bugs.webkit.org/show_bug.cgi?id=234022 Reviewed by Yusuke Suzuki. * bytecode/SuperSampler.cpp: * bytecode/SuperSampler.h: * heap/GCSegmentedArray.h: (JSC::GCSegmentedArrayIterator::operator== const): (JSC::GCSegmentedArrayIterator::operator!= const): (JSC::GCSegmentedArrayIterator::operator==): Deleted. (JSC::GCSegmentedArrayIterator::operator!=): Deleted. * jit/RegisterSet.h: (JSC::RegisterSet::iterator::operator== const): (JSC::RegisterSet::iterator::operator!= const): (JSC::RegisterSet::iterator::operator==): Deleted. (JSC::RegisterSet::iterator::operator!=): Deleted. * parser/Parser.h: (JSC::ScopeRef::operator== const): (JSC::ScopeRef::operator!= const): (JSC::ScopeRef::operator==): Deleted. (JSC::ScopeRef::operator!=): Deleted. * parser/ParserTokens.h: * runtime/GenericOffset.h: (JSC::GenericOffset::operator== const): (JSC::GenericOffset::operator!= const): (JSC::GenericOffset::operator< const): (JSC::GenericOffset::operator> const): (JSC::GenericOffset::operator<= const): (JSC::GenericOffset::operator>= const): * runtime/PropertyTable.h: 2021-12-09 Saam Barati Procedure::setNeedsPCToOriginMap should call Code::forcePreservationOfB3Origins https://bugs.webkit.org/show_bug.cgi?id=234093 Reviewed by Yusuke Suzuki. We need to do this to ensure the sampling profiler works in FTL. The reason this was sometimes working was Air::Code's constructor was looking at Procedure's m_needsPCToOriginMap before it was initialized, in its constructor. This is because Procedure was constructing Code before all its fields were initialized. This patch fixes that bug to construct Code after Procedure has all its fields initialized. * b3/B3Procedure.cpp: (JSC::B3::Procedure::Procedure): (JSC::B3::Procedure::setNeedsPCToOriginMap): * b3/B3Procedure.h: (JSC::B3::Procedure::setNeedsPCToOriginMap): Deleted. 2021-12-09 Saam Barati Add an option to dump the B3 IR for an allowlist of Wasm function indices https://bugs.webkit.org/show_bug.cgi?id=234028 Reviewed by Tadeu Zagallo. * b3/B3Common.cpp: (JSC::B3::shouldDumpIR): * b3/B3Common.h: * b3/B3Generate.cpp: (JSC::B3::generateToAir): * b3/B3Procedure.cpp: (JSC::B3::Procedure::dump const): (JSC::B3::Procedure::setShouldDumpIR): * b3/B3Procedure.h: (JSC::B3::Procedure::shouldDumpIR const): * b3/air/AirGenerate.cpp: (JSC::B3::Air::prepareForGeneration): * b3/testb3.h: (shouldBeVerbose): (lowerToAirForTesting): * b3/testb3_6.cpp: (testInterpreter): (testMoveConstants): * b3/testb3_7.cpp: (testReduceStrengthReassociation): * runtime/OptionsList.h: * tools/FunctionAllowlist.cpp: (JSC::FunctionAllowlist::shouldDumpWasmFunction const): * tools/FunctionAllowlist.h: * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::shouldDumpIRFor): (JSC::Wasm::parseAndCompile): * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): 2021-12-09 Yusuke Suzuki [JSC] Introduce BaselineCallLinkInfo and OptimizingCallLinkInfo to shrink sizeof(BaselineCallLinkInfo) https://bugs.webkit.org/show_bug.cgi?id=233985 Reviewed by Mark Lam. This patch introduces BaselineCallLinkInfo and OptimizingCallLinkInfo to shrink sizeof(BaselineCallLinkInfo). BaselineCallLinkInfo is included in metadata, and allocated for LLInt and Baseline. So shrinking it can make metadata small for LLInt and Baseline, which exists for all live functions. We also reorder OpIteratorOpen::Metadata and OpIteratorNext::Metadata to shrink sizes. sizeof(BaselineCallLinkInfo) becomes 88, while the old sizeof(CallLinkInfo) was 120. * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * bytecode/BytecodeList.rb: * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::setMonomorphicCallee): (JSC::CallLinkInfo::emitFastPathImpl): (JSC::OptimizingCallLinkInfo::emitFastPath): (JSC::OptimizingCallLinkInfo::emitTailCallFastPath): (JSC::OptimizingCallLinkInfo::emitSlowPath): (JSC::CallLinkInfo::emitDataICSlowPath): (JSC::OptimizingCallLinkInfo::slowPathStart): (JSC::OptimizingCallLinkInfo::fastPathStart): (JSC::OptimizingCallLinkInfo::emitDirectFastPath): (JSC::OptimizingCallLinkInfo::emitDirectTailCallFastPath): (JSC::OptimizingCallLinkInfo::initializeDirectCall): (JSC::OptimizingCallLinkInfo::setDirectCallTarget): (JSC::BaselineCallLinkInfo::initialize): (JSC::CallLinkInfo::slowPathStart): Deleted. (JSC::CallLinkInfo::fastPathStart): Deleted. (JSC::CallLinkInfo::emitFastPath): Deleted. (JSC::CallLinkInfo::emitTailCallFastPath): Deleted. (JSC::CallLinkInfo::emitSlowPath): Deleted. (JSC::CallLinkInfo::initializeDataIC): Deleted. (JSC::CallLinkInfo::emitDirectFastPath): Deleted. (JSC::CallLinkInfo::emitDirectTailCallFastPath): Deleted. (JSC::CallLinkInfo::initializeDirectCall): Deleted. (JSC::CallLinkInfo::setDirectCallTarget): Deleted. * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::type const): (JSC::CallLinkInfo::CallLinkInfo): (JSC::CallLinkInfo::calleeGPR const): (JSC::CallLinkInfo::callLinkInfoGPR const): (JSC::CallLinkInfo::setCallLinkInfoGPR): (JSC::CallLinkInfo::setUpCall): Deleted. (JSC::CallLinkInfo::setCodeLocations): Deleted. (JSC::CallLinkInfo::calleeGPR): Deleted. * bytecode/CallLinkStatus.cpp: (JSC::CallLinkStatus::computeFor): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::getICStatusMap): (JSC::CodeBlock::jettison): * bytecode/GetterSetterAccessCase.h: * bytecode/PolymorphicAccess.h: * bytecode/Repatch.cpp: (JSC::revertCall): (JSC::linkDirectCall): * bytecode/Repatch.h: * dfg/DFGCommonData.h: (JSC::DFG::CommonData::addCallLinkInfo): * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::addJSCall): (JSC::DFG::JITCompiler::addJSDirectCall): (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord): (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::createForBaselineOrLLIntTailCall): * jit/GCAwareJITStubRoutine.cpp: (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine): (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler): (JSC::createICJITStubRoutine): * jit/GCAwareJITStubRoutine.h: * jit/JITCall.cpp: (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (): Deleted. * wasm/js/JSWebAssemblyCodeBlock.h: * wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS): * wasm/js/WasmToJS.h: 2021-12-08 Asumu Takikawa Support WebAssembly.Memory imports in Wasm/ESM modules. https://bugs.webkit.org/show_bug.cgi?id=184745 Reviewed by Yusuke Suzuki. Changes how Wasm code is initialized for modules that are loaded by the module loader and have memory imports. The initial code for the LLInt tier is copied to all memory modes, so that the memory import can be initialized after compilation. When LLInt is turned off, the compilation of B3/Air code is delayed until the memory is initialized. * wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::createFromExisting): (JSC::Wasm::CodeBlock::CodeBlock): * wasm/WasmCodeBlock.h: * wasm/WasmInstance.h: (JSC::Wasm::Instance::finalizeCreation): (JSC::Wasm::Instance::module const): (JSC::Wasm::Instance::codeBlock const): (JSC::Wasm::Instance::memory const): (JSC::Wasm::Instance::isImportFunction const): (JSC::Wasm::Instance::module): Deleted. (JSC::Wasm::Instance::codeBlock): Deleted. (JSC::Wasm::Instance::memory): Deleted. * wasm/WasmModule.cpp: (JSC::Wasm::Module::copyInitialCodeBlockToAllMemoryModes): * wasm/WasmModule.h: * wasm/js/JSWebAssembly.cpp: (JSC::instantiate): * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::finalizeCreation): (JSC::JSWebAssemblyInstance::tryCreate): * wasm/js/JSWebAssemblyInstance.h: * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): 2021-12-08 Yusuke Suzuki [JSC] Introduce WriteBarrierStructureID https://bugs.webkit.org/show_bug.cgi?id=233918 Reviewed by Mark Lam. This patch adds WriteBarrierStructureID class, which is similar to WriteBarrier, but internally, it holds StructureID, so sizeof(WriteBarrierStructureID) is 4. This class is useful to use StructureID for memory saving while keeping WriteBarrier's useful features (automatically inserts write-barrier when setting etc.). This also paves the way to introducing DOMStructures array with WriteBarrierStructureID instead of costly HashMap>. * bytecode/AccessCase.cpp: (JSC::AccessCase::AccessCase): (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::dump const): (JSC::AccessCase::propagateTransitions const): (JSC::AccessCase::canBeShared): * bytecode/AccessCase.h: (JSC::AccessCase::structure const): (JSC::AccessCase::newStructure const): (JSC::AccessCase::hash const): (JSC::AccessCase::AccessCase): * bytecode/CheckPrivateBrandStatus.cpp: (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/DeleteByStatus.cpp: (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/InstanceOfStatus.cpp: (JSC::InstanceOfStatus::computeForStubInfo): * bytecode/InternalFunctionAllocationProfile.h: (JSC::InternalFunctionAllocationProfile::offsetOfStructureID): (JSC::InternalFunctionAllocationProfile::structure): (JSC::InternalFunctionAllocationProfile::clear): (JSC::InternalFunctionAllocationProfile::visitAggregate): (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase): (JSC::InternalFunctionAllocationProfile::offsetOfStructure): Deleted. * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * bytecode/SetPrivateBrandStatus.cpp: (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::deref): (JSC::StructureStubInfo::aboutToDie): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitAggregateImpl): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::summary const): (JSC::StructureStubInfo::containsPC const): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::inlineAccessBaseStructure): (JSC::StructureStubInfo::offsetOfByIdSelfOffset): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): Deleted. * dfg/DFGSpeculativeJIT.cpp: * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise): (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * heap/AbstractSlotVisitor.h: * heap/AbstractSlotVisitorInlines.h: (JSC::AbstractSlotVisitor::append): (JSC::AbstractSlotVisitor::appendHidden): * heap/SlotVisitor.h: * heap/SlotVisitorInlines.h: (JSC::SlotVisitor::append): (JSC::SlotVisitor::appendHidden): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitNonNullDecodeStructureID): (JSC::AssemblyHelpers::emitLoadStructure): * jit/AssemblyHelpers.h: * jit/JITInlineCacheGenerator.cpp: (JSC::generateGetByIdInlineAccess): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): * runtime/FunctionExecutable.cpp: (JSC::FunctionExecutable::visitChildrenImpl): * runtime/FunctionExecutable.h: * runtime/FunctionRareData.cpp: (JSC::FunctionRareData::visitChildrenImpl): * runtime/FunctionRareData.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator): (JSC::JSPropertyNameEnumerator::visitChildrenImpl): * runtime/JSPropertyNameEnumerator.h: * runtime/StructureRareData.cpp: (JSC::StructureRareData::StructureRareData): * runtime/StructureRareData.h: * runtime/WriteBarrier.h: (JSC::WriteBarrierStructureID::WriteBarrierStructureID): (JSC::WriteBarrierStructureID::get const): (JSC::WriteBarrierStructureID::operator* const): (JSC::WriteBarrierStructureID::operator-> const): (JSC::WriteBarrierStructureID::clear): (JSC::WriteBarrierStructureID::operator bool const): (JSC::WriteBarrierStructureID::operator! const): (JSC::WriteBarrierStructureID::setWithoutWriteBarrier): (JSC::WriteBarrierStructureID::unvalidatedGet const): (JSC::WriteBarrierStructureID::value const): * runtime/WriteBarrierInlines.h: (JSC::WriteBarrierStructureID::set): (JSC::WriteBarrierStructureID::setMayBeNull): (JSC::WriteBarrierStructureID::setEarlyValue): * tools/JSDollarVM.cpp: (JSC::JSDollarVM::finishCreation): (JSC::JSDollarVM::visitChildrenImpl): * tools/JSDollarVM.h: 2021-12-07 Saam Barati TypedArray prototype set should go down the fast path when using non clamped integer types of the same byte size https://bugs.webkit.org/show_bug.cgi?id=233905 Reviewed by Keith Miller. We can use memmove in this scenario because the bitpattern of the data between the signed and unsigned values will be the same. This patch also fixes a bug where we were looking at the wrong pointer when determining to do a forward or backwards loop in our memmove. We were looking at the vector instead of vector+offset. * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::set): 2021-12-07 Ross Kirsling [JSC] Add LLInt IC for try_get_by_id of own cacheable value https://bugs.webkit.org/show_bug.cgi?id=233830 Reviewed by Yusuke Suzuki. This patch adds an LLInt IC for the "own cacheable value" path of try_get_by_id; this is the simplest case and basically the same as get_by_id_direct. Performance is neutral with JIT enabled as well as on current uses of try_get_by_id in JSC (e.g. hasObservableSideEffectsForRegexpSplit), but microbenchmarks of try_get_by_id itself see a 2x speedup: Before After try-get-by-id-polymorphic 123.8361+-0.4562 ^ 61.7586+-0.3770 ^ definitely 2.0052x faster try-get-by-id-basic 124.4437+-0.6091 ^ 61.0340+-0.1924 ^ definitely 2.0389x faster 124.1207+-0.3130 ^ 61.3865+-0.2019 ^ definitely 2.0220x faster * bytecode/BytecodeList.rb: * bytecode/CodeBlock.cpp: * bytecode/GetByStatus.cpp: * llint/LLIntSlowPaths.cpp: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-12-07 Commit Queue Unreviewed, reverting r286502 and r286580. https://bugs.webkit.org/show_bug.cgi?id=233930 Speedometer2 0.7% regression Reverted changesets: "Remove StructureIDBlob" https://bugs.webkit.org/show_bug.cgi?id=233723 https://commits.webkit.org/r286502 "TypeInfo should be materializable from Structures as a single load." https://bugs.webkit.org/show_bug.cgi?id=233875 https://commits.webkit.org/r286580 2021-12-07 Zan Dobersek [RISCV64] Add more MacroAssemblerRISCV64 helper infrastructure https://bugs.webkit.org/show_bug.cgi?id=233805 Reviewed by Yusuke Suzuki. Introduce RISCV64Assembler::ImmediateLoader, a helper class that generates the operations necessary for loading any immediate value into some register. This can be as simple as using ADDI to load 12-bit values or a combination of LUI, ADDI and possibly additional combinations of LSHIFT and ADDI instructions. There's also a placeholder mode which generates no-ops for unused operation slots, in order to enable future patching and repatching for other immediate values. MacroAssemblerRISCV64::Imm is introduced as a private helper struct that groups together validity and construction operations for the different immediate types implemented in the RISCV64Instructions namespace. In MacroAssemblerRISCV64, resolveAddress() overloads are provided to help generate most optimal address loading sequencing. RISC-V addressing mode utilizes a base register and a 12-bit signed offset. When needed, additional computation is done on the address object's parameters and stored in the destination register through which the load can then be performed. Helper TempRegister and LazyTempRegister structs are added to the MacroAssemblerRISCV64 class, along with the respective temps() and lazyTemp() methods. temps() returns the TempRegister object, with the template parameters defining which of the two scratch register types should be allowed for use through this object. Release-time assert on the m_allowScratchRegister value is done at the point of calling temps(). lazyTemp() only handles one scratch register, and the assert is done only when the register is actually used, and not just reserved for use. This enables simpler implementations that better handle both modes of scratch register usage (allowed or disallowed). To get things rolling, the first set of MacroAssemblerRISCV64 methods is implemented. Addition, subtraction and multiplication definitions are provided, with the templated no-op declarations removed. * assembler/MacroAssemblerRISCV64.h: (JSC::MacroAssemblerRISCV64::TempRegister::data): (JSC::MacroAssemblerRISCV64::TempRegister::memory): (JSC::MacroAssemblerRISCV64::LazyTempRegister::LazyTempRegister): (JSC::MacroAssemblerRISCV64::LazyTempRegister::operator RegisterID): (JSC::MacroAssemblerRISCV64::temps): (JSC::MacroAssemblerRISCV64::lazyTemp): (JSC::MacroAssemblerRISCV64::add32): (JSC::MacroAssemblerRISCV64::add64): (JSC::MacroAssemblerRISCV64::sub32): (JSC::MacroAssemblerRISCV64::sub64): (JSC::MacroAssemblerRISCV64::mul32): (JSC::MacroAssemblerRISCV64::mul64): (JSC::MacroAssemblerRISCV64::Imm::isValid): (JSC::MacroAssemblerRISCV64::Imm::I): (JSC::MacroAssemblerRISCV64::Imm::S): (JSC::MacroAssemblerRISCV64::Imm::B): (JSC::MacroAssemblerRISCV64::Imm::U): (JSC::MacroAssemblerRISCV64::Imm::J): (JSC::MacroAssemblerRISCV64::resolveAddress): * assembler/RISCV64Assembler.h: (JSC::RISCV64Assembler::ImmediateLoader::ImmediateLoader): (JSC::RISCV64Assembler::ImmediateLoader::moveInto): 2021-12-06 Keith Miller TypeInfo should be materializable from Structures as a single load. https://bugs.webkit.org/show_bug.cgi?id=233875 Reviewed by Mark Lam. This is mostly just the members of Structure and JSCell so that JSType and InlineTypeFlags are at the end of the JSCell header. * assembler/testmasm.cpp: (JSC::testBranchIfType): (JSC::testBranchIfNotType): * ftl/FTLAbstractHeapRepository.cpp: (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository): * runtime/JSCell.h: * runtime/JSCellInlines.h: (JSC::JSCell::JSCell): * runtime/Structure.h: (JSC::Structure::typeInfo const): 2021-12-06 Mark Lam Remove unneeded virtual allocator methods from Subspace. https://bugs.webkit.org/show_bug.cgi?id=233891 rdar://86117970 Reviewed by Yusuke Suzuki. Since the virtual allocate() and allocateFor() methods are now deleted, we can also rename the inline allocateNonVirtual() and allocatorForNonVirtual() methods to simply allocate() and allocateFor(). Similarly, rename allocatorForNonVirtualConcurrently() to allocatorForConcurrently(). There are 2 places that still invokes the non-inline version of CompleteSubspace::allocatorFor(). For this reason, we introduce a CompleteSubsace::allocatorForNonInline() to keep the linkage the same. There's a chance that the compiler/linker may already inline the method in 1 or both of these places, but we'll offer allocatorForNonInline() to keep the code expressing the same thing and let the compiler/linker decide whether to inline it or not just as before. This is purely a re-factoring patch. There are no behavior changes, except for the removal of those 2 entries from the vtbls. * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * bytecode/ObjectAllocationProfileInlines.h: (JSC::ObjectAllocationProfileBase::initializeProfile): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitAllocateRawObject): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * heap/CompleteSubspace.cpp: (JSC::CompleteSubspace::allocatorForNonInline): (JSC::CompleteSubspace::tryAllocateSlow): (JSC::CompleteSubspace::allocatorFor): Deleted. (JSC::CompleteSubspace::allocate): Deleted. * heap/CompleteSubspace.h: (JSC::CompleteSubspace::allocatorFor): (JSC::CompleteSubspace::allocatorForNonVirtual): Deleted. * heap/CompleteSubspaceInlines.h: (JSC::CompleteSubspace::allocate): (JSC::CompleteSubspace::allocateNonVirtual): Deleted. * heap/IsoSubspace.cpp: (JSC::IsoSubspace::allocatorFor): Deleted. (JSC::IsoSubspace::allocate): Deleted. * heap/IsoSubspace.h: (JSC::IsoSubspace::allocatorFor): (JSC::IsoSubspace::allocatorForNonVirtual): Deleted. * heap/IsoSubspaceInlines.h: (JSC::IsoSubspace::allocate): (JSC::IsoSubspace::allocateNonVirtual): Deleted. * heap/Subspace.h: * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize): * runtime/ButterflyInlines.h: (JSC::Butterfly::tryCreateUninitialized): (JSC::Butterfly::createUninitialized): (JSC::Butterfly::tryCreate): (JSC::Butterfly::growArrayRight): (JSC::Butterfly::reallocArrayRightIfPossible): * runtime/DirectArguments.cpp: (JSC::DirectArguments::overrideThings): * runtime/GenericArgumentsInlines.h: (JSC::GenericArguments::initModifiedArgumentsDescriptor): * runtime/HashMapImpl.h: (JSC::HashMapBuffer::create): * runtime/JSArray.cpp: (JSC::JSArray::tryCreateUninitializedRestricted): * runtime/JSArray.h: (JSC::JSArray::tryCreate): * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): * runtime/JSBigInt.cpp: (JSC::JSBigInt::createWithLength): * runtime/JSCellInlines.h: (JSC::allocatorForConcurrently): (JSC::tryAllocateCellHelper): (JSC::allocatorForNonVirtualConcurrently): Deleted. * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::create): * runtime/ScopedArguments.cpp: (JSC::ScopedArguments::createUninitialized): * runtime/StructureChain.cpp: (JSC::StructureChain::create): 2021-12-06 Patrick Angle Web Inspector: Support Cascade Layers in the Styles sidebar https://bugs.webkit.org/show_bug.cgi?id=233208 Reviewed by Devin Rousso. Add new values to `CSS.Grouping`'s `type` enum for cascade layers and make the `text` optional since an anonymous layer will not have a name or other text. * inspector/protocol/CSS.json: 2021-12-03 Keith Miller Remove StructureIDBlob https://bugs.webkit.org/show_bug.cgi?id=233723 Reviewed by Yusuke Suzuki. StructureIDBlob isn't very useful now that StructureIDs are just the bottom bits of the pointer on 64 bit platforms. In a follow up patch I'll change the layout of JSCell and Structure so that TypeInfo creation can be a single load platforms that allow (and don't penalize) misaligned loads. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_to_scope): * runtime/Structure.cpp: (JSC::Structure::Structure): (JSC::Structure::addNewPropertyTransition): (JSC::Structure::removeNewPropertyTransition): (JSC::Structure::attributeChangeTransition): (JSC::Structure::nonPropertyTransitionSlow): (JSC::Structure::setBrandTransition): * runtime/Structure.h: (JSC::Structure::id const): (JSC::Structure::objectInitializationBlob const): (JSC::Structure::idBlob const): (JSC::Structure::isProxy const): (JSC::Structure::typeInfo const): (JSC::Structure::indexingType const): (JSC::Structure::indexingMode const): (JSC::Structure::fencedIndexingMode): (JSC::Structure::indexingModeIncludingHistory const): (JSC::Structure::indexingModeIncludingHistoryOffset): (JSC::Structure::structureIDOffset): Deleted. * runtime/StructureIDBlob.h: Removed. * runtime/StructureInlines.h: (JSC::Structure::hasIndexingHeader const): * tools/VMInspectorInlines.h: (JSC::VMInspector::verifyCellSize): 2021-12-02 Yusuke Suzuki [JSC] shell's $.globalObjectFor is not safe for non object cells https://bugs.webkit.org/show_bug.cgi?id=233794 Reviewed by Saam Barati. Only Object cells can have Structures having JSGlobalObject. * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): 2021-12-02 Saam Barati Lower structureHeapAddressSize on more memory limited ARM64 devices https://bugs.webkit.org/show_bug.cgi?id=233786 Reviewed by Yusuke Suzuki. Some processes using JSC are failing the mmap for the 1GB region. Let's lower the region size to 512MB on lower memory iOS devices. * runtime/JSCConfig.h: 2021-12-02 Saam Barati Fix OOM crash in JSValue::toWTFStringForConsole https://bugs.webkit.org/show_bug.cgi?id=233775 Reviewed by Mark Lam. * runtime/JSCJSValue.cpp: (JSC::JSValue::toWTFStringForConsole const): 2021-12-02 Zan Dobersek [RISCV64] Fix effective address loading for LabelReferences with offsets https://bugs.webkit.org/show_bug.cgi?id=233754 Reviewed by Yusuke Suzuki. r286345 (and subsequent change in r286372) introduced a load from a label address with an additional offset. To properly handle this, RISCV64 offlineasm generates the desired load-effective-address instruction but now also generates an additional add instruction when an offset value is present for that lea. * offlineasm/riscv64.rb: 2021-12-02 Geza Lore [JSC] Generated code size reductions for baseline JIT (all architectures) https://bugs.webkit.org/show_bug.cgi?id=233474 Reviewed by Yusuke Suzuki. This patch introduces a few improvements that reduce the generated code size. Target independent improvements to the Baseline JIT: 1. Some bytecodes that are very frequent (e.g.: get_by_id, call) share the same instructions at the tail end of the fast and slow paths. Instead of duplicating these in the slow path, then branch to the next sequential bytecode on the fast path, make the slow path branch to and reuse these common instructions, which then naturally fall through to the next sequential bytecode. 2. Minor tweaks in a few places to remove redundant reloading of immediates and remove redundant moves. 3. Remove a small number of redundant unconditional branches from some DataIC fast paths. ARMv7/Thumb-2 specific improvements: 4. Add assembler support for LDRD and STRD (load/store a pair of 32-bit GPRs) and use them throughout via loadValue/storeValue. This yields denser code as it often eliminates repeated temporary register setups (especially for a BaseIndex access), and also due to point 4 below. This is also potentially a performance improvement on micro-architectures with a 64-bit LSU data-path. 5. Instructions using only r0-r7 as operands can often use a short, 16-bit encoding in Thumb-2, so prefer to use low order registers as temporaries wherever possible. The net effect of this patch is that the emitted baseline code during a run of JetStream2 is ~6.6% smaller on x86_64, ~5.1% smaller on ARM64, and ~24% smaller on ARMv7/Thumb-2. On ARMv7/Thumb-2, DFG code is also ~5.3% smaller, while on other architectures the DFG code is unaffected. On ARMv7/Thumb-2, this patch also yields an ~2% improvement in JetStream2 scores on my test machine. * assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::ldrd): (JSC::ARMv7Assembler::strd): (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg4Reg4Reg4Imm8): * assembler/MacroAssembler.h: (JSC::MacroAssembler::addPtr): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::bestTempRegister): (JSC::MacroAssemblerARMv7::scratchRegister): (JSC::MacroAssemblerARMv7::add32): (JSC::MacroAssemblerARMv7::sub32): (JSC::MacroAssemblerARMv7::loadPair32): (JSC::MacroAssemblerARMv7::store32): (JSC::MacroAssemblerARMv7::storePair32): (JSC::MacroAssemblerARMv7::compare32AndSetFlags): (JSC::MacroAssemblerARMv7::test32): (JSC::MacroAssemblerARMv7::branch32): (JSC::MacroAssemblerARMv7::farJump): (JSC::MacroAssemblerARMv7::call): (JSC::MacroAssemblerARMv7::compare32): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::loadPair32): (JSC::MacroAssemblerMIPS::storePair32): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::storeValue): (JSC::AssemblyHelpers::loadValue): * jit/JIT.cpp: (JSC::JIT::privateCompileSlowCases): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITInlineCacheGenerator.cpp: (JSC::generateGetByIdInlineAccess): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::setFastPathResumePoint): (JSC::JIT::fastPathResumePoint const): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_enter): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_brand): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emitWriteBarrier): 2021-12-01 Adrian Perez de Castro Non-unified build fixes, early December 2021 edition https://bugs.webkit.org/show_bug.cgi?id=233699 Unreviewed non-unified build fixes. * dfg/DFGCodeOriginPool.h: Add missing CodeOrigin.h header. * heap/Heap.cpp: Add missing GigacageAlignedMemoryAllocator.h header. * heap/IsoSubspace.cpp: Add missing IsoAlignedMemoryAllocator.h header, and remove IsoMemoryAllocatorBase.h as it is included by the former. * runtime/StackFrame.h: Add missing BytecodeIndex.h header. * runtime/StructureID.h: Add missing wtf/HashTraits.h header. * tools/Integrity.h: Add missing StructureID.h header. 2021-12-01 Yusuke Suzuki [JSC] RegExpTestInline DFG / FTL nodes should introduce a write-barrier https://bugs.webkit.org/show_bug.cgi?id=233716 Reviewed by Michael Saboff. Since RegExpTestInline fast path stores cells into JSGlobalObject's RegExpCachedResult field, we need to consider about inserting a write-barrier onto JSGlobalObject. This patch adds RegExpTestInline to DFGStoreBarrierInsertionPhase so that DFG / FTL inserts a write-barrier appropriately. * dfg/DFGStoreBarrierInsertionPhase.cpp: 2021-12-01 Keith Miller Add static_assert the value we use to initialize a StructureID buffer should be 0. https://bugs.webkit.org/show_bug.cgi?id=233720 Reviewed by Yusuke Suzuki. Also, add static assert that the zero we are putting into the buffer matches the default StructureID constructor. * runtime/StructureChain.cpp: (JSC::StructureChain::create): * runtime/StructureID.h: (JSC::StructureID::bits const): 2021-12-01 Yusuke Suzuki Unreviewed, use void* to suppress GCC warning https://bugs.webkit.org/show_bug.cgi?id=233379 * runtime/StructureChain.cpp: (JSC::StructureChain::create): 2021-12-01 Mikhail R. Gadelha Disable madd4 instruction generation globally for MIPS https://bugs.webkit.org/show_bug.cgi?id=233713 Reviewed by Yusuke Suzuki. This is an improved version of r285788 and follows the approach used in r231301. This patch removes the volatile attribute from the double variable and adds a -mno-madd4 flag globally when compiling on MIPS. * CMakeLists.txt: * runtime/ParseInt.h: (JSC::parseInt): 2021-12-01 Yusuke Suzuki Unreviewed, fix CLoop build https://bugs.webkit.org/show_bug.cgi?id=233379 * llint/LowLevelInterpreter64.asm: 2021-12-01 Xan Lopez [JSC] Fix potential build break related to StructureID.h https://bugs.webkit.org/show_bug.cgi?id=233693 Reviewed by Adrian Perez de Castro. * runtime/StructureID.h: include StdIntExtras.h for CPURegister. 2021-12-01 Xan Lopez [JSC] Remove debug print left over from previous patch https://bugs.webkit.org/show_bug.cgi?id=233692 Unreviewed follow-up patch. * offlineasm/x86.rb: remove debug print. 2021-11-30 Mark Lam Move Subspaces from VM to Heap. https://bugs.webkit.org/show_bug.cgi?id=233648 rdar://85875751 Reviewed by Saam Barati. Subspaces are Heap data structures to begin with, and this refactoring is needed in preparation for the global GC. 1. Embed HeapCellType and IsoHeapCellType instances in Heap directly instead of malloc'ing them separately and referencing them via unique_ptrs. These instances are always instantiated unconditionally anyway. This change eliminates the unneeded busy work to allocate them separately. 2. Introduce a HeapSubspaceTypes.h that #include all the types that we have subspaces for. This makes it so that Heap.cpp's #include list is not flooded with these types with subspaces, and that it'll be easier to discern between these Subspace types from other data structures needed for implementing Heap. 3. Add VM accessor methods for subspaces that forward to Heap. This will make it easier for us to redirect to a thread local allocator later for the global GC. 4. Remove unneeded #includes in VM.h. 5. Remove unused CodeBlockSet::iterateViaSubspaces(). * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * bytecode/DFGExitProfile.h: * bytecode/EvalCodeBlock.h: * bytecode/ExecutableToCodeBlockEdge.cpp: (JSC::ExecutableToCodeBlockEdge::visitChildrenImpl): (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally): (JSC::ExecutableToCodeBlockEdge::runConstraint): * bytecode/ExecutableToCodeBlockEdge.h: * bytecode/FunctionCodeBlock.h: * bytecode/ModuleProgramCodeBlock.h: * bytecode/ProgramCodeBlock.h: * bytecode/Repatch.h: * bytecode/UnlinkedFunctionExecutable.cpp: (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor): (JSC::UnlinkedFunctionExecutable::finalizeUnconditionally): * bytecode/UnlinkedFunctionExecutable.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitAllocateRawObject): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * generator/DSL.rb: * heap/CodeBlockSet.h: * heap/CodeBlockSetInlines.h: (JSC::CodeBlockSet::iterateViaSubspaces): Deleted. * heap/Heap.cpp: (JSC::Heap::Heap): (JSC::Heap::finalizeUnconditionalFinalizers): (JSC::Heap::deleteAllCodeBlocks): (JSC::Heap::deleteAllUnlinkedCodeBlocks): (JSC::Heap::deleteUnmarkedCompiledCode): (JSC::Heap::sweepInFinalize): (JSC::Heap::addCoreConstraints): * heap/Heap.h: (JSC::Heap::gigacageAuxiliarySpace): (JSC::Heap::SpaceAndSet::SpaceAndSet): (JSC::Heap::SpaceAndSet::setFor): (JSC::Heap::forEachCodeBlockSpace): (JSC::Heap::forEachScriptExecutableSpace): * heap/HeapSubspaceTypes.h: Added. * heap/IsoHeapCellType.h: * heap/IsoInlinedHeapCellType.h: * heap/IsoInlinedHeapCellTypeInlines.h: Added. (JSC::IsoInlinedHeapCellType::IsoInlinedHeapCellType): (JSC::IsoInlinedHeapCellType::DestroyFunc::operator const): (JSC::IsoInlinedHeapCellType::finishSweep const): (JSC::IsoInlinedHeapCellType::destroy const): * heap/MarkedBlockInlines.h: * inspector/JSInjectedScriptHostPrototype.h: * inspector/JSJavaScriptCallFramePrototype.h: * interpreter/CallFrame.h: * jsc.cpp: (JSCMemoryFootprint::subspaceFor): (JSFileDescriptor::subspaceFor): * runtime/AggregateErrorPrototype.h: * runtime/ArrayIteratorPrototype.h: * runtime/AsyncFromSyncIteratorPrototype.h: * runtime/AsyncFunctionPrototype.h: * runtime/AsyncGeneratorFunctionPrototype.h: * runtime/AsyncGeneratorPrototype.h: * runtime/AsyncIteratorPrototype.h: * runtime/AtomicsObject.h: * runtime/BigIntPrototype.h: * runtime/BrandedStructure.h: * runtime/ButterflyInlines.h: (JSC::Butterfly::tryCreateUninitialized): (JSC::Butterfly::createUninitialized): (JSC::Butterfly::tryCreate): (JSC::Butterfly::growArrayRight): (JSC::Butterfly::reallocArrayRightIfPossible): * runtime/CachedTypes.h: * runtime/ClonedArguments.h: * runtime/ConsoleObject.h: * runtime/CustomGetterSetter.h: (JSC::CustomGetterSetter::subspaceFor): * runtime/DOMAttributeGetterSetter.h: * runtime/DateInstance.h: * runtime/DatePrototype.h: * runtime/DirectArguments.h: * runtime/ErrorPrototype.h: * runtime/Exception.h: * runtime/FinalizationRegistryPrototype.h: * runtime/FunctionExecutable.h: * runtime/GeneratorFunctionPrototype.h: * runtime/GeneratorPrototype.h: * runtime/GetterSetter.h: * runtime/HashMapImpl.h: (JSC::HashMapBuffer::create): * runtime/InternalFunction.h: (JSC::InternalFunction::subspaceFor): * runtime/IntlCollatorPrototype.h: * runtime/IntlDateTimeFormatPrototype.h: * runtime/IntlDisplayNamesPrototype.h: * runtime/IntlListFormatPrototype.h: * runtime/IntlLocalePrototype.h: * runtime/IntlNumberFormatPrototype.h: * runtime/IntlObject.h: * runtime/IntlPluralRulesPrototype.h: * runtime/IntlRelativeTimeFormatPrototype.h: * runtime/IntlSegmentIteratorPrototype.h: * runtime/IntlSegmenterPrototype.h: * runtime/IntlSegmentsPrototype.h: * runtime/IteratorPrototype.h: * runtime/JSArray.cpp: (JSC::JSArray::tryCreateUninitializedRestricted): * runtime/JSArray.h: (JSC::JSArray::subspaceFor): (JSC::JSArray::tryCreate): * runtime/JSArrayBufferPrototype.h: * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): * runtime/JSBigInt.cpp: (JSC::JSBigInt::createWithLength): * runtime/JSBigInt.h: * runtime/JSCallee.h: (JSC::JSCallee::subspaceFor): * runtime/JSDataViewPrototype.h: * runtime/JSFunction.h: (JSC::JSFunction::subspaceFor): * runtime/JSGenericTypedArrayViewPrototype.h: * runtime/JSGlobalLexicalEnvironment.h: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/JSLexicalEnvironment.h: (JSC::JSLexicalEnvironment::subspaceFor): * runtime/JSModuleLoader.h: * runtime/JSONObject.h: * runtime/JSObjectInlines.h: (JSC::JSFinalObject::subspaceFor): * runtime/JSPromise.h: (JSC::JSPromise::subspaceFor): * runtime/JSPromisePrototype.h: (JSC::JSPromisePrototype::subspaceFor): * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::create): * runtime/JSPropertyNameEnumerator.h: * runtime/JSProxy.h: (JSC::JSProxy::subspaceFor): * runtime/JSString.h: (JSC::JSString::subspaceFor): * runtime/JSTypedArrayViewPrototype.h: * runtime/MapIteratorPrototype.h: * runtime/MapPrototype.h: * runtime/MathObject.h: * runtime/NativeErrorPrototype.h: * runtime/NativeExecutable.h: * runtime/NumberObject.h: (JSC::NumberObject::subspaceFor): * runtime/ObjectPrototype.h: * runtime/ProgramExecutable.h: * runtime/PropertyTable.h: * runtime/ReflectObject.h: * runtime/RegExp.h: * runtime/RegExpObject.h: * runtime/RegExpPrototype.h: * runtime/RegExpStringIteratorPrototype.h: * runtime/ScopedArguments.cpp: (JSC::ScopedArguments::createUninitialized): * runtime/ScopedArguments.h: * runtime/SetIteratorPrototype.h: * runtime/SetPrototype.h: * runtime/ShadowRealmPrototype.h: * runtime/SparseArrayValueMap.h: * runtime/StringIteratorPrototype.h: * runtime/StringObject.h: (JSC::StringObject::subspaceFor): * runtime/Structure.h: (JSC::Structure::subspaceFor): * runtime/StructureChain.cpp: (JSC::StructureChain::create): * runtime/StructureChain.h: * runtime/StructureRareData.h: * runtime/SymbolPrototype.h: * runtime/SymbolTable.h: * runtime/TemporalCalendarPrototype.h: * runtime/TemporalDurationPrototype.h: * runtime/TemporalInstantPrototype.h: * runtime/TemporalNow.h: * runtime/TemporalObject.h: * runtime/TemporalPlainTimePrototype.h: * runtime/TemporalTimeZonePrototype.h: * runtime/ThrowScope.cpp: * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: (JSC::VM::cellHeapCellType): (JSC::VM::destructibleObjectHeapCellType): (JSC::VM::primitiveGigacageAuxiliarySpace): (JSC::VM::jsValueGigacageAuxiliarySpace): (JSC::VM::immutableButterflyJSValueGigacageAuxiliarySpace): (JSC::VM::gigacageAuxiliarySpace): (JSC::VM::cellSpace): (JSC::VM::variableSizedCellSpace): (JSC::VM::destructibleObjectSpace): (JSC::VM::arraySpace): (JSC::VM::bigIntSpace): (JSC::VM::calleeSpace): (JSC::VM::clonedArgumentsSpace): (JSC::VM::customGetterSetterSpace): (JSC::VM::dateInstanceSpace): (JSC::VM::domAttributeGetterSetterSpace): (JSC::VM::exceptionSpace): (JSC::VM::executableToCodeBlockEdgeSpace): (JSC::VM::functionSpace): (JSC::VM::getterSetterSpace): (JSC::VM::globalLexicalEnvironmentSpace): (JSC::VM::internalFunctionSpace): (JSC::VM::jsProxySpace): (JSC::VM::nativeExecutableSpace): (JSC::VM::numberObjectSpace): (JSC::VM::plainObjectSpace): (JSC::VM::promiseSpace): (JSC::VM::propertyNameEnumeratorSpace): (JSC::VM::propertyTableSpace): (JSC::VM::regExpSpace): (JSC::VM::regExpObjectSpace): (JSC::VM::ropeStringSpace): (JSC::VM::scopedArgumentsSpace): (JSC::VM::sparseArrayValueMapSpace): (JSC::VM::stringSpace): (JSC::VM::stringObjectSpace): (JSC::VM::structureChainSpace): (JSC::VM::structureRareDataSpace): (JSC::VM::structureSpace): (JSC::VM::brandedStructureSpace): (JSC::VM::symbolTableSpace): (JSC::VM::executableToCodeBlockEdgesWithConstraints): (JSC::VM::executableToCodeBlockEdgesWithFinalizers): (JSC::VM::codeBlockSpace): (JSC::VM::functionExecutableSpace): (JSC::VM::programExecutableSpace): (JSC::VM::unlinkedFunctionExecutableSpace): (JSC::VM::setFuzzerAgent): Deleted. (JSC::VM::SpaceAndSet::SpaceAndSet): Deleted. (JSC::VM::SpaceAndSet::setFor): Deleted. (JSC::VM::forEachCodeBlockSpace): Deleted. (JSC::VM::forEachScriptExecutableSpace): Deleted. * runtime/VMInlines.h: (JSC::VM::setFuzzerAgent): * runtime/WeakMapPrototype.h: * runtime/WeakObjectRefPrototype.h: * runtime/WeakSetPrototype.h: * tools/JSDollarVM.cpp: * tools/JSDollarVM.h: * wasm/js/JSWebAssembly.h: * wasm/js/WebAssemblyCompileErrorPrototype.h: * wasm/js/WebAssemblyExceptionPrototype.h: * wasm/js/WebAssemblyGlobalPrototype.h: * wasm/js/WebAssemblyInstancePrototype.h: * wasm/js/WebAssemblyLinkErrorPrototype.h: * wasm/js/WebAssemblyMemoryPrototype.h: * wasm/js/WebAssemblyModulePrototype.h: * wasm/js/WebAssemblyRuntimeErrorPrototype.h: * wasm/js/WebAssemblyTablePrototype.h: * wasm/js/WebAssemblyTagPrototype.h: 2021-11-30 Keith Miller Structures should be allocated out of an aligned pool of memory so StructureID->Structure* is fast. https://bugs.webkit.org/show_bug.cgi?id=233379 Reviewed by Yusuke Suzuki. This patch changes the 64-bit pointer variant of StructureID to just be the bottom bits of a reserved address space for structures. With this system the decoding of a StructureID is just adding the bits to the start of the structure address space (saved in JSCConfig). We also take care to ignore any high bits of a StructureID outside the reserved address range. This prevents a data corruption from causing us to read past the structure space, much like the gigacage. Now that StructureIDs can be directly determined from the Structure* (and visa versa) we no longer need StructureIDTable, which has been removed. Also, as Structures are still IsoHeaped but not allocated by fastMalloc, there's a new AlignedMemoryAllocator subclass that gets MarkedBlocks out of a simple static allocator. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::propagateTransitions const): (JSC::AccessCase::generateWithGuard): * bytecode/ArrayProfile.cpp: (JSC::ArrayProfile::computeUpdatedPrediction): * bytecode/ArrayProfile.h: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::propagateTransitions): (JSC::CodeBlock::determineLiveness): (JSC::CodeBlock::finalizeLLIntInlineCaches): (JSC::CodeBlock::stronglyVisitWeakReferences): * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadata::GetByIdModeMetadata): (JSC::GetByIdModeMetadata::clearToDefaultModeWithoutCache): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeFromLLInt): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/PolyProtoAccessChain.cpp: (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const): * bytecode/PolyProtoAccessChain.h: * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::visitWeak const): * bytecode/PutByIdFlags.h: * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeFromLLInt): * bytecode/SpeculatedType.cpp: (JSC::speculationFromCell): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::inlineAccessBaseStructure): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::branchWeakStructure): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::finalize): * dfg/DFGSpeculativeJIT.cpp: * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined): (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined): (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther): (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch): (JSC::DFG::SpeculativeJIT::emitUntypedBranch): (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * heap/Heap.cpp: (JSC::Heap::runEndPhase): * heap/Heap.h: (JSC::Heap::structureIDTable): Deleted. * heap/IsoAlignedMemoryAllocator.cpp: (JSC::IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator): (JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator): (JSC::IsoAlignedMemoryAllocator::tryMallocBlock): (JSC::IsoAlignedMemoryAllocator::freeBlock): (JSC::IsoAlignedMemoryAllocator::commitBlock): (JSC::IsoAlignedMemoryAllocator::decommitBlock): (JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory): Deleted. (JSC::IsoAlignedMemoryAllocator::freeAlignedMemory): Deleted. * heap/IsoAlignedMemoryAllocator.h: * heap/IsoMemoryAllocatorBase.cpp: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp. (JSC::IsoMemoryAllocatorBase::IsoMemoryAllocatorBase): (JSC::IsoMemoryAllocatorBase::~IsoMemoryAllocatorBase): (JSC::IsoMemoryAllocatorBase::releaseMemoryFromSubclassDestructor): (JSC::IsoMemoryAllocatorBase::tryAllocateAlignedMemory): (JSC::IsoMemoryAllocatorBase::freeAlignedMemory): * heap/IsoMemoryAllocatorBase.h: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h. * heap/IsoSubspace.cpp: (JSC::IsoSubspace::IsoSubspace): (JSC::IsoSubspace::tryAllocateFromLowerTier): * heap/IsoSubspace.h: * heap/PreciseAllocation.cpp: (JSC::PreciseAllocation::tryCreateForLowerTier): (JSC::PreciseAllocation::createForLowerTier): Deleted. * heap/PreciseAllocation.h: * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * heap/StructureAlignedMemoryAllocator.cpp: Added. (JSC::StructureAlignedMemoryAllocator::StructureAlignedMemoryAllocator): (JSC::StructureAlignedMemoryAllocator::~StructureAlignedMemoryAllocator): (JSC::StructureAlignedMemoryAllocator::dump const): (JSC::StructureAlignedMemoryAllocator::tryAllocateMemory): (JSC::StructureAlignedMemoryAllocator::freeMemory): (JSC::StructureAlignedMemoryAllocator::tryReallocateMemory): (JSC::StructureMemoryManager::StructureMemoryManager): (JSC::StructureMemoryManager::tryMallocStructureBlock): (JSC::StructureMemoryManager::freeStructureBlock): (JSC::StructureAlignedMemoryAllocator::initializeStructureAddressSpace): (JSC::StructureAlignedMemoryAllocator::tryMallocBlock): (JSC::StructureAlignedMemoryAllocator::freeBlock): (JSC::StructureAlignedMemoryAllocator::commitBlock): (JSC::StructureAlignedMemoryAllocator::decommitBlock): * heap/StructureAlignedMemoryAllocator.h: Copied from Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h. * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): (JSC::AssemblyHelpers::emitLoadStructure): (JSC::AssemblyHelpers::emitLoadPrototype): (JSC::AssemblyHelpers::emitRandomThunk): (JSC::AssemblyHelpers::emitConvertValueToBoolean): (JSC::AssemblyHelpers::branchIfValue): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchStructure): (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly): * jit/GCAwareJITStubRoutine.cpp: (JSC::PolymorphicAccessJITStubRoutine::computeHash): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_get_prototype_of): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_property_enumerator): * jit/JITStubRoutine.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::performLLIntGetByID): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/x86.rb: * runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/BigIntPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/BooleanPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/DatePrototype.cpp: (JSC::formateDateInstance): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ErrorInstance.cpp: (JSC::ErrorInstance::sanitizedMessageString): (JSC::ErrorInstance::sanitizedNameString): (JSC::ErrorInstance::sanitizedToString): * runtime/ErrorPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/FunctionPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/HasOwnPropertyCache.h: * runtime/InitializeThreading.cpp: (JSC::initialize): * runtime/JSCConfig.h: * runtime/JSCJSValue.cpp: (JSC::JSValue::dumpInContextAssumingStructure const): (JSC::JSValue::dumpForBacktrace const): * runtime/JSCell.cpp: (JSC::JSCell::toObjectSlow const): * runtime/JSCell.h: (JSC::JSCell::clearStructure): * runtime/JSCellInlines.h: (JSC::JSCell::structure const): (JSC::JSCell::setStructure): * runtime/JSObject.cpp: (JSC::JSObject::visitButterflyImpl): (JSC::JSObject::createInitialUndecided): (JSC::JSObject::createInitialInt32): (JSC::JSObject::createInitialDouble): (JSC::JSObject::createInitialContiguous): (JSC::JSObject::createArrayStorage): (JSC::JSObject::convertUndecidedToArrayStorage): (JSC::JSObject::convertInt32ToArrayStorage): (JSC::JSObject::convertDoubleToArrayStorage): (JSC::JSObject::convertContiguousToArrayStorage): (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition): (JSC::JSObject::putDirectNonIndexAccessorWithoutTransition): * runtime/JSObject.h: (JSC::JSObject::nukeStructureAndSetButterfly): (JSC::JSObject::getPropertySlot): * runtime/JSObjectInlines.h: (JSC::JSObject::getPropertySlot): (JSC::JSObject::getNonIndexPropertySlot): (JSC::JSObject::putDirectWithoutTransition): (JSC::JSObject::putDirectInternal): * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator): (JSC::JSPropertyNameEnumerator::visitChildrenImpl): * runtime/JSPropertyNameEnumerator.h: * runtime/NumberPrototype.cpp: (JSC::toThisNumber): * runtime/ObjectPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::objectPrototypeToString): * runtime/RegExpPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/StringPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/Structure.cpp: (JSC::Structure::Structure): (JSC::Structure::~Structure): (JSC::Structure::flattenDictionaryStructure): (JSC::Structure::dump const): (JSC::Structure::canCachePropertyNameEnumerator const): * runtime/Structure.h: (JSC::Structure::id const): * runtime/StructureChain.cpp: (JSC::StructureChain::visitChildrenImpl): * runtime/StructureID.h: Added. (JSC::StructureID::nuke const): (JSC::StructureID::isNuked const): (JSC::StructureID::decontaminate const): (JSC::StructureID::operator bool const): (JSC::StructureID::operator== const): (JSC::StructureID::operator!= const): (JSC::StructureID::bits const): (JSC::StructureID::StructureID): (JSC::StructureID::isHashTableDeletedValue const): (JSC::StructureID::decode const): (JSC::StructureID::encode): (JSC::StructureIDHash::hash): (JSC::StructureIDHash::equal): * runtime/StructureIDBlob.h: * runtime/StructureIDTable.cpp: Removed. * runtime/StructureIDTable.h: Removed. * runtime/StructureRareDataInlines.h: (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint): * runtime/SymbolPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TypeProfilerLog.cpp: (JSC::TypeProfilerLog::processLogEntries): (JSC::TypeProfilerLog::visit): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: (JSC::VM::getStructure): Deleted. (JSC::VM::tryGetStructure): Deleted. * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateJSCell): * tools/Integrity.cpp: * tools/Integrity.h: * tools/IntegrityInlines.h: (JSC::Integrity::auditStructureID): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyFunction.cpp: (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * wasm/js/WebAssemblyGlobalPrototype.cpp: (JSC::getGlobal): 2021-11-30 Alexey Shvayka Rename "queueTaskToEventLoop" to "queueMicrotaskToEventLoop" https://bugs.webkit.org/show_bug.cgi?id=233639 Reviewed by Mark Lam. This change improves grep-ability and avoids confusion since JSDOMWindowBase's queueMicrotaskToEventLoop() is capable only of scheduling microtasks (hence its signature). ECMA-262 has no notion of macrotasks, and now JSC hasn't as well. No behavior change. * API/JSAPIGlobalObject.cpp: * API/JSAPIGlobalObject.mm: * jsc.cpp: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::queueMicrotask): * runtime/JSGlobalObject.h: 2021-11-30 Saam Barati GetMyArgumentByValOutOfBounds needs to check for negative indices https://bugs.webkit.org/show_bug.cgi?id=232966 Reviewed by Yusuke Suzuki. Negative indices inside of GetMyArgumentByValOutOfBounds would cause us to have the resulting value be undefined, instead of a full blown lookup that properly consults the prototype chain and such. The reason for this is negative indices would show up as "out of bounds", which would lead this node to result in undefined. But negative indices really should be treated as string property names, and can't be treated like normal out of bounds positive integers. This patch makes it so we speculate that we don't see negative indices. If we do see negative indices, we stop performing the transformation inside of arguments elimination so we don't end up in an OSR exit loop. * dfg/DFGArgumentsEliminationPhase.cpp: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal): 2021-11-30 Geza Lore [JSC] Unify most Baseline ops between JSVALUE64 and JSVALUE32_64 https://bugs.webkit.org/show_bug.cgi?id=233424 Reviewed by Yusuke Suzuki. This patch unifies the Baseline JIT implementations of most bytecode ops between the JSVALUE32_64 and JSVALUE64 platforms. There are very few changes to the generated code on JSVALUE64 (and all are fairly trivial, e.g.: removal of redundant moves in the slow path), apart from machine register substitutions. My measurements on x86_64 indicate the patch is performance neutral there (which is what we expect). On ARMv7/Thumb-2 JetStream2 shows a 0.4% improvement. This is due to some of the improved implementations picked up from the JSVALUE64 versions. Also remove various unused code. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchIfBoolean): (JSC::AssemblyHelpers::branchIfNotBoolean): (JSC::AssemblyHelpers::isUndefined): * jit/GPRInfo.h: * jit/JIT.cpp: * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_op_unsigned): (JSC::JIT::emit_compareAndJumpImpl): (JSC::JIT::emit_compareUnsignedAndJumpImpl): (JSC::JIT::emit_compareUnsignedImpl): (JSC::JIT::emit_compareAndJumpSlowImpl): (JSC::JIT::emit_op_inc): (JSC::JIT::emit_op_dec): (JSC::JIT::emit_op_mod): (JSC::JIT::emitBitBinaryOpFastPath): (JSC::JIT::emit_op_bitnot): (JSC::JIT::emitRightShiftFastPath): (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow): (JSC::JIT::emit_op_div): * jit/JITArithmetic32_64.cpp: Removed. * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::emitGetVirtualRegisterPayload): (JSC::JIT::emitPutVirtualRegister): (JSC::JIT::emitJumpSlowCaseIfNotInt): (JSC::JIT::loadCodeBlockConstantPayload): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emit_op_is_empty): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_is_boolean): (JSC::JIT::emit_op_is_number): (JSC::JIT::emit_op_is_big_int): (JSC::JIT::emit_op_is_cell_with_type): (JSC::JIT::emit_op_is_object): (JSC::JIT::emit_op_to_primitive): (JSC::JIT::emit_op_to_property_key): (JSC::JIT::emit_op_not): (JSC::JIT::emit_op_jundefined_or_null): (JSC::JIT::emit_op_jnundefined_or_null): (JSC::JIT::emit_op_jeq_ptr): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_eq): (JSC::JIT::emit_op_neq): (JSC::JIT::compileOpStrictEq): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_string): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_get_parent_scope): (JSC::JIT::emit_op_get_scope): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_check_tdz): (JSC::JIT::emit_op_new_regexp): (JSC::JIT::emit_op_get_rest_length): (JSC::JIT::emit_op_get_prototype_of): * jit/JITOpcodes32_64.cpp: (JSC::JIT::compileOpEqCommon): (JSC::JIT::compileOpEqSlowCommon): (JSC::JIT::emit_op_eq): (JSC::JIT::emit_op_neq): (JSC::JIT::emit_op_jeq): (JSC::JIT::emit_op_jneq): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jeq): (JSC::JIT::emitSlow_op_jneq): (JSC::JIT::compileOpStrictEqCommon): (JSC::JIT::emit_op_stricteq): (JSC::JIT::emit_op_nstricteq): (JSC::JIT::emit_op_jstricteq): (JSC::JIT::emit_op_jnstricteq): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): * jit/JITPropertyAccess.cpp: (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emit_enumerator_has_propertyImpl): (JSC::JIT::emitWriteBarrier): * jit/JSInterfaceJIT.h: (JSC::JSInterfaceJIT::emitLoadJSCell): 2021-11-29 Yusuke Suzuki [JSC] jumpForTypedArrayOutOfBounds should use asAnyInt since it uses isAnyInt https://bugs.webkit.org/show_bug.cgi?id=233610 rdar://85820476 Reviewed by Saam Barati. Since we are using isAnyInt, then we should use asAnyInt. asUInt32 will crash if the value is double AnyInt etc. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): 2021-11-29 Saam Barati FTL's implementation of HasIndexedProperty for InBounds accesses checks the inverse of what it should be checking when exiting by seeing a hole https://bugs.webkit.org/show_bug.cgi?id=233408 Reviewed by Mark Lam. The implementation of an InBounds HasIndexedProperty in FTL, when speculating, we would exit when we did not see a hole, not when we did see a hole. This is the inverse of what we need to do, we should exit when we do see a hole. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-11-29 Yusuke Suzuki [JSC] slice should be aware of TerminationException https://bugs.webkit.org/show_bug.cgi?id=233593 rdar://85823844 Reviewed by Mark Lam. Since termination exception can happen at any time, assertNoException is wrong. * runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-11-29 Yusuke Suzuki [JSC] Add Intl.NumberFormat.formatRangeToParts https://bugs.webkit.org/show_bug.cgi?id=233540 Reviewed by Ross Kirsling. This patch implements Intl.NumberFormat#formatRangeToParts if ICU is 69 or greater. It also cleans up / optimizes existing Intl.NumberFormat#formatToParts implementation. We first collect all fields generated by ICU. And then, flattening nested fields into non-overlapping sequence of parts via flattenFields. * runtime/IntlNumberFormat.cpp: (JSC::flattenFields): (JSC::numberFieldsPracticallyEqual): (JSC::IntlNumberFormat::formatRangeToPartsInternal): (JSC::IntlNumberFormat::formatRangeToParts const): (JSC::IntlNumberFormat::formatToPartsInternal): (JSC::IntlNumberFormat::formatToParts const): * runtime/IntlNumberFormat.h: * runtime/IntlNumberFormatPrototype.cpp: (JSC::IntlNumberFormatPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/IntlRelativeTimeFormat.cpp: (JSC::IntlRelativeTimeFormat::formatToParts const): 2021-11-29 Michael Catanzaro [GTK] 2.35.1 fails to build for Fedora: undefined reference to 'llint_link_call' https://bugs.webkit.org/show_bug.cgi?id=233574 Unreviewed, add missing attributes. * llint/LLIntSlowPaths.h: 2021-11-29 Yusuke Suzuki [JSC] Public Class Field initialization is slow https://bugs.webkit.org/show_bug.cgi?id=232479 Reviewed by Alexey Shvayka. Class public field implementation did not have optimization for initializing class fields: using runtime call to initialize fields instead of IC. This patch leverages put_by_id / put_by_val with direct flag so that we can enable IC. Currently, we are not changing original putDirect semantics since it is out of this patch's scope. We will look into it and probably changing it in a separate patch, but not in this patch. ToT Patched class-fields-classic-constructor-assignments 17.1491+-2.6327 15.0906+-0.6795 might be 1.1364x faster class-fields-public-fields 409.4328+-8.3140 ^ 20.2752+-2.0835 ^ definitely 20.1938x faster class-fields-private-fields 27.2621+-1.3858 25.1810+-3.9873 might be 1.0826x faster * bytecompiler/NodesCodegen.cpp: (JSC::DefineFieldNode::emitBytecode): * runtime/CommonSlowPaths.h: (JSC::CommonSlowPaths::putDirectWithReify): * runtime/JSObject.cpp: (JSC::JSObject::putDirectCustomAccessor): (JSC::JSObject::putDirectNonIndexAccessor): * runtime/JSObject.h: (JSC::JSObject::putDirect): (JSC::JSObject::putDirectRespectingExtensibility): * runtime/JSObjectInlines.h: (JSC::JSObject::putInlineFast): (JSC::JSObject::putDirectInternal): (JSC::JSObject::putOwnDataProperty): (JSC::JSObject::putOwnDataPropertyMayBeIndex): 2021-11-29 Yusuke Suzuki [JSC] private name operation should use RETURN_IF_EXCEPTION https://bugs.webkit.org/show_bug.cgi?id=233577 rdar://85813869 Reviewed by Mark Lam. Because of TerminatedExecutionError, error can be thrown at any time. * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): (JSC::putPrivateNameOptimize): (JSC::putPrivateName): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): 2021-11-29 Yusuke Suzuki [JSC] Move m_incomingPolymorphicCalls out of CodeBlock::JITData https://bugs.webkit.org/show_bug.cgi?id=233415 Reviewed by Mark Lam and Darin Adler. This patch moves m_incomingPolymorphicCalls from CodeBlock::JITData to CodeBlock since it is now used in LLInt too if JIT is enabled. To keep CodeBlock small, this patch shrinks sizeof(SentinelLinkedList). * bytecode/CodeBlock.cpp: (JSC::CodeBlock::linkIncomingPolymorphicCall): (JSC::CodeBlock::unlinkIncomingCalls): * bytecode/CodeBlock.h: 2021-11-29 Yusuke Suzuki [JSC] GetTypedArrayLengthAsInt52 can get Array::Generic ArrayMode https://bugs.webkit.org/show_bug.cgi?id=233571 rdar://85812164 Reviewed by Mark Lam. If speculation is not populated enough, then GetTypedArrayLengthAsInt52 can get Array::Generic. In that case, we should convert it to Array::ForceExit as it is done in GetArrayLength. And blessArrayOperation inserts ForceOSRExit. So GetTypedArrayLengthAsInt52 won't be compiled. * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): 2021-11-29 Zan Dobersek [RISCV64] Populate RISCV64Assembler with instruction-generation methods https://bugs.webkit.org/show_bug.cgi?id=233256 Reviewed by Yusuke Suzuki. Sprinkle RISCV64Assembler class with helper methods for generating the desired instruction values. Immediate types from the RISCV64Instructions namespace are introduced into the class for easier usage here and in the MacroAssemblerRISCV64 class. Instruction-generating methods roughly match the different instruction types in the RISCV64Instructions namespace. A few optimizations are done around floating-point instructions. We can use one base method which expects the desired FP size as a template parameter, and the appropriate RISCV64Instructions type can then be selected based on that size value. Different combinations for FP move and conversion instructions are also grouped behind a single method, with thorough compile-time validation done to prevent generating invalid instructions. A few helper methods intended for masking, sign-extension and zero-extension are also added. The Condition enum is fixed to list only RISCV-viable conditions, with the values ordered so that a simple XOR-by-one of a given value will produce the value of the inverted condition. * assembler/RISCV64Assembler.h: (JSC::RISCV64Assembler::invert): (JSC::RISCV64Assembler::luiInsn): (JSC::RISCV64Assembler::auipcInsn): (JSC::RISCV64Assembler::jalInsn): (JSC::RISCV64Assembler::jalrInsn): (JSC::RISCV64Assembler::beqInsn): (JSC::RISCV64Assembler::bneInsn): (JSC::RISCV64Assembler::bltInsn): (JSC::RISCV64Assembler::bgeInsn): (JSC::RISCV64Assembler::bltuInsn): (JSC::RISCV64Assembler::bgeuInsn): (JSC::RISCV64Assembler::lbInsn): (JSC::RISCV64Assembler::lhInsn): (JSC::RISCV64Assembler::lwInsn): (JSC::RISCV64Assembler::ldInsn): (JSC::RISCV64Assembler::lbuInsn): (JSC::RISCV64Assembler::lhuInsn): (JSC::RISCV64Assembler::lwuInsn): (JSC::RISCV64Assembler::sbInsn): (JSC::RISCV64Assembler::shInsn): (JSC::RISCV64Assembler::swInsn): (JSC::RISCV64Assembler::sdInsn): (JSC::RISCV64Assembler::addiInsn): (JSC::RISCV64Assembler::sltiInsn): (JSC::RISCV64Assembler::sltiuInsn): (JSC::RISCV64Assembler::xoriInsn): (JSC::RISCV64Assembler::oriInsn): (JSC::RISCV64Assembler::andiInsn): (JSC::RISCV64Assembler::slliInsn): (JSC::RISCV64Assembler::srliInsn): (JSC::RISCV64Assembler::sraiInsn): (JSC::RISCV64Assembler::addInsn): (JSC::RISCV64Assembler::subInsn): (JSC::RISCV64Assembler::sllInsn): (JSC::RISCV64Assembler::sltInsn): (JSC::RISCV64Assembler::sltuInsn): (JSC::RISCV64Assembler::xorInsn): (JSC::RISCV64Assembler::srlInsn): (JSC::RISCV64Assembler::sraInsn): (JSC::RISCV64Assembler::orInsn): (JSC::RISCV64Assembler::andInsn): (JSC::RISCV64Assembler::ecallInsn): (JSC::RISCV64Assembler::ebreakInsn): (JSC::RISCV64Assembler::addiwInsn): (JSC::RISCV64Assembler::slliwInsn): (JSC::RISCV64Assembler::srliwInsn): (JSC::RISCV64Assembler::sraiwInsn): (JSC::RISCV64Assembler::addwInsn): (JSC::RISCV64Assembler::subwInsn): (JSC::RISCV64Assembler::sllwInsn): (JSC::RISCV64Assembler::srlwInsn): (JSC::RISCV64Assembler::srawInsn): (JSC::RISCV64Assembler::mulInsn): (JSC::RISCV64Assembler::mulhInsn): (JSC::RISCV64Assembler::mulhsuInsn): (JSC::RISCV64Assembler::mulhuInsn): (JSC::RISCV64Assembler::divInsn): (JSC::RISCV64Assembler::divuInsn): (JSC::RISCV64Assembler::remInsn): (JSC::RISCV64Assembler::remuInsn): (JSC::RISCV64Assembler::mulwInsn): (JSC::RISCV64Assembler::divwInsn): (JSC::RISCV64Assembler::divuwInsn): (JSC::RISCV64Assembler::remwInsn): (JSC::RISCV64Assembler::remuwInsn): (JSC::RISCV64Assembler::flwInsn): (JSC::RISCV64Assembler::fldInsn): (JSC::RISCV64Assembler::fswInsn): (JSC::RISCV64Assembler::fsdInsn): (JSC::RISCV64Assembler::fmaddInsn): (JSC::RISCV64Assembler::fmsubInsn): (JSC::RISCV64Assembler::fnmsubInsn): (JSC::RISCV64Assembler::fnmaddInsn): (JSC::RISCV64Assembler::faddInsn): (JSC::RISCV64Assembler::fsubInsn): (JSC::RISCV64Assembler::fmulInsn): (JSC::RISCV64Assembler::fdivInsn): (JSC::RISCV64Assembler::fsqrtInsn): (JSC::RISCV64Assembler::fsgnjInsn): (JSC::RISCV64Assembler::fsgnjnInsn): (JSC::RISCV64Assembler::fsgnjxInsn): (JSC::RISCV64Assembler::fminInsn): (JSC::RISCV64Assembler::fmaxInsn): (JSC::RISCV64Assembler::feqInsn): (JSC::RISCV64Assembler::fltInsn): (JSC::RISCV64Assembler::fleInsn): (JSC::RISCV64Assembler::fclassInsn): (JSC::RISCV64Assembler::fcvtInsn): (JSC::RISCV64Assembler::fmvInsn): (JSC::RISCV64Assembler::fenceInsn): (JSC::RISCV64Assembler::lrwInsn): (JSC::RISCV64Assembler::scwInsn): (JSC::RISCV64Assembler::lrdInsn): (JSC::RISCV64Assembler::scdInsn): (JSC::RISCV64Assembler::amoswapwInsn): (JSC::RISCV64Assembler::amoaddwInsn): (JSC::RISCV64Assembler::amoxorwInsn): (JSC::RISCV64Assembler::amoandwInsn): (JSC::RISCV64Assembler::amoorwInsn): (JSC::RISCV64Assembler::amoswapdInsn): (JSC::RISCV64Assembler::amoadddInsn): (JSC::RISCV64Assembler::amoxordInsn): (JSC::RISCV64Assembler::amoanddInsn): (JSC::RISCV64Assembler::amoordInsn): (JSC::RISCV64Assembler::nop): (JSC::RISCV64Assembler::maskRegister): (JSC::RISCV64Assembler::signExtend): (JSC::RISCV64Assembler::zeroExtend): (JSC::RISCV64Assembler::insn): (JSC::RISCV64Assembler::insnFP): (JSC::RISCV64Assembler::isValidShiftAmount): 2021-11-29 Myles C. Maxfield [Cocoa] Stop linking JavaScriptCore.framework with libz because it doesn't use any symbols from it https://bugs.webkit.org/show_bug.cgi?id=233550 Reviewed by Anders Carlsson. Every compile produces a message like: Ld /Users/mmaxfield/Build/Products/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore normal (in target 'JavaScriptCore' from project 'JavaScriptCore') ld: warning: linking with (/usr/lib/libz.1.dylib) but not using any symbols from it * JavaScriptCore.xcodeproj/project.pbxproj: 2021-11-26 Adrian Perez de Castro Non-unified build fixes, late November 2021 edition https://bugs.webkit.org/show_bug.cgi?id=233493 Unreviewed non-unified build fixes. * jit/ThunkGenerators.h: Add missing inclusion of CallMode.h header, move header inclusions inside the ENABLE(JIT) guard. 2021-11-24 Zan Dobersek MacroAssembler: remove unused load/store methods for addresses with patchable offsets https://bugs.webkit.org/show_bug.cgi?id=233251 Reviewed by Yusuke Suzuki. Remove MacroAssembler methods for load and store operations on addresses with patchable offset values as they're not used in any place anymore. * assembler/MacroAssembler.h: (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch): Deleted. (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch): Deleted. (JSC::MacroAssembler::storePtrWithAddressOffsetPatch): Deleted. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::load32WithAddressOffsetPatch): Deleted. (JSC::MacroAssemblerARM64::load32WithCompactAddressOffsetPatch): Deleted. (JSC::MacroAssemblerARM64::store32WithAddressOffsetPatch): Deleted. * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::load32WithAddressOffsetPatch): Deleted. (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): Deleted. (JSC::MacroAssemblerARMv7::store32WithAddressOffsetPatch): Deleted. * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch): Deleted. (JSC::MacroAssemblerMIPS::load32WithCompactAddressOffsetPatch): Deleted. (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch): Deleted. * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch): Deleted. (JSC::MacroAssemblerX86Common::load32WithCompactAddressOffsetPatch): Deleted. (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch): Deleted. 2021-11-24 Zan Dobersek [RISCV64] Fix floating-point register listings in FPRInfo.h https://bugs.webkit.org/show_bug.cgi?id=233243 Reviewed by Yusuke Suzuki. As with general-purpose registers, fpRegT0 to fpRegT7 assignments have to match the argument registers. Index-to-FPRReg mapping functions are updated accordingly. * jit/FPRInfo.h: (JSC::FPRInfo::toRegister): (JSC::FPRInfo::toIndex): 2021-11-24 Aditi Singh [JSC] Implement Date.prototype.toTemporalInstant() https://bugs.webkit.org/show_bug.cgi?id=232075 Reviewed by Yusuke Suzuki. * runtime/CommonIdentifiers.h: * runtime/DatePrototype.cpp: (JSC::DatePrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-11-23 Don Olmstead Non-unified build fixes, mid November 2021 edition https://bugs.webkit.org/show_bug.cgi?id=233450 Unreviewed non-unified build fixes. * heap/IsoHeapCellType.h: * jit/ThunkGenerators.h: 2021-11-22 Geza Lore [JSC] Make sharing of unlinked baseline code possible on JSVALUE32_64 https://bugs.webkit.org/show_bug.cgi?id=232624 Reviewed by Yusuke Suzuki. This patch contains a few different changes, which taken together make it possible to share the unlinked baseline JIT code between different CodeBlocks on JSVALUE32_64 platforms. Note that by default, code sharing is disabled on JSVALUE32_64 due to the increased executable memory usage it may cause. The reson the executable memory usage might increase is that the UnlinkedCodeBlock has a longer lifetime than the corresponding linked CodeBlocks (due to the CodeCache I'm told), and when using code sharing, it holds a reference to the JITed code. This then prevents recycling of executable memory while the UnlinkedCodeBlock is live, while without sharing we could have reclaimed some of the executable memory earlier. The high level changes in this pach are: 1. A lot of baseline implementations of the opcodes that needed changing for the unlinked baseline are now unified between the JSVALUE64 and JSVALUE32_64 platforms. Note that while this required adding some abstraction, the code generated by the baseline JIT on JSVALUE64 should be identical using this abstraction compared to before. 2. I added a JSRInfo class which defines standard names for certain JSValueReg instances. This enables a lot of the unification in the point above to be expressed in a very simple manner, with very little transformation of the existing code. Again, this should have no impact on the generated code on JSVALUE64, apart from some register substitutions. 3. The sizes of the resolve_scope and get_from_scope ops increased significantly with the unlinked baseline. This can cause issues on some JSVALUE32_64 targets where memory is more precious, so for these two ops I swapped in the implementations under EXTRA_CTI_THUNKS, which implement these using shared stubs. These stubs work on all platforms that support ENABLE(JIT), so they are now the only implementation and I have removed the basic bloated versions. 4. Removed some unused code and fields I discovered while working on this, strictly speaking this is not necessary for the functional change. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::storeValue): (JSC::AssemblyHelpers::isNull): (JSC::AssemblyHelpers::isNotNull): (JSC::AssemblyHelpers::emitTurnUndefinedIntoNull): (JSC::AssemblyHelpers::noOverlap): (JSC::AssemblyHelpers::noOverlapImpl): (JSC::AssemblyHelpers::noOverlapImplRegMask): * jit/GPRInfo.h: * jit/JIT.cpp: (JSC::JIT::privateCompileSlowCases): (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::link): (JSC::JIT::privateCompileExceptionHandlers): * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_compareAndJumpImpl): (JSC::JIT::emit_compareUnsignedAndJumpImpl): (JSC::JIT::emit_compareUnsignedImpl): (JSC::JIT::emit_op_mod): (JSC::JIT::emit_compareAndJump): (JSC::JIT::emit_compareUnsignedAndJump): (JSC::JIT::emit_compareUnsigned): (JSC::JIT::emit_compareAndJumpSlow): (JSC::JIT::emitBinaryDoubleOp): * jit/JITArithmetic32_64.cpp: (JSC::JIT::emit_op_unsigned): (JSC::JIT::emit_op_inc): (JSC::JIT::emit_op_dec): * jit/JITCall.cpp: (JSC::JIT::emit_op_ret): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileOpCall): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emit_op_iterator_next): * jit/JITInlines.h: (JSC::JIT::getConstantOperand): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile): (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitGetVirtualRegister): (JSC::JIT::emitPutVirtualRegister): (JSC::JIT::emitGetVirtualRegisterPayload): (JSC::JIT::emitGetVirtualRegisterTag): (JSC::JIT::emitLoadDouble): (JSC::loadAddrOfCodeBlockConstantBuffer): (JSC::JIT::loadCodeBlockConstant): (JSC::JIT::loadCodeBlockConstantPayload): (JSC::JIT::loadCodeBlockConstantTag): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_mov): (JSC::JIT::emit_op_end): (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_is_undefined_or_null): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::valueIsFalseyGenerator): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jeq_ptr): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_eq): (JSC::JIT::emit_op_jeq): (JSC::JIT::emit_op_jtrue): (JSC::JIT::valueIsTruthyGenerator): (JSC::JIT::emit_op_neq): (JSC::JIT::emit_op_jneq): (JSC::JIT::emit_op_throw): (JSC::JIT::compileOpStrictEq): (JSC::JIT::compileOpStrictEqJump): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_create_this): (JSC::JIT::emit_op_instanceof_custom): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): (JSC::JIT::emit_op_new_array_with_size): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_prologue): (JSC::JIT::emit_op_log_shadow_chicken_tail): (JSC::JIT::emit_op_get_argument): (JSC::JIT::emit_op_get_prototype_of): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emit_op_is_empty): (JSC::JIT::emit_op_is_boolean): (JSC::JIT::emit_op_is_number): (JSC::JIT::emit_op_is_cell_with_type): (JSC::JIT::emit_op_is_object): (JSC::JIT::emit_op_to_primitive): (JSC::JIT::emit_op_to_property_key): (JSC::JIT::emit_op_not): (JSC::JIT::emit_op_jundefined_or_null): (JSC::JIT::emit_op_jnundefined_or_null): (JSC::JIT::emit_op_jeq_ptr): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_eq): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::emit_op_jeq): (JSC::JIT::compileOpEqJumpSlow): (JSC::JIT::emit_op_neq): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emit_op_jneq): (JSC::JIT::compileOpStrictEq): (JSC::JIT::compileOpStrictEqJump): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_string): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_get_parent_scope): (JSC::JIT::emit_op_enter): (JSC::JIT::emit_op_check_tdz): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::slow_op_resolve_scopeGenerator): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::slow_op_get_from_scopeGenerator): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_put_to_arguments): (JSC::JIT::emit_op_get_internal_field): (JSC::JIT::emit_op_put_internal_field): (JSC::JIT::emit_op_get_property_enumerator): (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emitSlow_op_enumerator_get_by_val): (JSC::JIT::emit_op_enumerator_in_by_val): (JSC::JIT::emit_op_enumerator_has_own_property): (JSC::JIT::emitWriteBarrier): * jit/JITPropertyAccess32_64.cpp: Removed. * jit/JSInterfaceJIT.h: * jit/ThunkGenerators.cpp: (JSC::popThunkStackPreservesAndHandleExceptionGenerator): * jit/ThunkGenerators.h: * runtime/OptionsList.h: 2021-11-20 Yusuke Suzuki [JSC] Move RepatchXXX from jit to bytecode https://bugs.webkit.org/show_bug.cgi?id=233395 Reviewed by Mark Lam. They are also used by non JIT code too. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/Repatch.cpp: Renamed from Source/JavaScriptCore/jit/Repatch.cpp. * bytecode/Repatch.h: Renamed from Source/JavaScriptCore/jit/Repatch.h. * bytecode/RepatchInlines.h: Renamed from Source/JavaScriptCore/jit/RepatchInlines.h. 2021-11-19 Asumu Takikawa Fix WebAssembly memory.fill out of bounds error message https://bugs.webkit.org/show_bug.cgi?id=233392 Reviewed by Yusuke Suzuki. * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::addMemoryFill): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addMemoryFill): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::WASM_SLOW_PATH_DECL): 2021-11-19 Commit Queue Unreviewed, reverting r286030. https://bugs.webkit.org/show_bug.cgi?id=233387 5% JetStream2 regression Reverted changeset: "DFGByteCodeParser.cpp should avoid resizing the Operands<> of every BasicBlock on every inlining" https://bugs.webkit.org/show_bug.cgi?id=228053 https://commits.webkit.org/r286030 2021-11-19 Saam Barati Fix assertion added in r285592 https://bugs.webkit.org/show_bug.cgi?id=233373 rdar://85451012 Reviewed by Keith Miller. The assertion added in r285592 should not apply to Symbols. This patch fixes that error. We don't care if a Symbol can be parsed as an index since the string value in a Symbol is just its description, not the actual property. * dfg/DFGValidate.cpp: 2021-11-19 Joseph Griego [JSC] Shadow realms: set correct Function prototype on wrapped functions https://bugs.webkit.org/show_bug.cgi?id=233143 Reviewed by Yusuke Suzuki. At present, the Function prototype set on each of the returned wrapped functions will be the Function object from the realm the shadow realm builtin is from--to comply with the latest draft of the shadow realms spec [1], wrapped function objects should have the Function prototype from the realm the wrapper object is destined for, instead. At present, this requires tracking both the calling (destination) and target (source) realm and switching between the two as function arguments are wrapped (when the notion of source and destination realm also flips) Adds a simple builtin (moveFunctionToRealm) that can switch the Function prototype given only the Shadow Realm object corresponding to the correct global object. Also marks the corresponding part of test262 as passing. [1] https://tc39.es/proposal-shadowrealm/ sections 2.1, 2.2 * builtins/BuiltinNames.h: * builtins/ShadowRealmPrototype.js: (wrapped): (globalPrivate.wrap): (evaluate): (importValue): (globalPrivate.wrap.wrapped): Deleted. * bytecode/LinkTimeConstant.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): * runtime/ShadowRealmPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmPrototype.h: 2021-11-19 Robin Morisset AirFixObviousSpills should be optimized https://bugs.webkit.org/show_bug.cgi?id=228052 Reviewed by Yusuke Suzuki. There were two problems with AirFixObviousSpills: - merge() had a quadratic blow-up, as for each element in a vector, it was searching it in a different vector. - it would visit blocks even when their state at head had not changed. I fixed the first problem by making sure that the vectors are sorted before calling merge, and making use of that invariant in the search of the vectors (see filterVectorAgainst) This reduced the total time spent in that phase from 390ms to 230ms, and the worst case time spent in that phase for one function from 100ms to 30ms (all of the results in this Changelog are for JetStream2 on a M1 MBP). I fixed the second problem even more easily by adding a m_shouldVisit BitVector. I also moved the m_wasVisited boolean that was in State to a m_notBottom BitVector for simplicity and symmetry. That change further reduced the total/max time from 230ms/30ms to 140ms/16ms. * b3/air/AirFixObviousSpills.cpp: 2021-11-18 Robin Morisset [JSC/Air] Optimize enableMovesOnValueAndAdjacents in IRC https://bugs.webkit.org/show_bug.cgi?id=228615 Reviewed by Saam Barati. The Iterated Register Coalescing (IRC) register allocator spends a very significant fraction of its time in JS2 in enableMovesOnValueAndAdjacents (816ms out of 2.07s spent in register allocation for Wasm code in one run I looked at with Instruments). The reason is that if this function is called on N nodes that are neighbors of each other, then enableMovesOnValue (which is kinda expensive as it iterates a SmallSet which is not always small) will be called N times on each of the N nodes. This can trivially be fixed by keeping track of which nodes need enableMovesOnValue called on them and only calling it on them once. It is a bit tricky to measure the performance impact of this, as it heavily depends on whether some very large functions reach Air or not, so there is a lot of noise. Here are the numbers out of 4 runs of JS2 (cli version) on an M1 MBP with --airForceIRCAllocator=1: Baseline : total time in allocateRegistersByGraphColoring ranges from 2090ms to 3018ms, most time for a single function ranges from 631ms to 849ms With this patch: total time in allocateRegistersByGraphColoring ranges from 1580ms to 2333ms, most time for a single function ranges from 337ms to 560ms So despite the noise it seems quite clearly a win. * b3/air/AirAllocateRegistersByGraphColoring.cpp: 2021-11-18 Mark Lam SubSpace constructors should take a const HeapCellType& instead of a HeapCellType*. https://bugs.webkit.org/show_bug.cgi?id=233341 rdar://85573277 Reviewed by Yusuke Suzuki. This helps document that HeapCellTypes are immutable once they are instantiated, and that SubSpaces won't be modifying them. Also remove the const on CellAttributes return values since it is not needed nor meaningful. * heap/BlockDirectory.h: (JSC::BlockDirectory::attributes const): * heap/CompleteSubspace.cpp: (JSC::CompleteSubspace::CompleteSubspace): * heap/CompleteSubspace.h: * heap/HeapCellType.cpp: (JSC::HeapCellType::finishSweep const): (JSC::HeapCellType::destroy const): (JSC::HeapCellType::finishSweep): Deleted. (JSC::HeapCellType::destroy): Deleted. * heap/HeapCellType.h: (JSC::HeapCellType::attributes const): * heap/IsoHeapCellType.cpp: (JSC::IsoHeapCellType::finishSweep const): (JSC::IsoHeapCellType::destroy const): (JSC::IsoHeapCellType::finishSweep): Deleted. (JSC::IsoHeapCellType::destroy): Deleted. * heap/IsoHeapCellType.h: * heap/IsoInlinedHeapCellType.h: * heap/IsoSubspace.cpp: (JSC::IsoSubspace::IsoSubspace): * heap/IsoSubspace.h: * heap/IsoSubspacePerVM.cpp: (JSC::IsoSubspacePerVM::forVM): * heap/IsoSubspacePerVM.h: * heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::attributes const): (JSC::MarkedBlock::attributes const): * heap/PreciseAllocation.h: (JSC::PreciseAllocation::attributes const): * heap/Subspace.cpp: (JSC::Subspace::initialize): * heap/Subspace.h: (JSC::Subspace::heapCellType const): * heap/SubspaceInlines.h: (JSC::Subspace::attributes const): * runtime/JSDestructibleObjectHeapCellType.cpp: (JSC::JSDestructibleObjectHeapCellType::finishSweep const): (JSC::JSDestructibleObjectHeapCellType::destroy const): (JSC::JSDestructibleObjectHeapCellType::finishSweep): Deleted. (JSC::JSDestructibleObjectHeapCellType::destroy): Deleted. * runtime/JSDestructibleObjectHeapCellType.h: * runtime/VM.cpp: (JSC::VM::VM): 2021-11-18 Mark Lam Rename PropertyMapHashTable.h to PropertyTable.h to match the class. https://bugs.webkit.org/show_bug.cgi?id=233333 rdar://85565760 Reviewed by Yusuke Suzuki. Also renamed some supporting data structures to match. This is just a refactoring patch. There are no behavior changes. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * runtime/PropertyMapHashTable.h: Removed. * runtime/PropertyTable.cpp: * runtime/PropertyTable.h: Copied from Source/JavaScriptCore/runtime/PropertyMapHashTable.h. (JSC::PropertyTable::find): (JSC::PropertyTable::get): (JSC::PropertyTable::add): (JSC::PropertyTable::remove): (JSC::PropertyTable::reinsert): (JSC::PropertyTable::rehash): * runtime/Structure.cpp: (JSC::PropertyTableStatisticsExitLogger::PropertyTableStatisticsExitLogger): (JSC::PropertyTableStatisticsExitLogger::~PropertyTableStatisticsExitLogger): (JSC::PropertyMapStatisticsExitLogger::PropertyMapStatisticsExitLogger): Deleted. (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger): Deleted. * runtime/StructureInlines.h: * runtime/VM.cpp: 2021-11-18 Mark Lam CellAttributes should be returned by value. https://bugs.webkit.org/show_bug.cgi?id=233335 rdar://85568435 Reviewed by Yusuke Suzuki. CellAttributes fits in 16 bits, and client code never modifies returned CellAttributes values. Hence, there is no reason to return them by reference. Also fixed a bit-rotted comment in SubSpace.h. * heap/BlockDirectory.h: (JSC::BlockDirectory::attributes const): * heap/HeapCellType.h: (JSC::HeapCellType::attributes const): * heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::attributes const): (JSC::MarkedBlock::attributes const): * heap/PreciseAllocation.h: (JSC::PreciseAllocation::attributes const): * heap/Subspace.h: * heap/SubspaceInlines.h: (JSC::Subspace::attributes const): 2021-11-18 Robin Morisset DFGByteCodeParser.cpp should avoid resizing the Operands<> of every BasicBlock on every inlining https://bugs.webkit.org/show_bug.cgi?id=228053 Reviewed by Saam Barati. The dfg bytecode parser only makes use of block->variablesAtTail. But currently it updates the size of variablesAtHead, valuesAtHead, valuesAtTail and intersectionOfPastValuesAtHead every single time it changes the number of Tmps and/or Locals. This happens notably whenever it inlines a function. It is not nearly as cheap as it looks, as each resizing may reallocate a Vector, requires filling the new slots with zeros, and requires moving the existing values (which are all 0) to the new Vector. This was obvious when looking at profiling of JS2: bzero + memmove are the two hottest C++ functions, and the manipulation of Operands is partly responsible. This patch fixes this by only resizing block->variablesAtTail during the execution of the bytecode parser, and initializing all of the other operands at the very end of it. It also merges the adjustment of numLocals and of numTmps for variablesAtTail during inlining, to avoid accidentally moving data twice. On JetStream2 on an M1 MBP, it changes the total time spent in the DFGByteCodeParser from 1240-1260ms to 1155-1170ms. * bytecode/Operands.h: (JSC::Operands::ensureLocalsAndTmps): * dfg/DFGBasicBlock.cpp: * dfg/DFGBasicBlock.h: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::ensureLocalsForVariablesAtTail): (JSC::DFG::ByteCodeParser::ensureLocalsAndTmpsForVariablesAtTail): (JSC::DFG::ByteCodeParser::allocateBlock): (JSC::DFG::ByteCodeParser::allocateTargetableBlock): (JSC::DFG::ByteCodeParser::allocateUntargetableBlock): (JSC::DFG::ByteCodeParser::inlineCall): (JSC::DFG::ByteCodeParser::handleVarargsInlining): (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::handlePutById): (JSC::DFG::ByteCodeParser::parse): 2021-11-18 Yusuke Suzuki [JSC] Add branchTest16 operation https://bugs.webkit.org/show_bug.cgi?id=233275 Reviewed by Mark Lam. This patch adds branchTest16 to all macro assemblers. And it also fixes the existing bug of edge case of branchTest8: when we cannot represent the imm as ARM logical value, then we are failing to emit the right instructions. Probably this bug does not appear since we are not using such a value as an imm for branchTest8. We added tests to testmasm so that these code is stressed now. * assembler/MacroAssembler.h: (JSC::MacroAssembler::branchTest16): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::load16SignedExtendTo32): (JSC::MacroAssemblerARM64::branchTest32): (JSC::MacroAssemblerARM64::branchTest8): (JSC::MacroAssemblerARM64::branchTest16): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branchTest16): (JSC::MacroAssemblerARMv7::test32): (JSC::MacroAssemblerARMv7::test8): * assembler/MacroAssemblerHelpers.h: (JSC::MacroAssemblerHelpers::mask16OnCondition): (JSC::MacroAssemblerHelpers::load16OnCondition): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::load16): (JSC::MacroAssemblerMIPS::load16SignedExtendTo32): (JSC::MacroAssemblerMIPS::mask16OnTest): (JSC::MacroAssemblerMIPS::branchTest16): * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::branchTest16): * assembler/MacroAssemblerX86_64.h: (JSC::MacroAssemblerX86_64::branchTest16): * assembler/X86Assembler.h: (JSC::X86Assembler::cmpw_im): (JSC::X86Assembler::testw_im): * assembler/testmasm.cpp: (JSC::testBranchTest8): (JSC::testBranchTest16): 2021-11-18 David Kilzer Add missing dependencies for when generating derived sources Reviewed by Darin Adler. * JavaScriptCore.xcodeproj/project.pbxproj: (Derived Sources : Generate Derived Sources): - Add an input dependency on the script run from the build phase script. * DerivedSources-input.xcfilelist: - Update after changes to DerivedSoures.make. WebKit headers included by are now listed. * DerivedSources.make: (platform_h_compiler_command): Add. (FEATURE_AND_PLATFORM_DEFINES): - Extract compiler command into a call routine for reuse. (PLATFORM_HEADER_DIR): Add. (PLATFORM_HEADER_DEPENDENCIES): Add. (FEATURE_AND_PLATFORM_DEFINE_DEPENDENCIES): - Generate a makefile dependency list for , then filter it to list only WebKit project headers. 2021-11-18 Carlos Garcia Campos [GLIB] jsc_value_object_define_property_accessor() throws an exception when called on a value without a wrapper instance https://bugs.webkit.org/show_bug.cgi?id=233253 Reviewed by Michael Catanzaro. We assumed that getter and setter were always methods, so we always try to set the initial parameter as the instance. When called with a value not having an instance we get an exception because the expected instance is nullptr. This patch changes the behavior of jsc_value_object_define_property_accessor() to call the getter and setter as functions, but keeping the behavior of jsc_class_add_property() in which case they are still called as methods. * API/glib/JSCClass.cpp: (jsc_class_add_property): Use jscValueAddPropertyAccessor(). * API/glib/JSCValue.cpp: (jsObjectCall): Remove useless break after return. (jscValueObjectDefinePropertyAccessor): Helper to define the property accessor using the given function type for the getter and setter. (jsc_value_object_define_property_accessor): Call jscValueObjectDefinePropertyAccessor() with function as function type. (jscValueAddPropertyAccessor): Call jscValueObjectDefinePropertyAccessor() with method as function type. * API/glib/JSCValuePrivate.h: 2021-11-17 Yusuke Suzuki [JSC] TypedArray GetArrayLength should not use Reuse https://bugs.webkit.org/show_bug.cgi?id=233299 rdar://85502079 Reviewed by Robin Morisset. We should not perform OSR exit after assigning a value to a reused register, otherwise, OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform OSR exit after loading a length, so we should not use reused register for length. * dfg/DFGSpeculativeJIT.cpp: 2021-11-17 Saam Barati Run the memmove fast path in JSGenericTypedArrayView::set when using a combination of Uint8 and Uint8Clamped https://bugs.webkit.org/show_bug.cgi?id=233271 Reviewed by Yusuke Suzuki. We have a fast path for running memmove when both the thing being copied from and the thing being copied to have the same typed array type. However, when copying from a Uint8Array into a Uint8ClampedArray, or vice versa, we were going down the slow path. In this case, we can still take the fast path, since we're guaranteed that storing into a Uint8ClampedArray from a Uint8Array will never actually need to clamp values. And when storing from a Uint8ClampedArray into a Uint8Array, the values can trivially be copied over. This patch is a 100x speedup on the attached microbenchmark. * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::set): 2021-11-17 Yusuke Suzuki [JSC] Revise JSON.parse atomize policy https://bugs.webkit.org/show_bug.cgi?id=233231 Reviewed by Mark Lam. This patch improves JSON.parse performance by the following two changes. 1. Introduce JSONAtomStringCache. It is inspired from HTMLAtomStringCache. It offers cheap fixed-sized cache stored in VM. Since it is in VM, we do not need to clear it every time we call JSON.parse. We clear this cache when full GC happens. It contributes to flight-todomvc-json-parse by 5%. 2. Do not atomize long string. Profiling of JSON.parse said that most of time is used for atomizing of Strings. There is a tradeoff that, atomizing strings can reduce duplicate string allocations, but it has a performance penalty. V8 limits atomizing for <= 10 length strings, and SpiderMonkey does not atomize strings. In this patch, we aligned our atomizing policy to V8, so we do not atomize strings if the length is longer than 10. It contributes to flight-todomvc-json-parse by 50%. Many microbenchmarks show the improvement. ToT Patched json-parse-object-reviver-same-value 78.2683+-0.9598 77.7784+-0.9488 vanilla-es2015-babel-webpack-todomvc-json-parse 99.9129+-0.5508 ^ 85.8160+-0.8721 ^ definitely 1.1643x faster json-parse-array-reviver-same-value 63.5891+-0.8066 63.2895+-0.7336 flight-todomvc-json-parse 52.4230+-0.4474 ^ 34.1159+-0.2378 ^ definitely 1.5366x faster json-parse-object-reviver 80.8417+-0.5042 80.6393+-0.8087 json-parse-leaf-object 51.6836+-0.6754 ^ 46.8983+-0.1578 ^ definitely 1.1020x faster vanilla-es2015-todomvc-json-parse 100.5916+-0.9399 ^ 85.9522+-0.8470 ^ definitely 1.1703x faster vanilla-todomvc-json-parse 76.4518+-0.4341 ^ 64.2318+-0.7621 ^ definitely 1.1902x faster json-parse-array-reviver 76.1276+-0.8529 75.9747+-0.9002 And Speedometer2 shows 0.8% improvement. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |109.046667 |108.546667 |0.995415 | 0.197186 | | VueJS-TodoMVC |21.813333 |21.566667 |0.988692 | 0.313141 | | EmberJS-TodoMVC |117.796667 |118.086667 |1.002462 | 0.558244 | | Flight-TodoMVC |64.273333 |62.260000 |0.968675 | 0.000000 (significant) | | BackboneJS-TodoMVC |42.856667 |42.863333 |1.000156 | 0.975025 | | Preact-TodoMVC |16.326667 |16.673333 |1.021233 | 0.298674 | | AngularJS-TodoMVC |123.146667 |122.413333 |0.994045 | 0.160282 | | Inferno-TodoMVC |57.510000 |57.533333 |1.000406 | 0.947767 | | Vanilla-ES2015-TodoMVC |61.133333 |59.200000 |0.968375 | 0.000000 (significant) | | Angular2-TypeScript-TodoMVC |38.863333 |38.963333 |1.002573 | 0.860359 | | VanillaJS-TodoMVC |51.296667 |49.423333 |0.963480 | 0.000000 (significant) | | jQuery-TodoMVC |210.933333 |210.596667 |0.998404 | 0.590132 | | EmberJS-Debug-TodoMVC |326.093333 |324.890000 |0.996310 | 0.156955 | | React-TodoMVC |81.113333 |81.360000 |1.003041 | 0.335615 | | React-Redux-TodoMVC |132.560000 |132.256667 |0.997712 | 0.306072 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |60.073333 |59.026667 |0.982577 | 0.000883 (significant) | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 280.29390 b mean = 282.51413 pValue = 0.0000083325 (Bigger means are better.) 1.008 times better Results ARE significant * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * heap/Heap.cpp: (JSC::Heap::finalize): * runtime/JSONAtomStringCache.h: Added. (JSC::JSONAtomStringCache::makeIdentifier): (JSC::JSONAtomStringCache::clear): (JSC::JSONAtomStringCache::cacheSlot): (JSC::JSONAtomStringCache::cache): * runtime/JSONAtomStringCacheInlines.h: Added. (JSC::JSONAtomStringCache::make): (JSC::JSONAtomStringCache::vm const): * runtime/LiteralParser.cpp: (JSC::LiteralParser::makeIdentifier): (JSC::LiteralParser::makeJSString): (JSC::LiteralParser::parsePrimitiveValue): (JSC::LiteralParser::parse): * runtime/LiteralParser.h: * runtime/VM.h: 2021-11-15 Yusuke Suzuki [JSC] Use operation path when PutByVal child1 is not speculated as a Cell https://bugs.webkit.org/show_bug.cgi?id=233147 rdar://85344310 Reviewed by Mark Lam. r285530 removed non CellUse / non KnownCellUse case incorrectly (when we do not have Cell edge, then we should use the slow operation path). This patch recovers it. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePutByVal): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): 2021-11-14 Yusuke Suzuki [JSC] Use CallLinkInfo in LLInt https://bugs.webkit.org/show_bug.cgi?id=232746 Reviewed by Saam Barati. This patch integrates normal CallLinkInfo into LLInt and remove adhoc LLIntCallLinkInfo. So that we can simplify our IC software stack, and unifying call IC mechanism into one CallLinkInfo. 1. LLInt can fully use our polymorphic call IC, and we no longer need to reset call IC when tiering up from LLInt to Baseline JIT since both now uses the same CallLinkInfo data structure. DFG and FTL can also retrieve call information from this CallLinkInfo. 2. LLInt varargs calls get the same level of optimization to Baseline. Previously it does not have call IC. 3. When JIT is disabled, we disable polymorphic call IC since it requires dynamic code generation. In that case, we only use monomorphic one, which is the same to the old LLIntCallLinkInfo. 4. CallLinkInfo::doneLocation is set up only after Baseline JIT. We adjust call IC code so that we no longer rely on doneLocation when using DataIC. This allows us to smoothly tiering up from LLInt to Baseline JIT while using the same CallLinkInfo. We set up doneLocation in Baseline JIT just because DFG OSR exit requires when exiting to Baseline JIT code. 5. We remove CallLinkInfo from JIT constant pool, and we store CallLinkInfo in metadata so that LLInt and Baseline JIT quickly access to that and keeping unlinked Baseline JIT working. 6. We implement LLInt version of call IC thunks so that we can use them even when JIT is disabled. Speedometer2 is neutral. JetStream2 is 0.7% progressed. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * assembler/CodeLocation.h: * assembler/LinkBuffer.cpp: (JSC::shouldDumpDisassemblyFor): Deleted. * assembler/LinkBuffer.h: * assembler/MacroAssemblerCodeRef.cpp: (JSC::shouldDumpDisassemblyFor): * assembler/MacroAssemblerCodeRef.h: (JSC::MacroAssemblerCodePtr::dumpWithName const): * bytecode/BytecodeList.rb: * bytecode/BytecodeOperandsForCheckpoint.h: (JSC::callLinkInfoFor): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::clearStub): (JSC::CallLinkInfo::setMonomorphicCallee): (JSC::CallLinkInfo::clearCallee): (JSC::CallLinkInfo::visitWeak): (JSC::CallLinkInfo::emitFastPathImpl): (JSC::CallLinkInfo::emitTailCallFastPath): (JSC::CallLinkInfo::emitTailCallDataICFastPath): (JSC::CallLinkInfo::emitSlowPath): (JSC::CallLinkInfo::initializeDataIC): (JSC::CallLinkInfo::emitDirectTailCallFastPath): (JSC::CallLinkInfo::revertCallToStub): * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::isLinked const): (JSC::CallLinkInfo::stub const): (JSC::CallLinkInfo::updateMaxArgumentCountIncludingThis): (JSC::CallLinkInfo::forEachDependentCell const): (JSC::CallLinkInfo::setSlowStub): Deleted. (JSC::CallLinkInfo::clearSlowStub): Deleted. (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted. * bytecode/CallLinkStatus.cpp: (JSC::CallLinkStatus::computeFor): (JSC::CallLinkStatus::computeFromLLInt): Deleted. * bytecode/CallLinkStatus.h: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::finalizeLLIntInlineCaches): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::getICStatusMap): (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): (JSC::CodeBlock::linkIncomingCall): (JSC::CodeBlock::unlinkIncomingCalls): (JSC::CodeBlock::jettison): (JSC::CodeBlock::getArrayProfile): (JSC::CodeBlock::updateAllArrayProfilePredictions): * bytecode/CodeBlock.h: * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachLLIntOrBaselineCallLinkInfo): (JSC::CodeBlock::forEachLLIntCallLinkInfo): Deleted. * bytecode/LLIntCallLinkInfo.h: Removed. * bytecode/Opcode.h: * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: * dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::callerReturnPC): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitVirtualCall): (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject): * jit/AssemblyHelpers.h: * jit/BaselineJITCode.h: * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::createForBaselineOrLLIntTailCall): * jit/CallFrameShuffleData.h: * jit/JIT.cpp: (JSC::JIT::addUnlinkedCallLinkInfo): (JSC::JIT::link): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::emit_op_ret): (JSC::JIT::returnFromBaselineGenerator): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): * jit/JITOpcodes.cpp: (JSC::JIT::op_ret_handlerGenerator): Deleted. * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): (JSC::handleHostCall): Deleted. (JSC::virtualForWithFunction): Deleted. * jit/Repatch.cpp: (JSC::linkSlowPathTo): (JSC::linkSlowFor): (JSC::webAssemblyOwner): (JSC::linkMonomorphicCall): (JSC::revertCall): (JSC::unlinkCall): (JSC::jsToWasmICCodePtr): (JSC::linkVirtualFor): (JSC::linkPolymorphicCall): * jit/Repatch.h: * jit/RepatchInlines.h: Added. (JSC::handleHostCall): (JSC::linkFor): (JSC::virtualForWithFunction): * jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::virtualThunkForRegularConstruct): Deleted. (JSC::virtualThunkForTailConstruct): Deleted. (JSC::virtualThunkForConstructCall): Deleted. * jit/ThunkGenerators.h: * llint/LLIntData.cpp: (JSC::LLInt::initialize): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_link_call): (JSC::LLInt::llint_virtual_call): (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall): (JSC::LLInt::varargsSetup): (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::commonCallEval): (JSC::LLInt::genericCall): Deleted. * llint/LLIntSlowPaths.h: * llint/LLIntThunks.cpp: (JSC::LLInt::createJSGateThunk): (JSC::LLInt::createTailCallGate): (JSC::LLInt::returnLocationThunk): * llint/LLIntThunks.h: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter.cpp: (JSC::CLoopRegister::operator CallLinkInfo*): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/cloop.rb: * offlineasm/instructions.rb: * runtime/ExecutableBase.h: * runtime/FunctionExecutable.h: * runtime/Gate.h: * runtime/VM.cpp: (JSC::VM::getCTILinkCall): (JSC::VM::getCTIThrowExceptionFromCallSlowPath): (JSC::VM::getCTIVirtualCall): * runtime/VM.h: 2021-11-14 Yusuke Suzuki [JSC] Initialize m_usesT2 https://bugs.webkit.org/show_bug.cgi?id=233095 Reviewed by Alexey Shvayka. m_usesT2 is not initialized as "false" correctly. * yarr/YarrJIT.cpp: 2021-11-14 Mikhail R. Gadelha Prevent fused multiply add during ParseInt https://bugs.webkit.org/show_bug.cgi?id=232951 Reviewed by Yusuke Suzuki. When parsing the string in parseInt, gcc can wrongfully generate a fused multiply-add instruction, causing the conversion to be wrong for some high values. An add followed by a multiply gives the correct result and it is the code generated most of the times. This patch adds a volatile qualifier to the number variable, so the compiler doesn't try to optimize it, and enables a failing test on mips. Alternative solutions that I tried but gcc seems to ignore: #pragma STDC FP_CONTRACT OFF, compiling with -ffp-contract=off, and setting function attributes __attribute__((optimize("fp-contract=off"))) and __attribute__((optimize("-ffp-contract=off"))), so volative seems to be a good compromise. The issue was found when cross compiling to mips with gcc 8.4.0 and options -ffp-contract=off -mmadd4. * runtime/ParseInt.h: (JSC::parseInt): 2021-11-12 Darin Adler Make sort-Xcode-project-file idempotent https://bugs.webkit.org/show_bug.cgi?id=233077 Reviewed by Wenson Hsieh. * JavaScriptCore.xcodeproj/project.pbxproj: Sorted. 2021-11-11 Mark Lam Refactor allocateCell() and tryAllocateCell() to take VM& instead of Heap&. https://bugs.webkit.org/show_bug.cgi?id=233028 rdar://85329680 Reviewed by Yusuke Suzuki. allocateCell() and tryAllocateCell() can fetch Heap& from VM& themselves. This allows us to make all the client code more terse, and also makes it easier to redirect the underlying heap to allocate from later for global GC work. Additionally, this will help make the global GC patch less of a mega patch and easier to review later. * API/JSAPIGlobalObject.h: * API/JSAPIValueWrapper.h: * API/JSCallbackConstructor.h: * API/JSCallbackFunction.cpp: (JSC::JSCallbackFunction::create): * API/JSCallbackObject.cpp: (JSC::JSCallbackObject::create): * API/JSCallbackObject.h: * API/ObjCCallbackFunction.mm: (JSC::ObjCCallbackFunction::create): * API/glib/JSAPIWrapperGlobalObject.cpp: (JSC::JSCallbackObject::create): * API/glib/JSCCallbackFunction.cpp: (JSC::JSCCallbackFunction::create): * bytecode/EvalCodeBlock.h: * bytecode/ExecutableToCodeBlockEdge.cpp: (JSC::ExecutableToCodeBlockEdge::create): * bytecode/FunctionCodeBlock.h: * bytecode/ModuleProgramCodeBlock.h: * bytecode/ProgramCodeBlock.h: * bytecode/UnlinkedEvalCodeBlock.h: * bytecode/UnlinkedFunctionCodeBlock.h: * bytecode/UnlinkedFunctionExecutable.h: * bytecode/UnlinkedModuleProgramCodeBlock.h: * bytecode/UnlinkedProgramCodeBlock.h: * debugger/DebuggerScope.cpp: (JSC::DebuggerScope::create): * inspector/JSInjectedScriptHost.h: * inspector/JSInjectedScriptHostPrototype.h: * inspector/JSJavaScriptCallFrame.h: * inspector/JSJavaScriptCallFramePrototype.h: * jsc.cpp: (JSCMemoryFootprint::create): (JSFileDescriptor::create): * runtime/AggregateErrorConstructor.h: * runtime/AggregateErrorPrototype.h: * runtime/ArrayConstructor.h: * runtime/ArrayIteratorPrototype.h: * runtime/ArrayPrototype.cpp: (JSC::ArrayPrototype::create): * runtime/AsyncFromSyncIteratorPrototype.cpp: (JSC::AsyncFromSyncIteratorPrototype::create): * runtime/AsyncFunctionConstructor.h: * runtime/AsyncFunctionPrototype.h: * runtime/AsyncGeneratorFunctionConstructor.h: * runtime/AsyncGeneratorFunctionPrototype.h: * runtime/AsyncGeneratorPrototype.h: * runtime/AsyncIteratorPrototype.h: * runtime/AtomicsObject.cpp: (JSC::AtomicsObject::create): * runtime/BigIntConstructor.h: * runtime/BigIntObject.cpp: (JSC::BigIntObject::create): * runtime/BigIntPrototype.h: * runtime/BooleanConstructor.h: * runtime/BooleanObject.h: (JSC::BooleanObject::create): * runtime/BooleanPrototype.h: * runtime/BrandedStructure.cpp: (JSC::BrandedStructure::create): * runtime/CachedTypes.cpp: (JSC::CachedProgramCodeBlock::decode const): (JSC::CachedModuleCodeBlock::decode const): (JSC::CachedEvalCodeBlock::decode const): (JSC::CachedFunctionCodeBlock::decode const): (JSC::CachedFunctionExecutable::decode const): * runtime/ClonedArguments.cpp: (JSC::ClonedArguments::createEmpty): * runtime/ConsoleObject.h: * runtime/CustomGetterSetter.h: (JSC::CustomGetterSetter::create): * runtime/DOMAttributeGetterSetter.h: * runtime/DateConstructor.h: * runtime/DateInstance.h: * runtime/DatePrototype.h: * runtime/DirectArguments.cpp: (JSC::DirectArguments::createUninitialized): * runtime/DirectEvalExecutable.cpp: (JSC::DirectEvalExecutable::create): * runtime/ErrorConstructor.h: * runtime/ErrorInstance.h: (JSC::ErrorInstance::create): * runtime/ErrorPrototype.h: * runtime/Exception.cpp: (JSC::Exception::create): * runtime/FinalizationRegistryConstructor.h: * runtime/FinalizationRegistryPrototype.h: * runtime/FunctionConstructor.h: * runtime/FunctionExecutable.h: * runtime/FunctionPrototype.h: * runtime/FunctionRareData.cpp: (JSC::FunctionRareData::create): * runtime/GeneratorFunctionConstructor.h: * runtime/GeneratorFunctionPrototype.h: * runtime/GeneratorPrototype.h: * runtime/GetterSetter.h: * runtime/HashMapImpl.h: * runtime/IndirectEvalExecutable.cpp: (JSC::IndirectEvalExecutable::createImpl): * runtime/InternalFunction.cpp: (JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined): * runtime/IntlCollator.cpp: (JSC::IntlCollator::create): * runtime/IntlCollatorConstructor.cpp: (JSC::IntlCollatorConstructor::create): * runtime/IntlCollatorPrototype.cpp: (JSC::IntlCollatorPrototype::create): * runtime/IntlDateTimeFormat.cpp: (JSC::IntlDateTimeFormat::create): * runtime/IntlDateTimeFormatConstructor.cpp: (JSC::IntlDateTimeFormatConstructor::create): * runtime/IntlDateTimeFormatPrototype.cpp: (JSC::IntlDateTimeFormatPrototype::create): * runtime/IntlDisplayNames.cpp: (JSC::IntlDisplayNames::create): * runtime/IntlDisplayNamesConstructor.cpp: (JSC::IntlDisplayNamesConstructor::create): * runtime/IntlDisplayNamesPrototype.cpp: (JSC::IntlDisplayNamesPrototype::create): * runtime/IntlListFormat.cpp: (JSC::IntlListFormat::create): * runtime/IntlListFormatConstructor.cpp: (JSC::IntlListFormatConstructor::create): * runtime/IntlListFormatPrototype.cpp: (JSC::IntlListFormatPrototype::create): * runtime/IntlLocale.cpp: (JSC::IntlLocale::create): * runtime/IntlLocaleConstructor.cpp: (JSC::IntlLocaleConstructor::create): * runtime/IntlLocalePrototype.cpp: (JSC::IntlLocalePrototype::create): * runtime/IntlNumberFormat.cpp: (JSC::IntlNumberFormat::create): * runtime/IntlNumberFormatConstructor.cpp: (JSC::IntlNumberFormatConstructor::create): * runtime/IntlNumberFormatPrototype.cpp: (JSC::IntlNumberFormatPrototype::create): * runtime/IntlObject.cpp: (JSC::IntlObject::create): * runtime/IntlPluralRules.cpp: (JSC::IntlPluralRules::create): * runtime/IntlPluralRulesConstructor.cpp: (JSC::IntlPluralRulesConstructor::create): * runtime/IntlPluralRulesPrototype.cpp: (JSC::IntlPluralRulesPrototype::create): * runtime/IntlRelativeTimeFormat.cpp: (JSC::IntlRelativeTimeFormat::create): * runtime/IntlRelativeTimeFormatConstructor.cpp: (JSC::IntlRelativeTimeFormatConstructor::create): * runtime/IntlRelativeTimeFormatPrototype.cpp: (JSC::IntlRelativeTimeFormatPrototype::create): * runtime/IntlSegmentIterator.cpp: (JSC::IntlSegmentIterator::create): * runtime/IntlSegmentIteratorPrototype.cpp: (JSC::IntlSegmentIteratorPrototype::create): * runtime/IntlSegmenter.cpp: (JSC::IntlSegmenter::create): * runtime/IntlSegmenterConstructor.cpp: (JSC::IntlSegmenterConstructor::create): * runtime/IntlSegmenterPrototype.cpp: (JSC::IntlSegmenterPrototype::create): * runtime/IntlSegments.cpp: (JSC::IntlSegments::create): * runtime/IntlSegmentsPrototype.cpp: (JSC::IntlSegmentsPrototype::create): * runtime/IteratorPrototype.h: * runtime/JSArray.h: (JSC::JSArray::createWithButterfly): * runtime/JSArrayBuffer.cpp: (JSC::JSArrayBuffer::create): * runtime/JSArrayBufferConstructor.h: * runtime/JSArrayBufferPrototype.cpp: (JSC::JSArrayBufferPrototype::create): * runtime/JSArrayIterator.cpp: (JSC::JSArrayIterator::create): (JSC::JSArrayIterator::createWithInitialValues): * runtime/JSAsyncFunction.cpp: (JSC::JSAsyncFunction::createImpl): * runtime/JSAsyncGenerator.cpp: (JSC::JSAsyncGenerator::create): * runtime/JSAsyncGeneratorFunction.cpp: (JSC::JSAsyncGeneratorFunction::createImpl): * runtime/JSBigInt.cpp: (JSC::JSBigInt::createWithLength): * runtime/JSBoundFunction.cpp: (JSC::JSBoundFunction::create): * runtime/JSCallee.h: (JSC::JSCallee::create): * runtime/JSCell.h: * runtime/JSCellInlines.h: (JSC::allocateCell): (JSC::tryAllocateCell): * runtime/JSCustomGetterFunction.cpp: (JSC::JSCustomGetterFunction::create): * runtime/JSCustomSetterFunction.cpp: (JSC::JSCustomSetterFunction::create): * runtime/JSDataView.cpp: (JSC::JSDataView::create): * runtime/JSDataViewPrototype.cpp: (JSC::JSDataViewPrototype::create): * runtime/JSFinalizationRegistry.cpp: (JSC::JSFinalizationRegistry::create): * runtime/JSFunction.cpp: (JSC::JSFunction::create): * runtime/JSFunction.h: (JSC::JSFunction::createImpl): * runtime/JSGenerator.cpp: (JSC::JSGenerator::create): * runtime/JSGeneratorFunction.cpp: (JSC::JSGeneratorFunction::createImpl): * runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::JSGenericTypedArrayViewConstructor::create): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::create): (JSC::JSGenericTypedArrayView::createWithFastVector): (JSC::JSGenericTypedArrayView::createUninitialized): * runtime/JSGenericTypedArrayViewPrototypeInlines.h: (JSC::JSGenericTypedArrayViewPrototype::create): * runtime/JSGlobalLexicalEnvironment.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::create): (JSC::JSGlobalObject::createWithCustomMethodTable): * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::tryCreate): * runtime/JSInternalPromise.cpp: (JSC::JSInternalPromise::create): * runtime/JSInternalPromiseConstructor.cpp: (JSC::JSInternalPromiseConstructor::create): * runtime/JSInternalPromisePrototype.cpp: (JSC::JSInternalPromisePrototype::create): * runtime/JSLexicalEnvironment.h: (JSC::JSLexicalEnvironment::create): * runtime/JSMap.cpp: (JSC::JSMap::clone): * runtime/JSMap.h: * runtime/JSMapIterator.cpp: (JSC::JSMapIterator::createWithInitialValues): * runtime/JSMapIterator.h: * runtime/JSModuleEnvironment.cpp: (JSC::JSModuleEnvironment::create): * runtime/JSModuleLoader.h: * runtime/JSModuleNamespaceObject.h: * runtime/JSModuleRecord.cpp: (JSC::JSModuleRecord::create): * runtime/JSNativeStdFunction.cpp: (JSC::JSNativeStdFunction::create): * runtime/JSONObject.h: * runtime/JSObject.h: (JSC::JSFinalObject::createWithButterfly): * runtime/JSPromise.cpp: (JSC::JSPromise::create): * runtime/JSPromiseConstructor.cpp: (JSC::JSPromiseConstructor::create): * runtime/JSPromisePrototype.cpp: (JSC::JSPromisePrototype::create): * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::create): * runtime/JSProxy.h: (JSC::JSProxy::create): * runtime/JSScriptFetchParameters.h: * runtime/JSScriptFetcher.h: * runtime/JSSet.cpp: (JSC::JSSet::clone): * runtime/JSSet.h: * runtime/JSSetIterator.cpp: (JSC::JSSetIterator::createWithInitialValues): * runtime/JSSetIterator.h: * runtime/JSSourceCode.h: * runtime/JSString.cpp: (JSC::JSString::createEmptyString): (JSC::StringObject::create): * runtime/JSString.h: (JSC::JSString::create): (JSC::JSString::createHasOtherOwner): * runtime/JSStringIterator.h: * runtime/JSTemplateObjectDescriptor.cpp: (JSC::JSTemplateObjectDescriptor::create): * runtime/JSTypedArrayViewConstructor.h: * runtime/JSTypedArrayViewPrototype.cpp: (JSC::JSTypedArrayViewPrototype::create): * runtime/JSWeakMap.h: * runtime/JSWeakObjectRef.h: * runtime/JSWeakSet.h: * runtime/JSWithScope.cpp: (JSC::JSWithScope::create): * runtime/MapConstructor.h: * runtime/MapIteratorPrototype.h: * runtime/MapPrototype.h: * runtime/MathObject.h: * runtime/ModuleProgramExecutable.cpp: (JSC::ModuleProgramExecutable::create): * runtime/NativeErrorConstructor.h: * runtime/NativeErrorPrototype.h: * runtime/NativeExecutable.cpp: (JSC::NativeExecutable::create): * runtime/NullGetterFunction.h: * runtime/NullSetterFunction.h: * runtime/NumberConstructor.h: * runtime/NumberObject.h: (JSC::NumberObject::create): * runtime/NumberPrototype.h: * runtime/ObjectConstructor.h: * runtime/ObjectPrototype.cpp: (JSC::ObjectPrototype::create): * runtime/ProgramExecutable.h: * runtime/PropertyTable.cpp: (JSC::PropertyTable::create): (JSC::PropertyTable::clone): * runtime/ProxyConstructor.cpp: (JSC::ProxyConstructor::create): * runtime/ProxyObject.h: * runtime/ProxyRevoke.cpp: (JSC::ProxyRevoke::create): * runtime/ReflectObject.h: * runtime/RegExp.cpp: (JSC::RegExp::createWithoutCaching): * runtime/RegExpConstructor.h: * runtime/RegExpObject.h: * runtime/RegExpPrototype.h: * runtime/RegExpStringIteratorPrototype.h: * runtime/ScopedArguments.cpp: (JSC::ScopedArguments::createUninitialized): * runtime/ScopedArgumentsTable.cpp: (JSC::ScopedArgumentsTable::create): (JSC::ScopedArgumentsTable::tryCreate): * runtime/SetConstructor.h: * runtime/SetIteratorPrototype.h: * runtime/SetPrototype.h: * runtime/ShadowRealmConstructor.h: * runtime/ShadowRealmObject.cpp: (JSC::ShadowRealmObject::create): * runtime/ShadowRealmPrototype.h: * runtime/SparseArrayValueMap.cpp: (JSC::SparseArrayValueMap::create): * runtime/StrictEvalActivation.h: * runtime/StringConstructor.h: * runtime/StringIteratorPrototype.h: * runtime/StringObject.h: (JSC::StringObject::create): * runtime/StringPrototype.cpp: (JSC::StringPrototype::create): * runtime/StructureChain.cpp: (JSC::StructureChain::create): * runtime/StructureInlines.h: (JSC::Structure::create): (JSC::Structure::createStructure): * runtime/StructureRareData.cpp: (JSC::StructureRareData::create): * runtime/Symbol.cpp: (JSC::SymbolObject::create): (JSC::Symbol::create): (JSC::Symbol::createWithDescription): * runtime/SymbolConstructor.h: * runtime/SymbolObject.h: * runtime/SymbolPrototype.h: * runtime/SymbolTable.h: * runtime/TemporalCalendar.cpp: (JSC::TemporalCalendar::create): * runtime/TemporalCalendarConstructor.cpp: (JSC::TemporalCalendarConstructor::create): * runtime/TemporalCalendarPrototype.cpp: (JSC::TemporalCalendarPrototype::create): * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::create): * runtime/TemporalDurationConstructor.cpp: (JSC::TemporalDurationConstructor::create): * runtime/TemporalDurationPrototype.cpp: (JSC::TemporalDurationPrototype::create): * runtime/TemporalInstant.cpp: (JSC::TemporalInstant::create): * runtime/TemporalInstantConstructor.cpp: (JSC::TemporalInstantConstructor::create): * runtime/TemporalInstantPrototype.cpp: (JSC::TemporalInstantPrototype::create): * runtime/TemporalNow.cpp: (JSC::TemporalNow::create): * runtime/TemporalObject.cpp: (JSC::TemporalObject::create): * runtime/TemporalPlainTime.cpp: (JSC::TemporalPlainTime::create): * runtime/TemporalPlainTimeConstructor.cpp: (JSC::TemporalPlainTimeConstructor::create): * runtime/TemporalPlainTimePrototype.cpp: (JSC::TemporalPlainTimePrototype::create): * runtime/TemporalTimeZone.cpp: (JSC::TemporalTimeZone::createFromID): (JSC::TemporalTimeZone::createFromUTCOffset): * runtime/TemporalTimeZoneConstructor.cpp: (JSC::TemporalTimeZoneConstructor::create): * runtime/TemporalTimeZonePrototype.cpp: (JSC::TemporalTimeZonePrototype::create): * runtime/WeakMapConstructor.h: * runtime/WeakMapPrototype.h: * runtime/WeakObjectRefConstructor.h: * runtime/WeakObjectRefPrototype.h: * runtime/WeakSetConstructor.h: * runtime/WeakSetPrototype.h: * testRegExp.cpp: * tools/JSDollarVM.cpp: * tools/JSDollarVM.h: * wasm/js/JSToWasmICCallee.cpp: (JSC::JSToWasmICCallee::create): * wasm/js/JSWebAssembly.cpp: (JSC::JSWebAssembly::create): * wasm/js/JSWebAssemblyCodeBlock.cpp: (JSC::JSWebAssemblyCodeBlock::create): * wasm/js/JSWebAssemblyException.h: * wasm/js/JSWebAssemblyGlobal.cpp: (JSC::JSWebAssemblyGlobal::tryCreate): * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::tryCreate): * wasm/js/JSWebAssemblyMemory.cpp: (JSC::JSWebAssemblyMemory::tryCreate): * wasm/js/JSWebAssemblyModule.cpp: (JSC::JSWebAssemblyModule::createStub): * wasm/js/JSWebAssemblyTable.cpp: (JSC::JSWebAssemblyTable::tryCreate): * wasm/js/JSWebAssemblyTag.cpp: (JSC::JSWebAssemblyTag::create): * wasm/js/WebAssemblyCompileErrorConstructor.cpp: (JSC::WebAssemblyCompileErrorConstructor::create): * wasm/js/WebAssemblyCompileErrorPrototype.cpp: (JSC::WebAssemblyCompileErrorPrototype::create): * wasm/js/WebAssemblyExceptionConstructor.cpp: (JSC::WebAssemblyExceptionConstructor::create): * wasm/js/WebAssemblyExceptionPrototype.cpp: (JSC::WebAssemblyExceptionPrototype::create): * wasm/js/WebAssemblyFunction.cpp: (JSC::WebAssemblyFunction::create): * wasm/js/WebAssemblyGlobalConstructor.cpp: (JSC::WebAssemblyGlobalConstructor::create): * wasm/js/WebAssemblyGlobalPrototype.cpp: (JSC::WebAssemblyGlobalPrototype::create): * wasm/js/WebAssemblyInstanceConstructor.cpp: (JSC::WebAssemblyInstanceConstructor::create): * wasm/js/WebAssemblyInstancePrototype.cpp: (JSC::WebAssemblyInstancePrototype::create): * wasm/js/WebAssemblyLinkErrorConstructor.cpp: (JSC::WebAssemblyLinkErrorConstructor::create): * wasm/js/WebAssemblyLinkErrorPrototype.cpp: (JSC::WebAssemblyLinkErrorPrototype::create): * wasm/js/WebAssemblyMemoryConstructor.cpp: (JSC::WebAssemblyMemoryConstructor::create): * wasm/js/WebAssemblyMemoryPrototype.cpp: (JSC::WebAssemblyMemoryPrototype::create): * wasm/js/WebAssemblyModuleConstructor.cpp: (JSC::WebAssemblyModuleConstructor::create): * wasm/js/WebAssemblyModulePrototype.cpp: (JSC::WebAssemblyModulePrototype::create): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::create): * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp: (JSC::WebAssemblyRuntimeErrorConstructor::create): * wasm/js/WebAssemblyRuntimeErrorPrototype.cpp: (JSC::WebAssemblyRuntimeErrorPrototype::create): * wasm/js/WebAssemblyTableConstructor.cpp: (JSC::WebAssemblyTableConstructor::create): * wasm/js/WebAssemblyTablePrototype.cpp: (JSC::WebAssemblyTablePrototype::create): * wasm/js/WebAssemblyTagConstructor.cpp: (JSC::WebAssemblyTagConstructor::create): * wasm/js/WebAssemblyTagPrototype.cpp: (JSC::WebAssemblyTagPrototype::create): * wasm/js/WebAssemblyWrapperFunction.cpp: (JSC::WebAssemblyWrapperFunction::create): 2021-11-12 Adrian Perez de Castro Non-unified build fixes, early November 2021 edition, bis x2 Unreviewed non-unified build fixes. * jit/JITWorklist.cpp: Add missing DeferGCInlines.h header. 2021-11-11 Mark Lam Add VM::writeBarrier() and VM::mutatorFence(). https://bugs.webkit.org/show_bug.cgi?id=233019 rdar://85318693 Reviewed by Saam Barati. These are ALWAYS_INLINE functions that will forward the call to the Heap versions. Adding these allows us to make all the client code more terse, and also makes it easier to redirect the underlying writeBarrier implementation later for global GC work. Additionally, this will help make the global GC patch less of a mega patch and easier to review later. Also remove unused Heap::writeBarrierWithoutFence(). This is a refactoring patch. There is no behavior change. * bytecode/LLIntCallLinkInfo.h: (JSC::LLIntCallLinkInfo::link): * bytecode/ObjectPropertyCondition.h: (JSC::ObjectPropertyCondition::presence): (JSC::ObjectPropertyCondition::absence): (JSC::ObjectPropertyCondition::absenceOfSetEffect): (JSC::ObjectPropertyCondition::equivalence): (JSC::ObjectPropertyCondition::hasStaticProperty): (JSC::ObjectPropertyCondition::hasPrototype): * bytecode/PropertyCondition.h: (JSC::PropertyCondition::absence): (JSC::PropertyCondition::absenceOfSetEffect): (JSC::PropertyCondition::equivalence): (JSC::PropertyCondition::hasPrototype): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::considerCaching): * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): * bytecode/UnlinkedFunctionExecutable.cpp: (JSC::UnlinkedFunctionExecutable::decodeCachedCodeBlocks): * dfg/DFGJITFinalizer.cpp: (JSC::DFG::JITFinalizer::finalize): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::finalize): * ftl/FTLJITFinalizer.cpp: (JSC::FTL::JITFinalizer::finalize): * heap/Heap.h: * heap/HeapInlines.h: (JSC::Heap::writeBarrierWithoutFence): Deleted. * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::setupGetByIdPrototypeCache): (JSC::LLInt::performLLIntGetByID): (JSC::LLInt::llint_write_barrier_slow): * runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/AuxiliaryBarrierInlines.h: (JSC::AuxiliaryBarrier::AuxiliaryBarrier): (JSC::AuxiliaryBarrier::set): * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/ErrorInstance.cpp: (JSC::ErrorInstance::finishCreation): * runtime/InferredValue.h: (JSC::InferredValue::InferredValueWatchpointSet::notifyWriteSlow): (JSC::InferredValue::notifyWriteSlow): * runtime/JSArray.cpp: (JSC::JSArray::appendMemcpy): (JSC::JSArray::shiftCountWithAnyIndexingType): (JSC::JSArray::unshiftCountWithAnyIndexingType): * runtime/JSArrayInlines.h: (JSC::JSArray::pushInline): * runtime/JSCellInlines.h: (JSC::JSCell::finishCreation): (JSC::JSCell::setStructure): * runtime/JSFinalizationRegistry.cpp: (JSC::JSFinalizationRegistry::registerTarget): * runtime/JSFunction.cpp: (JSC::JSFunction::allocateRareData): (JSC::JSFunction::allocateAndInitializeRareData): * runtime/JSObject.cpp: (JSC::JSObject::putByIndex): * runtime/JSObject.h: (JSC::JSObject::trySetIndexQuickly): (JSC::JSObject::setIndexQuickly): * runtime/JSWeakObjectRef.h: * runtime/LazyPropertyInlines.h: (JSC::ElementType>::setMayBeNull): * runtime/ObjectInitializationScope.cpp: (JSC::ObjectInitializationScope::~ObjectInitializationScope): * runtime/ObjectInitializationScope.h: (JSC::ObjectInitializationScope::~ObjectInitializationScope): * runtime/RegExpCachedResult.cpp: (JSC::RegExpCachedResult::lastResult): * runtime/RegExpCachedResult.h: (JSC::RegExpCachedResult::record): * runtime/RegExpObject.h: * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::installCode): * runtime/Structure.cpp: (JSC::Structure::flattenDictionaryStructure): * runtime/StructureChain.cpp: (JSC::StructureChain::finishCreation): * runtime/StructureRareDataInlines.h: (JSC::StructureRareData::setCachedPropertyNameEnumerator): * runtime/VM.h: (JSC::VM::writeBarrier): (JSC::VM::writeBarrierSlowPath): (JSC::VM::mutatorFence): * runtime/WriteBarrierInlines.h: (JSC::Traits>::setEarlyValue): (JSC::RawValueTraits>::set): * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/js/JSWebAssemblyInstance.h: 2021-11-11 Mark Lam Disable JIT runs of the ExecutionTimeLimitTest when !ENABLE(JIT). https://bugs.webkit.org/show_bug.cgi?id=233003 Reviewed by Yusuke Suzuki. * API/tests/ExecutionTimeLimitTest.cpp: (testExecutionTimeLimit): 2021-11-11 Adrian Perez de Castro Non-unified build fixes, early November 2021 edition, bis https://bugs.webkit.org/show_bug.cgi?id=232998 Unreviewed non-unified build fixes. * interpreter/Interpreter.cpp: Add missing JSWebAssemblyInstance.h header. * jit/JITInlineCacheGenerator.cpp: Remove unneeded JIT.h, as it is already included transitively by JITInlines.h instead. * llint/LLIntExceptions.cpp: Replace inclusion of WasmContext.h with WasmContextInlines.h * wasm/WasmStreamingCompiler.cpp: Add missing JSBigInt.h header. * wasm/js/JSWebAssemblyException.cpp: Add missing AuxiliaryBarrierInlines.h, JSBigInt.h, JSCJSValueInlines.h and JSCellInlines.h * wasm/js/JSWebAssemblyException.h: Add missing JSObject.h header. * wasm/js/JSWebAssemblyTag.cpp: Add missing JSCellInlines.h, JSObjectInlines.h, and StructureInlines.h headers. * wasm/js/JSWebAssemblyTag.h: Add missing JSObject.h header. * wasm/js/WebAssemblyExceptionConstructor.cpp: Add missing JSWebAssemblyTag.h header. * wasm/js/WebAssemblyExceptionPrototype.cpp: Add missing headers JSWebAssemblyException.h and JSWebAssemblyTag.h * wasm/js/WebAssemblyTagPrototype.cpp: Add missing headers JSCellInlines.h, JSObjectInlines.h, JSWebAssemblyTag.h, and StructureInlines.h 2021-11-11 Mark Lam Rename Heap::isCurrentThreadBusy() to Heap::currentThreadIsDoingGCWork(). https://bugs.webkit.org/show_bug.cgi?id=233005 rdar://85307204 Reviewed by Saam Barati. This rename clarifies what the "busy" part is about. Also remove some unused code: Heap::isValidAllocation(), isValidThreadState(), and isValidSharedInstanceThreadState(). * bytecode/CodeBlock.cpp: (JSC::CodeBlock::jettison): * heap/Heap.cpp: (JSC::Heap::currentThreadIsDoingGCWork): (JSC::Heap::isValidAllocation): Deleted. (JSC::Heap::isCurrentThreadBusy): Deleted. * heap/Heap.h: * jsc.cpp: (jscmain): * runtime/VM.h: (JSC::VM::isCollectorBusyOnCurrentThread): 2021-11-11 Michael Saboff Inline RegExp.test JIT code in DFG and FTL https://bugs.webkit.org/show_bug.cgi?id=230469 Reviewed by Saam Barati. Restructured YarrJIT from inheriting from MacroAssembler to having a MacroAssembler member. Added a new path to Yarr JIT code to compile inline code by changing how the code is entered and exited. Added statistic to the normal compilation path to record the size of the matching code generated, the amount of stack space needed, and if the code can be inlined. This patch only inlines 8bit code, as this seems to cover the most common performance sensitive cases. Adding 16 bit, non-Unicode inlining would be straightforward. The code is structured to take the inlined path for the case of non-rope string arguments. For other cases, we fall back to calling out to C++ paths. Here are the perf results running the newly added regexp-test-inlined micro benchmark (time in msec): Baseline With this patch Result ARM64 137.3849+-3.0740 64.9282+-0.7348 2.12x faster X86-64 220.2616+-19.2814 105.2034+-6.8722 2.09x faster As part of this change, found that the strength reduction didn't work properly for the existing cases for RegExpExec, RegExpTest and related since we added that checks for overriding the RegExp object. Clobberize for tryGetById was clobber top, but added an exception for RegExp.lastIndex. This fix allowed many of the strength reductions cases to start working again, namely the costant folding cases. * JavaScriptCore.xcodeproj/project.pbxproj: * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGCommonData.h: * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGNode.cpp: (JSC::DFG::Node::convertToRegExpTestInline): * dfg/DFGNode.h: (JSC::DFG::Node::hasHeapPrediction): (JSC::DFG::Node::hasCellOperand): (JSC::DFG::Node::hasCellOperand2): (JSC::DFG::Node::cellOperand2): * dfg/DFGNodeType.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileRegExpTestInline): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGStrengthReductionPhase.cpp: (JSC::DFG::StrengthReductionPhase::handleNode): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * runtime/OptionsList.h: * runtime/RegExp.h: * runtime/StackAlignment.h: (JSC::argumentCountForStackSize): * yarr/YarrJIT.cpp: (JSC::Yarr::jitCompile): (JSC::Yarr::jitCompileInlinedTest): * yarr/YarrJIT.h: (JSC::Yarr::YarrBoyerMoyerData::saveMaps): (JSC::Yarr::YarrBoyerMoyerData::clearMaps): (JSC::Yarr::YarrBoyerMoyerData::tryReuseBoyerMooreBitmap const): (JSC::Yarr::YarrCodeBlock::InlineStats::InlineStats): (JSC::Yarr::YarrCodeBlock::InlineStats::set): (JSC::Yarr::YarrCodeBlock::InlineStats::clear): (JSC::Yarr::YarrCodeBlock::InlineStats::codeSize const): (JSC::Yarr::YarrCodeBlock::InlineStats::stackSize const): (JSC::Yarr::YarrCodeBlock::InlineStats::canInline const): (JSC::Yarr::YarrCodeBlock::InlineStats::needsTemp2 const): (JSC::Yarr::YarrCodeBlock::set8BitCode): (JSC::Yarr::YarrCodeBlock::set16BitCode): (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::set8BitInlineStats): (JSC::Yarr::YarrCodeBlock::set16BitInlineStats): (JSC::Yarr::YarrCodeBlock::get8BitInlineStats): (JSC::Yarr::YarrCodeBlock::get16BitInlineStats): (JSC::Yarr::YarrCodeBlock::clear): (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreBitmap const): Deleted. * yarr/YarrJITRegisters.h: Added. (JSC::Yarr::YarrJITRegisters::YarrJITRegisters): 2021-11-10 Mark Lam Move m_doesGC from Heap to VM. https://bugs.webkit.org/show_bug.cgi?id=232975 rdar://85277492 Reviewed by Filip Pizlo. m_doesGC is only needed for ENABLE(DFG_DOES_GC_VALIDATION), and is used for checking if the VM thread's execution is in a state that can allow GC to run. Hence, it is more related to VM thread execution as opposed to the state of the Heap. This patch moves m_doesGC from Heap to VM to get it out of the way of upcoming Global GC work. Also change DeferGC, DeferGCForAWhile, and GCDeferralContext to take a VM& instead of a Heap&. DeferGC and GCDeferralContext need to access VM& in order to call VM::verifyCanGC(). DeferGCForAWhile does not need VM&, but we're changing it to be consistent with DeferGC. There should be no perf impact for this change. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::jettison): * bytecode/UnlinkedFunctionExecutable.cpp: (JSC::UnlinkedFunctionExecutable::decodeCachedCodeBlocks): * bytecode/Watchpoint.cpp: (JSC::WatchpointSet::fireAllWatchpoints): * bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::generate): * dfg/DFGDoesGCCheck.cpp: * dfg/DFGOSRExit.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): (JSC::DFG::OSRExit::compileExit): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileLoopHint): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * heap/CompleteSubspace.cpp: (JSC::CompleteSubspace::tryAllocateSlow): (JSC::CompleteSubspace::reallocatePreciseAllocationNonVirtual): * heap/CompleteSubspaceInlines.h: (JSC::CompleteSubspace::allocateNonVirtual): * heap/DeferGC.h: (JSC::DeferGC::DeferGC): Deleted. (JSC::DeferGC::~DeferGC): Deleted. (JSC::DeferGCForAWhile::DeferGCForAWhile): Deleted. (JSC::DeferGCForAWhile::~DeferGCForAWhile): Deleted. * heap/DeferGCInlines.h: Added. (JSC::DeferGC::DeferGC): (JSC::DeferGC::~DeferGC): (JSC::DeferGCForAWhile::DeferGCForAWhile): (JSC::DeferGCForAWhile::~DeferGCForAWhile): * heap/GCDeferralContext.h: * heap/GCDeferralContextInlines.h: (JSC::GCDeferralContext::GCDeferralContext): (JSC::GCDeferralContext::~GCDeferralContext): * heap/Heap.cpp: (JSC::Heap::collectNow): (JSC::Heap::collectAsync): (JSC::Heap::collectSync): (JSC::Heap::stopIfNecessarySlow): (JSC::Heap::collectIfNecessaryOrDefer): * heap/Heap.h: (JSC::Heap::addressOfDoesGC): Deleted. (JSC::Heap::setDoesGCExpectation): Deleted. (JSC::Heap::verifyCanGC): Deleted. * heap/HeapInlines.h: (JSC::Heap::acquireAccess): (JSC::Heap::stopIfNecessary): * heap/HeapSnapshotBuilder.cpp: (JSC::HeapSnapshotBuilder::json): * heap/IncrementalSweeper.cpp: (JSC::IncrementalSweeper::sweepNextBlock): * heap/LocalAllocatorInlines.h: (JSC::LocalAllocator::allocate): * heap/PreciseAllocation.cpp: (JSC::PreciseAllocation::tryCreate): (JSC::PreciseAllocation::createForLowerTier): * inspector/JSInjectedScriptHost.cpp: (Inspector::JSInjectedScriptHost::queryHolders): * inspector/agents/InspectorHeapAgent.cpp: (Inspector::InspectorHeapAgent::getPreview): (Inspector::InspectorHeapAgent::getRemoteObject): * inspector/agents/InspectorScriptProfilerAgent.cpp: (Inspector::InspectorScriptProfilerAgent::trackingComplete): * interpreter/ShadowChickenInlines.h: (JSC::ShadowChicken::iterate): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITWorklist.cpp: (JSC::JITWorklist::completeAllReadyPlansForVM): (JSC::JITWorklist::waitUntilAllPlansForVMAreReady): (JSC::JITWorklist::completeAllPlansForVM): (JSC::JITWorklist::removeAllReadyPlansForVM): * jit/Repatch.cpp: (JSC::fireWatchpointsAndClearStubIfNeeded): (JSC::tryCacheGetBy): (JSC::tryCacheArrayGetByVal): (JSC::tryCachePutBy): (JSC::tryCacheArrayPutByVal): (JSC::tryCacheDeleteBy): (JSC::tryCacheInBy): (JSC::tryCacheHasPrivateBrand): (JSC::tryCacheCheckPrivateBrand): (JSC::tryCacheSetPrivateBrand): (JSC::tryCacheInstanceOf): (JSC::linkPolymorphicCall): * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * runtime/CachedTypes.cpp: (JSC::decodeCodeBlockImpl): * runtime/ConcurrentJSLock.h: (JSC::GCSafeConcurrentJSLocker::GCSafeConcurrentJSLocker): * runtime/ExceptionFuzz.cpp: (JSC::doExceptionFuzzing): * runtime/JSArray.cpp: (JSC::JSArray::unshiftCountWithArrayStorage): * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::slowDownAndWasteMemory): * runtime/JSCellInlines.h: * runtime/JSGenericTypedArrayViewInlines.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::haveABadTime): * runtime/JSObject.cpp: (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): (JSC::JSObject::createInitialUndecided): (JSC::JSObject::createInitialInt32): (JSC::JSObject::createInitialDouble): (JSC::JSObject::createInitialContiguous): (JSC::JSObject::createArrayStorage): (JSC::JSObject::convertUndecidedToArrayStorage): (JSC::JSObject::convertInt32ToArrayStorage): (JSC::JSObject::convertDoubleToArrayStorage): (JSC::JSObject::convertContiguousToArrayStorage): (JSC::JSObject::increaseVectorLength): (JSC::JSObject::ensureLengthSlow): (JSC::JSObject::reallocateAndShrinkButterfly): (JSC::createCustomGetterFunction): (JSC::createCustomSetterFunction): * runtime/JSString.h: (JSC::jsSingleCharacterString): (JSC::JSString::toAtomString const): (JSC::JSString::toExistingAtomString const): (JSC::JSString::value const): (JSC::JSString::tryGetValue const): (JSC::JSRopeString::unsafeView const): (JSC::JSRopeString::viewWithUnderlyingString const): (JSC::JSString::unsafeView const): * runtime/JSSymbolTableObject.h: (JSC::symbolTablePut): * runtime/RegExpKey.h: * runtime/RegExpMatchesArray.cpp: (JSC::createEmptyRegExpMatchesArray): * runtime/RegExpMatchesArray.h: (JSC::createRegExpMatchesArray): * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::stackTracesAsJSON): (JSC::SamplingProfiler::reportTopFunctions): (JSC::SamplingProfiler::reportTopBytecodes): * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::prepareForExecutionImpl): * runtime/Structure.cpp: (JSC::Structure::materializePropertyTable): (JSC::Structure::addNewPropertyTransition): (JSC::Structure::removeNewPropertyTransition): (JSC::Structure::changePrototypeTransition): (JSC::Structure::attributeChangeTransition): (JSC::Structure::toDictionaryTransition): (JSC::Structure::nonPropertyTransitionSlow): (JSC::Structure::flattenDictionaryStructure): * runtime/StructureInlines.h: (JSC::Structure::add): (JSC::Structure::remove): (JSC::Structure::attributeChange): * runtime/VM.h: (JSC::VM::addressOfDoesGC): (JSC::VM::setDoesGCExpectation): (JSC::VM::verifyCanGC): 2021-11-10 Saam Barati in_by_val should not constant fold to in_by_id when the property is a property index https://bugs.webkit.org/show_bug.cgi?id=232753 Reviewed by Yusuke Suzuki. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGValidate.cpp: 2021-11-09 Commit Queue Unreviewed, reverting r285246. https://bugs.webkit.org/show_bug.cgi?id=232907 Broke FixedVector Reverted changeset: "[JSC] Clean up StructureStubInfo initialization" https://bugs.webkit.org/show_bug.cgi?id=232652 https://commits.webkit.org/r285246 2021-11-09 Robin Morisset Using WASM function size as the cap for choosing a register allocator causes performance regressions. https://bugs.webkit.org/show_bug.cgi?id=217290 Reviewed by Yusuke Suzuki. This patch just increases --maximumTmpsForGraphColoring from 25k to 60k. It was originally lowered to prevent jetsams in some wasm webpages such as mruby-wasm.aotoki.dev. These jetsams were caused by excessive memory consumption by the interference graphs used by AirAllocateRegistersByGraphColoring and AirAllocateStackByGraphColoring. I massively optimized these interference graphs in the following two patches (effect on mruby-wasm.aotoki.dev): - https://trac.webkit.org/changeset/277714/webkit (262MB + 262MB -> 20MB + 10MB in register allocator) - https://trac.webkit.org/changeset/278186/webkit (221MB + 399MB -> 6.5MB + 10.5MB in stack slot allocator) So it should now be safe to increase --maximumTmpsForGraphColoring. It is valuable to increase it, because some webpages such as https://dos.zone/en/play/https%3A%2F%2Fdoszone-uploads.s3.dualstack.eu-central-1.amazonaws.com%2Foriginal%2F2X%2Fb%2Fb4b5275904d86a4ab8a20917b2b7e34f0df47bf7.jsdos see massive performance wins/losses depending on whether we register allocate all of their wasm functions or not. For example that page has two functions with ~54k temporaries, and its integrated benchmark has a score increase from about 27 to about 70 on an M1 MBP 2020 when they are register allocated. External reports suggest that this the performance difference is even larger on older machines (5.5 to 48). * runtime/OptionsList.h: 2021-11-09 Zan Dobersek [RISCV64] Add assembly, disassembly infrastructure https://bugs.webkit.org/show_bug.cgi?id=232870 Reviewed by Yusuke Suzuki. Provide the necessary facilities for assembling and disassembling RISC-V instructions. This is just a preliminary patch that introduces the necessary assembly and disassembly infrastructure while actual enhancements to RISCV64Assembler and MacroAssemblerRISCV64 classes are left for later. In RISCV64Assembler.h header, necessary helper functions, enumerations and structs are introduced that enable crafting instruction values in accordance with the base RISC-V specification. All the necessary immediate and instruction types are supported, and the relevant instruction definitions are introduced and become usable in future work. For debugging purposes, a custom RISC-V disassembler is also introduced and is enabled when appropriate. The implementation utilizes functionality introduced in RISCV64Assembler.h, and different formatters are introduced to handle special cases even among the established instruction types. * Sources.txt: * assembler/RISCV64Assembler.h: (JSC::RISCV64Instructions::registerValue): (JSC::RISCV64Instructions::InstructionValue::InstructionValue): (JSC::RISCV64Instructions::InstructionValue::field): (JSC::RISCV64Instructions::InstructionValue::opcode): (JSC::RISCV64Instructions::ImmediateBase::isValid): (JSC::RISCV64Instructions::ImmediateBase::v): (JSC::RISCV64Instructions::ImmediateBase::ImmediateBase): (JSC::RISCV64Instructions::ImmediateBase::field): (JSC::RISCV64Instructions::IImmediate::IImmediate): (JSC::RISCV64Instructions::IImmediate::value): (JSC::RISCV64Instructions::SImmediate::SImmediate): (JSC::RISCV64Instructions::SImmediate::value): (JSC::RISCV64Instructions::BImmediate::BImmediate): (JSC::RISCV64Instructions::BImmediate::value): (JSC::RISCV64Instructions::UImmediate::UImmediate): (JSC::RISCV64Instructions::UImmediate::value): (JSC::RISCV64Instructions::JImmediate::JImmediate): (JSC::RISCV64Instructions::JImmediate::value): (JSC::RISCV64Instructions::RegistersBase::Size): (JSC::RISCV64Instructions::RTypeBase::construct): (JSC::RISCV64Instructions::RTypeBase::matches): (JSC::RISCV64Instructions::RTypeBase::rd): (JSC::RISCV64Instructions::RTypeBase::rs1): (JSC::RISCV64Instructions::RTypeBase::rs2): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::construct): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::matches): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rd): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rs1): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rs2): (JSC::RISCV64Instructions::RTypeBaseWithRoundingMode::rm): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::construct): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::matches): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rd): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rs1): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::rs2): (JSC::RISCV64Instructions::RTypeBaseWithAqRl::aqrl): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::construct): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::matches): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rd): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs1): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs2): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rs3): (JSC::RISCV64Instructions::R4TypeBaseWithRoundingMode::rm): (JSC::RISCV64Instructions::ITypeBase::construct): (JSC::RISCV64Instructions::ITypeBase::matches): (JSC::RISCV64Instructions::ITypeBase::rd): (JSC::RISCV64Instructions::ITypeBase::rs1): (JSC::RISCV64Instructions::STypeBase::construct): (JSC::RISCV64Instructions::STypeBase::matches): (JSC::RISCV64Instructions::STypeBase::rs1): (JSC::RISCV64Instructions::STypeBase::rs2): (JSC::RISCV64Instructions::BTypeBase::construct): (JSC::RISCV64Instructions::BTypeBase::matches): (JSC::RISCV64Instructions::BTypeBase::rs1): (JSC::RISCV64Instructions::BTypeBase::rs2): (JSC::RISCV64Instructions::UTypeBase::construct): (JSC::RISCV64Instructions::UTypeBase::matches): (JSC::RISCV64Instructions::UTypeBase::rd): (JSC::RISCV64Instructions::JTypeBase::construct): (JSC::RISCV64Instructions::JTypeBase::matches): (JSC::RISCV64Instructions::JTypeBase::rd): (JSC::RISCV64Instructions::SLLI::construct): (JSC::RISCV64Instructions::SRLI::construct): (JSC::RISCV64Instructions::SRAI::construct): (JSC::RISCV64Instructions::SLLIW::construct): (JSC::RISCV64Instructions::SRLIW::construct): (JSC::RISCV64Instructions::SRAIW::construct): (JSC::RISCV64Instructions::FCVTImpl::construct): (JSC::RISCV64Instructions::FMVImpl::construct): * disassembler/RISCV64Disassembler.cpp: Added. (JSC::RISCV64Disassembler::StringBufferBase::data): (JSC::RISCV64Disassembler::StringBufferBase::size): (JSC::RISCV64Disassembler::StringBufferBase::createString): (JSC::RISCV64Disassembler::registerName): (JSC::RISCV64Disassembler::registerName): (JSC::RISCV64Disassembler::roundingMode): (JSC::RISCV64Disassembler::memoryOperationFlags): (JSC::RISCV64Disassembler::aqrlFlags): (JSC::RISCV64Disassembler::InstructionList::contains): (JSC::RISCV64Disassembler::RTypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::RTypeR2Formatting::disassemble): (JSC::RISCV64Disassembler::RTypeWithRoundingModeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::RTypeWithRoundingModeFSQRTFormatting::disassemble): (JSC::RISCV64Disassembler::RTypeWithRoundingModeFCVTFormatting::disassemble): (JSC::RISCV64Disassembler::RTypeWithAqRlDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::RTypeWithAqRlLRFormatting::disassemble): (JSC::RISCV64Disassembler::R4TypeWithRoundingModeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::ITypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::ITypeImmediateAsOffsetFormatting::disassemble): (JSC::RISCV64Disassembler::STypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::BTypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::UTypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::JTypeDefaultFormatting::disassemble): (JSC::RISCV64Disassembler::FenceInstructionFormatting::disassemble): (JSC::RISCV64Disassembler::FenceIInstructionFormatting::disassemble): (JSC::RISCV64Disassembler::EnvironmentInstructionFormatting::disassemble): (JSC::RISCV64Disassembler::DisassemblyFormatting::disassemble): (JSC::RISCV64Disassembler::Disassembler::disassemble): (JSC::RISCV64Disassembler::Disassembler::disassemble): (JSC::RISCV64Disassembler::disassembleOpcode): (JSC::tryToDisassemble): 2021-11-09 Mikhail R. Gadelha Refactoring and PutByVal cleanup https://bugs.webkit.org/show_bug.cgi?id=232265 Reviewed by Saam Barati. Follow-up from https://bugs.webkit.org/show_bug.cgi?id=232242, this patch includes several small code changes but the patch doesn't add/remove any feature: 1. Removed several calls to operationPutByVal*Cell* that were only used by the 32 bit code paths due to the lack of registers. These calls were replaced by the calls used by the 64 bit paths, that expect EncodedJSValues 2. Because of #1, this patch removes those methods, since no one uses them anymore. 3. Created compilePutByVal to handle all cases (similar to compileGetByVal). 4. Removed the Edge& childX from the PutByVal handling (and all methods that expected them) in favor of getting them from node when needed. 5. Unified compileContiguousPutByVal so it could be used by both 32 and 64 bit archs. 6. Removed a lot of whitespace. * dfg/DFGOperations.cpp: * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): (JSC::DFG::SpeculativeJIT::compileDoublePutByVal): (JSC::DFG::SpeculativeJIT::compilePutByVal): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol): Deleted. (JSC::DFG::SpeculativeJIT::compileGetPrivateName): Deleted. (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal): Deleted. (JSC::DFG::SpeculativeJIT::compileGetPrivateNameById): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithString): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByValForCellWithSymbol): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByValWithThis): Deleted. (JSC::DFG::SpeculativeJIT::compilePutPrivateName): Deleted. (JSC::DFG::SpeculativeJIT::compilePutPrivateNameById): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand): Deleted. (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags): Deleted. (JSC::DFG::SpeculativeJIT::compileParseInt): Deleted. (JSC::DFG::SpeculativeJIT::compileOverridesHasInstance): Deleted. (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells): Deleted. (JSC::DFG::SpeculativeJIT::compileInstanceOf): Deleted. (JSC::DFG::SpeculativeJIT::compileValueBitNot): Deleted. (JSC::DFG::SpeculativeJIT::compileBitwiseNot): Deleted. (JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp): Deleted. (JSC::DFG::SpeculativeJIT::compileValueBitwiseOp): Deleted. (JSC::DFG::SpeculativeJIT::compileBitwiseOp): Deleted. (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp): Deleted. (JSC::DFG::SpeculativeJIT::compileValueLShiftOp): Deleted. (JSC::DFG::SpeculativeJIT::compileValueBitRShift): Deleted. (JSC::DFG::SpeculativeJIT::compileShiftOp): Deleted. (JSC::DFG::SpeculativeJIT::compileValueAdd): Deleted. (JSC::DFG::SpeculativeJIT::compileValueSub): Deleted. (JSC::DFG::SpeculativeJIT::compileMathIC): Deleted. (JSC::DFG::SpeculativeJIT::compileInstanceOfCustom): Deleted. (JSC::DFG::SpeculativeJIT::compileIsCellWithType): Deleted. (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView): Deleted. (JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor): Deleted. (JSC::DFG::SpeculativeJIT::compileArithAdd): Deleted. (JSC::DFG::SpeculativeJIT::compileArithAbs): Deleted. (JSC::DFG::SpeculativeJIT::compileArithClz32): Deleted. (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp): Deleted. (JSC::DFG::SpeculativeJIT::compileArithSub): Deleted. (JSC::DFG::SpeculativeJIT::compileIncOrDec): Deleted. (JSC::DFG::SpeculativeJIT::compileValueNegate): Deleted. (JSC::DFG::SpeculativeJIT::compileArithNegate): Deleted. (JSC::DFG::SpeculativeJIT::compileValueMul): Deleted. (JSC::DFG::SpeculativeJIT::compileArithMul): Deleted. (JSC::DFG::SpeculativeJIT::compileValueDiv): Deleted. (JSC::DFG::SpeculativeJIT::compileArithDiv): Deleted. (JSC::DFG::SpeculativeJIT::compileArithFRound): Deleted. (JSC::DFG::SpeculativeJIT::compileValueMod): Deleted. (JSC::DFG::SpeculativeJIT::compileArithMod): Deleted. (JSC::DFG::SpeculativeJIT::compileArithRounding): Deleted. (JSC::DFG::SpeculativeJIT::compileArithUnary): Deleted. (JSC::DFG::SpeculativeJIT::compileArithSqrt): Deleted. (JSC::DFG::SpeculativeJIT::compileArithMinMax): Deleted. (JSC::DFG::compileArithPowIntegerFastPath): Deleted. (JSC::DFG::SpeculativeJIT::compileValuePow): Deleted. (JSC::DFG::SpeculativeJIT::compileArithPow): Deleted. (JSC::DFG::SpeculativeJIT::compare): Deleted. (JSC::DFG::SpeculativeJIT::compileCompareUnsigned): Deleted. (JSC::DFG::SpeculativeJIT::compileStrictEq): Deleted. (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Deleted. (JSC::DFG::SpeculativeJIT::compileInt32Compare): Deleted. (JSC::DFG::SpeculativeJIT::compileDoubleCompare): Deleted. (JSC::DFG::SpeculativeJIT::compileObjectEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileSymbolEquality): Deleted. (JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality): Deleted. (JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality): Deleted. (JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted. (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileStringEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileStringIdentEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileStringCompare): Deleted. (JSC::DFG::SpeculativeJIT::compileStringIdentCompare): Deleted. (JSC::DFG::SpeculativeJIT::compileSameValue): Deleted. (JSC::DFG::SpeculativeJIT::compileToBooleanString): Deleted. (JSC::DFG::SpeculativeJIT::compileToBooleanStringOrOther): Deleted. (JSC::DFG::SpeculativeJIT::emitStringBranch): Deleted. (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch): Deleted. (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer): Deleted. (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): Deleted. (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): Deleted. (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileGetScope): Deleted. (JSC::DFG::SpeculativeJIT::compileSkipScope): Deleted. (JSC::DFG::SpeculativeJIT::compileGetGlobalObject): Deleted. (JSC::DFG::SpeculativeJIT::compileGetGlobalThis): Deleted. (JSC::DFG::SpeculativeJIT::canBeRope): Deleted. (JSC::DFG::SpeculativeJIT::compileGetArrayLength): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted. (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon): Deleted. (JSC::DFG::SpeculativeJIT::compileNewFunction): Deleted. (JSC::DFG::SpeculativeJIT::compileSetFunctionName): Deleted. (JSC::DFG::SpeculativeJIT::compileVarargsLength): Deleted. (JSC::DFG::SpeculativeJIT::compileLoadVarargs): Deleted. (JSC::DFG::SpeculativeJIT::compileForwardVarargs): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateActivation): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileGetFromArguments): Deleted. (JSC::DFG::SpeculativeJIT::compilePutToArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileGetArgument): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateArgumentsButterfly): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateRest): Deleted. (JSC::DFG::SpeculativeJIT::compileSpread): Deleted. (JSC::DFG::SpeculativeJIT::compileNewArray): Deleted. (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): Deleted. (JSC::DFG::SpeculativeJIT::compileGetRestLength): Deleted. (JSC::DFG::SpeculativeJIT::emitPopulateSliceIndex): Deleted. (JSC::DFG::SpeculativeJIT::compileArraySlice): Deleted. (JSC::DFG::SpeculativeJIT::compileArrayIndexOf): Deleted. (JSC::DFG::SpeculativeJIT::compileArrayPush): Deleted. (JSC::DFG::SpeculativeJIT::compileNotifyWrite): Deleted. (JSC::DFG::SpeculativeJIT::compileIsObject): Deleted. (JSC::DFG::SpeculativeJIT::compileTypeOfIsObject): Deleted. (JSC::DFG::SpeculativeJIT::compileIsCallable): Deleted. (JSC::DFG::SpeculativeJIT::compileIsConstructor): Deleted. (JSC::DFG::SpeculativeJIT::compileTypeOf): Deleted. (JSC::DFG::SpeculativeJIT::emitStructureCheck): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckIsConstant): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckNotEmpty): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckStructure): Deleted. (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): Deleted. (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): Deleted. (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly): Deleted. (JSC::DFG::SpeculativeJIT::compileGetButterfly): Deleted. (JSC::DFG::allocateTemporaryRegistersForSnippet): Deleted. (JSC::DFG::SpeculativeJIT::compileCallDOM): Deleted. (JSC::DFG::SpeculativeJIT::compileCallDOMGetter): Deleted. (JSC::DFG::SpeculativeJIT::compileCheckJSCast): Deleted. (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal): Deleted. (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf): Deleted. (JSC::DFG::getExecutable): Deleted. (JSC::DFG::SpeculativeJIT::compileFunctionToString): Deleted. (JSC::DFG::SpeculativeJIT::compileNumberToStringWithValidRadixConstant): Deleted. (JSC::DFG::SpeculativeJIT::compileNumberToStringWithRadix): Deleted. (JSC::DFG::SpeculativeJIT::compileNewStringObject): Deleted. (JSC::DFG::SpeculativeJIT::compileNewSymbol): Deleted. (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): Deleted. (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): Deleted. (JSC::DFG::SpeculativeJIT::compileNewRegexp): Deleted. (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering): Deleted. (JSC::DFG::SpeculativeJIT::speculateCellType): Deleted. (JSC::DFG::SpeculativeJIT::speculateInt32): Deleted. (JSC::DFG::SpeculativeJIT::speculateNumber): Deleted. (JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted. (JSC::DFG::SpeculativeJIT::speculateDoubleRepReal): Deleted. (JSC::DFG::SpeculativeJIT::speculateBoolean): Deleted. (JSC::DFG::SpeculativeJIT::speculateCell): Deleted. (JSC::DFG::SpeculativeJIT::speculateCellOrOther): Deleted. (JSC::DFG::SpeculativeJIT::speculateObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateFunction): Deleted. (JSC::DFG::SpeculativeJIT::speculateFinalObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateRegExpObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateArray): Deleted. (JSC::DFG::SpeculativeJIT::speculateProxyObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateDerivedArray): Deleted. (JSC::DFG::SpeculativeJIT::speculatePromiseObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateDateObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateMapObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateSetObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateWeakMapObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateWeakSetObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateDataViewObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateObjectOrOther): Deleted. (JSC::DFG::SpeculativeJIT::speculateString): Deleted. (JSC::DFG::SpeculativeJIT::speculateStringOrOther): Deleted. (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage): Deleted. (JSC::DFG::SpeculativeJIT::speculateStringIdent): Deleted. (JSC::DFG::SpeculativeJIT::speculateStringObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject): Deleted. (JSC::DFG::SpeculativeJIT::speculateNotStringVar): Deleted. (JSC::DFG::SpeculativeJIT::speculateNotSymbol): Deleted. (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted. (JSC::DFG::SpeculativeJIT::speculateHeapBigInt): Deleted. (JSC::DFG::SpeculativeJIT::speculateNotCell): Deleted. (JSC::DFG::SpeculativeJIT::speculateNotCellNorBigInt): Deleted. (JSC::DFG::SpeculativeJIT::speculateNotDouble): Deleted. (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt): Deleted. (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): Deleted. (JSC::DFG::SpeculativeJIT::speculateOther): Deleted. (JSC::DFG::SpeculativeJIT::speculateMisc): Deleted. (JSC::DFG::SpeculativeJIT::speculate): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchImm): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchChar): Deleted. (JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitchString): Deleted. (JSC::DFG::SpeculativeJIT::emitSwitch): Deleted. (JSC::DFG::SpeculativeJIT::addBranch): Deleted. (JSC::DFG::SpeculativeJIT::linkBranches): Deleted. (JSC::DFG::SpeculativeJIT::compileStoreBarrier): Deleted. (JSC::DFG::SpeculativeJIT::compilePutAccessorById): Deleted. (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById): Deleted. (JSC::DFG::SpeculativeJIT::compileResolveScope): Deleted. (JSC::DFG::SpeculativeJIT::compileResolveScopeForHoistingFuncDeclInEval): Deleted. (JSC::DFG::SpeculativeJIT::compileGetGlobalVariable): Deleted. (JSC::DFG::SpeculativeJIT::compilePutGlobalVariable): Deleted. (JSC::DFG::SpeculativeJIT::compileGetDynamicVar): Deleted. (JSC::DFG::SpeculativeJIT::compilePutDynamicVar): Deleted. (JSC::DFG::SpeculativeJIT::compileGetClosureVar): Deleted. (JSC::DFG::SpeculativeJIT::compilePutClosureVar): Deleted. (JSC::DFG::SpeculativeJIT::compileGetInternalField): Deleted. (JSC::DFG::SpeculativeJIT::compilePutInternalField): Deleted. (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal): Deleted. (JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex): Deleted. (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex): Deleted. (JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted. (JSC::DFG::SpeculativeJIT::compileRegExpTest): Deleted. (JSC::DFG::SpeculativeJIT::compileStringReplace): Deleted. (JSC::DFG::SpeculativeJIT::compileRegExpExecNonGlobalOrSticky): Deleted. (JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal): Deleted. (JSC::DFG::SpeculativeJIT::compileRegExpMatchFast): Deleted. (JSC::DFG::SpeculativeJIT::compileLazyJSConstant): Deleted. (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject): Deleted. (JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult): Deleted. (JSC::DFG::SpeculativeJIT::compileDefineDataProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty): Deleted. (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): Deleted. (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey): Deleted. (JSC::DFG::SpeculativeJIT::compileGetMapBucketHead): Deleted. (JSC::DFG::SpeculativeJIT::compileGetMapBucketNext): Deleted. (JSC::DFG::SpeculativeJIT::compileLoadKeyFromMapBucket): Deleted. (JSC::DFG::SpeculativeJIT::compileLoadValueFromMapBucket): Deleted. (JSC::DFG::SpeculativeJIT::compileExtractValueFromWeakMapGet): Deleted. (JSC::DFG::SpeculativeJIT::compileThrow): Deleted. (JSC::DFG::SpeculativeJIT::compileThrowStaticError): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractIndex): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractMode): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorInByVal): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorHasOwnProperty): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByIdFlush): Deleted. (JSC::DFG::SpeculativeJIT::compilePutById): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByIdDirect): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByIdWithThis): Deleted. (JSC::DFG::SpeculativeJIT::compileGetByOffset): Deleted. (JSC::DFG::SpeculativeJIT::compilePutByOffset): Deleted. (JSC::DFG::SpeculativeJIT::compileMatchStructure): Deleted. (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): Deleted. (JSC::DFG::SpeculativeJIT::compileGetExecutable): Deleted. (JSC::DFG::SpeculativeJIT::compileGetGetter): Deleted. (JSC::DFG::SpeculativeJIT::compileGetSetter): Deleted. (JSC::DFG::SpeculativeJIT::compileGetCallee): Deleted. (JSC::DFG::SpeculativeJIT::compileSetCallee): Deleted. (JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis): Deleted. (JSC::DFG::SpeculativeJIT::compileSetArgumentCountIncludingThis): Deleted. (JSC::DFG::SpeculativeJIT::compileStrCat): Deleted. (JSC::DFG::SpeculativeJIT::compileNewArrayBuffer): Deleted. (JSC::DFG::SpeculativeJIT::compileNewArrayWithSize): Deleted. (JSC::DFG::SpeculativeJIT::compileNewTypedArray): Deleted. (JSC::DFG::SpeculativeJIT::compileToThis): Deleted. (JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames): Deleted. (JSC::DFG::SpeculativeJIT::compileObjectAssign): Deleted. (JSC::DFG::SpeculativeJIT::compileObjectCreate): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateThis): Deleted. (JSC::DFG::SpeculativeJIT::compileCreatePromise): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateInternalFieldObject): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateGenerator): Deleted. (JSC::DFG::SpeculativeJIT::compileCreateAsyncGenerator): Deleted. (JSC::DFG::SpeculativeJIT::compileNewObject): Deleted. (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObjectImpl): Deleted. (JSC::DFG::SpeculativeJIT::compileNewGenerator): Deleted. (JSC::DFG::SpeculativeJIT::compileNewAsyncGenerator): Deleted. (JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject): Deleted. (JSC::DFG::SpeculativeJIT::compileToPrimitive): Deleted. (JSC::DFG::SpeculativeJIT::compileToPropertyKey): Deleted. (JSC::DFG::SpeculativeJIT::compileToNumeric): Deleted. (JSC::DFG::SpeculativeJIT::compileCallNumberConstructor): Deleted. (JSC::DFG::SpeculativeJIT::compileLogShadowChickenPrologue): Deleted. (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): Deleted. (JSC::DFG::SpeculativeJIT::compileSetAdd): Deleted. (JSC::DFG::SpeculativeJIT::compileMapSet): Deleted. (JSC::DFG::SpeculativeJIT::compileWeakMapGet): Deleted. (JSC::DFG::SpeculativeJIT::compileWeakSetAdd): Deleted. (JSC::DFG::SpeculativeJIT::compileWeakMapSet): Deleted. (JSC::DFG::SpeculativeJIT::compileGetPrototypeOf): Deleted. (JSC::DFG::SpeculativeJIT::compileIdentity): Deleted. (JSC::DFG::SpeculativeJIT::compileMiscStrictEq): Deleted. (JSC::DFG::SpeculativeJIT::emitInitializeButterfly): Deleted. (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize): Deleted. (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileExtractCatchLocal): Deleted. (JSC::DFG::SpeculativeJIT::compileClearCatchLocals): Deleted. (JSC::DFG::SpeculativeJIT::compileProfileType): Deleted. (JSC::DFG::SpeculativeJIT::cachedPutById): Deleted. (JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeCompare): Deleted. (JSC::DFG::SpeculativeJIT::genericJSValuePeepholeBranch): Deleted. (JSC::DFG::SpeculativeJIT::compileHeapBigIntEquality): Deleted. (JSC::DFG::SpeculativeJIT::compileMakeRope): Deleted. (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted. * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): Deleted. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchIfEmpty): (JSC::AssemblyHelpers::branchIfNotEmpty): 2021-11-09 Saam Barati When inlining NewSymbol in the DFG don't universally call ToString on the input https://bugs.webkit.org/show_bug.cgi?id=232754 Reviewed by Robin Morisset. When inlining Symbol(x) in the DFG, we were always calling ToString on x. However, this is wrong spec wise. If x is undefined, the symbol should produce a description value of `undefined`, but calling ToString on x was causing us to produce a description with the string `"undefined"`. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleConstantInternalFunction): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGClobbersExitState.cpp: (JSC::DFG::clobbersExitState): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGMayExit.cpp: * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNewSymbol): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewSymbol): 2021-11-09 Yusuke Suzuki Unreviewed, suppress scope check failures on Debug JSC tests https://bugs.webkit.org/show_bug.cgi?id=215438 * runtime/IntlNumberFormat.cpp: (JSC::IntlNumberFormat::initializeNumberFormat): 2021-11-08 Alex Christensen Parse redirect and modify-headers actions for WKContentRuleList https://bugs.webkit.org/show_bug.cgi?id=232838 Reviewed by Tim Hatcher. * inspector/InspectorBackendDispatcher.cpp: (Inspector::BackendDispatcher::getObject): 2021-11-08 Yusuke Suzuki Unreviewed, fix the newly added code https://bugs.webkit.org/show_bug.cgi?id=215438 * runtime/TemporalObject.cpp: (JSC::roundNumberToIncrement): 2021-11-08 Yusuke Suzuki [JSC] Implement IntlNumberFormat v3 https://bugs.webkit.org/show_bug.cgi?id=215438 Reviewed by Ross Kirsling. This patch implements part of Intl.NumberFormat v3 proposal[1]. It adds (1) several new options to Intl.NumberFormat, (2) adds formatRange and formatRangeToParts to Intl.NumberFormat and Intl.PluralRules, and (3) adds toIntlMathematicalValue support, which allows some of Intl.NumberFormat functions to take "string" decimal form. We cannot implement some features because it requires super new ICU. - trailingZeroDisplay (requires ICU 69) - halfCeil / halfFloor (requires ICU 69) - signDisplay: "negative" (requires ICU 69) - formatRangeToParts (requires ICU 70) [1]: https://github.com/tc39/proposal-intl-numberformat-v3 * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * runtime/BigIntPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/CommonIdentifiers.h: * runtime/IntlNumberFormat.cpp: (JSC::UNumberFormatterDeleter::operator()): (JSC::UNumberRangeFormatterDeleter::operator()): (JSC::partTypeString): (JSC::IntlNumberFormat::initializeNumberFormat): (JSC::IntlNumberFormat::format const): (JSC::IntlNumberFormat::formatRange const): (JSC::IntlNumberFormat::signDisplayString): (JSC::IntlNumberFormat::roundingModeString): (JSC::IntlNumberFormat::trailingZeroDisplayString): (JSC::IntlNumberFormat::roundingPriorityString): (JSC::IntlNumberFormat::useGroupingValue): (JSC::IntlNumberFormat::resolvedOptions const): (JSC::IntlNumberFormat::formatToPartsInternal): (JSC::IntlNumberFormat::formatToParts const): * runtime/IntlNumberFormat.h: (JSC::IntlMathematicalValue::IntlMathematicalValue): (JSC::IntlMathematicalValue::ensureNonDouble): (JSC::IntlMathematicalValue::numberType const): (JSC::IntlMathematicalValue::sign const): (JSC::IntlMathematicalValue::tryGetDouble const): (JSC::IntlMathematicalValue::getString const): (JSC::IntlMathematicalValue::numberTypeFromDouble): * runtime/IntlNumberFormatInlines.h: (JSC::setNumberFormatDigitOptions): (JSC::appendNumberFormatDigitOptionsToSkeleton): (JSC::toIntlMathematicalValue): * runtime/IntlNumberFormatPrototype.cpp: (JSC::IntlNumberFormatPrototype::create): (JSC::IntlNumberFormatPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/IntlNumberFormatPrototype.h: * runtime/IntlObjectInlines.h: (JSC::intlStringOrBooleanOption): * runtime/IntlPluralRules.cpp: (JSC::UPluralRulesDeleter::operator()): (JSC::IntlPluralRules::initializePluralRules): (JSC::IntlPluralRules::resolvedOptions const): (JSC::IntlPluralRules::select const): (JSC::IntlPluralRules::selectRange const): * runtime/IntlPluralRules.h: * runtime/IntlPluralRulesPrototype.cpp: (JSC::IntlPluralRulesPrototype::create): (JSC::IntlPluralRulesPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/IntlPluralRulesPrototype.h: * runtime/IntlRelativeTimeFormat.cpp: (JSC::IntlRelativeTimeFormat::formatToParts const): * runtime/JSBigInt.h: (JSC::JSBigInt::tryExtractDouble): * runtime/MathCommon.h: (JSC::isNegativeZero): * runtime/TemporalObject.cpp: (JSC::roundNumberToIncrement): * runtime/TemporalObject.h: 2021-11-08 Saam Barati We need to PreferNumber when calling toPrimitive for negate https://bugs.webkit.org/show_bug.cgi?id=232679 Reviewed by Alexey Shvayka. We were forgetting to do this in a few implementations of the negate bytecode. So depending on which variant you took, you could get different results. * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): 2021-11-05 Russell Epstein Cherry-pick r284635. rdar://problem/85039977 [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52 https://bugs.webkit.org/show_bug.cgi?id=232059 Reviewed by Saam Barati. JSTests: * stress/inserted-gettypedarraylengthasint52-should-have-int52-result-for-put-by-val.js: Added. (foo.bar): (foo): Source/JavaScriptCore: When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52. * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284635 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2021-10-21 Yusuke Suzuki [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52 https://bugs.webkit.org/show_bug.cgi?id=232059 Reviewed by Saam Barati. When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52. * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): 2021-11-04 Alexey Shvayka We need to PreferNumber when calling toPrimitive for coercion to BigInt https://bugs.webkit.org/show_bug.cgi?id=232720 Reviewed by Saam Barati. The difference between "default" and "number" hints is observable only via Symbol.toPrimitive method. This patch aligns hints in ToBigInt [1] and BigInt constructor [2] with the spec, V8, and SpiderMonkey. [1]: https://tc39.es/ecma262/#sec-tobigint (step 1) [2]: https://tc39.es/ecma262/#sec-bigint-constructor-number-value (step 2) * runtime/BigIntConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSCJSValue.cpp: (JSC::JSValue::toBigInt const): 2021-11-03 Yusuke Suzuki [JSC] Clean up StructureStubInfo initialization https://bugs.webkit.org/show_bug.cgi?id=232652 Reviewed by Saam Barati. This patch enhances FixedVector to initialize it from the other containers. So we can simplify baseline StructureStubInfo initialization. Now, StructureStubInfo::initializeFromUnlinkedStructureStubInfo becomes StructureStubInfo constructor taking const UnlinkedStructureStubInfo&. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::setupWithUnlinkedBaselineCode): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::StructureStubInfo): (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): Deleted. * bytecode/StructureStubInfo.h: * jit/JIT.cpp: (JSC::JIT::link): 2021-11-02 Ross Kirsling [JSC] Add LLInt fast path for OpMod on x86_64 https://bugs.webkit.org/show_bug.cgi?id=232644 Reviewed by Saam Barati and Yusuke Suzuki. This patch ports the x86_64 fast path for OpMod from baseline JIT to LLInt. This is quite similar to OpDiv but the implementation avoids using binaryOpCustomStore because OpMod is not a ProfiledBinaryOp. Performance results appear negligible with all JIT tiers enabled; relevant microbenchmarks with JIT off are as follows. Before After int-or-other-mod-then-get-by-val 158.0136+-0.9338 ^ 39.7698+-0.4394 ^ definitely 3.9732x faster integer-modulo 15.1972+-0.4197 ^ 7.1461+-0.1530 ^ definitely 2.1266x faster mod-boolean 145.4011+-2.0483 ? 146.1243+-1.6816 ? mod-boolean-double 145.6148+-1.8530 ? 145.9380+-1.7073 ? mod-untyped 286.9585+-3.9535 284.0360+-4.1221 might be 1.0103x faster negative-zero-modulo 1.2951+-0.1275 ^ 1.0220+-0.0412 ^ definitely 1.2672x faster 51.5408+-0.8164 ^ 34.7341+-0.3365 ^ definitely 1.4839x faster * jit/GPRInfo.h: Add assertions. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-11-02 Don Olmstead Non-unified build fixes early November 2021 edition https://bugs.webkit.org/show_bug.cgi?id=232589 Unreviewed non-unified build fixes. * API/JSAPIGlobalObject.cpp: * bytecode/EvalCodeBlock.cpp: * bytecode/FunctionCodeBlock.cpp: * bytecode/ModuleProgramCodeBlock.cpp: * bytecode/ProgramCodeBlock.cpp: * jit/JITInlineCacheGenerator.h: * runtime/CustomGetterSetter.cpp: * runtime/JSScriptFetcher.cpp: * runtime/JSSourceCode.cpp: * runtime/ShadowRealmObject.cpp: * runtime/ShadowRealmPrototype.cpp: * runtime/TemporalInstant.cpp: 2021-11-02 Philip Chimento [JSC] Implement Temporal.Instant https://bugs.webkit.org/show_bug.cgi?id=229826 Reviewed by Yusuke Suzuki. * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * runtime/ISO8601.cpp: (JSC::ISO8601::parseInstant): Add a parsing function for Instant strings reusing as much as possible from the other parsing functions. (JSC::ISO8601::ExactTime::fromISOPartsAndOffset): Static method for creating from ISO calendar components and UTC offset. (JSC::ISO8601::checkedCastDoubleToInt128): Helper function for checking whether a double can fit into an int128 without overflow. (JSC::ISO8601::ExactTime::add const): (JSC::ISO8601::ExactTime::round): (JSC::ISO8601::ExactTime::difference const): (JSC::ISO8601::ExactTime::round const): * runtime/ISO8601.h: (JSC::ISO8601::ExactTime::ExactTime): Add an ExactTime type that wraps an Int128 and can do the basic operations. This type can be reused in Temporal.ZonedDateTime. (JSC::ISO8601::ExactTime::fromEpochSeconds): (JSC::ISO8601::ExactTime::fromEpochMilliseconds): (JSC::ISO8601::ExactTime::fromEpochMicroseconds): (JSC::ISO8601::ExactTime::epochSeconds const): (JSC::ISO8601::ExactTime::epochMilliseconds const): (JSC::ISO8601::ExactTime::epochMicroseconds const): (JSC::ISO8601::ExactTime::epochNanoseconds const): (JSC::ISO8601::ExactTime::nanosecondsFraction const): (JSC::ISO8601::ExactTime::asString const): (JSC::ISO8601::ExactTime::isValid const): (JSC::ISO8601::ExactTime::operator< const): (JSC::ISO8601::ExactTime::operator<= const): (JSC::ISO8601::ExactTime::operator== const): (JSC::ISO8601::ExactTime::operator!= const): (JSC::ISO8601::ExactTime::operator>= const): (JSC::ISO8601::ExactTime::operator> const): * runtime/IntlDateTimeFormat.h: * runtime/IntlDateTimeFormatPrototype.cpp: (JSC::IntlDateTimeFormat::handleDateTimeValue): Add a minimal implementation of the HandleDateTimeValue abstract op from the Temporal specification, only covering Temporal.Instant. (JSC::JSC_DEFINE_HOST_FUNCTION): Use it in the existing Intl.DateTimeFormat methods. * runtime/JSBigInt.cpp: (JSC::JSBigInt::createFrom): Add an overload that takes an Int128. * runtime/JSBigInt.h: Remove declaration for nonexistent toUint64Heap(). * runtime/JSDateMath.cpp: Move timeToMS() into WTF. * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::instantStructure): * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::toLimitedDuration): Added. * runtime/TemporalDuration.h: * runtime/TemporalInstant.cpp: Added. (JSC::TemporalInstant::createStructure): (JSC::TemporalInstant::TemporalInstant): (JSC::TemporalInstant::create): (JSC::TemporalInstant::tryCreateIfValid): (JSC::TemporalInstant::toInstant): (JSC::TemporalInstant::from): (JSC::TemporalInstant::fromEpochSeconds): (JSC::TemporalInstant::fromEpochMilliseconds): (JSC::TemporalInstant::fromEpochMicroseconds): (JSC::TemporalInstant::fromEpochNanoseconds): (JSC::TemporalInstant::compare): * runtime/TemporalInstant.h: Added. * runtime/TemporalInstantConstructor.cpp: Added. (JSC::TemporalInstantConstructor::create): (JSC::TemporalInstantConstructor::createStructure): (JSC::TemporalInstantConstructor::TemporalInstantConstructor): (JSC::TemporalInstantConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalInstantConstructor.h: Added. * runtime/TemporalInstantPrototype.cpp: Added. (JSC::TemporalInstantPrototype::create): (JSC::TemporalInstantPrototype::createStructure): (JSC::TemporalInstantPrototype::TemporalInstantPrototype): (JSC::TemporalInstantPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/TemporalInstantPrototype.h: Added. * runtime/TemporalObject.cpp: (JSC::createInstantConstructor): Added. (JSC::formatSecondsStringPart): Added. (JSC::abs): Added for clarity. (JSC::roundNumberToIncrement): Add overload for Int128. * runtime/TemporalObject.h: * runtime/VM.cpp: * runtime/VM.h: 2021-11-02 Ross Kirsling [JSC][LLInt] Reverse unintended effects of r285152 https://bugs.webkit.org/show_bug.cgi?id=232633 Reviewed by Saam Barati. The previous patch was not intended to change the generated assembly whatsoever, but it turns out that 3-argument syntax produces, e.g. `vsub` instead of `sub` on x86. As such, this patch does away with the 3-arg cases and merely clarifies names as `rhs, lhs` across the board. (Also: Fix a line from the previous patch where a macro was not referring to a passed label properly.) * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-11-02 Saam Barati EnumeratorGetByVal for IndexedMode+OwnStructureMode doesn't always recover the property name https://bugs.webkit.org/show_bug.cgi?id=231321 Reviewed by Yusuke Suzuki. When running an EnumeratorGetByVal in IndexedMode+OwnStructureMode, we may go to the slow path. However, we were incorrectly going to the slow path before recovering the actual property name. Instead, we were passing in the integer index value to the get by val. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-11-02 Patrick Angle WebDriver: [Cocoa] support `acceptInsecureCerts` capability https://bugs.webkit.org/show_bug.cgi?id=231789 Reviewed by BJ Burg. Add necessary plumbing to support the `acceptInsecureCerts` WebDriver capability. * inspector/remote/RemoteInspectorConstants.h: * inspector/remote/cocoa/RemoteInspectorCocoa.mm: (Inspector::RemoteInspector::receivedAutomationSessionRequestMessage): 2021-11-01 Mark Lam Remove some unused Heap fields. https://bugs.webkit.org/show_bug.cgi?id=232604 Reviewed by Yusuke Suzuki. * heap/Heap.cpp: (JSC::Heap::notifyThreadStopping): * heap/Heap.h: 2021-11-01 Ross Kirsling [JSC][LLInt] Non-commutative binops are hard to reason about when operands are labelled in reverse https://bugs.webkit.org/show_bug.cgi?id=232598 Reviewed by Saam Barati. In offlineasm, `OP a, b, c` is `c = a OP b` but `OP a, b` is `b = b OP a`. This can make identifiers like `left` and `right` quite confusing -- simple cases like `subd left, right` are already misleading, while OpDiv literally passes its RHS to a macro as `left` and then checks `left` for division by zero. It becomes difficult to keep this all in one's brain without rewriting it on paper. This patch may not constitute a "complete solution", but it at least makes our naming honest: 1. Use 3-argument syntax (as `left, right, result`) whenever possible. 2. When not possible (e.g. because `bsubio` isn't flexible about its arguments or because x86 doesn't have 3-argument shift operations), then say `rhs, lhs` explicitly. * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-11-01 Yusuke Suzuki [JSC] LLIntCallee should have two replacements https://bugs.webkit.org/show_bug.cgi?id=228552 rdar://81217357 Reviewed by Saam Barati. LLIntCallee can be used for signaling memory and bounds-checking memory. Thus it should have two replacements for each mode. * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::work): * wasm/WasmCallee.h: (JSC::Wasm::Callee::setOSREntryCallee): * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::updateCallSitesToCallUs): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::WASM_SLOW_PATH_DECL): 2021-11-01 Saam Barati ArrayBuffer species watchpoint being invalidated doesn't mean it's not an ArrayBuffer constructor from the same global object https://bugs.webkit.org/show_bug.cgi?id=231322 Reviewed by Yusuke Suzuki. We were relying on the watchpoint to tell us if the Array species watchpoint for 'constructor' is set to the right value. However, the watchpoint being fired doesn't guarantee that it won't be the right value. For example, we might not be able to install the watchpoint because the replacement watchpoint may already be fired. * runtime/JSArrayBufferPrototype.cpp: (JSC::arrayBufferSpeciesConstructorSlow): 2021-11-01 Robin Morisset JSGenericTypedArrayView::set crashes if the length + objectOffset is > UINT32_MAX https://bugs.webkit.org/show_bug.cgi?id=231975 rdar://84402043 Reviewed by Yusuke Suzuki. UINT_MAX (and anything above it) is not a valid array index, so we cannot use JSObject::get(JSGlobalObject*, unsigned) with an index that big. This was pointed by Yusuke in his review of my recent patch that introduced the problem (https://bugs.webkit.org/show_bug.cgi?id=229353#c21), but I misunderstood the code and thought we could never get values that big at that point, thus only putting a RELEASE_ASSERT. In this patch I instead apply his original suggestion to have a first loop using the (fast) JSObject::get(), and a second loop for any large indices, using a slower but safe code path. I also fixed an unrelated bug I noticed in Clobberize/AbstractInterpreter while testing the rest of the patch: they were not aware that NewTypedArray can take a Int52RepUse child. Finally, while trying to properly test this change, I discovered that genericTypedArrayViewProtoFuncSlice (which is the only caller of JSGenericTypedArrayView::set which passes it a non-0 objectOffset) was still using unsigned everywhere instead of size_t, and that the same was true of all other functions in the same file. So I fixed it in the same patch. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * runtime/JSArrayBufferConstructor.cpp: (JSC::JSGenericArrayBufferConstructor::constructImpl): * runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewImpl): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::set): * runtime/JSGenericTypedArrayViewPrototypeFunctions.h: (JSC::argumentClampedIndexFromStartOrEnd): (JSC::genericTypedArrayViewProtoFuncSet): (JSC::genericTypedArrayViewProtoFuncCopyWithin): (JSC::genericTypedArrayViewProtoFuncIncludes): (JSC::genericTypedArrayViewProtoFuncIndexOf): (JSC::genericTypedArrayViewProtoFuncJoin): (JSC::genericTypedArrayViewProtoFuncFill): (JSC::genericTypedArrayViewProtoFuncLastIndexOf): (JSC::genericTypedArrayViewProtoFuncSlice): (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate): 2021-10-31 Cameron McCormack Update Web IDL links to new URL https://bugs.webkit.org/show_bug.cgi?id=232533 Reviewed by Sam Weinig. * wasm/js/WebAssemblyMemoryConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyTableConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-10-29 Yusuke Suzuki [JSC] Having StructureStubInfo and CallLinkInfo via FixedVector for Baseline JIT https://bugs.webkit.org/show_bug.cgi?id=232521 Reviewed by Saam Barati. We know # of StructureStubInfo and # of CallLinkInfo after compiling Baseline JIT code. So when installing a code into CodeBlock, we do not need to use Bag<>. Instead we can just use FixedVector to allocate these instances. We keep FixedVector and FixedVector in JITData for Baseline JIT. And moving Bag and Bag to DFG::CommonData when they are instantiated for DFG / FTL codes. * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::CallLinkInfo): Deleted. * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::CallLinkInfo): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::~CodeBlock): (JSC::CodeBlock::propagateTransitions): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::getICStatusMap): (JSC::CodeBlock::findStubInfo): (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): (JSC::CodeBlock::resetJITData): (JSC::CodeBlock::stronglyVisitStrongReferences): (JSC::CodeBlock::jettison): (JSC::CodeBlock::findPC): (JSC::CodeBlock::addOptimizingStubInfo): Deleted. (JSC::CodeBlock::addCallLinkInfo): Deleted. * bytecode/CodeBlock.h: * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::StructureStubInfo): Deleted. * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::StructureStubInfo): * dfg/DFGCommonData.h: (JSC::DFG::CommonData::addCallLinkInfo): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileDeleteById): (JSC::DFG::SpeculativeJIT::compileDeleteByVal): (JSC::DFG::SpeculativeJIT::compileInById): (JSC::DFG::SpeculativeJIT::compileInByVal): (JSC::DFG::SpeculativeJIT::compileHasPrivate): (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal): (JSC::DFG::SpeculativeJIT::compilePutPrivateName): (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand): (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand): (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells): (JSC::DFG::SpeculativeJIT::cachedPutById): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::getPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/BaselineJITCode.h: * jit/JIT.cpp: (JSC::JIT::addUnlinkedCallLinkInfo): (JSC::JIT::link): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::compileOpCall): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emit_op_iterator_next): * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITByIdGenerator::JITByIdGenerator): (JSC::JITGetByIdGenerator::JITGetByIdGenerator): (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator): (JSC::JITPutByIdGenerator::JITPutByIdGenerator): (JSC::JITDelByValGenerator::JITDelByValGenerator): (JSC::JITDelByIdGenerator::JITDelByIdGenerator): (JSC::JITInByValGenerator::JITInByValGenerator): (JSC::JITInByIdGenerator::JITInByIdGenerator): (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator): (JSC::JITGetByValGenerator::JITGetByValGenerator): (JSC::JITPutByValGenerator::JITPutByValGenerator): (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator): * jit/JITInlineCacheGenerator.h: * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_instanceof): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_instanceof): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emit_op_enumerator_get_by_val): 2021-10-29 Yusuke Suzuki [JSC] Clean up Baseline StructureStubInfo management https://bugs.webkit.org/show_bug.cgi?id=232513 Reviewed by Saam Barati. 1. We should keep Generator::m_stubInfo nullptr. And we add some assertions about it since it should not be allocated and used. 2. We found that propertyIsInt32 for op_get_by_val and op_put_by_val is not appropriately configured for UnlinkedStructureStubInfo (it was accidentally set for the above wasted StructureStubInfo). This patch attaches that information. 3. We keep UnlinkedStructureStubInfo in a FixedVector in BaselineJITCode. While we need to keep pointer identity while compiling Baseline JIT, after that, we no longer need to keep that since these pointers are not embedded into JIT code. This patch allocates UnlinkedStructureStubInfo via SegmentedVector during compilation to keep pointer identity, but when finalizing, we allocate FixedVector and copy the above content to that to keep memory as small as possible. We should do similar thing to UnlinkedCallLinkInfo, StructureStubInfo etc. for baseline, but this should be done in a separate patch. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::addOptimizingStubInfo): (JSC::CodeBlock::addStubInfo): Deleted. * bytecode/CodeBlock.h: * bytecode/PutKind.h: * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * bytecode/StructureStubInfo.h: * jit/BaselineJITCode.h: * jit/JIT.cpp: (JSC::JIT::addUnlinkedStructureStubInfo): (JSC::JIT::link): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emit_op_iterator_next): * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITInlineCacheGenerator::finalize): (JSC::JITByIdGenerator::JITByIdGenerator): (JSC::JITByIdGenerator::finalize): (JSC::JITGetByIdGenerator::generateFastPath): (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator): (JSC::JITGetByIdWithThisGenerator::generateFastPath): (JSC::JITPutByIdGenerator::JITPutByIdGenerator): (JSC::JITPutByIdGenerator::generateFastPath): (JSC::JITDelByValGenerator::JITDelByValGenerator): (JSC::JITDelByValGenerator::generateFastPath): (JSC::JITDelByValGenerator::finalize): (JSC::JITDelByIdGenerator::JITDelByIdGenerator): (JSC::JITDelByIdGenerator::generateFastPath): (JSC::JITDelByIdGenerator::finalize): (JSC::JITInByValGenerator::JITInByValGenerator): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByValGenerator::finalize): (JSC::JITInByIdGenerator::generateFastPath): (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator): (JSC::JITInstanceOfGenerator::generateFastPath): (JSC::JITInstanceOfGenerator::finalize): (JSC::JITGetByValGenerator::JITGetByValGenerator): (JSC::JITGetByValGenerator::generateFastPath): (JSC::JITGetByValGenerator::finalize): (JSC::JITPutByValGenerator::JITPutByValGenerator): (JSC::JITPutByValGenerator::generateFastPath): (JSC::JITPutByValGenerator::finalize): (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator): (JSC::JITPrivateBrandAccessGenerator::generateFastPath): (JSC::JITPrivateBrandAccessGenerator::finalize): (JSC::garbageStubInfo): Deleted. * jit/JITInlineCacheGenerator.h: * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_instanceof): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_instanceof): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emit_op_enumerator_get_by_val): 2021-10-29 Dmitry Bezhetskov [WASM-Function-References] Add support for (ref.null heaptype) https://bugs.webkit.org/show_bug.cgi?id=229707 Reviewed by Yusuke Suzuki. Added support for (ref.null $t) from the typed function references proposal: https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md#optional-references. Since now we can have null references I've also updated call_ref implementation to check the target reference for null. According to the spec (https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md#functions) we must trap on null. * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::addCallRef): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addCallRef): * wasm/WasmExceptionType.h: * wasm/WasmFormat.h: (JSC::Wasm::isTypeIndexHeapType): * wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser::parseExpression): * wasm/WasmParser.h: (JSC::Wasm::Parser::parseHeapType): (JSC::Wasm::Parser::parseValueType): * wasm/WasmSectionParser.cpp: (JSC::Wasm::SectionParser::parseInitExpr): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::doWasmCallRef): 2021-10-28 Saam Barati Don't call type() on Structure, instead call type() on its typeInfo() https://bugs.webkit.org/show_bug.cgi?id=232414 Reviewed by Yusuke Suzuki. * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitAllocateRawObject): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * runtime/Structure.h: (JSC::Structure::type): 2021-10-27 Dmitry Bezhetskov [WASM-Function-References] Add call_ref spec tests https://bugs.webkit.org/show_bug.cgi?id=229710 Reviewed by Yusuke Suzuki. Removed redundand TypeKind::TypeIdx because new Ref and RefNull opcodes cover the same cases. Also use new internal representation of Funcref/Externref when typed function references proposal is enabled. * bytecode/BytecodeDumper.cpp: (JSC::Wasm::BytecodeDumper::formatConstant const): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::gRef): (JSC::Wasm::AirIRGenerator::tmpForType): (JSC::Wasm::AirIRGenerator::emitCCall): (JSC::Wasm::AirIRGenerator::moveOpForValueType): (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::addLocal): (JSC::Wasm::AirIRGenerator::addConstant): (JSC::Wasm::AirIRGenerator::addRefFunc): (JSC::Wasm::AirIRGenerator::gTypeIdx): Deleted. * wasm/WasmCallingConvention.h: (JSC::Wasm::WasmCallingConvention::marshallLocation const): (JSC::Wasm::JSCallingConvention::marshallLocation const): * wasm/WasmFormat.h: (JSC::Wasm::isValueType): (JSC::Wasm::isRefType): (JSC::Wasm::isExternref): (JSC::Wasm::isFuncref): (JSC::Wasm::FuncrefType): (JSC::Wasm::ExternrefType): (JSC::Wasm::isRefWithTypeIndex): (JSC::Wasm::isSubtype): (JSC::Wasm::isDefaultableType): (JSC::Wasm::TableInformation::wasmType const): * wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser::parseExpression): * wasm/WasmGlobal.cpp: (JSC::Wasm::Global::get const): (JSC::Wasm::Global::set): (JSC::Wasm::Global::visitAggregateImpl): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::callInformationForCaller): (JSC::Wasm::LLIntGenerator::callInformationForCallee): (JSC::Wasm::LLIntGenerator::addArguments): (JSC::Wasm::LLIntGenerator::addLocal): * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmParser.h: (JSC::Wasm::Parser::parseValueType): * wasm/WasmSectionParser.cpp: (JSC::Wasm::SectionParser::parseInitExpr): * wasm/WasmTable.cpp: (JSC::Wasm::Table::wasmType const): * wasm/js/JSToWasm.cpp: (JSC::Wasm::marshallJSResult): * wasm/js/JSWebAssemblyGlobal.cpp: (JSC::JSWebAssemblyGlobal::type): * wasm/js/JSWebAssemblyHelpers.h: (JSC::defaultValueForReferenceType): * wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS): * wasm/js/WebAssemblyFunction.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * wasm/js/WebAssemblyGlobalConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::linkImpl): * wasm/wasm.json: 2021-10-27 Geza Lore [JSC][32bit] Fix CSR restore on DFG tail calls, add extra register on ARMv7 https://bugs.webkit.org/show_bug.cgi?id=230622 Reviewed by Keith Miller. This re-introduces the patch reverted by https://trac.webkit.org/changeset/284911/webkit with the C_LOOP interpreter now fixed. The only difference between the original patch and this version is in LowLevelInterpreter32_64.asm and LowLevelInterpreter64.asm, which need the PC base (PB) register restored on C_LOOP on return from a call, as C_LOOP does not seem to handle this as a proper callee save register (CSR). On non C_LOOP builds, the CSR restore mechanism takes care of this, so removed the superfluous instructions. --- Original ChangeLog --- This patch does two things: 1. Adds an extra callee save register (CSR) to be available to DFG on ARMv7. To do this properly required the following: 2. Implements the necessary shuffling in CallFrameShuffler on 32-bit architectures that is required to restore CSRs properly after a tail call on these architectures. This also fixes the remaining failures in the 32-bit build of the unlinked baseline JIT. * bytecode/ValueRecovery.cpp: (JSC::ValueRecovery::dumpInContext const): * bytecode/ValueRecovery.h: (JSC::ValueRecovery::calleeSaveRegDisplacedInJSStack): (JSC::ValueRecovery::isInJSStack const): (JSC::ValueRecovery::dataFormat const): (JSC::ValueRecovery::withLocalsOffset const): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * jit/CachedRecovery.cpp: (JSC::CachedRecovery::loadsIntoGPR const): * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::setupCalleeSaveRegisters): * jit/CallFrameShuffleData.h: * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::CallFrameShuffler): * jit/CallFrameShuffler.h: (JSC::CallFrameShuffler::snapshot const): (JSC::CallFrameShuffler::addNew): * jit/CallFrameShuffler32_64.cpp: (JSC::CallFrameShuffler::emitLoad): (JSC::CallFrameShuffler::emitDisplace): * jit/GPRInfo.h: (JSC::GPRInfo::toRegister): (JSC::GPRInfo::toIndex): * jit/RegisterSet.cpp: (JSC::RegisterSet::dfgCalleeSaveRegisters): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: 2021-10-26 Commit Queue Unreviewed, reverting r284255. https://bugs.webkit.org/show_bug.cgi?id=232353 breaks 32-bit watch CLoop. Reverted changeset: "[JSC][32bit] Fix CSR restore on DFG tail calls, add extra register on ARMv7" https://bugs.webkit.org/show_bug.cgi?id=230622 https://commits.webkit.org/r284255 2021-10-26 Xan López [JSC] Improve offlineasm debug annotations for Linux/ELF https://bugs.webkit.org/show_bug.cgi?id=232303 Reviewed by Mark Lam. This patch does two things: Add the .size and .type directives to every llint "function" (global, llint opcode, 'glue'). This allows a debugger to tell you in what logical function you are inside the giant chunk of code that is the llint interpreter. So instead of something like this: (gdb) x/5i $pc => 0xf5f8af60 : b.n 0xf5f8af6c 0xf5f8af62 : ldr r2, [r7, #8] 0xf5f8af64 : ldr r2, [r2, #28] 0xf5f8af66 : subs r0, #16 0xf5f8af68 : ldr.w r0, [r2, r0, lsl #3] you get something like this: (gdb) x/5i $pc => 0xf5f8c770 : bge.n 0xf5f8c77c 0xf5f8c772 : add.w r6, r7, r9, lsl #3 0xf5f8c776 : vldr d0, [r6] 0xf5f8c77a : b.n 0xf5f8c78c 0xf5f8c77c : ldr r2, [r7, #8] The other change adds a local symbol (in addition to an internal label) to all the "glue" labels. That allows wasm opcodes to be seen by the debugger (and the user to break on them), among other things. * CMakeLists.txt: tell offlineasm we use the ELF binary format on Linux. * llint/LowLevelInterpreter.cpp: emit a non-local label for "glue" labels. * offlineasm/asm.rb: emit the .size and .type directives for every llint "function" on ELF systems. 2021-10-25 Yusuke Suzuki [JSC] Fix stale assertion in InternalFunctionAllocationProfile after r284757 https://bugs.webkit.org/show_bug.cgi?id=232269 Reviewed by Robin Morisset. Now, condition in InternalFunction is changed in r284757. We need to update this assertion accordingly. It is tested (and crashing) in the existing stress test[1]. [1]: InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js * bytecode/InternalFunctionAllocationProfile.h: (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase): 2021-10-25 Yusuke Suzuki [JSC] Don't branch around register allocation in DFG enumerator get by val https://bugs.webkit.org/show_bug.cgi?id=232260 rdar://84544469 Reviewed by Robin Morisset. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetByValOnString): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString): (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol): (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments): (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments): (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): 2021-10-25 Mikhail R. Gadelha [JSC][32bit] Don't speculate Cell on PutByVal https://bugs.webkit.org/show_bug.cgi?id=232242 Reviewed by Yusuke Suzuki. This patch is similar to https://bugs.webkit.org/show_bug.cgi?id=232052 but smaller: given that we have more registers available, we don't have to speculate Cells anymore. This patch removes the Cell speculation during the DFG FixUp phase and adjust the operationPutByVal* calls to use the generic version (instead of the Cell versions). * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): 2021-10-25 Geza Lore [JSC][32bit] Use DataIC in Baseline JIT https://bugs.webkit.org/show_bug.cgi?id=232079 Reviewed by Yusuke Suzuki. This patch ports the JSVALUE32_64 baseline JIT to use DataICs. The majority of the involved opcodes (all but one) could be easily modified to use a common implementation between JSVALUE64 and JSVALUE32_64 platforms by abstracting over machine registers holding a JSValue using JSValueReg types instead of GPRReg. The only non-trivial additional abstraction needed was over the ideal argument registers used in a function call, so loading the arguments from memory can put them straight in the ABI specific argument register whenever possible, or appropriate temporaries otherwise. For this I added CCallHelpers::preferredArgumentGPR (for passing host pointers and other primitive types that fit in a machine register on the host platform), and CCallHelpers::preferredArgumentJSR (for passing JSValue/EncodedJSValue). Please see the description of these in the code. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * assembler/ARMv7Assembler.h: (JSC::ARMv7Assembler::strb): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::emitFastPathImpl): (JSC::CallLinkInfo::emitDataICFastPath): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchIfNotObject): * jit/CCallHelpers.h: (JSC::CCallHelpers::sizeOfArg): (JSC::CCallHelpers::pickJSR): (JSC::CCallHelpers::preferredArgumentJSR): (JSC::CCallHelpers::preferredArgumentGPR): * jit/CallFrameShuffler.h: * jit/GPRInfo.h: (JSC::JSValueRegs::operator== const): (JSC::JSValueRegs::operator!= const): (JSC::JSValueRegs::tagGPR const): (JSC::JSValueRegs::payloadGPR const): (JSC::JSValueRegs::uses const): (JSC::JSValueRegs::overlaps const): (JSC::JSValueRegs::JSValueRegs): (JSC::JSValueRegs::payloadOnly): * jit/JIT.cpp: (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::link): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::emit_op_ret): (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCall32_64.cpp: Removed. * jit/JITCode.h: (JSC::JITCode::useDataIC): * jit/JITInlineCacheGenerator.cpp: (JSC::generateGetByIdInlineAccess): (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::emitArrayProfilingSiteWithCell): (JSC::JIT::emitJumpSlowCaseIfNotJSCell): * jit/JITOpcodes.cpp: * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::slow_op_get_by_val_prepareCallGenerator): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_put_by_val_direct): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emit_op_enumerator_get_by_val): * jit/JITPropertyAccess32_64.cpp: 2021-10-24 Alexey Shvayka InternalFunction::createSubclassStructure() should use prototype's global object https://bugs.webkit.org/show_bug.cgi?id=231874 Reviewed by Yusuke Suzuki. In case NewTarget has a cross-realm "prototype" object, even though the instance structure is created with correct [[Prototype]], it's m_globalObject is of NewTarget's realm instead of prototype's. That is observable in various places, including when calling CustomAccessor, fast paths for iteration protocol / collection constructors, isHavingABadTime() handling etc. This patch fixes structure's global object to be correct: per spec [1], we fallback to NewTarget's realm only if "prototype" is a primitive. [1]: https://tc39.es/ecma262/#sec-getprototypefromconstructor (step 3.b) * runtime/InternalFunction.cpp: (JSC::InternalFunction::createSubclassStructure): 2021-10-22 Justin Michaud Fix nits from 232019 https://bugs.webkit.org/show_bug.cgi?id=232180 Reviewed by Saam Barati. We only need one write barrier, since we only need to guarantee that we read the status of the write barrier before we read from the structure cache. If we are delayed in watching the watchpoint, it does not change any of the interleavings. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): 2021-10-22 Yusuke Suzuki [JSC] GetTypedArrayLengthAsInt52 must be inserted only when we ensure that input is TypedArray via array-mode-based filtering https://bugs.webkit.org/show_bug.cgi?id=232168 rdar://84366658 Reviewed by Robin Morisset. GetTypedArrayLengthAsInt52 works only when input is TypedArray, which should be validated via array-mode (and already inserted checks in fixup). Accidentally we were inserting it without checking typed-array condition in SSA lowering phase. This patch adds a condition which ensures it is TypedArray. * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck): 2021-10-22 Mark Lam Change Heap::writeBarrier() to do the cheaper check first. https://bugs.webkit.org/show_bug.cgi?id=232172 Reviewed by Robin Morisset. It's cheaper to do a check using incoming args (which are already loaded in registers) than to do a check which requires memory loads. * heap/HeapInlines.h: (JSC::Heap::writeBarrier): 2021-10-22 Asumu Takikawa Change WebAssembly module import linking time to evaluate step. https://bugs.webkit.org/show_bug.cgi?id=231114 Reviewed by Yusuke Suzuki. Moves the Wasm module import linking code to execute in the module evaluation step, which is the behavior specified in the Wasm/ESM-integration proposal: https://github.com/WebAssembly/esm-integration/tree/main/proposals/esm-integration#evaluate * runtime/AbstractModuleRecord.cpp: (JSC::AbstractModuleRecord::link): (JSC::AbstractModuleRecord::evaluate): * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::finalizeCreation): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::link): (JSC::WebAssemblyModuleRecord::initializeImportsAndExports): (JSC::WebAssemblyModuleRecord::linkImpl): Deleted. * wasm/js/WebAssemblyModuleRecord.h: 2021-10-22 Mikhail R. Gadelha [JSC][32bit] Re-enable compileEnumeratorGetByVal fast path https://bugs.webkit.org/show_bug.cgi?id=232052 Reviewed by Yusuke Suzuki. In https://bugs.webkit.org/show_bug.cgi?id=229543, the compileEnumeratorGetByVal fast path had to be disabled in 32 bits due to not having enough registers. There are enough registers available now, so we can re-enable the fast path and removed the speculation that the baseEdge of both enumeratorGetByVal and getByVal is a Cell in 32 bits. I've also updated the 32 bits version of compileGetByVal to be closer to the 64 bits version: using DFG_CRASH instead of RELEASE_ASSERT_NOT_REACHED, using nullptr instead of 0, and removed some whitespaces. * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): Deleted. 2021-10-22 Saam Barati canDoFastSpread should also check that the Structure is from the global object we're watching https://bugs.webkit.org/show_bug.cgi?id=231976 Reviewed by Keith Miller. Just reorder the checks for clarity. * dfg/DFGGraph.cpp: (JSC::DFG::Graph::canDoFastSpread): 2021-10-22 Robin Morisset --reportBytecodeCompileTimes=1 should correctly report the bytecode size https://bugs.webkit.org/show_bug.cgi?id=232118 Reviewed by Michael Saboff. generate() calls m_writer.finalize() which moves m_instructions, so when we later query its size we get 0. The solution is simply to put the size in an out-parameter just before calling finalize(). * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::generate): * bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::generate): 2021-10-22 Mark Lam Remove unneeded Heap::m_vm. https://bugs.webkit.org/show_bug.cgi?id=232132 Reviewed by Yusuke Suzuki. Heap::vm() already computes the associated VM& using offset math. This entails subtracting a constant from Heap's this pointer, which is faster than loading from a field. * heap/Heap.cpp: (JSC::Heap::Heap): (JSC::Heap::lastChanceToFinalize): (JSC::Heap::releaseDelayedReleasedObjects): (JSC::Heap::protect): (JSC::Heap::unprotect): (JSC::Heap::finalizeUnconditionalFinalizers): (JSC::Heap::completeAllJITPlans): (JSC::Heap::iterateExecutingAndCompilingCodeBlocks): (JSC::Heap::gatherJSStackRoots): (JSC::Heap::gatherScratchBufferRoots): (JSC::Heap::removeDeadCompilerWorklistEntries): (JSC::Heap::gatherExtraHeapData): (JSC::Heap::deleteAllCodeBlocks): (JSC::Heap::deleteAllUnlinkedCodeBlocks): (JSC::Heap::finishChangingPhase): (JSC::Heap::collectInMutatorThread): (JSC::Heap::finishRelinquishingConn): (JSC::Heap::deleteSourceProviderCaches): (JSC::Heap::didFinishCollection): (JSC::Heap::isValidAllocation): (JSC::Heap::addCoreConstraints): * heap/Heap.h: 2021-10-21 Saam Barati Clean up some code around checking the state of Watchpoints https://bugs.webkit.org/show_bug.cgi?id=232111 Reviewed by Yusuke Suzuki. No need to have state() and stateOnJSThread(), since they're now the same. Also, there is no need to check the allocation watchpoint twice for the function/internal function allocation profiles. * bytecode/Watchpoint.h: (JSC::WatchpointSet::isStillValid const): (JSC::WatchpointSet::stateOnJSThread const): Deleted. (JSC::WatchpointSet::isStillValidOnJSThread const): Deleted. (JSC::InlineWatchpointSet::stateOnJSThread const): Deleted. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::handleCreateInternalFieldObject): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * runtime/ArrayPrototype.cpp: (JSC::speciesWatchpointIsValid): (JSC::canUseDefaultArrayJoinForToString): * runtime/InferredValue.h: (JSC::InferredValue::notifyWrite): (JSC::InferredValue::stateOnJSThread const): Deleted. * runtime/JSArrayBufferPrototypeInlines.h: (JSC::speciesWatchpointIsValid): * runtime/ObjectPropertyChangeAdaptiveWatchpoint.h: 2021-10-21 Mark Lam Remove an unused field: Heap::m_copyingRememberedSet. https://bugs.webkit.org/show_bug.cgi?id=232119 Reviewed by Robin Morisset. * heap/Heap.h: 2021-10-21 Yusuke Suzuki [JSC] Make GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 NodeResultInt52 https://bugs.webkit.org/show_bug.cgi?id=232100 Reviewed by Robin Morisset. This patch makes GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 have NodeResultInt52 by default. And DFG validation should skip Int52 validation before fixup phase, as we are doing for double results. * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGNodeType.h: * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck): * dfg/DFGValidate.cpp: 2021-10-21 Yusuke Suzuki [JSC] Inserted GetTypedArrayLengthAsInt52 for PutByVal should have NodeResultInt52 https://bugs.webkit.org/show_bug.cgi?id=232059 Reviewed by Saam Barati. When inserting GetTypedArrayLengthAsInt52 after fixup phase, we must set NodeResultInt52. * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): 2021-10-21 Michael Saboff Add missing overflow check to DFGIntegerRangeOptimizationPhase::filterConstant() https://bugs.webkit.org/show_bug.cgi?id=232058 Reviewed by Robin Morisset. Added overflow check. * dfg/DFGIntegerRangeOptimizationPhase.cpp: 2021-10-20 Yusuke Suzuki *IsSane API's could take in the Structure's we're consulting, or they can be out parameters, so we don't rely on the CPU's memory ordering https://bugs.webkit.org/show_bug.cgi?id=231996 Reviewed by Filip Pizlo. objectPrototypeIsSane, arrayPrototypeChainIsSane, and stringPrototypeChainIsSane reloads structures from prototype objects while the caller is already getting them and validating them. This introduces a race condition where structure transition happens just before calling these APIs and we will see different structures which are already validated. This is simply wrong: if we validate one structure, then we should continue using that and we should put a watchpoint on this structure. We should not reload structures from the prototype again. We add Concurrently postfix to these functions, and passing structures to these APIs to continue using these structures instead of reloading it from prototype objects. This eliminate the race condition we had, and this removes the necessity of load-load-fence on watchpoint state retrieval. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine const): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicCall): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::setSaneChainIfPossible): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetByValOnString): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAtImpl): * runtime/JSGlobalObject.h: * runtime/JSGlobalObjectInlines.h: (JSC::JSGlobalObject::objectPrototypeIsSane): (JSC::JSGlobalObject::arrayPrototypeChainIsSaneConcurrently): (JSC::JSGlobalObject::stringPrototypeChainIsSaneConcurrently): (JSC::JSGlobalObject::arrayPrototypeChainIsSane): (JSC::JSGlobalObject::stringPrototypeChainIsSane): 2021-10-20 Yusuke Suzuki [JSC] ArithAbs should care about INT32_MIN https://bugs.webkit.org/show_bug.cgi?id=232051 rdar://84338648 Reviewed by Michael Saboff. ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use. * dfg/DFGIntegerRangeOptimizationPhase.cpp: 2021-10-20 Justin Michaud We should watch isHavingABadTime if we read from the structureCache https://bugs.webkit.org/show_bug.cgi?id=232019 Reviewed by Yusuke Suzuki. We should lock the structure cache when we clear it, and the compiler thread should watch isHavingABadTime in the case that the cache might get cleared. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::haveABadTime): * runtime/StructureCache.cpp: (JSC::StructureCache::clear): * runtime/StructureCache.h: (JSC::StructureCache::clear): Deleted. 2021-10-20 Michael Saboff Add missing overflow checks to DFGIntegerRangeOptimizationPhase::isEquivalentTo() https://bugs.webkit.org/show_bug.cgi?id=232024 Reviewed by Tadeu Zagallo. Added overflow check before comparing for equality. * dfg/DFGIntegerRangeOptimizationPhase.cpp: 2021-10-20 Michael Catanzaro Do not use strerror() https://bugs.webkit.org/show_bug.cgi?id=231913 Reviewed by Chris Dumez. * API/JSScript.mm: (-[JSScript writeCache:]): * API/tests/testapi.mm: (resolvePathToScripts): * jsc.cpp: * runtime/BytecodeCacheError.cpp: (JSC::BytecodeCacheError::StandardError::message const): * tools/FunctionAllowlist.cpp: (JSC::FunctionAllowlist::FunctionAllowlist): * tools/FunctionOverrides.cpp: (JSC::FunctionOverrides::parseOverridesInFile): * wasm/WasmMemory.cpp: (JSC::Wasm::MemoryHandle::~MemoryHandle): (JSC::Wasm::Memory::tryCreate): (JSC::Wasm::Memory::growShared): (JSC::Wasm::Memory::grow): 2021-10-20 Michael Catanzaro Suppress a -Wreturn-type warning https://bugs.webkit.org/show_bug.cgi?id=229681 Unreviewed. * wasm/WasmFormat.h: (JSC::Wasm::typeToString): 2021-10-19 Tadeu Zagallo Address post-landing feedback to wasm exceptions https://bugs.webkit.org/show_bug.cgi?id=231973 Reviewed by Saam Barati. Address comments left by Saam in https://bugs.webkit.org/show_bug.cgi?id=229681 after the patch landed. This includes deleting some unused code, and renaming a couple variables and methods, but the biggest change is copying the callee saves to VMEntry in the llint rethrow. * interpreter/Interpreter.cpp: (JSC::CatchInfo::CatchInfo): (JSC::UnwindFunctor::operator() const): * interpreter/Interpreter.h: (JSC::CatchInfo::CatchInfo): Deleted. * jit/JSInterfaceJIT.h: (JSC::JSInterfaceJIT::convertCalleeToVM): Deleted. * llint/WebAssembly.asm: * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::ControlData::ControlData): (JSC::Wasm::B3IRGenerator::ControlData::tryDepth const): (JSC::Wasm::B3IRGenerator::connectControlAtEntrypoint): (JSC::Wasm::B3IRGenerator::addLoop): (JSC::Wasm::B3IRGenerator::addTry): (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions): (JSC::Wasm::B3IRGenerator::emitCatchImpl): (JSC::Wasm::B3IRGenerator::addDelegateToUnreachable): (JSC::Wasm::B3IRGenerator::addThrow): (JSC::Wasm::B3IRGenerator::addRethrow): (JSC::Wasm::B3IRGenerator::addEndToUnreachable): (JSC::Wasm::B3IRGenerator::connectControlEntry): Deleted. * wasm/WasmCallee.h: (JSC::Wasm::Callee::llintFunctionCodeBlock const): (JSC::Wasm::Callee::functionCodeBlock const): Deleted. * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::unifyValuesWithBlock): (JSC::Wasm::LLIntGenerator::addTry): (JSC::Wasm::LLIntGenerator::addThrow): (JSC::Wasm::LLIntGenerator::repatch): Deleted. * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmOperations.h: 2021-10-19 Alexey Proskuryakov Eagerly resolve python3 path in Makefiles https://bugs.webkit.org/show_bug.cgi?id=231979 Reviewed by Jonathan Bedard. * DerivedSources.make: 2021-10-19 Saam Barati canDoFastSpread should also check that the Structure is from the global object we're watching https://bugs.webkit.org/show_bug.cgi?id=231976 Reviewed by Keith Miller. * dfg/DFGGraph.cpp: (JSC::DFG::Graph::canDoFastSpread): 2021-10-19 Chris Dumez [clang 13] Suppress sign comparison warnings https://bugs.webkit.org/show_bug.cgi?id=231188 Reviewed by Alex Christensen. * inspector/remote/socket/RemoteInspectorSocket.cpp: (Inspector::RemoteInspector::backendCommands const): 2021-10-18 Yusuke Suzuki Wasm Table can take arbitrary default value https://bugs.webkit.org/show_bug.cgi?id=231933 rdar://84327812 Reviewed by Robin Morisset. * wasm/WasmTable.cpp: (JSC::Wasm::Table::grow): 2021-10-19 Chris Dumez Unreviewed build fix. * DerivedSources-input.xcfilelist: 2021-10-18 Phillip Mates shadow realms implementation https://bugs.webkit.org/show_bug.cgi?id=230602 Reviewed by Yusuke Suzuki. Implementation of the Shadow Realms proposal (stage 3 in TC39) [1] Main APIs added are - `new ShadowRealm()` creates an object that has its own global object and module graph. - ShadowRealm.prototype.evaluate(sourceText) this allows for evaluating code in the context of the realm, which has its own module graph and global object. - ShadowRealm.prototype.importValue(specifier, exportName) this allows importing module exports in the the context of the realm, which has its own module graph and global object. The main detail of the Shadow Realm implementation is that values passed between realms must be either primitives or wrapped callables. Wrapped callables themselves are callables that check that their arguments and return values are also either primitives or wrapped callables. This detail is implemented via JS builtins + a few new intrinsics. Can be enabled using `--useShadowRealm=true` [1]: https://github.com/tc39/proposal-shadowrealm * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * builtins/BuiltinNames.h: * builtins/ShadowRealmPrototype.js: Added. (globalPrivate.wrap.wrapped): (globalPrivate.wrap): (evaluate): (importValue): * bytecode/BytecodeIntrinsicRegistry.h: * bytecode/LinkTimeConstant.h: * bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::emitIsShadowRealm): * bytecompiler/NodesCodegen.cpp: * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * parser/Parser.cpp: (JSC::Parser::parseMemberExpression): * runtime/CommonIdentifiers.h: * runtime/IndirectEvalExecutable.cpp: (JSC::IndirectEvalExecutable::createImpl): (JSC::IndirectEvalExecutable::create): (JSC::IndirectEvalExecutable::tryCreate): * runtime/IndirectEvalExecutable.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): (JSC::JSGlobalObject::createWithCustomMethodTable): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::shadowRealmPrototype const): (JSC::JSGlobalObject::shadowRealmStructure const): * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSType.cpp: (WTF::printInternal): * runtime/JSType.h: * runtime/OptionsList.h: * runtime/ShadowRealmConstructor.cpp: Added. (JSC::ShadowRealmConstructor::ShadowRealmConstructor): (JSC::ShadowRealmConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmConstructor.h: Added. * runtime/ShadowRealmObject.cpp: Added. (JSC::ShadowRealmObject::ShadowRealmObject): (JSC::ShadowRealmObject::visitChildrenImpl): (JSC::ShadowRealmObject::create): (JSC::ShadowRealmObject::finishCreation): * runtime/ShadowRealmObject.h: Added. * runtime/ShadowRealmPrototype.cpp: Added. (JSC::ShadowRealmPrototype::ShadowRealmPrototype): (JSC::ShadowRealmPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmPrototype.h: Added. * runtime/VM.cpp: * runtime/VM.h: 2021-10-18 Saam Barati Don't load metadata base pointer in EXTRA_CTI_THUNKS https://bugs.webkit.org/show_bug.cgi?id=231850 Reviewed by Yusuke Suzuki. We were loading the metadata table base pointer dynamically. But in unlinked baseline JIT, it's already pinned in a register. Let's just use the register instead of recomputing what's already there. This is a small speedup in throughput of unlinked baseline JIT code for scope operations. * jit/JITPropertyAccess.cpp: (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::generateOpGetFromScopeThunk): 2021-10-18 Yusuke Suzuki [JSC] Use USE(LARGE_TYPED_ARRAY) https://bugs.webkit.org/show_bug.cgi?id=231885 Reviewed by Sam Weinig. Fix USE(ADDRESS64) with USE(LARGE_TYPED_ARRAY). USE(ADDRESS64) is not correct (it should be CPU(ADDRESS64)). It is coverted by JSTests/stress/typed-array-large-eventually-oob.js. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-10-18 Yusuke Suzuki [JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL https://bugs.webkit.org/show_bug.cgi?id=231884 rdar://84357099 Reviewed by Robin Morisset. The child5 of PutByVal should be KnownInt32Use or Int52RepUse. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): 2021-10-16 Mark Lam Make LLIntAssembly.h more readable. https://bugs.webkit.org/show_bug.cgi?id=231876 Reviewed by Yusuki Suzuki. In this patch, I did the following: 1. Changed `CodeOrigin` to only dump the filename, and not the full path. 2. Deferred printing the ".loc" metadata in `$asm.debugAnnotation` till we format the line to dump in `$asm.formatDump`. This enabled the ".loc" metadata to be dumped on the same line as the asm instruction. 3. Changed `$asm.codeOrigin` to not dump multiple codeOrigin comments. The only times when there appears to be "multiple" codeOrigins for any given instruction is if the instruction before it was elided, thereby leaving the elided instruction's codeOrigin to be mis-attributed to the subsequent instruction. 4. Moved the MIPS `Assembler.putStr` method to asm.rb. This method was already commonly used in arm.rb and arm64.rb previously. Hence, it belongs in common code. Also enhanced it to support indenting by the column width of ".loc" debug annotations if `$enableDebugAnnotations` is true. This keeps the ".loc" column on the left clear of other content, thereby making it easy to visually filter out that column when scanning through the generated asm code. 5. Changed some code that called `outp.puts` directly to call `$asm.putStr` instead. This yields the nice alignment for easy visual filtering described in (4). 6. Changed `$preferredCommentStartColumn` to be at column 40 to make the generated asm code more compact. However, if the backend is the C_LOOP, then change it back to 60 because C_LOOP code is more verbose and need the extra space. Demo time: Before this patch, LLIntAssembly.h looks like this: ``` #if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT OFFLINE_ASM_BEGIN OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart) ".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n" ".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n" ".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n" ".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n" ".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n" ".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n" ".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n" ".loc 1 1672\n" "\tbrk #0xc471\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1672 ".loc 1 1681\n" OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript) ".loc 1 1066\n" "\tpacibsp\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1066 ".loc 1 1070\n" "\tstp x29, x30, [sp, #-16]!\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1070 ".loc 1 1075\n" "\tmov x29, sp\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1075 ".loc 1 1090\n" "\tsub sp, x29, #176\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1090 ".loc 3 169\n" "\tmovz x13, #48040, lsl #0\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:169 ".loc 3 169\n" "\tadd x17, x1, x13, lsl #0\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:169 ".loc 3 169\n" "\tldr w4, [x17, #0]\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:169 ".loc 3 170\n" "\tcbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntry__checkVMEntryPermission) "\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:170 ".loc 3 172\n" "\tstr x1, [sp, #0]\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:172 ... ".loc 3 309\n" "\tmov x3, x0\n" // JavaScriptCore/llint/LowLevelInterpreter64.asm:309 ".loc 1 1\n" #if OS(DARWIN) "\tL_offlineasm_loh_adrp_1:\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1 "\tadrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE\n" "\tL_offlineasm_loh_ldr_1:\n" "\tldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF]\n" #elif OS(LINUX) "\tadrp x2, :got:" LOCAL_REFERENCE(g_config) "\n" "\tldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "]\n" #else #error Missing globaladdr implementation #endif ".loc 1 1\n" "\tadd x2, x2, #3072\n" // JavaScriptCore/llint/LowLevelInterpreter.asm:1 ``` After this patch, LLIntAssembly.h looks like this: ``` #if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT OFFLINE_ASM_BEGIN OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart) ".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n" ".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n" ".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n" ".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n" ".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n" ".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n" ".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n" ".loc 1 1672\n" "brk #0xc471 \n" // LowLevelInterpreter.asm:1672 ".loc 1 1681\n" OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript) ".loc 1 1066\n" "pacibsp \n" // LowLevelInterpreter.asm:1066 ".loc 1 1070\n" "stp x29, x30, [sp, #-16]! \n" // LowLevelInterpreter.asm:1070 ".loc 1 1075\n" "mov x29, sp \n" // LowLevelInterpreter.asm:1075 ".loc 1 1090\n" "sub sp, x29, #176 \n" // LowLevelInterpreter.asm:1090 ".loc 3 169\n" "movz x13, #48040, lsl #0 \n" // LowLevelInterpreter64.asm:169 "add x17, x1, x13, lsl #0 \n" "ldr w4, [x17, #0] \n" ".loc 3 170\n" "cbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntry__checkVMEntryPermission) " \n" // LowLevelInterpreter64.asm:170 ".loc 3 172\n" "str x1, [sp, #0] \n" // LowLevelInterpreter64.asm:172 ... ".loc 3 309\n" "mov x3, x0 \n" // LowLevelInterpreter64.asm:309 #if OS(DARWIN) ".loc 1 1\n" "L_offlineasm_loh_adrp_1: \n" // LowLevelInterpreter.asm:1 "adrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE \n" "L_offlineasm_loh_ldr_1: \n" "ldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF] \n" #elif OS(LINUX) "adrp x2, :got:" LOCAL_REFERENCE(g_config) " \n" "ldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "] \n" #else #error Missing globaladdr implementation #endif ".loc 1 1\n" "add x2, x2, #3072 \n" ``` * offlineasm/asm.rb: * offlineasm/cloop.rb: * offlineasm/config.rb: * offlineasm/mips.rb: * offlineasm/parser.rb: 2021-10-16 Yusuke Suzuki [JSC] Use SourceID in SamplingProfiler https://bugs.webkit.org/show_bug.cgi?id=231855 Reviewed by Mark Lam. SamplingProfiler was still using intptr_t. We replace it with SourceID. We also define internalSourceID and aggregatedExternalSourceID in SourceID.h. They are special SourceID internally used in SamplingProfiler. * bytecode/SourceID.h: * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::StackFrame::sourceID): (JSC::SamplingProfiler::reportTopFunctions): * runtime/SamplingProfiler.h: 2021-10-16 Robin Morisset Allow WASM to use up to 4GB https://bugs.webkit.org/show_bug.cgi?id=229353 rdar://81603447 Reviewed by Yusuke Suzuki. While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work: - 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being size_t. - This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size. In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52) - Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number. I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples - In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52 - I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B. - I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL. I then updated the runtime functions used by the slow paths to correctly update it. Unfortunately I ran out of time to add all the speculations/update all the fast paths. So the following will have to wait for a follow-up patch: - Accepting large indices in the fast path of GetByVal in the LLInt - Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess - Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array. Other minor changes in this patch: - Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0) - Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues. - Fixed a variety of obsolete comments - Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right) (there was already support for the same but with TrustedImm64) - Made various AbstractMacroAssembler function constexpr as part of the previous point * assembler/AbstractMacroAssembler.cpp: * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr): (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr): (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32): (JSC::AbstractMacroAssembler::Imm32::Imm32): (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const): (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64): (JSC::AbstractMacroAssembler::Imm64::Imm64): (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const): (JSC::AbstractMacroAssembler::canBlind): (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch): * assembler/MacroAssembler.h: (JSC::MacroAssembler::branch64): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch): (JSC::MacroAssemblerARM64::branch64): * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagArrayPtrLength64): (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted. * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::canBlind): (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch): * bytecode/AccessCase.cpp: (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::generateWithGuard): * bytecode/ArrayProfile.h: (JSC::ArrayProfile::setMayBeLargeTypedArray): (JSC::ArrayProfile::mayBeLargeTypedArray const): (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile): (JSC::UnlinkedArrayProfile::update): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine const): * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::ArrayMode): (JSC::DFG::ArrayMode::mayBeLargeTypedArray const): (JSC::DFG::ArrayMode::withType const): (JSC::DFG::ArrayMode::withSpeculation const): (JSC::DFG::ArrayMode::withConversion const): (JSC::DFG::ArrayMode::withTypeAndConversion const): (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const): (JSC::DFG::ArrayMode::speculationFromProfile): (JSC::DFG::ArrayMode::withSpeculationFromProfile const): (JSC::DFG::ArrayMode::withProfile const): (JSC::DFG::ArrayMode::operator== const): (JSC::DFG::ArrayMode::withArrayClass const): Deleted. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicGetter): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGCommon.h: (JSC::DFG::enableInt52): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::convertToGetArrayLength): (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted. * dfg/DFGGenerationInfo.h: * dfg/DFGHeapLocation.cpp: (WTF::printInternal): * dfg/DFGHeapLocation.h: * dfg/DFGIntegerRangeOptimizationPhase.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode): * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::newTypedArrayWithSize): (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck): * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): (JSC::DFG::SpeculativeJIT::compileGetArrayLength): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): (JSC::DFG::SpeculativeJIT::compileNewTypedArray): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): * dfg/DFGValidate.cpp: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::validateAIState): (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOutput.h: (JSC::FTL::Output::load64NonNegative): * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): * jit/JITOperations.cpp: (JSC::putByVal): (JSC::getByVal): * llint/LLIntOfflineAsmConfig.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::getByVal): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/ArrayBuffer.cpp: (JSC::SharedArrayBufferContents::SharedArrayBufferContents): (JSC::ArrayBufferContents::ArrayBufferContents): (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBuffer::create): (JSC::ArrayBuffer::createAdopted): (JSC::ArrayBuffer::createFromBytes): (JSC::ArrayBuffer::tryCreate): (JSC::ArrayBuffer::createUninitialized): (JSC::ArrayBuffer::tryCreateUninitialized): (JSC::ArrayBuffer::createInternal): (JSC::ArrayBuffer::clampValue): (JSC::ArrayBuffer::clampIndex const): (JSC::ArrayBuffer::sliceWithClampedIndex const): * runtime/ArrayBuffer.h: (JSC::ArrayBufferContents::sizeInBytes const): (JSC::ArrayBuffer::byteLength const): (JSC::ArrayBuffer::gcSizeEstimateInBytes const): * runtime/ArrayBufferView.cpp: (JSC::ArrayBufferView::ArrayBufferView): * runtime/ArrayBufferView.h: (JSC::ArrayBufferView::byteOffset const): (JSC::ArrayBufferView::byteLength const): (JSC::ArrayBufferView::verifyByteOffsetAlignment): (JSC::ArrayBufferView::verifySubRangeLength): (JSC::ArrayBufferView::clampOffsetAndNumElements): (JSC::ArrayBufferView::setImpl): (JSC::ArrayBufferView::setRangeImpl): (JSC::ArrayBufferView::getRangeImpl): (JSC::ArrayBufferView::zeroRangeImpl): (JSC::ArrayBufferView::calculateOffsetAndLength): Deleted. * runtime/AtomicsObject.cpp: * runtime/DataView.cpp: (JSC::DataView::DataView): (JSC::DataView::create): * runtime/DataView.h: * runtime/GenericTypedArrayView.h: * runtime/GenericTypedArrayViewInlines.h: (JSC::GenericTypedArrayView::GenericTypedArrayView): (JSC::GenericTypedArrayView::create): (JSC::GenericTypedArrayView::tryCreate): (JSC::GenericTypedArrayView::createUninitialized): (JSC::GenericTypedArrayView::tryCreateUninitialized): (JSC::GenericTypedArrayView::subarray const): Deleted. * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::byteLength const): (JSC::JSArrayBufferView::slowDownAndWasteMemory): (JSC::JSArrayBufferView::possiblySharedImpl): * runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::sizeOf): (JSC::JSArrayBufferView::ConstructionContext::length const): (JSC::JSArrayBufferView::length const): * runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::byteOffsetImpl): (JSC::JSArrayBufferView::byteOffset): (JSC::JSArrayBufferView::byteOffsetConcurrently): * runtime/JSCJSValue.h: * runtime/JSCJSValueInlines.h: (JSC::JSValue::toIndex const): (JSC::JSValue::toTypedArrayIndex const): * runtime/JSDataView.cpp: (JSC::JSDataView::create): (JSC::JSDataView::createUninitialized): (JSC::JSDataView::set): (JSC::JSDataView::setIndex): * runtime/JSDataView.h: * runtime/JSDataViewPrototype.cpp: (JSC::getData): (JSC::setData): * runtime/JSGenericTypedArrayView.h: * runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewWithArguments): (JSC::constructGenericTypedArrayViewImpl): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::create): (JSC::JSGenericTypedArrayView::createWithFastVector): (JSC::JSGenericTypedArrayView::createUninitialized): (JSC::JSGenericTypedArrayView::validateRange): (JSC::JSGenericTypedArrayView::setWithSpecificType): (JSC::JSGenericTypedArrayView::set): * runtime/JSObject.h: (JSC::JSObject::putByIndexInline): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::trySetIndexQuickly): (JSC::JSObject::canSetIndexQuickly): Deleted. * runtime/JSObjectInlines.h: (JSC::JSObject::getIndexQuicklyForTypedArray const): (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType): (JSC::JSObject::trySetIndexQuicklyForTypedArray): (JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted. * runtime/Operations.h: (JSC::getByValWithIndex): * wasm/WasmPageCount.h: 2021-10-15 Ross Kirsling Realize Mac CMake build of WebCore and WebKit https://bugs.webkit.org/show_bug.cgi?id=231749 Reviewed by Alex Christensen. * PlatformMac.cmake: * shell/PlatformMac.cmake: 2021-10-15 Yusuke Suzuki [JSC] Optimize Structure::getConcurrently https://bugs.webkit.org/show_bug.cgi?id=231825 Reviewed by Filip Pizlo. From artrace data, we found that Structure::getConcurrently is taking fair amount of time in Speedometer2 *in the main thread*! This is because Structure::getConcurrently is used in PropertyCondition, and its validation can be called in the main thread when watched Structure transition happens, ObjectPropertyConditionSet is created for IC etc. Structure::getConcurrently is slow since it is using Structure::forEachPropertyConcurrently. We can optimize Structure::getConcurrently since, 1. We do not need to track seen properties via seenProperties HashSet. 2. We can handle TransitionKind::PropertyDeletion. 3. We can use PropertyTable::get. We are seeing consistent 0.4% improvement in Speedometer2 (I ran 120 Speedometer2 runs twice and both said 0.4% improvement). ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |106.201667 |106.030000 |0.998384 | 0.666695 | | VueJS-TodoMVC |21.955000 |21.985000 |1.001366 | 0.898294 | | EmberJS-TodoMVC |120.720000 |119.938333 |0.993525 | 0.055063 | | BackboneJS-TodoMVC |40.306667 |40.023333 |0.992971 | 0.054858 | | Preact-TodoMVC |16.273333 |15.968333 |0.981258 | 0.135893 | | AngularJS-TodoMVC |123.325000 |122.596667 |0.994094 | 0.079212 | | Vanilla-ES2015-TodoMVC |60.116667 |60.168333 |1.000859 | 0.691981 | | Inferno-TodoMVC |58.945000 |58.538333 |0.993101 | 0.155753 | | Flight-TodoMVC |57.846667 |57.808333 |0.999337 | 0.868408 | | Angular2-TypeScript-TodoMVC |38.595000 |38.260000 |0.991320 | 0.392602 | | VanillaJS-TodoMVC |50.316667 |50.185000 |0.997383 | 0.609335 | | jQuery-TodoMVC |208.376667 |208.933333 |1.002671 | 0.196406 | | EmberJS-Debug-TodoMVC |338.481667 |336.755000 |0.994899 | 0.007485 | | React-TodoMVC |82.533333 |82.091667 |0.994649 | 0.037482 | | React-Redux-TodoMVC |133.703333 |133.258333 |0.996672 | 0.069242 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.346667 |59.600000 |1.004269 | 0.203370 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 282.95715 b mean = 284.07606 pValue = 0.0013877157 (Bigger means are better.) 1.004 times better Results ARE significant * runtime/Structure.cpp: (JSC::Structure::getConcurrently): 2021-10-15 Geza Lore [JSC][32bit] Fix CSR restore on DFG tail calls, add extra register on ARMv7 https://bugs.webkit.org/show_bug.cgi?id=230622 Reviewed by Saam Barati. This patch does two things: 1. Adds an extra callee save register (CSR) to be available to DFG on ARMv7. To do this properly required the following: 2. Implements the necessary shuffling in CallFrameShuffler on 32-bit architectures that is required to restore CSRs properly after a tail call on these architectures. This also fixes the remaining failures in the 32-bit build of the unlinked baseline JIT. * bytecode/ValueRecovery.cpp: (JSC::ValueRecovery::dumpInContext const): * bytecode/ValueRecovery.h: (JSC::ValueRecovery::calleeSaveRegDisplacedInJSStack): (JSC::ValueRecovery::isInJSStack const): (JSC::ValueRecovery::dataFormat const): (JSC::ValueRecovery::withLocalsOffset const): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * jit/CachedRecovery.cpp: (JSC::CachedRecovery::loadsIntoGPR const): * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::setupCalleeSaveRegisters): * jit/CallFrameShuffleData.h: * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::CallFrameShuffler): * jit/CallFrameShuffler.h: (JSC::CallFrameShuffler::snapshot const): (JSC::CallFrameShuffler::addNew): * jit/CallFrameShuffler32_64.cpp: (JSC::CallFrameShuffler::emitLoad): (JSC::CallFrameShuffler::emitDisplace): * jit/GPRInfo.h: (JSC::GPRInfo::toRegister): (JSC::GPRInfo::toIndex): * jit/RegisterSet.cpp: (JSC::RegisterSet::dfgCalleeSaveRegisters): * llint/LowLevelInterpreter32_64.asm: 2021-10-15 Robin Morisset Revert r284230, my last fixes to the watch build make it break tests https://bugs.webkit.org/show_bug.cgi?id=231797 Unreviewed. Revert "Allow WASM to use up to 4GB" * assembler/AbstractMacroAssembler.cpp: * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr): (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr): (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32): (JSC::AbstractMacroAssembler::Imm32::Imm32): (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const): (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64): (JSC::AbstractMacroAssembler::Imm64::Imm64): (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const): (JSC::AbstractMacroAssembler::canBlind): (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch): * assembler/MacroAssembler.h: (JSC::MacroAssembler::and64): (JSC::MacroAssembler::branch64): Deleted. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch): * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): (JSC::MacroAssemblerARM64E::untagArrayPtrLength64): Deleted. * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::canBlind): (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch): * bytecode/AccessCase.cpp: (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::generateWithGuard): * bytecode/ArrayProfile.h: (JSC::UnlinkedArrayProfile::update): (JSC::ArrayProfile::setMayBeLargeTypedArray): Deleted. (JSC::ArrayProfile::mayBeLargeTypedArray const): Deleted. (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile): Deleted. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine const): * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::ArrayMode): (JSC::DFG::ArrayMode::action const): (JSC::DFG::ArrayMode::withSpeculation const): (JSC::DFG::ArrayMode::withArrayClass const): (JSC::DFG::ArrayMode::withSpeculationFromProfile const): (JSC::DFG::ArrayMode::withProfile const): (JSC::DFG::ArrayMode::withType const): (JSC::DFG::ArrayMode::withConversion const): (JSC::DFG::ArrayMode::withTypeAndConversion const): (JSC::DFG::ArrayMode::operator== const): (JSC::DFG::ArrayMode::mayBeLargeTypedArray const): Deleted. (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const): Deleted. (JSC::DFG::ArrayMode::speculationFromProfile): Deleted. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicGetter): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGCommon.h: (JSC::DFG::enableInt52): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::prependGetArrayLength): * dfg/DFGGenerationInfo.h: * dfg/DFGHeapLocation.cpp: (WTF::printInternal): * dfg/DFGHeapLocation.h: * dfg/DFGIntegerRangeOptimizationPhase.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode): * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::newTypedArrayWithSize): (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck): * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): (JSC::DFG::SpeculativeJIT::compileGetArrayLength): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): (JSC::DFG::SpeculativeJIT::compileNewTypedArray): (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): Deleted. * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): Deleted. (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): Deleted. (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): Deleted. * dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): * dfg/DFGValidate.cpp: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::validateAIState): (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset): (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): Deleted. (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52): Deleted. (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): Deleted. (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52): Deleted. (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): Deleted. * ftl/FTLOutput.h: (JSC::FTL::Output::load32NonNegative): (JSC::FTL::Output::load64NonNegative): Deleted. * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): * jit/JITOperations.cpp: (JSC::putByVal): (JSC::getByVal): * llint/LLIntOfflineAsmConfig.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::getByVal): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/ArrayBuffer.cpp: (JSC::SharedArrayBufferContents::SharedArrayBufferContents): (JSC::ArrayBufferContents::ArrayBufferContents): (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBuffer::create): (JSC::ArrayBuffer::createAdopted): (JSC::ArrayBuffer::createFromBytes): (JSC::ArrayBuffer::tryCreate): (JSC::ArrayBuffer::createUninitialized): (JSC::ArrayBuffer::tryCreateUninitialized): (JSC::ArrayBuffer::createInternal): (JSC::ArrayBuffer::clampValue): (JSC::ArrayBuffer::clampIndex const): (JSC::ArrayBuffer::sliceWithClampedIndex const): * runtime/ArrayBuffer.h: (JSC::ArrayBufferContents::sizeInBytes const): (JSC::ArrayBuffer::byteLength const): (JSC::ArrayBuffer::gcSizeEstimateInBytes const): * runtime/ArrayBufferView.cpp: (JSC::ArrayBufferView::ArrayBufferView): * runtime/ArrayBufferView.h: (JSC::ArrayBufferView::byteOffset const): (JSC::ArrayBufferView::byteLength const): (JSC::ArrayBufferView::verifyByteOffsetAlignment): (JSC::ArrayBufferView::verifySubRangeLength): (JSC::ArrayBufferView::clampOffsetAndNumElements): (JSC::ArrayBufferView::setImpl): (JSC::ArrayBufferView::setRangeImpl): (JSC::ArrayBufferView::getRangeImpl): (JSC::ArrayBufferView::zeroRangeImpl): (JSC::ArrayBufferView::calculateOffsetAndLength): * runtime/AtomicsObject.cpp: * runtime/DataView.cpp: (JSC::DataView::DataView): (JSC::DataView::create): * runtime/DataView.h: * runtime/GenericTypedArrayView.h: * runtime/GenericTypedArrayViewInlines.h: (JSC::GenericTypedArrayView::GenericTypedArrayView): (JSC::GenericTypedArrayView::create): (JSC::GenericTypedArrayView::tryCreate): (JSC::GenericTypedArrayView::createUninitialized): (JSC::GenericTypedArrayView::tryCreateUninitialized): (JSC::GenericTypedArrayView::subarray const): * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::byteLength const): (JSC::JSArrayBufferView::slowDownAndWasteMemory): (JSC::JSArrayBufferView::possiblySharedImpl): * runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::sizeOf): (JSC::JSArrayBufferView::ConstructionContext::length const): (JSC::JSArrayBufferView::length const): * runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::byteOffsetImpl): (JSC::JSArrayBufferView::byteOffset): (JSC::JSArrayBufferView::byteOffsetConcurrently): * runtime/JSCJSValue.h: * runtime/JSCJSValueInlines.h: (JSC::JSValue::toIndex const): (JSC::JSValue::toTypedArrayIndex const): Deleted. * runtime/JSDataView.cpp: (JSC::JSDataView::create): (JSC::JSDataView::createUninitialized): (JSC::JSDataView::set): (JSC::JSDataView::setIndex): * runtime/JSDataView.h: * runtime/JSDataViewPrototype.cpp: (JSC::getData): (JSC::setData): * runtime/JSGenericTypedArrayView.h: * runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewWithArguments): (JSC::constructGenericTypedArrayViewImpl): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::create): (JSC::JSGenericTypedArrayView::createWithFastVector): (JSC::JSGenericTypedArrayView::createUninitialized): (JSC::JSGenericTypedArrayView::validateRange): (JSC::JSGenericTypedArrayView::setWithSpecificType): (JSC::JSGenericTypedArrayView::set): * runtime/JSObject.h: (JSC::JSObject::putByIndexInline): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::canSetIndexQuickly): (JSC::JSObject::trySetIndexQuickly): Deleted. * runtime/JSObjectInlines.h: (JSC::JSObject::canSetIndexQuicklyForTypedArray const): (JSC::JSObject::getIndexQuicklyForTypedArray const): (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType): Deleted. (JSC::JSObject::trySetIndexQuicklyForTypedArray): Deleted. * runtime/Operations.h: (JSC::getByValWithIndex): * wasm/WasmPageCount.h: 2021-10-14 Robin Morisset Allow WASM to use up to 4GB https://bugs.webkit.org/show_bug.cgi?id=229353 rdar://81603447 Reviewed by Yusuke Suzuki. While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work: - 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being size_t. - This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size. In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52) - Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number. I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples - In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52 - I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B. - I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL. I then updated the runtime functions used by the slow paths to correctly update it. Unfortunately I ran out of time to add all the speculations/update all the fast paths. So the following will have to wait for a follow-up patch: - Accepting large indices in the fast path of GetByVal in the LLInt - Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess - Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array. Other minor changes in this patch: - Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0) - Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues. - Fixed a variety of obsolete comments - Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right) (there was already support for the same but with TrustedImm64) - Made various AbstractMacroAssembler function constexpr as part of the previous point * assembler/AbstractMacroAssembler.cpp: * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr): (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr): (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32): (JSC::AbstractMacroAssembler::Imm32::Imm32): (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const): (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64): (JSC::AbstractMacroAssembler::Imm64::Imm64): (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const): (JSC::AbstractMacroAssembler::canBlind): (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch): * assembler/MacroAssembler.h: (JSC::MacroAssembler::branch64): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch): (JSC::MacroAssemblerARM64::branch64): * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagArrayPtrLength64): (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted. * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::canBlind): (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch): * bytecode/AccessCase.cpp: (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::generateWithGuard): * bytecode/ArrayProfile.h: (JSC::ArrayProfile::setMayBeLargeTypedArray): (JSC::ArrayProfile::mayBeLargeTypedArray const): (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile): (JSC::UnlinkedArrayProfile::update): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine const): * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::ArrayMode): (JSC::DFG::ArrayMode::mayBeLargeTypedArray const): (JSC::DFG::ArrayMode::withType const): (JSC::DFG::ArrayMode::withSpeculation const): (JSC::DFG::ArrayMode::withConversion const): (JSC::DFG::ArrayMode::withTypeAndConversion const): (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const): (JSC::DFG::ArrayMode::speculationFromProfile): (JSC::DFG::ArrayMode::withSpeculationFromProfile const): (JSC::DFG::ArrayMode::withProfile const): (JSC::DFG::ArrayMode::operator== const): (JSC::DFG::ArrayMode::withArrayClass const): Deleted. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicGetter): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGCommon.h: (JSC::DFG::enableInt52): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::convertToGetArrayLength): (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted. * dfg/DFGGenerationInfo.h: * dfg/DFGHeapLocation.cpp: (WTF::printInternal): * dfg/DFGHeapLocation.h: * dfg/DFGIntegerRangeOptimizationPhase.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode): * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::newTypedArrayWithSize): (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck): * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): (JSC::DFG::SpeculativeJIT::compileGetArrayLength): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): (JSC::DFG::SpeculativeJIT::compileNewTypedArray): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): * dfg/DFGValidate.cpp: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::validateAIState): (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOutput.h: (JSC::FTL::Output::load64NonNegative): * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): * jit/JITOperations.cpp: (JSC::putByVal): (JSC::getByVal): * llint/LLIntOfflineAsmConfig.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::getByVal): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/ArrayBuffer.cpp: (JSC::SharedArrayBufferContents::SharedArrayBufferContents): (JSC::ArrayBufferContents::ArrayBufferContents): (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBuffer::create): (JSC::ArrayBuffer::createAdopted): (JSC::ArrayBuffer::createFromBytes): (JSC::ArrayBuffer::tryCreate): (JSC::ArrayBuffer::createUninitialized): (JSC::ArrayBuffer::tryCreateUninitialized): (JSC::ArrayBuffer::createInternal): (JSC::ArrayBuffer::clampValue): (JSC::ArrayBuffer::clampIndex const): (JSC::ArrayBuffer::sliceWithClampedIndex const): * runtime/ArrayBuffer.h: (JSC::ArrayBufferContents::sizeInBytes const): (JSC::ArrayBuffer::byteLength const): (JSC::ArrayBuffer::gcSizeEstimateInBytes const): * runtime/ArrayBufferView.cpp: (JSC::ArrayBufferView::ArrayBufferView): * runtime/ArrayBufferView.h: (JSC::ArrayBufferView::byteOffset const): (JSC::ArrayBufferView::byteLength const): (JSC::ArrayBufferView::verifyByteOffsetAlignment): (JSC::ArrayBufferView::verifySubRangeLength): (JSC::ArrayBufferView::clampOffsetAndNumElements): (JSC::ArrayBufferView::setImpl): (JSC::ArrayBufferView::setRangeImpl): (JSC::ArrayBufferView::getRangeImpl): (JSC::ArrayBufferView::zeroRangeImpl): (JSC::ArrayBufferView::calculateOffsetAndLength): Deleted. * runtime/AtomicsObject.cpp: * runtime/DataView.cpp: (JSC::DataView::DataView): (JSC::DataView::create): * runtime/DataView.h: * runtime/GenericTypedArrayView.h: * runtime/GenericTypedArrayViewInlines.h: (JSC::GenericTypedArrayView::GenericTypedArrayView): (JSC::GenericTypedArrayView::create): (JSC::GenericTypedArrayView::tryCreate): (JSC::GenericTypedArrayView::createUninitialized): (JSC::GenericTypedArrayView::tryCreateUninitialized): (JSC::GenericTypedArrayView::subarray const): Deleted. * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::byteLength const): (JSC::JSArrayBufferView::slowDownAndWasteMemory): (JSC::JSArrayBufferView::possiblySharedImpl): * runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::sizeOf): (JSC::JSArrayBufferView::ConstructionContext::length const): (JSC::JSArrayBufferView::length const): * runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::byteOffsetImpl): (JSC::JSArrayBufferView::byteOffset): (JSC::JSArrayBufferView::byteOffsetConcurrently): * runtime/JSCJSValue.h: * runtime/JSCJSValueInlines.h: (JSC::JSValue::toIndex const): (JSC::JSValue::toTypedArrayIndex const): * runtime/JSDataView.cpp: (JSC::JSDataView::create): (JSC::JSDataView::createUninitialized): (JSC::JSDataView::set): (JSC::JSDataView::setIndex): * runtime/JSDataView.h: * runtime/JSDataViewPrototype.cpp: (JSC::getData): (JSC::setData): * runtime/JSGenericTypedArrayView.h: * runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewWithArguments): (JSC::constructGenericTypedArrayViewImpl): * runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView::create): (JSC::JSGenericTypedArrayView::createWithFastVector): (JSC::JSGenericTypedArrayView::createUninitialized): (JSC::JSGenericTypedArrayView::validateRange): (JSC::JSGenericTypedArrayView::setWithSpecificType): (JSC::JSGenericTypedArrayView::set): * runtime/JSObject.h: (JSC::JSObject::putByIndexInline): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::trySetIndexQuickly): (JSC::JSObject::canSetIndexQuickly): Deleted. * runtime/JSObjectInlines.h: (JSC::JSObject::getIndexQuicklyForTypedArray const): (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType): (JSC::JSObject::trySetIndexQuicklyForTypedArray): (JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted. * runtime/Operations.h: (JSC::getByValWithIndex): * wasm/WasmPageCount.h: 2021-10-14 Saam Barati Make unlinked Baseline JIT scope operations bias the order of checks to the ResolveType that profiling tells us we are likely to be https://bugs.webkit.org/show_bug.cgi?id=231715 Reviewed by Yusuke Suzuki. This is a small throughout win in the code generated by unlinked baseline JIT. * jit/JIT.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::emit_op_put_to_scope): 2021-10-14 Alex Christensen Remove Variant.h https://bugs.webkit.org/show_bug.cgi?id=231744 Reviewed by Darin Adler. * jit/AssemblyHelpers.h: * jit/SnippetReg.h: * parser/Lexer.cpp: * parser/VariableEnvironment.h: * runtime/BytecodeCacheError.h: * runtime/CachePayload.h: * runtime/CacheUpdate.h: * runtime/TemporalObject.h: * runtime/TemporalTimeZone.h: * wasm/WasmLLIntGenerator.cpp: 2021-10-14 Tadeu Zagallo Wasm LLInt should zero bytecodeIndex before throwing https://bugs.webkit.org/show_bug.cgi?id=231688 Reviewed by Yusuke Suzuki. After r283852, the unwinder can now ask WebAssembly frames for their bytecodeIndex. We do write to the bytecodeIndex when throwing from the wasm `throw` opcode, but we failed to write when trapping (e.g. throwing an OOB or Unreachable). The value of the bytecodeIndex in this is case is not interesting, since these exceptions can't be caught from Wasm, all we need to know is ensure there isn't an invalid left-over value in that stack slot, so we zero it. * llint/WebAssembly.asm: 2021-10-14 Myles C. Maxfield All the SDKVariant.xcconfig files should match https://bugs.webkit.org/show_bug.cgi?id=231663 Reviewed by Youenn Fablet. The linter says they're all supposed to match. Source/ThirdParty/libwebrtc/Configurations/SDKVariant.xcconfig has an extra section, and if you delete that section the build fails, so this patch broadcasts that extra section to all the other SDKVariant.xcconfig files. * Configurations/SDKVariant.xcconfig: 2021-10-14 Chris Dumez Unreviewed build fix with recent SDKs. Use std::invoke_result<> instead of std::result_of<>, as it was deprecated in C++17. * runtime/JSCJSValue.h: * runtime/JSCJSValueInlines.h: (JSC::JSValue::getPropertySlot const): * runtime/JSObject.h: * runtime/JSObjectInlines.h: (JSC::JSObject::getPropertySlot const): * runtime/ParseInt.h: (JSC::toStringView): 2021-10-14 Zan Dobersek [RISCV64] Support logical operations with immediates on BaseIndex addresses in LLInt https://bugs.webkit.org/show_bug.cgi?id=231734 Reviewed by Yusuke Suzuki. RISCV64 offlineasm implementation gains support for performing logical operations with immediate values on BaseIndex adresses, fixing the build and bringing things back into operational state. For this to function properly, BaseIndex loading is reworked so that no additional scratch register is necessary for computing the target address. * offlineasm/riscv64.rb: 2021-10-14 Commit Queue Unreviewed, reverting r284151. https://bugs.webkit.org/show_bug.cgi?id=231740 WTR Reverted changeset: "Test coverage for JSC shadow realms implementation" https://bugs.webkit.org/show_bug.cgi?id=230602 https://commits.webkit.org/r284151 2021-10-14 Phillip Mates shadow realms implementation https://bugs.webkit.org/show_bug.cgi?id=230602 Reviewed by Yusuke Suzuki. Implementation of the Shadow Realms proposal (stage 3 in TC39) [1] Main APIs added are - `new ShadowRealm()` creates an object that has its own global object and module graph. - ShadowRealm.prototype.evaluate(sourceText) this allows for evaluating code in the context of the realm, which has its own module graph and global object. - ShadowRealm.prototype.importValue(specifier, exportName) this allows importing module exports in the the context of the realm, which has its own module graph and global object. The main detail of the Shadow Realm implementation is that values passed between realms must be either primitives or wrapped callables. Wrapped callables themselves are callables that check that their arguments and return values are also either primitives or wrapped callables. This detail is implemented via JS builtins + a few new intrinsics. Can be enabled using `--useShadowRealm=true` [1]: https://github.com/tc39/proposal-shadowrealm * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * builtins/BuiltinNames.h: * builtins/ShadowRealmPrototype.js: Added. (globalPrivate.wrap.wrapped): (globalPrivate.wrap): (evaluate): (importValue): * bytecode/BytecodeIntrinsicRegistry.h: * bytecode/LinkTimeConstant.h: * bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::emitIsShadowRealm): * bytecompiler/NodesCodegen.cpp: * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * parser/Parser.cpp: (JSC::Parser::parseMemberExpression): * runtime/CommonIdentifiers.h: * runtime/IndirectEvalExecutable.cpp: (JSC::IndirectEvalExecutable::createImpl): (JSC::IndirectEvalExecutable::create): (JSC::IndirectEvalExecutable::tryCreate): * runtime/IndirectEvalExecutable.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): (JSC::JSGlobalObject::createWithCustomMethodTable): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::shadowRealmPrototype const): (JSC::JSGlobalObject::shadowRealmStructure const): * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSType.cpp: (WTF::printInternal): * runtime/JSType.h: * runtime/OptionsList.h: * runtime/ShadowRealmConstructor.cpp: Added. (JSC::ShadowRealmConstructor::ShadowRealmConstructor): (JSC::ShadowRealmConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmConstructor.h: Added. * runtime/ShadowRealmObject.cpp: Added. (JSC::ShadowRealmObject::ShadowRealmObject): (JSC::ShadowRealmObject::visitChildrenImpl): (JSC::ShadowRealmObject::create): (JSC::ShadowRealmObject::finishCreation): * runtime/ShadowRealmObject.h: Added. * runtime/ShadowRealmPrototype.cpp: Added. (JSC::ShadowRealmPrototype::ShadowRealmPrototype): (JSC::ShadowRealmPrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ShadowRealmPrototype.h: Added. * runtime/VM.cpp: * runtime/VM.h: 2021-10-13 Yusuke Suzuki Unreviewed, speculative build fix with new clang Speculative since I cannot install this clang now. * b3/B3ValueRep.h: 2021-10-13 Jean-Yves Avenard Clearly distinguish serial from concurrent WorkQueue https://bugs.webkit.org/show_bug.cgi?id=231418 rdar://problem/84021977 Reviewed by Chris Dumez. Replace instances of WorkQueue being constructed as a concurrent one with ConcurrentWorkQueue. Remove the now unnecessary use of WorkQueue::Type::Serial in constructor. * jit/ExecutableAllocator.cpp: (JSC::dumpJITMemory): * runtime/Watchdog.cpp: (JSC::Watchdog::Watchdog): 2021-10-13 Yusuke Suzuki Unreviewed, build fix with new clang * wasm/WasmValueLocation.h: 2021-10-13 Yusuke Suzuki [JSC] Update adjusted thread numbers https://bugs.webkit.org/show_bug.cgi?id=231696 Reviewed by Saam Barati. This adjusted numbers were empirically obtained at that time. But after that, we switched bmalloc to libpas in ARM64 macOS so that we removed scalability bottleneck in concurrent compilers. We evaluated and adjusted the configuration again. It improves Speedometer2 by 0.9% and JetStream2 by 0.7%. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |116.361667 |115.145000 |0.989544 | 0.000869 (significant) | | VueJS-TodoMVC |23.195000 |22.483333 |0.969318 | 0.002243 (significant) | | EmberJS-TodoMVC |124.720000 |121.211667 |0.971870 | 0.000000 (significant) | | BackboneJS-TodoMVC |43.923333 |43.771667 |0.996547 | 0.338425 | | Preact-TodoMVC |16.791667 |17.013333 |1.013201 | 0.337214 | | AngularJS-TodoMVC |129.860000 |128.475000 |0.989335 | 0.000838 (significant) | | Vanilla-ES2015-TodoMVC |61.703333 |61.625000 |0.998730 | 0.534118 | | Inferno-TodoMVC |62.638333 |62.101667 |0.991432 | 0.045766 | | Flight-TodoMVC |63.878333 |63.723333 |0.997574 | 0.578999 | | Angular2-TypeScript-TodoMVC |41.601667 |40.015000 |0.961861 | 0.000070 (significant) | | VanillaJS-TodoMVC |51.065000 |50.830000 |0.995398 | 0.284824 | | jQuery-TodoMVC |213.223333 |212.976667 |0.998843 | 0.536898 | | EmberJS-Debug-TodoMVC |333.051667 |331.588333 |0.995606 | 0.032867 | | React-TodoMVC |82.665000 |82.540000 |0.998488 | 0.542365 | | React-Redux-TodoMVC |134.823333 |133.665000 |0.991409 | 0.000002 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.983333 |59.941667 |0.999305 | 0.700077 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 271.53654 b mean = 274.08757 pValue = 0.0000000000 (Bigger means are better.) 1.009 times better Results ARE significant ------------------------------------------------------------------------------------------------------------------------- | subtest | pts | pts | b / a | pValue (significance using False Discovery Rate) | ------------------------------------------------------------------------------------------------------------------------- | gaussian-blur |545.633826 |544.387097 |0.997715 | 0.632889 | | HashSet-wasm |47.725969 |53.977426 |1.130986 | 0.014208 | | gcc-loops-wasm |46.592278 |45.484195 |0.976217 | 0.188166 | | json-parse-inspector |252.822356 |254.060654 |1.004898 | 0.261381 | | prepack-wtb |60.534710 |60.580410 |1.000755 | 0.932640 | | date-format-xparb-SP |445.456679 |450.988456 |1.012418 | 0.563115 | | WSL |1.814989 |1.806757 |0.995464 | 0.035202 | | OfflineAssembler |191.018184 |191.527453 |1.002666 | 0.512619 | | cdjs |194.872003 |197.611972 |1.014060 | 0.006522 | | UniPoker |522.254384 |520.751124 |0.997122 | 0.738800 | | json-stringify-inspector |272.090046 |269.563607 |0.990715 | 0.156680 | | crypto-sha1-SP |788.203441 |786.796976 |0.998216 | 0.889433 | | Basic |705.357988 |704.506995 |0.998794 | 0.851524 | | chai-wtb |108.246674 |109.283047 |1.009574 | 0.313095 | | crypto-aes-SP |716.467647 |722.010176 |1.007736 | 0.589988 | | Babylon |669.393771 |670.186691 |1.001185 | 0.908244 | | string-unpack-code-SP |400.848798 |397.690936 |0.992122 | 0.379538 | | stanford-crypto-aes |448.517790 |450.916593 |1.005348 | 0.421547 | | raytrace |834.526654 |876.061864 |1.049771 | 0.000000 (significant) | | multi-inspector-code-load |398.195009 |400.638554 |1.006137 | 0.624663 | | hash-map |588.390020 |593.336508 |1.008407 | 0.032313 | | stanford-crypto-pbkdf2 |705.031717 |714.947310 |1.014064 | 0.451490 | | coffeescript-wtb |41.104563 |41.590079 |1.011812 | 0.104485 | | Box2D |457.517551 |457.676651 |1.000348 | 0.938025 | | lebab-wtb |63.284589 |63.746412 |1.007298 | 0.021550 | | tsf-wasm |121.000104 |116.584889 |0.963511 | 0.566993 | | base64-SP |627.310289 |631.360337 |1.006456 | 0.380323 | | navier-stokes |717.211598 |715.546883 |0.997679 | 0.776740 | | jshint-wtb |52.822264 |53.067727 |1.004647 | 0.265734 | | regex-dna-SP |444.626036 |444.565652 |0.999864 | 0.981250 | | async-fs |232.138408 |234.088380 |1.008400 | 0.084059 | | crypto-md5-SP |738.555352 |739.048809 |1.000668 | 0.936794 | | first-inspector-code-load |272.911902 |274.186589 |1.004671 | 0.223172 | | segmentation |53.421830 |53.253527 |0.996850 | 0.488595 | | typescript |26.619459 |26.404921 |0.991941 | 0.021613 | | octane-code-load |1229.345392 |1238.504125 |1.007450 | 0.273224 | | float-mm.c |17.443005 |17.474949 |1.001831 | 0.160549 | | quicksort-wasm |472.609429 |490.175315 |1.037168 | 0.134603 | | Air |420.285523 |422.507814 |1.005288 | 0.535574 | | splay |472.850630 |484.805521 |1.025283 | 0.202943 | | ai-astar |663.547782 |684.429114 |1.031469 | 0.035910 | | acorn-wtb |68.978436 |69.675311 |1.010103 | 0.085505 | | gbemu |159.998563 |154.256612 |0.964112 | 0.052665 | | richards |957.006036 |970.082604 |1.013664 | 0.080437 | | 3d-cube-SP |539.329388 |548.346324 |1.016719 | 0.126931 | | espree-wtb |71.026174 |72.950691 |1.027096 | 0.005430 | | bomb-workers |100.837095 |102.616328 |1.017645 | 0.024650 | | tagcloud-SP |293.735729 |295.721652 |1.006761 | 0.604433 | | mandreel |150.843346 |151.169263 |1.002161 | 0.406810 | | 3d-raytrace-SP |503.282797 |508.519569 |1.010405 | 0.330728 | | delta-blue |1064.779647 |1085.099791 |1.019084 | 0.111789 | | ML |143.453624 |144.404535 |1.006629 | 0.054459 | | regexp |465.598651 |469.139986 |1.007606 | 0.040131 | | crypto |1534.715604 |1518.978823 |0.989746 | 0.398916 | | richards-wasm |144.325337 |144.296964 |0.999803 | 0.993066 | | earley-boyer |831.216095 |862.902139 |1.038120 | 0.089284 | | octane-zlib |27.146237 |27.203847 |1.002122 | 0.668749 | | date-format-tofte-SP |390.913746 |391.453527 |1.001381 | 0.837893 | | n-body-SP |1142.063928 |1139.347984 |0.997622 | 0.764020 | | pdfjs |183.711632 |185.851180 |1.011646 | 0.144519 | | FlightPlanner |908.621057 |901.866743 |0.992566 | 0.434806 | | uglify-js-wtb |34.644842 |34.797497 |1.004406 | 0.126209 | | babylon-wtb |82.702004 |83.505631 |1.009717 | 0.092402 | | stanford-crypto-sha256 |810.898597 |810.480366 |0.999484 | 0.943677 | ------------------------------------------------------------------------------------------------------------------------- a mean = 242.30806 b mean = 243.91901 pValue = 0.0014473755 (Bigger means are better.) 1.007 times better Results ARE significant * runtime/Options.cpp: (JSC::overrideDefaults): 2021-10-13 Mikhail R. Gadelha [JSC][32bit] Fix wrong branchAdd32 assembly for ARMv7 https://bugs.webkit.org/show_bug.cgi?id=231362 Reviewed by Yusuke Suzuki. After the unlinked baseline jit was merged, a new branchAdd32 method needed to be implemented for ARMv7, however, the first version submitted by me used the add32 method to perform the add before branching. In this patch, we fix the call to add32 by adding a new private method add32Impl with an optional parameter that selects either add or adds, make branchAdd32 call the adds version. (Patch co-authored with Geza Lore) * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branchAdd32): 2021-10-12 Alexey Proskuryakov Invoke build scripts with python3 explicitly https://bugs.webkit.org/show_bug.cgi?id=231587 Reviewed by Jonathan Bedard. Much of the work to support Python 3 was done years ago, but we need this to actually use Python 3 on macOS. Python 3 no longer raises ValueError on relative module import failure, so changed that to the correct ImportError. * DerivedSources.make: * Scripts/UpdateContents.py: * Scripts/cssmin.py: * Scripts/generate-combined-inspector-json.py: * Scripts/generate-js-builtins.py: * Scripts/inline-and-minify-stylesheets-and-scripts.py: * Scripts/lazywriter.py: * Scripts/make-js-file-arrays.py: * Scripts/wkbuiltins/builtins_generate_combined_header.py: * Scripts/wkbuiltins/builtins_generate_combined_implementation.py: * Scripts/wkbuiltins/builtins_generate_internals_wrapper_header.py: * Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py: * Scripts/wkbuiltins/builtins_generate_separate_header.py: * Scripts/wkbuiltins/builtins_generate_separate_implementation.py: * Scripts/wkbuiltins/builtins_generate_wrapper_header.py: * Scripts/wkbuiltins/builtins_generate_wrapper_implementation.py: * Scripts/wkbuiltins/builtins_generator.py: * Scripts/wkbuiltins/builtins_model.py: * Scripts/wkbuiltins/builtins_templates.py: * disassembler/udis86/ud_opcode.py: (UdOpcodeTable.entries): (UdOpcodeTables.addSSE2AVXInsn): (itemslist): Deleted. * inspector/scripts/codegen/cpp_generator.py: * inspector/scripts/codegen/cpp_generator_templates.py: * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py: * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py: * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py: * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py: * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py: * inspector/scripts/codegen/generate_cpp_protocol_types_header.py: * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py: * inspector/scripts/codegen/generate_js_backend_commands.py: * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py: * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py: * inspector/scripts/codegen/generate_objc_configuration_header.py: * inspector/scripts/codegen/generate_objc_configuration_implementation.py: * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py: * inspector/scripts/codegen/generate_objc_header.py: * inspector/scripts/codegen/generate_objc_internal_header.py: * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py: * inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py: * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py: * inspector/scripts/codegen/generator.py: * inspector/scripts/codegen/generator_templates.py: * inspector/scripts/codegen/models.py: * inspector/scripts/codegen/objc_generator.py: * inspector/scripts/codegen/objc_generator_templates.py: * inspector/scripts/generate-inspector-protocol-bindings.py: * wasm/generateWasm.py: * wasm/generateWasmB3IRGeneratorInlinesHeader.py: * wasm/generateWasmOpsHeader.py: * yarr/create_regex_tables: (in): Deleted. * yarr/generateYarrCanonicalizeUnicode: * yarr/generateYarrUnicodePropertyTables.py: * yarr/hasher.py: 2021-10-13 Alex Christensen Remove WTF::Variant and WTF::get https://bugs.webkit.org/show_bug.cgi?id=231675 Reviewed by Chris Dumez. * bytecode/StructureStubClearingWatchpoint.cpp: (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndInstallWatchpoint): (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::branchIfValue): * jit/SnippetReg.h: (JSC::SnippetReg::gpr const): (JSC::SnippetReg::fpr const): (JSC::SnippetReg::jsValueRegs const): * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * parser/Lexer.cpp: (JSC::Lexer::lexWithoutClearingLineTerminator): * parser/VariableEnvironment.cpp: (JSC::CompactTDZEnvironment::toTDZEnvironmentSlow const): * parser/VariableEnvironment.h: (JSC::CompactTDZEnvironment::toTDZEnvironment const): * runtime/CacheUpdate.cpp: (JSC::CacheUpdate::asGlobal const): (JSC::CacheUpdate::asFunction const): * runtime/CachedTypes.cpp: (JSC::CachedCompactTDZEnvironment::encode): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::ControlType::isCatch): (JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const): (JSC::Wasm::LLIntGenerator::addLoop): (JSC::Wasm::LLIntGenerator::addElseToUnreachable): (JSC::Wasm::LLIntGenerator::addCatchToUnreachable): (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable): (JSC::Wasm::LLIntGenerator::addDelegateToUnreachable): (JSC::Wasm::LLIntGenerator::addRethrow): 2021-10-13 Diego Pino Garcia [GTK] Unreviewed, build fix for Ubuntu 18.04 after r283852 * wasm/WasmB3IRGenerator.h: 2021-10-12 Ross Kirsling Non-unified build fixes, October 2021 edition. https://bugs.webkit.org/show_bug.cgi?id=231654 Reviewed by Don Olmstead. * runtime/ControlFlowProfiler.h: 2021-10-12 Alex Christensen Use std::variant instead of WTF::Variant https://bugs.webkit.org/show_bug.cgi?id=231629 Reviewed by Chris Dumez. * bytecode/StructureStubClearingWatchpoint.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCallDOM): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::branchIfValue): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchIfTruthy): (JSC::AssemblyHelpers::branchIfFalsey): * jit/SnippetReg.h: * jsc.cpp: * parser/Lexer.h: * parser/VariableEnvironment.h: * runtime/BytecodeCacheError.h: * runtime/CachePayload.cpp: (JSC::CachePayload::CachePayload): * runtime/CachePayload.h: * runtime/CacheUpdate.h: * runtime/ISO8601.cpp: (JSC::ISO8601::parseTimeZoneBracketedAnnotation): * runtime/ISO8601.h: * wasm/WasmLLIntGenerator.cpp: 2021-10-12 Chris Dumez Decrease use of makeWeakPtr() https://bugs.webkit.org/show_bug.cgi?id=231615 Reviewed by Alex Christensen. Decrease use of makeWeakPtr() and use WeakPtr { } directly instead. * inspector/JSGlobalObjectInspectorController.cpp: (Inspector::JSGlobalObjectInspectorController::consoleClient const): * wasm/WasmMemory.cpp: (JSC::Wasm::Memory::registerInstance): 2021-10-12 Saam Barati Fix spec-correctness when inlining __proto__ intrinsic using get_by_id_with_this https://bugs.webkit.org/show_bug.cgi?id=231559 Reviewed by Yusuke Suzuki. My original fix in r283512 has some theoretical spec correctness issues. I'm not sure if they can be materialized or not since we only use get_by_id_with_this in very limited scenarios. However, this patch just makes it so we call the getter instead of attempting to inline it when using get_by_id_with_this. * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck): Deleted. * jit/AssemblyHelpers.h: * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter): (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): 2021-10-12 Alex Christensen Use STL instead of WTF::get_if, WTF::Monostate, WTF::visit, and WTF::holds_alternative https://bugs.webkit.org/show_bug.cgi?id=231582 Reviewed by Darin Adler. * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::branchIfValue): * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * parser/Lexer.cpp: (JSC::Lexer::lexWithoutClearingLineTerminator): * parser/VariableEnvironment.h: (JSC::CompactTDZEnvironment::toTDZEnvironment const): * runtime/CacheUpdate.cpp: (JSC::CacheUpdate::isGlobal const): * runtime/CachedTypes.cpp: (JSC::CachedCompactTDZEnvironment::encode): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::ControlType::isLoop): (JSC::Wasm::LLIntGenerator::ControlType::isTopLevel): (JSC::Wasm::LLIntGenerator::ControlType::isBlock): (JSC::Wasm::LLIntGenerator::ControlType::isIf): (JSC::Wasm::LLIntGenerator::ControlType::isTry): (JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch): (JSC::Wasm::LLIntGenerator::ControlType::isCatch): (JSC::Wasm::LLIntGenerator::ControlType::targetLabelForBranch const): (JSC::Wasm::LLIntGenerator::ControlType::branchTargetArity const): (JSC::Wasm::LLIntGenerator::ControlType::branchTargetType const): (JSC::Wasm::LLIntGenerator::addElse): (JSC::Wasm::LLIntGenerator::addCatchToUnreachable): (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable): (JSC::Wasm::LLIntGenerator::addRethrow): (JSC::Wasm::LLIntGenerator::addEndToUnreachable): 2021-10-12 Alex Christensen Begin migration from WTF::Variant to std::variant https://bugs.webkit.org/show_bug.cgi?id=231086 Reviewed by Chris Dumez. * bytecode/StructureStubClearingWatchpoint.cpp: (JSC::WatchpointsOnStructureStubInfo::addWatchpoint): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCallDOM): * runtime/TemporalTimeZone.cpp: (JSC::TemporalTimeZone::createFromID): (JSC::TemporalTimeZone::createFromUTCOffset): 2021-10-11 Saam Barati Remove ImplicitAddress https://bugs.webkit.org/show_bug.cgi?id=230820 Reviewed by Yusuke Suzuki. Because we rely on implicit conversion from RegisterID to int values, some compilers (aka MSVC) might convert a constant RegisterID that's passed in to nullptr instead of calling the implicit constructor in ImplicitAddress. For example, I got bit by this when I had code that did: loadPtr(regT0, xyz) This called the loadPtr(void*, RegisterID) function with nullptr passed as the first argument instead of the loadPtr(ImplicitAddress, RegisterID) function. Let's avoid any such problems in the future by just not using ImplicitAddress. * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::ImplicitAddress::ImplicitAddress): Deleted. * assembler/MacroAssembler.h: (JSC::MacroAssembler::pushToSave): (JSC::MacroAssembler::popToRestore): (JSC::MacroAssembler::loadPtr): (JSC::MacroAssembler::storePtr): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::load64): (JSC::MacroAssemblerARM64::load32): (JSC::MacroAssemblerARM64::load16): (JSC::MacroAssemblerARM64::load16Unaligned): (JSC::MacroAssemblerARM64::load16SignedExtendTo32): (JSC::MacroAssemblerARM64::load8): (JSC::MacroAssemblerARM64::load8SignedExtendTo32): (JSC::MacroAssemblerARM64::store64): (JSC::MacroAssemblerARM64::store32): (JSC::MacroAssemblerARM64::store16): (JSC::MacroAssemblerARM64::store8): (JSC::MacroAssemblerARM64::loadDouble): (JSC::MacroAssemblerARM64::loadFloat): (JSC::MacroAssemblerARM64::storeDouble): (JSC::MacroAssemblerARM64::storeFloat): (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters): (JSC::MacroAssemblerARM64::popToRestore): (JSC::MacroAssemblerARM64::pushToSave): (JSC::MacroAssemblerARM64::storePtrWithPatch): (JSC::MacroAssemblerARM64::loadAcq8SignedExtendTo32): (JSC::MacroAssemblerARM64::loadAcq8): (JSC::MacroAssemblerARM64::storeRel8): (JSC::MacroAssemblerARM64::loadAcq16SignedExtendTo32): (JSC::MacroAssemblerARM64::loadAcq16): (JSC::MacroAssemblerARM64::storeRel16): (JSC::MacroAssemblerARM64::loadAcq32): (JSC::MacroAssemblerARM64::loadAcq64): (JSC::MacroAssemblerARM64::storeRel32): (JSC::MacroAssemblerARM64::storeRel64): (JSC::MacroAssemblerARM64::loadLink8): (JSC::MacroAssemblerARM64::loadLinkAcq8): (JSC::MacroAssemblerARM64::storeCond8): (JSC::MacroAssemblerARM64::storeCondRel8): (JSC::MacroAssemblerARM64::loadLink16): (JSC::MacroAssemblerARM64::loadLinkAcq16): (JSC::MacroAssemblerARM64::storeCond16): (JSC::MacroAssemblerARM64::storeCondRel16): (JSC::MacroAssemblerARM64::loadLink32): (JSC::MacroAssemblerARM64::loadLinkAcq32): (JSC::MacroAssemblerARM64::storeCond32): (JSC::MacroAssemblerARM64::storeCondRel32): (JSC::MacroAssemblerARM64::loadLink64): (JSC::MacroAssemblerARM64::loadLinkAcq64): (JSC::MacroAssemblerARM64::storeCond64): (JSC::MacroAssemblerARM64::storeCondRel64): (JSC::MacroAssemblerARM64::extractSimpleAddress): * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::atomicXchgAdd8): (JSC::MacroAssemblerARM64E::atomicXchgAdd16): (JSC::MacroAssemblerARM64E::atomicXchgAdd32): (JSC::MacroAssemblerARM64E::atomicXchgAdd64): (JSC::MacroAssemblerARM64E::atomicXchgXor8): (JSC::MacroAssemblerARM64E::atomicXchgXor16): (JSC::MacroAssemblerARM64E::atomicXchgXor32): (JSC::MacroAssemblerARM64E::atomicXchgXor64): (JSC::MacroAssemblerARM64E::atomicXchgOr8): (JSC::MacroAssemblerARM64E::atomicXchgOr16): (JSC::MacroAssemblerARM64E::atomicXchgOr32): (JSC::MacroAssemblerARM64E::atomicXchgOr64): (JSC::MacroAssemblerARM64E::atomicXchgClear8): (JSC::MacroAssemblerARM64E::atomicXchgClear16): (JSC::MacroAssemblerARM64E::atomicXchgClear32): (JSC::MacroAssemblerARM64E::atomicXchgClear64): (JSC::MacroAssemblerARM64E::atomicXchg8): (JSC::MacroAssemblerARM64E::atomicXchg16): (JSC::MacroAssemblerARM64E::atomicXchg32): (JSC::MacroAssemblerARM64E::atomicXchg64): (JSC::MacroAssemblerARM64E::atomicStrongCAS8): (JSC::MacroAssemblerARM64E::atomicStrongCAS16): (JSC::MacroAssemblerARM64E::atomicStrongCAS32): (JSC::MacroAssemblerARM64E::atomicStrongCAS64): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::or8): (JSC::MacroAssemblerARMv7::or16): (JSC::MacroAssemblerARMv7::or32): (JSC::MacroAssemblerARMv7::load32): (JSC::MacroAssemblerARMv7::load8): (JSC::MacroAssemblerARMv7::load8SignedExtendTo32): (JSC::MacroAssemblerARMv7::load16): (JSC::MacroAssemblerARMv7::load16SignedExtendTo32): (JSC::MacroAssemblerARMv7::store32): (JSC::MacroAssemblerARMv7::store16): (JSC::MacroAssemblerARMv7::loadDouble): (JSC::MacroAssemblerARMv7::loadFloat): (JSC::MacroAssemblerARMv7::storeDouble): (JSC::MacroAssemblerARMv7::storeFloat): (JSC::MacroAssemblerARMv7::storePtrWithPatch): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::load8): (JSC::MacroAssemblerMIPS::load8SignedExtendTo32): (JSC::MacroAssemblerMIPS::load32): (JSC::MacroAssemblerMIPS::load16): (JSC::MacroAssemblerMIPS::store8): (JSC::MacroAssemblerMIPS::store16): (JSC::MacroAssemblerMIPS::store32): (JSC::MacroAssemblerMIPS::storePtrWithPatch): (JSC::MacroAssemblerMIPS::loadFloat): (JSC::MacroAssemblerMIPS::loadDouble): (JSC::MacroAssemblerMIPS::storeFloat): (JSC::MacroAssemblerMIPS::storeDouble): * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::load32): (JSC::MacroAssemblerX86Common::load16Unaligned): (JSC::MacroAssemblerX86Common::load8): (JSC::MacroAssemblerX86Common::load8SignedExtendTo32): (JSC::MacroAssemblerX86Common::load16): (JSC::MacroAssemblerX86Common::store32): (JSC::MacroAssemblerX86Common::store16): (JSC::MacroAssemblerX86Common::loadDouble): (JSC::MacroAssemblerX86Common::loadFloat): (JSC::MacroAssemblerX86Common::storeDouble): (JSC::MacroAssemblerX86Common::storeFloat): * assembler/MacroAssemblerX86_64.h: (JSC::MacroAssemblerX86_64::load8): (JSC::MacroAssemblerX86_64::load32): (JSC::MacroAssemblerX86_64::store32): (JSC::MacroAssemblerX86_64::load64): (JSC::MacroAssemblerX86_64::store64): (JSC::MacroAssemblerX86_64::storePtrWithPatch): * assembler/testmasm.cpp: (JSC::testBranchTruncateDoubleToInt32): (JSC::testLoadPrePostIndex32): (JSC::testLoadPrePostIndex64): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileStringSlice): (JSC::DFG::SpeculativeJIT::compileGetByValOnString): (JSC::DFG::SpeculativeJIT::compileClearCatchLocals): * ftl/FTLLocation.cpp: (JSC::FTL::Location::restoreInto const): * ftl/FTLThunks.cpp: (JSC::FTL::genericGenerationThunkGenerator): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::debugCall): (JSC::AssemblyHelpers::sanitizeStackInline): * jit/JITPropertyAccess.cpp: (JSC::JIT::emitGetVarFromIndirectPointer): * jit/ThunkGenerators.cpp: (JSC::arityFixupGenerator): * wasm/WasmBinding.cpp: (JSC::Wasm::wasmToWasm): * yarr/YarrJIT.cpp: 2021-10-11 Saam Barati Share more code that uses ScratchRegisterAllocator in the ICs https://bugs.webkit.org/show_bug.cgi?id=231125 Reviewed by Sam Weinig. We had the same code to allocate a scratch register allocator copy pasted all over the IC code. This patch refactors that to use a shared helper. Also, Delete was using a ScratchRegisterAllocator for no reason (it never allocated a scratch register), so I deleted that code. * bytecode/AccessCase.cpp: (JSC::AccessCase::generateWithGuard): (JSC::AccessCase::generateImpl): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::makeDefaultScratchAllocator): (JSC::PolymorphicAccess::regenerate): * bytecode/PolymorphicAccess.h: * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): 2021-10-11 Saam Barati Don't branch around register allocation in DFG enumerator get by val and pass in the right LValue type to strictInt52ToJSValue https://bugs.webkit.org/show_bug.cgi?id=231465 Reviewed by Yusuke Suzuki. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-10-11 Geza Lore [JSC][ARMv7] Make LLInt CSR save/restore order match the JITs https://bugs.webkit.org/show_bug.cgi?id=231517 Reviewed by Saam Barati. Since the new unlinked baseline JIT was introduced, the baseline JIT uses the metadata table GPR the same way as the LLInt does, and relies on it being in a saved CSR in emit_op_catch. This unearthed an issue in the order in which LLInt on ARMv7 stores and restores CSRs when trying to handle exceptions. This patch fixes the mismatch. * llint/LowLevelInterpreter.asm: 2021-10-11 Alex Christensen Prepare to switch from WTF::Variant to std::variant https://bugs.webkit.org/show_bug.cgi?id=231239 Reviewed by Chris Dumez. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCallDOM): * parser/Lexer.cpp: (JSC::Lexer::parseHex): (JSC::Lexer::parseBinary): (JSC::Lexer::parseOctal): (JSC::Lexer::parseDecimal): * runtime/CachePayload.cpp: (JSC::CachePayload::data const): (JSC::CachePayload::size const): * runtime/CacheUpdate.cpp: (JSC::CacheUpdate::CacheUpdate): 2021-10-11 Keith Miller SourceID should have a type name and only be 32-bits https://bugs.webkit.org/show_bug.cgi?id=231436 Reviewed by Filip Pizlo. This patch gives SourceID a proper type name and shrinks it to 32-bits on 64-bit systems. Shrinking the size makes room on SourceProvider for metadata in a future patch I'm working on. It's also pretty unlikely that any system has more than ~4 billion script tags, evals, wasm modules so shinking the size is unlikely to cause any debugger/profiling issues. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/TypeLocation.h: * debugger/Debugger.cpp: (JSC::Debugger::toggleBreakpoint): (JSC::Debugger::pauseIfNeeded): * debugger/DebuggerLocation.h: (JSC::DebuggerLocation::DebuggerLocation): * debugger/DebuggerPrimitives.h: * inspector/JavaScriptCallFrame.h: (Inspector::JavaScriptCallFrame::sourceID const): * inspector/ScriptCallStackFactory.cpp: (Inspector::CreateScriptCallStackFunctor::operator() const): (Inspector::createScriptCallStackFromException): * interpreter/StackVisitor.cpp: (JSC::StackVisitor::Frame::sourceID): * interpreter/StackVisitor.h: * parser/Nodes.h: (JSC::ScopeNode::sourceID const): * parser/SourceCode.h: (JSC::SourceCode::SourceCode): (JSC::SourceCode::firstLine const): (JSC::SourceCode::startColumn const): (JSC::SourceCode::providerID const): (JSC::SourceCode::provider const): (JSC::SourceCode::operator== const): (JSC::SourceCode::operator!= const): (JSC::makeSource): (JSC::SourceCode::subExpression const): * parser/SourceProvider.cpp: (JSC::SourceProvider::getID): * parser/SourceProvider.h: (JSC::SourceProvider::asID): * runtime/ControlFlowProfiler.cpp: (JSC::ControlFlowProfiler::getBasicBlockLocation): (JSC::ControlFlowProfiler::getBasicBlocksForSourceID const): (JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted): (JSC::ControlFlowProfiler::basicBlockExecutionCountAtTextOffset): * runtime/ControlFlowProfiler.h: * runtime/FunctionHasExecutedCache.cpp: (JSC::FunctionHasExecutedCache::hasExecutedAtOffset): (JSC::FunctionHasExecutedCache::insertUnexecutedRange): (JSC::FunctionHasExecutedCache::removeUnexecutedRange): (JSC::FunctionHasExecutedCache::getFunctionRanges): * runtime/FunctionHasExecutedCache.h: * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::StackFrame::sourceID): * runtime/SamplingProfiler.h: * runtime/ScriptExecutable.h: (JSC::ScriptExecutable::sourceID const): * runtime/StackFrame.cpp: (JSC::StackFrame::sourceID const): * runtime/StackFrame.h: * runtime/TypeLocationCache.cpp: (JSC::TypeLocationCache::getTypeLocation): * runtime/TypeLocationCache.h: * runtime/TypeProfiler.cpp: (JSC::TypeProfiler::typeInformationForExpressionAtOffset): (JSC::TypeProfiler::findLocation): * runtime/TypeProfiler.h: (JSC::QueryKey::QueryKey): (JSC::QueryKey::isHashTableDeletedValue const): 2021-10-11 Geza Lore [JSC][32bit] Fix profiling in baseline https://bugs.webkit.org/show_bug.cgi?id=231368 Reviewed by Yusuke Suzuki. Fixes profiling omissions introduced with the recent 32-bit baseline build fixes, and also brings the rest of profile updates in-line with the unlinked baseline on 64-bit platforms. * jit/JIT.h: * jit/JITCall32_64.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileOpCall): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITInlines.h: (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitArrayProfilingSiteWithCell): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): 2021-10-10 Sihui Liu Add support for iterating FileSystemDirectoryHandle https://bugs.webkit.org/show_bug.cgi?id=231142 Reviewed by Youenn Fablet and Yusuke Suzuki. * CMakeLists.txt: * runtime/JSBoundFunction.h: * runtime/JSGlobalObject.h: * runtime/JSGlobalObjectInlines.h: (JSC::JSGlobalObject::performPromiseThenFunction const): * runtime/JSPromise.cpp: (JSC::JSPromise::createNewPromiseCapability): (JSC::JSPromise::convertCapabilityToDeferredData): (JSC::JSPromise::createDeferredData): (JSC::JSPromise::performPromiseThen): * runtime/JSPromise.h: 2021-10-09 Yusuke Suzuki [JSC] Refine RegExp#compile based on regexp-legacy-features proposal https://bugs.webkit.org/show_bug.cgi?id=231486 Reviewed by Alexey Shvayka. This patch refines RegExp#compile based regexp-legacy-features proposal[1]. We add legacyFeaturesDisabledFlag flag to RegExpObject so that we can detect [[LegacyFeaturesEnabled]]. We also add regExpRecompiledWatchpoint to JSGlobalObject. We have strength reduction in DFG / FTL, but we should recompile DFG / FTL code when RegExp is recompiled. Since it is rare, instead of having this watchpoint per RegExpObject, we hold it in JSGlobalObject. [1]: https://github.com/tc39/proposal-regexp-legacy-features * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNewRegexp): (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex): * dfg/DFGStrengthReductionPhase.cpp: (JSC::DFG::StrengthReductionPhase::handleNode): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::JSGlobalObject): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::regExpRecompiledWatchpoint): (JSC::JSGlobalObject::isRegExpRecompiled const): * runtime/RegExpConstructor.cpp: (JSC::areLegacyFeaturesEnabled): (JSC::regExpCreate): (JSC::constructRegExp): * runtime/RegExpObject.cpp: (JSC::RegExpObject::RegExpObject): * runtime/RegExpObject.h: * runtime/RegExpPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-10-08 Saam Barati Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser https://bugs.webkit.org/show_bug.cgi?id=230823 Reviewed by Yusuke Suzuki. When I ported the phase to run right after bytecode parsing, I wanted to maintain the same behavior as the prior pass that ran after CPS rethreading. I noticed a slight bug in some of my logic that changed some of heuristics and how they'd effect double voting. The old patch was mimicking the "is loaded from" bit by using the NodeFlags. Howver, this has some issues with how this interacts with our other uses of NodeFlags. So, to make things simple, I just add a new "VariableIsUsed" bit. * dfg/DFGBackwardsPropagationPhase.cpp: (JSC::DFG::BackwardsPropagationPhase::propagate): 2021-10-08 Tadeu Zagallo and Keith Miller Implement the WebAssembly exception handling proposal https://bugs.webkit.org/show_bug.cgi?id=229681 Reviewed by Keith Miller. Add support for the WebAssembly exception handling proposal, as per the WIP spec: https://github.com/WebAssembly/exception-handling The proposal includes 6 new instructions: try, catch, catch_all, delegate, throw and rethrow. All the instructions are supported by the LLInt and B3 generators, but not yet supported in Air. Any functions use exceptions will use B3 in BBQ. A few important notes about the implementation: - In B3, since we can now have multiple entrypoints (one for the function entry + 1 for each catch/catch_all), we can no longer just replace every value in the stack with a Phi when we find a new entrypoint. This worked so far because of the assumption that any block couldn't access its enclosing stack, and since the enclosing stack would only be accessible when we exited the current block, we added Phis at the end of each block when we had a new entrypoint. Now, since we have to capture all live values at any point that might throw (calls, throw and rethrow), we break that assumption. To simplify all the possible ways we might have to merge the state from multiple entrypoints we now use B3 Variables to represent stack slots. - Some extra information is required to be able to properly restore the state when catching an exception: - We added a field VM::calleeForWasmCatch. This field is necessary because whenever we throw, we might end up in JavaScript, which assumes the callee is a cell and uses it to get the VM and restore callee saves. The issue is when catching exceptions in wasm we still need the original callee, and if throwing and catching from the same frame, that call frame slot has now been overwritten, so we store its original value in the VM field. - We also need to store the current Wasm Instance into the call frame's slot for the `this` argument. The instance is used both by the unwinder, to check if the exception being thrown matches the exceptions handled by catch candidates, and by the catch implementation, which is necessary when throwing from a cross instance call where both the callee save or TLS will have the callee's instance. - We store the current opcode for the llint, or the call site index for B3, in the call frame slot for the argument count tag. The call site index is used by the unwinder to check if a given catch can handle the exception being thrown. * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/BytecodeList.rb: * bytecode/HandlerInfo.h: * bytecode/Instruction.h: (JSC::BaseInstruction::name const): * interpreter/CallFrame.cpp: (JSC::CallFrame::bytecodeIndex const): * interpreter/CallFrame.h: (JSC::CallSiteIndex::CallSiteIndex): (JSC::CallSiteIndex::hash const): (JSC::CallSiteIndex::deletedValue): (JSC::CallSiteIndex::isHashTableDeletedValue const): (JSC::CallSiteIndexHash::hash): (JSC::CallSiteIndexHash::equal): * interpreter/Interpreter.cpp: (JSC::CatchInfo::CatchInfo): (JSC::UnwindFunctor::UnwindFunctor): (JSC::UnwindFunctor::operator() const): (JSC::Interpreter::unwind): * interpreter/Interpreter.h: (JSC::CatchInfo::CatchInfo): * interpreter/StackVisitor.cpp: (JSC::StackVisitor::readNonInlinedFrame): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer): (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer): (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBufferImpl): * jit/AssemblyHelpers.h: * jit/JITExceptions.cpp: (JSC::genericUnwind): * jit/JSInterfaceJIT.h: (JSC::JSInterfaceJIT::convertCalleeToVM): * llint/LLIntData.h: (JSC::LLInt::getCodeRef): (JSC::LLInt::getWide16CodeRef): (JSC::LLInt::getWide32CodeRef): * llint/LLIntExceptions.cpp: (JSC::LLInt::wasmReturnToThrow): (JSC::LLInt::handleWasmCatch): (JSC::LLInt::handleWasmCatchAll): * llint/LLIntExceptions.h: * llint/LLIntOffsetsExtractor.cpp: * llint/WebAssembly.asm: * runtime/ErrorInstance.cpp: (JSC::ErrorInstance::ErrorInstance): * runtime/ErrorInstance.h: (JSC::ErrorInstance::setCatchableFromWasm): (JSC::ErrorInstance::isCatchableFromWasm const): * runtime/JSGlobalObject.cpp: * runtime/JSGlobalObject.h: * runtime/OptionsList.h: * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: (JSC::VM::calleeForWasmCatchOffset): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::ControlData::isTry): (JSC::Wasm::AirIRGenerator::ControlData::isCatch): (JSC::Wasm::AirIRGenerator::ControlData::isAnyCatch): (JSC::Wasm::AirIRGenerator::ControlData::isLoop): (JSC::Wasm::AirIRGenerator::ControlData::isBlock): (JSC::Wasm::AirIRGenerator::ControlData::dump const): (JSC::Wasm::AirIRGenerator::addTry): (JSC::Wasm::AirIRGenerator::addCatch): (JSC::Wasm::AirIRGenerator::addCatchToUnreachable): (JSC::Wasm::AirIRGenerator::addCatchAll): (JSC::Wasm::AirIRGenerator::addCatchAllToUnreachable): (JSC::Wasm::AirIRGenerator::addDelegate): (JSC::Wasm::AirIRGenerator::addDelegateToUnreachable): (JSC::Wasm::AirIRGenerator::addThrow): (JSC::Wasm::AirIRGenerator::addRethrow): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::ControlData::ControlData): (JSC::Wasm::B3IRGenerator::ControlData::isTry): (JSC::Wasm::B3IRGenerator::ControlData::isAnyCatch): (JSC::Wasm::B3IRGenerator::ControlData::isLoop): (JSC::Wasm::B3IRGenerator::ControlData::isBlock): (JSC::Wasm::B3IRGenerator::ControlData::isCatch): (JSC::Wasm::B3IRGenerator::ControlData::dump const): (JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatch): (JSC::Wasm::B3IRGenerator::ControlData::convertTryToCatchAll): (JSC::Wasm::B3IRGenerator::ControlData::tryStart const): (JSC::Wasm::B3IRGenerator::ControlData::tryEnd const): (JSC::Wasm::B3IRGenerator::ControlData::tryDepth const): (JSC::Wasm::B3IRGenerator::ControlData::catchKind const): (JSC::Wasm::B3IRGenerator::ControlData::exception const): (JSC::Wasm::B3IRGenerator::ControlData::stackSize const): (JSC::Wasm::B3IRGenerator::didPopValueFromStack): (JSC::Wasm::B3IRGenerator::addStackMap): (JSC::Wasm::B3IRGenerator::takeStackmaps): (JSC::Wasm::B3IRGenerator::takeExceptionHandlers): (JSC::Wasm::B3IRGenerator::push): (JSC::Wasm::B3IRGenerator::get): (JSC::Wasm::B3IRGenerator::set): (JSC::Wasm::PatchpointExceptionHandle::generate const): (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffset): (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState): (JSC::Wasm::B3IRGenerator::insertEntrySwitch): (JSC::Wasm::B3IRGenerator::insertConstants): (JSC::Wasm::B3IRGenerator::addRefIsNull): (JSC::Wasm::B3IRGenerator::addTableGet): (JSC::Wasm::B3IRGenerator::addTableSet): (JSC::Wasm::B3IRGenerator::addRefFunc): (JSC::Wasm::B3IRGenerator::addTableInit): (JSC::Wasm::B3IRGenerator::addTableSize): (JSC::Wasm::B3IRGenerator::addTableGrow): (JSC::Wasm::B3IRGenerator::addTableFill): (JSC::Wasm::B3IRGenerator::addTableCopy): (JSC::Wasm::B3IRGenerator::getLocal): (JSC::Wasm::B3IRGenerator::emitIndirectCall): (JSC::Wasm::B3IRGenerator::addGrowMemory): (JSC::Wasm::B3IRGenerator::addCurrentMemory): (JSC::Wasm::B3IRGenerator::addMemoryFill): (JSC::Wasm::B3IRGenerator::addMemoryInit): (JSC::Wasm::B3IRGenerator::addMemoryCopy): (JSC::Wasm::B3IRGenerator::setLocal): (JSC::Wasm::B3IRGenerator::getGlobal): (JSC::Wasm::B3IRGenerator::setGlobal): (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer): (JSC::Wasm::B3IRGenerator::emitLoadOp): (JSC::Wasm::B3IRGenerator::load): (JSC::Wasm::B3IRGenerator::emitStoreOp): (JSC::Wasm::B3IRGenerator::store): (JSC::Wasm::B3IRGenerator::sanitizeAtomicResult): (JSC::Wasm::B3IRGenerator::fixupPointerPlusOffsetForAtomicOps): (JSC::Wasm::B3IRGenerator::emitAtomicLoadOp): (JSC::Wasm::B3IRGenerator::atomicLoad): (JSC::Wasm::B3IRGenerator::emitAtomicStoreOp): (JSC::Wasm::B3IRGenerator::atomicStore): (JSC::Wasm::B3IRGenerator::emitAtomicBinaryRMWOp): (JSC::Wasm::B3IRGenerator::atomicBinaryRMW): (JSC::Wasm::B3IRGenerator::emitAtomicCompareExchange): (JSC::Wasm::B3IRGenerator::atomicCompareExchange): (JSC::Wasm::B3IRGenerator::atomicWait): (JSC::Wasm::B3IRGenerator::atomicNotify): (JSC::Wasm::B3IRGenerator::truncSaturated): (JSC::Wasm::B3IRGenerator::addSelect): (JSC::Wasm::B3IRGenerator::addConstant): (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): (JSC::Wasm::B3IRGenerator::loadFromScratchBuffer): (JSC::Wasm::B3IRGenerator::connectControlEntry): (JSC::Wasm::B3IRGenerator::addLoop): (JSC::Wasm::B3IRGenerator::addTopLevel): (JSC::Wasm::B3IRGenerator::addBlock): (JSC::Wasm::B3IRGenerator::addIf): (JSC::Wasm::B3IRGenerator::addElse): (JSC::Wasm::B3IRGenerator::addElseToUnreachable): (JSC::Wasm::B3IRGenerator::addTry): (JSC::Wasm::B3IRGenerator::addCatch): (JSC::Wasm::B3IRGenerator::preparePatchpointForExceptions): (JSC::Wasm::B3IRGenerator::addCatchToUnreachable): (JSC::Wasm::B3IRGenerator::addCatchAll): (JSC::Wasm::B3IRGenerator::addCatchAllToUnreachable): (JSC::Wasm::B3IRGenerator::emitCatchImpl): (JSC::Wasm::B3IRGenerator::addDelegate): (JSC::Wasm::B3IRGenerator::addDelegateToUnreachable): (JSC::Wasm::B3IRGenerator::addThrow): (JSC::Wasm::B3IRGenerator::addRethrow): (JSC::Wasm::B3IRGenerator::addReturn): (JSC::Wasm::B3IRGenerator::addBranch): (JSC::Wasm::B3IRGenerator::addSwitch): (JSC::Wasm::B3IRGenerator::endBlock): (JSC::Wasm::B3IRGenerator::addEndToUnreachable): (JSC::Wasm::B3IRGenerator::createCallPatchpoint): (JSC::Wasm::B3IRGenerator::addCall): (JSC::Wasm::B3IRGenerator::addCallIndirect): (JSC::Wasm::B3IRGenerator::addCallRef): (JSC::Wasm::B3IRGenerator::unify): (JSC::Wasm::B3IRGenerator::unifyValuesWithBlock): (JSC::Wasm::parseAndCompile): (JSC::Wasm::computeExceptionHandlerLocations): (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): (JSC::Wasm::B3IRGenerator::addOp): * wasm/WasmB3IRGenerator.h: * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::prepareImpl): (JSC::Wasm::BBQPlan::work): (JSC::Wasm::BBQPlan::compileFunction): (JSC::Wasm::BBQPlan::didCompleteCompilation): (JSC::Wasm::BBQPlan::initializeCallees): * wasm/WasmBBQPlan.h: * wasm/WasmCallee.cpp: (JSC::Wasm::Callee::handlerForIndex): (JSC::Wasm::LLIntCallee::LLIntCallee): (JSC::Wasm::LLIntCallee::linkExceptionHandlers): (JSC::Wasm::OptimizingJITCallee::linkExceptionHandlers): (JSC::Wasm::OptimizingJITCallee::stackmap const): * wasm/WasmCallee.h: (JSC::Wasm::Callee::hasExceptionHandlers const): (JSC::Wasm::Callee::functionCodeBlock const): (JSC::Wasm::OptimizingJITCallee::OptimizingJITCallee): * wasm/WasmCallingConvention.h: (JSC::Wasm::WasmCallingConvention::callInformationFor const): * wasm/WasmFormat.h: (JSC::Wasm::typeToString): (JSC::Wasm::isValidExternalKind): (JSC::Wasm::makeString): * wasm/WasmFunctionCodeBlock.h: (JSC::Wasm::FunctionCodeBlock::numberOfExceptionHandlers const): (JSC::Wasm::FunctionCodeBlock::exceptionHandler): (JSC::Wasm::FunctionCodeBlock::addExceptionHandler): * wasm/WasmFunctionParser.h: (JSC::Wasm::isTryOrCatch): (JSC::Wasm::FunctionParser::parseExceptionIndex): (JSC::Wasm::FunctionParser::parseExpression): (JSC::Wasm::FunctionParser::parseUnreachableExpression): * wasm/WasmHandlerInfo.cpp: Added. (JSC::Wasm::HandlerInfo::initialize): (JSC::Wasm::HandlerInfo::handlerForIndex): * wasm/WasmHandlerInfo.h: Added. (JSC::Wasm::UnlinkedHandlerInfo::UnlinkedHandlerInfo): (JSC::Wasm::HandlerInfo::tag const): (JSC::Wasm::HandlerInfo::delegateTarget const): * wasm/WasmInstance.cpp: (JSC::Wasm::Instance::~Instance): * wasm/WasmInstance.h: (JSC::Wasm::Instance::addTag): (JSC::Wasm::Instance::tag const): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::ControlType::try_): (JSC::Wasm::LLIntGenerator::ControlType::catch_): (JSC::Wasm::LLIntGenerator::ControlType::isLoop): (JSC::Wasm::LLIntGenerator::ControlType::isBlock): (JSC::Wasm::LLIntGenerator::ControlType::isIf): (JSC::Wasm::LLIntGenerator::ControlType::isTry): (JSC::Wasm::LLIntGenerator::ControlType::isAnyCatch): (JSC::Wasm::LLIntGenerator::ControlType::isCatch): (JSC::Wasm::LLIntGenerator::unifyValuesWithBlock): (JSC::Wasm::LLIntGenerator::walkExpressionStack): (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals): (JSC::Wasm::parseAndCompileBytecode): (JSC::Wasm::LLIntGenerator::LLIntGenerator): (JSC::Wasm::LLIntGenerator::repatch): (JSC::Wasm::LLIntGenerator::finalize): (JSC::Wasm::LLIntGenerator::callInformationForCaller): (JSC::Wasm::LLIntGenerator::callInformationForCallee): (JSC::Wasm::LLIntGenerator::addArguments): (JSC::Wasm::LLIntGenerator::addLoop): (JSC::Wasm::LLIntGenerator::addTry): (JSC::Wasm::LLIntGenerator::finalizePreviousBlockForCatch): (JSC::Wasm::LLIntGenerator::addCatch): (JSC::Wasm::LLIntGenerator::addCatchToUnreachable): (JSC::Wasm::LLIntGenerator::addCatchAll): (JSC::Wasm::LLIntGenerator::addCatchAllToUnreachable): (JSC::Wasm::LLIntGenerator::addDelegate): (JSC::Wasm::LLIntGenerator::addDelegateToUnreachable): (JSC::Wasm::LLIntGenerator::addThrow): (JSC::Wasm::LLIntGenerator::addRethrow): (JSC::Wasm::LLIntGenerator::endBlock): (JSC::Wasm::LLIntGenerator::addEndToUnreachable): * wasm/WasmLLIntGenerator.h: * wasm/WasmLimits.h: * wasm/WasmModuleInformation.cpp: * wasm/WasmModuleInformation.h: (JSC::Wasm::ModuleInformation::exceptionIndexSpaceSize const): (JSC::Wasm::ModuleInformation::isImportedExceptionFromExceptionIndexSpace const): (JSC::Wasm::ModuleInformation::signatureIndexFromExceptionIndexSpace const): (JSC::Wasm::ModuleInformation::importExceptionCount const): (JSC::Wasm::ModuleInformation::isDeclaredException const): (JSC::Wasm::ModuleInformation::addDeclaredException): * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmOSREntryData.h: (JSC::Wasm::OSREntryData::values): * wasm/WasmOperations.cpp: (JSC::Wasm::loadValuesIntoBuffer): (JSC::Wasm::doOSREntry): (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmOperations.h: * wasm/WasmSectionParser.cpp: (JSC::Wasm::SectionParser::parseImport): (JSC::Wasm::SectionParser::parseExport): (JSC::Wasm::SectionParser::parseException): * wasm/WasmSections.h: (JSC::Wasm::validateOrder): * wasm/WasmSignature.cpp: (JSC::Wasm::SignatureInformation::SignatureInformation): (JSC::Wasm::SignatureInformation::signatureFor): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::WASM_SLOW_PATH_DECL): * wasm/WasmSlowPaths.h: * wasm/WasmStreamingParser.cpp: (JSC::Wasm::StreamingParser::parseCodeSectionSize): * wasm/WasmTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/WasmTag.h: Copied from Source/JavaScriptCore/wasm/WasmLLIntGenerator.h. (JSC::Wasm::Tag::create): (JSC::Wasm::Tag::parameterCount const): (JSC::Wasm::Tag::parameter const): (JSC::Wasm::Tag::operator== const): (JSC::Wasm::Tag::operator!= const): (JSC::Wasm::Tag::signature const): (JSC::Wasm::Tag::Tag): * wasm/WasmThunks.cpp: * wasm/WasmThunks.h: * wasm/generateWasmB3IRGeneratorInlinesHeader.py: (CodeGenerator.generateOpcode): (CodeGenerator.makeResult): (CodeGenerator.generate): * wasm/generateWasmOpsHeader.py: (typeMacroizer): * wasm/js/JSWebAssembly.cpp: * wasm/js/JSWebAssemblyException.cpp: Added. (JSC::JSWebAssemblyException::JSWebAssemblyException): (JSC::JSWebAssemblyException::finishCreation): (JSC::JSWebAssemblyException::visitChildrenImpl): (JSC::JSWebAssemblyException::destroy): (JSC::JSWebAssemblyException::getArg const): * wasm/js/JSWebAssemblyException.h: Added. (JSC::JSWebAssemblyException::subspaceFor): (JSC::JSWebAssemblyException::createStructure): (JSC::JSWebAssemblyException::create): (JSC::JSWebAssemblyException::tag const): (JSC::JSWebAssemblyException::payload const): * wasm/js/JSWebAssemblyHelpers.h: (JSC::toJSValue): (JSC::fromJSValue): * wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::tryCreate): * wasm/js/JSWebAssemblyInstance.h: * wasm/js/JSWebAssemblyRuntimeError.cpp: (JSC::createJSWebAssemblyRuntimeError): * wasm/js/JSWebAssemblyRuntimeError.h: * wasm/js/JSWebAssemblyTag.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp. (JSC::JSWebAssemblyTag::create): (JSC::JSWebAssemblyTag::createStructure): (JSC::JSWebAssemblyTag::JSWebAssemblyTag): * wasm/js/JSWebAssemblyTag.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS): * wasm/js/WebAssemblyExceptionConstructor.cpp: Added. (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::WebAssemblyExceptionConstructor::create): (JSC::WebAssemblyExceptionConstructor::createStructure): (JSC::WebAssemblyExceptionConstructor::finishCreation): (JSC::WebAssemblyExceptionConstructor::WebAssemblyExceptionConstructor): * wasm/js/WebAssemblyExceptionConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/js/WebAssemblyExceptionPrototype.cpp: Added. (JSC::WebAssemblyExceptionPrototype::create): (JSC::WebAssemblyExceptionPrototype::createStructure): (JSC::WebAssemblyExceptionPrototype::finishCreation): (JSC::WebAssemblyExceptionPrototype::WebAssemblyExceptionPrototype): (JSC::getException): (JSC::getTag): (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyExceptionPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/js/WebAssemblyFunction.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::linkImpl): * wasm/js/WebAssemblyTagConstructor.cpp: Added. (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::WebAssemblyTagConstructor::createTag): (JSC::WebAssemblyTagConstructor::create): (JSC::WebAssemblyTagConstructor::createStructure): (JSC::WebAssemblyTagConstructor::finishCreation): (JSC::WebAssemblyTagConstructor::WebAssemblyTagConstructor): * wasm/js/WebAssemblyTagConstructor.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/js/WebAssemblyTagPrototype.cpp: Added. (JSC::WebAssemblyTagPrototype::create): (JSC::WebAssemblyTagPrototype::createStructure): (JSC::WebAssemblyTagPrototype::finishCreation): (JSC::WebAssemblyTagPrototype::WebAssemblyTagPrototype): (JSC::getTag): (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyTagPrototype.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h. * wasm/wasm.json: 2021-10-08 Jer Noble [Build-time perf] Forward-declare more things in Element.h https://bugs.webkit.org/show_bug.cgi?id=231283 Reviewed by Myles C. Maxfield. Add two new forwarding headers: one for Strong, and as a dependency, one for Handle. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * heap/Handle.h: * heap/HandleForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h. * heap/Strong.h: * heap/StrongForward.h: Copied from Source/JavaScriptCore/runtime/Forward.h. * runtime/Forward.h: 2021-10-08 Ross Kirsling and Stephan Szabo [JSC] Add private C API for JSGlobalObject::setEvalEnabled https://bugs.webkit.org/show_bug.cgi?id=231448 Reviewed by Yusuke Suzuki. WebCore can prohibit eval (and Function constructor) usage in JS execution based on content security policy; this patch gives embedders the ability to do similarly. * API/JSContextRef.cpp: (JSGlobalContextSetEvalEnabled): Added. * API/JSContextRefPrivate.h: * API/tests/testapi.c: 2021-10-08 Yusuke Suzuki [JSC] UnlinkedCodeBlock::m_instructions can be nullptr https://bugs.webkit.org/show_bug.cgi?id=231445 rdar://83975933 Reviewed by Mark Lam. UnlinkedCodeBlock is first created with m_instructions = nullptr. If BytecodeGenerator failed (due to OOM error etc.), then we keep it nullptr. So, when destroying UnlinkedCodeBlock, we should have nullptr check. * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): 2021-10-08 Saam Barati RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp* https://bugs.webkit.org/show_bug.cgi?id=231382 Reviewed by Mark Lam. Because of the RegExp.prototype.compile API, we don't know if the RegExp produced by RegExpExec will have indices or not, because that bit of information can be reset by the RegExp.prototype.compile API. So, we conservatively say that it can produce either structure. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): 2021-10-07 Alexey Shvayka `highWaterMark` should be a readonly WebIDL attribute of queuing strategies https://bugs.webkit.org/show_bug.cgi?id=231355 Reviewed by Youenn Fablet. Removes now unused @Object.@defineProperty private method. In most cases, property descriptor merging is unnecessary and @putDirect should be used instead. * runtime/ObjectConstructor.cpp: (JSC::ObjectConstructor::finishCreation): 2021-10-07 Ross Kirsling Unreviewed, build fix for non-unified JSC. * dfg/DFGBackwardsPropagationPhase.cpp: Add missing include. 2021-10-07 Carlos Garcia Campos [GTK] Reenable -fvisibility=hidden https://bugs.webkit.org/show_bug.cgi?id=181916 Reviewed by Michael Catanzaro. * shell/PlatformGTK.cmake: 2021-10-07 Philip Chimento [JSC] Temporal tweaks to pass more test262 tests https://bugs.webkit.org/show_bug.cgi?id=231331 Reviewed by Yusuke Suzuki. * runtime/ISO8601.h: (JSC::ISO8601::Duration::operator[]): Add an overload for Duration[] that indexes by TemporalUnit enum instead of integer index. (JSC::ISO8601::Duration::operator[] const): * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::fromDurationLike): Access Duration properties in the order defined in the specification. (JSC::TemporalDuration::with const): Access Duration properties in the order defined in the specification. (JSC::TemporalDuration::round const): Temporarily throw an exception here instead of failing an assertion, when attempting to use unimplemented relativeTo functionality. * runtime/TemporalObject.cpp: (JSC::temporalUnitPluralPropertyName): Rename from temporalUnitPropertyName. (JSC::temporalUnitSingularPropertyName): Added. * runtime/TemporalObject.h: Add array corresponding to the table in the spec text specifying alphabetical access order for unit properties. * runtime/TemporalPlainTime.cpp: (JSC::toTemporalTimeRecord): Access PlainTime properties in the order defined in the specification. (JSC::toPartialTime): Access PlainTime properties in the order defined in the specification. 2021-10-06 Fujii Hironori Python 3: run-inspector-generator-tests and generate-inspector-protocol-bindings.py https://bugs.webkit.org/show_bug.cgi?id=231055 Reviewed by Jonathan Bedard. BaseException.message has been deprecated as of Python 2.6. Use str(e) instead. It seems that using frozenset causes flaky test failures in Python 3. Stopped using frozenset. Rebaselined test expected results with Python 3. This change is not Python 2 compatible because Python 2 represent a unicode text as u'pagee' while Python 3 does 'pagee'. * inspector/scripts/codegen/models.py: * inspector/scripts/generate-inspector-protocol-bindings.py: * inspector/scripts/tests/expected/fail-on-command-targetType-matching-domain-debuggableType.json-error: * inspector/scripts/tests/expected/fail-on-command-targetTypes-value.json-error: * inspector/scripts/tests/expected/fail-on-domain-debuggableTypes-value.json-error: * inspector/scripts/tests/expected/fail-on-domain-targetType-matching-domain-debuggableType.json-error: * inspector/scripts/tests/expected/fail-on-domain-targetTypes-value.json-error: * inspector/scripts/tests/expected/fail-on-event-targetType-matching-domain-debuggableType.json-error: * inspector/scripts/tests/expected/fail-on-event-targetTypes-value.json-error: 2021-10-06 Mark Lam Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal. https://bugs.webkit.org/show_bug.cgi?id=231252 rdar://83310320 Reviewed by Yusuke Suzuki. We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal(). Adding a null check here as a speculative fix to mitigate crashes while we investigate further. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::handlePutByVal): 2021-10-06 Saam Barati Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser https://bugs.webkit.org/show_bug.cgi?id=230823 Reviewed by Robin Morisset. We've found yet another bug where pruning code after OSR exits before running backwards propagation leads to us breaking the spec in weird IR situations. In the particular test case here, we end up not thinking we care about negative zero for an ArithNegate, and we exit the program while recovering the value 0 instead of -0. Fundamentally, backwards propagation wants to see all bytecode uses. Therefore, it seems like a more sound strategy to run backwards propagation before we end up mucking with the graph. This patch makes it so we run backwards propagation inside bytecode parser before we prune the IR. That way, the phase sees the graph as if it's an IR over the whole bytecode graph. * bytecode/Operands.h: (JSC::Operands::operator!= const): * dfg/DFGBackwardsPropagationPhase.cpp: (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase): (JSC::DFG::BackwardsPropagationPhase::run): (JSC::DFG::BackwardsPropagationPhase::mergeFlags): (JSC::DFG::BackwardsPropagationPhase::propagate): (JSC::DFG::performBackwardsPropagation): * dfg/DFGBackwardsPropagationPhase.h: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parse): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::compileInThreadImpl): * dfg/DFGUnificationPhase.cpp: (JSC::DFG::UnificationPhase::run): 2021-10-06 Xan López [JSC][32bit] Remove a bunch of compiler warnings https://bugs.webkit.org/show_bug.cgi?id=231091 Reviewed by Carlos Alberto Lopez Perez. * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): silence warning about unused variable, it's not used in 32-bit. * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_enter): use an unsigned int for the loop count. 2021-10-06 Carlos Garcia Campos [WPE][GTK] TestJSC incorrectly expects garbage collector to collect variables still on the stack https://bugs.webkit.org/show_bug.cgi?id=222972 Reviewed by Michael Catanzaro. Add JSCContextInternal.h header to be used by unit tests to use private JSC API and add jscContextGarbageCollect(). * API/glib/JSCContext.cpp: (jscContextGarbageCollect): Moved from unit tests here adding a parameter to optionally call sanitizeStackForVM() before doing the garbage collection. * API/glib/JSCContextInternal.h: Added. 2021-10-06 Jer Noble [Build-time perf] Forward declare JS TypedArrays https://bugs.webkit.org/show_bug.cgi?id=231196 Reviewed by Tim Horton. Add a new file, Forward.h, containing forward declarations of commonly used JavaScriptCore types. Removed duplicate declarations of TypedArray classes from TypedArrayAdapters.h and TypedArrays.h. * JavaScriptCore.xcodeproj/project.pbxproj: * runtime/Forward.h: Added. * runtime/TypedArrayAdaptors.h: * runtime/TypedArrayAdaptersForwardDeclarations.h: Added. * runtime/TypedArrays.h: 2021-10-06 Mikhail R. Gadelha Fix wrong edge type from get-by-val in 32 bits https://bugs.webkit.org/show_bug.cgi?id=231179 Reviewed by Yusuke Suzuki. After https://bugs.webkit.org/show_bug.cgi?id=230801, a different type can be set in DFG nodes, however, in 32 bits jsc was always setting the type to Cell. This caused jsc to abort when verify the type of the edge: DFG ASSERTION FAILED: Edge verification error: D@64->Check:Object:D@60 was expected to have type Object but has type Cell (43984760078335) This patch changes the 32 bits version of the compileEnumeratorGetByVal to manually speculate the edge if it is a Cell, since a differente Kind could've been during Fixup. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): 2021-10-05 Saam Barati Don't pass DontBuildStrings to next token after parsing an empty parameter list https://bugs.webkit.org/show_bug.cgi?id=225094 Reviewed by Yusuke Suzuki. We might need the string, it turns out! * parser/Parser.cpp: (JSC::Parser::parseArguments): 2021-10-05 Patrick Angle Web Inspector: Show color space for canvases in the Graphics tab on the overview cards https://bugs.webkit.org/show_bug.cgi?id=231205 Reviewed by Devin Rousso. Use an enum instead of strings for color space values sent to the frontend. * inspector/protocol/Canvas.json: * inspector/scripts/codegen/generator.py: 2021-10-05 Mark Lam CodeBlock should not add/remove LoopHintExecutionCounters. https://bugs.webkit.org/show_bug.cgi?id=231209 rdar://83571235 Reviewed by Saam Barati. This is because cached unlinked baseline JIT code would retain a pointer to those counters. Hence, the UnlinkedCodeBlock should do the add /remove of the counters instead. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::~CodeBlock): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::initializeLoopHintExecutionCounter): (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): * bytecode/UnlinkedCodeBlock.h: * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): 2021-10-05 Kate Cheney CSP: unsafe-eval tests timing out or failing https://bugs.webkit.org/show_bug.cgi?id=231113 Reviewed by Brent Fulgham. Many imported unsafe-eval tests are failing because we don't report violations to the DOM or report URI when an eval is blocked. This patch adds support for that by calling ContentSecurityPolicy::allowEval() when eval is disabled. Eventually I think we can remove the evalEnabled() code and check the CSP policy instead, but I will save that for another patch. * API/JSAPIGlobalObject.cpp: * API/JSAPIGlobalObject.mm: * interpreter/Interpreter.cpp: (JSC::eval): * jsc.cpp: * runtime/DirectEvalExecutable.cpp: (JSC::DirectEvalExecutable::create): * runtime/FunctionConstructor.cpp: (JSC::constructFunction): * runtime/IndirectEvalExecutable.cpp: (JSC::IndirectEvalExecutable::create): * runtime/JSGlobalObject.cpp: * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::reportViolationForUnsafeEval): Per the spec we should send the report to the element's document and bubble it up to the window. * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-10-05 Xan López [JSC][32bit] Fix bugs after unlinked baseline jit https://bugs.webkit.org/show_bug.cgi?id=231232 Reviewed by Yusuke Suzuki. Fix a bunch of bugs introduced with unlinked baseline jit. As of now we are disabling DataIC on baseline JIT to get things working ASAP, making that work will be the next step. This makes us almost go back to green bots. (Patch co-authored with Geza Lore) * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::emitDataICFastPath): ASSERT we are not using DataIC on 32-bit. * bytecode/CodeBlock.h: (JSC::CodeBlock::hasDebuggerRequests const): (JSC::CodeBlock::debuggerRequestsAddress): Deleted. * jit/JITCall32_64.cpp: (JSC::JIT::compileOpCall): don't use DataIC. (JSC::JIT::compileOpCallSlowCase): set missing label. * jit/JITCode.h: (JSC::JITCode::useDataIC): disable DataIC on baseline JIT for 32-bit. * jit/JITInlines.h: (JSC::JIT::getConstantOperand): get constants from the CodeBlock, since we don't do sharing on 32-bit. (JSC::JIT::emitValueProfilingSite): remove an overzealous ASSERT. (JSC::JIT::loadConstant): use sizeof(void*) instead of '8', makes things work on 32-bit. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_debug): share this with 32-bit. * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_debug): Deleted. * llint/LowLevelInterpreter32_64.asm: do not thrash the PC register. 2021-10-05 Yusuke Suzuki [JSC] JSPropertyNameEnumerator should not have cached prototype chain since empty JSPropertyNameEnumerator is shared https://bugs.webkit.org/show_bug.cgi?id=231202 rdar://83815122 Reviewed by Keith Miller. r282014 assumed an invariant that JSPropertyNameEnumerator's StructureChain is immutable. This invariant is also used in validation of JSPropertyNameEnumerator. However, this invariant was broken since we now have shared empty sentinel JSPropertyNameEnumerator, which can be used for different structures having different prototype chain. Since now we have shared JSPropertyNameEnumerator, JSPropertyNameEnumerator should not have StructureChain in its member. When invalidating StructureChain in Structure, we also clear cached JSPropertyNameEnumerator so that we do not get a stale JSPropertyNameEnumerator from Structure even though watchpoint-based validation is not used. This patch also removes ValidatedViaWatchpoint flag in JSPropertyNameEnumerator due to the same reason. We should not modify JSPropertyNameEnumerator once it is instantiated. Instead, we encode this flag as a lowest bit of m_cachedPropertyNameEnumerator. If it is validated via traversing (not watchpoints), then this bit is set. So when loading that pointer from StructureRareData, we can quickly detect it without even accessing to the enumerator. This fixes the issue, and it is even cleaner. We rename m_cachedPropertyNameEnumerator to m_cachedPropertyNameEnumeratorAndFlag since it now includes this flag. While reviewing the code, we also found that watchpoint-based validation didn't care about PolyProto. We should disable watchpoint-based validation if PolyProto is used. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_property_enumerator): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter64.asm: * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::visitChildrenImpl): * runtime/JSPropertyNameEnumerator.h: (JSC::propertyNameEnumerator): * runtime/Structure.cpp: (JSC::Structure::visitChildrenImpl): (JSC::Structure::setCachedPropertyNameEnumerator): (JSC::Structure::cachedPropertyNameEnumeratorAndFlag const): * runtime/Structure.h: (JSC::Structure::propertyNameEnumeratorShouldWatch const): * runtime/StructureInlines.h: (JSC::Structure::prototypeChain const): (JSC::Structure::clearCachedPrototypeChain): * runtime/StructureRareData.cpp: (JSC::StructureRareData::visitChildrenImpl): * runtime/StructureRareData.h: * runtime/StructureRareDataInlines.h: (JSC::StructureRareData::cachedPropertyNameEnumerator const): (JSC::StructureRareData::cachedPropertyNameEnumeratorAndFlag const): (JSC::StructureRareData::setCachedPropertyNameEnumerator): (JSC::StructureChainInvalidationWatchpoint::fireInternal): (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint): (JSC::StructureRareData::clearCachedPropertyNameEnumerator): (JSC::StructureRareData::invalidateWatchpointBasedValidation): Deleted. 2021-10-04 Saam Barati Display return values in nicer way in the jsc REPL and add a prettyPrint function https://bugs.webkit.org/show_bug.cgi?id=230931 Reviewed by Tadeu Zagallo. Currently, print(1), print("1"), and print([1]) all print to stdout simply as "1" (without the quotes). Same for values when running the REPL. This isn't super helpful. Let's print quotes for strings, and brackets for arrays. This patch adds a prettyPrint function to do that, since we have a lot of tests that depend on the old print behavior. This patch also makes values printed in the REPL the new pretty style. * jsc.cpp: (toCString): (printInternal): (JSC_DEFINE_HOST_FUNCTION): (runInteractive): (cStringFromViewWithString): Deleted. * runtime/JSCJSValue.cpp: (JSC::JSValue::toWTFStringForConsole const): * runtime/JSCJSValue.h: 2021-10-04 Saam Barati IntrinsicGetterAccessCase implementation of __proto__ needs to handle get_by_id_with_this https://bugs.webkit.org/show_bug.cgi?id=229951 Reviewed by Yusuke Suzuki. The whole point of get_by_id_with_this is to have different slot base values for |this| vs the slot base when invoking getters. However, our intrinsic getter inlining wasn't respecting this. This patch makes the __proto__ intrinsic getter do the right thing. For typed array intrinsic getters, if they have different |this| value vs slot base, we chose not to inline them, because the type checks are not on the |this| value, so they're not guaranteed to be typed arrays. We can improve upon this in the future. * bytecode/IntrinsicGetterAccessCase.h: * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitLoadPrototypeWithoutCheck): * jit/AssemblyHelpers.h: * jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::canEmitIntrinsicGetter): (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): * jit/Repatch.cpp: (JSC::tryCacheGetBy): 2021-10-03 Don Olmstead Non-unified build fixes, early October 2021 edition https://bugs.webkit.org/show_bug.cgi?id=231143 Unreviewed non-unified build fixes. * jit/BaselineJITCode.cpp: 2021-10-03 Lauro Moura Remove control reaches end of non-void function warning Unreviewed. Warning introduced in r283139. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const): 2021-10-02 Yusuke Suzuki [JSC] DateTimeFormat.resolvedOptions shouldn't return an object with other date/time properties if dateStyle or timeStyle are set https://bugs.webkit.org/show_bug.cgi?id=231041 Reviewed by Ross Kirsling. When "dateStyle" or "timestyle" option is specified in Intl.DateTimeFormat, we should not expose detailed resolved format information in resolvedOptions, since specifying these options is not what the user of this Intl.DateTimeFormat intended. This is specified in the spec[1] step 5-d. [1]: https://tc39.es/ecma402/#sec-intl.datetimeformat.prototype.resolvedoptions * runtime/IntlDateTimeFormat.cpp: (JSC::IntlDateTimeFormat::resolvedOptions const): 2021-10-02 Yusuke Suzuki [JSC] Enable Intl.DisplayNames without ICU version check https://bugs.webkit.org/show_bug.cgi?id=231122 Reviewed by Ross Kirsling. Now every port requires ICU 61.2 or later. Since Intl.DisplayNames requires ICU 61, we can enable it without ICU version check. This simplifies Intl.DisplayNames code. * runtime/IntlDisplayNames.cpp: (JSC::IntlDisplayNames::initializeDisplayNames): (JSC::IntlDisplayNames::of const): * runtime/IntlDisplayNames.h: * runtime/IntlObject.cpp: (JSC::IntlObject::finishCreation): 2021-10-02 Yusuke Suzuki [JSC] Enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build https://bugs.webkit.org/show_bug.cgi?id=231120 Reviewed by Ross Kirsling. We now assume that ICU is 64.2 or later in Darwin since Mojave WebKit build is no longer supported. We enable HAVE_ICU_U_DATE_INTERVAL_FORMAT_FORMAT_RANGE_TO_PARTS on Darwin OSS build. * runtime/IntlDateTimeFormat.h: 2021-10-02 Yusuke Suzuki Remove JSC hack after r283410 https://bugs.webkit.org/show_bug.cgi?id=230261 Reviewed by Mark Lam. * runtime/JSObject.cpp: (JSC::JSObject::getOwnPropertyDescriptor): * runtime/PropertySlot.h: 2021-10-01 Commit Queue Unreviewed, reverting r283293. https://bugs.webkit.org/show_bug.cgi?id=231116 changing print() broke a lot of random things Reverted changeset: "Print values in a nicer way in the jsc shell" https://bugs.webkit.org/show_bug.cgi?id=230931 https://commits.webkit.org/r283293 2021-10-01 Yusuke Suzuki Disable new incumbent-window until it is fully implemented https://bugs.webkit.org/show_bug.cgi?id=230261 Reviewed by Chris Dumez and Geoffrey Garen. * interpreter/CallFrame.cpp: (JSC::CallFrame::globalObjectOfClosestCodeBlock): * runtime/JSObject.cpp: (JSC::JSObject::getOwnPropertyDescriptor): * runtime/PropertySlot.h: 2021-10-01 Xan López [JSC][32bit] Fix build after unlinked baseline JIT https://bugs.webkit.org/show_bug.cgi?id=230803 Reviewed by Saam Barati. This is enough to make things build, but pretty much nothing works yet. Will fix in a follow-up, this way we at least give people a chance at not introducing more build regressions. (With some code by Mikhail R. Gadelha and Geza Lore) * CMakeLists.txt: * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branch32): (JSC::MacroAssemblerARMv7::branchAdd32): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::branchAdd32): * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): * jit/JIT.h: * jit/JITCall32_64.cpp: (JSC::JIT::compileOpCall): * jit/JITInlines.h: (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitArrayProfilingSiteWithCell): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_loop_hint): * jit/JITPropertyAccess.cpp: (JSC::JIT::emitVarInjectionCheck): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_brand): (JSC::JIT::emitResolveClosure): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitPutGlobalVariableIndirect): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::emitVarInjectionCheck): Deleted. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: 2021-10-01 Yusuke Suzuki [JSC] Remove CodeBlock::m_numberOfNonArgumentValueProfiles since we can get the same value from UnlinkedCodeBlock https://bugs.webkit.org/show_bug.cgi?id=231066 Reviewed by Robin Morisset. Since UnlinkedCodeBlock has UnlinkedValueProfile FixedVector, we can get CodeBlock::m_numberOfNonArgumentValueProfiles from UnlinkedCodeBlock. So CodeBlock does not need to keep it in its member. We also reorder some fields to shrink sizeof(CodeBlock) after this change. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finishCreation): * bytecode/CodeBlock.h: (JSC::CodeBlock::numberOfNonArgumentValueProfiles): (JSC::CodeBlock::totalNumberOfValueProfiles): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::numberOfValueProfiles const): (JSC::UnlinkedCodeBlock::numberOfArrayProfiles const): 2021-10-01 Olivier Blin [JSC][GLib] Fix typo in WrapperMap creation methods https://bugs.webkit.org/show_bug.cgi?id=231076 Reviewed by Michael Catanzaro. * API/glib/JSCContext.cpp: (jscContextGetOrCreateJSWrapper): (jscContextCreateContextWithJSWrapper): * API/glib/JSCWrapperMap.cpp: (JSC::WrapperMap::createJSWrapper): (JSC::WrapperMap::createContextWithJSWrapper): (JSC::WrapperMap::createJSWrappper): Deleted. (JSC::WrapperMap::createContextWithJSWrappper): Deleted. * API/glib/JSCWrapperMap.h: 2021-09-30 Yusuke Suzuki Upgrade GCC requirement to 8.3.0 https://bugs.webkit.org/show_bug.cgi?id=231042 Reviewed by Darin Adler. * runtime/ConfigFile.cpp: (JSC::ConfigFile::canonicalizePaths): 2021-09-30 Saam Barati Regressions (r283288): [ macOS Debug ] webgl/2.0.0/conformance/state/gl-object-get-calls.html is timing out https://bugs.webkit.org/show_bug.cgi?id=231024 Reviewed by Mark Lam. Speed up our debug assert by not using a probe. * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): 2021-09-30 Saam Barati The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable https://bugs.webkit.org/show_bug.cgi?id=230804 Reviewed by Yusuke Suzuki. This patch fixes a couple bugs: - We were constant folding typeof on ProxyObject to "object" even when ProxyObject might produce a callable Proxy, and hence, should produce "function". This was a bug in AI. - This also fixes a similar bug in IsCallable's implementation in the FTL where we assumed that ProxyObject's type can't be callable. * bytecode/SpeculatedType.h: * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-09-30 Fujii Hironori Python 3 fails to run run-builtins-generator-tests : ModuleNotFoundError: No module named 'builtins_model' https://bugs.webkit.org/show_bug.cgi?id=230870 Reviewed by Jonathan Bedard. BaseException.message has been deprecated as of Python 2.6. Use str(e) instead. Implicit relative imports have been deprecated in Python 3. Basically, relative imports should be used. However, the scripts in wkbuiltins directory are flattened when they are copied to WebKitBuild directory. So, relative imports can't be used. So, append wkbuiltins directory to sys.path as a workaround. * Scripts/generate-js-builtins.py: 2021-09-29 Mark Lam DFG strength reduction on % operator should handle an INT_MIN divisor. https://bugs.webkit.org/show_bug.cgi?id=230391 Reviewed by Robin Morisset. * dfg/DFGStrengthReductionPhase.cpp: (JSC::DFG::StrengthReductionPhase::handleNode): 2021-09-29 Saam Barati Print values in a nicer way in the jsc shell https://bugs.webkit.org/show_bug.cgi?id=230931 Reviewed by Tadeu Zagallo. Currently, print(1), print("1"), and print([1]) all print to stdout simply as "1" (without the quotes). Same for values when running the REPL. This isn't super helpful. Let's print quotes for strings, and brackets for arrays. Some tests rely on the old print behavior. Those tests now use the legacyPrint instead. * jsc.cpp: (toCString): (printInternal): (JSC_DEFINE_HOST_FUNCTION): (runInteractive): (cStringFromViewWithString): Deleted. * runtime/JSCJSValue.cpp: (JSC::JSValue::toWTFStringForConsole const): * runtime/JSCJSValue.h: 2021-09-29 Saam Barati We need to load the baseline JIT's constant pool register after OSR exit to checkpoints if we return to baseline code https://bugs.webkit.org/show_bug.cgi?id=230972 Reviewed by Mark Lam and Yusuke Suzuki. Consider the following: - We have a CodeBlock A. - DFG or FTL compiles an exit to A when A is still LLInt code. This means the OSR exit code will materialize registers as if A is LLInt. - We tier up A to Baseline JIT code. - Now, we take the exit to A as if it's LLInt. But the checkpoint OSR exit code will actually jump to the tiered up baseline code when it's done, because it determines where to jump at runtime. Because of this, when we return from the checkpoint code, and if we are jumping into baseline code, we must always load the constant pool register. - There's no need to load the metadata register because that register is shared with LLInt code, and will already contain the right value. * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::dispatchToNextInstructionDuringExit): (JSC::LLInt::llint_slow_path_checkpoint_osr_exit_from_inlined_call): (JSC::LLInt::llint_slow_path_checkpoint_osr_exit): (JSC::LLInt::dispatchToNextInstruction): Deleted. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: 2021-09-29 Basuke Suzuki Suppress warnings for implicit copy assignment operator/copy constructor with clang 13 https://bugs.webkit.org/show_bug.cgi?id=230963 Reviewed by Mark Lam. Added default copy constructor to suppress warning. * bytecode/Operands.h: 2021-09-29 Basuke Suzuki [JSC] Add objectTypeCounts to JSGetMemoryUsageStatistics https://bugs.webkit.org/show_bug.cgi?id=230957 Reviewed by Yusuke Suzuki. * API/JSBase.cpp: Added objectTypeCounts property (JSGetMemoryUsageStatistics): * API/JSBasePrivate.h: Added description of objectTypeCounts property * jsc.cpp: Added memoryUsageStatistics() function 2021-09-29 Yusuke Suzuki [JSC] Remove CodeBlock::m_llintExecuteCounter https://bugs.webkit.org/show_bug.cgi?id=230938 Reviewed by Keith Miller. CodeBlock::m_llintExecuteCounter is a pointer pointing the middle of UnlinkedCodeBlock. So this is not necessary to have this pointer separately to access to that from LLInt, since loading UnlinkedCodeBlock and accessing to the middle of that do the same number of loads. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::jitSoon): (JSC::CodeBlock::jitNextInvocation): * bytecode/CodeBlock.h: (JSC::CodeBlock::checkIfJITThresholdReached): (JSC::CodeBlock::dontJITAnytimeSoon): (JSC::CodeBlock::llintExecuteCounter const): (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted. * llint/LowLevelInterpreter.asm: 2021-09-29 Saam Barati Code inside strength reduction can incorrectly prove that we know what lastIndex is https://bugs.webkit.org/show_bug.cgi?id=230802 Reviewed by Mark Lam. The phase was searching backwards in the graph to see if it found the RegExp node. However, the RegExp node might be a JSConstant. Hence, the program didn't allocate it. So we can't assume that we know what the lastIndex is. We were incorrectly assuming it was "0" in a program like this: a: JSConstant(RegExp) b: RegExpExec(@a) And we assumed we're invoking RegExpExec with lastIndex is 0, because we found our RegExp in a backwards search. This is likely because we're also matching NewRegExp nodes, in which case, it is valid to say lastIndex is 0. This caused us to return a constant value that would've been the exec result had we invoked it with a NewRegExpNode. * dfg/DFGStrengthReductionPhase.cpp: (JSC::DFG::StrengthReductionPhase::run): (JSC::DFG::StrengthReductionPhase::handleNode): 2021-09-29 Yusuke Suzuki [JSC] Use FixedVector in JITConstantPool https://bugs.webkit.org/show_bug.cgi?id=230937 Reviewed by Keith Miller. This patch changes JITConstantPool to use FixedVector. This allocates exact size of memory and Making sizeof(JITConstantPool) smaller. We also use CompactPointerTuple for JITConstantPool::Value since it is faster for access. To achieve that, in JIT, we append Value to normal Vector. And when finalizing BaselineJITCode we construct JITConstantPool from that Vector. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::setupWithUnlinkedBaselineCode): * jit/BaselineJITCode.h: (JSC::JITConstantPool::JITConstantPool): (JSC::JITConstantPool::add): Deleted. * jit/JIT.cpp: (JSC::JIT::JIT): (JSC::JIT::addToConstantPool): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::compileOpCall): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emit_op_iterator_next): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emit_op_enumerator_get_by_val): 2021-09-28 Saam Barati DoesGCCheck does not use enough bits for nodeIndex https://bugs.webkit.org/show_bug.cgi?id=230915 Reviewed by Mark Lam. * dfg/DFGDoesGCCheck.h: (JSC::DFG::DoesGCCheck::DoesGCCheck): (JSC::DFG::DoesGCCheck::encode): (JSC::DFG::DoesGCCheck::set): (JSC::DFG::DoesGCCheck::expectDoesGC const): (JSC::DFG::DoesGCCheck::isSpecial const): (JSC::DFG::DoesGCCheck::special): (JSC::DFG::DoesGCCheck::nodeOp): (JSC::DFG::DoesGCCheck::nodeIndex): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileLoopHint): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): 2021-09-28 Alex Christensen Mostly fix Mac CMake build https://bugs.webkit.org/show_bug.cgi?id=230868 Reviewed by Don Olmstead. * shell/PlatformMac.cmake: 2021-09-28 Saam Barati Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata https://bugs.webkit.org/show_bug.cgi?id=230798 Reviewed by Yusuke Suzuki. This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile have an index into a table instead of storing a pointer to the profile in its metadata. Then, we can just load the profile using the index in the bytecode, which saves memory. * bytecode/BytecodeList.rb: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): * bytecode/UnlinkedCodeBlockGenerator.h: (JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile): (JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile): * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitUnaryOp): (JSC::BytecodeGenerator::emitInc): (JSC::BytecodeGenerator::emitDec): * bytecompiler/BytecodeGenerator.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_op_negate): (JSC::JIT::emit_op_add): (JSC::JIT::emit_op_div): (JSC::JIT::emit_op_mul): (JSC::JIT::emit_op_sub): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CommonSlowPaths.cpp: (JSC::updateArithProfileForUnaryArithOp): (JSC::JSC_DEFINE_COMMON_SLOW_PATH): 2021-09-28 Alexey Shvayka Speed up setting JSFunction's "prototype" property https://bugs.webkit.org/show_bug.cgi?id=230864 Reviewed by Yusuke Suzuki. This patch: 1. Removes "prototype" lookup from put(), which was non-inlineable and created an interim object with "constructor" field. Instead, the new value is put directly, with correct attributes, and respecting an altered receiver. This results in 2.8X perf boost for very common case of setting "prototype": `Cat.prototype = new Animal`. 2. Simplifies initialization of class constructor's prototype object, removing tentacles from getOwnPropertySlot() and extracting constructPrototypeObject() helper. Provides a fast path for op_define_data_property, speeding up `class` creation by ~40%, while reifies normal function's prototype with correct attributes for Object.defineProperty(). * runtime/JSFunction.cpp: (JSC::constructPrototypeObject): (JSC::JSFunction::getOwnPropertySlot): (JSC::JSFunction::put): (JSC::JSFunction::defineOwnProperty): 2021-09-27 Yusuke Suzuki [WTF] Add ApproximateTime https://bugs.webkit.org/show_bug.cgi?id=230876 Reviewed by Filip Pizlo. This patch adds ApproximateTime, which offers monotonically increasing time but with coarse-grained resolution. ApproximateTime::now() is faster than normal MonotonicTime::now(), so that we can use this when we do not care about high resolution. For example, in Darwin x64, it is ~4x faster. Internally, it is using mach_approximate_time() in Darwin, clock_gettime+CLOCK_MONOTONIC_COARSE in Linux, and clock_gettime+CLOCK_MONOTONIC_FAST in FreeBSD. On the other platforms, we simply use the same source to MonotonicTime. wall-time-now 102.2614+-0.2449 approximate-time-now 23.2583+-0.4083 monotonic-time-now 88.8518+-2.4106 We would like to use it in some places in JavaScriptCore in a subsequent patch: CodeBlock's creation time, GC time etc. * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-09-28 Alexey Shvayka Tweak isCallable() to early return `true` for InternalFunction instances https://bugs.webkit.org/show_bug.cgi?id=230869 Reviewed by Yusuke Suzuki. With this change, isCallable() avoids calling into InternalFunction::getCallData(), which is concurrency-aware and guaranteed to never return CallData::Type::None. We have a similar optimization for JSFunction. * runtime/JSCellInlines.h: (JSC::JSCell::isCallableWithConcurrency): 2021-09-27 Saam Barati Build an unlinked baseline JIT https://bugs.webkit.org/show_bug.cgi?id=229223 Reviewed by Yusuke Suzuki. This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT code produced by this baseline JIT can be shared between all CodeBlocks that share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT instance, this new CodeBlock just starts off executing in the baseline JIT "for free". To make this work, the code we emit now needs to be independent of a specific CodeBlock instance. We use a CodeBlock instance for minimal profiling information when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When we need CodeBlock specific information, we load it. This usually means things like we'll load things from the Metadata dynamically. This patch also adds a "linked constant pool" concept, and anytime we instantiate such a CodeBlock, we also need to instantiate this "linked constant pool". This contains things like our inline cache data structures (StructureStubInfo*), JSGlobalObject*, etc. Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I made data ICs work on x86_64. To do this, we no longer call/ret to the IC. Instead, we jump to the IC, and the IC jumps back by loading the "done" location from the StructureStubInfo dynamically. This simplifies the design to not be based on the arm64 calling convention, and keeps the same performance characteristics. This patch also adds a new version of InlineAccess that is only used in baseline JIT (for now). In the future, we can make the DFG/FTL also use this for Data ICs. But we don't need to do that yet since those tiers don't use data ICs by default. The baseline JIT now has a pure data IC approach to InlineAccess. So instead of repatching code, we repatch fields we load dynamically. This patch also cleans up a few things in OSR exit, where both DFG/FTL were storing callee saves to the callee saves buffer in a weird place, and separate from one another. I noticed this code can be simplified if we just store callee saves at the end of the OSR exit handler, and from common JIT emission code. This patch also fixes a bug where we could end up with the wrong (and always more negative) SP in the baseline JIT. This could happen when we OSR exit from an inlined getter/setter. The OSR exit code puts the return PC when returning to the call site of the getter/setter to be the inline cache's "done location". However, this "done location" didn't used to restore SP. This patch conservatively makes it so that we restore the SP at these sites. This is measured as a 1% speedup on Speedometer2. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::fromStructureStubInfo): (JSC::AccessCase::generateImpl): * bytecode/BytecodeList.rb: * bytecode/BytecodeOperandsForCheckpoint.h: (JSC::valueProfileOffsetFor): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::fastPathStart): (JSC::CallLinkInfo::emitFastPathImpl): (JSC::CallLinkInfo::emitFastPath): (JSC::CallLinkInfo::emitTailCallFastPath): (JSC::CallLinkInfo::emitDataICFastPath): (JSC::CallLinkInfo::emitTailCallDataICFastPath): (JSC::CallLinkInfo::emitDataICSlowPath): (JSC::CallLinkInfo::initializeDataIC): (JSC::CallLinkInfo::emitDirectFastPath): (JSC::CallLinkInfo::emitDirectTailCallFastPath): * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis): (JSC::CallLinkInfo::slowStub): Deleted. (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const): (JSC::CodeBlock::setConstantRegisters): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::frameRegisterCount): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): (JSC::CodeBlock::findPC): (JSC::CodeBlock::jitSoon): (JSC::CodeBlock::jitNextInvocation): (JSC::CodeBlock::dumpMathICStats): (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted. (JSC::CodeBlock::addJITAddIC): Deleted. (JSC::CodeBlock::addJITMulIC): Deleted. (JSC::CodeBlock::addJITSubIC): Deleted. (JSC::CodeBlock::addJITNegIC): Deleted. (JSC::CodeBlock::setPCToCodeOriginMap): Deleted. (JSC::CodeBlock::thresholdForJIT): Deleted. (JSC::CodeBlock::jitAfterWarmUp): Deleted. * bytecode/CodeBlock.h: (JSC::CodeBlock::JITData::offsetOfJITConstantPool): (JSC::CodeBlock::offsetOfJITData): (JSC::CodeBlock::offsetOfArgumentValueProfiles): (JSC::CodeBlock::offsetOfConstantsVectorBuffer): (JSC::CodeBlock::baselineJITConstantPool): (JSC::CodeBlock::checkIfJITThresholdReached): (JSC::CodeBlock::dontJITAnytimeSoon): (JSC::CodeBlock::llintExecuteCounter const): (JSC::CodeBlock::offsetOfDebuggerRequests): (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::CodeBlock::addressOfNumParameters): Deleted. (JSC::CodeBlock::isKnownCell): Deleted. (JSC::CodeBlock::addMathIC): Deleted. (JSC::CodeBlock::setJITCodeMap): Deleted. (JSC::CodeBlock::jitCodeMap): Deleted. (JSC::CodeBlock::switchJumpTable): Deleted. (JSC::CodeBlock::stringSwitchJumpTable): Deleted. * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachValueProfile): (JSC::CodeBlock::jitCodeMap): (JSC::CodeBlock::baselineSwitchJumpTable): (JSC::CodeBlock::baselineStringSwitchJumpTable): (JSC::CodeBlock::dfgSwitchJumpTable): (JSC::CodeBlock::dfgStringSwitchJumpTable): * bytecode/ExecutableToCodeBlockEdge.h: * bytecode/ExecutionCounter.cpp: (JSC::ExecutionCounter::setThreshold): * bytecode/ExecutionCounter.h: (JSC::ExecutionCounter::clippedThreshold): * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile): (JSC::GetByIdModeMetadata::offsetOfMode): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::generateSelfPropertyAccess): (JSC::InlineAccess::canGenerateSelfPropertyReplace): (JSC::InlineAccess::generateSelfPropertyReplace): (JSC::InlineAccess::isCacheableArrayLength): (JSC::InlineAccess::generateArrayLength): (JSC::InlineAccess::isCacheableStringLength): (JSC::InlineAccess::generateStringLength): (JSC::InlineAccess::generateSelfInAccess): (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/InlineAccess.h: * bytecode/IterationModeMetadata.h: (JSC::IterationModeMetadata::offsetOfSeenModes): * bytecode/LLIntCallLinkInfo.h: (JSC::LLIntCallLinkInfo::offsetOfArrayProfile): * bytecode/Opcode.h: * bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::succeed): (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling): (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): (JSC::PolymorphicAccess::regenerate): * bytecode/PolymorphicAccess.h: (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted. * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfByIdSelfOffset): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): (JSC::StructureStubInfo::inlineAccessBaseStructure): (JSC::StructureStubInfo::offsetOfDoneLocation): * bytecode/SuperSampler.cpp: (JSC::printSuperSamplerState): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::UnlinkedCodeBlock::hasIdentifier): (JSC::UnlinkedCodeBlock::thresholdForJIT): (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::constantRegister): (JSC::UnlinkedCodeBlock::instructionAt const): (JSC::UnlinkedCodeBlock::bytecodeOffset): (JSC::UnlinkedCodeBlock::instructionsSize const): (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::UnlinkedCodeBlock::outOfLineJumpOffset): (JSC::UnlinkedCodeBlock::binaryArithProfile): (JSC::UnlinkedCodeBlock::unaryArithProfile): (JSC::UnlinkedCodeBlock::llintExecuteCounter): * bytecode/UnlinkedMetadataTable.h: (JSC::UnlinkedMetadataTable::offsetInMetadataTable): * bytecode/ValueProfile.h: (JSC::ValueProfileBase::ValueProfileBase): (JSC::ValueProfileBase::clearBuckets): (JSC::ValueProfile::offsetOfFirstBucket): * dfg/DFGCommonData.h: * dfg/DFGJITCode.cpp: * dfg/DFGJITCode.h: * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGOSREntry.cpp: (JSC::DFG::prepareOSREntry): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::handleExitCounts): (JSC::DFG::callerReturnPC): (JSC::DFG::reifyInlinedCallFrames): (JSC::DFG::adjustAndJumpToTarget): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePutPrivateName): (JSC::DFG::SpeculativeJIT::compileValueAdd): (JSC::DFG::SpeculativeJIT::compileValueSub): (JSC::DFG::SpeculativeJIT::compileValueNegate): (JSC::DFG::SpeculativeJIT::compileValueMul): (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLJITCode.h: * ftl/FTLLink.cpp: (JSC::FTL::link): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::addMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): * generator/Metadata.rb: * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::storeProperty): (JSC::AssemblyHelpers::emitVirtualCall): (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer): * jit/BaselineJITCode.cpp: Added. (JSC::MathICHolder::addJITAddIC): (JSC::MathICHolder::addJITMulIC): (JSC::MathICHolder::addJITSubIC): (JSC::MathICHolder::addJITNegIC): (JSC::MathICHolder::adoptMathICs): (JSC::BaselineJITCode::BaselineJITCode): (JSC::BaselineJITCode::~BaselineJITCode): * jit/BaselineJITCode.h: Added. (JSC::JITConstantPool::add): (JSC::JITConstantPool::size const): (JSC::JITConstantPool::at const): * jit/BaselineJITPlan.cpp: (JSC::BaselineJITPlan::finalize): * jit/CCallHelpers.cpp: (JSC::CCallHelpers::logShadowChickenTailPacketImpl): (JSC::CCallHelpers::logShadowChickenTailPacket): * jit/CCallHelpers.h: * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::setupCalleeSaveRegisters): * jit/CallFrameShuffleData.h: * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::CallFrameShuffler): (JSC::CallFrameShuffler::prepareForTailCall): * jit/CallFrameShuffler.h: (JSC::CallFrameShuffler::snapshot const): * jit/JIT.cpp: (JSC::JIT::JIT): (JSC::JIT::emitEnterOptimizationCheck): (JSC::JIT::emitNotifyWriteWatchpoint): (JSC::JIT::emitVarReadOnlyCheck): (JSC::JIT::assertStackPointerOffset): (JSC::JIT::resetSP): (JSC::JIT::emitPutCodeBlockToFrameInPrologue): (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters): (JSC::JIT::emitRestoreCalleeSaves): (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::link): (JSC::JIT::finalizeOnMainThread): (JSC::JIT::privateCompile): (JSC::JIT::frameRegisterCountFor): (JSC::JIT::stackPointerOffsetFor): * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_compareAndJumpSlowImpl): (JSC::JIT::emit_compareAndJumpSlow): (JSC::JIT::emit_op_negate): (JSC::JIT::emit_op_add): (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow): (JSC::JIT::emit_op_div): (JSC::JIT::emit_op_mul): (JSC::JIT::emit_op_sub): * jit/JITCall.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCall32_64.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCode.h: (JSC::JITCode::useDataIC): (JSC::JITCode::pcToCodeOriginMap): * jit/JITCompilationKey.cpp: (JSC::JITCompilationKey::dump const): * jit/JITCompilationKey.h: (JSC::JITCompilationKey::JITCompilationKey): (JSC::JITCompilationKey::operator! const): (JSC::JITCompilationKey::isHashTableDeletedValue const): (JSC::JITCompilationKey::operator== const): (JSC::JITCompilationKey::hash const): (JSC::JITCompilationKey::profiledBlock const): Deleted. * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITInlineCacheGenerator::finalize): (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdGenerator::JITGetByIdGenerator): (JSC::generateGetByIdInlineAccess): (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITDelByValGenerator::generateFastPath): (JSC::JITDelByIdGenerator::generateFastPath): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInstanceOfGenerator::generateFastPath): (JSC::JITGetByValGenerator::generateFastPath): (JSC::JITPutByValGenerator::generateFastPath): (JSC::JITPrivateBrandAccessGenerator::generateFastPath): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::isOperandConstantDouble): (JSC::JIT::isOperandConstantInt): (JSC::JIT::isKnownCell): (JSC::JIT::getConstantOperand): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile): (JSC::JIT::linkSlowCaseIfNotJSCell): (JSC::JIT::advanceToNextCheckpoint): (JSC::JIT::emitJumpSlowToHotForCheckpoint): (JSC::JIT::isOperandConstantChar): (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitArrayProfilingSiteWithCell): (JSC::JIT::emitLoadDouble): (JSC::JIT::emitJumpSlowCaseIfNotJSCell): (JSC::JIT::emitGetVirtualRegister): (JSC::JIT::jumpTarget): (JSC::JIT::loadPtrFromMetadata): (JSC::JIT::load32FromMetadata): (JSC::JIT::load8FromMetadata): (JSC::JIT::store8ToMetadata): (JSC::JIT::store32ToMetadata): (JSC::JIT::materializePointerIntoMetadata): (JSC::JIT::loadConstant): (JSC::JIT::loadGlobalObject): (JSC::JIT::loadCodeBlockConstant): (JSC::JIT::copiedGetPutInfo): Deleted. (JSC::JIT::copiedArithProfile): Deleted. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_mov): (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::op_ret_handlerGenerator): (JSC::JIT::emit_op_to_primitive): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::valueIsFalseyGenerator): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jeq_ptr): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_jtrue): (JSC::JIT::valueIsTruthyGenerator): (JSC::JIT::emit_op_throw): (JSC::JIT::op_throw_handlerGenerator): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_debug): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_handlerGenerator): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_create_this): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jeq): (JSC::JIT::emitSlow_op_jneq): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitSlow_op_check_traps): (JSC::JIT::op_check_traps_handlerGenerator): (JSC::JIT::emit_op_new_regexp): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): (JSC::JIT::emit_op_new_array): (JSC::JIT::emit_op_new_array_with_size): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): (JSC::JIT::emit_op_profile_control_flow): (JSC::JIT::emit_op_get_argument): (JSC::JIT::emit_op_get_prototype_of): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::emit_op_jtrue): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::compileOpEqJumpSlow): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_throw): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_enter): (JSC::JIT::emit_op_create_this): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPlan.cpp: (JSC::JITPlan::key): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::slow_op_get_by_val_prepareCallGenerator): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::slow_op_get_private_name_prepareCallGenerator): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::slow_op_del_by_id_prepareCallGenerator): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::slow_op_del_by_val_prepareCallGenerator): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_prepareCallGenerator): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::slow_op_put_by_id_prepareCallGenerator): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_brand): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emitResolveClosure): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::slow_op_resolve_scopeGenerator): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::slow_op_get_from_scopeGenerator): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::slow_op_put_to_scopeGenerator): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emit_enumerator_has_propertyImpl): (JSC::JIT::emitWriteBarrier): (JSC::JIT::emitPutGlobalVariable): Deleted. (JSC::JIT::emitPutGlobalVariableIndirect): Deleted. (JSC::JIT::emitPutClosureVar): Deleted. * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): * jit/Repatch.cpp: (JSC::tryCacheGetBy): (JSC::tryCachePutBy): (JSC::tryCacheInBy): (JSC::unlinkCall): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CacheableIdentifier.h: * runtime/CacheableIdentifierInlines.h: (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock): * runtime/CachedTypes.cpp: (JSC::CachedCodeBlock::numBinaryArithProfiles const): (JSC::CachedCodeBlock::numUnaryArithProfiles const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedCodeBlock::encode): * runtime/CommonSlowPaths.cpp: (JSC::updateArithProfileForUnaryArithOp): * runtime/FunctionExecutable.h: * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::prepareForExecutionImpl): * wasm/WasmLLIntTierUpCounter.h: (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp): (JSC::Wasm::LLIntTierUpCounter::optimizeSoon): * wasm/WasmTierUpCount.cpp: (JSC::Wasm::TierUpCount::TierUpCount): * wasm/WasmTierUpCount.h: (JSC::Wasm::TierUpCount::optimizeAfterWarmUp): (JSC::Wasm::TierUpCount::optimizeNextInvocation): (JSC::Wasm::TierUpCount::optimizeSoon): 2021-09-27 Xan López [JSC][32bit] Fix build after r283098 https://bugs.webkit.org/show_bug.cgi?id=230856 Unreviewed build fix. * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jeq_ptr): remove unused (broken) line. 2021-09-27 Commit Queue Unreviewed, reverting r283102, r283103 and r283104. https://bugs.webkit.org/show_bug.cgi?id=230854 It regresses JetStream2 on iOS devices Reverted changesets: "Build an unlinked baseline JIT" https://bugs.webkit.org/show_bug.cgi?id=229223 https://commits.webkit.org/r283102 "Unreviewed, fix CLoop build" https://bugs.webkit.org/show_bug.cgi?id=229223 https://commits.webkit.org/r283103 "Unreviewed, fix CLoop build part 2" https://bugs.webkit.org/show_bug.cgi?id=229223 https://commits.webkit.org/r283104 2021-09-27 Yusuke Suzuki Unreviewed, fix CLoop build part 2 https://bugs.webkit.org/show_bug.cgi?id=229223 * llint/LowLevelInterpreter64.asm: 2021-09-27 Yusuke Suzuki Unreviewed, fix CLoop build https://bugs.webkit.org/show_bug.cgi?id=229223 * llint/LLIntOfflineAsmConfig.h: * llint/LowLevelInterpreter64.asm: 2021-09-27 Saam Barati Build an unlinked baseline JIT https://bugs.webkit.org/show_bug.cgi?id=229223 Reviewed by Yusuke Suzuki. This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT code produced by this baseline JIT can be shared between all CodeBlocks that share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT instance, this new CodeBlock just starts off executing in the baseline JIT "for free". To make this work, the code we emit now needs to be independent of a specific CodeBlock instance. We use a CodeBlock instance for minimal profiling information when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When we need CodeBlock specific information, we load it. This usually means things like we'll load things from the Metadata dynamically. This patch also adds a "linked constant pool" concept, and anytime we instantiate such a CodeBlock, we also need to instantiate this "linked constant pool". This contains things like our inline cache data structures (StructureStubInfo*), JSGlobalObject*, etc. Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I made data ICs work on x86_64. To do this, we no longer call/ret to the IC. Instead, we jump to the IC, and the IC jumps back by loading the "done" location from the StructureStubInfo dynamically. This simplifies the design to not be based on the arm64 calling convention, and keeps the same performance characteristics. This patch also adds a new version of InlineAccess that is only used in baseline JIT (for now). In the future, we can make the DFG/FTL also use this for Data ICs. But we don't need to do that yet since those tiers don't use data ICs by default. The baseline JIT now has a pure data IC approach to InlineAccess. So instead of repatching code, we repatch fields we load dynamically. This patch also cleans up a few things in OSR exit, where both DFG/FTL were storing callee saves to the callee saves buffer in a weird place, and separate from one another. I noticed this code can be simplified if we just store callee saves at the end of the OSR exit handler, and from common JIT emission code. This patch also fixes a bug where we could end up with the wrong (and always more negative) SP in the baseline JIT. This could happen when we OSR exit from an inlined getter/setter. The OSR exit code puts the return PC when returning to the call site of the getter/setter to be the inline cache's "done location". However, this "done location" didn't used to restore SP. This patch conservatively makes it so that we restore the SP at these sites. This is measured as a 1% speedup on Speedometer2. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::fromStructureStubInfo): (JSC::AccessCase::generateImpl): * bytecode/BytecodeList.rb: * bytecode/BytecodeOperandsForCheckpoint.h: (JSC::valueProfileOffsetFor): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::fastPathStart): (JSC::CallLinkInfo::emitFastPathImpl): (JSC::CallLinkInfo::emitFastPath): (JSC::CallLinkInfo::emitTailCallFastPath): (JSC::CallLinkInfo::emitDataICFastPath): (JSC::CallLinkInfo::emitTailCallDataICFastPath): (JSC::CallLinkInfo::emitDataICSlowPath): (JSC::CallLinkInfo::initializeDataIC): (JSC::CallLinkInfo::emitDirectFastPath): (JSC::CallLinkInfo::emitDirectTailCallFastPath): * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis): (JSC::CallLinkInfo::slowStub): Deleted. (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const): (JSC::CodeBlock::setConstantRegisters): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::frameRegisterCount): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): (JSC::CodeBlock::findPC): (JSC::CodeBlock::jitSoon): (JSC::CodeBlock::jitNextInvocation): (JSC::CodeBlock::dumpMathICStats): (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted. (JSC::CodeBlock::addJITAddIC): Deleted. (JSC::CodeBlock::addJITMulIC): Deleted. (JSC::CodeBlock::addJITSubIC): Deleted. (JSC::CodeBlock::addJITNegIC): Deleted. (JSC::CodeBlock::setPCToCodeOriginMap): Deleted. (JSC::CodeBlock::thresholdForJIT): Deleted. (JSC::CodeBlock::jitAfterWarmUp): Deleted. * bytecode/CodeBlock.h: (JSC::CodeBlock::JITData::offsetOfJITConstantPool): (JSC::CodeBlock::offsetOfJITData): (JSC::CodeBlock::offsetOfArgumentValueProfiles): (JSC::CodeBlock::offsetOfConstantsVectorBuffer): (JSC::CodeBlock::baselineJITConstantPool): (JSC::CodeBlock::checkIfJITThresholdReached): (JSC::CodeBlock::dontJITAnytimeSoon): (JSC::CodeBlock::llintExecuteCounter const): (JSC::CodeBlock::offsetOfDebuggerRequests): (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::CodeBlock::addressOfNumParameters): Deleted. (JSC::CodeBlock::isKnownCell): Deleted. (JSC::CodeBlock::addMathIC): Deleted. (JSC::CodeBlock::setJITCodeMap): Deleted. (JSC::CodeBlock::jitCodeMap): Deleted. (JSC::CodeBlock::switchJumpTable): Deleted. (JSC::CodeBlock::stringSwitchJumpTable): Deleted. * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachValueProfile): (JSC::CodeBlock::jitCodeMap): (JSC::CodeBlock::baselineSwitchJumpTable): (JSC::CodeBlock::baselineStringSwitchJumpTable): (JSC::CodeBlock::dfgSwitchJumpTable): (JSC::CodeBlock::dfgStringSwitchJumpTable): * bytecode/ExecutableToCodeBlockEdge.h: * bytecode/ExecutionCounter.cpp: (JSC::ExecutionCounter::setThreshold): * bytecode/ExecutionCounter.h: (JSC::ExecutionCounter::clippedThreshold): * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile): (JSC::GetByIdModeMetadata::offsetOfMode): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::generateSelfPropertyAccess): (JSC::InlineAccess::canGenerateSelfPropertyReplace): (JSC::InlineAccess::generateSelfPropertyReplace): (JSC::InlineAccess::isCacheableArrayLength): (JSC::InlineAccess::generateArrayLength): (JSC::InlineAccess::isCacheableStringLength): (JSC::InlineAccess::generateStringLength): (JSC::InlineAccess::generateSelfInAccess): (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/InlineAccess.h: * bytecode/IterationModeMetadata.h: (JSC::IterationModeMetadata::offsetOfSeenModes): * bytecode/LLIntCallLinkInfo.h: (JSC::LLIntCallLinkInfo::offsetOfArrayProfile): * bytecode/Opcode.h: * bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::succeed): (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling): (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): (JSC::PolymorphicAccess::regenerate): * bytecode/PolymorphicAccess.h: (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted. * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfByIdSelfOffset): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): (JSC::StructureStubInfo::inlineAccessBaseStructure): (JSC::StructureStubInfo::offsetOfDoneLocation): * bytecode/SuperSampler.cpp: (JSC::printSuperSamplerState): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::UnlinkedCodeBlock::hasIdentifier): (JSC::UnlinkedCodeBlock::thresholdForJIT): (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::constantRegister): (JSC::UnlinkedCodeBlock::instructionAt const): (JSC::UnlinkedCodeBlock::bytecodeOffset): (JSC::UnlinkedCodeBlock::instructionsSize const): (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::UnlinkedCodeBlock::outOfLineJumpOffset): (JSC::UnlinkedCodeBlock::binaryArithProfile): (JSC::UnlinkedCodeBlock::unaryArithProfile): (JSC::UnlinkedCodeBlock::llintExecuteCounter): * bytecode/UnlinkedMetadataTable.h: (JSC::UnlinkedMetadataTable::offsetInMetadataTable): * bytecode/ValueProfile.h: (JSC::ValueProfileBase::ValueProfileBase): (JSC::ValueProfileBase::clearBuckets): (JSC::ValueProfile::offsetOfFirstBucket): * dfg/DFGCommonData.h: * dfg/DFGJITCode.cpp: * dfg/DFGJITCode.h: * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGOSREntry.cpp: (JSC::DFG::prepareOSREntry): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::handleExitCounts): (JSC::DFG::callerReturnPC): (JSC::DFG::reifyInlinedCallFrames): (JSC::DFG::adjustAndJumpToTarget): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePutPrivateName): (JSC::DFG::SpeculativeJIT::compileValueAdd): (JSC::DFG::SpeculativeJIT::compileValueSub): (JSC::DFG::SpeculativeJIT::compileValueNegate): (JSC::DFG::SpeculativeJIT::compileValueMul): (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLJITCode.h: * ftl/FTLLink.cpp: (JSC::FTL::link): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::addMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): * generator/Metadata.rb: * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::storeProperty): (JSC::AssemblyHelpers::emitVirtualCall): (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer): * jit/BaselineJITCode.cpp: Added. (JSC::MathICHolder::addJITAddIC): (JSC::MathICHolder::addJITMulIC): (JSC::MathICHolder::addJITSubIC): (JSC::MathICHolder::addJITNegIC): (JSC::MathICHolder::adoptMathICs): (JSC::BaselineJITCode::BaselineJITCode): (JSC::BaselineJITCode::~BaselineJITCode): * jit/BaselineJITCode.h: Added. (JSC::JITConstantPool::add): (JSC::JITConstantPool::size const): (JSC::JITConstantPool::at const): * jit/BaselineJITPlan.cpp: (JSC::BaselineJITPlan::finalize): * jit/CCallHelpers.cpp: (JSC::CCallHelpers::logShadowChickenTailPacketImpl): (JSC::CCallHelpers::logShadowChickenTailPacket): * jit/CCallHelpers.h: * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::setupCalleeSaveRegisters): * jit/CallFrameShuffleData.h: * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::CallFrameShuffler): (JSC::CallFrameShuffler::prepareForTailCall): * jit/CallFrameShuffler.h: (JSC::CallFrameShuffler::snapshot const): * jit/JIT.cpp: (JSC::JIT::JIT): (JSC::JIT::emitEnterOptimizationCheck): (JSC::JIT::emitNotifyWriteWatchpoint): (JSC::JIT::emitVarReadOnlyCheck): (JSC::JIT::assertStackPointerOffset): (JSC::JIT::resetSP): (JSC::JIT::emitPutCodeBlockToFrameInPrologue): (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters): (JSC::JIT::emitRestoreCalleeSaves): (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::link): (JSC::JIT::finalizeOnMainThread): (JSC::JIT::privateCompile): (JSC::JIT::frameRegisterCountFor): (JSC::JIT::stackPointerOffsetFor): * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_compareAndJumpSlowImpl): (JSC::JIT::emit_compareAndJumpSlow): (JSC::JIT::emit_op_negate): (JSC::JIT::emit_op_add): (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow): (JSC::JIT::emit_op_div): (JSC::JIT::emit_op_mul): (JSC::JIT::emit_op_sub): * jit/JITCall.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCall32_64.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCode.h: (JSC::JITCode::useDataIC): (JSC::JITCode::pcToCodeOriginMap): * jit/JITCompilationKey.cpp: (JSC::JITCompilationKey::dump const): * jit/JITCompilationKey.h: (JSC::JITCompilationKey::JITCompilationKey): (JSC::JITCompilationKey::operator! const): (JSC::JITCompilationKey::isHashTableDeletedValue const): (JSC::JITCompilationKey::operator== const): (JSC::JITCompilationKey::hash const): (JSC::JITCompilationKey::profiledBlock const): Deleted. * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITInlineCacheGenerator::finalize): (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdGenerator::JITGetByIdGenerator): (JSC::generateGetByIdInlineAccess): (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITDelByValGenerator::generateFastPath): (JSC::JITDelByIdGenerator::generateFastPath): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInstanceOfGenerator::generateFastPath): (JSC::JITGetByValGenerator::generateFastPath): (JSC::JITPutByValGenerator::generateFastPath): (JSC::JITPrivateBrandAccessGenerator::generateFastPath): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::isOperandConstantDouble): (JSC::JIT::isOperandConstantInt): (JSC::JIT::isKnownCell): (JSC::JIT::getConstantOperand): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile): (JSC::JIT::linkSlowCaseIfNotJSCell): (JSC::JIT::advanceToNextCheckpoint): (JSC::JIT::emitJumpSlowToHotForCheckpoint): (JSC::JIT::isOperandConstantChar): (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitArrayProfilingSiteWithCell): (JSC::JIT::emitLoadDouble): (JSC::JIT::emitJumpSlowCaseIfNotJSCell): (JSC::JIT::emitGetVirtualRegister): (JSC::JIT::jumpTarget): (JSC::JIT::loadPtrFromMetadata): (JSC::JIT::load32FromMetadata): (JSC::JIT::load8FromMetadata): (JSC::JIT::store8ToMetadata): (JSC::JIT::store32ToMetadata): (JSC::JIT::materializePointerIntoMetadata): (JSC::JIT::loadConstant): (JSC::JIT::loadGlobalObject): (JSC::JIT::loadCodeBlockConstant): (JSC::JIT::copiedGetPutInfo): Deleted. (JSC::JIT::copiedArithProfile): Deleted. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_mov): (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::op_ret_handlerGenerator): (JSC::JIT::emit_op_to_primitive): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::valueIsFalseyGenerator): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jeq_ptr): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_jtrue): (JSC::JIT::valueIsTruthyGenerator): (JSC::JIT::emit_op_throw): (JSC::JIT::op_throw_handlerGenerator): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_debug): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_handlerGenerator): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_create_this): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jeq): (JSC::JIT::emitSlow_op_jneq): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitSlow_op_check_traps): (JSC::JIT::op_check_traps_handlerGenerator): (JSC::JIT::emit_op_new_regexp): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): (JSC::JIT::emit_op_new_array): (JSC::JIT::emit_op_new_array_with_size): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): (JSC::JIT::emit_op_profile_control_flow): (JSC::JIT::emit_op_get_argument): (JSC::JIT::emit_op_get_prototype_of): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::emit_op_jtrue): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::compileOpEqJumpSlow): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_throw): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_enter): (JSC::JIT::emit_op_create_this): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPlan.cpp: (JSC::JITPlan::key): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::slow_op_get_by_val_prepareCallGenerator): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::slow_op_get_private_name_prepareCallGenerator): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::slow_op_del_by_id_prepareCallGenerator): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::slow_op_del_by_val_prepareCallGenerator): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_prepareCallGenerator): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::slow_op_put_by_id_prepareCallGenerator): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_brand): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emitResolveClosure): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::slow_op_resolve_scopeGenerator): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::slow_op_get_from_scopeGenerator): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::slow_op_put_to_scopeGenerator): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emit_enumerator_has_propertyImpl): (JSC::JIT::emitWriteBarrier): (JSC::JIT::emitPutGlobalVariable): Deleted. (JSC::JIT::emitPutGlobalVariableIndirect): Deleted. (JSC::JIT::emitPutClosureVar): Deleted. * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): * jit/Repatch.cpp: (JSC::tryCacheGetBy): (JSC::tryCachePutBy): (JSC::tryCacheInBy): (JSC::unlinkCall): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CacheableIdentifier.h: * runtime/CacheableIdentifierInlines.h: (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock): * runtime/CachedTypes.cpp: (JSC::CachedCodeBlock::numBinaryArithProfiles const): (JSC::CachedCodeBlock::numUnaryArithProfiles const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedCodeBlock::encode): * runtime/CommonSlowPaths.cpp: (JSC::updateArithProfileForUnaryArithOp): * runtime/FunctionExecutable.h: * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::prepareForExecutionImpl): * wasm/WasmLLIntTierUpCounter.h: (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp): (JSC::Wasm::LLIntTierUpCounter::optimizeSoon): * wasm/WasmTierUpCount.cpp: (JSC::Wasm::TierUpCount::TierUpCount): * wasm/WasmTierUpCount.h: (JSC::Wasm::TierUpCount::optimizeAfterWarmUp): (JSC::Wasm::TierUpCount::optimizeNextInvocation): (JSC::Wasm::TierUpCount::optimizeSoon): 2021-09-27 Yusuke Suzuki [JSC] Use op_jeq_ptr for empty JSPropertyNameEnumerator check https://bugs.webkit.org/show_bug.cgi?id=230817 Reviewed by Saam Barati. We use op_jeq_ptr for empty JSPropertyNameEnumerator check instead of stricteq for smaller bytecode size and efficient branching in LLInt and Baseline. In DFG and FTL, both will get the same nodes. * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::ForInNode::emitBytecode): 2021-09-26 Yusuke Suzuki [JSC] Optimize PutByVal with for-in https://bugs.webkit.org/show_bug.cgi?id=230801 Reviewed by Saam Barati. We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes. And we also found that we are using polluted non-good type for the property names from for-in: String | Other. The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes. In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content) is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName. To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr for existing jneq_ptr bytecode. We also clean up DFG operation related to PutByVal. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) | | VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 | | EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 | | BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 | | Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 | | AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 | | Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 | | Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 | | Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 | | Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 | | VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 | | jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 | | EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 | | React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 | | React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 271.75873 b mean = 272.45804 pValue = 0.0263030803 (Bigger means are better.) 1.003 times better Results ARE significant * builtins/BuiltinNames.h: * bytecode/BytecodeList.rb: * bytecode/BytecodeUseDef.cpp: (JSC::computeUsesForBytecodeIndexImpl): (JSC::computeDefsForBytecodeIndexImpl): * bytecode/LinkTimeConstant.h: * bytecode/Opcode.h: (JSC::isBranch): * bytecode/PreciseJumpTargetsInlines.h: * bytecompiler/BytecodeGenerator.cpp: (JSC::GenericLabel::setLocation): (JSC::BytecodeGenerator::emitJumpIfSentinelString): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::ForInNode::emitBytecode): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel): * dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::putByValInternal): (JSC::DFG::putByValCellInternal): (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): * jit/JIT.h: * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_jeq_ptr): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jeq_ptr): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_next): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): * runtime/SmallStrings.cpp: (JSC::SmallStrings::initializeCommonStrings): (JSC::SmallStrings::visitStrongReferences): * runtime/SmallStrings.h: (JSC::SmallStrings::sentinelString const): 2021-09-26 Commit Queue Unreviewed, reverting r283095. https://bugs.webkit.org/show_bug.cgi?id=230815 We should land the original patch since this does not work with bytecode cache Reverted changeset: "[JSC] Optimize PutByVal with for-in" https://bugs.webkit.org/show_bug.cgi?id=230801 https://commits.webkit.org/r283095 2021-09-26 Yusuke Suzuki [JSC] Optimize PutByVal with for-in https://bugs.webkit.org/show_bug.cgi?id=230801 Reviewed by Saam Barati. We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes. And we also found that we are using polluted non-good type for the property names from for-in: String | Other. The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes. In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content) is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName. To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr for existing jneq_ptr bytecode. We also clean up DFG operation related to PutByVal. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) | | VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 | | EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 | | BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 | | Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 | | AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 | | Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 | | Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 | | Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 | | Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 | | VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 | | jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 | | EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 | | React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 | | React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 271.75873 b mean = 272.45804 pValue = 0.0263030803 (Bigger means are better.) 1.003 times better Results ARE significant * builtins/BuiltinNames.h: * bytecode/BytecodeList.rb: * bytecode/BytecodeUseDef.cpp: (JSC::computeUsesForBytecodeIndexImpl): (JSC::computeDefsForBytecodeIndexImpl): * bytecode/LinkTimeConstant.h: * bytecode/Opcode.h: (JSC::isBranch): * bytecode/PreciseJumpTargetsInlines.h: * bytecompiler/BytecodeGenerator.cpp: (JSC::GenericLabel::setLocation): (JSC::BytecodeGenerator::emitJumpIfSentinelString): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::ForInNode::emitBytecode): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel): * dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::putByValInternal): (JSC::DFG::putByValCellInternal): (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): * jit/JIT.h: * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_jeq_ptr): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jeq_ptr): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_next): * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): * runtime/SmallStrings.cpp: (JSC::SmallStrings::initializeCommonStrings): (JSC::SmallStrings::visitStrongReferences): * runtime/SmallStrings.h: (JSC::SmallStrings::sentinelString const): 2021-09-26 Commit Queue Unreviewed, reverting r283083 and r283088. https://bugs.webkit.org/show_bug.cgi?id=230806 Windows pors are crashing Reverted changesets: "Build an unlinked baseline JIT" https://bugs.webkit.org/show_bug.cgi?id=229223 https://commits.webkit.org/r283083 "Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata" https://bugs.webkit.org/show_bug.cgi?id=230798 https://commits.webkit.org/r283088 2021-09-26 Saam Barati Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata https://bugs.webkit.org/show_bug.cgi?id=230798 Reviewed by Yusuke Suzuki. This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile have an index into a table instead of storing a pointer to the profile in its metadata. Then, we can just load the profile using the index in the bytecode, which saves memory. * bytecode/BytecodeList.rb: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): * bytecode/UnlinkedCodeBlockGenerator.h: (JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile): (JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile): * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitUnaryOp): (JSC::BytecodeGenerator::emitInc): (JSC::BytecodeGenerator::emitDec): * bytecompiler/BytecodeGenerator.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_op_negate): (JSC::JIT::emit_op_add): (JSC::JIT::emit_op_div): (JSC::JIT::emit_op_mul): (JSC::JIT::emit_op_sub): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CommonSlowPaths.cpp: (JSC::updateArithProfileForUnaryArithOp): (JSC::JSC_DEFINE_COMMON_SLOW_PATH): 2021-09-25 Saam Barati Build an unlinked baseline JIT https://bugs.webkit.org/show_bug.cgi?id=229223 Reviewed by Yusuke Suzuki. This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT code produced by this baseline JIT can be shared between all CodeBlocks that share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT instance, this new CodeBlock just starts off executing in the baseline JIT "for free". To make this work, the code we emit now needs to be independent of a specific CodeBlock instance. We use a CodeBlock instance for minimal profiling information when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When we need CodeBlock specific information, we load it. This usually means things like we'll load things from the Metadata dynamically. This patch also adds a "linked constant pool" concept, and anytime we instantiate such a CodeBlock, we also need to instantiate this "linked constant pool". This contains things like our inline cache data structures (StructureStubInfo*), JSGlobalObject*, etc. Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I made data ICs work on x86_64. To do this, we no longer call/ret to the IC. Instead, we jump to the IC, and the IC jumps back by loading the "done" location from the StructureStubInfo dynamically. This simplifies the design to not be based on the arm64 calling convention, and keeps the same performance characteristics. This patch also adds a new version of InlineAccess that is only used in baseline JIT (for now). In the future, we can make the DFG/FTL also use this for Data ICs. But we don't need to do that yet since those tiers don't use data ICs by default. The baseline JIT now has a pure data IC approach to InlineAccess. So instead of repatching code, we repatch fields we load dynamically. This patch also cleans up a few things in OSR exit, where both DFG/FTL were storing callee saves to the callee saves buffer in a weird place, and separate from one another. I noticed this code can be simplified if we just store callee saves at the end of the OSR exit handler, and from common JIT emission code. This patch also fixes a bug where we could end up with the wrong (and always more negative) SP in the baseline JIT. This could happen when we OSR exit from an inlined getter/setter. The OSR exit code puts the return PC when returning to the call site of the getter/setter to be the inline cache's "done location". However, this "done location" didn't used to restore SP. This patch conservatively makes it so that we restore the SP at these sites. This is measured as a 1% speedup on Speedometer2. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::fromStructureStubInfo): (JSC::AccessCase::generateImpl): * bytecode/BytecodeList.rb: * bytecode/BytecodeOperandsForCheckpoint.h: (JSC::valueProfileOffsetFor): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::fastPathStart): (JSC::CallLinkInfo::emitFastPathImpl): (JSC::CallLinkInfo::emitFastPath): (JSC::CallLinkInfo::emitTailCallFastPath): (JSC::CallLinkInfo::emitDataICFastPath): (JSC::CallLinkInfo::emitTailCallDataICFastPath): (JSC::CallLinkInfo::emitDataICSlowPath): (JSC::CallLinkInfo::initializeDataIC): (JSC::CallLinkInfo::emitDirectFastPath): (JSC::CallLinkInfo::emitDirectTailCallFastPath): * bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis): (JSC::CallLinkInfo::slowStub): Deleted. (JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setupWithUnlinkedBaselineCode): (JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const): (JSC::CodeBlock::setConstantRegisters): (JSC::CodeBlock::finalizeJITInlineCaches): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::frameRegisterCount): (JSC::CodeBlock::binaryArithProfileForPC): (JSC::CodeBlock::unaryArithProfileForPC): (JSC::CodeBlock::findPC): (JSC::CodeBlock::jitSoon): (JSC::CodeBlock::jitNextInvocation): (JSC::CodeBlock::dumpMathICStats): (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted. (JSC::CodeBlock::addJITAddIC): Deleted. (JSC::CodeBlock::addJITMulIC): Deleted. (JSC::CodeBlock::addJITSubIC): Deleted. (JSC::CodeBlock::addJITNegIC): Deleted. (JSC::CodeBlock::setPCToCodeOriginMap): Deleted. (JSC::CodeBlock::thresholdForJIT): Deleted. (JSC::CodeBlock::jitAfterWarmUp): Deleted. * bytecode/CodeBlock.h: (JSC::CodeBlock::JITData::offsetOfJITConstantPool): (JSC::CodeBlock::offsetOfJITData): (JSC::CodeBlock::offsetOfArgumentValueProfiles): (JSC::CodeBlock::offsetOfConstantsVectorBuffer): (JSC::CodeBlock::baselineJITConstantPool): (JSC::CodeBlock::checkIfJITThresholdReached): (JSC::CodeBlock::dontJITAnytimeSoon): (JSC::CodeBlock::llintExecuteCounter const): (JSC::CodeBlock::offsetOfDebuggerRequests): (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): (JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::CodeBlock::addressOfNumParameters): Deleted. (JSC::CodeBlock::isKnownCell): Deleted. (JSC::CodeBlock::addMathIC): Deleted. (JSC::CodeBlock::setJITCodeMap): Deleted. (JSC::CodeBlock::jitCodeMap): Deleted. (JSC::CodeBlock::switchJumpTable): Deleted. (JSC::CodeBlock::stringSwitchJumpTable): Deleted. * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachValueProfile): (JSC::CodeBlock::jitCodeMap): (JSC::CodeBlock::baselineSwitchJumpTable): (JSC::CodeBlock::baselineStringSwitchJumpTable): (JSC::CodeBlock::dfgSwitchJumpTable): (JSC::CodeBlock::dfgStringSwitchJumpTable): * bytecode/ExecutableToCodeBlockEdge.h: * bytecode/ExecutionCounter.cpp: (JSC::ExecutionCounter::setThreshold): * bytecode/ExecutionCounter.h: (JSC::ExecutionCounter::clippedThreshold): * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile): (JSC::GetByIdModeMetadata::offsetOfMode): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InlineAccess.cpp: (JSC::InlineAccess::generateSelfPropertyAccess): (JSC::InlineAccess::canGenerateSelfPropertyReplace): (JSC::InlineAccess::generateSelfPropertyReplace): (JSC::InlineAccess::isCacheableArrayLength): (JSC::InlineAccess::generateArrayLength): (JSC::InlineAccess::isCacheableStringLength): (JSC::InlineAccess::generateStringLength): (JSC::InlineAccess::generateSelfInAccess): (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): * bytecode/InlineAccess.h: * bytecode/IterationModeMetadata.h: (JSC::IterationModeMetadata::offsetOfSeenModes): * bytecode/LLIntCallLinkInfo.h: (JSC::LLIntCallLinkInfo::offsetOfArrayProfile): * bytecode/Opcode.h: * bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::succeed): (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling): (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): (JSC::PolymorphicAccess::regenerate): * bytecode/PolymorphicAccess.h: (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted. * bytecode/PutByStatus.cpp: (JSC::PutByStatus::computeForStubInfo): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfByIdSelfOffset): (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): (JSC::StructureStubInfo::inlineAccessBaseStructure): (JSC::StructureStubInfo::offsetOfDoneLocation): * bytecode/SuperSampler.cpp: (JSC::printSuperSamplerState): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::UnlinkedCodeBlock::hasIdentifier): (JSC::UnlinkedCodeBlock::thresholdForJIT): (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::constantRegister): (JSC::UnlinkedCodeBlock::instructionAt const): (JSC::UnlinkedCodeBlock::bytecodeOffset): (JSC::UnlinkedCodeBlock::instructionsSize const): (JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn): (JSC::UnlinkedCodeBlock::outOfLineJumpOffset): (JSC::UnlinkedCodeBlock::binaryArithProfile): (JSC::UnlinkedCodeBlock::unaryArithProfile): (JSC::UnlinkedCodeBlock::llintExecuteCounter): * bytecode/UnlinkedMetadataTable.h: (JSC::UnlinkedMetadataTable::offsetInMetadataTable): * bytecode/ValueProfile.h: (JSC::ValueProfileBase::ValueProfileBase): (JSC::ValueProfileBase::clearBuckets): (JSC::ValueProfile::offsetOfFirstBucket): * dfg/DFGCommonData.h: * dfg/DFGJITCode.cpp: * dfg/DFGJITCode.h: * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGOSREntry.cpp: (JSC::DFG::prepareOSREntry): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::handleExitCounts): (JSC::DFG::callerReturnPC): (JSC::DFG::reifyInlinedCallFrames): (JSC::DFG::adjustAndJumpToTarget): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePutPrivateName): (JSC::DFG::SpeculativeJIT::compileValueAdd): (JSC::DFG::SpeculativeJIT::compileValueSub): (JSC::DFG::SpeculativeJIT::compileValueNegate): (JSC::DFG::SpeculativeJIT::compileValueMul): (JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitCall): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLJITCode.h: * ftl/FTLLink.cpp: (JSC::FTL::link): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::addMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): * generator/Metadata.rb: * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::storeProperty): (JSC::AssemblyHelpers::emitVirtualCall): (JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer): * jit/BaselineJITCode.cpp: Added. (JSC::MathICHolder::addJITAddIC): (JSC::MathICHolder::addJITMulIC): (JSC::MathICHolder::addJITSubIC): (JSC::MathICHolder::addJITNegIC): (JSC::MathICHolder::adoptMathICs): (JSC::BaselineJITCode::BaselineJITCode): (JSC::BaselineJITCode::~BaselineJITCode): * jit/BaselineJITCode.h: Added. (JSC::JITConstantPool::add): (JSC::JITConstantPool::size const): (JSC::JITConstantPool::at const): * jit/BaselineJITPlan.cpp: (JSC::BaselineJITPlan::finalize): * jit/CCallHelpers.cpp: (JSC::CCallHelpers::logShadowChickenTailPacketImpl): (JSC::CCallHelpers::logShadowChickenTailPacket): * jit/CCallHelpers.h: * jit/CallFrameShuffleData.cpp: (JSC::CallFrameShuffleData::setupCalleeSaveRegisters): * jit/CallFrameShuffleData.h: * jit/CallFrameShuffler.cpp: (JSC::CallFrameShuffler::CallFrameShuffler): (JSC::CallFrameShuffler::prepareForTailCall): * jit/CallFrameShuffler.h: (JSC::CallFrameShuffler::snapshot const): * jit/JIT.cpp: (JSC::JIT::JIT): (JSC::JIT::emitEnterOptimizationCheck): (JSC::JIT::emitNotifyWriteWatchpoint): (JSC::JIT::emitVarReadOnlyCheck): (JSC::JIT::assertStackPointerOffset): (JSC::JIT::resetSP): (JSC::JIT::emitPutCodeBlockToFrameInPrologue): (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters): (JSC::JIT::emitRestoreCalleeSaves): (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::link): (JSC::JIT::finalizeOnMainThread): (JSC::JIT::privateCompile): (JSC::JIT::frameRegisterCountFor): (JSC::JIT::stackPointerOffsetFor): * jit/JIT.h: * jit/JITArithmetic.cpp: (JSC::JIT::emit_compareAndJumpSlowImpl): (JSC::JIT::emit_compareAndJumpSlow): (JSC::JIT::emit_op_negate): (JSC::JIT::emit_op_add): (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow): (JSC::JIT::emit_op_div): (JSC::JIT::emit_op_mul): (JSC::JIT::emit_op_sub): * jit/JITCall.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileTailCall): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCall32_64.cpp: (JSC::JIT::emitPutCallResult): (JSC::JIT::compileSetupFrame): (JSC::JIT::compileCallEval): (JSC::JIT::compileCallEvalSlowCase): (JSC::JIT::compileOpCall): (JSC::JIT::compileOpCallSlowCase): (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCode.h: (JSC::JITCode::useDataIC): (JSC::JITCode::pcToCodeOriginMap): * jit/JITCompilationKey.cpp: (JSC::JITCompilationKey::dump const): * jit/JITCompilationKey.h: (JSC::JITCompilationKey::JITCompilationKey): (JSC::JITCompilationKey::operator! const): (JSC::JITCompilationKey::isHashTableDeletedValue const): (JSC::JITCompilationKey::operator== const): (JSC::JITCompilationKey::hash const): (JSC::JITCompilationKey::profiledBlock const): Deleted. * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITInlineCacheGenerator::finalize): (JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdGenerator::JITGetByIdGenerator): (JSC::generateGetByIdInlineAccess): (JSC::JITGetByIdGenerator::generateBaselineDataICFastPath): (JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath): (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath): (JSC::JITDelByValGenerator::generateFastPath): (JSC::JITDelByIdGenerator::generateFastPath): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByIdGenerator::generateBaselineDataICFastPath): (JSC::JITInstanceOfGenerator::generateFastPath): (JSC::JITGetByValGenerator::generateFastPath): (JSC::JITPutByValGenerator::generateFastPath): (JSC::JITPrivateBrandAccessGenerator::generateFastPath): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::isOperandConstantDouble): (JSC::JIT::isOperandConstantInt): (JSC::JIT::isKnownCell): (JSC::JIT::getConstantOperand): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile): (JSC::JIT::linkSlowCaseIfNotJSCell): (JSC::JIT::advanceToNextCheckpoint): (JSC::JIT::emitJumpSlowToHotForCheckpoint): (JSC::JIT::isOperandConstantChar): (JSC::JIT::emitValueProfilingSite): (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): (JSC::JIT::emitArrayProfilingSiteWithCell): (JSC::JIT::emitLoadDouble): (JSC::JIT::emitJumpSlowCaseIfNotJSCell): (JSC::JIT::emitGetVirtualRegister): (JSC::JIT::jumpTarget): (JSC::JIT::loadPtrFromMetadata): (JSC::JIT::load32FromMetadata): (JSC::JIT::load8FromMetadata): (JSC::JIT::store8ToMetadata): (JSC::JIT::store32ToMetadata): (JSC::JIT::materializePointerIntoMetadata): (JSC::JIT::loadConstant): (JSC::JIT::loadGlobalObject): (JSC::JIT::loadCodeBlockConstant): (JSC::JIT::copiedGetPutInfo): Deleted. (JSC::JIT::copiedArithProfile): Deleted. * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_mov): (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::op_ret_handlerGenerator): (JSC::JIT::emit_op_to_primitive): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::valueIsFalseyGenerator): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emit_op_jtrue): (JSC::JIT::valueIsTruthyGenerator): (JSC::JIT::emit_op_throw): (JSC::JIT::op_throw_handlerGenerator): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_debug): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_handlerGenerator): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_create_this): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jeq): (JSC::JIT::emitSlow_op_jneq): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitSlow_op_check_traps): (JSC::JIT::op_check_traps_handlerGenerator): (JSC::JIT::emit_op_new_regexp): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): (JSC::JIT::emit_op_new_array): (JSC::JIT::emit_op_new_array_with_size): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): (JSC::JIT::emit_op_profile_control_flow): (JSC::JIT::emit_op_get_argument): (JSC::JIT::emit_op_get_prototype_of): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_new_object): (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_overrides_has_instance): (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::emitSlow_op_instanceof_custom): (JSC::JIT::emit_op_typeof_is_undefined): (JSC::JIT::emit_op_set_function_name): (JSC::JIT::emit_op_jfalse): (JSC::JIT::emit_op_jtrue): (JSC::JIT::emit_op_jeq_null): (JSC::JIT::emit_op_jneq_null): (JSC::JIT::emit_op_jneq_ptr): (JSC::JIT::emitSlow_op_eq): (JSC::JIT::compileOpEqJumpSlow): (JSC::JIT::emitSlow_op_neq): (JSC::JIT::emitSlow_op_jstricteq): (JSC::JIT::emitSlow_op_jnstricteq): (JSC::JIT::emit_op_eq_null): (JSC::JIT::emit_op_neq_null): (JSC::JIT::emit_op_throw): (JSC::JIT::emit_op_to_number): (JSC::JIT::emit_op_to_numeric): (JSC::JIT::emit_op_to_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::emit_op_switch_char): (JSC::JIT::emit_op_switch_string): (JSC::JIT::emit_op_enter): (JSC::JIT::emit_op_create_this): (JSC::JIT::emit_op_to_this): (JSC::JIT::emit_op_profile_type): (JSC::JIT::emit_op_log_shadow_chicken_tail): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPlan.cpp: (JSC::JITPlan::key): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::slow_op_get_by_val_prepareCallGenerator): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::slow_op_get_private_name_prepareCallGenerator): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::slow_op_del_by_id_prepareCallGenerator): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::slow_op_del_by_val_prepareCallGenerator): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_prepareCallGenerator): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::slow_op_put_by_id_prepareCallGenerator): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_brand): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emitResolveClosure): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::generateOpResolveScopeThunk): (JSC::JIT::slow_op_resolve_scopeGenerator): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::slow_op_get_from_scopeGenerator): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::slow_op_put_to_scopeGenerator): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emit_enumerator_has_propertyImpl): (JSC::JIT::emitWriteBarrier): (JSC::JIT::emitSlow_op_get_from_scope): Deleted. (JSC::JIT::emitPutGlobalVariable): Deleted. (JSC::JIT::emitPutGlobalVariableIndirect): Deleted. (JSC::JIT::emitPutClosureVar): Deleted. * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emit_op_put_getter_by_val): (JSC::JIT::emit_op_put_setter_by_val): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emitVarInjectionCheck): (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emitSlow_op_get_from_scope): (JSC::JIT::emit_op_put_to_scope): (JSC::JIT::emitSlow_op_put_to_scope): (JSC::JIT::emit_op_get_from_arguments): (JSC::JIT::emit_op_get_internal_field): * jit/Repatch.cpp: (JSC::tryCacheGetBy): (JSC::tryCachePutBy): (JSC::tryCacheInBy): (JSC::unlinkCall): * jit/ThunkGenerators.cpp: (JSC::handleExceptionGenerator): (JSC::popThunkStackPreservesAndHandleExceptionGenerator): * jit/ThunkGenerators.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/CacheableIdentifier.h: * runtime/CacheableIdentifierInlines.h: (JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock): * runtime/CachedTypes.cpp: (JSC::CachedCodeBlock::numBinaryArithProfiles const): (JSC::CachedCodeBlock::numUnaryArithProfiles const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedCodeBlock::encode): * runtime/CommonSlowPaths.cpp: (JSC::updateArithProfileForUnaryArithOp): * runtime/FunctionExecutable.h: * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::prepareForExecutionImpl): * wasm/WasmLLIntTierUpCounter.h: (JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp): (JSC::Wasm::LLIntTierUpCounter::optimizeSoon): * wasm/WasmTierUpCount.cpp: (JSC::Wasm::TierUpCount::TierUpCount): * wasm/WasmTierUpCount.h: (JSC::Wasm::TierUpCount::optimizeAfterWarmUp): (JSC::Wasm::TierUpCount::optimizeNextInvocation): (JSC::Wasm::TierUpCount::optimizeSoon): 2021-09-24 Rick Waldron [JSC] Add checkScriptSyntax function to jsc host environment https://bugs.webkit.org/show_bug.cgi?id=230631 Reviewed by Yusuke Suzuki. Introduce a function called checkScriptSyntax() that performs the same operation as checkModuleSyntax(), without the module specific semantics. Updates tests that were using eval() to verify syntax. * jsc.cpp: (functionCheckScriptSyntax) 2021-09-23 Philip Chimento Various tweaks in preparation for Temporal.Instant https://bugs.webkit.org/show_bug.cgi?id=230331 Reviewed by Yusuke Suzuki. * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::fromDurationLike): Use temporalUnitPropertyName(). (JSC::TemporalDuration::toISO8601Duration): Improve error message to include the invalid string. (JSC::TemporalDuration::with const): Use temporalUnitPropertyName(). (JSC::TemporalDuration::toString): Use formatSecondsStringFraction(). * runtime/TemporalObject.cpp: (JSC::ellipsizeAt): Add helper to ellipsize string at certain length. (JSC::temporalUnitPropertyName): Move code from TemporalDuration into a function which will be reused in other Temporal types. (JSC::temporalFractionalSecondDigits): Handle NaN as per specification, and improve error message to include the invalid value. (JSC::formatSecondsStringFraction): Move code from TemporalDuration into a function which will be reused in other Temporal types. * runtime/TemporalObject.h: 2021-09-23 Devin Rousso Web Inspector: Graphics: add instrumentation for new `CanvasRenderingContext2DSettings` https://bugs.webkit.org/show_bug.cgi?id=225180 Reviewed by BJ Burg. * inspector/protocol/Canvas.json: Add `colorSpace` and `desynchronized` to `Canvas.ContextAttributes`. 2021-09-23 Ross Kirsling [JSC] Handle syntactic production for `#x in expr` correctly https://bugs.webkit.org/show_bug.cgi?id=230668 Reviewed by Yusuke Suzuki. The production for `#x in expr` is easy to get wrong. RelationalExpression[In, Yield, Await] : ShiftExpression[?Yield, ?Await] RelationalExpression[?In, ?Yield, ?Await] < ShiftExpression[?Yield, ?Await] RelationalExpression[?In, ?Yield, ?Await] > ShiftExpression[?Yield, ?Await] RelationalExpression[?In, ?Yield, ?Await] <= ShiftExpression[?Yield, ?Await] RelationalExpression[?In, ?Yield, ?Await] >= ShiftExpression[?Yield, ?Await] RelationalExpression[?In, ?Yield, ?Await] instanceof ShiftExpression[?Yield, ?Await] [+In] RelationalExpression[+In, ?Yield, ?Await] in ShiftExpression[?Yield, ?Await] [+In] PrivateIdentifier in ShiftExpression[?Yield, ?Await] We were ensuring that a standalone private name `#x` is always followed by operator `in`; this patch further ensures that that particular `in` can't have its LHS misparsed as a RelationalExpression. * parser/Parser.cpp: (JSC::Parser::parseBinaryExpression): Verify the precedence of the topmost operator on the stack (if any) when parsing standalone `#x`. 2021-09-22 Mikhail R. Gadelha Null pointer dereference in JSC::GetByStatus https://bugs.webkit.org/show_bug.cgi?id=229674 Reviewed by Yusuke Suzuki. In GetByStatus::computeForStubInfoWithoutExitSiteFeedback, there are several places that dereference the stubInfo argument when calling the GetByStatus constructor. To prevent a nullptr dereference, the pointer is not dereferenced anymore, and a check was added to check if stubInfo is a valid pointer before accessing it. * bytecode/GetByStatus.cpp: (JSC::GetByStatus::GetByStatus): (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/GetByStatus.h: 2021-09-22 Yusuke Suzuki [JSC] Filter algorithmic numbering systems from enumeration data https://bugs.webkit.org/show_bug.cgi?id=230660 Reviewed by Ross Kirsling. Algorithmic numbering systems' handling is not included in normal ICU build. This patch filters out them from available numbering systems. * runtime/IntlObject.cpp: (JSC::availableNumberingSystems): 2021-09-22 Yusuke Suzuki [JSC] Adjust Intl currency enumeration https://bugs.webkit.org/show_bug.cgi?id=230656 Reviewed by Ross Kirsling. 1. List up all available currencies. 2. Introduce a work-around for VES, LSM, and EQE * runtime/IntlObject.cpp: (JSC::availableCurrencies): 2021-09-22 Yusuke Suzuki [JSC] emoji and eor collations are missing https://bugs.webkit.org/show_bug.cgi?id=230652 Reviewed by Ross Kirsling. Due to ICU's bug, "emoji" and "eor" collations are missing from enumeration. This patch adds work-around for this. * runtime/IntlObject.cpp: (JSC::availableCollations): 2021-09-22 Yusuke Suzuki [JSC] Intl unicode identifier type will reject underscore https://bugs.webkit.org/show_bug.cgi?id=230645 Reviewed by Ross Kirsling. We reject '_' since BCP-47 rejects it and we should follow BCP-47 in all Intl inputs. * runtime/IntlObject.cpp: (JSC::isUnicodeLocaleIdentifierType): 2021-09-21 Alexey Shvayka [WebIDL] DOM constructors should extend InternalFunction https://bugs.webkit.org/show_bug.cgi?id=228763 Reviewed by Sam Weinig. Introduce finishCreation(VM&) overload to preserve the current property order of WebIDL constructors, and to defer a large code change needed for passing through `length` / `name` parameters (bug #230584). * runtime/InternalFunction.cpp: (JSC::InternalFunction::InternalFunction): (JSC::InternalFunction::finishCreation): * runtime/InternalFunction.h: 2021-09-21 Chris Dumez Reduce use of makeRef() and use Ref { } instead https://bugs.webkit.org/show_bug.cgi?id=230585 Reviewed by Alex Christensen. * debugger/Debugger.cpp: (JSC::Debugger::setBreakpoint): (JSC::Debugger::schedulePauseForSpecialBreakpoint): * llint/LLIntEntrypoint.cpp: (JSC::LLInt::setFunctionEntrypoint): (JSC::LLInt::setEvalEntrypoint): (JSC::LLInt::setProgramEntrypoint): (JSC::LLInt::setModuleProgramEntrypoint): * runtime/JSString.cpp: (JSC::JSRopeString::resolveRopeToExistingAtomString const): * runtime/VM.cpp: (JSC::jitCodeForCallTrampoline): (JSC::jitCodeForConstructTrampoline): * wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::CodeBlock): * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::OMGForOSREntryPlan): * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::OMGPlan): * wasm/WasmSignature.cpp: (JSC::Wasm::SignatureInformation::signatureFor): * wasm/WasmSignatureInlines.h: (JSC::Wasm::SignatureInformation::get): * wasm/WasmSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): * wasm/js/JSWebAssemblyInstance.h: 2021-09-21 Yusuke Suzuki [JSC] CompareStrictEq is omitting String check incorrectly https://bugs.webkit.org/show_bug.cgi?id=230582 rdar://83237121 Reviewed by Mark Lam. 1. Add left and right prefixes to neitherDoubleNorHeapBigIntChild and notDoubleChild edges since registers are named with left and right. Without this prefix, it is hard to follow in the code. 2. Remove leftGPR and rightGPR and use leftRegs.payloadGPR() and rightRegs.payloadGPR() to avoid having different variables pointing to the same registers. 3. DFG needsTypeCheck is done with wrong type filters. As a result, necessary checks are omitted. This patch fixes that. FTL does not have the same problem. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileNeitherDoubleNorHeapBigIntToNotDoubleStrictEquality): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-09-21 Mark Lam Replace a few ASSERTs with static_asserts in the ARM64 MacroAssemblers. https://bugs.webkit.org/show_bug.cgi?id=230569 Reviewed by Yusuke Suzuki. * assembler/ARM64Assembler.h: * assembler/ARM64EAssembler.h: 2021-09-21 Justin Michaud Differential testing: live statement don't execute https://bugs.webkit.org/show_bug.cgi?id=229939 Reviewed by Saam Barati. In statements are supposed to throw if they are applied to a non-object. We incorrectly converted InByVals into HasIndexedProperty any time they were a cell, so we silently converted non-objects. Before converting an InByVal, we first speculate that the base is an object now. We do not always require an object edge for HasIndexedProperty because enumerator next() does not throw if it encounters a cell that requires conversion during the call to toObject (for example, a string literal). That is, we should silently convert the string during enumeration, but not for an In statement, and so HasIndexedProperty is prepared to handle both cases. * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::convertToHasIndexedProperty): 2021-09-21 Mikhail R. Gadelha Prevent test from accessing FP registers if they are not available (e.g., arm softFP) https://bugs.webkit.org/show_bug.cgi?id=230493 Unreviewed gardening. The patch from https://bugs.webkit.org/show_bug.cgi?id=228543 introduced explicity calls to FP registers, however, they are not available in archs that emulate FPs. This patch adds an #ifdef to only enable the test if the arch has FP registers. * assembler/testmasm.cpp: (JSC::testStoreBaseIndex): 2021-09-20 Chris Dumez Stop using makeRef(*this) / makeRefPtr(this) https://bugs.webkit.org/show_bug.cgi?id=230464 Reviewed by Alex Christensen. * inspector/InjectedScriptHost.cpp: (Inspector::InjectedScriptHost::wrapper): * inspector/remote/RemoteConnectionToTarget.cpp: (Inspector::RemoteConnectionToTarget::close): * inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm: (Inspector::RemoteConnectionToTarget::setup): (Inspector::RemoteConnectionToTarget::close): (Inspector::RemoteConnectionToTarget::sendMessageToTarget): * wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::compileAsync): * wasm/WasmNameSection.h: (JSC::Wasm::NameSection::get): * wasm/WasmStreamingCompiler.cpp: (JSC::Wasm::StreamingCompiler::didReceiveFunctionData): 2021-09-17 Mikhail R. Gadelha Fix CellTag being set 32 bits even if the base is not a cell https://bugs.webkit.org/show_bug.cgi?id=230364 Reviewed by Yusuke Suzuki. Initial patch by Caio Lima. In 32 bits the tag of the base was not being preserved before calling the slow path and was instead being always being set to cellTag. This patch slightly changes the code to instead of setting the cellTag, it now calls the slow path using only the payload if the base is a cell, otherwise it uses tag+payload. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): 2021-09-17 Yusuke Suzuki [JSC] Add fast property enumeration mode for JSON.stringify https://bugs.webkit.org/show_bug.cgi?id=230393 Reviewed by Mark Lam. We collected profiles and found several subtests are using JSON.stringify enough. And generated strings are many serialized leaf objects. This patch adds fast object property enumeration. When we know that source object meets some conditions, we can say that, as long as structure is not changed, we can continue using property names and offset collected from the structure. This way removes non observable [[Get]] operations to accelerate JSON.stringify performance for major object iteration cases. We also extend MarkedArgumentBuffer: introducing MarkedArgumentBufferWithSize which can take default inline capacity as a template parameter. This is used in JSON.stringify to increase the buffer because now we also need to record structures in MarkedArgumentBuffer. This offers 0.4% improvement in Speedometer2 (EmberJS-TodoMVC, Vanilla-XXX, EmberJS-Debug-TodoMVC, they have enough amount of JSON.stringify time). ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |117.710000 |117.751667 |1.000354 | 0.883246 | | VueJS-TodoMVC |24.500000 |24.311667 |0.992313 | 0.365130 | | EmberJS-TodoMVC |126.646667 |125.738333 |0.992828 | 0.002587 (significant) | | BackboneJS-TodoMVC |47.873333 |47.911667 |1.000801 | 0.762509 | | Preact-TodoMVC |17.020000 |17.070000 |1.002938 | 0.786799 | | AngularJS-TodoMVC |129.856667 |129.353333 |0.996124 | 0.177632 | | Vanilla-ES2015-TodoMVC |61.698333 |61.120000 |0.990626 | 0.000003 (significant) | | Inferno-TodoMVC |62.840000 |62.496667 |0.994536 | 0.312340 | | Flight-TodoMVC |77.095000 |76.936667 |0.997946 | 0.702724 | | Angular2-TypeScript-TodoMVC |39.740000 |39.191667 |0.986202 | 0.053485 | | VanillaJS-TodoMVC |49.008333 |48.346667 |0.986499 | 0.000638 (significant) | | jQuery-TodoMVC |216.785000 |217.188333 |1.001861 | 0.270747 | | EmberJS-Debug-TodoMVC |344.230000 |342.993333 |0.996407 | 0.012262 (significant) | | React-TodoMVC |85.461667 |85.411667 |0.999415 | 0.758049 | | React-Redux-TodoMVC |140.681667 |140.640000 |0.999704 | 0.871277 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |59.928333 |59.351667 |0.990377 | 0.000000 (significant) | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 264.40650 b mean = 265.51533 pValue = 0.0005567357 (Bigger means are better.) 1.004 times better Results ARE significant * heap/Heap.cpp: (JSC::Heap::addCoreConstraints): * heap/Heap.h: * heap/HeapInlines.h: * runtime/ArgList.cpp: (JSC::MarkedArgumentBufferBase::addMarkSet): (JSC::MarkedArgumentBufferBase::markLists): (JSC::MarkedArgumentBufferBase::slowEnsureCapacity): (JSC::MarkedArgumentBufferBase::expandCapacity): (JSC::MarkedArgumentBufferBase::slowAppend): (JSC::MarkedArgumentBuffer::addMarkSet): Deleted. (JSC::MarkedArgumentBuffer::markLists): Deleted. (JSC::MarkedArgumentBuffer::slowEnsureCapacity): Deleted. (JSC::MarkedArgumentBuffer::expandCapacity): Deleted. (JSC::MarkedArgumentBuffer::slowAppend): Deleted. * runtime/ArgList.h: (JSC::MarkedArgumentBufferWithSize::MarkedArgumentBufferWithSize): (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer): Deleted. (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer): Deleted. (JSC::MarkedArgumentBuffer::size const): Deleted. (JSC::MarkedArgumentBuffer::isEmpty const): Deleted. (JSC::MarkedArgumentBuffer::at const): Deleted. (JSC::MarkedArgumentBuffer::clear): Deleted. (JSC::MarkedArgumentBuffer::appendWithAction): Deleted. (JSC::MarkedArgumentBuffer::append): Deleted. (JSC::MarkedArgumentBuffer::appendWithCrashOnOverflow): Deleted. (JSC::MarkedArgumentBuffer::removeLast): Deleted. (JSC::MarkedArgumentBuffer::last): Deleted. (JSC::MarkedArgumentBuffer::takeLast): Deleted. (JSC::MarkedArgumentBuffer::ensureCapacity): Deleted. (JSC::MarkedArgumentBuffer::hasOverflowed): Deleted. (JSC::MarkedArgumentBuffer::overflowCheckNotNeeded): Deleted. (JSC::MarkedArgumentBuffer::fill): Deleted. (JSC::MarkedArgumentBuffer::slotFor const): Deleted. (JSC::MarkedArgumentBuffer::mallocBase): Deleted. (JSC::MarkedArgumentBuffer::setNeedsOverflowCheck): Deleted. (JSC::MarkedArgumentBuffer::clearNeedsOverflowCheck): Deleted. * runtime/JSONObject.cpp: (JSC::Stringifier::Holder::hasFastObjectProperties const): (JSC::Stringifier::appendStringifiedValue): (JSC::Stringifier::Holder::Holder): (JSC::Stringifier::Holder::appendNextProperty): * runtime/ObjectConstructorInlines.h: (JSC::canPerformFastPropertyEnumerationForJSONStringify): 2021-09-17 Ross Kirsling Unreviewed fix for JSCOnly build with ENABLE_DFG_JIT off. * b3/testb3_1.cpp: * wasm/WasmEntryPlan.cpp: * wasm/WasmLLIntPlan.cpp: * wasm/WasmOperations.cpp: * wasm/WasmSignature.cpp: * wasm/WasmSignature.h: * wasm/generateWasmOpsHeader.py: * wasm/js/JSToWasm.h: 2021-09-17 Angelos Oikonomopoulos Unbreak GCC_OFFLINEASM_SOURCE_MAP when LTO is in use https://bugs.webkit.org/show_bug.cgi?id=230061 Reviewed by Michael Catanzaro. Our ASM postprocessing hack is incompatible with LTO. Unconditionally disable LTO for LowLevelInterpreter.cxx when GCC_OFFLINEASM_SOURCE_MAP is in use. * CMakeLists.txt: 2021-09-17 Justin Michaud Improve access case printing and show inline capacity for structures https://bugs.webkit.org/show_bug.cgi?id=230357 Reviewed by Saam Barati. This just makes the printing of access cases slightly more readable. * bytecode/AccessCase.cpp: (JSC::AccessCase::dump const): * bytecode/AccessCase.h: (JSC::AccessCase::dumpImpl const): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::dumpImpl const): * bytecode/GetterSetterAccessCase.h: * bytecode/InstanceOfAccessCase.cpp: (JSC::InstanceOfAccessCase::dumpImpl const): * bytecode/InstanceOfAccessCase.h: * bytecode/ProxyableAccessCase.cpp: (JSC::ProxyableAccessCase::dumpImpl const): * bytecode/ProxyableAccessCase.h: * heap/Heap.cpp: (JSC::Heap::runEndPhase): * runtime/JSCJSValue.cpp: (JSC::JSValue::dumpInContextAssumingStructure const): * runtime/Structure.cpp: (JSC::Structure::dump const): 2021-09-17 Justin Michaud PutByVal and PutPrivateName ICs should emit a write barrier if a butterfly might be allocated https://bugs.webkit.org/show_bug.cgi?id=230378 Reviewed by Yusuke Suzuki. Right now, PutByVal and PutPrivateName check the value type to determine if a write barrier is needed. For example, putting a primitive is considered to not require a write barrier. This makes sense, except for the case when we might allocate or re-allocate a butterfly in the IC. This does not emit a write barrier, and so the GC might miss the new butterfly. That is somewhat undesirable. This is a temporary conservative fix. If we don't write to the butterfly pointer, then we still don't need a write barrier; this work is captured by https://bugs.webkit.org/show_bug.cgi?id=230377 * dfg/DFGStoreBarrierInsertionPhase.cpp: 2021-09-16 Saam Barati Don't throw an exception in the middle of linking a CodeBlock https://bugs.webkit.org/show_bug.cgi?id=230367 Reviewed by Yusuke Suzuki. It's cleaner, and probably more correct, to wait until we're done linking the instruction stream before throwing any exceptions from CodeBlock::finishCreation. This guarantees, for example, that all metadata structs are initialized. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setConstantRegisters): (JSC::CodeBlock::initializeTemplateObjects): * bytecode/CodeBlock.h: * runtime/JSScope.cpp: (JSC::abstractAccess): (JSC::JSScope::abstractResolve): 2021-09-16 Saam Barati Move some profiling to UnlinkedCodeBlock https://bugs.webkit.org/show_bug.cgi?id=230078 Reviewed by Yusuke Suzuki. This patch adds UnlinkedValueProfile and UnlinkedArrayProfile to UnlinkedCodeBlock. These profiles serialize the data in ValueProfile and ArrayProfile. Each time a CodeBlock updates value profiles, it mixes in up to date information from the unlinked profiles, and also writes back data to the unlinked profiles, so the data is shared between CodeBlocks of the same UnlinkedCodeBlock. This patch also fixes a pre-existing bug where we would sometimes think we had more metadata table entries than we really had in practice. This is because MetadataTable::forEach used the next opcode's start pointer. That pointer was aligned to that opcode's metadata alignment. So that might make the previous opcode think it had an extra 1-7 entries (depending on size, alignment, etc). This patch fixes that by having the next opcode's start offset in the table always be the end offset of the previous opcode, and we align the start pointer when using it. This was measured as a ~0.5% speedup on Speedometer2. * bytecode/ArrayProfile.h: (JSC::UnlinkedArrayProfile::update): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::updateAllValueProfilePredictionsAndCountLiveness): (JSC::CodeBlock::updateAllArrayProfilePredictions): (JSC::CodeBlock::updateAllArrayPredictions): * bytecode/CodeBlock.h: (JSC::CodeBlock::metadata): * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachArrayProfile): Deleted. * bytecode/MetadataTable.cpp: (JSC::DeallocTable::withOpcodeType): * bytecode/MetadataTable.h: (JSC::MetadataTable::get): (JSC::MetadataTable::forEach): (JSC::MetadataTable::getWithoutAligning): (JSC::MetadataTable::getImpl): Deleted. * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::allocateSharedProfiles): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::unlinkedValueProfile): (JSC::UnlinkedCodeBlock::unlinkedArrayProfile): * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): * bytecode/UnlinkedMetadataTable.cpp: (JSC::UnlinkedMetadataTable::finalize): * bytecode/UnlinkedMetadataTable.h: (JSC::UnlinkedMetadataTable::isFinalized): (JSC::UnlinkedMetadataTable::hasMetadata): * bytecode/UnlinkedMetadataTableInlines.h: (JSC::UnlinkedMetadataTable::numEntries): * bytecode/ValueProfile.h: (JSC::UnlinkedValueProfile::update): * bytecompiler/BytecodeGenerator.h: * llint/LowLevelInterpreter.asm: * runtime/CachedTypes.cpp: (JSC::CachedCodeBlock::numValueProfiles const): (JSC::CachedCodeBlock::numArrayProfiles const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedCodeBlock::encode): 2021-09-16 Commit Queue Unreviewed, reverting r282478. https://bugs.webkit.org/show_bug.cgi?id=230358 Reverted changeset: "Move some profiling to UnlinkedCodeBlock" https://bugs.webkit.org/show_bug.cgi?id=230078 https://commits.webkit.org/r282478 2021-09-16 Mikhail R. Gadelha Fix crash in 32 bits due to not enough scratch registers available https://bugs.webkit.org/show_bug.cgi?id=230241 Reviewed by Filip Pizlo. Since patch 229229 (Polymorphic PutByVal) landed, jsc is now reaching the case Transition in `AccessCase::generateImpl` which needs three scratch registers when reallocating, but in ARMv7/MIPS, there are only two registers available. So in this patch, `AccessCase::createTransition` is changed to actually check if there are enough registers available before creating the AccessCase object. * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): 2021-09-15 Saam Barati Move some profiling to UnlinkedCodeBlock https://bugs.webkit.org/show_bug.cgi?id=230078 Reviewed by Yusuke Suzuki. This patch moves ValueProfiles and ArrayProfiles for non-call opcodes into UnlinkedCodeBlock. This way, the data is shared between the linked CodeBlocks of the same UnlinkedCodeBlock. The profiling bet here is that when the same code runs in a different global object, it largely runs in the same way. We've made this same bet in other ways with our profiling, and it largely makes sense to do for ValueProfile and ArrayProfile since they both hold global object independent data. Because ArrayProfiles are now shared between CodeBlocks, the existing m_usesOriginalArrayStructures bit is slightly harder to track now, since the ArrayProfile may see inputs from a different global object, an array may be an original array in one lexical global object, but not another. So we now track when an ArrayProfile sees a different global object than the lexical global object, and when we observe exits in the DFG, we propagate that bit to the m_usesOriginalArrayStructures bit. This patch also makes it so we no longer hold the CodeBlock lock when processing ValueProfiles and ArrayProfiles. We now allow multiple compiler threads to race against each other when updating these profiles. This is fine. It may end up with incomplete data in the profiles, but it won't corrupt them. This patch also makes it so we finalized visited UnlinkedCodeBlocks to finalize their value profiles. We no longer do that work inside CodeBlock for the ValueProfiles that UnlinkedCodeBlock owns. This also means that we have to WriteBarrier UnlinkedCodeBlock when executing in the LLInt, Baseline, and other areas, such as OSR exit, and in the GC when a CodeBlock was executing. That way we're guaranteed to visit the UnlinkedCodeBlock, add it to the visited set, and then finalize it at the end of GC. This patch also makes it so that inside CodeBlock::finishCreation, we finish linking before we do anything that can throw an exception. It's not valid to finalize a CodeBlock that isn't linked. This was measured as a 0.5-1% speedup on Speedometer2. * bytecode/ArrayProfile.cpp: (JSC::ArrayProfile::computeUpdatedPrediction): (JSC::ArrayProfile::briefDescription): (JSC::ArrayProfile::briefDescriptionWithoutUpdating): * bytecode/ArrayProfile.h: (JSC::ArrayProfile::ArrayProfile): (JSC::ArrayProfile::observedArrayModes const): (JSC::ArrayProfile::mayInterceptIndexedAccesses const): (JSC::ArrayProfile::mayStoreToHole const): (JSC::ArrayProfile::outOfBounds const): (JSC::ArrayProfile::usesOriginalArrayStructures const): (JSC::ArrayProfile::setDoesNotUseOriginalArrayStructures): (JSC::ArrayProfile::observedDifferentGlobalObject const): * bytecode/BytecodeList.rb: * bytecode/BytecodeOperandsForCheckpoint.h: (JSC::valueProfileForImpl): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): (JSC::CodeBlock::setConstantRegisters): (JSC::CodeBlock::initializeTemplateObjects): (JSC::CodeBlock::setNumParameters): (JSC::CodeBlock::visitChildren): (JSC::CodeBlock::finalizeUnconditionally): (JSC::CodeBlock::getArrayProfile): (JSC::CodeBlock::updateAllValueProfilePredictionsAndCountLiveness): (JSC::CodeBlock::updateAllArrayPredictions): (JSC::CodeBlock::tryGetValueProfileForBytecodeIndex): (JSC::CodeBlock::valueProfilePredictionForBytecodeIndex): * bytecode/CodeBlock.h: (JSC::CodeBlock::offsetOfUnlinkedCodeBlock): (JSC::CodeBlock::numberOfArgumentValueProfiles): (JSC::CodeBlock::valueProfileForArgument): (JSC::CodeBlock::metadata): * bytecode/CodeBlockInlines.h: (JSC::CodeBlock::forEachValueProfile): (JSC::CodeBlock::forEachArrayProfile): * bytecode/DFGExitProfile.cpp: (JSC::DFG::ExitProfile::hasAnyExitsAt const): * bytecode/DFGExitProfile.h: * bytecode/GetByIdMetadata.h: (JSC::GetByIdModeMetadata::setArrayLengthMode): * bytecode/LazyOperandValueProfile.cpp: (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions): (JSC::LazyOperandValueProfileParser::prediction const): * bytecode/MetadataTable.cpp: (JSC::DeallocTable::withOpcodeType): * bytecode/MetadataTable.h: (JSC::MetadataTable::get): (JSC::MetadataTable::forEach): (JSC::MetadataTable::getWithoutAligning): (JSC::MetadataTable::getImpl): Deleted. * bytecode/Opcode.h: * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::visitChildrenImpl): (JSC::UnlinkedCodeBlock::allocateSharedProfiles): (JSC::UnlinkedCodeBlock::finalizeUnconditionally): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::hasAnyExitsAt const): (JSC::UnlinkedCodeBlock::hasAnyExitsAt): (JSC::UnlinkedCodeBlock::valueProfile): (JSC::UnlinkedCodeBlock::arrayProfile): (JSC::UnlinkedCodeBlock::numValueProfiles const): (JSC::UnlinkedCodeBlock::numArrayProfiles const): * bytecode/UnlinkedCodeBlockGenerator.cpp: (JSC::UnlinkedCodeBlockGenerator::finalize): * bytecode/UnlinkedMetadataTable.cpp: (JSC::UnlinkedMetadataTable::finalize): * bytecode/UnlinkedMetadataTable.h: (JSC::UnlinkedMetadataTable::isFinalized): (JSC::UnlinkedMetadataTable::hasMetadata): * bytecode/UnlinkedMetadataTableInlines.h: (JSC::UnlinkedMetadataTable::numEntries): * bytecode/ValueProfile.h: (JSC::ValueProfileBase::ValueProfileBase): (JSC::ValueProfileBase::clearBuckets): (JSC::ValueProfileBase::briefDescription): (JSC::ValueProfileBase::computeUpdatedPrediction): (JSC::ValueProfile::offsetOfFirstBucket): (JSC::ValueProfileBase::classInfo const): Deleted. * dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::fromObserved): * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::withSpeculationFromProfile const): (JSC::DFG::ArrayMode::withProfile const): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit): (JSC::DFG::ByteCodeParser::getArrayMode): (JSC::DFG::ByteCodeParser::handleVarargsInlining): (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::handlePutByVal): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength): * dfg/DFGGraph.h: * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::osrWriteBarrier): (JSC::DFG::adjustAndJumpToTarget): * dfg/DFGPredictionInjectionPhase.cpp: (JSC::DFG::PredictionInjectionPhase::run): * heap/CodeBlockSetInlines.h: (JSC::CodeBlockSet::iterateViaSubspaces): * heap/Heap.cpp: (JSC::Heap::finalizeMarkedUnconditionalFinalizers): (JSC::Heap::finalizeUnconditionalFinalizers): (JSC::Heap::deleteUnmarkedCompiledCode): (JSC::Heap::runEndPhase): (JSC::Heap::addCoreConstraints): * jit/JIT.h: * jit/JITInlines.h: (JSC::JIT::emitValueProfilingSiteIfProfiledOpcode): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_handlerGenerator): * jit/JITOperations.cpp: (JSC::putByValOptimize): (JSC::directPutByValOptimize): (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::generateOpGetFromScopeThunk): (JSC::JIT::slow_op_get_from_scopeGenerator): (JSC::JIT::emit_op_enumerator_get_by_val): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::performLLIntGetByID): (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::getByVal): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * profiler/ProfilerBytecodeSequence.cpp: (JSC::Profiler::BytecodeSequence::BytecodeSequence): * runtime/CachedTypes.cpp: (JSC::CachedCodeBlock::numValueProfiles const): (JSC::CachedCodeBlock::numArrayProfiles const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedCodeBlock::encode): * runtime/CommonSlowPaths.cpp: (JSC::iteratorNextTryFastImpl): (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/JSScope.cpp: (JSC::abstractAccess): (JSC::JSScope::abstractResolve): * runtime/VM.cpp: * runtime/VM.h: (JSC::VM::forEachUnlinkedCodeBlockSpace): (JSC::VM::forEachCodeBlockSpace): Deleted. 2021-09-15 Michael Catanzaro Avoid GCC warnings introduced in r282125 https://bugs.webkit.org/show_bug.cgi?id=230154 Reviewed by Fujii Hironori. Yusuke suggested casting to UChar to avoid -Wswitch-out-of-range. This works! Also, avoid -Wredundant-move by removing one unnecessary WTFMove. * runtime/ISO8601.cpp: (JSC::ISO8601::parseTimeZoneBracketedAnnotation): (JSC::ISO8601::canBeTimeZone): (JSC::ISO8601::parseTimeZone): 2021-09-15 Yusuke Suzuki [JSC] Optimize leaf object creation in JSON.parse https://bugs.webkit.org/show_bug.cgi?id=230298 Reviewed by Keith Miller. This patch optimizes JSON.parse. 1. Use table in isJSONWhiteSpace. 2. Extract primitive value creation as parsePrimitiveValue function to use it in different place. 3. Add leaf-object creation fast path. Previously, when creating a leaf-object from JSON.parse we are too generic and jumping around the code. Instead we add a fast path that does not perform unnecessary operations and code gets tight. It offers 3-4% improvement in microbenchmarks. ToT Patched vanilla-es2015-babel-webpack-todomvc-json-parse 104.7169+-0.1113 ^ 101.4836+-0.2168 ^ definitely 1.0319x faster flight-todomvc-json-parse 53.9074+-0.0957 ^ 52.1347+-0.0802 ^ definitely 1.0340x faster vanilla-es2015-todomvc-json-parse 104.9373+-0.1631 ^ 101.4978+-0.1073 ^ definitely 1.0339x faster vanilla-todomvc-json-parse 79.1330+-0.0963 ^ 76.7568+-0.1606 ^ definitely 1.0310x faster This offers 0.2% improvement in Speedometer2. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |116.860000 |116.825000 |0.999700 | 0.901070 | | VueJS-TodoMVC |24.658333 |24.763333 |1.004258 | 0.571728 | | EmberJS-TodoMVC |126.666667 |126.335000 |0.997382 | 0.289517 | | BackboneJS-TodoMVC |48.435000 |48.523333 |1.001824 | 0.455638 | | Preact-TodoMVC |17.585000 |17.368333 |0.987679 | 0.247658 | | AngularJS-TodoMVC |129.576667 |129.398333 |0.998624 | 0.625634 | | Vanilla-ES2015-TodoMVC |62.746667 |62.241667 |0.991952 | 0.000019 (significant) | | Inferno-TodoMVC |63.741667 |63.495000 |0.996130 | 0.448861 | | Flight-TodoMVC |78.021667 |77.306667 |0.990836 | 0.087137 | | Angular2-TypeScript-TodoMVC |39.823333 |39.923333 |1.002511 | 0.736279 | | VanillaJS-TodoMVC |50.073333 |49.791667 |0.994375 | 0.136495 | | jQuery-TodoMVC |221.300000 |221.586667 |1.001295 | 0.418008 | | EmberJS-Debug-TodoMVC |340.145000 |339.965000 |0.999471 | 0.691490 | | React-TodoMVC |85.698333 |85.650000 |0.999436 | 0.761586 | | React-Redux-TodoMVC |140.510000 |140.785000 |1.001957 | 0.285922 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |60.928333 |60.500000 |0.992970 | 0.000069 (significant) | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 262.15844 b mean = 262.72261 pValue = 0.0428052487 (Bigger means are better.) 1.002 times better Results ARE significant * runtime/LiteralParser.cpp: (JSC::LiteralParser::makeIdentifier): (JSC::isJSONWhiteSpace): (JSC::LiteralParser::Lexer::lex): (JSC::LiteralParser::parsePrimitiveValue): (JSC::LiteralParser::parse): * runtime/LiteralParser.h: 2021-09-14 Don Olmstead Non-unified build fixes, mid September 2021 edition https://bugs.webkit.org/show_bug.cgi?id=230110 Unreviewed non-unified build fixes. * runtime/TemporalPlainTimeConstructor.cpp: * runtime/TemporalPlainTimePrototype.cpp: 2021-09-14 Ross Kirsling [Win] JSRemoteInspector.h missing stdint include https://bugs.webkit.org/show_bug.cgi?id=230275 Reviewed by Don Olmstead. * API/JSRemoteInspector.h: Include stdint for uint8_t definition on Windows. 2021-09-14 Xan Lopez [JSC] Remove unnecessary exception checks in DFGOperations https://bugs.webkit.org/show_bug.cgi?id=230247 Reviewed by Caio Araujo Neponoceno de Lima. JSValue::decode cannot throw an exception, remove a couple of unnecessary RETURN_IF_EXCEPTION() calls. * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): 2021-09-14 Xan López [JSC] ASSERT failed in stress/for-in-tests.js (32bit) https://bugs.webkit.org/show_bug.cgi?id=229543 Reviewed by Yusuke Suzuki. Since r280760 DFG::SpeculativeJIT::compileEnumeratorGetByVal uses too many registers for 32bit. Revert to the slow path as a temporary measure to avoid crashes, we'll try to reenable the optimizations later on (see bug #230189). * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): define a generic call operation for compileEnumeratorGetByVal. * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT.cpp: move the current version of compileEnumeratorGetByVal to 64bit, since it won't work on 32bit. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): call the generic call op always. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): use the previous version here. * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): refactor a bit the slow path for enumeratorGetByVal so it can be called from DFG as a call operation. * runtime/CommonSlowPaths.h: (JSC::CommonSlowPaths::opEnumeratorGetByVal): 2021-09-13 Xan López [JSC][32bit] in-by-val fails inside for-in loop after delete https://bugs.webkit.org/show_bug.cgi?id=230150 Reviewed by Carlos Garcia Campos. The order of payload and tag was reversed when constructing the base value for compileEnumeratorHasProperty. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): 2021-09-10 Stephan Szabo [PlayStation] Support running applications with ENABLE_STATIC_JSC=ON https://bugs.webkit.org/show_bug.cgi?id=230170 Reviewed by Ross Kirsling. Updating loading code to not load libJavaScriptCore shared library if we are using a static version. * shell/playstation/Initializer.cpp: 2021-09-09 Ross Kirsling [JSC] Clean up current state of Temporal API https://bugs.webkit.org/show_bug.cgi?id=230130 Reviewed by Yusuke Suzuki. This patch perfoms a variety of cleanup tasks following the implementation of Temporal.PlainTime. 1. Do away with the alias Subdurations and refer to ISO8601::Duration directly. (But we can still say "subduration" when referring to a single ordered field, as in `largestSubduration`.) 2. Represent ToTemporalDuration, ToTemporalDurationRecord, and ToLimitedTemporalDuration more directly in code, as TemporalDuration::{toTemporalDuration, fromDurationLike, toISO8601Duration}. (Note: The last of these doesn't take a disallowedFields parameter; Temporal.Instant can do this after the fact, since no one else makes use of this functionality.) 3. Extract intlOption into a helper function, `temporalRoundingMode`. 4. Remove largestSubplainTime(), which was declared but not defined. 5. Correct spelling of TemporalPlainTime::constrainTime(). * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::create): (JSC::TemporalDuration::TemporalDuration): (JSC::TemporalDuration::tryCreateIfValid): (JSC::TemporalDuration::fromDurationLike): Added. (JSC::TemporalDuration::toISO8601Duration): Added. (JSC::TemporalDuration::toTemporalDuration): Added. (JSC::TemporalDuration::from): (JSC::totalNanoseconds): (JSC::TemporalDuration::compare): (JSC::TemporalDuration::sign): (JSC::TemporalDuration::with const): (JSC::TemporalDuration::negated const): (JSC::TemporalDuration::abs const): (JSC::largestSubduration): Added. (JSC::TemporalDuration::balance): (JSC::TemporalDuration::add const): (JSC::TemporalDuration::subtract const): (JSC::TemporalDuration::round): (JSC::TemporalDuration::round const): (JSC::TemporalDuration::total const): (JSC::TemporalDuration::toString const): (JSC::TemporalDuration::toString): (JSC::TemporalDuration::fromNonDurationValue): Deleted. (JSC::TemporalDuration::toDuration): Deleted. (JSC::TemporalDuration::toDurationRecord): Deleted. (JSC::TemporalDuration::largestSubduration const): Deleted. * runtime/TemporalDuration.h: * runtime/TemporalDurationConstructor.cpp: * runtime/TemporalDurationPrototype.cpp: * runtime/TemporalObject.cpp: (JSC::temporalRoundingMode): Added. * runtime/TemporalObject.h: * runtime/TemporalPlainTime.cpp: (JSC::TemporalPlainTime::round const): (JSC::TemporalPlainTime::toString const): (JSC::constrainTime): Added. (JSC::regulateTime): (JSC::TemporalPlainTime::add const): (JSC::TemporalPlainTime::subtract const): (JSC::extractDifferenceOptions): (JSC::constraintTime): Deleted. (JSC::toLimitedTemporalDuration): Deleted. * runtime/TemporalPlainTime.h: 2021-09-09 Yusuke Suzuki [JSC] Intl.Locale weekendInfo should list all weekend days instead of range https://bugs.webkit.org/show_bug.cgi?id=230108 Reviewed by Ross Kirsling. We cannot assume that weekend is contiguous. For example, Burnei's weekend is Friday and Sunday. This is raised in [1], and our conclusion in Sep-9 meeting is that we should have an array which includes all the weekend days. The change is merged in [2], and this patch changes our implementation accordingly. [1]: https://github.com/tc39/proposal-intl-locale-info/issues/25 [2]: https://github.com/tc39/proposal-intl-locale-info/commit/afb1e269dd698476a2514129235cdad88af60e6f * runtime/IntlLocale.cpp: (JSC::IntlLocale::weekInfo): * runtime/IntlObjectInlines.h: (JSC::createArrayFromIntVector): 2021-09-09 Darin Adler Improve performance by using StringView, not "const StringView&" https://bugs.webkit.org/show_bug.cgi?id=229834 Reviewed by Anders Carlsson. * parser/Lexer.h: * runtime/IntlDateTimeFormat.cpp: (JSC::IntlDateTimeFormat::setFormatsFromPattern): * runtime/IntlDateTimeFormat.h: Use StringView, not const StringView&. 2021-09-09 Yusuke Suzuki [JSC] Optimize op_get_property_enumerator further https://bugs.webkit.org/show_bug.cgi?id=230086 Reviewed by Saam Barati. 1. This patch adds fast path of op_get_property_enumerator to LLInt and Baseline. Previously, we only had this fast path in DFG and FTL. 2. From the profiled data, Speedometer2/React-Redux-TodoMVC has GetPropertyEnumerator(CellOrOther). However, DFG and FTL only optimized GetPropertyEnumerator(Cell). We add CellOrOther and Other cases: if the argument is Other, then we can constant fold it to the empty enumerator. If the argument is CellOrOther, we can check first, and return empty enumerator for Other case. 3. This patch also cleans up StructureRareData lookup by introducing StructureType to JSType. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |117.388333 |117.680000 |1.002485 | 0.269607 | | VueJS-TodoMVC |24.918333 |24.651667 |0.989298 | 0.157665 | | EmberJS-TodoMVC |126.430000 |126.296667 |0.998945 | 0.673803 | | BackboneJS-TodoMVC |48.695000 |48.411667 |0.994181 | 0.019164 | | Preact-TodoMVC |17.268333 |17.511667 |1.014091 | 0.199775 | | AngularJS-TodoMVC |130.246667 |129.850000 |0.996954 | 0.261543 | | Vanilla-ES2015-TodoMVC |63.626667 |63.611667 |0.999764 | 0.912112 | | Inferno-TodoMVC |63.881667 |63.600000 |0.995591 | 0.385440 | | Flight-TodoMVC |78.158333 |78.606667 |1.005736 | 0.284177 | | Angular2-TypeScript-TodoMVC |39.448333 |39.411667 |0.999071 | 0.890825 | | VanillaJS-TodoMVC |50.858333 |51.130000 |1.005342 | 0.195409 | | jQuery-TodoMVC |225.318333 |226.256667 |1.004164 | 0.011190 | | EmberJS-Debug-TodoMVC |340.150000 |338.450000 |0.995002 | 0.000063 (significant) | | React-TodoMVC |85.703333 |85.606667 |0.998872 | 0.549298 | | React-Redux-TodoMVC |141.985000 |140.418333 |0.988966 | 0.000000 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.505000 |61.705000 |1.003252 | 0.079817 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 260.98021 b mean = 261.16020 pValue = 0.4985041089 (Bigger means are better.) 1.001 times better Results ARE NOT significant * bytecode/SpeculatedType.cpp: (JSC::dumpSpeculation): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): (JSC::DFG::SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::branchIfStructure): (JSC::AssemblyHelpers::branchIfNotStructure): * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): * jit/JIT.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_property_enumerator): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_get_property_enumerator): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * runtime/BrandedStructure.cpp: (JSC::BrandedStructure::create): * runtime/JSType.cpp: (WTF::printInternal): * runtime/JSType.h: * runtime/Structure.cpp: (JSC::Structure::Structure): (JSC::Structure::create): * runtime/Structure.h: (JSC::Structure::isRareData): (JSC::Structure::isRareData const): Deleted. * runtime/StructureInlines.h: (JSC::Structure::create): (JSC::Structure::createStructure): * runtime/StructureRareData.h: * runtime/VM.cpp: (JSC::VM::VM): 2021-09-09 Patrick Angle run-webkit-archive crashes with dyld error https://bugs.webkit.org/show_bug.cgi?id=228060 Reviewed by Alex Christensen. Add a compatibility symbol for the old `WTF::Optional` version of `BackendDispatcher::reportProtocolError` in versions of Safari shipping with macOS Big Sur and earlier. This has the side effect of not surfacing protocol errors and instead silently discarding them when crossing this API boundary. Newer versions of macOS ship using the newer symbol and are therefor not affected and will continue to surface protocol errors to the frontend. * runtime/SymbolStubsForSafariCompatibility.mm: (Inspector::BackendDispatcher::reportProtocolError): 2021-09-09 Justin Michaud Differential testing: incorrect constant propagation around Uint8ClampedArray https://bugs.webkit.org/show_bug.cgi?id=229869 We casted int52 values to int32 before clamping, which caused any value with the 32nd bit set to be interpreted as negative. The fix is to check the full-size value when deciding to clamp. Reviewed by Saam Barati. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-09-09 Robin Morisset Optimize compareStrictEq when neither side is a double and at least one is not a BigInt https://bugs.webkit.org/show_bug.cgi?id=226755 Reviewed by Yusuke Suzuki. This is a very similar patch to https://bugs.webkit.org/show_bug.cgi?id=226676. The difference is that here we allow Strings on both side of the comparison, so we must add code to handle equality among strings. Like for that other patch, the optimization is disabled for BigInt32. Enabling it in that case would either need modifying the speculation (from banning HeapBigInt to banning all BigInts), or ensuring that we can never have a HeapBigInt so small it compares equal to a BigInt32. I only implemented this optimization on 64-bits: it is just painful to write code that handles registers at such a low-level without a 32-bit machine to test things locally. If anyone wants to make this optimization work on 32-bit, I don't foretell any major difficulty. Finally, like quite a few other useKinds already, this case does not make the CompareStrictEq merge with an adjacent Branch. The reason is simply that this patch relies on compileStringEquality, which currently does not support that feature. I intend to fix this (for all useKinds at once) in a separate patch. Effect on microbenchmarks: poly-stricteq-not-double 46.8000+-0.4110 ^ 23.5872+-0.3061 ^ definitely 1.9841x faster poly-stricteq-not-double-nor-string 16.6880+-0.2317 16.3627+-0.3729 might be 1.0199x faster poly-stricteq 49.2175+-0.6047 48.9532+-0.6758 I looked at how many cases of Untyped/Untyped compareStrictEq have been fixed by this patch and two other recent patches. On JetStream2: - https://bugs.webkit.org/show_bug.cgi?id=226621: 731 instances - https://bugs.webkit.org/show_bug.cgi?id=226676: 944 instances - This patch: only 26 instances This leaves 20 instances of Untyped/Untyped. On Speedometer2.0: - https://bugs.webkit.org/show_bug.cgi?id=226621: 1587 instances - https://bugs.webkit.org/show_bug.cgi?id=226676: 2784 instances - This patch: 891 instances This leaves 75 instances of Untyped/Untyped. * bytecode/SpeculatedType.h: (JSC::isNeitherDoubleNorHeapBigIntSpeculation): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue): * dfg/DFGNode.h: (JSC::DFG::Node::shouldSpeculateNeitherDoubleNorHeapBigInt): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileStrictEq): (JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality): (JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality): (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt): (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileNeitherDoubleNorHeapBigIntToNotDoubleStrictEquality): * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::checkMayCrashIfInputIsEmpty): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-09-07 Yusuke Suzuki Unreviewed, add files to xcodeproj https://bugs.webkit.org/show_bug.cgi?id=229892 * JavaScriptCore.xcodeproj/project.pbxproj: 2021-09-07 Yusuke Suzuki [JSC] Implement Temporal.PlainTime https://bugs.webkit.org/show_bug.cgi?id=229892 Reviewed by Darin Adler. This patch implements Temporal.PlainTime[1]. This is time representation which is not associated to calendars and timezones. This is tuple of hour, minute, second, millisecond, microsecond, and nanosecond. 1. We add full-fledged ISO8601 DateTime / Time parser, so that Temporal.PlainTime.from can extract time as specified. 2. ISO8601::PlainTime is used for already-validated PlainTime data. When performing arithmetics, we first do that in ISO8601::Duration, and then we validate and convert it to PlainTime. We also found several spec issues, and reported in [2,3,4]. [1]: https://tc39.es/proposal-temporal/#sec-temporal-plaintime-objects [2]: https://github.com/tc39/proposal-temporal/issues/1803 [3]: https://github.com/tc39/proposal-temporal/issues/1804 [4]: https://github.com/tc39/proposal-temporal/issues/1805 * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * Sources.txt: * runtime/CommonIdentifiers.h: * runtime/ISO8601.cpp: (JSC::ISO8601::parseTimeZoneName): (JSC::ISO8601::parseDecimalInt32): (JSC::ISO8601::parseDuration): (JSC::ISO8601::parseTimeSpec): (JSC::ISO8601::parseTimeZoneNumericUTCOffset): (JSC::ISO8601::parseTimeZoneBracketedAnnotation): (JSC::ISO8601::canBeTimeZone): (JSC::ISO8601::parseTimeZone): (JSC::ISO8601::parseTime): (JSC::ISO8601::daysInMonth): (JSC::ISO8601::parseDate): (JSC::ISO8601::parseDateTime): (JSC::ISO8601::formatTimeZoneOffsetString): (JSC::ISO8601::temporalTimeToString): (JSC::ISO8601::isValidDuration): * runtime/ISO8601.h: (JSC::ISO8601::Duration::Duration): (JSC::ISO8601::Duration::operator[]): (JSC::ISO8601::Duration::operator[] const): (JSC::ISO8601::Duration::begin const): (JSC::ISO8601::Duration::end const): (JSC::ISO8601::Duration::clear): (JSC::ISO8601::Duration::operator- const): (JSC::ISO8601::PlainTime::PlainTime): (JSC::ISO8601::PlainTime::operator==): (JSC::ISO8601::PlainDate::PlainDate): (JSC::ISO8601::PlainDate::year const): (JSC::ISO8601::PlainDate::month const): (JSC::ISO8601::PlainDate::day const): * runtime/IntlObject.cpp: (JSC::utcTimeZoneIDSlow): * runtime/IntlObject.h: (JSC::utcTimeZoneID): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::plainTimeStructure): * runtime/TemporalCalendarConstructor.cpp: (JSC::TemporalCalendarConstructor::finishCreation): * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::tryCreateIfValid): (JSC::TemporalDuration::fromNonDurationValue): (JSC::TemporalDuration::toDuration): (JSC::TemporalDuration::toDurationRecord): (JSC::TemporalDuration::toString const): (JSC::TemporalDuration::toString): (JSC::isValidDuration): Deleted. (JSC::TemporalDuration::fromObject): Deleted. * runtime/TemporalDuration.h: * runtime/TemporalNow.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalObject.cpp: (JSC::createPlainTimeConstructor): (JSC::secondsStringPrecision): (JSC::toTemporalOverflow): * runtime/TemporalObject.h: * runtime/TemporalPlainTime.cpp: Added. (JSC::TemporalPlainTime::create): (JSC::TemporalPlainTime::createStructure): (JSC::TemporalPlainTime::TemporalPlainTime): (JSC::TemporalPlainTime::finishCreation): (JSC::TemporalPlainTime::visitChildrenImpl): (JSC::toPlainTime): (JSC::TemporalPlainTime::tryCreateIfValid): (JSC::nonNegativeModulo): (JSC::balanceTime): (JSC::roundTime): (JSC::TemporalPlainTime::round const): (JSC::TemporalPlainTime::toString const): (JSC::propertyName): (JSC::toTemporalTimeRecord): (JSC::toPartialTime): (JSC::constraintTime): (JSC::regulateTime): (JSC::toTemporalCalendarWithISODefault): (JSC::getTemporalCalendarWithISODefault): (JSC::TemporalPlainTime::from): (JSC::TemporalPlainTime::compare): (JSC::toLimitedTemporalDuration): (JSC::addTime): (JSC::TemporalPlainTime::add const): (JSC::TemporalPlainTime::subtract const): (JSC::TemporalPlainTime::with const): (JSC::differenceTime): (JSC::extractDifferenceOptions): (JSC::TemporalPlainTime::until const): (JSC::TemporalPlainTime::since const): * runtime/TemporalPlainTime.h: Added. * runtime/TemporalPlainTimeConstructor.cpp: Added. (JSC::TemporalPlainTimeConstructor::create): (JSC::TemporalPlainTimeConstructor::createStructure): (JSC::TemporalPlainTimeConstructor::TemporalPlainTimeConstructor): (JSC::TemporalPlainTimeConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalPlainTimeConstructor.h: Copied from Source/JavaScriptCore/runtime/TemporalTimeZone.h. * runtime/TemporalPlainTimePrototype.cpp: Added. (JSC::TemporalPlainTimePrototype::create): (JSC::TemporalPlainTimePrototype::createStructure): (JSC::TemporalPlainTimePrototype::TemporalPlainTimePrototype): (JSC::TemporalPlainTimePrototype::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/TemporalPlainTimePrototype.h: Copied from Source/JavaScriptCore/runtime/TemporalTimeZone.h. * runtime/TemporalTimeZone.cpp: (JSC::TemporalTimeZone::from): (JSC::TemporalTimeZone::idForTimeZoneName): Deleted. * runtime/TemporalTimeZone.h: * runtime/TemporalTimeZoneConstructor.cpp: (JSC::TemporalTimeZoneConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/VM.cpp: * runtime/VM.h: 2021-09-07 Yusuke Suzuki Math.hypot checks for infinite values prematurely https://bugs.webkit.org/show_bug.cgi?id=229843 Reviewed by Ross Kirsling. According to the spec[1], we should throw an error about non finite argument after coercing all arguments to doubles. [1]: https://tc39.es/ecma262/#sec-math.hypot * runtime/MathObject.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-09-07 Adrian Perez de Castro Non-unified build fixes, early September 2021 edition https://bugs.webkit.org/show_bug.cgi?id=229983 Unreviewed non-unified build fixes. * runtime/TemporalTimeZone.cpp: Add missing JSObjectInlines.h header. 2021-09-03 Yusuke Suzuki [JSC] Make EnumeratorNextUpdateIndexAndMode clobberizing rule precise https://bugs.webkit.org/show_bug.cgi?id=229898 rdar://82714439 Reviewed by Saam Barati. Clobberizing rule and AI does not match for EnumeratorNextUpdateIndexAndMode node. We fix both cases: isSaneChain is not related to this node. So we should use isInBounds as we are doing for HasIndexedProperty node. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): 2021-09-03 Ross Kirsling Unreviewed, non-unified JSC build fix following 241222@main. * b3/B3ReduceLoopStrength.h: * jit/JITOperations.h: * wasm/WasmOperations.h: 2021-09-03 Ross Kirsling [JSC] Yarr::ByteTerm sometimes leaves fields uninitialized https://bugs.webkit.org/show_bug.cgi?id=229891 Reviewed by Yusuke Suzuki. * yarr/YarrInterpreter.h: (JSC::Yarr::ByteTerm::ByteTerm): Default initialize `frameLocation` and `inputPosition`. (Also, use initializer list where possible.) 2021-09-03 Yusuke Suzuki [JSC] Implement Temporal.TimeZone https://bugs.webkit.org/show_bug.cgi?id=229703 Reviewed by Ross Kirsling. This patch implements Temporal.TimeZone. While this patch does not implement features which requires Temporal.Instant, we implement the core of Temporal.TimeZone, holding UTC offset or IANA TimeZone ID. This patch implements parsing TimeZoneNumericUTCOffset to populate TimeZone from that format. Since Temporal.TimeZone is implemented, we also support `Temporal.Now.timeZone()`, which returns current system TimeZone. We also fix Intl enumeration not including "UTC". Since it is included in IANA TimeZones, we should include that. * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * runtime/ISO8601.cpp: (JSC::ISO8601::parseDecimalInt32): (JSC::ISO8601::handleFraction): (JSC::ISO8601::parseTimeZoneNumericUTCOffset): (JSC::ISO8601::formatTimeZoneOffsetString): * runtime/ISO8601.h: * runtime/IntlObject.cpp: (JSC::isValidTimeZoneNameFromICUTimeZone): (JSC::canonicalizeTimeZoneNameFromICUTimeZone): (JSC::intlAvailableTimeZones): (JSC::availableTimeZones): * runtime/IntlObject.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::timeZoneStructure): * runtime/TemporalNow.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalNow.h: * runtime/TemporalObject.cpp: (JSC::createTimeZoneConstructor): * runtime/TemporalTimeZone.cpp: Added. (JSC::TemporalTimeZone::createFromID): (JSC::TemporalTimeZone::createFromUTCOffset): (JSC::TemporalTimeZone::createStructure): (JSC::TemporalTimeZone::TemporalTimeZone): (JSC::TemporalTimeZone::idForTimeZoneName): (JSC::parseTemporalTimeZoneString): (JSC::TemporalTimeZone::from): * runtime/TemporalTimeZone.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h. * runtime/TemporalTimeZoneConstructor.cpp: Added. (JSC::TemporalTimeZoneConstructor::create): (JSC::TemporalTimeZoneConstructor::createStructure): (JSC::TemporalTimeZoneConstructor::TemporalTimeZoneConstructor): (JSC::TemporalTimeZoneConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalTimeZoneConstructor.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h. * runtime/TemporalTimeZonePrototype.cpp: Added. (JSC::TemporalTimeZonePrototype::create): (JSC::TemporalTimeZonePrototype::createStructure): (JSC::TemporalTimeZonePrototype::TemporalTimeZonePrototype): (JSC::TemporalTimeZonePrototype::finishCreation): (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalTimeZonePrototype.h: Copied from Source/JavaScriptCore/runtime/ISO8601.h. * runtime/VM.cpp: * runtime/VM.h: 2021-09-02 Yusuke Suzuki [JSC] Validate JSPropertyNameEnumerator via watchpoints https://bugs.webkit.org/show_bug.cgi?id=229846 Reviewed by Keith Miller. Looked into Elm-TodoMVC sampling profiler data and found that op_get_property_enumerator is taking enough amount of time. And Instruments say validating JSPropertyNameEnumerator via traversing StructureChain is costly. We are caching JSPropertyNameEnumerator only when we meet the condition: objects in prototype chain can ensure identity of property names if structure is not changed. So we can use watchpoint based approach to invalidate JSPropertyNameEnumerator. This patch injects structure transition watchpoints if possible. And when watchpoint is fired, we invalidate JSPropertyNameEnumerator cached in StructureRareData, as if we are ensuring prototype chain condition for the other property accesses. This offers 0.6% improvement in Speedometer2. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |121.971667 |117.725000 |0.965183 | 0.000000 (significant) | | VueJS-TodoMVC |26.246667 |26.035000 |0.991935 | 0.360614 | | EmberJS-TodoMVC |126.196667 |126.653333 |1.003619 | 0.103138 | | BackboneJS-TodoMVC |48.976667 |48.881667 |0.998060 | 0.474106 | | Preact-TodoMVC |20.118333 |20.115000 |0.999834 | 0.989038 | | AngularJS-TodoMVC |131.545000 |130.706667 |0.993627 | 0.015344 (significant) | | Vanilla-ES2015-TodoMVC |63.725000 |63.773333 |1.000758 | 0.706560 | | Inferno-TodoMVC |64.231667 |62.653333 |0.975427 | 0.000000 (significant) | | Flight-TodoMVC |77.223333 |77.690000 |1.006043 | 0.268309 | | Angular2-TypeScript-TodoMVC |39.686667 |39.500000 |0.995296 | 0.499678 | | VanillaJS-TodoMVC |52.321667 |51.973333 |0.993342 | 0.077777 | | jQuery-TodoMVC |224.908333 |225.761667 |1.003794 | 0.022136 | | EmberJS-Debug-TodoMVC |339.858333 |339.886667 |1.000083 | 0.950320 | | React-TodoMVC |86.545000 |86.070000 |0.994512 | 0.001518 (significant) | | React-Redux-TodoMVC |146.010000 |142.855000 |0.978392 | 0.000000 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.411667 |61.456667 |1.000733 | 0.631499 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 255.96543 b mean = 257.53379 pValue = 0.0000034394 (Bigger means are better.) 1.006 times better Results ARE significant * bytecode/Watchpoint.cpp: * bytecode/Watchpoint.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * runtime/JSPropertyNameEnumerator.h: (JSC::propertyNameEnumerator): * runtime/StructureRareData.h: * runtime/StructureRareDataInlines.h: (JSC::StructureRareData::setCachedPropertyNameEnumerator): (JSC::StructureChainInvalidationWatchpoint::install): (JSC::StructureChainInvalidationWatchpoint::fireInternal): (JSC::StructureRareData::tryCachePropertyNameEnumeratorViaWatchpoint): (JSC::StructureRareData::invalidateWatchpointBasedValidation): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-09-03 Yusuke Suzuki [JSC] Fix WebKitAdditions directory traversal in offlineasm part 2 https://bugs.webkit.org/show_bug.cgi?id=229853 Reviewed by Mark Lam. When DEPLOYMENT_LOCATION is YES, WEBKITADDITIONS_HEADERS_FOLDER_PATH is /usr/local/include/WebKitAdditions. However, since Xcode implicitly changes it to ${SDKROOT}/usr/local/include/WebKitAdditions, we need to pass the path with ${SDKROOT} if this path is used by non-Xcode. In this patch, we replace --use-deployment-location with --webkit-additions-path=path and passing WebKitAdditions path directly from Xcode. We define WK_WEBKITADDITIONS_INSTALL_PATH and WK_WEBKITADDITIONS_HEADERS_FOLDER_PATH in JavaScriptCore/Configurations/Base.xcconfig to populate this variable and pass WK_WEBKITADDITIONS_HEADERS_FOLDER_PATH to the scripts. We also fix offlineasm's path concatenation. It was using +, but this does not work if directory doesn't end with '/'. We should use File.join when concatenating file paths. * Configurations/Base.xcconfig: * JavaScriptCore.xcodeproj/project.pbxproj: * offlineasm/asm.rb: * offlineasm/generate_offset_extractor.rb: * offlineasm/generate_settings_extractor.rb: * offlineasm/parser.rb: 2021-09-03 Michael Catanzaro Silence more -Wreturn-type warnings https://bugs.webkit.org/show_bug.cgi?id=229858 Unreviewed. * runtime/TemporalDuration.cpp: (JSC::propertyName): * runtime/TemporalObject.cpp: (JSC::roundNumberToIncrement): 2021-09-02 Yusuke Suzuki [JSC] Fix WebKitAdditions directory traversal in offlineasm https://bugs.webkit.org/show_bug.cgi?id=229841 Reviewed by Mark Lam. When DEPLOYMENT_LOCATION is YES, WebKitAdditions directory becomes /usr/local/include/WebKitAdditions. This patch adds --use-deployment-location option to generate_offset_extractor.rb, generate_settings_extractor.rb, and asm.rb. And they pass it to parser to change the include directory. * JavaScriptCore.xcodeproj/project.pbxproj: * offlineasm/asm.rb: * offlineasm/generate_offset_extractor.rb: * offlineasm/generate_settings_extractor.rb: * offlineasm/parser.rb: 2021-09-02 Ross Kirsling [JSC] ScriptExecutable::newCodeBlockFor should handle exceptions more predictably https://bugs.webkit.org/show_bug.cgi?id=229787 Reviewed by Mark Lam. ScriptExecutable::newCodeBlockFor has four codepaths -- one for each of EvalExecutable, ProgramExecutable, ModuleProgramExecutable, and FunctionExecutable. These all end up in bool CodeBlock::finishCreation(...), but the first three overwrite the current exception with an OOM error while the last does not. Furthermore, newCodeBlockFor handles exceptions via an out param, which is then returned by its single caller, prepareForExecutionImpl. Altogether, this results in some questionable checking of the returned exception against throwScope.exception() at prepareForExecution's callsites in Interpreter and elsewhere. This patch aims to make this exception handling clearer and more consistent by: 1. not overwriting an existing exception with an OOM error 2. doing away with the out param in favor of RETURN_IF_EXCEPTION * bytecode/CodeBlock.h: (JSC::ScriptExecutable::prepareForExecution): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * interpreter/Interpreter.cpp: (JSC::Interpreter::executeProgram): (JSC::Interpreter::executeCall): (JSC::Interpreter::executeConstruct): (JSC::Interpreter::prepareForRepeatCall): (JSC::Interpreter::execute): (JSC::Interpreter::executeModuleProgram): * interpreter/InterpreterInlines.h: (JSC::Interpreter::execute): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): (JSC::virtualForWithFunction): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::setUpCall): * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::newCodeBlockFor): (JSC::ScriptExecutable::prepareForExecutionImpl): * runtime/ScriptExecutable.h: 2021-09-02 Mikhail R. Gadelha Fix IndexedDoubleStore InlineAccess for 32 bits https://bugs.webkit.org/show_bug.cgi?id=229772 Reviewed by Caio Araujo Neponoceno de Lima. In IndexedDoubleStore inline access, the path if the value is NaN is only being handled in 64 bits, thus introducing some wrong results in 32 bits. This patch fixes: stress/double-add-sub-mul-can-produce-nan.js stress/pow-stable-results.js stress/math-pow-stable-results.js * bytecode/AccessCase.cpp: (JSC::AccessCase::generateWithGuard): 2021-09-02 Ross Kirsling [JSC] Fix invalid exception checks in Temporal classes https://bugs.webkit.org/show_bug.cgi?id=229793 Reviewed by Yusuke Suzuki. * runtime/TemporalCalendarPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalDuration.cpp: (JSC::TemporalDuration::fromObject): (JSC::TemporalDuration::toDuration): (JSC::TemporalDuration::with const): * runtime/TemporalDurationPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-09-02 Yusuke Suzuki Unreviewed, annotate executeJSCJITProbe with REFERENCED_FROM_ASM WTF_INTERNAL * assembler/ProbeContext.h: 2021-09-02 Mark Lam Add more support for JIT operation validation testing. https://bugs.webkit.org/show_bug.cgi?id=229534 rdar://81526335 Reviewed by Saam Barati. 1. Added a JITOperationValidation.h to tidy up the code for supporting JIT operation validation. 2. Introduce a JITOperationAnnotation struct to record JIT operation function pointers, with an extra pointer field for a validation test function. 3. Changed JSC_ANNOTATE_JIT_OPERATION to capture a JITOperationAnnotation struct instead of just a single operation pointer. 4. Converted the static addPointers() function in JITOperationList.cpp into a member function of JITOperationList. This allows for the code to be more terse, as well as enables the use of an inverse map mechanism on debug builds only. 5. Added more macros to help differentiate between different types of JIT operation functions. 6. Made all JIT operation functions use extern "C" linkage to make it possible to write validation tests in assembly so that we can run them on a release build as well without taking too much time. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * assembler/JITOperationList.cpp: (JSC::JITOperationList::addInverseMap): (JSC::JITOperationList::addPointers): (JSC::JITOperationList::populatePointersInJavaScriptCore): (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt): (JSC::JITOperationList::populatePointersInEmbedder): (JSC::addPointers): Deleted. * assembler/JITOperationList.h: (JSC::JITOperationList::map const): (JSC::JITOperationList::inverseMap const): (JSC::JITOperationList::assertIsJITOperation): (JSC::JITOperationList::assertIsJITOperationWithvalidation): * assembler/JITOperationValidation.h: Added. * assembler/MacroAssemblerARM64.cpp: * assembler/MacroAssemblerARM64.h: * assembler/MacroAssemblerARM64E.h: * assembler/MacroAssemblerARMv7.cpp: * assembler/MacroAssemblerMIPS.cpp: * assembler/MacroAssemblerX86Common.cpp: * b3/testb3.h: * b3/testb3_1.cpp: * b3/testb3_5.cpp: * b3/testb3_7.cpp: * dfg/DFGOSRExit.h: * ftl/FTLLowerDFGToB3.cpp: * jit/ExecutableAllocator.cpp: (JSC::initializeJITPageReservation): * jit/Repatch.cpp: (JSC::retagOperationWithValidation): (JSC::retagCallTargetWithValidation): (JSC::readPutICCallTarget): * jit/ThunkGenerators.cpp: * jsc.cpp: * llint/LLIntData.cpp: * llint/LLIntThunks.cpp: * runtime/CommonSlowPaths.h: * runtime/JSCPtrTag.h: (JSC::tagJSCCodePtrImpl): (JSC::untagJSCCodePtrImpl): (JSC::isTaggedJSCCodePtrImpl): * runtime/MathCommon.h: * runtime/Options.cpp: (JSC::canUseJITCage): * tools/JSDollarVM.cpp: * yarr/YarrJIT.cpp: 2021-09-01 Ross Kirsling Unreviewed exception scope verification fix for r241171. * runtime/TemporalDurationConstructor.cpp: Add missing RELEASE_AND_RETURN. 2021-09-01 Myles C. Maxfield Fix the Xcode build after r281838 Unreviewed. * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: 2021-09-01 Zan Dobersek REGRESSION(r279256): Crash in JSC::FTL::saveAllRegisters https://bugs.webkit.org/show_bug.cgi?id=229235 Reviewed by Mark Lam. Avoid out-of-bounds access into RegisterSet's underlying Bitmap that occurs in FTL::saveAllRegisters() and FTL::restoreAllRegisters(). Helper Regs::nextRegister() and Regs::nextFPRegister() methods can increase the register ID values beyond the valid values, at which point there's a possibility of misuse if these register ID values are used to index into the Bitmap. To avoid this, iterating over RegisterID and FPRegisterID ranges is simplified yet kept efficient, and access into the RegisterSet is now only done if the register ID values are valid. This enables removing Regs::nextFPRegister(). Regs::nextRegister() is still used but is not adjusted to also use a for-loop to iterate across the valid RegisterID values, and only for those values the access into the RegisterSet is possible. * ftl/FTLSaveRestore.cpp: (JSC::FTL::saveAllRegisters): (JSC::FTL::restoreAllRegisters): 2021-08-31 Ross Kirsling [JSC] Implement Temporal.Duration https://bugs.webkit.org/show_bug.cgi?id=228532 Reviewed by Yusuke Suzuki. This patch implements the Duration class for the upcoming Temporal API (currently at stage 3 in TC39). Spec: https://tc39.es/proposal-temporal/#sec-temporal-duration-objects Docs: https://tc39.es/proposal-temporal/docs/duration.html A Duration is ultimately an array of doubles (years, months, weeks, days, hours, minutes, seconds, ms, μs, ns) which can be converted to and from an ISO string representation (e.g. "-P1Y2M3W4DT5H6M7.123456789S") and which supports various calculations. The spec is still in flux and certain issues were identified in the course of preparing this patch. This code aims to be "as correct as possible" for the moment; small corrections are expected in the near future. * CMakeLists.txt: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * runtime/CommonIdentifiers.h: * runtime/ISO8601.cpp: Added. * runtime/ISO8601.h: Added. * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::durationStructure): * runtime/TemporalDuration.cpp: Added. * runtime/TemporalDuration.h: Added. * runtime/TemporalDurationConstructor.cpp: Added. * runtime/TemporalDurationConstructor.h: Added. * runtime/TemporalDurationPrototype.cpp: Added. * runtime/TemporalDurationPrototype.h: Added. * runtime/TemporalObject.cpp: (JSC::createDurationConstructor): (JSC::singularUnit): (JSC::temporalUnitType): (JSC::temporalLargestUnit): (JSC::temporalSmallestUnit): (JSC::temporalFractionalSecondDigits): (JSC::secondsStringPrecision): (JSC::maximumRoundingIncrement): (JSC::temporalRoundingIncrement): (JSC::roundNumberToIncrement): * runtime/TemporalObject.h: * runtime/VM.cpp: * runtime/VM.h: 2021-08-31 Lauro Moura Non-unified build partial fixes, late late August 2021 https://bugs.webkit.org/show_bug.cgi?id=229741 Unreviewed non-unified build fixes. * bytecode/PutByStatus.cpp: Add missing header. * bytecode/PutByVariant.h: Ditto. * runtime/TemporalCalendar.cpp: Ditto. * runtime/TemporalCalendarPrototype.cpp: Ditto. 2021-08-31 Yusuke Suzuki [JSC] Enable Object.hasOwn https://bugs.webkit.org/show_bug.cgi?id=229730 Reviewed by Saam Barati. Enable Object.hasOwn implementation. And cleaning up feature flag list. * runtime/OptionsList.h: 2021-08-31 Saam Barati Baseline JIT's in_by_val and emitHasPrivate should load the property before branching on if the base is a cell https://bugs.webkit.org/show_bug.cgi?id=229725 Reviewed by Keith Miller. If the base isn't a cell, we're calling the slow path with a random value in the property. This works, because the slow paths first branch on if the base is a cell or not, and throw an exception. But we fix this for our own sanity, since it's never a good idea to go to a slow path with a JSValue argument containing unknown bits. * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitHasPrivate): 2021-08-31 Aditi Singh Implement Object.hasOwn() https://bugs.webkit.org/show_bug.cgi?id=226291 Reviewed by Alexey Shvayka. This patch implements Object.hasOwn() method which is a stage 3 proposal. The method is disabled by default and can be enabled using the feature flag. The proposal details can be found here: https://github.com/tc39/proposal-accessible-object-hasownproperty. The patch also refines objectPrototypeHasOwnProperty() to accept JSObject* base rather than JSValue. * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * runtime/CommonIdentifiers.h: * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/ObjectConstructor.cpp: (JSC::ObjectConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ObjectPrototype.cpp: (JSC::objectPrototypeHasOwnProperty): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ObjectPrototype.h: * runtime/OptionsList.h: 2021-08-26 Darin Adler Cut down on use of CFGetTypeID, using dynamic_cf_cast instead; related streamlining https://bugs.webkit.org/show_bug.cgi?id=229414 Reviewed by Tim Horton. * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm: (Inspector::RemoteInspectorXPCConnection::deserializeMessage): Use dynamic_cf_cast to check type instead of CFGetTypeID. Also do the check at runtime rather than asserting. Not really sufficient to assert correct type for something that comes over an XPC connection. 2021-08-30 Ross Kirsling [JSC] Host functions and custom getters should be lowerCamelCase https://bugs.webkit.org/show_bug.cgi?id=229695 Reviewed by Yusuke Suzuki. For some reason, the host functions and custom getters for Intl (and JSONObject) were written in UpperCamelCase. * runtime/IntlCollatorConstructor.cpp: * runtime/IntlCollatorPrototype.cpp: * runtime/IntlDateTimeFormatConstructor.cpp: * runtime/IntlDateTimeFormatPrototype.cpp: * runtime/IntlDisplayNamesConstructor.cpp: * runtime/IntlDisplayNamesPrototype.cpp: * runtime/IntlListFormatConstructor.cpp: * runtime/IntlListFormatPrototype.cpp: * runtime/IntlLocalePrototype.cpp: * runtime/IntlNumberFormatConstructor.cpp: * runtime/IntlNumberFormatPrototype.cpp: * runtime/IntlPluralRulesConstructor.cpp: * runtime/IntlPluralRulesPrototype.cpp: * runtime/IntlRelativeTimeFormatConstructor.cpp: * runtime/IntlRelativeTimeFormatPrototype.cpp: * runtime/IntlSegmentIteratorPrototype.cpp: * runtime/IntlSegmenterConstructor.cpp: * runtime/IntlSegmenterPrototype.cpp: * runtime/IntlSegmentsPrototype.cpp: * runtime/JSONObject.cpp: 2021-08-30 Ross Kirsling [JSC][Intl] Errors for .call({}) are too verbose https://bugs.webkit.org/show_bug.cgi?id=229694 Reviewed by Yusuke Suzuki. * runtime/IntlCollatorPrototype.cpp: * runtime/IntlDateTimeFormatPrototype.cpp: * runtime/IntlDisplayNamesPrototype.cpp: * runtime/IntlListFormatPrototype.cpp: * runtime/IntlLocalePrototype.cpp: * runtime/IntlNumberFormatPrototype.cpp: * runtime/IntlPluralRulesPrototype.cpp: * runtime/IntlRelativeTimeFormatPrototype.cpp: * runtime/IntlSegmentIteratorPrototype.cpp: * runtime/IntlSegmenterPrototype.cpp: * runtime/IntlSegmentsPrototype.cpp: 2021-08-30 Yusuke Suzuki [JSC] Implement Temporal.Calendar https://bugs.webkit.org/show_bug.cgi?id=229651 Reviewed by Ross Kirsling. This patch implements Temporal.Calendar's simple part. Currently, we do not implement many part of Temporal.Calendar since we do not have Temporal Date-like structures yet, but this patch implemented core part of Temporal.Calendar: keeping calendar identifier. We also defer implementing Temporal.Calendar.from's calendar ID parsing part since it requires full-fledged ISO 8601 parser, which will be implemented in a separate patch. We use `unsigned` for CalendarID, and this id corresponds to the array index of intlAvailableCalendars, which returns array of String from ICU. * CMakeLists.txt: * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: * DerivedSources.make: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * runtime/CommonIdentifiers.h: * runtime/IntlObject.cpp: (JSC::intlAvailableCalendars): (JSC::iso8601CalendarIDSlow): (JSC::availableCalendars): (JSC::createArrayFromStringVector): Deleted. * runtime/IntlObject.h: (JSC::iso8601CalendarID): * runtime/IntlObjectInlines.h: (JSC::createArrayFromStringVector): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: (JSC::JSGlobalObject::calendarStructure): * runtime/TemporalCalendar.cpp: Added. (JSC::TemporalCalendar::create): (JSC::TemporalCalendar::createStructure): (JSC::TemporalCalendar::TemporalCalendar): (JSC::TemporalCalendar::isBuiltinCalendar): (JSC::parseTemporalCalendarString): (JSC::TemporalCalendar::from): * runtime/TemporalCalendar.h: Added. * runtime/TemporalCalendarConstructor.cpp: Added. (JSC::TemporalCalendarConstructor::create): (JSC::TemporalCalendarConstructor::createStructure): (JSC::TemporalCalendarConstructor::TemporalCalendarConstructor): (JSC::TemporalCalendarConstructor::finishCreation): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/TemporalCalendarConstructor.h: Added. * runtime/TemporalCalendarPrototype.cpp: Added. (JSC::TemporalCalendarPrototype::create): (JSC::TemporalCalendarPrototype::createStructure): (JSC::TemporalCalendarPrototype::TemporalCalendarPrototype): (JSC::TemporalCalendarPrototype::finishCreation): (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::defaultMergeFields): * runtime/TemporalCalendarPrototype.h: Added. * runtime/TemporalObject.cpp: (JSC::createCalendarConstructor): * runtime/VM.cpp: * runtime/VM.h: 2021-08-30 Ross Kirsling Unreviewed, add missing include to pre-empt unified source shift. * runtime/IntlObject.cpp: 2021-08-30 Angelos Oikonomopoulos resolve-asm-file-conflicts.rb build failure after upgrade to CMake 3.21.0; DWARF 5 incompatibility https://bugs.webkit.org/show_bug.cgi?id=228267 Reviewed by Adrian Perez de Castro. Implement the fix suggested by Adrian Vovk: any .file 0 directive should pass through unchanged. While here - if the file path is an absolute path, don't concat it with the working directory - also accept 'md5 0xhash' in the .file directive. * Scripts/resolve-asm-file-conflicts.rb: 2021-08-30 Zan Dobersek RISCV64 support in LLInt https://bugs.webkit.org/show_bug.cgi?id=229035 Reviewed by Yusuke Suzuki. Introduce RISCV64 support at the LLint level. Along with the necessary offlineasm backend, plenty of miscellaneous code around MacroAssembler infrastructure is also introduced. Of the existing supported architectures, RISCV64 is most similar to ARM64, with the same word size and similar register abundance. This is mirrored in most changes around the MacroAssembler infrastructure as well as using same or similar codepaths in LLint for the two ISAs. For the MacroAssembler infrastructure, it won't be used until proper JIT support is introduced, but the basic facilities are still necessary to keep things compiling without complicating the configuration matrix. MacroAssemblerRISCV64 class provides no-op methods through C++ templates while RISCV64Assembler is also added in a limited form. The riscv64 offlineasm backend covers assembly generation for instructions that are exhibited by LLInt in the current configuration. It doesn't cover instructions that e.g. are only used in the WebAssembly opcodes, and WebAssembly won't be enabled until the higher JIT tiers are supported anyway. The offlineasm backend's assembly generation for specific instructions uses pattern matching of operand types for better overview of how resulting assembly is constructed. There's still certain improvements possible, e.g. in how scratch registers for more expansive operations are allocated. * CMakeLists.txt: * Sources.txt: * assembler/AbstractMacroAssembler.h: * assembler/MacroAssembler.h: * assembler/MacroAssemblerRISCV64.cpp: Added. (JSC::MacroAssembler::probe): * assembler/MacroAssemblerRISCV64.h: Added. Distorted auto-generated method list removed. Necessary methods are introduced through no-op templates until actually needed for JIT generation. * assembler/MaxFrameExtentForSlowPathCall.h: * assembler/PerfLog.cpp: * assembler/ProbeContext.h: * assembler/RISCV64Assembler.h: Added. (JSC::RISCV64Assembler::firstRegister): (JSC::RISCV64Assembler::lastRegister): (JSC::RISCV64Assembler::numberOfRegisters): (JSC::RISCV64Assembler::firstSPRegister): (JSC::RISCV64Assembler::lastSPRegister): (JSC::RISCV64Assembler::numberOfSPRegisters): (JSC::RISCV64Assembler::firstFPRegister): (JSC::RISCV64Assembler::lastFPRegister): (JSC::RISCV64Assembler::numberOfFPRegisters): (JSC::RISCV64Assembler::gprName): (JSC::RISCV64Assembler::sprName): (JSC::RISCV64Assembler::fprName): (JSC::RISCV64Assembler::RISCV64Assembler): (JSC::RISCV64Assembler::buffer): (JSC::RISCV64Assembler::invert): (JSC::RISCV64Assembler::getRelocatedAddress): (JSC::RISCV64Assembler::codeSize const): (JSC::RISCV64Assembler::getCallReturnOffset): (JSC::RISCV64Assembler::labelIgnoringWatchpoints): (JSC::RISCV64Assembler::labelForWatchpoint): (JSC::RISCV64Assembler::label): (JSC::RISCV64Assembler::linkJump): (JSC::RISCV64Assembler::linkCall): (JSC::RISCV64Assembler::linkPointer): (JSC::RISCV64Assembler::maxJumpReplacementSize): (JSC::RISCV64Assembler::patchableJumpSize): (JSC::RISCV64Assembler::repatchPointer): (JSC::RISCV64Assembler::relinkJump): (JSC::RISCV64Assembler::relinkJumpToNop): (JSC::RISCV64Assembler::relinkCall): (JSC::RISCV64Assembler::debugOffset): (JSC::RISCV64Assembler::cacheFlush): (JSC::RISCV64Assembler::fillNops): * assembler/RISCV64Registers.h: Added. * jit/FPRInfo.h: (JSC::FPRInfo::toRegister): (JSC::FPRInfo::toArgumentRegister): (JSC::FPRInfo::toIndex): (JSC::FPRInfo::debugName): * jit/GPRInfo.h: (JSC::GPRInfo::toRegister): (JSC::GPRInfo::toArgumentRegister): (JSC::GPRInfo::toIndex): (JSC::GPRInfo::debugName): * jit/RegisterSet.cpp: (JSC::RegisterSet::vmCalleeSaveRegisters): (JSC::RegisterSet::llintBaselineCalleeSaveRegisters): * llint/LLIntData.h: * llint/LLIntOfflineAsmConfig.h: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/backends.rb: Reference the riscv64 backend as required. * offlineasm/registers.rb: List additional possible registers. * offlineasm/riscv64.rb: Added. 2021-08-29 Keith Miller Add openFile function to jsc.cpp that links to file backed memory https://bugs.webkit.org/show_bug.cgi?id=229621 Reviewed by Saam Barati. This patch uses fopen directly rather than use WTF::MappedFileData so there were less changes to readline. * jsc.cpp: (computeFilePath): (JSC_DEFINE_HOST_FUNCTION): (JSFileDescriptor::subspaceFor): (JSFileDescriptor::createStructure): (JSFileDescriptor::create): (JSFileDescriptor::finishCreation): (JSFileDescriptor::destroy): (JSFileDescriptor::descriptor const): (JSFileDescriptor::JSFileDescriptor): (JSFileDescriptor::~JSFileDescriptor): 2021-08-29 Joonghun Park Unreviewed. Remove the build warning below since r281615. warning: control reaches end of non-void function [-Wreturn-type] * bytecode/PutByStatus.cpp: (JSC::PutByStatus::makesCalls const): 2021-08-28 Cameron McCormack Miscellaneous typo fixes https://bugs.webkit.org/show_bug.cgi?id=229642 Reviewed by Fujii Hironori. * API/JSValue.h: * runtime/RegExp.cpp: (JSC::RegExp::matchCompareWithInterpreter): 2021-08-27 Stephan Szabo [PlayStation][CMake] Add control over whether JavaScriptCore should be shared https://bugs.webkit.org/show_bug.cgi?id=229591 Reviewed by Don Olmstead. Make LowLevelInterpreterLib objects get added via _PRIVATE_LIBRARIES when using JavaScriptCore as an object library in order to propogate them correctly. * CMakeLists.txt: 2021-08-27 Russell Epstein Land Windows build fixes from safari-612.1.29.14-branch. https://bugs.webkit.org/show_bug.cgi?id=229627. Reviewed by Per Arne Vollan. * JavaScriptCore.vcxproj/JavaScriptCore.proj: 2021-08-27 Mark Lam Changed ARM64 probe trampoline to do ptr auth the standard way. https://bugs.webkit.org/show_bug.cgi?id=229629 rdar://problem/82453220 Reviewed by Saam Barati. Also fix a comment, and add back 2 lines that I accidentally deleted in r281718. * assembler/MacroAssemblerARM64.cpp: 2021-08-27 Mark Lam Make ARM64 and X86_64 probe code a little bit more efficient. https://bugs.webkit.org/show_bug.cgi?id=229618 rdar://82445743 Reviewed by Yusuke Suzuki. We were using an unnecessary indirect call to call Probe::executeProbe() when we can be using a direct call, which emits less JIT code. This patch changes the ARM64 and X86_64 ports to use a direct call now. Also rename executeProbe to executeJSCJITProbe to make it more unique since we're switching to extern "C" linkage for this function now. For MacroAssemblerX86Common.cpp, we left the X86 and MSVC implementations unchanged. For X86, I don't know the stack alignment requirements (if any) plus we might want to delete this code eventually since we're not supporting the X86 JIT anymore. For MSVC, I don't know the way to express a direct call in MSVC assembly, and have no way to test it. Will leave that as an exercise for folks working on the Windows ports if they are interested. Also remove JITProbeExecutorPtrTag since it's no longer needed. * assembler/MacroAssemblerARM64.cpp: (JSC::MacroAssembler::probe): * assembler/MacroAssemblerARMv7.cpp: (JSC::MacroAssembler::probe): * assembler/MacroAssemblerMIPS.cpp: (JSC::MacroAssembler::probe): * assembler/MacroAssemblerX86Common.cpp: (JSC::ctiMasmProbeTrampoline): (JSC::MacroAssembler::probe): * assembler/ProbeContext.cpp: (JSC::Probe::executeJSCJITProbe): (JSC::Probe::executeProbe): Deleted. * assembler/ProbeContext.h: * runtime/JSCPtrTag.h: 2021-08-27 Saam Barati Update ARM64EHash https://bugs.webkit.org/show_bug.cgi?id=228962 Reviewed by Mark Lam. * assembler/AssemblerBuffer.h: (JSC::ARM64EHash::ARM64EHash): (JSC::ARM64EHash::update): (JSC::ARM64EHash::makeDiversifier): (JSC::ARM64EHash::nextValue): (JSC::ARM64EHash::bitsForDiversifier): (JSC::ARM64EHash::currentHash): (JSC::ARM64EHash::setUpdatedHash): (JSC::AssemblerBuffer::AssemblerBuffer): (JSC::AssemblerBuffer::putIntegralUnchecked): * assembler/LinkBuffer.cpp: (JSC::LinkBuffer::copyCompactAndLinkCode): 2021-08-27 Mikhail R. Gadelha Avoid increasing required alignment of target type warning on ARM 32 bits https://bugs.webkit.org/show_bug.cgi?id=229151 Reviewed by Mark Lam. Same approach as https://bugs.webkit.org/show_bug.cgi?id=38045 cast pointers to void* to bypass warning about increasing pointer alingment. reinterpret_cast_ptr has custom behaviour only on ARM and MIPS 32 bits, and doesn't change the behaviour in 64 bits archs (reinterpret_cast_ptr is preprocessed to reinterpret_cast in 64 bits archs) * bytecode/Instruction.h: (JSC::BaseInstruction::asKnownWidth const): * llint/LLIntCommon.h: 2021-08-27 Commit Queue Unreviewed, reverting r281587. https://bugs.webkit.org/show_bug.cgi?id=229609 stress test failed on ARM64 Reverted changeset: "[ARM64] Fix pre-index address mode" https://bugs.webkit.org/show_bug.cgi?id=229175 https://commits.webkit.org/r281587 2021-08-26 Yusuke Suzuki Intl.DateTimeFormat incorrectly parses patterns with 'h' literal https://bugs.webkit.org/show_bug.cgi?id=229313 rdar://82414310 Reviewed by Ross Kirsling. While DateTimeFormat pattern and skeleton can include single-quoted literal texts, we are not respecting that when parsing them to extract information. As a result, we are incorrectly extracting hour-cycle information for "fr" locale since it can include "HH 'h'" pattern text. This patch fixes that by skipping literal text correctly. * runtime/IntlDateTimeFormat.cpp: (JSC::skipLiteralText): (JSC::IntlDateTimeFormat::setFormatsFromPattern): (JSC::IntlDateTimeFormat::hourCycleFromPattern): (JSC::IntlDateTimeFormat::replaceHourCycleInSkeleton): (JSC::IntlDateTimeFormat::replaceHourCycleInPattern): * runtime/IntlDateTimeFormat.h: * runtime/IntlLocale.cpp: (JSC::IntlLocale::hourCycles): 2021-08-26 Yusuke Suzuki Float32Arrays.sort() return undefined when length < 2 https://bugs.webkit.org/show_bug.cgi?id=229575 Reviewed by Saam Barati. TypedArray#sort should return |this| even when we don't perform sorting. * builtins/TypedArrayPrototype.js: (sort): 2021-08-26 Yusuke Suzuki [JSC] op_put_private_name should use modern IC and remove ByValInfo https://bugs.webkit.org/show_bug.cgi?id=229544 Reviewed by Saam Barati. This patch makes op_put_private_name use new PutByVal IC. This allows op_put_private_name to support polymorphic properties, and we can finally remove Baseline's adhoc IC and ByValInfo completely. Added microbenchmark showed 3x improvement due to polymorphic PutPrivateName IC. ToT Patched class-private-field-polymorphic 9.3666+-0.0332 ^ 3.1199+-0.0182 ^ definitely 3.0022x faster * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/ByValInfo.cpp: Removed. * bytecode/ByValInfo.h: Removed. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::getICStatusMap): (JSC::CodeBlock::stronglyVisitStrongReferences): (JSC::CodeBlock::findByValInfo): Deleted. (JSC::CodeBlock::addByValInfo): Deleted. * bytecode/CodeBlock.h: * bytecode/ICStatusMap.h: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetPrivateName): (JSC::DFG::SpeculativeJIT::compilePutPrivateName): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGStoreBarrierInsertionPhase.cpp: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): * jit/JIT.cpp: (JSC::JIT::privateCompileSlowCases): (JSC::JIT::link): (JSC::JIT::privateCompileExceptionHandlers): * jit/JIT.h: (JSC::ByValCompilationInfo::ByValCompilationInfo): Deleted. * jit/JITInlines.h: (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): Deleted. (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase): Deleted. * jit/JITOperations.cpp: (JSC::putPrivateNameOptimize): (JSC::putPrivateName): (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emitPutByValWithCachedId): Deleted. (JSC::JIT::emitPutPrivateNameWithCachedId): Deleted. (JSC::JIT::emitByValIdentifierCheck): Deleted. (JSC::JIT::privateCompilePutPrivateNameWithCachedId): Deleted. * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): * jit/Repatch.cpp: (JSC::appropriateGenericPutByFunction): (JSC::appropriateOptimizingPutByFunction): (JSC::resetPutBy): 2021-08-26 Saam Barati r281485 was not sufficient in where it called disablePeepholeOptimization https://bugs.webkit.org/show_bug.cgi?id=229582 Reviewed by Yusuke Suzuki. r281485 accidentally deleted a place where we called disablePeepholeOptimization that was necessary. Basically, after we seek where the current instruction in BytecodeGenerator is, we need to disablePeepholeOptimization. * bytecompiler/BytecodeGenerator.cpp: (JSC::ForInContext::finalize): 2021-08-26 Per Arne Vollan [AppleWin] JSC build failure https://bugs.webkit.org/show_bug.cgi?id=229578 Reviewed by Don Olmstead. Add new build dependency between LLIntOffsetsExtractor and JSCBuiltins targets. * CMakeLists.txt: 2021-08-26 Yusuke Suzuki [JSC] Segfault in stress/typedarray-every.js (32bit) https://bugs.webkit.org/show_bug.cgi?id=229546 Reviewed by Saam Barati. ARMv7 does not have enough registers. Adding workaround by using getEffectiveAddress. * bytecode/AccessCase.cpp: (JSC::AccessCase::generateWithGuard): 2021-08-26 Yusuke Suzuki [JSC] DataIC should not embed StructureStubInfo pointer https://bugs.webkit.org/show_bug.cgi?id=229541 Reviewed by Mark Lam. We should not embed pointer to StructureStubInfo::countdown if DataIC is used. * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::store8): * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::regenerate): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfCountdown): 2021-08-25 Yusuke Suzuki [JSC] Polymorphic PutByVal https://bugs.webkit.org/show_bug.cgi?id=229229 Reviewed by Saam Barati. This patch changes PutByVal IC to modern style. This polymorphic PutByVal can handle multiple array types and multiple identifiers. Also, this removes adhoc IC code in Baseline so that it paves the way to unlinked Baseline JIT by cleaning up IC. Several interesting points of the design. 1. We need to pass ArrayProfile* via GPRReg to IC since we need to profile mayStoreToHole, which is still important to avoid the slow path. 2. Transition / Replace IC need to record propertyRegs if it exists not to clobber these registers. This is important in DFG / FTL since IC should not clobber these registers unless it is flushed. It also makes Baseline code smaller since we do not reload them in the slow path call. 3. Added a path folding String/Symbol when emitting PutByVal in DFG / FTL. This edge-case is found via a microbenchmark. Let's consider the case: one put_by_val site has one identifier "foo", but it has so many different Structures. Previously, we emit JITPutByIdGenerator adhocly, and still we cache this "foo" identifier in cachedId. In DFG / FTL, while we cannot make it PutByOffset, we can emit PutById since we know that identifier is always "foo". But after this patch's change, such a site becomes slow-path. And then this identifier information is missed, and we were emitting PutByVal for that. For now, we attempt to fold to one identifier in DFGByteCodeParser so that we can still attempt to make it PutById, which can be PutByOffset in constant folding phase. We would like to handle this one identifier slow-path case in PutByStatus / GetByStatus in the future patch. 4. Now, DFG OSR exit does not query to ByValInfo for setter calls since JITPutByValGenerator use StructureStubInfo in Baseline. Results of Microbenchmarks look good. ToT Patched put-by-val-direct-large-index 94.6265+-0.9076 93.4550+-0.7121 might be 1.0125x faster inlined-put-by-val-with-string-transition 23.7131+-0.3282 ^ 22.7679+-0.1137 ^ definitely 1.0415x faster put-by-val-with-string-slightly-polymorphic 1.9852+-0.0284 1.9580+-0.0224 might be 1.0139x faster get-and-put-by-val-double-index-dont-fall-off-a-cliff 185.4762+-0.5737 ? 185.6325+-0.5819 ? polymorphic-put-by-val-with-string 30.9903+-0.1207 30.8097+-0.1285 put-by-val-machine-int 1.8803+-0.0384 1.8707+-0.0440 fold-put-by-val-with-symbol-to-multi-put-by-offset 4.8463+-0.1148 4.7839+-0.0547 might be 1.0130x faster put-by-val-with-string-replace-and-transition 8.8730+-1.5934 ^ 6.2276+-0.0585 ^ definitely 1.4248x faster fold-put-by-val-with-string-to-multi-put-by-offset 4.8183+-0.0841 ? 4.8233+-0.0892 ? put-by-val-direct 0.2845+-0.0091 ? 0.2901+-0.0088 ? might be 1.0196x slower put-by-val-with-symbol-replace-and-transition 6.3527+-0.0686 ? 6.3933+-0.0961 ? put-by-val-with-symbol 9.3556+-3.1421 7.1509+-0.1019 might be 1.3083x faster put-by-val-with-symbol-slightly-polymorphic 2.0052+-0.0309 1.9781+-0.0397 might be 1.0137x faster put-by-val-negative-array-index 14.9572+-0.1221 ^ 14.5636+-0.1044 ^ definitely 1.0270x faster put-by-val-with-string 11.6345+-4.3048 ^ 7.0919+-0.0918 ^ definitely 1.6405x faster put-by-val-large-index-blank-indexing-type 3.1425+-0.1165 3.1236+-0.0378 inlined-put-by-val-with-symbol-transition 23.4932+-0.3186 ^ 22.8469+-0.0873 ^ definitely 1.0283x faster polymorphic-put-by-val-with-symbol 36.6046+-1.6519 ^ 30.8597+-0.1474 ^ definitely 1.1862x faster Speedometer2 showed roughly 0.2-0.3% progression. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |121.916667 |121.958333 |1.000342 | 0.876802 | | VueJS-TodoMVC |26.263333 |26.006667 |0.990227 | 0.263868 | | EmberJS-TodoMVC |127.080000 |127.866667 |1.006190 | 0.011497 (significant) | | BackboneJS-TodoMVC |48.920000 |49.318333 |1.008143 | 0.003395 (significant) | | Preact-TodoMVC |19.828333 |19.828333 |1.000000 | 1.000000 | | AngularJS-TodoMVC |134.011667 |132.080000 |0.985586 | 0.000000 (significant) | | Vanilla-ES2015-TodoMVC |63.726667 |63.838333 |1.001752 | 0.408404 | | Inferno-TodoMVC |65.153333 |63.753333 |0.978512 | 0.000000 (significant) | | Flight-TodoMVC |78.133333 |78.780000 |1.008276 | 0.097794 | | Angular2-TypeScript-TodoMVC |40.415000 |40.100000 |0.992206 | 0.287630 | | VanillaJS-TodoMVC |51.931667 |52.500000 |1.010944 | 0.004149 (significant) | | jQuery-TodoMVC |226.056667 |225.073333 |0.995650 | 0.007796 (significant) | | EmberJS-Debug-TodoMVC |341.210000 |340.978333 |0.999321 | 0.623386 | | React-TodoMVC |87.198333 |86.893333 |0.996502 | 0.042189 | | React-Redux-TodoMVC |146.506667 |145.958333 |0.996257 | 0.018801 (significant) | | Vanilla-ES2015-Babel-Webpack-TodoMVC |61.450000 |61.870000 |1.006835 | 0.000049 (significant) | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 254.85111 b mean = 255.25735 pValue = 0.1856561656 (Bigger means are better.) 1.002 times better Results ARE NOT significant * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/AccessCase.cpp: (JSC::AccessCase::create): (JSC::AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck const): (JSC::AccessCase::requiresIdentifierNameMatch const): (JSC::AccessCase::requiresInt32PropertyCheck const): (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::doesCalls const): (JSC::AccessCase::canReplace const): (JSC::AccessCase::generateWithGuard): (JSC::AccessCase::generateImpl): (JSC::AccessCase::toTypedArrayType): (JSC::AccessCase::canBeShared): * bytecode/AccessCase.h: (JSC::SharedJITStubSet::Hash::Key::Key): (JSC::SharedJITStubSet::Hash::Key::operator==): (JSC::SharedJITStubSet::Searcher::Translator::equal): * bytecode/ArrayProfile.h: (JSC::ArrayProfile::offsetOfMayStoreToHole): (JSC::ArrayProfile::offsetOfLastSeenStructureID): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/ICStatusMap.h: * bytecode/InlineAccess.cpp: (JSC::getScratchRegister): * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::regenerate): (WTF::printInternal): * bytecode/PutByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/PutByIdStatus.cpp. (JSC::PutByStatus::appendVariant): (JSC::PutByStatus::shrinkToFit): (JSC::PutByStatus::computeFromLLInt): (JSC::PutByStatus::PutByStatus): (JSC::PutByStatus::computeFor): (JSC::PutByStatus::computeForStubInfo): (JSC::PutByStatus::makesCalls const): (JSC::PutByStatus::slowVersion const): (JSC::PutByStatus::singleIdentifier const): (JSC::PutByStatus::visitAggregateImpl): (JSC::PutByStatus::markIfCheap): (JSC::PutByStatus::finalize): (JSC::PutByStatus::merge): (JSC::PutByStatus::filter): (JSC::PutByStatus::dump const): * bytecode/PutByStatus.h: Renamed from Source/JavaScriptCore/bytecode/PutByIdStatus.h. * bytecode/PutByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/PutByIdVariant.cpp. (JSC::PutByVariant::PutByVariant): (JSC::PutByVariant::operator=): (JSC::PutByVariant::replace): (JSC::PutByVariant::transition): (JSC::PutByVariant::setter): (JSC::PutByVariant::oldStructureForTransition const): (JSC::PutByVariant::fixTransitionToReplaceIfNecessary): (JSC::PutByVariant::writesStructures const): (JSC::PutByVariant::reallocatesStorage const): (JSC::PutByVariant::makesCalls const): (JSC::PutByVariant::attemptToMerge): (JSC::PutByVariant::attemptToMergeTransitionWithReplace): (JSC::PutByVariant::visitAggregateImpl): (JSC::PutByVariant::markIfCheap): (JSC::PutByVariant::finalize): (JSC::PutByVariant::dump const): (JSC::PutByVariant::dumpInContext const): * bytecode/PutByVariant.h: Renamed from Source/JavaScriptCore/bytecode/PutByIdVariant.h. (JSC::PutByVariant::PutByVariant): (JSC::PutByVariant::identifier const): (JSC::PutByVariant::overlaps): * bytecode/RecordedStatuses.cpp: (JSC::RecordedStatuses::addPutByStatus): (JSC::RecordedStatuses::visitAggregateImpl): (JSC::RecordedStatuses::addPutByIdStatus): Deleted. * bytecode/RecordedStatuses.h: * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::reset): * bytecode/StructureStubInfo.h: * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): (JSC::DFG::AbstractInterpreter::filterICStatus): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::load): (JSC::DFG::ByteCodeParser::store): (JSC::DFG::ByteCodeParser::emitPutById): (JSC::DFG::ByteCodeParser::handlePutById): (JSC::DFG::ByteCodeParser::handlePutPrivateNameById): (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::handlePutByVal): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGClobbersExitState.cpp: (JSC::DFG::clobbersExitState): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitPutByOffset): (JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGGraph.h: * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::addPutByVal): * dfg/DFGMayExit.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasPutByStatus): (JSC::DFG::Node::putByStatus): (JSC::DFG::Node::hasPutByIdStatus): Deleted. (JSC::DFG::Node::putByIdStatus): Deleted. * dfg/DFGNodeType.h: * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::callerReturnPC): * dfg/DFGObjectAllocationSinkingPhase.cpp: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGStoreBarrierInsertionPhase.cpp: * dfg/DFGValidate.cpp: * dfg/DFGVarargsForwardingPhase.cpp: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset): * generator/DSL.rb: * jit/ICStats.h: * jit/JIT.cpp: (JSC::JIT::privateCompileSlowCases): (JSC::JIT::link): * jit/JIT.h: * jit/JITInlineCacheGenerator.cpp: (JSC::JITPutByIdGenerator::JITPutByIdGenerator): (JSC::JITPutByValGenerator::JITPutByValGenerator): (JSC::JITPutByValGenerator::generateFastPath): (JSC::JITPutByValGenerator::finalize): * jit/JITInlineCacheGenerator.h: * jit/JITInlines.h: (JSC::JIT::emitArrayProfilingSiteWithCell): (JSC::JIT::chooseArrayMode): Deleted. * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): (JSC::putByVal): (JSC::directPutByVal): (JSC::putByValOptimize): (JSC::directPutByValOptimize): (JSC::tryPutByValOptimize): Deleted. (JSC::tryDirectPutByValOptimize): Deleted. * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emitGenericContiguousPutByVal): Deleted. (JSC::JIT::emitArrayStoragePutByVal): Deleted. (JSC::JIT::privateCompilePutByVal): Deleted. (JSC::JIT::privateCompilePutByValWithCachedId): Deleted. (JSC::JIT::emitIntTypedArrayPutByVal): Deleted. (JSC::JIT::emitFloatTypedArrayPutByVal): Deleted. * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emitGenericContiguousPutByVal): Deleted. (JSC::JIT::emitArrayStoragePutByVal): Deleted. * jit/Repatch.cpp: (JSC::appropriateGenericPutByFunction): (JSC::appropriateOptimizingPutByFunction): (JSC::tryCachePutBy): (JSC::repatchPutBy): (JSC::tryCacheArrayPutByVal): (JSC::repatchArrayPutByVal): (JSC::tryCacheInBy): (JSC::resetPutBy): (JSC::appropriateGenericPutByIdFunction): Deleted. (JSC::appropriateOptimizingPutByIdFunction): Deleted. (JSC::tryCachePutByID): Deleted. (JSC::repatchPutByID): Deleted. (JSC::resetPutByID): Deleted. * jit/Repatch.h: * llint/LowLevelInterpreter.h: 2021-08-25 Yusuke Suzuki REGRESSION(r281513?): [ JSC Catalina+ Debug ] 16 stress/intl-enumeration.js (JSC Tests) are flaky failing https://bugs.webkit.org/show_bug.cgi?id=229526 Reviewed by Mark Lam. Fix debug JSC test failures by using RELEASE_AND_RETURN. * runtime/IntlObject.cpp: (JSC::availableCalendars): (JSC::availableCollations): (JSC::availableCurrencies): (JSC::availableNumberingSystems): (JSC::availableTimeZones): 2021-08-25 Yijia Huang [ARM64] Fix pre-index address mode https://bugs.webkit.org/show_bug.cgi?id=229175 Reviewed by Saam Barati. This patch fixes the canonicalization phase for pre/post-increment address mode due to the potential bugs commented on in the previous patch https://bugs.webkit.org/show_bug.cgi?id=228538. And this patch removed the temporary fix in https://bugs.webkit.org/show_bug.cgi?id=229211. Previously, the pre-index address mode for Load instruction convert the pattern to the canonical form like this: address = Add(base, offset) address = Add(base, offset) ... --> newMemory = Load(base, offset) ... ... memory = Load(base, offset) memory = Identity(newMemory) which is wrong. Assume "..." contains a store to a memory location that aliases for address: address = Add(base, offset) address = Add(base, offset) ... --> newMemory = Load(base, offset) ... ... Store(value1, address) Store(value1, address) memory = Load(base, offset) memory = Identity(newMemory) The loaded value should always be value1 which is not true after the conversion. So, moving the load above the store is semantically incorrect because it's not identical to the behavior of the original program. In this case, maybe we should apply alias analysis to detect the violations of reference updating. To solve this problem, we moves the address value to just before the memory value instead of moving memory value upward. Convert Pre-Index Load Pattern to the Canonical Form: address = Add(base, offset) address = Nop ... ... ... newAddress = Add(base, offset) memory = Load(base, offset) --> memory = Load(base, offset) ... ... parent = B3Opcode(address, ...) parent = B3Opcode(newAddress, ...) Convert Pre-Index Store Pattern to the Canonical Form: address = Add(base, offset) address = Nop ... ... ... newAddress = Add(base, offset) memory = Store(value1, base, offset) --> memory = Store(value1, base, offset) ... ... parent = B3Opcode(address, ...) parent = B3Opcode(newAddress, ...) To move the address value downward, we need to make sure that no use reference of address between the address and memory values. * b3/B3CanonicalizePrePostIncrements.cpp: (JSC::B3::canonicalizePrePostIncrements): * b3/B3Generate.cpp: (JSC::B3::generateToAir): * b3/B3ValueKey.h: * b3/B3ValueKeyInlines.h: (JSC::B3::ValueKey::ValueKey): * b3/testb3.h: * b3/testb3_3.cpp: (testLoadWithStorePreIndex32): (testStorePreIndex32): (testStorePreIndex64): (testStorePostIndex32): (testStorePostIndex64): (addShrTests): * runtime/OptionsList.h: 2021-08-25 Xan Lopez [JSC] Infinite loop in for...in after r280760 https://bugs.webkit.org/show_bug.cgi?id=229493 Reviewed by Yusuke Suzuki. A missing instruction in the 32bit branch can potentially cause infinite loops when using for-in. No new test, this is already covered by (among others) LayoutTests/js/reserved-words.html. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode): 2021-08-25 Keith Miller Add for-in OwnStructureMode optimizations to LLInt https://bugs.webkit.org/show_bug.cgi?id=229038 Reviewed by Saam Barati. This patch adds the optimizations we have for OwnStructureMode in the Baseline to the LLInt. The patch also adds redundant self move (i.e. move a, a) elimination to arm64. Finally, a bunch of the property offset functions are now marked constexpr and return intptr_t rather than size_t as the values can be negative. There's also a minor fix to disable MSVC's signed to unsigned cast warning for LLIntOffsetsExtractor as we don't care about signedness for extracting constants. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_get_by_val): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/arm64.rb: * offlineasm/generate_offset_extractor.rb: * runtime/Butterfly.h: (JSC::Butterfly::indexOfPropertyStorage): * runtime/JSObject.h: (JSC::offsetInButterfly): * runtime/PropertyOffset.h: (JSC::checkOffset): (JSC::validateOffset): (JSC::isValidOffset): (JSC::isInlineOffset): (JSC::isOutOfLineOffset): (JSC::offsetInInlineStorage): (JSC::offsetInOutOfLineStorage): (JSC::offsetInRespectiveStorage): (JSC::numberOfOutOfLineSlotsForMaxOffset): (JSC::numberOfSlotsForMaxOffset): (JSC::offsetForPropertyNumber): 2021-08-25 Commit Queue Unreviewed, reverting r281523. https://bugs.webkit.org/show_bug.cgi?id=229494 broke cloop build Reverted changeset: "Add for-in OwnStructureMode optimizations to LLInt" https://bugs.webkit.org/show_bug.cgi?id=229038 https://commits.webkit.org/r281523 2021-08-24 Mark Lam Refactor ENABLE(JIT_OPERATION_VALIDATION) code to emit no code when disabled. https://bugs.webkit.org/show_bug.cgi?id=229482 rdar://82318317 Reviewed by Yusuke Suzuki. * assembler/JITOperationList.cpp: (JSC::addPointers): (JSC::JITOperationList::populatePointersInJavaScriptCore): (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt): (JSC::JITOperationList::populatePointersInEmbedder): * assembler/JITOperationList.h: (JSC::JITOperationList::map const): (JSC::JITOperationList::assertIsJITOperation): (JSC::JITOperationList::initialize): (JSC::JITOperationList::populatePointersInJavaScriptCore): (JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt): * runtime/JSCPtrTag.h: (JSC::tagJSCCodePtrImpl): (JSC::untagJSCCodePtrImpl): 2021-08-24 Mark Lam [Re-landing] Add some offlineasm enhancements. https://bugs.webkit.org/show_bug.cgi?id=229332 rdar://82163923 Reviewed by Keith Miller. 1. Enhance "include" offlineasm Instruction to always attempt to include an asm file from /usr/local/include/WebKitAdditions/ first. If the specified file is not available there, then it will attempt to include the file from the same directory as the current source file (which in practice, means Source/JavaScriptCore/llint/). 2. Enhance "include" offlineasm Instruction to allow an optional file to be included if it exists. For example, the following offlineasm code: include? LowLevelInterpreterAdditions ... will attempt to include a file LowLevelInterpreterAdditions.asm. If the file does not exist, this will be a no-op. Note: the "?" after the "include" means the include is optional. 3. Enhanced "emit" offlineasm Instruction to be able to take more than one operand. "emit" used to just copy the string operand that follows into the generated LLIntAssembly.h. Now, "emit" can take multiple comma separated operands, and will concatenate all the operands. Additionally, "emit" can now take a LocalLabelReference as an operand. For example, this offline asm code: emit "b ", .done ... .done: ... will generate this inline asm code in LLIntAssembly.h: "b " LOCAL_LABEL_STRING(_offlineasm_someLabel_done) "\n" This makes it easier to emit branches to local labels. 4. Also fixed LLInt code alignment for ARM_THUMB2 and ARM64. Previously, it was aligned using ".align 4" which means aligned on a 4 instruction boundary. Note: the interpretation of .align varies for different target CPU architectures. Now, we do the alignment using ".balign 4" which means align on a 4 byte boundary. This is the intended alignment because ARM64 instruction size is 4 bytes, and ARM_THUMB2 instruction size is either 2 bytes or 4 bytes. Using .align before was potentially wasting some code space. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter.cpp: * offlineasm/ast.rb: * offlineasm/parser.rb: 2021-08-24 Mark Lam testb3_6 should be using JSSwitchPtrTag instead of JITCompilationPtrTag. https://bugs.webkit.org/show_bug.cgi?id=229479 rdar://82316967 Reviewed by Yusuke Suzuki. This is in testInterpreter() which is emitting code for a jump table. JSSwitchPtrTag is the right tag to use here. * b3/testb3_6.cpp: (testInterpreter): 2021-08-24 Keith Miller Add for-in OwnStructureMode optimizations to LLInt https://bugs.webkit.org/show_bug.cgi?id=229038 Reviewed by Saam Barati. This patch adds the optimizations we have for OwnStructureMode in the Baseline to the LLInt. The patch also adds redundant self move (i.e. move a, a) elimination to arm64. Finally, a bunch of the property offset functions are now marked constexpr and return intptr_t rather than size_t as the values can be negative. There's also a minor fix to disable MSVC's signed to unsigned cast warning for LLIntOffsetsExtractor as we don't care about signedness for extracting constants. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_get_by_val): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/arm64.rb: * offlineasm/generate_offset_extractor.rb: * runtime/Butterfly.h: (JSC::Butterfly::indexOfPropertyStorage): * runtime/JSObject.h: (JSC::offsetInButterfly): * runtime/PropertyOffset.h: (JSC::checkOffset): (JSC::validateOffset): (JSC::isValidOffset): (JSC::isInlineOffset): (JSC::isOutOfLineOffset): (JSC::offsetInInlineStorage): (JSC::offsetInOutOfLineStorage): (JSC::offsetInRespectiveStorage): (JSC::numberOfOutOfLineSlotsForMaxOffset): (JSC::numberOfSlotsForMaxOffset): (JSC::offsetForPropertyNumber): 2021-08-24 Yusuke Suzuki [JSC] Add Intl Enumeration APIs https://bugs.webkit.org/show_bug.cgi?id=214795 Reviewed by Ross Kirsling. This patch implements Intl enumeration API[1] which is in stage-3. Supported keys are, "calendar", "collation", "currency", "numberingSystem", "timeZone", and "unit". [1]: https://github.com/tc39/proposal-intl-enumeration * runtime/IntlDateTimeFormat.cpp: (JSC::IntlDateTimeFormat::localeData): (JSC::IntlDateTimeFormat::initializeDateTimeFormat): * runtime/IntlLocale.cpp: (JSC::createArrayFromStringVector): Deleted. * runtime/IntlNumberFormat.cpp: (JSC::sanctionedSimpleUnitIdentifier): * runtime/IntlObject.cpp: (JSC::IntlObject::finishCreation): (JSC::mapICUCalendarKeywordToBCP47): (JSC::availableCalendars): (JSC::availableCollations): (JSC::availableCurrencies): (JSC::availableNumberingSystems): (JSC::canonicalizeTimeZoneNameFromICUTimeZone): (JSC::availableTimeZones): (JSC::availableUnits): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::createArrayFromStringVector): * runtime/IntlObject.h: * runtime/OptionsList.h: 2021-08-24 Keith Miller (r281473) stress/for-in-has-own-property-shouldnt-flush-registers.js failing on Debug https://bugs.webkit.org/show_bug.cgi?id=229448 Reviewed by Mark Lam. Add missing exception checks. * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): 2021-08-24 Commit Queue Unreviewed, reverting r281321. https://bugs.webkit.org/show_bug.cgi?id=229449 causes crashes on ARM64 Reverted changeset: "Add some offlineasm enhancements." https://bugs.webkit.org/show_bug.cgi?id=229332 https://commits.webkit.org/r281321 2021-08-23 Saam Barati Disable peephole optimizations in the byte code generator after rewriting instructions for for-in https://bugs.webkit.org/show_bug.cgi?id=229420 Reviewed by Keith Miller. The final instruction in a for-in loop might be the get by val that we're rewriting because there was an escape. We won't ever actually do peephole optimizations on this get_by_val today, but it breaks some bookkeeping that the bytecode generator does. This patch makes sure the bookkeeping is up to date. * bytecompiler/BytecodeGenerator.cpp: (JSC::ForInContext::finalize): 2021-08-23 Saam Barati compileEnumeratorHasProperty uses flushRegisters incorrectly https://bugs.webkit.org/show_bug.cgi?id=229412 Reviewed by Keith Miller. We were calling flushRegisters() inside code that isn't always runs inside the EnumeratorInByVal/EnumeratorHasOwnProperty nodes. That is a violation of how flushRegisters() must be used, since flushRegisters() updates global register allocation state, and therefore must run each time a node is run. To fix, we move flushRegisters() before the code starts emitting branches. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): 2021-08-23 Yusuke Suzuki [JSC] emitArrayProfilingSiteWithCell should not load indexingType unnecessarily https://bugs.webkit.org/show_bug.cgi?id=229396 Reviewed by Saam Barati. emitArrayProfilingSiteWithCell is always loading indexingType after profiling a cell. But (possibly) this is old code, and there is no reason to do that. This patch removes it. * jit/JIT.h: * jit/JITInlines.h: (JSC::JIT::emitArrayProfilingSiteWithCell): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emit_op_enumerator_get_by_val): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_in_by_val): 2021-08-22 Yusuke Suzuki [JSC] Remove already-shipped wasm option flags https://bugs.webkit.org/show_bug.cgi?id=229386 Reviewed by Ross Kirsling. This patch removes some wasm option flags which are already shipped. * runtime/OptionsList.h: * wasm/WasmFormat.h: (JSC::Wasm::isValueType): * wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser::parseExpression): (JSC::Wasm::FunctionParser::parseUnreachableExpression): * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmParser.h: (JSC::Wasm::Parser::parseBlockSignature): * wasm/WasmSectionParser.cpp: (JSC::Wasm::SectionParser::parseType): (JSC::Wasm::SectionParser::parseElement): (JSC::Wasm::SectionParser::parseData): (JSC::Wasm::SectionParser::parseDataCount): * wasm/js/JSWebAssembly.cpp: (JSC::JSWebAssembly::finishCreation): * wasm/js/WebAssemblyGlobalConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyTableConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyTablePrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-08-22 Yusuke Suzuki [JSC] Remove already-shipped JS feature flags https://bugs.webkit.org/show_bug.cgi?id=229387 Reviewed by Ross Kirsling. These features are already shipped. So removing these runtime flags to clean up source code and remove untested path. * API/JSObjectRef.cpp: (JSObjectMakeError): * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator): * bytecompiler/NodesCodegen.cpp: (JSC::FunctionCallValueNode::emitBytecode): * parser/Lexer.cpp: (JSC::Lexer::lexWithoutClearingLineTerminator): * parser/Parser.cpp: (JSC::Parser::parseInner): (JSC::Parser::parseForStatement): (JSC::Parser::parseClass): (JSC::Parser::parseBinaryExpression): (JSC::Parser::parseGetterSetter): (JSC::Parser::parsePrimaryExpression): (JSC::Parser::parseUnaryExpression): * runtime/AggregateErrorConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ErrorConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSGlobalObject.h: * runtime/NativeErrorConstructor.cpp: (JSC::NativeErrorConstructor::constructImpl): (JSC::NativeErrorConstructor::callImpl): * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: * wasm/js/WebAssemblyCompileErrorConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyLinkErrorConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-08-22 Commit Queue Unreviewed, reverting r280984 and r280996. https://bugs.webkit.org/show_bug.cgi?id=229384 Speedometer2 0.3-0.5% regression Reverted changesets: "Update ARM64EHash" https://bugs.webkit.org/show_bug.cgi?id=228962 https://commits.webkit.org/r280984 "Refactor some ARM64EHash code." https://bugs.webkit.org/show_bug.cgi?id=229054 https://commits.webkit.org/r280996 2021-08-21 Yusuke Suzuki [JSC] Remove Intl runtime feature flags for already shipped ones https://bugs.webkit.org/show_bug.cgi?id=229371 Reviewed by Ross Kirsling. Since they are already shipped, we should remove these runtime flags. * builtins/DatePrototype.js: (globalPrivate.toDateTimeOptionsAnyAll): (globalPrivate.toDateTimeOptionsTimeTime): * bytecode/BytecodeIntrinsicRegistry.cpp: (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry): * bytecode/BytecodeIntrinsicRegistry.h: * runtime/IntlDateTimeFormat.cpp: (JSC::toDateTimeOptionsAnyDate): (JSC::IntlDateTimeFormat::initializeDateTimeFormat): (JSC::IntlDateTimeFormat::resolvedOptions const): * runtime/IntlDateTimeFormatPrototype.cpp: (JSC::IntlDateTimeFormatPrototype::finishCreation): * runtime/OptionsList.h: 2021-08-21 Yusuke Suzuki [JSC] Intl.DisplayNames v2 https://bugs.webkit.org/show_bug.cgi?id=227832 Reviewed by Ross Kirsling. This patch implements Intl.DisplayNames v2[1]. Newly added names are calendar names and date time field names. For the language name, language display option is added. [1]: https://github.com/tc39/intl-displaynames-v2 * runtime/CommonIdentifiers.h: * runtime/IntlCache.cpp: (JSC::IntlCache::getFieldDisplayName): * runtime/IntlCache.h: * runtime/IntlDisplayNames.cpp: (JSC::IntlDisplayNames::initializeDisplayNames): (JSC::IntlDisplayNames::of const): (JSC::IntlDisplayNames::resolvedOptions const): (JSC::IntlDisplayNames::typeString): (JSC::IntlDisplayNames::languageDisplayString): * runtime/IntlDisplayNames.h: * runtime/IntlObject.cpp: (JSC::isUnicodeLocaleIdentifierType): (JSC::canonicalizeUnicodeLocaleID): (JSC::canonicalizeLocaleList): (JSC::defaultLocale): (JSC::mapBCP47ToICUCalendarKeyword): (JSC::mapICUCollationKeywordToBCP47): (JSC::canonicalizeLanguageTag): Deleted. * runtime/IntlObject.h: 2021-08-21 Yusuke Suzuki [JSC] Intl Locale Info https://bugs.webkit.org/show_bug.cgi?id=227830 Reviewed by Ross Kirsling. This patch implements Intl.Locale's extension (Intl Locale Info proposal)[1], which is already stage 3. Intl.Locale#{calendars,collations,hourCycles,numberingSystems,timeZones} can return array of preferred configuration for the given locale. And Intl.Locale#textInfo can return text layout direction and Intl.Locale#weekInfo can return weekday information (e.g. when weekend starts). [1]: https://github.com/tc39/proposal-intl-locale-info * runtime/IntlLocale.cpp: (JSC::createArrayFromStringVector): (JSC::IntlLocale::calendars): (JSC::IntlLocale::collations): (JSC::IntlLocale::hourCycles): (JSC::IntlLocale::numberingSystems): (JSC::IntlLocale::timeZones): (JSC::IntlLocale::textInfo): (JSC::IntlLocale::weekInfo): * runtime/IntlLocale.h: * runtime/IntlLocalePrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): 2021-08-21 Yusuke Suzuki [JSC] Extend Intl TimeZoneName Option https://bugs.webkit.org/show_bug.cgi?id=227831 Reviewed by Ross Kirsling. https://github.com/tc39/proposal-intl-extend-timezonename This patch implements Extend Intl TimeZoneName proposal, which adds "shortOffset", "longOffset", "shortGeneric", "longGeneric" timeZoneName variants. * runtime/IntlDateTimeFormat.cpp: (JSC::IntlDateTimeFormat::setFormatsFromPattern): (JSC::IntlDateTimeFormat::initializeDateTimeFormat): (JSC::IntlDateTimeFormat::timeZoneNameString): * runtime/IntlDateTimeFormat.h: 2021-08-21 Yusuke Suzuki [JSC] Enable String,TypedArray#at https://bugs.webkit.org/show_bug.cgi?id=229354 Reviewed by Saam Barati. Enable String and TypedArray's `at` method. * runtime/OptionsList.h: 2021-08-21 Yusuke Suzuki [JSC] Enable Array#findLast method https://bugs.webkit.org/show_bug.cgi?id=229355 Reviewed by Saam Barati. This patch enables Array#findLast and Array#findLastIndex methods. * runtime/ArrayPrototype.cpp: Order of unscopables is alphabet ordering (https://tc39.es/ecma262/#sec-array.prototype-@@unscopables) (JSC::ArrayPrototype::finishCreation): * runtime/OptionsList.h: 2021-08-20 Yusuke Suzuki [JSC] Simplify moveIntsToDouble https://bugs.webkit.org/show_bug.cgi?id=229351 Reviewed by Saam Barati. MacroAssembler::moveIntsToDouble required scratch FPRReg. But it was only required for MacroAssemblerX86, and it is already removed. This means that we no longer need this scratch FPRReg. This change makes a lot of IC code, property access code simpler. This patch removes that scratch FPRReg, and removed scratch FPRReg of many arithmetic ICs. This patch is important for PutByVal modern IC since some of property access requires FPRReg because of MacroAssembler::moveIntsToDouble, and it requires adding new m_scratch2FPR to AccessCase. But after this simplification, this is no longer necessary. * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::moveIntsToDouble): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::moveIntsToDouble): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileValueToInt32): (JSC::DFG::SpeculativeJIT::compileDoubleRep): (JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp): (JSC::DFG::SpeculativeJIT::compileValueAdd): (JSC::DFG::SpeculativeJIT::compileValueSub): (JSC::DFG::SpeculativeJIT::compileMathIC): (JSC::DFG::SpeculativeJIT::compileValueNegate): (JSC::DFG::SpeculativeJIT::compileValueMul): (JSC::DFG::SpeculativeJIT::speculateRealNumber): (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::unboxDouble): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitConvertValueToBoolean): (JSC::AssemblyHelpers::branchIfValue): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::unboxDoubleNonDestructive): (JSC::AssemblyHelpers::unboxDouble): * jit/JITAddGenerator.cpp: (JSC::JITAddGenerator::generateFastPath): * jit/JITAddGenerator.h: (JSC::JITAddGenerator::JITAddGenerator): * jit/JITArithmetic.cpp: (JSC::JIT::emitRightShiftFastPath): (JSC::JIT::emitMathICFast): * jit/JITDivGenerator.cpp: (JSC::JITDivGenerator::loadOperand): * jit/JITMulGenerator.cpp: (JSC::JITMulGenerator::generateInline): (JSC::JITMulGenerator::generateFastPath): * jit/JITMulGenerator.h: (JSC::JITMulGenerator::JITMulGenerator): * jit/JITPropertyAccess.cpp: (JSC::JIT::emitFloatTypedArrayPutByVal): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emitGenericContiguousPutByVal): * jit/JITRightShiftGenerator.cpp: (JSC::JITRightShiftGenerator::generateFastPath): * jit/JITRightShiftGenerator.h: (JSC::JITRightShiftGenerator::JITRightShiftGenerator): * jit/JITSubGenerator.cpp: (JSC::JITSubGenerator::generateInline): (JSC::JITSubGenerator::generateFastPath): * jit/JITSubGenerator.h: (JSC::JITSubGenerator::JITSubGenerator): 2021-08-20 Yusuke Suzuki [JSC] Remove unnecessary moves in Yarr's sub32 / add32 related code https://bugs.webkit.org/show_bug.cgi?id=228813 Reviewed by Mark Lam. This patch adds three operand sub32 to X64 masm so that we can use it in all masms. We use add32 and sub32 in YarrJIT to remove unnecessary mov instructions in ARM64. * assembler/MacroAssembler.h: (JSC::MacroAssembler::sub32): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::sub32): * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::sub32): * assembler/testmasm.cpp: (JSC::testSub32ArgImm): * yarr/YarrJIT.cpp: 2021-08-20 Yusuke Suzuki [JSC] Remove MacroAssemblerX86 https://bugs.webkit.org/show_bug.cgi?id=229331 Reviewed by Mark Lam. This patch removes MacroAssemblerX86, which allows simplifying some 32bit MacroAssembler code in a subsequent patch. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * assembler/MacroAssembler.h: * assembler/MacroAssemblerX86.h: Removed. 2021-08-20 Mikhail R. Gadelha Fix DFG compilation of StringCharAt in 32 bits jsc debug build https://bugs.webkit.org/show_bug.cgi?id=229293 Reviewed by Keith Miller. In SpeculativeJIT::compileGetByValOnString the format can be either DataFormatJS or DataFormatCell so assert either value when compiling it in 32 bits. It's the same assert already present in the DFG 64 bits counterpart * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): 2021-08-20 Mark Lam Add some offlineasm enhancements. https://bugs.webkit.org/show_bug.cgi?id=229332 rdar://82163923 Reviewed by Keith Miller. 1. Enhance "include" offlineasm Instruction to always attempt to include an asm file from /usr/local/include/WebKitAdditions/ first. If the specified file is not available there, then it will attempt to include the file from the same directory as the current source file (which in practice, means Source/JavaScriptCore/llint/). 2. Enhance "include" offlineasm Instruction to allow an optional file to be included if it exists. For example, the following offlineasm code: include? LowLevelInterpreterAdditions ... will attempt to include a file LowLevelInterpreterAdditions.asm. If the file does not exist, this will be a no-op. Note: the "?" after the "include" means the include is optional. 3. Enhanced "emit" offlineasm Instruction to be able to take more than one operand. "emit" used to just copy the string operand that follows into the generated LLIntAssembly.h. Now, "emit" can take multiple comma separated operands, and will concatenate all the operands. Additionally, "emit" can now take a LocalLabelReference as an operand. For example, this offline asm code: emit "b ", .done ... .done: ... will generate this inline asm code in LLIntAssembly.h: "b " LOCAL_LABEL_STRING(_offlineasm_someLabel_done) "\n" This makes it easier to emit branches to local labels. 4. Also fixed LLInt code alignment for ARM_THUMB2 and ARM64. Previously, it was aligned using ".align 4" which means aligned on a 4 instruction boundary. Note: the interpretation of .align varies for different target CPU architectures. Now, we do the alignment using ".balign 4" which means align on a 4 byte boundary. This is the intended alignment because ARM64 instruction size is 4 bytes, and ARM_THUMB2 instruction size is either 2 bytes or 4 bytes. Using .align before was potentially wasting some code space. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter.cpp: * offlineasm/ast.rb: * offlineasm/parser.rb: 2021-08-20 Mark Lam Reduce StructureID entropy bits to 5 to make room for more StructureIDs. https://bugs.webkit.org/show_bug.cgi?id=229326 rdar://60141624 Reviewed by Yusuke Suzuki. * runtime/StructureIDTable.h: 2021-08-19 Tim Nguyen Implement ::backdrop pseudo element https://bugs.webkit.org/show_bug.cgi?id=227801 Reviewed by Antti Koivisto. This adds UA styles, RenderTreeBuilder support and WebInspector support for ::backdrop. Some imported blink tests now start passing, some still need proper top layer support. * inspector/protocol/CSS.json: 2021-08-18 Yusuke Suzuki [JSC] Remove op_has_indexed_property related code https://bugs.webkit.org/show_bug.cgi?id=229271 Reviewed by Saam Barati. After our new for-in protocol, op_has_indexed_property is removed. As a result, we can remove many ByValInfo code that is used only for op_has_indexed_property. * jit/JIT.h: * jit/JITInlines.h: (JSC::JIT::emitLoadForArrayMode): Deleted. * jit/JITOpcodes.cpp: (JSC::JIT::privateCompileHasIndexedProperty): Deleted. * jit/JITOpcodes32_64.cpp: (JSC::JIT::privateCompileHasIndexedProperty): Deleted. * jit/JITOperations.cpp: * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emitDoubleLoad): Deleted. (JSC::JIT::emitContiguousLoad): Deleted. (JSC::JIT::emitArrayStorageLoad): Deleted. 2021-08-18 Michael Catanzaro REGRESSION(r280382): [GTK] 2.33.3 does not build with gtk-doc enabled, installs broken pkg-config files https://bugs.webkit.org/show_bug.cgi?id=229152 Reviewed by Philippe Normand. * PlatformGTK.cmake: * javascriptcoregtk.pc.in: 2021-08-17 Saam Barati Add an option for canonicalizePrePostIncrements https://bugs.webkit.org/show_bug.cgi?id=229211 Reviewed by Mark Lam. The current phase has bugs. Let's disable it for now until the bugs are fixed. See discussion about the bugs I spotted in: https://bugs.webkit.org/show_bug.cgi?id=228538 * b3/B3Generate.cpp: (JSC::B3::generateToAir): * b3/testb3_3.cpp: (addShrTests): * runtime/OptionsList.h: 2021-08-16 Mark Lam Ensure that unused LLInt opcodes are not inadvertently used. https://bugs.webkit.org/show_bug.cgi?id=229161 Reviewed by Robin Morisset. The op macro is used for generating LLInt asm code for some entry points to the LLInt, where we don't need 16 bits and 32 bit wide versions of the entry point. For example, we use it for llint_program_prologue. Note that llint_program_prologue is generated using: op(llint_program_prologue, macro () ... where op is: macro op(l, fn) commonOp(l, macro () end, macro (size) size(fn, macro() end, macro() end, macro(gen) gen() end) # ^ ^----- wide32 generator # `------------------ wide16 generator end) end Note that the generators for the wide16 and wide32 versions of the entry point currently emit nothing. As a result, if we ever have a bug that ends up dispatching to llint_program_prologue_wide16 or llint_program_prologue_wide32, we'll end up falling thru to llint_module_program_prologue, which just happens to be the entry point positioned after those labels. This patch adds breakpoints in those 2 unused generators so that we won't inadvertently execute code for something else. * llint/LowLevelInterpreter.asm: 2021-08-15 Yijia Huang [ARM64] Add Pre/Post-Indexed Address Mode to Air for ARM64 (Store Instruction) https://bugs.webkit.org/show_bug.cgi?id=228538 Reviewed by Filip Pizlo. The previous patch has introduced the pre/post-index address mode for Load instruction, which benefits loop program. Here, this patch adds the corresponding mode for Store instruction. Store Register (immediate) stores a word or a doubleword from a register to memory. The address that is used for the store is calculated from a base register and an immediate offset. ###################################### ## Pre-Index Address Mode For Store ## ###################################### STR Wt, [Xn, #imm]! In B3 Reduction Strength, since we have this reduction rule: Turns this: Store(value, Add(address, offset1), offset = offset2) Into this: Store(value, address, offset = offset1 + offset2) The equivalent pattern is: address = Add(base, offset) ... memory = Store(value, base, offset) Here, we only consider the pattern: address = Add(base, offset) memory = Store(value, base, offset) And, this patch directly treats it as the canonical form. Ideally, we should move memory to just after the address like what we did for PreIndex Load in the previous patch. But, we cannot provide a better way to do that since the value may be used between address and memory. To move value upward, we must move all descendants of the value along with it to prevent B3 IR index violations, which is risky and expensive. Next, lower to Air: Move %base, %address Move %value, (%address, prefix(offset)) ###################################### ## Post-Index Address Mode For Load ## ###################################### STR Wt, [Xn], #imm Then, the equivalent pattern is: memory = Store(value, base, 0) ... address = Add(base, offset) First, we convert it to the canonical form: newOffset = Constant newAddress = Add(base, offset) memory = Store(value, base, 0) // move the offset and address to just before the memory ... offset = Identity(newOffset) address = Identity(newAddress) Next, lower to Air: Move %base, %newAddress Move %value, (%newAddress, postfix(offset)) ############################################## ## Test for Pre/Post-Increment Address Mode ## ############################################## B3 IR: ------------------------------------------------------ Int64 b@0 = ArgumentReg(%x0) Int64 b@1 = ArgumentReg(%x1) Int64 b@2 = Const64(8) Int64 b@3 = Add(b@0, $8(b@2)) Void b@4 = Store(b@1, b@3, ControlDependent|Writes:Top) Void b@5 = Return(b@3, Terminal) ------------------------------------------------------ W/O Pre-Increment Address Mode: ------------------------------------------------------ Move %x0, %x2, b@0 Add64 $8, %x2, %x0, b@3 Move %x1, 8(%x2), b@4 Ret64 %x0, b@5 ------------------------------------------------------ W/ Pre-Increment Address Mode: ------------------------------------------------------ MoveWithIncrement64 %x1, (%x0,Pre($8)), b@4 Ret64 %x0, b@5 ------------------------------------------------------ B3 IR: ------------------------------------------------------ Int64 b@0 = ArgumentReg(%x0) Int64 b@1 = ArgumentReg(%x1) Void b@2 = Store(b@1, b@0, ControlDependent|Writes:Top) Int64 b@3 = Const64(8) Int64 b@4 = Add(b@0, $8(b@3)) Void b@5 = Return(b@4, Terminal) ------------------------------------------------------ W/O Post-Increment Address Mode: ------------------------------------------------------ Move %x1, (%x0), b@2 Add64 $8, %x0, %x0, b@4 Ret64 %x0, b@5 ------------------------------------------------------ W/ Post-Increment Address Mode: ------------------------------------------------------ MoveWithIncrement64 %x1, (%x0,Post($8)), b@2 Ret64 %x0, b@5 ------------------------------------------------------ * b3/B3CanonicalizePrePostIncrements.cpp: (JSC::B3::canonicalizePrePostIncrements): * b3/B3LowerToAir.cpp: * b3/testb3.h: * b3/testb3_3.cpp: (testStorePreIndex32): (testStorePreIndex64): (testStorePostIndex32): (testStorePostIndex64): (addShrTests): 2021-08-13 Keith Miller EnumeratorNextUpdatePropertyName always needs to be able to handle IndexedMode https://bugs.webkit.org/show_bug.cgi?id=229087 Reviewed by Filip Pizlo. Right now, this operation incorrectly assumes that EnumeratorNextUpdateIndexAndMode will guarantee the mode matches the seen mode set. But no speculation is guaranteed and adding such a guarantee would require adding checkpoints, which is likely not worth it. Instead, this patch just makes sure we always handle the allocation for IndexedMode. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-08-12 Mark Lam Refactor some ARM64EHash code. https://bugs.webkit.org/show_bug.cgi?id=229054 Reviewed by Keith Miller and Robin Morisset. This patch only refactors ARM64EHash code by moving some methods into the private section, and removing some unneeded static_casts. Verified with a diff of `otool -tv` dumps of the built JavaScriptCore binaries, that there are no diffs in the generated code from this change. * assembler/AssemblerBuffer.h: (JSC::ARM64EHash::ARM64EHash): (JSC::ARM64EHash::update): (JSC::ARM64EHash::makeDiversifier): (JSC::ARM64EHash::nextValue): (JSC::ARM64EHash::bitsForDiversifier): (JSC::ARM64EHash::currentHash): 2021-08-12 Saam Barati Update ARM64EHash https://bugs.webkit.org/show_bug.cgi?id=228962 Reviewed by Mark Lam. * assembler/AssemblerBuffer.h: (JSC::ARM64EHash::makeDiversifier): (JSC::ARM64EHash::nextValue): (JSC::ARM64EHash::bitsForDiversifier): (JSC::ARM64EHash::currentHash): (JSC::ARM64EHash::setUpdatedHash): (JSC::ARM64EHash::ARM64EHash): (JSC::ARM64EHash::update): (JSC::ARM64EHash::finalize): (JSC::AssemblerBuffer::AssemblerBuffer): (JSC::AssemblerBuffer::putIntegralUnchecked): (JSC::AssemblerBuffer::hash const): * assembler/LinkBuffer.cpp: (JSC::LinkBuffer::copyCompactAndLinkCode): 2021-08-11 Yusuke Suzuki WTFCrash in JSC::Lexer::append8 https://bugs.webkit.org/show_bug.cgi?id=228982 Reviewed by Mark Lam. sourceURL / sourceMapURL directive should not assume Latin1 characters. * parser/Lexer.cpp: (JSC::Lexer::parseCommentDirectiveValue): 2021-08-10 Keith Miller CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr https://bugs.webkit.org/show_bug.cgi?id=228931 Reviewed by Mark Lam. Right now current debugging code expects that the JS return PC on the stack is already unsigned. This is not true on arm64e. This patch now properly unsigns the return PC before passing it to the ReturnAddressPC constructor. * assembler/MacroAssemblerCodeRef.h: (JSC::ReturnAddressPtr::fromTaggedPC): * interpreter/AbstractPC.cpp: (JSC::AbstractPC::AbstractPC): * interpreter/AbstractPC.h: (JSC::AbstractPC::AbstractPC): (JSC::AbstractPC::jitReturnAddress const): * interpreter/CallFrame.h: (JSC::CallFrame::returnPC const): 2021-08-10 Kimmo Kinnunen Scripts/generate-derived-sources.sh: line 19: [: binary operator expected while building Source/WebKit https://bugs.webkit.org/show_bug.cgi?id=228908 Reviewed by Per Arne Vollan. * Scripts/generate-derived-sources.sh: Quote the use of CC so that future copy-paste does not make the same mistake as this bug. 2021-08-09 Yusuke Suzuki [JSC] super-Latin1 white space and line terminator after regular expression literal misinterpreted as flags https://bugs.webkit.org/show_bug.cgi?id=227944 Reviewed by Alexey Shvayka. There are non-Latin1 white-spaces and line-terminators, but Lexer::scanRegExp's code did not assume that. As a result, if there is a non-Latin1 white-spaces or line-terminators after RegExp, we raise SyntaxError while this is valid. This patch fixes that. * parser/Lexer.cpp: (JSC::Lexer::scanRegExp): 2021-08-09 Michael Catanzaro Fix yet another -Wreturn-type warning https://bugs.webkit.org/show_bug.cgi?id=228928 Unreviewed. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl): 2021-08-09 Yijia Huang [ARM64] Clean up and fix Pre/Post-Indexed Address Mode to Air for ARM64 (Load Instruction) https://bugs.webkit.org/show_bug.cgi?id=228890 Reviewed by Keith Miller. This patch cleans up and does minor fix to the previous patch (https://bugs.webkit.org/show_bug.cgi?id=228047). For the modifications in b3/B3Generate.cpp and b3/B3CanonicalizePrePostIncrements.cpp, we need to convert post-index candidates to the canonical form. So, the address value needs to be moved immediately before the load. This is subject to the dominance constraints that add must be controlled equivalent to the load. So, similarly, if we need to move the offset to just before the load, the dominance constraints must be satisfied. Since it is a constant value, a better approach is to add a new constant value before the memory value. Then, eliminate the dead code. There is a bug in b3/B3CanonicalizePrePostIncrements.cpp. The insertionSet.execute(BasicBlock) will reorder value indexes in the basic block. So, we should re-search for the value index in the block every time after the execution. In b3/B3LowerToAir.cpp, we need m_locked checks on address and base values. If they are already locked, there is no need to convert the Load instruction to the pre/post-increment form. * b3/B3CanonicalizePrePostIncrements.cpp: (JSC::B3::canonicalizePrePostIncrements): * b3/B3Generate.cpp: (JSC::B3::generateToAir): * b3/B3LowerToAir.cpp: * b3/air/AirArg.h: (JSC::B3::Air::Arg::isValidIncrementIndexForm): (JSC::B3::Air::Arg::isValidForm const): (JSC::B3::Air::Arg::isValidPreIndexForm): Deleted. (JSC::B3::Air::Arg::isValidPostIndexForm): Deleted. * b3/air/opcode_generator.rb: 2021-08-09 Keith Miller Revert bad assert about the number of upsilons going into a phi https://bugs.webkit.org/show_bug.cgi?id=228922 Reviewed by Yusuke Suzuki. This assert was invalid because we sometimes emit unreachable phis that don't have any incoming upsilons. Specifically for MultiGetByOffset. * ftl/FTLOutput.h: (JSC::FTL::Output::phi): 2021-08-09 Michael Catanzaro Adding missing REFERENCED_FROM_ASM annotations to facilitate LTO https://bugs.webkit.org/show_bug.cgi?id=228865 Reviewed by Yusuke Suzuki. When investigating why WebKitGTK fails to build with LTO (link-time optimization) enabled, one of the GCC developers noticed that we are missing __attribute__ (("used")) on several C++ functions declared in LLIntSlowPaths.h and WasmSlowPaths.h that are called only from asm. Without this attribute, GCC assumes the functions are unused and drops them, then linking fails because they really are used. * llint/LLIntSlowPaths.h: * wasm/WasmSlowPaths.h: 2021-08-07 Michael Catanzaro Fix ODR violations in JSC https://bugs.webkit.org/show_bug.cgi?id=228876 Reviewed by Yusuke Suzuki. When built with LTO enabled, GCC will warn about violations of C++'s one-definition rule. JSC currently has two violations. The first is JSC::SpeciesConstructResult, which has two different declarations, one in ArrayPrototype.cpp and the other in JSArrayBufferPrototype.cpp. I decided to change the version in ArrayPrototype.cpp to make the declarations match. The next problem is JSC::SignalContext. We have two different versions of this struct, one in VMTraps.cpp and the other in SigillCrashAnalyzer.cpp. In this case, I decided to change the one in VMTraps.cpp from JSC::SignalContext to JSC::VMTraps::SignalContext. * runtime/ArrayPrototype.cpp: * runtime/VMTraps.cpp: (JSC::VMTraps::tryInstallTrapBreakpoints): * runtime/VMTraps.h: 2021-08-07 Keith Miller for-in should only emit one loop in bytecode https://bugs.webkit.org/show_bug.cgi?id=227989 Reviewed by Yusuke Suzuki. This patch redesigns how we implement for-in loops. Before this patch we would emit three copies of the for-in loop body. One for the indexed properties, one for the named-own properties, and one for generic properties (anything else). This had a couple of problems. Firstly, it meant bytecode size grew exponentially to number of nested for-in loops. This in turn meant DFG/FTL compilation took much longer. Going off our experience with fast for-of, this patch turns for-in loops specializations into a "fused" opcode that internally switches on the enumeration mode it currently sees. For example, if we are enumerating an own-named property, the new enumerator_get_by_val bytecode will check the enumerator cell's cached structure matches the base's then load the property offset directly. There are four new opcodes this patch adds, which replace the various operations we had for the specialized loops previously. The new opcodes are EnumeratorGetByVal, EnumeratorInByVal, EnumeratorHasOwnProperty, and EnumeratorNext. The first three correspond to GetByVal, InByVal, and HasOwnProperty respectively. The EnumeratorNext opcode has three results in bytecode, the next enumeration value's mode, the index of the property name, and the property name string itself. When enumeration is done EnumeratorNext returns JS null as the property name string. Since the DFG doesn't support tuples yet this opcode is spilt into four new nodes. The first computes the updated index and mode for the next enumeration key, which is encoded into a single JS number. Then there are two nodes that extract the mode and index. Finally, the last new node produces the property name string or null based on the extracted mode and index. Since, in most benchmarks, any given enumeration opcode tends to profile exactly one enumeration mode. This patch focuses primarily on reimplementing all the optimizations we have for any one specific mode. This means there are still potential optimizations for the multi-mode flavors of each new opcode. The main optimizations implemented for each new opcode are: EnumeratorNext: 1) IndexedMode loops are loaded and checked for presence inline (DFG/FTL). 2) NamedMode is computed inline as long as the cached structure on the enumerator cell matches the base (Baseline+). This can only differ if there's a transition. 3) property names are extracted from the cached buffer inline (Baseline+). EnumeratorGetByVal: EnumeratorInByVal: EnumeratorHasOwnProperty: 1) IndexedMode has all the optimizations of a normal XByVal on indexed properties (DFG/FTL). 2) NamedMode will extract the value directly from the inline/out-of-line offset if the structure matches the enumerator's (Baseline+). There are also a few interesting changes worth mentioning here: 1) If a for-in loop would produce an empty enumerator we now always return the VMs empty enumerator. This has two benefits, most importantly, it distingishes between an unprofiled for-in loop and empty enumeration, which prevents OSR exit loops. Also, it means that the various Enumerator opcodes no longer need to handle undefined/null when `toObject`ing the base value. 2) The enumerator now contains a bit set of all the modes it will produce. This removes a few extra branches when speculating on the modes we will see in EnumeratorNext. 3) In the DFG, enumerator GetByVal relies on compileGetByVal to set the result it also passes a prefix callback which emits code after the various cases set up their operands but before code is emitting to help satisfy the branch over register allocation validation. Also, the array mode branch in compileGetByVal passes the data format that it would prefer, which for normal GetByVal is returned. For EnumeratorGetByVal, that preference is completely ignored and it always returns DataFormatJS. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::or8): * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::or8): * assembler/MacroAssemblerX86_64.h: (JSC::MacroAssemblerX86_64::rshift64): (JSC::MacroAssemblerX86_64::or8): Deleted. * builtins/BuiltinNames.h: * bytecode/BytecodeList.rb: * bytecode/BytecodeUseDef.cpp: (JSC::computeUsesForBytecodeIndexImpl): (JSC::computeDefsForBytecodeIndexImpl): * bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): * bytecode/LinkTimeConstant.h: * bytecode/Opcode.h: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::recordHasOwnPropertyInForInLoop): (JSC::BytecodeGenerator::emitInByVal): (JSC::BytecodeGenerator::emitGetByVal): (JSC::BytecodeGenerator::emitEnumeratorNext): (JSC::BytecodeGenerator::emitEnumeratorHasOwnProperty): (JSC::BytecodeGenerator::pushForInScope): (JSC::BytecodeGenerator::popForInScope): (JSC::rewriteOp): (JSC::ForInContext::finalize): (JSC::BytecodeGenerator::findForInContext): (JSC::BytecodeGenerator::recordHasOwnStructurePropertyInForInLoop): Deleted. (JSC::BytecodeGenerator::emitGetEnumerableLength): Deleted. (JSC::BytecodeGenerator::emitHasEnumerableIndexedProperty): Deleted. (JSC::BytecodeGenerator::emitHasEnumerableStructureProperty): Deleted. (JSC::BytecodeGenerator::emitHasEnumerableProperty): Deleted. (JSC::BytecodeGenerator::emitHasOwnStructureProperty): Deleted. (JSC::BytecodeGenerator::emitEnumeratorStructurePropertyName): Deleted. (JSC::BytecodeGenerator::emitEnumeratorGenericPropertyName): Deleted. (JSC::BytecodeGenerator::emitToIndexString): Deleted. (JSC::BytecodeGenerator::pushIndexedForInScope): Deleted. (JSC::BytecodeGenerator::popIndexedForInScope): Deleted. (JSC::BytecodeGenerator::pushStructureForInScope): Deleted. (JSC::BytecodeGenerator::popStructureForInScope): Deleted. (JSC::StructureForInContext::finalize): Deleted. (JSC::IndexedForInContext::finalize): Deleted. (JSC::BytecodeGenerator::findStructureForInContext): Deleted. * bytecompiler/BytecodeGenerator.h: (JSC::ForInContext::isValid const): (JSC::ForInContext::invalidate): (JSC::ForInContext::local const): (JSC::ForInContext::propertyName const): (JSC::ForInContext::propertyOffset const): (JSC::ForInContext::enumerator const): (JSC::ForInContext::mode const): (JSC::ForInContext::ForInContext): (JSC::ForInContext::bodyBytecodeStartOffset const): (JSC::ForInContext::type const): Deleted. (JSC::ForInContext::isIndexedForInContext const): Deleted. (JSC::ForInContext::isStructureForInContext const): Deleted. (JSC::ForInContext::asIndexedForInContext): Deleted. (JSC::ForInContext::asStructureForInContext): Deleted. (JSC::StructureForInContext::StructureForInContext): Deleted. (JSC::StructureForInContext::index const): Deleted. (JSC::StructureForInContext::property const): Deleted. (JSC::StructureForInContext::enumerator const): Deleted. (JSC::StructureForInContext::baseVariable const): Deleted. (JSC::StructureForInContext::addGetInst): Deleted. (JSC::StructureForInContext::addInInst): Deleted. (JSC::StructureForInContext::addHasOwnPropertyJump): Deleted. (JSC::IndexedForInContext::IndexedForInContext): Deleted. (JSC::IndexedForInContext::index const): Deleted. (JSC::IndexedForInContext::addGetInst): Deleted. * bytecompiler/NodesCodegen.cpp: (JSC::HasOwnPropertyFunctionCallDotNode::emitBytecode): (JSC::ForInNode::emitBytecode): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::isSaneChain const): * dfg/DFGBackwardsPropagationPhase.cpp: (JSC::DFG::BackwardsPropagationPhase::propagate): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGCFAPhase.cpp: (JSC::DFG::CFAPhase::injectOSR): * dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::setJSArraySaneChainIfPossible): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGIntegerRangeOptimizationPhase.cpp: * dfg/DFGMayExit.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasHeapPrediction): (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode): (JSC::DFG::Node::hasEnumeratorMetadata const): (JSC::DFG::Node::enumeratorMetadata): * dfg/DFGNodeType.h: * dfg/DFGOpInfo.h: (JSC::DFG::OpInfo::OpInfo): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary): (JSC::DFG::SpeculativeJIT::compileGetByValOnString): (JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString): (JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol): (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments): (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments): (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode): (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractIndex): (JSC::DFG::SpeculativeJIT::compileEnumeratorNextExtractMode): (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName): (JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal): (JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty): (JSC::DFG::SpeculativeJIT::compileEnumeratorInByVal): (JSC::DFG::SpeculativeJIT::compileEnumeratorHasOwnProperty): (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty): (JSC::DFG::SpeculativeJIT::compileGetEnumerableLength): Deleted. (JSC::DFG::SpeculativeJIT::compileHasEnumerableProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileToIndexString): Deleted. (JSC::DFG::SpeculativeJIT::compileHasEnumerableStructureProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileHasOwnStructurePropertyImpl): Deleted. (JSC::DFG::SpeculativeJIT::compileHasOwnStructureProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileInStructureProperty): Deleted. (JSC::DFG::SpeculativeJIT::compileGetEnumeratorPname): Deleted. (JSC::DFG::SpeculativeJIT::compileGetDirectPname): Deleted. * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::allocate): (JSC::DFG::JSValueOperand::regs): (JSC::DFG::JSValueOperand::gpr): (JSC::DFG::StorageOperand::StorageOperand): (JSC::DFG::StorageOperand::~StorageOperand): (JSC::DFG::StorageOperand::emplace): (JSC::DFG::JSValueRegsTemporary::operator bool): (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAtImpl): (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOutput.h: (JSC::FTL::Output::phi): * generator/DSL.rb: * interpreter/Register.h: * interpreter/RegisterInlines.h: (JSC::Register::operator=): * jit/AssemblyHelpers.h: * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): * jit/JIT.h: * jit/JITOpcodes.cpp: (JSC::JIT::privateCompileHasIndexedProperty): (JSC::JIT::emit_op_has_structure_propertyImpl): Deleted. (JSC::JIT::emit_op_has_enumerable_structure_property): Deleted. (JSC::JIT::emit_op_has_own_structure_property): Deleted. (JSC::JIT::emit_op_in_structure_property): Deleted. (JSC::JIT::emit_op_has_enumerable_indexed_property): Deleted. (JSC::JIT::emitSlow_op_has_enumerable_indexed_property): Deleted. (JSC::JIT::emit_op_get_direct_pname): Deleted. (JSC::JIT::emit_op_enumerator_structure_pname): Deleted. (JSC::JIT::emit_op_enumerator_generic_pname): Deleted. * jit/JITOpcodes32_64.cpp: (JSC::JIT::privateCompileHasIndexedProperty): (JSC::JIT::emit_op_has_structure_propertyImpl): Deleted. (JSC::JIT::emit_op_has_enumerable_structure_property): Deleted. (JSC::JIT::emit_op_has_own_structure_property): Deleted. (JSC::JIT::emit_op_in_structure_property): Deleted. (JSC::JIT::emit_op_has_enumerable_indexed_property): Deleted. (JSC::JIT::emitSlow_op_has_enumerable_indexed_property): Deleted. (JSC::JIT::emit_op_get_direct_pname): Deleted. (JSC::JIT::emit_op_enumerator_structure_pname): Deleted. (JSC::JIT::emit_op_enumerator_generic_pname): Deleted. * jit/JITPropertyAccess.cpp: (JSC::JIT::generateGetByValSlowCase): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emitSlow_op_enumerator_get_by_val): (JSC::JIT::emit_enumerator_has_propertyImpl): (JSC::JIT::emit_op_enumerator_in_by_val): (JSC::JIT::emit_op_enumerator_has_own_property): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_enumerator_next): (JSC::JIT::emit_op_enumerator_get_by_val): (JSC::JIT::emitSlow_op_enumerator_get_by_val): (JSC::JIT::emit_op_enumerator_in_by_val): (JSC::JIT::emit_op_enumerator_has_own_property): * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/CommonSlowPaths.h: * runtime/FileBasedFuzzerAgent.cpp: (JSC::FileBasedFuzzerAgent::getPredictionInternal): * runtime/FileBasedFuzzerAgentBase.cpp: (JSC::FileBasedFuzzerAgentBase::opcodeAliasForLookupKey): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator): (JSC::JSPropertyNameEnumerator::computeNext): * runtime/JSPropertyNameEnumerator.h: (JSC::propertyNameEnumerator): * runtime/PredictionFileCreatingFuzzerAgent.cpp: (JSC::PredictionFileCreatingFuzzerAgent::getPredictionInternal): 2021-08-06 Yusuke Suzuki Unreviewed, build fix on Debug build https://bugs.webkit.org/show_bug.cgi?id=228810 * yarr/YarrJIT.h: (JSC::Yarr::BoyerMooreBitmap::addCharacters): (JSC::Yarr::BoyerMooreBitmap::addRanges): 2021-08-06 Yusuke Suzuki [JSC] Yarr's character tracking for BoyerMoore search should be more precise https://bugs.webkit.org/show_bug.cgi?id=228810 Reviewed by Saam Barati. We should track up to 2 candidate characters without masking, so that we can search a character without masking. To track candidates, we introduce BoyerMooreCharacterCandidates. We also add support for m_table because m_table can be used for important CharacterClass like `\s`, and still that does not have many character candidates if the mode is Char8. To make `\s` work on Char8 case, we use Char8 / Char16 information to filter characters that never appears in BoyreMoore search bitmap construction. * yarr/YarrJIT.cpp: (JSC::Yarr::BoyerMooreInfo::BoyerMooreInfo): (JSC::Yarr::BoyerMooreInfo::set): (JSC::Yarr::BoyerMooreInfo::addCharacters): (JSC::Yarr::BoyerMooreInfo::addRanges): (JSC::Yarr::BoyerMooreInfo::create): (JSC::Yarr::BoyerMooreInfo::createCandidateBitmap const): * yarr/YarrJIT.h: (JSC::Yarr::BoyerMooreCharacterCandidates::isValid const): (JSC::Yarr::BoyerMooreCharacterCandidates::invalidate): (JSC::Yarr::BoyerMooreCharacterCandidates::isEmpty const): (JSC::Yarr::BoyerMooreCharacterCandidates::size const): (JSC::Yarr::BoyerMooreCharacterCandidates::at const): (JSC::Yarr::BoyerMooreCharacterCandidates::add): (JSC::Yarr::BoyerMooreCharacterCandidates::merge): (JSC::Yarr::BoyerMooreBitmap::characterCandidates const): (JSC::Yarr::BoyerMooreBitmap::add): (JSC::Yarr::BoyerMooreBitmap::addCharacters): (JSC::Yarr::BoyerMooreBitmap::addRanges): (JSC::Yarr::BoyerMooreBitmap::isMaskEffective const): Deleted. 2021-08-05 Mikhail R. Gadelha Assertion failure when checking array in DFG (32 bits) https://bugs.webkit.org/show_bug.cgi?id=228839 Reviewed by Yusuke Suzuki. Since empty values don't pass the cell check in 32 bits, we need to guard the SpecEmpty check to only happen in 64 bits archs * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): 2021-08-05 Robin Morisset REGRESSION (r280507): ASSERTION FAILED: !undominatedPhis.contains(value) in JSC::B3::(anonymous namespace)::Validater::validatePhisAreDominatedByUpsilons() https://bugs.webkit.org/show_bug.cgi?id=228838 Reviewed by Geoffrey Garen. When I added validation of the dominance of Phis by their Upsilons, I checked two things: - There is no path from the entry point to a Phi without going through a corresponding Upsilon (the actual dominance check) - There is no way to execute a Phi twice without going through a corresponding Upsilon in between The second property is not actually true in B3 IR, I had misunderstood that part of the meaning of Phis/Upsilons. So this patch just removes this second check. It has no security/stability/performance implication: this is validation code, which runs automatically in debug mode, but should not run at all on customer machines. * b3/B3Validate.cpp: 2021-08-05 Michael Catanzaro GCC 11 builds should use -Wno-array-bounds, -Wno-nonnull https://bugs.webkit.org/show_bug.cgi?id=228601 Reviewed by Carlos Garcia Campos. * b3/air/AirAllocateRegistersByGraphColoring.cpp: * jit/JITCall.cpp: (JSC::JIT::compileOpCall): 2021-08-05 Zan Dobersek Use reinterpret_cast_ptr in KeywordLookupGenerator, PropertyMapHashTable https://bugs.webkit.org/show_bug.cgi?id=228819 Reviewed by Adrian Perez de Castro. Switch to using reinterpret_cast_ptr in KeywordLookupGenerator (which generates the KeywordLookup.h header) and PropertyMapHashTable, reducing a bit the GCC warning spewage when compiling for targets benefitting from the reinterpret_cast_ptr workaround. * KeywordLookupGenerator.py: * runtime/PropertyMapHashTable.h: (JSC::PropertyTable::table): (JSC::PropertyTable::table const): 2021-08-04 Yijia Huang [ARM64] Fix Zoom black screen during video meeting on Safari https://bugs.webkit.org/show_bug.cgi?id=228776 Reviewed by Saam Barati. The problem (rdar://81434487) reports that Zoom turns to a black screen during the video meeting on Safari. The reproduction of this problem is verified and bisected to the previous patch (https://bugs.webkit.org/show_bug.cgi?id=228057). Previously, we introduce a pattern matching for instruction EON-with-shift on ARM64, where the pattern is d = n ^ ((m ShiftType amount) ^ -1). x = m ShiftType amount y = x ^ -1 z = n ^ y We check canBeInternal() on x but not on y based on the computing cost analysis in that patch, which is totally wrong. If the pattern matching is triggered, then the compiler would not emit the corresponding Air of x after lowering, leading to data corruption or system crash since y depends on x. In the real world example (Zoom video meeting), we find the B3 IR: ... Int32 b@528 = SShr(b@526, $31(b@527), Wasm: {opcode: I32ShrS, location: 0x26b}) Int32 b@529 = BitXor(b@528, $-1(b@144), Wasm: {opcode: I32Xor, location: 0x26e}) ... Int32 b@551 = BitXor(b@446, b@529, Wasm: {opcode: I32Xor, location: 0x28e}) ... After Lowering to Air: ... Not32 %fp, %x2, b@529 ... XorNotRightShift32 %tmp199, %tmp211, $31, %tmp209, b@551 ... Since the implementation of the previous patch does commitInternal() on b@528, the operand of b@529 turns to a frame pointer. To resolve this problem, we should either check canBeInternal() on both b@528 and b@529 or not at all. * b3/B3LowerToAir.cpp: 2021-08-04 Commit Queue Unreviewed, reverting r280609. https://bugs.webkit.org/show_bug.cgi?id=228791 Broke JSC tests on iOS. Reverted changeset: "[ARM64] Use link register instead of pinning a register for materializing big load constants" https://bugs.webkit.org/show_bug.cgi?id=228710 https://commits.webkit.org/r280609 2021-08-03 Yijia Huang [ARM64] Use link register instead of pinning a register for materializing big load constants https://bugs.webkit.org/show_bug.cgi?id=228710 Reviewed by Mark Lam. Previously, we pin a register as a temp for materializing a large constant that cannot fit in Load/Store imm form. This is not efficient since the register allocator has one less register to allocate from. To solve this problem, we should switch to using the link register as the temp on ARM64. * b3/B3Common.cpp: (JSC::B3::linkRegister): (JSC::B3::pinnedExtendedOffsetAddrRegister): Deleted. * b3/B3Common.h: * b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp: (JSC::B3::Air::callFrameAddr): * b3/air/AirCode.cpp: (JSC::B3::Air::Code::Code): * b3/air/AirLowerStackArgs.cpp: (JSC::B3::Air::lowerStackArgs): 2021-08-02 Yijia Huang Add a new pattern to instruction selector to utilize UMULL supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=228721 Reviewed by Saam Barati. Unsigned Multiply Long (UMULL) multiplies two 32-bit register values, and writes the result to the destination register. This instruction is an alias of the UMADDL instruction. umull xd wn wm The equivalent pattern is: d = ZExt32(n) * ZExt32(m) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = Trunc(@0) Int @2 = ArgumentReg(%x1) Int @3 = Trunc(@2) Int @4 = ZExt32(@1) Int @5 = ZExt32(@3) Int @6 = Mul(@4, @5) Void@7 = Return(@6, Terminal) // Old optimized AIR Move %x0, %x0, @4 Move %x1, %x1, @5 Mul %x0, %x1, %x0, @6 Ret %x0, @7 // New optimized AIR MultiplyZeroExtend %x0, %x1, %x0, @6 Ret %x0, @7 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::multiplyZeroExtend32): * assembler/testmasm.cpp: (JSC::testMultiplyZeroExtend32): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testMulArgs32SignExtend): (testMulArgs32ZeroExtend): * b3/testb3_3.cpp: (addArgTests): 2021-08-02 Yijia Huang Add new patterns to instruction selector to utilize AND/EOR/ORR-with-shift supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=228675 Reviewed by Saam Barati. Bitwise AND (shifted register) performs a bitwise AND of a register value and an optionally-shifted register value, and writes the result to the destination register. and wd wn wm ShiftType #amount The equivalent pattern is: n & (m ShiftType amount) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = Const32(63) Int @3 = Shl(@1, $63(@2)) Int @4 = BitAnd(@0, @3) Void@5 = Return(@4, Terminal) // Old optimized AIR Lshift %x1, $63, %x1, @3 And %x0, %x1, %x0, @4 Ret %x0, @5 // New optimized AIR AndLeftShift %x0, %x1, $63, %x0, @4 Ret %x0, @5 Bitwise Exclusive OR (shifted register) performs a bitwise Exclusive OR of a register value and an optionally-shifted register value, and writes the result to the destination register. eor wd wn wm ShiftType #amount The equivalent pattern is: n ^ (m ShiftType amount) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = Const32(63) Int @3 = Shl(@1, $63(@2)) Int @4 = BitXor(@0, @3) Void@5 = Return(@4, Terminal) // Old optimized AIR Lshift %x1, $63, %x1, @3 Xor %x0, %x1, %x0, @4 Ret %x0, @5 // New optimized AIR XorLeftShift %x0, %x1, $63, %x0, @4 Ret %x0, @5 Bitwise OR (shifted register) performs a bitwise (inclusive) OR of a register value and an optionally-shifted register value, and writes the result to the destination register. orr wd wn wm ShiftType #amount The equivalent pattern is: n | (m ShiftType amount) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = Const32(63) Int @3 = Shl(@1, $63(@2)) Int @4 = BitOr(@0, @3) Void@5 = Return(@4, Terminal) // Old optimized AIR Lshift %x1, $63, %x1, @3 Or %x0, %x1, %x0, @4 Ret %x0, @5 // New optimized AIR OrLeftShift %x0, %x1, $63, %x0, @4 Ret %x0, @5 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::andLeftShift32): (JSC::MacroAssemblerARM64::andRightShift32): (JSC::MacroAssemblerARM64::andUnsignedRightShift32): (JSC::MacroAssemblerARM64::andLeftShift64): (JSC::MacroAssemblerARM64::andRightShift64): (JSC::MacroAssemblerARM64::andUnsignedRightShift64): (JSC::MacroAssemblerARM64::xorLeftShift32): (JSC::MacroAssemblerARM64::xorRightShift32): (JSC::MacroAssemblerARM64::xorUnsignedRightShift32): (JSC::MacroAssemblerARM64::xorLeftShift64): (JSC::MacroAssemblerARM64::xorRightShift64): (JSC::MacroAssemblerARM64::xorUnsignedRightShift64): (JSC::MacroAssemblerARM64::orLeftShift32): (JSC::MacroAssemblerARM64::orRightShift32): (JSC::MacroAssemblerARM64::orUnsignedRightShift32): (JSC::MacroAssemblerARM64::orLeftShift64): (JSC::MacroAssemblerARM64::orRightShift64): (JSC::MacroAssemblerARM64::orUnsignedRightShift64): * assembler/testmasm.cpp: (JSC::testAndLeftShift32): (JSC::testAndRightShift32): (JSC::testAndUnsignedRightShift32): (JSC::testAndLeftShift64): (JSC::testAndRightShift64): (JSC::testAndUnsignedRightShift64): (JSC::testXorLeftShift32): (JSC::testXorRightShift32): (JSC::testXorUnsignedRightShift32): (JSC::testXorLeftShift64): (JSC::testXorRightShift64): (JSC::testXorUnsignedRightShift64): (JSC::testOrLeftShift32): (JSC::testOrRightShift32): (JSC::testOrUnsignedRightShift32): (JSC::testOrLeftShift64): (JSC::testOrRightShift64): (JSC::testOrUnsignedRightShift64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testAndLeftShift32): (testAndRightShift32): (testAndUnsignedRightShift32): (testAndLeftShift64): (testAndRightShift64): (testAndUnsignedRightShift64): (testXorLeftShift32): (testXorRightShift32): (testXorUnsignedRightShift32): (testXorLeftShift64): (testXorRightShift64): (testXorUnsignedRightShift64): (testOrLeftShift32): (testOrRightShift32): (testOrUnsignedRightShift32): (testOrLeftShift64): (testOrRightShift64): (testOrUnsignedRightShift64): (addBitTests): 2021-08-02 Yusuke Suzuki [JSC] Use loadPair / storePair in YarrJIT https://bugs.webkit.org/show_bug.cgi?id=228687 Reviewed by Mark Lam. Use loadPair / storePair if possible in YarrJIT. Currently, we are not deploying Spooler in YarrJIT, but we should do that in the future too. In this patch, we also add appropriate fallback code in loadPair / storePair: the offset of these functions are small enough so that we should consider overflowing case. If it overflows, we use two loads or stores. This patch also adds loadPair32 and storePair32 to all macro assembler so that we can call it without CPU(ARM64). Internally, two loads or stores are combined. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::loadPair32): (JSC::MacroAssemblerARM64::loadPair64): (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess): (JSC::MacroAssemblerARM64::storePair32): (JSC::MacroAssemblerARM64::storePair64): (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::loadPair32): (JSC::MacroAssemblerARMv7::storePair32): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::loadPair32): (JSC::MacroAssemblerMIPS::storePair32): * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::loadPair32): (JSC::MacroAssemblerX86Common::storePair32): * assembler/testmasm.cpp: (JSC::testLoadStorePair32): (JSC::testLoadStorePair64Int64): * yarr/YarrJIT.cpp: 2021-08-02 Yusuke Suzuki Unreviewed, fix accidental narrowing https://bugs.webkit.org/show_bug.cgi?id=228613 Note that this narrowing does not matter semantically since we mask this value with 0x7f. * yarr/YarrJIT.h: (JSC::Yarr::BoyerMooreBitmap::addCharacters): 2021-08-02 Yusuke Suzuki [JSC] Yarr BoyerMoore search should support character-class https://bugs.webkit.org/show_bug.cgi?id=228613 Reviewed by Saam Barati. This patch adds character-class support for BoyerMoore lookahead search in Yarr. Currently, we only support fixed-sized character-class. We can extend it for repeat cases in the future. To apply this character-class thing to jQuery's RegExp, we also allow non-fixed-sized disjunction. For example, /aaaa.*|bbbb/'s disjunction is not fixed-sized. But still we can use (aaaa|bbbb) prefix since this part is fixed-sized and we know minimum-size of this disjunction is 4. Plus, instead of giving up BoyerMoore search when we found non-supported terms, we shorten BoyerMoore search length not to include this term so that we can still have a chance to leverage BoyerMoore search. In the case of /aaaa|bbbb|ccc(d|e|f)/, we previously gave up since it finds `(d|e|f)`. But now, instead we shorten the length from 4 to 3, and construct search pattern with `aaa|bbb|ccc`. This patch improves jquery-todomvc-regexp by 20%. ToT Patched jquery-todomvc-regexp 545.3561+-0.6968 ^ 451.6117+-0.4613 ^ definitely 1.2076x faster This improves Speedometer2/jQuery-TodoMVC by 2%. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |123.470833 |123.550000 |1.000641 | 0.841600 | | VueJS-TodoMVC |26.883333 |26.950000 |1.002480 | 0.846732 | | EmberJS-TodoMVC |127.708333 |127.754167 |1.000359 | 0.934206 | | BackboneJS-TodoMVC |50.545833 |50.445833 |0.998022 | 0.679610 | | Preact-TodoMVC |20.879167 |20.791667 |0.995809 | 0.796541 | | AngularJS-TodoMVC |137.479167 |137.275000 |0.998515 | 0.729817 | | Vanilla-ES2015-TodoMVC |69.079167 |68.912500 |0.997587 | 0.524325 | | Inferno-TodoMVC |65.604167 |66.120833 |1.007876 | 0.145549 | | Flight-TodoMVC |77.029167 |76.708333 |0.995835 | 0.518562 | | Angular2-TypeScript-TodoMVC |40.516667 |40.812500 |1.007302 | 0.513386 | | VanillaJS-TodoMVC |54.762500 |54.895833 |1.002435 | 0.647381 | | jQuery-TodoMVC |255.950000 |250.425000 |0.978414 | 0.000000 (significant) | | EmberJS-Debug-TodoMVC |341.745833 |342.804167 |1.003097 | 0.219937 | | React-TodoMVC |88.854167 |88.700000 |0.998265 | 0.568405 | | React-Redux-TodoMVC |151.266667 |150.804167 |0.996942 | 0.256403 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |65.783333 |65.645833 |0.997910 | 0.437464 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 246.52898 b mean = 246.85128 pValue = 0.3927330278 (Bigger means are better.) 1.001 times better Results ARE NOT significant * yarr/YarrJIT.cpp: (JSC::Yarr::BoyerMooreInfo::shortenLength): (JSC::Yarr::BoyerMooreInfo::setAll): (JSC::Yarr::BoyerMooreInfo::addCharacters): (JSC::Yarr::BoyerMooreInfo::addRanges): * yarr/YarrJIT.h: (JSC::Yarr::BoyerMooreBitmap::add): (JSC::Yarr::BoyerMooreBitmap::addCharacters): (JSC::Yarr::BoyerMooreBitmap::addRanges): (JSC::Yarr::BoyerMooreBitmap::setAll): (JSC::Yarr::BoyerMooreBitmap::isAllSet const): 2021-08-02 Stephan Szabo [PlayStation] Make C files in testapi compile with a C standard rather than C++ one https://bugs.webkit.org/show_bug.cgi?id=228701 Reviewed by Ross Kirsling. * shell/PlatformPlayStation.cmake: Set standard for C files in testapi 2021-08-02 Yusuke Suzuki [JSC] Yarr should use Bitmap instead of ByteVector for BoyerMoore search https://bugs.webkit.org/show_bug.cgi?id=228676 Reviewed by Saam Barati. We observed that using Bitmap instead of ByteVector does not pose performance issue. It was neutral in jquery-todomvc-regexp.js. In that case, we should use Bitmap since it is 8x smaller. We also search reusable Bitmap from Vector since comparing 128bit Bitmap is super fast so we do not need to bother about linear search here (# of Bitmap is currently up to 4). To make code simplified, we add regT2 to ARMv7 and MIPS backend of YarrJIT. ToT Patched jquery-todomvc-regexp 555.9566+-0.8856 555.0737+-0.9717 * yarr/YarrJIT.cpp: (JSC::Yarr::BoyerMooreInfo::index const): Deleted. (JSC::Yarr::BoyerMooreInfo::setIndex): Deleted. * yarr/YarrJIT.h: (JSC::Yarr::YarrCodeBlock::set8BitCode): (JSC::Yarr::YarrCodeBlock::set16BitCode): (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreBitmap const): (JSC::Yarr::BoyerMooreByteVector::BoyerMooreByteVector): Deleted. (JSC::Yarr::YarrCodeBlock::tryReuseBoyerMooreByteVector const): Deleted. 2021-07-31 Yusuke Suzuki [JSC] Move JIT_UNICODE_EXPRESSIONS to ENABLE(YARR_JIT_UNICODE_EXPRESSIONS) in PlatformEnable.h https://bugs.webkit.org/show_bug.cgi?id=228669 Reviewed by Alexey Shvayka. Move JIT_UNICODE_EXPRESSIONS to PlatformEnable.h to align to the other YarrJIT flags. This makes it easy to read that this is enabled on ARM64 and X86_64. * yarr/YarrJIT.cpp: 2021-07-31 Yusuke Suzuki [JSC] Clean up Yarr by using `static constexpr` https://bugs.webkit.org/show_bug.cgi?id=228678 Reviewed by Alexey Shvayka. Modernize Yarr code by using static constexpr. * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32): * yarr/YarrCanonicalizeUCS2.cpp: * yarr/YarrCanonicalizeUCS2.js: (set characters.hex.set string_appeared_here): * yarr/YarrErrorCode.cpp: (JSC::Yarr::errorMessage): * yarr/YarrJIT.cpp: 2021-07-31 Joonghun Park Unreviewed. Remove the build warning below since r280493. warning: variable ‘block’ set but not used [-Wunused-but-set-variable] * b3/B3CanonicalizePrePostIncrements.cpp: (JSC::B3::canonicalizePrePostIncrements): 2021-07-30 Yusuke Suzuki [JSC] branchTest8 should not emit tst for Zero/NonZero cases https://bugs.webkit.org/show_bug.cgi?id=228674 Reviewed by Mark Lam. Previously, branchTest8(NonZero, BaseIndex) emits `tst` instruction unnecessarily. This is because the mask is truncated into 8bit, which makes branchTest32 (which is internally used in branchTest8) emits tst. We observed many unnecessary tst in YarrJIT. This patch removes this unnecessary truncation since Zero/NonZero does not care high bits of mask in branchTest8. This is ok because the ResultCondition version of mask8OnCondition() is always used to generate a mask that is only used against a value that is loaded with MacroAssemblerHelpers::load8OnCondition(). For Zero/NonZero conditions, load8OnCondition() will always zero fill the upper bytes. The 0 filled upper bytes will not affect the result of a branch on zero or branch on not zero. Before: 0x10a8068b0: ldrb w16, [x7, x6] 0x10a8068b4: tst w16, #0xff 0x10a8068b8: b.ne 0x10a8068cc After: 0x1070068b0: ldrb w16, [x7, x6] 0x1070068b4: cbnz w16, 0x1070068c8 * assembler/MacroAssemblerHelpers.h: (JSC::MacroAssemblerHelpers::mask8OnCondition): 2021-07-30 Robin Morisset Improve OSR entry into Wasm loops with arguments https://bugs.webkit.org/show_bug.cgi?id=228595 Reviewed by Yusuke Suzuki. This patch has two parts: - improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated) - improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks. Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s). * b3/B3Validate.cpp: * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addLoop): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): (JSC::Wasm::B3IRGenerator::addLoop): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::addLoop): 2021-07-30 Philip Chimento [JSC] Rename Temporal.now to Temporal.Now https://bugs.webkit.org/show_bug.cgi?id=228658 Reviewed by Yusuke Suzuki. See https://github.com/tc39/proposal-temporal/pull/1645. In the July 2021 meeting TC39 achieved consensus to rename Temporal.now to Temporal.Now since it is a namespace. * runtime/TemporalNow.cpp: Change Now[@@toStringTag] accordingly. * runtime/TemporalObject.cpp: Rename now property to Now. 2021-07-30 Tadeu Zagallo putInlineFastReplacingStaticPropertyIfNeeded should handle custom values https://bugs.webkit.org/show_bug.cgi?id=227963 Reviewed by Alexey Shvayka. Follow up after r280463: as it turns out, putInlineFastReplacingStaticPropertyIfNeeded also needs to handle custom values, similar to how definePropertyOnReceiverSlow was updated. This function will be called when the target property of the receiver is a custom value and isn't reified. The previous test case was expanded to test both the reified and non-reified cases. * runtime/JSObject.cpp: (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded): * tools/JSDollarVM.cpp: 2021-07-30 Yusuke Suzuki Unreviewed, fix wrong access width https://bugs.webkit.org/show_bug.cgi?id=228301 rdar://81341472 * yarr/YarrJIT.cpp: 2021-07-30 Yijia Huang Add Pre/Post-Indexed Address Mode to Air for ARM64 https://bugs.webkit.org/show_bug.cgi?id=228047 Reviewed by Phil Pizlo. Pre-indexed addressing means that the address is the sum of the value in the 64-bit base register and an offset, and the address is then written back to the base register. And post-indexed addressing means that the address is the value in the 64-bit base register, and the sum of the address and the offset is then written back to the base register. They are relatively common for loops to iterate over an array by increasing/decreasing a pointer into the array at each iteration. With such an addressing mode, the instruction selector can merge the increment and access the array. ##################################### ## Pre-Index Address Mode For Load ## ##################################### LDR Wt, [Xn, #imm]! In B3 Reduction Strength, since we have this reduction rule: Turn this: Load(Add(address, offset1), offset = offset2) Into this: Load(address, offset = offset1 + offset2) Then, the equivalent pattern is: address = Add(base, offset) ... memory = Load(base, offset) First, we convert it to the canonical form: address = Add(base, offset) newMemory = Load(base, offset) // move the memory to just after the address ... memory = Identity(newMemory) Next, lower to Air: Move %base, %address Move (%address, prefix(offset)), %newMemory ###################################### ## Post-Index Address Mode For Load ## ###################################### LDR Wt, [Xn], #imm Then, the equivalent pattern is: memory = Load(base, 0) ... address = Add(base, offset) First, we convert it to the canonical form: newOffset = Constant newAddress = Add(base, offset) memory = Load(base, 0) // move the offset and address to just before the memory ... offset = Identity(newOffset) address = Identity(newAddress) Next, lower to Air: Move %base, %newAddress Move (%newAddress, postfix(offset)), %memory ############################# ## Pattern Match Algorithm ## ############################# To detect the pattern for prefix/postfix increment address is tricky due to the structure in B3 IR. The algorithm used in this patch is to collect the first valid values (add/load), then search for any paired value (load/add) to match all of them. In worst case, the runtime complexity is O(n^2) when n is the number of all values. After collecting two sets of candidates, we match the prefix incremental address first since it seems more beneficial to the compiler (shown in the next section). And then, go for the postfix one. ############################################## ## Test for Pre/Post-Increment Address Mode ## ############################################## Given Loop with Pre-Increment: int64_t ldr_pre(int64_t *p) { int64_t res = 0; while (res < 10) res += *++p; return res; } B3 IR: ------------------------------------------------------ BB#0: ; frequency = 1.000000 Int64 b@0 = Const64(0) Int64 b@2 = ArgumentReg(%x0) Void b@20 = Upsilon($0(b@0), ^18, WritesLocalState) Void b@21 = Upsilon(b@2, ^19, WritesLocalState) Void b@4 = Jump(Terminal) Successors: #1 BB#1: ; frequency = 1.000000 Predecessors: #0, #2 Int64 b@18 = Phi(ReadsLocalState) Int64 b@19 = Phi(ReadsLocalState) Int64 b@7 = Const64(10) Int32 b@8 = AboveEqual(b@18, $10(b@7)) Void b@9 = Branch(b@8, Terminal) Successors: Then:#3, Else:#2 BB#2: ; frequency = 1.000000 Predecessors: #1 Int64 b@10 = Const64(8) Int64 b@11 = Add(b@19, $8(b@10)) Int64 b@13 = Load(b@11, ControlDependent|Reads:Top) Int64 b@14 = Add(b@18, b@13) Void b@22 = Upsilon(b@14, ^18, WritesLocalState) Void b@23 = Upsilon(b@11, ^19, WritesLocalState) Void b@16 = Jump(Terminal) Successors: #1 BB#3: ; frequency = 1.000000 Predecessors: #1 Void b@17 = Return(b@18, Terminal) Variables: Int64 var0 Int64 var1 ------------------------------------------------------ W/O Pre-Increment Address Mode: ------------------------------------------------------ ... BB#2: ; frequency = 1.000000 Predecessors: #1 Move $8, %x3, $8(b@12) Add64 $8, %x0, %x1, b@11 Move (%x0,%x3), %x0, b@13 Add64 %x0, %x2, %x2, b@14 Move %x1, %x0, b@23 Jump b@16 Successors: #1 ... ------------------------------------------------------ W/ Pre-Increment Address Mode: ------------------------------------------------------ ... BB#2: ; frequency = 1.000000 Predecessors: #1 MoveWithIncrement64 (%x0,Pre($8)), %x2, b@13 Add64 %x2, %x1, %x1, b@14 Jump b@16 Successors: #1 ... ------------------------------------------------------ Given Loop with Post-Increment: int64_t ldr_pre(int64_t *p) { int64_t res = 0; while (res < 10) res += *p++; return res; } B3 IR: ------------------------------------------------------ BB#0: ; frequency = 1.000000 Int64 b@0 = Const64(0) Int64 b@2 = ArgumentReg(%x0) Void b@20 = Upsilon($0(b@0), ^18, WritesLocalState) Void b@21 = Upsilon(b@2, ^19, WritesLocalState) Void b@4 = Jump(Terminal) Successors: #1 BB#1: ; frequency = 1.000000 Predecessors: #0, #2 Int64 b@18 = Phi(ReadsLocalState) Int64 b@19 = Phi(ReadsLocalState) Int64 b@7 = Const64(10) Int32 b@8 = AboveEqual(b@18, $10(b@7)) Void b@9 = Branch(b@8, Terminal) Successors: Then:#3, Else:#2 BB#2: ; frequency = 1.000000 Predecessors: #1 Int64 b@10 = Load(b@19, ControlDependent|Reads:Top) Int64 b@11 = Add(b@18, b@10) Int64 b@12 = Const64(8) Int64 b@13 = Add(b@19, $8(b@12)) Void b@22 = Upsilon(b@11, ^18, WritesLocalState) Void b@23 = Upsilon(b@13, ^19, WritesLocalState) Void b@16 = Jump(Terminal) Successors: #1 BB#3: ; frequency = 1.000000 Predecessors: #1 Void b@17 = Return(b@18, Terminal) Variables: Int64 var0 Int64 var1 ------------------------------------------------------ W/O Post-Increment Address Mode: ------------------------------------------------------ ... BB#2: ; frequency = 1.000000 Predecessors: #1 Move (%x0), %x2, b@10 Add64 %x2, %x1, %x1, b@11 Add64 $8, %x0, %x0, b@13 Jump b@16 Successors: #1 ... ------------------------------------------------------ W/ Post-Increment Address Mode: ------------------------------------------------------ ... BB#2: ; frequency = 1.000000 Predecessors: #1 MoveWithIncrement64 (%x0,Post($8)), %x2, b@10 Add64 %x2, %x1, %x1, b@11 Jump b@16 Successors: #1 ... ------------------------------------------------------ * Sources.txt: * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::PreIndexAddress::PreIndexAddress): (JSC::AbstractMacroAssembler::PostIndexAddress::PostIndexAddress): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::load64): (JSC::MacroAssemblerARM64::load32): (JSC::MacroAssemblerARM64::store64): (JSC::MacroAssemblerARM64::store32): * assembler/testmasm.cpp: (JSC::testStorePrePostIndex32): (JSC::testStorePrePostIndex64): (JSC::testLoadPrePostIndex32): (JSC::testLoadPrePostIndex64): * b3/B3CanonicalizePrePostIncrements.cpp: Added. (JSC::B3::canonicalizePrePostIncrements): * b3/B3CanonicalizePrePostIncrements.h: Copied from Source/JavaScriptCore/b3/B3ValueKeyInlines.h. * b3/B3Generate.cpp: (JSC::B3::generateToAir): * b3/B3LowerToAir.cpp: * b3/B3ValueKey.h: * b3/B3ValueKeyInlines.h: (JSC::B3::ValueKey::ValueKey): * b3/air/AirArg.cpp: (JSC::B3::Air::Arg::jsHash const): (JSC::B3::Air::Arg::dump const): (WTF::printInternal): * b3/air/AirArg.h: (JSC::B3::Air::Arg::preIndex): (JSC::B3::Air::Arg::postIndex): (JSC::B3::Air::Arg::isPreIndex const): (JSC::B3::Air::Arg::isPostIndex const): (JSC::B3::Air::Arg::isMemory const): (JSC::B3::Air::Arg::base const): (JSC::B3::Air::Arg::offset const): (JSC::B3::Air::Arg::isGP const): (JSC::B3::Air::Arg::isFP const): (JSC::B3::Air::Arg::isValidPreIndexForm): (JSC::B3::Air::Arg::isValidPostIndexForm): (JSC::B3::Air::Arg::isValidForm const): (JSC::B3::Air::Arg::forEachTmpFast): (JSC::B3::Air::Arg::forEachTmp): (JSC::B3::Air::Arg::asPreIndexAddress const): (JSC::B3::Air::Arg::asPostIndexAddress const): * b3/air/AirOpcode.opcodes: * b3/air/opcode_generator.rb: * b3/testb3.h: * b3/testb3_3.cpp: (testLoadPreIndex32): (testLoadPreIndex64): (testLoadPostIndex32): (testLoadPostIndex64): (addShrTests): * jit/ExecutableAllocator.cpp: (JSC::jitWriteThunkGenerator): 2021-07-30 Alexey Shvayka REGRESSION (r280460): 42 JSC test failures on Debug arm64 with ASSERTION FAILED: !m_needExceptionCheck https://bugs.webkit.org/show_bug.cgi?id=228652 Unreviewed unchecked exception fix. Release scope before calling RegExpGlobalData::getBackref(). * runtime/RegExpConstructor.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): 2021-07-30 Yusuke Suzuki [JSC] Use UCPURegister argument to remove zero extension in JIT code https://bugs.webkit.org/show_bug.cgi?id=228625 Reviewed by Robin Morisset. Yarr JIT code emits zeroExtend32ToWord for some arguments, but this is not necessary if argument is defined as UCPURegister. In that case, caller guarantees that top 32bits are cleared. * yarr/YarrJIT.cpp: * yarr/YarrJIT.h: 2021-07-29 Myles C. Maxfield Stop building WebGPU and the WHLSL compiler to decrease binary size https://bugs.webkit.org/show_bug.cgi?id=228179 Reviewed by Dean Jackson, Robin Morisset, and Devin Rousso. This patch deletes the existing implementation just to reduce binary size in releases of WebKit which don't enable WebGPU by default. It doesn't represent a change in direction or policy or anything regarding WebGPU. It's a (somewhat temporary) pragmatic change. Our current implementation of WebGPU: 1. Is off by default on all platforms 2. Is extremely outdated 3. Has no notion of the GPU Process, and therefore needs to be redesigned and largely rewritten 4. Only implements a fraction of what is in the spec Removing the code from the tree doesn't delete it from existence; it's still in source control. The benefit of reducing binary size seems to outweigh having this code in the tree. * inspector/protocol/Canvas.json: * inspector/scripts/codegen/generator.py: 2021-07-29 Carlos Alberto Lopez Perez [WPE][GTK] build broken with python2 after r280382 https://bugs.webkit.org/show_bug.cgi?id=228629 Reviewed by Philippe Normand. Call {PYTHON_EXECUTABLE} instead of python3. * PlatformGTK.cmake: 2021-07-29 Tadeu Zagallo definePropertyOnReceiver should check if receiver canPerformFastPutInline https://bugs.webkit.org/show_bug.cgi?id=227963 Reviewed by Alexey Shvayka. definePropertyOnReceiver has a fast path if the slot is not opaque and the receiver doesn't have a custom defineOwnProperty implementation, in which case it calls putInlineFast (and transitively putDirectInternal). The issue is that putDirectInternal does not handle customValues correctly: it just overwrites the property without changing the attributes. To fix that, we should first check if the property might be a custom value, and if that's the case we now call `definePropertyOnReceiverSlow`, which has been updated to handle custom values correctly. I also added assertions to putInlineFastReplacingStaticPropertyIfNeeded and putDirectInternal to make sure we don't accidentally overwrite custom values in the future. * runtime/JSObject.cpp: (JSC::definePropertyOnReceiverSlow): (JSC::JSObject::definePropertyOnReceiver): (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded): * runtime/JSObjectInlines.h: (JSC::JSObject::putDirectInternal): 2021-07-29 Yusuke Suzuki and Alexey Shvayka [JSC] Legacy RegExp fields should be accessors https://bugs.webkit.org/show_bug.cgi?id=220233 Reviewed by Tadeu Zagallo. This patch implements a part of Legacy RegExp features proposal [1], replacing custom values with custom accessors that require |this| value to be RegExp constructor of the same realm. Apart from fixing property descriptors, this change brings legacy RegExpConstructor fields in compliance with invariants of internal methods [2] (described in #151348), aligning JSC with V8 and SpiderMonkey. It doesn't, however, implement [[LegacyFeaturesEnabled]] and RegExp.prototype.compile changes. [1]: https://github.com/tc39/proposal-regexp-legacy-features [2]: https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * runtime/RegExpConstructor.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_CUSTOM_SETTER): (JSC::regExpConstructorDollarImpl): Deleted. * tools/JSDollarVM.cpp: 2021-07-29 Myles C. Maxfield Add WebGPU to webkit.org/status https://bugs.webkit.org/show_bug.cgi?id=228623 Reviewed by Robin Morisset. * features.json: 2021-07-28 Yusuke Suzuki [JSC] Yarr should perform BoyerMoore search https://bugs.webkit.org/show_bug.cgi?id=228301 Reviewed by Saam Barati. This patch emits skipping fast-path at the beginning of body alternatives with a large stride. So we can quickly discard unrelated characters and attempt to find possibly related sequence in the long sequence. The method is derived from V8's implementation (with some extensions). If we have a searching pattern /abcdef/, then we can check the 6th character against a set of {a, b, c, d, e, f}. If it does not match, we can shift 6 characters. We use this strategy since this way can be extended easily to support disjunction, character-class, and ignore-cases. For example, in the case of /(?:abc|def)/, we can check 3rd character against {a, b, c, d, e, f} and shift 3 characters if it does not match. Then, the best way to perform the above shifting is that finding the longest character sequence which does not have many candidates. In the case of /[a-z]aaaaaaa[a-z]/, we can extract "aaaaaaa" sequence and check 8th character against {a}. If it does not match, then we can shift 7 characters (length of "aaaaaaa"). This shifting is better than using "[a-z]aaaaaaa[a-z]" sequence and {a-z} set since {a-z} set will almost always match. We first collect possible characters for each character position. Then, apply heuristics to extract good character sequence from that and construct fast searching with long stride. Microbenchmark which performs RegExp ops in Speedometer2/jQuery-TodoMVC shows 25% improvement. ToT Patched jquery-todomvc-regexp 723.9739+-1.3997 ^ 579.1698+-1.2505 ^ definitely 1.2500x faster This improves Speedometer2/jQuery-TodoMVC by 3%. ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |123.365625 |123.456250 |1.000735 | 0.804077 | | VueJS-TodoMVC |26.912500 |26.925000 |1.000464 | 0.969603 | | EmberJS-TodoMVC |127.540625 |127.562500 |1.000172 | 0.960474 | | BackboneJS-TodoMVC |50.606250 |50.518750 |0.998271 | 0.670313 | | Preact-TodoMVC |21.018750 |20.850000 |0.991971 | 0.563818 | | AngularJS-TodoMVC |136.943750 |137.271875 |1.002396 | 0.531513 | | Vanilla-ES2015-TodoMVC |68.521875 |68.593750 |1.001049 | 0.701376 | | Inferno-TodoMVC |65.559375 |65.803125 |1.003718 | 0.414418 | | Flight-TodoMVC |77.284375 |76.715625 |0.992641 | 0.219870 | | Angular2-TypeScript-TodoMVC |40.725000 |40.318750 |0.990025 | 0.281212 | | VanillaJS-TodoMVC |55.209375 |54.715625 |0.991057 | 0.056921 | | jQuery-TodoMVC |266.396875 |258.471875 |0.970251 | 0.000000 (significant) | | EmberJS-Debug-TodoMVC |341.550000 |341.856250 |1.000897 | 0.618140 | | React-TodoMVC |88.731250 |88.871875 |1.001585 | 0.512407 | | React-Redux-TodoMVC |150.340625 |150.065625 |0.998171 | 0.412940 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |65.390625 |65.362500 |0.999570 | 0.834760 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 245.96997 b mean = 246.86366 pValue = 0.0061448402 (Bigger means are better.) 1.004 times better Results ARE significant * runtime/OptionsList.h: * yarr/YarrJIT.cpp: (JSC::Yarr::BoyerMooreInfo::BoyerMooreInfo): (JSC::Yarr::BoyerMooreInfo::length const): (JSC::Yarr::BoyerMooreInfo::set): (JSC::Yarr::BoyerMooreInfo::index const): (JSC::Yarr::BoyerMooreInfo::setIndex): (JSC::Yarr::BoyerMooreInfo::create): (JSC::Yarr::BoyerMooreInfo::findBestCharacterSequence const): (JSC::Yarr::BoyerMooreInfo::findWorthwhileCharacterSequenceForLookahead const): (JSC::Yarr::BoyerMooreInfo::createCandidateBitmap const): * yarr/YarrJIT.h: (JSC::Yarr::BoyerMooreBitmap::count const): (JSC::Yarr::BoyerMooreBitmap::map const): (JSC::Yarr::BoyerMooreBitmap::isMaskEffective const): (JSC::Yarr::BoyerMooreBitmap::add): (JSC::Yarr::BoyerMooreByteVector::BoyerMooreByteVector): (JSC::Yarr::YarrCodeBlock::set8BitCode): (JSC::Yarr::YarrCodeBlock::set16BitCode): (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly): (JSC::Yarr::YarrCodeBlock::clear): (JSC::Yarr::YarrCodeBlock::findSameVector const): 2021-07-28 Yusuke Suzuki [JSC] load/store with BaseIndex is inefficient in ARM64 https://bugs.webkit.org/show_bug.cgi?id=228543 Reviewed by Mark Lam. While we are frequently using load + BaseIndex (with offset) in RegExp code, we emit 3 instructions in ARM64. This can be represented in 2 instructions. This patch adds that path to make generated code tight in ARM64 RegExp. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::load64): (JSC::MacroAssemblerARM64::load32): (JSC::MacroAssemblerARM64::load16): (JSC::MacroAssemblerARM64::load16SignedExtendTo32): (JSC::MacroAssemblerARM64::load8): (JSC::MacroAssemblerARM64::load8SignedExtendTo32): (JSC::MacroAssemblerARM64::store64): (JSC::MacroAssemblerARM64::store32): (JSC::MacroAssemblerARM64::store16): (JSC::MacroAssemblerARM64::store8): (JSC::MacroAssemblerARM64::loadDouble): (JSC::MacroAssemblerARM64::loadFloat): (JSC::MacroAssemblerARM64::storeDouble): (JSC::MacroAssemblerARM64::storeFloat): (JSC::MacroAssemblerARM64::tryFoldBaseAndOffsetPart): * assembler/testmasm.cpp: (JSC::testLoadBaseIndex): (JSC::testStoreBaseIndex): 2021-07-28 Philippe Normand [WPE][GTK] SVN_REVISION drifting away if bots don't re-run cmake https://bugs.webkit.org/show_bug.cgi?id=228290 Reviewed by Michael Catanzaro. * PlatformGTK.cmake: Expand ${BUILD_REVISION} with apply-build-revision-to-files.py for non-tarball builds, or let CMake do it for tarball builds. * javascriptcoregtk.pc.in: Switch revision var to ${} format, so that we can choose to either let CMake expand it or do it ourselves. 2021-07-27 Patrick Angle Web Inspector: [Cocoa] "RemoteInspector XPC connection to relay failed." messages are confusing in StdErr https://bugs.webkit.org/show_bug.cgi?id=228303 Reviewed by Darin Adler. Remove overly verbose and confusing `WTFLogAlways` messages added in r278413, which can confuse applications listening to stderr of a process using JavaScriptCore. * inspector/remote/cocoa/RemoteInspectorCocoa.mm: (Inspector::RemoteInspector::xpcConnectionFailed): 2021-07-27 Alexey Shvayka ProxyObject callees should be skipped during Function.prototype.caller resolution https://bugs.webkit.org/show_bug.cgi?id=228341 Reviewed by Yusuke Suzuki. Just like a bound function, a Proxy with nullish "apply" handler merely forwards [[Call]] to its target [1], without pushing onto the execution context stack. This fact is also noted in Function.prototype.{caller,arguments} reflection proposal [2]. This patch aligns JSC with V8 and SpiderMonkey if Proxy's "apply" handler is userland or nullish. However, since JSC implements proper tail calls, `Function.prototype.caller` result is divergent from other engines if the handler is `Reflect.apply`, which performs a tail call that gets optimized away [2] (unless called by another Proxy). [1]: https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-call-thisargument-argumentslist (step 8) [2]: https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (see notes) * runtime/FunctionPrototype.cpp: (JSC::RetrieveCallerFunctionFunctor::operator() const): 2021-07-26 Yusuke Suzuki Add Temporal to features.json https://bugs.webkit.org/show_bug.cgi?id=228292 Reviewed by Myles C. Maxfield. * features.json: 2021-07-25 Alexey Shvayka Partly implement Function.prototype.{caller,arguments} reflection proposal https://bugs.webkit.org/show_bug.cgi?id=158116 Reviewed by Yusuke Suzuki. To ensure web-compatibility, only the safe subset of Function.prototype.{caller,arguments} reflection proposal [1] is implemented, which is currently shipped in SpiderMonkey. Complete list of differences from the proposed spec: 1. Cross-realm receiver function is allowed instead of throwing a TypeError. Throwing is likely safe to ship, but #225997 needs to be fixed first for custom properties to receive correct global object. 2. Cross-realm caller function is returned instead of `null`. Hiding cross-realm caller may break things: we currently have a test for the opposite behavior. 3. Defines "caller" and "arguments" setters that throw for disallowed receivers, instead failing silently in sloppy mode. This is actually more restrictive than the spec, which is preferable, and aligns with V8 and SM. Most importantly, this patch removes own "caller" and "arguments" properties from sloppy mode ES5 functions. They were non-configurable, making it harder to use their holder as a [[ProxyTarget]]. They were also non-writable, with a constantly changing [[Value]], which violated the invariants of internal methods [2]. As a result, JSFunction methods are greatly simplified, especially defineOwnProperty() and getOwnSpecialPropertyNames(). The latter is now 2.1x faster according to the provided microbenchmark. Also, removes double "prototype" lookup from [[Get]], which is a 10% progression. [1]: https://github.com/claudepache/es-legacy-function-reflection [2]: https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods * runtime/ClonedArguments.cpp: (JSC::ClonedArguments::getOwnPropertySlot): (JSC::ClonedArguments::materializeSpecials): * runtime/FunctionExecutable.h: * runtime/FunctionPrototype.cpp: (JSC::FunctionPrototype::addFunctionProperties): (JSC::isAllowedReceiverFunctionForCallerAndArguments): (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor): (JSC::RetrieveArgumentsFunctor::result const): (JSC::RetrieveArgumentsFunctor::operator() const): (JSC::retrieveArguments): (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor): (JSC::RetrieveCallerFunctionFunctor::result const): (JSC::RetrieveCallerFunctionFunctor::operator() const): (JSC::retrieveCallerFunction): (JSC::JSC_DEFINE_CUSTOM_SETTER): (JSC::FunctionPrototype::initRestrictedProperties): Deleted. * runtime/FunctionPrototype.h: * runtime/JSFunction.cpp: (JSC::JSFunction::getOwnPropertySlot): (JSC::JSFunction::getOwnSpecialPropertyNames): (JSC::JSFunction::put): (JSC::JSFunction::deleteProperty): (JSC::JSFunction::defineOwnProperty): (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor): Deleted. (JSC::RetrieveArgumentsFunctor::result const): Deleted. (JSC::RetrieveArgumentsFunctor::operator() const): Deleted. (JSC::retrieveArguments): Deleted. (JSC::JSC_DEFINE_CUSTOM_GETTER): Deleted. (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor): Deleted. (JSC::RetrieveCallerFunctionFunctor::result const): Deleted. (JSC::RetrieveCallerFunctionFunctor::operator() const): Deleted. (JSC::retrieveCallerFunction): Deleted. * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildrenImpl): * runtime/JSGlobalObject.h: Remove unused m_throwTypeErrorGetterSetter and make [[ThrowTypeError]] lazily-created. * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/JSGlobalObjectFunctions.h: * runtime/JSObject.cpp: (JSC::JSObject::putDirectCustomGetterSetterWithoutTransition): * runtime/JSObject.h: 2021-07-24 Yusuke Suzuki [JSC] Change most of enum in Yarr to enum-class https://bugs.webkit.org/show_bug.cgi?id=228264 Reviewed by Mark Lam. This patch simply changes most of enum to enum-class in Yarr. We also remove YarrJIT YarrGenerator's template parameter since it is not worth doubling code. We can just hold Yarr::JITCompileMode as m_compileMode. * runtime/RegExp.cpp: (JSC::RegExp::compile): (JSC::RegExp::matchConcurrently): (JSC::RegExp::compileMatchOnly): * runtime/RegExp.h: * runtime/RegExpInlines.h: (JSC::RegExp::hasCodeFor): (JSC::RegExp::compileIfNecessary): (JSC::RegExp::matchInline): (JSC::RegExp::hasMatchOnlyCodeFor): (JSC::RegExp::compileIfNecessaryMatchOnly): * yarr/Yarr.h: (): Deleted. * yarr/YarrInterpreter.cpp: (JSC::Yarr::Interpreter::backtrackPatternCharacter): (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter): (JSC::Yarr::Interpreter::matchCharacterClass): (JSC::Yarr::Interpreter::backtrackCharacterClass): (JSC::Yarr::Interpreter::matchBackReference): (JSC::Yarr::Interpreter::backtrackBackReference): (JSC::Yarr::Interpreter::parenthesesDoBacktrack): (JSC::Yarr::Interpreter::matchParenthesesOnceBegin): (JSC::Yarr::Interpreter::matchParenthesesOnceEnd): (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin): (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd): (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin): (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd): (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin): (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin): (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd): (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin): (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd): (JSC::Yarr::Interpreter::matchParentheses): (JSC::Yarr::Interpreter::backtrackParentheses): (JSC::Yarr::Interpreter::matchDisjunction): (JSC::Yarr::Interpreter::matchNonZeroDisjunction): (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin): (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin): (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin): (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin): (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd): (JSC::Yarr::ByteCompiler::closeAlternative): (JSC::Yarr::ByteCompiler::closeBodyAlternative): (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd): (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd): (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd): (JSC::Yarr::ByteCompiler::emitDisjunction): (JSC::Yarr::ByteCompiler::dumpDisjunction): * yarr/YarrInterpreter.h: (JSC::Yarr::ByteTerm::ByteTerm): (JSC::Yarr::ByteTerm::BOL): (JSC::Yarr::ByteTerm::CheckInput): (JSC::Yarr::ByteTerm::UncheckInput): (JSC::Yarr::ByteTerm::EOL): (JSC::Yarr::ByteTerm::WordBoundary): (JSC::Yarr::ByteTerm::BackReference): (JSC::Yarr::ByteTerm::BodyAlternativeBegin): (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction): (JSC::Yarr::ByteTerm::BodyAlternativeEnd): (JSC::Yarr::ByteTerm::AlternativeBegin): (JSC::Yarr::ByteTerm::AlternativeDisjunction): (JSC::Yarr::ByteTerm::AlternativeEnd): (JSC::Yarr::ByteTerm::SubpatternBegin): (JSC::Yarr::ByteTerm::SubpatternEnd): (JSC::Yarr::ByteTerm::DotStarEnclosure): * yarr/YarrJIT.cpp: (JSC::Yarr::jitCompile): * yarr/YarrJIT.h: * yarr/YarrParser.h: (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate): (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter): (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass): (JSC::Yarr::Parser::CharacterClassParserDelegate::end): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin): (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin): (JSC::Yarr::YarrPatternConstructor::atomBackReference): (JSC::Yarr::YarrPatternConstructor::copyTerm): (JSC::Yarr::YarrPatternConstructor::quantifyAtom): (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses): (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms): (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions): (JSC::Yarr::PatternTerm::dumpQuantifier): (JSC::Yarr::PatternTerm::dump): * yarr/YarrPattern.h: (JSC::Yarr::PatternTerm::PatternTerm): (JSC::Yarr::PatternTerm::ForwardReference): (JSC::Yarr::PatternTerm::BOL): (JSC::Yarr::PatternTerm::EOL): (JSC::Yarr::PatternTerm::WordBoundary): (JSC::Yarr::PatternTerm::isFixedWidthCharacterClass const): (JSC::Yarr::PatternTerm::containsAnyCaptures): (JSC::Yarr::PatternTerm::quantify): 2021-07-23 Alexey Shvayka [WebIDL] Properly validate and merge descriptors in [Replaceable] setter https://bugs.webkit.org/show_bug.cgi?id=227662 Reviewed by Sam Weinig. Extracts createDataProperty() method to keep WebIDL code generator as simple as possible, and also to emphasize a subtle difference between { [[Value]]: X } and { [[Value]]: X, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true }. * runtime/JSONObject.cpp: (JSC::Walker::walk): * runtime/JSObject.cpp: (JSC::definePropertyOnReceiverSlow): * runtime/JSObject.h: * runtime/JSObjectInlines.h: (JSC::JSObject::createDataProperty): * runtime/Lookup.h: (JSC::replaceStaticPropertySlot): Deleted. 2021-07-23 Alexey Shvayka [JSC] Call custom accessors / values with their holder's global object https://bugs.webkit.org/show_bug.cgi?id=225997 Reviewed by Yusuke Suzuki. Just like JS built-ins, getter / setter functions of WebIDL attributes are created in realm of their holder interface [1][2], which is their _current_ realm for throwing an error [3]. With this patch, custom properties get correct global object instead of lexical, including when inline cached, aligning them with functions and regular accessors. The latter allowed switching JS built-ins to CustomAccessor (e.g. Symbol#description), which is slightly more efficient to call from C++, doesn't need reification on first access, and has nicer signature. Also, renames WASM accessors to drop "func" and removes unused function length parameter. [1]: https://heycam.github.io/webidl/#dfn-attribute-getter (step 2) [2]: https://heycam.github.io/webidl/#dfn-attribute-setter (step 5) [3]: https://heycam.github.io/webidl/#ecmascript-throw * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * create_hash_table: * interpreter/CallFrame.cpp: (JSC::CallFrame::globalObjectOfClosestCodeBlock): * interpreter/CallFrame.h: * runtime/IntlCollatorPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/IntlDateTimeFormatPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/IntlLocalePrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/IntlNumberFormatPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/JSDataViewPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * runtime/JSObject.cpp: (JSC::JSObject::putInlineSlow): * runtime/PropertySlot.cpp: (JSC::PropertySlot::customGetter const): * runtime/PropertySlot.h: (JSC::PropertySlot::getValue const): * runtime/SymbolPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * tools/JSDollarVM.cpp: * wasm/js/WebAssemblyInstancePrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): (JSC::JSC_DEFINE_HOST_FUNCTION): Deleted. * wasm/js/WebAssemblyMemoryPrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): * wasm/js/WebAssemblyTablePrototype.cpp: (JSC::JSC_DEFINE_CUSTOM_GETTER): 2021-07-22 Saam Barati AirStackSlot's uint16_t byte size is too small https://bugs.webkit.org/show_bug.cgi?id=228193 Reviewed by Mark Lam. * b3/B3Procedure.cpp: (JSC::B3::Procedure::addStackSlot): * b3/B3Procedure.h: * b3/air/AirCode.cpp: (JSC::B3::Air::Code::addStackSlot): * b3/air/AirCode.h: * b3/air/AirStackSlot.cpp: (JSC::B3::Air::StackSlot::StackSlot): * b3/air/AirStackSlot.h: (JSC::B3::Air::StackSlot::ensureSize): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::lower): * ftl/FTLOutput.cpp: (JSC::FTL::Output::lockedStackSlot): * ftl/FTLOutput.h: 2021-07-22 Saam Barati Fix uses of Dependency::fence with respect to the compiler outsmarting us https://bugs.webkit.org/show_bug.cgi?id=227757 Reviewed by Robin Morisset. We were running into issues on arm64 with respect to the memory model ordering of loads, and how the compiler optimized code around Dependency::fence. The issue manifested as calls to isMarked incorrectly returning true. To see the issue, let's consider a program like this: a = load(p1) b = load(p2) if (a != b) return; d = Dependency::fence(b) At the point of defining the dependency, the compiler has proven a == b. So, instead of building the dependency on the register used for b, we end up using the register for a. So the actual compiled code ends up with a dependency on load(p1), not load(p2). To fix this, we end up adding a new API, Dependency::loadEndFence(pointer, result), which is defined as: template static Dependency loadAndFence(T* pointer, T& output) { T value = *opaque(pointer); Dependency dependency = Dependency::fence(value); output = opaque(value); return dependency; } The reason for this is that it split "b" in the above program into two values, and the "b" the program compares against is not known to the compiler to be the same value that we build a dependency on. * heap/MarkedBlock.h: (JSC::MarkedBlock::aboutToMark): (JSC::MarkedBlock::isMarked): * runtime/JSObject.cpp: (JSC::JSObject::visitButterflyImpl): * runtime/JSObject.h: (JSC::JSObject::fencedButterfly): * runtime/SparseArrayValueMap.cpp: (JSC::SparseArrayEntry::getConcurrently): (JSC::SparseArrayEntry::getConcurrently const): Deleted. * runtime/SparseArrayValueMap.h: * runtime/Structure.h: (JSC::Structure::fencedIndexingMode): * runtime/StructureIDBlob.h: (JSC::StructureIDBlob::fencedIndexingModeIncludingHistory): 2021-07-22 Keith Miller useProfiler option should automatically disable concurrent JIT https://bugs.webkit.org/show_bug.cgi?id=228152 Reviewed by Saam Barati. The bytecode profiler is not thread safe so we should have recomputeDependentOptions() disable concurrent JIT. Also, fix the jsc CLI to set the useProfiler option rather than have its own state. Note, we call Options::setOption() rather than setting the Options::useProfiler() option directly as setOption calls recomputeDependentOptions() for us. * jsc.cpp: (CommandLine::parseArguments): (runJSC): * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): (JSC::Options::ensureOptionsAreCoherent): 2021-07-21 Yijia Huang Fix type check error in testb3 https://bugs.webkit.org/show_bug.cgi?id=228166 Reviewed by Saam Barati. * b3/testb3_2.cpp: (testXorNotWithLeftShift32): (testXorNotWithRightShift32): (testXorNotWithUnsignedRightShift32): 2021-07-21 Keith Miller speculateNeitherDoubleNorStringNorHeapBigInt should only have a single JSType branch https://bugs.webkit.org/show_bug.cgi?id=228146 Reviewed by Robin Morisset. Since StringType and HeapBigIntType are adjacent JSTypes we can do an integer range check rather than two separate JSType checks. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): 2021-07-20 Yijia Huang Add ARM64 EON opcode and select it in AIR https://bugs.webkit.org/show_bug.cgi?id=228057 Reviewed by Saam Barati. EON Rd Rn Rm #amount Bitwise Exclusive OR NOT (shifted register) performs a bitwise Exclusive OR NOT of a register value Rn and an optionally-shifted register value Rm, and writes the result to the destination register. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. The equivalent pattern of EON Rd Rn Rm is d = n ^ (m ^ -1) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = -1 Int @3 = BitXor(@1, @2) Int @4 = BitXor(@0, b@3) Void@5 = Return(@4, Terminal) // Old optimized AIR Not %x1, %x1, @3 Xor %x0, %x1, %x0, @4 Ret %x0, @5 // New optimized AIR XorNot %x0, %x1, %x0, @4 Ret %x0, @5 The equivalent pattern of EON-with-shift is d = n ^ ((m ShiftType amount) ^ -1) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = amount Int @3 = -1 Int @4 = Shl(@1, @2) Int @5 = BitXor(@4, @3) Int @6 = BitXor(@0, @5) Void b@7 = Return(b@6, Terminal) // Old optimized AIR Lshift %x1, amount, %x1, @4 Not %x1, %x1, @5 Xor %x0, %x1, %x0, @6 Ret %x0, @7 // New optimized AIR XorNotLeftShift %x0, %x1, $63, %x0, @6 Ret %x0, @7 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::xorNot32): (JSC::MacroAssemblerARM64::xorNot64): (JSC::MacroAssemblerARM64::xorNotLeftShift32): (JSC::MacroAssemblerARM64::xorNotRightShift32): (JSC::MacroAssemblerARM64::xorNotUnsignedRightShift32): (JSC::MacroAssemblerARM64::xorNotLeftShift64): (JSC::MacroAssemblerARM64::xorNotRightShift64): (JSC::MacroAssemblerARM64::xorNotUnsignedRightShift64): * assembler/testmasm.cpp: (JSC::testXorNot32): (JSC::testXorNot64): (JSC::testXorNotWithLeftShift32): (JSC::testXorNotWithRightShift32): (JSC::testXorNotWithUnsignedRightShift32): (JSC::testXorNotWithLeftShift64): (JSC::testXorNotWithRightShift64): (JSC::testXorNotWithUnsignedRightShift64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testXorNot32): (testXorNot64): (testXorNotWithLeftShift32): (testXorNotWithRightShift32): (testXorNotWithUnsignedRightShift32): (testXorNotWithLeftShift64): (testXorNotWithRightShift64): (testXorNotWithUnsignedRightShift64): (addBitTests): 2021-07-20 Yusuke Suzuki [JSC] invalidParameterInstanceofSourceAppender should care direct call of Symbol.hasInstance https://bugs.webkit.org/show_bug.cgi?id=228075 rdar://80762879 Reviewed by Frédéric Wang. invalidParameterInstanceofSourceAppender can be invoked without `instanceof` expression since we can call `[Symbol.hasInstance]` function directly, but the implementation did not assume that. This patch fixes it to handle this direct call. * runtime/ExceptionHelpers.cpp: (JSC::invalidParameterInstanceofSourceAppender): 2021-07-19 Yusuke Suzuki [JSC] StructureStubInfo's m_identifier should follow to the same protocol of inlineAccessBaseStructure https://bugs.webkit.org/show_bug.cgi?id=228092 Reviewed by Saam Barati. In r279813, we fixed a race condition related to inlineAccessBaseStructure: while we clear inlineAccessBaseStructure, we still run code relying on this field's value until stub version of the code is generated. As a result, we run the code which relies on the cells that are already collected. And we have the same problem with m_identifier field too. This patch makes m_identifier follow to the same protocol of inlineAccessBaseStructure so that we fix this race issue too: both fields will be alive until we switch to the code that are not relying on these fields. We also make inlineAccessBaseStructure to m_inlineAccessBaseStructure to easily find that this is member field. And we also use setWithoutWriteBarrier for m_inlineAccessBaseStructure since we emit codeBlock->vm().heap.writeBarrier(codeBlock) immediately after that. * bytecode/AccessCase.cpp: (JSC::AccessCase::fromStructureStubInfo): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/PutByIdStatus.cpp: (JSC::PutByIdStatus::computeForStubInfo): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initArrayLength): (JSC::StructureStubInfo::initStringLength): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitAggregateImpl): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): (JSC::StructureStubInfo::setCacheType): Deleted. * bytecode/StructureStubInfo.h: 2021-07-19 Mark Lam DFG's parseIntResult() should check for negative zero. https://bugs.webkit.org/show_bug.cgi?id=228068 rdar://80788603 Reviewed by Yusuke Suzuki. We have to check for negative zero explicitly because C++ evaluates 0.0 == -0.0 as true. * dfg/DFGOperations.cpp: (JSC::DFG::parseIntResult): 2021-07-19 Yusuke Suzuki [JSC] InByStatus / InByVariant should visit CacheableIdentifier https://bugs.webkit.org/show_bug.cgi?id=228088 rdar://80794604 Reviewed by Mark Lam. After r278445, InByVariant holds CacheableIdentifier. And this can have String/Symbol cells if this variant is generated by in_by_val. In that case, we must visit this cell as GetByStatus / GetByVariant are doing. * bytecode/InByStatus.cpp: (JSC::InByStatus::visitAggregateImpl): * bytecode/InByStatus.h: * bytecode/InByVariant.cpp: (JSC::InByVariant::visitAggregateImpl): * bytecode/InByVariant.h: * bytecode/RecordedStatuses.cpp: (JSC::RecordedStatuses::visitAggregateImpl): 2021-07-16 Yijia Huang Add ExtendType to Air::Arg Index to fully utilize address computation in memory instruction for ARM64 https://bugs.webkit.org/show_bug.cgi?id=227970 Reviewed by Saam Barati. The pattern recognition of address computation in the instructions, e.g., Load Resistor (LDR), Store Register (STR), etc., can benefit the instruction selector. Then, the Air operand BaseIndex containing base, index, and scale is introduced to Air opcode. However, the option of index address is not fully leveraged in the previous implementation. To fill that gap, this patch adds a new member, MacroAssembler::Extend, to the current design of BaseIndex to trigger zero/sign extension on the Index address. And this is enabled for Store/Load with valid index address and shift amount. Maybe, the ideal approach is to introduce a decorator (Index@EXT) to the Air operand to provide an extension opportunity for the specific form of the Air opcode. Load Register (LDR) calculates an address from a base register value and an offset register value, loads a word from memory, and writes it to a register. The offset register value can optionally be shifted and extended. Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = Z/SExt32(Trunc(ArgumentReg(%x1))) Int @2 = scale Int @3 = Shl(@1, @2) Int @4 = Add(@0, @3) Int @5 = Load(@4, ControlDependent|Reads:Top) Void@6 = Return(@5, Terminal) // Old optimized AIR Move %x1, %x1, @1 Move (%x0,%x1,2^scale), %x0, @5 Ret %x0, @6 // New optimized AIR Move (%x0,%x1,2^scale), %x0, @5 Ret %x0, @6 Store Register (STR) calculates an address from a base register value and an offset register value, and stores a 32-bit word or a 64-bit doubleword to the calculated address, from a register. Given B3 IR: Int @0 = value Int @1 = ArgumentReg(%x0) Int @2 = Z/SExt32(Trunc(ArgumentReg(%x1)) Int @3 = scale Int @4 = Shl(@2, @3) Int @5 = Add(@1, @4) Void@6 = Store(@0, @5, ControlDependent|Writes:Top) Void@7 = Return(@0, Terminal) // Old optimized AIR Move32 %x1, %x1, @2 Store32 %xzr, (%x0,%x1,2^scale), @6 Move $0, %x0, @7 Ret32 %x0, @7 // New optimized AIR Store32 %xzr, (%x0,%x1,2^scale), @6 Move $0, %x0, @7 Ret32 %x0, @7 * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::BaseIndex::BaseIndex): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::indexExtendType): (JSC::MacroAssemblerARM64::load64): (JSC::MacroAssemblerARM64::load32): (JSC::MacroAssemblerARM64::load16): (JSC::MacroAssemblerARM64::load16SignedExtendTo32): (JSC::MacroAssemblerARM64::load8): (JSC::MacroAssemblerARM64::load8SignedExtendTo32): (JSC::MacroAssemblerARM64::store64): (JSC::MacroAssemblerARM64::store32): (JSC::MacroAssemblerARM64::store16): (JSC::MacroAssemblerARM64::store8): (JSC::MacroAssemblerARM64::loadDouble): (JSC::MacroAssemblerARM64::loadFloat): (JSC::MacroAssemblerARM64::storeDouble): (JSC::MacroAssemblerARM64::storeFloat): * b3/B3LowerToAir.cpp: * b3/air/AirArg.h: (JSC::B3::Air::Arg::index): (JSC::B3::Air::Arg::asBaseIndex const): * b3/testb3.h: * b3/testb3_2.cpp: (testLoadZeroExtendIndexAddress): (testLoadSignExtendIndexAddress): (testStoreZeroExtendIndexAddress): (testStoreSignExtendIndexAddress): (addBitTests): 2021-07-16 Saam Barati Grab the lock in FTL::Thunks::keyForSlowPathCallThunk https://bugs.webkit.org/show_bug.cgi?id=227988 Reviewed by Mark Lam. Both FTL::Thunks::keyForSlowPathCallThunk and FTL::Thunks::getSlowPathCallThunk both touch the thunks hash map. In r278030, when I added the lock, I grabbed it in getSlowPathCallThunk, but forgot to also grab it in keyForSlowPathCallThunk. * ftl/FTLThunks.h: (JSC::FTL::Thunks::keyForSlowPathCallThunk): 2021-07-16 Commit Queue Unreviewed, reverting r279916. https://bugs.webkit.org/show_bug.cgi?id=228037 some of tests are timing out Reverted changeset: "Convert small JIT pool tests into executable fuzzing" https://bugs.webkit.org/show_bug.cgi?id=226279 https://commits.webkit.org/r279916 2021-07-16 Yusuke Suzuki [JSC] RegExp::dumpToStream must not ref Strings since it is called concurrently https://bugs.webkit.org/show_bug.cgi?id=228031 rdar://80686425 Reviewed by Mark Lam. RegExp::dumpToStream's escapedPattern can return m_pattern. In that case, it is refed in the concurrent thread. This is wrong since StringImpl must not be ref-ed concurrently. This patch just revert this function to the old behavior. * runtime/RegExp.cpp: (JSC::RegExp::dumpToStream): 2021-07-15 Keith Miller Alias JSC graph dumping options https://bugs.webkit.org/show_bug.cgi?id=228015 Reviewed by Yusuke Suzuki. My brain seems to associate the phases with the tier we are compiling in rather than the type of graph we are processing. At this point it's probably easier to just add an alias rather than convince me otherwise. * runtime/OptionsList.h: 2021-07-15 Yusuke Suzuki [JSC] SamplingProfiler should recognize RegExp execution https://bugs.webkit.org/show_bug.cgi?id=201702 Reviewed by Saam Barati. This patch extends SamplingProfiler to recognize RegExp execution. We record executing RegExp in VM via MatchingContextHolder so that SamplingProfiler can detect it. We use MatchingContextHolder even if the RegExp is interpreter mode so that we can still catch non-JIT RegExp in SamplingProfiler. The example output is the following. Sampling rate: 1000.000000 microseconds. Total samples: 1830 Top functions as 466 'Exec#:4' 225 '/(^|[^\\])\"\\\/Qngr\((-?[0-9]+)\)\\\/\"/g#:-1' 173 'runBlock1#:4' 88 '/NQ_VQ/g#:-1' 83 '/d2/g#:-1' 78 '/d1/g#:-1' 70 '/\s?;\s?/#:-1' 68 'replace#:3' 50 '/(((\w+):\/\/)([^\/:]*)(:(\d+))?)?([^#?]*)(\?([^#]*))?(#(.*))?/#:-1' 49 'runBlock0#:4' 46 '#:-1' 24 '/^\s*|\s*$/g#:-1' Sampling rate: 1000.000000 microseconds. Total samples: 1830 Tier breakdown: ----------------------------------- LLInt: 13 (0.710383%) Baseline: 54 (2.950820%) DFG: 187 (10.218579%) FTL: 612 (33.442623%) js builtin: 73 (3.989071%) Wasm: 0 (0.000000%) Host: 0 (0.000000%) RegExp: 907 (49.562842%) C/C++: 0 (0.000000%) Unknown Executable: 57 (3.114754%) Hottest bytecodes as 378 'Exec#:FTL:bc#27' 225 '/(^|[^\\])\"\\\/Qngr\((-?[0-9]+)\)\\\/\"/g#:RegExp:' 88 '/NQ_VQ/g#:RegExp:' 83 '/d2/g#:RegExp:' 78 '/d1/g#:RegExp:' 70 '/\s?;\s?/#:RegExp:' 62 'replace#:FTL:bc#63' 53 'Exec#:DFG:bc#27' 50 '/(((\w+):\/\/)([^\/:]*)(:(\d+))?)?([^#?]*)(\?([^#]*))?(#(.*))?/#:RegExp:' 46 '#:None:' 42 'runBlock1#:FTL:bc#1795' 29 'runBlock1#:FTL:bc#1849' 29 'runBlock1#:FTL:bc#1741' 24 '/^\s*|\s*$/g#:RegExp:' 17 'runBlock1#:DFG:bc#1741' 17 'runBlock1#:DFG:bc#1795' 16 '/\b\w+\b/g#:RegExp:' 14 '/TNQP=([^;]*)/i#:RegExp:' 13 '/%\w?$/#:RegExp:' 12 '/^ba/#:RegExp:' 11 '/^\s*(\S*(\s+\S+)*)\s*$/#:RegExp:' 10 'runBlock0#:FTL:bc#400' 10 'runBlock1#:DFG:bc#1849' 10 'Exec#:DFG:bc#16' 9 '/(?:ZFVR.(\d+\.\d+))|(?:(?:Sversbk|TenaCnenqvfb|Vprjrnfry).(\d+\.\d+))|(?:Bcren.(\d+\.\d+))|(?:NccyrJroXvg.(\d+(?:\.\d+)?))/#:RegExp:' 8 '/##yv18##/gi#:RegExp:' 8 '/([a-zA-Z]|\s)+/#:RegExp:' 7 '/JroXvg\/(\S+)/#:RegExp:' 7 'runBlock0#:FTL:bc#2671' 7 '/^([#.]?)((?:[\w\u0128-\uffff*_-]|\\.)*)/#:RegExp:' 6 '/##oe##/gi#:RegExp:' 6 'runBlock1#:FTL:bc#124' 6 '/[+, ]/#:RegExp:' 6 'runBlock1#:FTL:bc#1903' 6 'replace#:DFG:bc#63' 5 'runBlock0#:FTL:bc#3378' 5 '/'/g#:RegExp:' 5 '/##yv20##/gi#:RegExp:' 4 '/\?[\w\W]*(sevraqvq|punaaryvq|tebhcvq)=([^\&\?#]*)/i#:RegExp:' 4 'load#:None:' * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * runtime/RegExp.cpp: (JSC::RegExp::matchCompareWithInterpreter): (JSC::RegExp::dumpToStream): (JSC::appendLineTerminatorEscape): (JSC::appendLineTerminatorEscape): (JSC::escapePattern): (JSC::RegExp::escapedPattern const): Moved from RegExpPrototype.cpp to implement RegExp::toSourceString and RegExp::escapedPattern. (JSC::RegExp::toSourceString const): (JSC::regexpToSourceString): Deleted. * runtime/RegExp.h: * runtime/RegExpInlines.h: (JSC::RegExp::matchInline): * runtime/RegExpPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::appendLineTerminatorEscape): Deleted. (JSC::appendLineTerminatorEscape): Deleted. (JSC::regExpProtoGetterSourceInternal): Deleted. * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::takeSample): (JSC::SamplingProfiler::processUnverifiedStackTraces): (JSC::SamplingProfiler::StackFrame::nameFromCallee): (JSC::SamplingProfiler::StackFrame::displayName): (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests): (JSC::SamplingProfiler::StackFrame::functionStartLine): (JSC::SamplingProfiler::StackFrame::functionStartColumn): (JSC::SamplingProfiler::StackFrame::sourceID): (JSC::SamplingProfiler::StackFrame::url): (JSC::SamplingProfiler::reportTopBytecodes): (WTF::printInternal): * runtime/SamplingProfiler.h: * runtime/VM.h: * yarr/YarrJIT.cpp: (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): Deleted. (JSC::Yarr::MatchingContextHolder::~MatchingContextHolder): Deleted. * yarr/YarrJIT.h: (JSC::Yarr::MatchingContextHolder::offsetOfStackLimit): Deleted. (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBuffer): Deleted. (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBufferSize): Deleted. * yarr/YarrMatchingContextHolder.h: Added. (JSC::Yarr::MatchingContextHolder::offsetOfStackLimit): (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBuffer): (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBufferSize): (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): (JSC::Yarr::MatchingContextHolder::~MatchingContextHolder): 2021-07-15 Yusuke Suzuki [JSC] Harden defaultTimeZone retrieval https://bugs.webkit.org/show_bug.cgi?id=227996 rdar://80540300 Reviewed by Mark Lam. We received the report that "UTC" can appear in Intl.DateTimeFormat's default timezone. While we cannot reproduce it, this patch attempts to avoid using TimeZone from UCalendar so that the code gets the same to the old defaultTimeZone implementation. * runtime/JSDateMath.cpp: (JSC::DateCache::defaultTimeZone): (JSC::DateCache::timeZoneCacheSlow): 2021-07-15 Mark Lam JITWorklist::waitUntilAllPlansForVMAreReady() should also be notified when plans are cancelled. https://bugs.webkit.org/show_bug.cgi?id=228003 rdar://78314543 Reviewed by Yusuke Suzuki. Previously, it only gets notified when plans are done compiling. As a result, if JITWorklist::waitUntilAllPlansForVMAreReady() found non-ready plans and started waiting, and those plans were canceled, then JITWorklist::waitUntilAllPlansForVMAreReady() can hang indefinitely. This patch renames JITWorklist::::m_planCompiled to m_planCompiledOrCancelled, and notifies it also when plans are cancelled. * jit/JITWorklist.cpp: (JSC::JITWorklist::waitUntilAllPlansForVMAreReady): (JSC::JITWorklist::removeMatchingPlansForVM): * jit/JITWorklist.h: * jit/JITWorklistThread.cpp: (JSC::JITWorklistThread::work): 2021-07-15 Yusuke Suzuki [JSC] Add samplingProfilerIgnoreExternalSourceID option https://bugs.webkit.org/show_bug.cgi?id=227985 Reviewed by Mark Lam. We can ignore sourceID when aggregating samples. By doing so, we can open Speedometer2 style iframes and still aggregate all the functions even though each script in iframe has different source ID. * runtime/OptionsList.h: * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::StackFrame::sourceID): (JSC::SamplingProfiler::reportTopFunctions): * runtime/SamplingProfiler.h: 2021-07-15 Adrian Perez de Castro Non-unified build fixes, mid-July 2021 edition https://bugs.webkit.org/show_bug.cgi?id=227981 Unreviewed non-unified build fixes. * ftl/FTLState.cpp: Add missing B3ValueInlines.h header. * runtime/TemporalNow.cpp: Add missing JSCJSValueInlines.h and JSObjectInlines.h headers. * runtime/TemporalObject.cpp: Ditto. 2021-07-14 Devin Rousso Implement Array.prototype.findLast and Array.prototype.findLastIndex https://bugs.webkit.org/show_bug.cgi?id=227939 Reviewed by Yusuke Suzuki. * builtins/ArrayPrototype.js: (findLast): Added. (findLastIndex): Added. (JSC::ArrayPrototype::finishCreation): * runtime/JSTypedArrayViewPrototype.cpp: * builtins/TypedArrayPrototype.js: (findLast): Added. (findLastIndex): Added. * runtime/ArrayPrototype.cpp: (JSC::JSTypedArrayViewPrototype::finishCreation): * runtime/OptionsList.h: 2021-07-14 Michael Saboff [macOS] Add new entitlement to limit process to a single JIT region https://bugs.webkit.org/show_bug.cgi?id=227956 Reviewed by Mark Lam. This macOS entitlement limits a process to a single JIT region. This matches the behavior on iOS. * Scripts/process-entitlements.sh: * entitlements.plist: 2021-07-14 Mark Lam Speculative fix for failed scope.releaseAssertNoException() after calls to JSMap::create(). https://bugs.webkit.org/show_bug.cgi?id=227964 rdar://78013960 Reviewed by Yusuke Suzuki. There have been reports of flaky failures on the scope.releaseAssertNoException() after the call to JSMap::create() in JSModuleLoader::finishCreation(). The scope.releaseAssertNoException() says that we don't expect the JSMap::create() to ever throw an exception. If the assertion is true, the only way that we can see an exception there is if we're throwing an asynchronous TerminationException. Since JSModuleLoader::finishCreation() does not have any long running loops, we can just DeferTerminationForAWhile and let the next exception check site throw the asynchronous TerminationException. We don't want to just use DeferTermination because it will throw the TerminationException right at the end of JSModuleLoader::finishCreation(), and the caller of JSModuleLoader::finishCreation() may be similarly not expecting an exception to be thrown there. Also apply the same treatment to AbstractModuleRecord::finishCreation(), and getBackingMap() in WebCore for the same reason. Other than those, other sites that call JSMap::create() already check for exceptions. So, those sites do not need to DeferTerminationForAWhile. * runtime/AbstractModuleRecord.cpp: (JSC::AbstractModuleRecord::finishCreation): * runtime/JSModuleLoader.cpp: (JSC::JSModuleLoader::finishCreation): 2021-07-14 Keith Miller Convert small JIT pool tests into executable fuzzing https://bugs.webkit.org/show_bug.cgi?id=226279 Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit. Instead of testing such a small pool we should just fuzz each executable allocation that says it can fail. The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command. Reviewed by Michael Saboff. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::numberOfDFGCompiles): * jit/ExecutableAllocationFuzz.cpp: (JSC::doExecutableAllocationFuzzing): * jsc.cpp: (runJSC): 2021-07-14 Mark Lam Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape(). https://bugs.webkit.org/show_bug.cgi?id=227962 rdar://78392251 Reviewed by Yusuke Suzuki. * runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): 2021-07-14 Yusuke Suzuki libpas executable-allocator should reserve more than 256KB for non-fail region at least https://bugs.webkit.org/show_bug.cgi?id=227927 Reviewed by Keith Miller. libpas jit_heap has mediam allocator which allocates 128KB pages at once. However, our JSC stress tests are setting 100KB for small executable memory tests. As a result, under this configuration, we fail immediately after using medium allocator. But this test's "total size of executable memory is 100KB" is unrealistic: it is possible that only 100KB memory remains, but it is impossible that we reserve only 25KB for non-fail reservation. In production, we are always reserving 128MB. So this configuration is not realistic actually. So, this patch changes, 1. If non-fail region is less than 256KB, then we add 256KB and keep this 256KB as non-fail executable allocation. If not, use 0.25 ratio as we are doing. This means that Options::jitMemoryReservationSize configures failable region of executable memory. 2. We also revive bytesReserved and bytesAllocated to make memoryPressureMultiplier and early-fail allocation (when there is not enough memory and allocation can fail, then we should fail). * jit/ExecutableAllocator.cpp: (JSC::initializeJITPageReservation): (JSC::ExecutableAllocator::underMemoryPressure): (JSC::ExecutableAllocator::memoryPressureMultiplier): (JSC::ExecutableAllocator::allocate): (JSC::ExecutableMemoryHandle::createImpl): (JSC::ExecutableMemoryHandle::~ExecutableMemoryHandle): (JSC::ExecutableMemoryHandle::shrink): (JSC::ExecutableMemoryHandle::sizeInBytes const): Deleted. * jit/ExecutableMemoryHandle.h: (JSC::ExecutableMemoryHandle::sizeInBytes const): (JSC::ExecutableMemoryHandle::ExecutableMemoryHandle): 2021-07-14 Mark Lam Placate exception checker validation in operationObjectAssignUntyped. https://bugs.webkit.org/show_bug.cgi?id=227955 rdar://80503746 Reviewed by Michael Saboff. * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): 2021-07-13 Robin Morisset Invalid machine code emitted by SpeculativeJIT::emitObjectOrOtherBranch https://bugs.webkit.org/show_bug.cgi?id=227869 Reviewed by Mark Lam. SpeculativeJIT::emitObjectOrOtherBranch used to check the validity of the masqueradesAsUndefined watchpoint twice, and assumed that it could not change in between. That is clearly incorrect as the main thread is running concurrently with it, and so the watchpoint could fire at any time. The fix is trivial: just check the validity once, and store the result in a boolean. If the watchpoint triggers later that is fine: we'll notice and cancel the compilation (see WatchpointCollectionPhase, Plan::isStillValid() and Plan::finalize()). The change only protects us from rare and hard-to-reproduce crashes on debug builds caused by an ASSERT firing. I did not add a testcase, as I can only reproduce the bug by adding an extra wait in the middle of emitObjectOrOtherBranch. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch): 2021-07-13 Yijia Huang Add a new Air::Arg kind ZeroReg to let AIR recognise the new instructions/forms accepting zero register in ARM64 https://bugs.webkit.org/show_bug.cgi?id=227510 Reviewed by Saam Barati. B3 is designed to be portable to many kinds of CPUs. However, to effectively compile code to different CPUs, the compiler must eventually make explicit instruction set details. Then, Air is introduced, and it is designed to target individual CPU architectures and generate instructions specific to those CPUs. Previously, Air don't recognize the zero register. This problem has been pointed out in #174821, which was trying to introduce the new opcodes to handle the zero register. To solve this problem in a modular reasoning approach, a new Air operand ZeroReg should be introduced. Its goal is to closely match the CPU instructions accepting the zero register in ARM64. Another reason is that the new overloads of the instructions taking the zero register can benefit instruction selection with this implementation. Here, the ZeroReg is added as a new kind for Air::Arg, which acts as a "high level" operand to be emitted with the associative opcodes. In ARM64, the ZeroReg would be emitted as a zero register. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::storeZero64): Deleted. (JSC::MacroAssemblerARM64::storeZero32): Deleted. (JSC::MacroAssemblerARM64::storeZero16): Deleted. * assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::storeZero32): Deleted. (JSC::MacroAssemblerX86Common::storeZero16): Deleted. * assembler/MacroAssemblerX86_64.h: (JSC::MacroAssemblerX86_64::storeZero64): Deleted. * b3/B3LowerToAir.cpp: * b3/air/AirArg.cpp: (JSC::B3::Air::Arg::jsHash const): (JSC::B3::Air::Arg::dump const): (WTF::printInternal): * b3/air/AirArg.h: (JSC::B3::Air::Arg::zeroReg): (JSC::B3::Air::Arg::isZeroReg const): (JSC::B3::Air::Arg::isGP const): (JSC::B3::Air::Arg::isFP const): (JSC::B3::Air::Arg::isValidForm const): (JSC::B3::Air::Arg::asZeroReg const): * b3/air/AirLowerStackArgs.cpp: (JSC::B3::Air::lowerStackArgs): * b3/air/AirOpcode.opcodes: * b3/air/opcode_generator.rb: * b3/testb3.h: * b3/testb3_1.cpp: (run): * b3/testb3_3.cpp: (testStoreZeroReg): 2021-07-12 Filip Pizlo and Yusuke Suzuki New malloc algorithm https://bugs.webkit.org/show_bug.cgi?id=226404 Reviewed by Yusuke Suzuki. Switch the ExecutableAllocator to the libpas jit_heap. The libpas jit_heap uses two size categories of bitfit and a large heap, and is happy to do its approximate first-fit in any ranges of memory you give it. Jit_heap never allocates metadata inside the memory it manages. Allocations and deallocations take a constant-bounded amount of time except for unusual situations, and are protected by fine-grained locking in most cases. Decommit follows libpas scavenging policy. This alone is a speed-up on Speedometer (probably about 1% or more). Also expose some libpas introspection via $vm. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * assembler/MacroAssemblerCodeRef.h: * jit/ExecutableAllocator.cpp: (JSC::ExecutableAllocator::underMemoryPressure): (JSC::ExecutableAllocator::memoryPressureMultiplier): (JSC::ExecutableAllocator::allocate): (JSC::ExecutableAllocator::committedByteCount): (JSC::ExecutableMemoryHandle::createImpl): (JSC::ExecutableMemoryHandle::~ExecutableMemoryHandle): (JSC::ExecutableMemoryHandle::sizeInBytes const): (JSC::ExecutableMemoryHandle::shrink): * jit/ExecutableAllocator.h: * jit/ExecutableMemoryHandle.h: Added. (JSC::ExecutableMemoryHandle::start const): (JSC::ExecutableMemoryHandle::end const): (JSC::ExecutableMemoryHandle::startAsInteger const): (JSC::ExecutableMemoryHandle::endAsInteger const): (JSC::ExecutableMemoryHandle::containsIntegerAddress const): (JSC::ExecutableMemoryHandle::contains const): (JSC::ExecutableMemoryHandle::key const): (JSC::ExecutableMemoryHandle::dump const): (JSC::ExecutableMemoryHandle::ExecutableMemoryHandle): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-07-12 Mark Lam Revert r277027: breaks GC. https://bugs.webkit.org/show_bug.cgi?id=227888 Reviewed by Saam Barati. The patch in r277027 to make deletion of GCAwareJITStubRoutines incremental has a bug: the routine may not be deleted yet by the incremental sweeper before the next GC cycle, and the GC will not be happy visiting dead cell pointers in that routine. There is also another bug with the triggering of sweeping. For now, we're reverting the patch, and will revisit this at a later time. * CMakeLists.txt: * heap/Heap.cpp: (JSC::Heap::deleteUnmarkedCompiledCode): (JSC::Heap::sweepSynchronously): * heap/Heap.h: * heap/HeapInlines.h: (JSC::Heap::mayHaveJITStubRoutinesToDelete): Deleted. (JSC::Heap::deleteDeadJITStubRoutines): Deleted. * heap/IncrementalSweeper.cpp: (JSC::IncrementalSweeper::doSweep): * heap/JITStubRoutineSet.cpp: (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): * heap/JITStubRoutineSet.h: (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): (JSC::JITStubRoutineSet::traceMarkedStubRoutines): (JSC::JITStubRoutineSet::mayHaveRoutinesToDelete): Deleted. (JSC::JITStubRoutineSet::notifyHaveRoutinesToDelete): Deleted. * jit/GCAwareJITStubRoutine.cpp: (JSC::GCAwareJITStubRoutine::observeZeroRefCount): * jit/JITStubRoutine.h: (JSC::JITStubRoutine::createSelfManagedRoutine): 2021-07-12 Yijia Huang Add SMNEGL, UMNEGL, UMADDL, and UMSUBL for ARM64 and select this instruction in Air https://bugs.webkit.org/show_bug.cgi?id=227857 Reviewed by Robin Morisset. The previous patches have already added MNEG, MADD, MSUB, SMADDL, and SMSUBL. This patch completes the corresponding signed or unsigned variants (SMNEGL, UMNEGL, UMADDL, and UMSUBL) of them. In addition, this patch refactors the implementation and the associative test cases of MADD, MSUB, and MNEG to be more readable and maintainable w.r.t their variants. ------------------------------ ### SMNEGL/UMNEGL Xd Wn Wm ### ------------------------------ Signed/Unsigned Multiply-Negate Long multiplies two 32-bit register values, negates the product, and writes the result to the 64-bit destination register. The equivalent patterns are d = -(SExt32(n) * SExt32(m)) and d = -(ZExt32(n) * ZExt32(m)) respectively. Given B3 IR: Int @0 = S/ZExt32(Trunc(ArgumentReg(%x0))) Int @1 = S/ZExt32(Trunc(ArgumentReg(%x1))) Int @2 = Mul(@0, @1) Int @3 = Neg(@2) Void@4 = Return(@3, Terminal) // Old optimized AIR Move32 %x0, %x0, @0 Move32 %x1, %x1, @1 MultiplyNeg %x0, %x1, %x0, @3 Ret %x0, @4 // New optimized AIR MultiplyNegSign/ZeroExtend %x0, %x1, %x0, @3 Ret %x0, @4 -------------------------- ### UMADDL Xd Wn Wm Xa ### -------------------------- Unsigned Multiply-Add Long multiplies two 32-bit register values, adds a 64-bit register value, and writes the result to the 64-bit destination register. The equivalent patterns are d = ZExt32(n) * ZExt32(m) + a or d = a + ZExt32(n) * ZExt32(m) Given B3 IR: Int @0 = ZExt32(Trunc(ArgumentReg(%x0))) Int @1 = ZExt32(Trunc(ArgumentReg(%x1))) Int @2 = ArgumentReg(%x2) Int @3 = Mul(@0, @1) Int @4 = Add(@3, @2) Void@5 = Return(@4, Terminal) // Old optimized AIR Move32 %x0, %x0, @1 Move32 %x1, %x1, @2 MultiplyAdd %x0, %x1, %x2, %x0, @4 Ret64 %x0, @5 // New optimized AIR MultiplyAddZeroExtend %x0, %x1, %x2, %x0, @8 Ret %x0, @9 -------------------------- ### UMSUBL Xd Wn Wm Xa ### -------------------------- Unsigned Multiply-Subtract Long multiplies two 32-bit register values, subtracts the product from a 64-bit register value, and writes the result to the 64-bit destination register. The equivalent patterns are d = a - ZExt32(n) * ZExt32(m) Given B3 IR: Int @0 = ZExt32(Trunc(ArgumentReg(%x0))) Int @1 = ZExt32(Trunc(ArgumentReg(%x1))) Int @2 = ArgumentReg(%x2) Int @3 = Mul(@0, @1) Int @4 = Sub(@2, @3) Void@5 = Return(@4, Terminal) // Old optimized AIR Move32 %x0, %x0, @1 Move32 %x1, %x1, @2 MultiplySub %x0, %x1, %x2, %x0, @4 Ret64 %x0, @5 // New optimized AIR MultiplySubZeroExtend %x0, %x1, %x2, %x0, @8 Ret %x0, @9 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::multiplyNeg32): (JSC::MacroAssemblerARM64::multiplyAddZeroExtend32): (JSC::MacroAssemblerARM64::multiplySubZeroExtend32): (JSC::MacroAssemblerARM64::multiplyNeg64): (JSC::MacroAssemblerARM64::multiplyNegSignExtend32): (JSC::MacroAssemblerARM64::multiplyNegZeroExtend32): * assembler/testmasm.cpp: (JSC::testMultiplyAddSignExtend32): (JSC::testMultiplyAddZeroExtend32): (JSC::testMultiplySubSignExtend32): (JSC::testMultiplySubZeroExtend32): (JSC::testMultiplyNegSignExtend32): (JSC::testMultiplyNegZeroExtend32): (JSC::testMultiplyAddSignExtend32Left): Deleted. (JSC::testMultiplyAddSignExtend32Right): Deleted. * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testMulAddArgsLeft): (testMulAddArgsRight): (testMulAddSignExtend32ArgsLeft): (testMulAddZeroExtend32ArgsLeft): (testMulAddZeroExtend32ArgsRight): (testMulSubArgsLeft): (testMulSubArgsRight): (testMulSubArgsRight32): (testMulSubSignExtend32): (testMulSubZeroExtend32): (testMulNegArgArg): (testMulNegArgs): (testMulNegArgs32): (testMulNegSignExtend32): (testMulNegZeroExtend32): (testMulSubSignExtend32Args): Deleted. * b3/testb3_3.cpp: (addArgTests): 2021-07-12 Yusuke Suzuki [JSC] JITCage already includes guard pages https://bugs.webkit.org/show_bug.cgi?id=227867 Reviewed by Mark Lam. Since JITCage already includes guard pages, we do not need to allocate that additionally. * jit/ExecutableAllocator.cpp: (JSC::initializeJITPageReservation): 2021-07-10 Saam Barati Continue to consult InlineAccess's Structure even after switching to a stub IC https://bugs.webkit.org/show_bug.cgi?id=227785 Reviewed by Yusuke Suzuki. This patch fixes a crash in: stress/class-subclassing-function.js The bug is this: 1. We initialize a StructureStubInfo to be an inline self access doing a load based on structure S. 2. We transition to being a PolymorphicAccess based StructureStubInfo. But, we haven't generated code yet. We're in the buffered state. So we are still running the inline access from (1). But the StructureStubInfo thinks it's a "Stub". 3. S is collected 4. We continue to run code from (1), because when we finalize the IC during GC, it doesn't think it's an inline access. The fix is to always track the structure S that we used when generating the inline access, and to only stop tracking it once we've generated code for the Stub. * bytecode/AccessCase.cpp: (JSC::AccessCase::fromStructureStubInfo): (JSC::AccessCase::propagateTransitions const): * bytecode/AccessCase.h: * bytecode/GetByStatus.cpp: (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/InByStatus.cpp: (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::propagateTransitions const): * bytecode/PolymorphicAccess.h: * bytecode/PutByIdStatus.cpp: (JSC::PutByIdStatus::computeForStubInfo): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::initGetByIdSelf): (JSC::StructureStubInfo::initPutByIdReplace): (JSC::StructureStubInfo::initInByIdSelf): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::visitWeakReferences): (JSC::StructureStubInfo::propagateTransitions): * bytecode/StructureStubInfo.h: 2021-07-10 Yusuke Suzuki [JSC] Workaround test262.report bug by making $ properties enumerable https://bugs.webkit.org/show_bug.cgi?id=227855 Reviewed by Alexey Shvayka. test262.report's harness has a bug and it reports incorrect results for JSC on tests using $262 properties. This patch introduces a workaround which makes properties of $ enumerable. * jsc.cpp: 2021-07-08 Yijia Huang Add Air opcode add/sub-and-shift for ARM64 and select this instruction in Air https://bugs.webkit.org/show_bug.cgi?id=227509 Reviewed by Saam Barati. This patch includes two modifications: 1. Add add/sub-with-shift to Air opcode and the corresponding pattern match for instruction selection. 2. Minor fix in disassembler. Given the operation: add/sub Rd, Rn, Rm, ShiftType, amount ADD/SUB (shifted register), adds/subs a register value Rn and an optionally-shifted register value Rm, and writes the result to the destination register Rd. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. The equivalent pattern would be: d = n +/- (m ShiftType amount) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = amount Int @3 = ZShr(@1, @2) Int @4 = Add/Sub(@0, @3) Void@5 = Return(@4, Terminal) // Old optimized AIR Shift %x1, amount, %x1, @3 Add/Sub %x0, %x1, %x0, @4 Ret %x0, @5 // New optimized AIR Add(Sub)Shift %x0, %x1, amount, %x0, @4 Ret %x0, @5 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::addLeftShift32): (JSC::MacroAssemblerARM64::addRightShift32): (JSC::MacroAssemblerARM64::addUnsignedRightShift32): (JSC::MacroAssemblerARM64::addLeftShift64): (JSC::MacroAssemblerARM64::addRightShift64): (JSC::MacroAssemblerARM64::addUnsignedRightShift64): (JSC::MacroAssemblerARM64::subLeftShift32): (JSC::MacroAssemblerARM64::subRightShift32): (JSC::MacroAssemblerARM64::subUnsignedRightShift32): (JSC::MacroAssemblerARM64::subLeftShift64): (JSC::MacroAssemblerARM64::subRightShift64): (JSC::MacroAssemblerARM64::subUnsignedRightShift64): * assembler/testmasm.cpp: (JSC::testAddWithLeftShift32): (JSC::testAddWithRightShift32): (JSC::testAddWithUnsignedRightShift32): (JSC::testAddWithLeftShift64): (JSC::testAddWithRightShift64): (JSC::testAddWithUnsignedRightShift64): (JSC::testSubWithLeftShift32): (JSC::testSubWithRightShift32): (JSC::testSubWithUnsignedRightShift32): (JSC::testSubWithLeftShift64): (JSC::testSubWithRightShift64): (JSC::testSubWithUnsignedRightShift64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: (checkUsesInstruction): * b3/testb3_2.cpp: (testAddWithLeftShift32): (testAddWithRightShift32): (testAddWithUnsignedRightShift32): (testAddWithLeftShift64): (testAddWithRightShift64): (testAddWithUnsignedRightShift64): (testSubWithLeftShift32): (testSubWithRightShift32): (testSubWithUnsignedRightShift32): (testSubWithLeftShift64): (testSubWithRightShift64): (testSubWithUnsignedRightShift64): (addBitTests): * disassembler/ARM64/A64DOpcode.cpp: * disassembler/ARM64/A64DOpcode.h: (JSC::ARM64Disassembler::A64DOpcodeAddSubtractShiftedRegister::immediate6): (JSC::ARM64Disassembler::A64DOpcodeLogicalShiftedRegister::immediate6): 2021-07-08 Keith Miller display-profiler-output should be able to print disassembly for the FTL https://bugs.webkit.org/show_bug.cgi?id=227798 Reviewed by Saam Barati. Right now running JSC with the bytecode profiler will not print disassembly for FTL code. This patch adds this support. In order to get execution counts there is a callback at the transition between each DFG node in the Air disassembler. Since B3 code move parts of DFG nodes to different basic blocks we don't include execution counts in the dump. However, the DFG-only graph printed before the disassembly will still have the counts. * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLLink.cpp: (JSC::FTL::link): * ftl/FTLState.cpp: (JSC::FTL::State::dumpDisassembly): * ftl/FTLState.h: (JSC::FTL::State::dumpDisassembly): 2021-07-08 Yusuke Suzuki Use JSC::Yarr::flagsString to get string representation of RegExp flags https://bugs.webkit.org/show_bug.cgi?id=227790 Reviewed by Keith Miller. * yarr/YarrFlags.h: 2021-07-07 Yusuke Suzuki [JSC] Clean up RegExp flag code https://bugs.webkit.org/show_bug.cgi?id=227786 Reviewed by Filip Pizlo. I found a bug in regexpToSourceString (used for RegExp's dump code), and it motivates me to clean up all RegExp flag handling code. We define RegExp flags as a macro and updating that macro updates all RegExp flag handling code too. * runtime/RegExp.cpp: (JSC::RegExpFunctionalTestCollector::outputOneTest): (JSC::regexpToSourceString): * runtime/RegExp.h: * runtime/RegExpPrototype.cpp: (JSC::flagsString): * yarr/YarrFlags.cpp: (JSC::Yarr::parseFlags): (JSC::Yarr::flagsString): * yarr/YarrFlags.h: 2021-07-07 Saam Barati JSArrayBufferView::byteOffsetConcurrently has a race when using PAC https://bugs.webkit.org/show_bug.cgi?id=227765 Reviewed by Mark Lam. We were calling JSArrayBufferView::vector(), which does PAC validation using the length() of the array. However, this can race with JSArrayBufferView::detach, which sets the length to zero, leading to sadness on the compiler thread. * runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::vectorWithoutPACValidation const): * runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::byteOffsetImpl): 2021-07-07 Yusuke Suzuki [JSC] Fix Object.assign fast path to accept undefined/null https://bugs.webkit.org/show_bug.cgi?id=227769 rdar://80264271 Reviewed by Saam Barati. Object.assign can accept undefined or null as a second (or latter) parameters. If it is passed, the parameter is just ignored. Previous DFG / FTL optimization patch does not handle this case. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicCall): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileObjectAssign): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign): * runtime/ObjectConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ObjectConstructorInlines.h: (JSC::objectAssignFast): 2021-07-07 Mark Lam Heap::waitForCollector() needs to set m_mutatorDidRun. https://bugs.webkit.org/show_bug.cgi?id=227782 rdar://78326474 Reviewed by Saam Barati. Heap::waitForCollector() is one of 2 clients of Heap::stopIfNecessarySlow(unsigned oldState). The other client, Heap::stopIfNecessarySlow() sets m_mutatorDidRun to true after calling Heap::stopIfNecessarySlow(unsigned oldState). Heap::waitForCollector() needs to do the same. Constraint solvers rely on this. Without this, one fall out we've seen is that DOMGCOutputConstraint fails to visitOutputConstraints, and as a result, opaqueRoots may not get updated. This issue was caught by the GC verifier. * heap/Heap.cpp: (JSC::Heap::waitForCollector): 2021-07-07 Michael Saboff fitcored crashes at JavaScriptCore: JSC::Heap::releaseAccessSlow https://bugs.webkit.org/show_bug.cgi?id=227767 Reviewed by Geoffrey Garen. Speculative fix for this crash. We are crashing while destroying the VM as we are about to release the JSLock. In JSLock::willReleaseLock(), we release heap access. Therefore we don't need to release it again when undertaking the various shutdown steps in the VM destructor. Added a new scope class that will only release and then acquire heap access if the caller currently has heap access. * heap/ReleaseHeapAccessScope.h: (JSC::ReleaseHeapAccessIfNeededScope::ReleaseHeapAccessIfNeededScope): (JSC::ReleaseHeapAccessIfNeededScope::~ReleaseHeapAccessIfNeededScope): * jit/JITWorklist.cpp: (JSC::JITWorklist::waitUntilAllPlansForVMAreReady): 2021-07-07 Yusuke Suzuki [JSC] Do not allocate JITWorklist if JIT is disabled https://bugs.webkit.org/show_bug.cgi?id=227734 Reviewed by Mark Lam. Previously, this code was doing, if (Options::useJIT()) DFG::iterateCodeBlocksForGC(visitor, m_vm, func); But r278082 changed it to JITWorklist::ensureGlobalWorklist().iterateCodeBlocksForGC(visitor, m_vm, func); As a result, we are always allocating JITWorklist even JIT is not enabled. This patch fixes the behavior not to allocate JITWorklist. * heap/Heap.cpp: (JSC::Heap::iterateExecutingAndCompilingCodeBlocks): 2021-07-06 Yusuke Suzuki r270214 broke testb3 on arm64e https://bugs.webkit.org/show_bug.cgi?id=227713 Reviewed by Saam Barati. ARM64E CAS lacks isBranch case. This patch adds isBranch implementation. We also adjust disasm scanning test to support CAS in ARM64E. * assembler/testmasm.cpp: (JSC::testAtomicStrongCASFill8): (JSC::testAtomicStrongCASFill16): * b3/B3LowerToAir.cpp: * b3/testb3_8.cpp: (testAtomicWeakCAS): (testAtomicStrongCAS): (testAtomicXchg): 2021-07-06 Yusuke Suzuki Unreviewed, build fix after r279630 https://bugs.webkit.org/show_bug.cgi?id=223166 * DerivedSources-input.xcfilelist: * DerivedSources-output.xcfilelist: 2021-07-06 Commit Queue Unreviewed, reverting r279546, r279554, r279558 and r279567. https://bugs.webkit.org/show_bug.cgi?id=227732 Speedometer/jQuery-TodoMVC 2-3% regression Reverted changesets: "[WebIDL] Rework runtime enabled properties leveraging PropertyCallback" https://bugs.webkit.org/show_bug.cgi?id=227275 https://commits.webkit.org/r279546 "[WebIDL] Generate constructor's hash table in GenerateConstructorHelperMethods" https://bugs.webkit.org/show_bug.cgi?id=227668 https://commits.webkit.org/r279554 "[WebIDL] Simplify generation of runtime conditionally read- write attributes" https://bugs.webkit.org/show_bug.cgi?id=227672 https://commits.webkit.org/r279558 "Use AbortSignal's [PrivateIdentifier] whenSignalAborted() static method" https://bugs.webkit.org/show_bug.cgi?id=227673 https://commits.webkit.org/r279567 2021-07-06 Philip Chimento [JSC] Implement Temporal https://bugs.webkit.org/show_bug.cgi?id=223166 Reviewed by Yusuke Suzuki. Intended to be the first patch in a stack. Adds boilerplate for Temporal in order to unblock further parallelizable work on this bug. This patch adds a feature flag for Temporal, and a toplevel Temporal global containing only Temporal.now, which is itself an empty object. These objects will be further populated in later patches. * CMakeLists.txt: Add TemporalObject and TemporalNow. Property lookup table in TemporalObject. * DerivedSources.make: Add TemporalObject property lookup table header. * JavaScriptCore.xcodeproj/project.pbxproj: Add new files. * Sources.txt: Add TemporalObject and TemporalNow. * runtime/CommonIdentifiers.h: Add 'Temporal' property key. * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): Create the Temporal global if the feature flag is enabled. * runtime/OptionsList.h: Add useTemporal feature flag. * runtime/TemporalNow.cpp: Added. (JSC::TemporalNow::TemporalNow): (JSC::TemporalNow::create): (JSC::TemporalNow::createStructure): (JSC::TemporalNow::finishCreation): * runtime/TemporalNow.h: Added. * runtime/TemporalObject.cpp: Added. (JSC::createNowObject): (JSC::TemporalObject::TemporalObject): (JSC::TemporalObject::create): (JSC::TemporalObject::createStructure): (JSC::TemporalObject::finishCreation): * runtime/TemporalObject.h: Added. 2021-07-06 Yijia Huang Fix type error in testb3 https://bugs.webkit.org/show_bug.cgi?id=227722 Reviewed by Mark Lam. Fix type error in testb3. Shift amount should be 32-bit constant. * b3/testb3_3.cpp: (testInsertSignedBitfieldInZero64): (testExtractSignedBitfield64): 2021-07-05 Yusuke Suzuki [JSC] Optimize Object.assign and putDirectInternal https://bugs.webkit.org/show_bug.cgi?id=227677 Reviewed by Filip Pizlo. This patch improves Object.assign performance (and this requires putDirectInternal improvement). 1. Object.assign is handled by DFG / FTL as ObjectAssign node 2. We found that putDirectInternal is suboptimal. This patch removes several bottlenecks. They are super critical from the measurement of microbenchmarks. 2.1. Creating and destroying DeferredStructureTransitionWatchpointFire is not free. We should do that only when we need it. 2.2. Before r277620, we are checking m_replacementWatchpointSets's nullptr and that was fast. But after that, we are always calling HashMap::get, and it is not inlined. This means that if we have StructureRareData, we are always calling HashMap::get even though there is no m_replacementWatchpointSets set. This patch adds HashMap::isNullStorage to avoid this call by inlinely check this via `LIKELY(m_replacementWatchpointSets.isNullStorage())`. 2.3. Structure::addPropertyTransitionToExistingStructure has very cheap fast path and we must inline them to get performance benefit for major single-transition case. Added microbenchmarks show significant performance improvements. And Speedometer2 shows 0.6 - 1.0% improvement. ToT Patched object-assign-transition 105.2539+-0.2970 ^ 88.8046+-0.2029 ^ definitely 1.1852x faster object-assign-replace 116.1568+-0.0905 ^ 75.0673+-0.0658 ^ definitely 1.5474x faster * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/Watchpoint.cpp: (JSC::DeferredWatchpointFire::fireAllSlow): (JSC::DeferredWatchpointFire::DeferredWatchpointFire): Deleted. (JSC::DeferredWatchpointFire::~DeferredWatchpointFire): Deleted. (JSC::DeferredWatchpointFire::fireAll): Deleted. * bytecode/Watchpoint.h: (JSC::DeferredWatchpointFire::DeferredWatchpointFire): (JSC::DeferredWatchpointFire::fireAll): (JSC::FireDetail::FireDetail): Deleted. (JSC::FireDetail::~FireDetail): Deleted. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicCall): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGMayExit.cpp: * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileObjectAssign): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileObjectAssign): * runtime/Intrinsic.cpp: (JSC::intrinsicName): * runtime/Intrinsic.h: * runtime/JSObject.cpp: (JSC::JSObject::deleteProperty): * runtime/JSObjectInlines.h: (JSC::JSObject::putDirectInternal): * runtime/ObjectConstructor.cpp: (JSC::objectAssignGeneric): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/ObjectConstructor.h: * runtime/ObjectConstructorInlines.h: Added. (JSC::canPerformFastPropertyEnumerationForObjectAssign): * runtime/Structure.cpp: (JSC::StructureTransitionTable::singleTransition const): Deleted. (JSC::StructureTransitionTable::get const): Deleted. (JSC::Structure::addPropertyTransitionToExistingStructureImpl): Deleted. (JSC::Structure::addPropertyTransitionToExistingStructure): Deleted. (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently): Deleted. * runtime/Structure.h: * runtime/StructureInlines.h: (JSC::Structure::didReplaceProperty): (JSC::Structure::propertyReplacementWatchpointSet): (JSC::Structure::addPropertyTransitionToExistingStructureImpl): (JSC::Structure::addPropertyTransitionToExistingStructure): (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently): (JSC::StructureTransitionTable::singleTransition const): (JSC::StructureTransitionTable::get const): 2021-07-06 Yijia Huang Fix instruction check failure of UBFX and SBFIZ in testb3 due to the speculative fix in bug 227554 https://bugs.webkit.org/show_bug.cgi?id=227563 Reviewed by Filip Pizlo. This patch includes two modifications to resolve rdar://79978150: 1. Fix the bug caused by the patch introducing BFI. 2. Discard the corresponding speculative fix in https://bugs.webkit.org/show_bug.cgi?id=227554. The previous patch, added bit field insert (BFI) to AIR opcode, causes the Gmail page hanging issue on Safari. The root cause is the incorrect definition of register role in BFI's AIR opcode. Since BFI inserts a bit field at the low end of the destination register while keeping the high bit unchanged, the destination register should have both roles of use and define simultaneously, which is not (missing use) in the previous patch. This will result in the loss of preserving the value of the destination register, which does happen when browsing the Gmail page on Safari. // B3 IR snippets from Gmail Int32 b@23 = Add(b@104, b@111, D@100) ... Int32 b@55 = Const32(65535, D@50) Int32 b@137 = BitAnd(b@118, $65535(b@55), D@160) Int32 b@168 = Const32(16, D@40) Int32 b@141 = Shl(b@137, $16(b@168), D@163) Int32 b@143 = BitAnd(b@23, $65535(b@55), D@166) Int32 b@144 = BitOr(b@141, b@143, D@169) The pattern of BFI is d = ((n & mask1) << lsb) | (d & mask2). So, it is obvious that BFI can be utilized in b@144 where the d is b@23. // Incorrect AIR opcode of BFI arm64: InsertBitField32 U:G:32, U:G:32, U:G:32, ZD:G:32 Tmp, Imm, Imm, Tmp // Air w/o use role Add32 %x3, %x7, %x7, b@23 ... InsertBitField32 %x3, $16, $16, %x4, b@144 // Generated code w/o use role add w7, w3, w7 ... bfi w4, w3, #16, #16 In Air, the added value is stored in the w7. But the value is not preserved after lowering with BFI. To fix this, the use role should be enabled for the destination register. // Correnct AIR opcode of BFI arm64: InsertBitField32 U:G:32, U:G:32, U:G:32, UZD:G:32 Tmp, Imm, Imm, Tmp // Air w/ use role Add32 %x3, %x7, %x7, b@23 ... Move32 %x7, %x4, b@144 InsertBitField32 %x3, $16, $16, %x4, b@144 // Generated code w/ use role add w7, w3, w7 ... ubfx x4, x7, #0, #32 bfi w4, w3, #16, #16 In addition, BFXIL, which has pattern d = ((n >> lsb) & mask1) | (d & mask2), also needs the similar update. * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3_2.cpp: (testInsertBitField32): (testInsertBitField64): (testExtractInsertBitfieldAtLowEnd32): (testExtractInsertBitfieldAtLowEnd64): * runtime/OptionsList.h: 2021-07-04 Robin Morisset ActiveScratchBufferScope should take the buffer as argument https://bugs.webkit.org/show_bug.cgi?id=227670 rdar://80011612 Reviewed by Mark Lam. https://bugs.webkit.org/show_bug.cgi?id=227013 created ActiveScratchBufferScope. It is used by operations that can cause the GC to run, to mark as roots the contents of the scratch buffer that is live during that time (if any). The bug is that it simply asks the VM for a scratch buffer of the right size, but this will always return the last scratch buffer, and not necessarily the one that the operation is actually using. A fairly simple fix is to pass it directly the scratch buffer, since the operation normally can get it easily enough. In most cases the operation has access to the m_buffer field of the ScratchBuffer, but getting a pointer to the entire structure from that is fairly simple (I added ScratchBuffer::fromData() to do so). * dfg/DFGOSRExit.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOSRExit.h: * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNewArray): * dfg/DFGThunks.cpp: (JSC::DFG::osrExitGenerationThunkGenerator): * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::haveABadTime): * runtime/VM.h: (JSC::ScratchBuffer::fromData): * runtime/VMInlines.h: (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope): (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope): 2021-07-04 Alexey Shvayka [WebIDL] Simplify generation of runtime conditionally read-write attributes https://bugs.webkit.org/show_bug.cgi?id=227672 Reviewed by Sam Weinig. * runtime/Lookup.h: (JSC::HashTableValue::makeReadOnlyCopy const): 2021-07-03 Alexey Shvayka [WebIDL] Rework runtime enabled properties leveraging PropertyCallback https://bugs.webkit.org/show_bug.cgi?id=227275 Reviewed by Saam Barati. To make the implementation of WebIDL runtime enabled properties independent of eager property reification, this change: 1. Introduces IsLazyPropertyEnabledCallback, which is needed separately from existing value callback to maintain the invariant that reifyStaticProperty() always puts a property, and to keep enumeration fast. Calling disableCaching() isn't enough to achieve correct [[Get]] inline caching, so isTaintedByOpaqueObject() is leveraged to prohibit caching of runtime disabled properties, just like in operationTryGetByIdOptimize(). The only case that might seem weird is runtime disabled properties, which were enabled after all static properties were reified via [[Delete]], are not appearing. It's fixable, yet there is currently no demand for it. 2. Adds support for LazyPropertyCallback returning GetterSetter / CustomGetterSetter, ensuring correct structure flags and slot initialization. Previously, the callback was used to init only objects and constructors, using putDirect() unconditionally. To avoid mixing other non-basic attributes with PropertyCallback, which would require hoisting of checks against PropertyCallback and complicating attribute validation in HashTableValue methods, this patch checks the type of callback's return value instead. In the future, sticking to this approach will make returning CustomValue impossible as it can't be distinguished from CustomAccessor. That's fine because all present CustomValue usages merely do lazy init, which PropertyCallback is better suited for. Also, this patch: 3. Expands setUpStaticFunctionSlot() to handle constant integers so the code using `Node.ELEMENT_NODE` & friends doesn't regress (proven by attached microbenchmark). 4. Removes extra checks from setUpStaticPropertySlot(), which is called only on non-reified properties. 5. Removes invariant that DOMJITAttribute property is read-only, which was broken by `document.body` having a non-JIT custom setter. This aligns non-reified properties with structure ones. * jit/Repatch.cpp: (JSC::tryCacheGetBy): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::setupGetByIdPrototypeCache): * runtime/HasOwnPropertyCache.h: (JSC::HasOwnPropertyCache::tryAdd): * runtime/JSObject.cpp: (JSC::lookupPropertyForPut): (JSC::JSObject::putInlineSlow): (JSC::JSObject::reifyAllStaticProperties): * runtime/JSObject.h: (JSC::JSObject::getOwnNonIndexPropertySlot): (JSC::JSObject::fillStructurePropertySlot): * runtime/JSObjectInlines.h: (JSC::JSObject::getNonReifiedStaticPropertyNames): * runtime/Lookup.cpp: (JSC::setUpStaticPropertySlot): (JSC::setUpStaticFunctionSlot): Deleted. * runtime/Lookup.h: (JSC::HashTableValue::isLazyPropertyEnabled const): (JSC::getStaticPropertySlotFromTable): (JSC::reifyStaticProperty): (JSC::reifyStaticProperties): * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-07-02 Keith Miller Add 10 more unified source cpp files for JSC https://bugs.webkit.org/show_bug.cgi?id=227643 Reviewed by Alex Christensen. * JavaScriptCore.xcodeproj/project.pbxproj: * Scripts/generate-unified-sources.sh: * UnifiedSources-output.xcfilelist: 2021-07-02 Philippe Normand [GTK] Add new revision variable in pkgconfig file https://bugs.webkit.org/show_bug.cgi?id=227629 Reviewed by Michael Catanzaro. * javascriptcoregtk.pc.in: Include SVN_REVISION as revision variable, useful for apps to know on which upstream SVN revision their WebKitGTK-based app is built on. 2021-07-01 Yijia Huang Remove unnecessary canBeInternal invocations to mitigate the cost of potential unmatched patterns in B3LowerToAir https://bugs.webkit.org/show_bug.cgi?id=227508 Reviewed by Filip Pizlo. The bit pattern doesn't cause worse code generation in the all-internals-are-captured case. So, they don't need canBeInternal checks which might terminate potential matched scenarios. The equivalent pattern of SBFIZ is ((src << amount) >> amount) << lsb. Given the code: a = x << C b = a >> C c = b << D print(a) print(b) print(c) The pattern won't match because of !canBeInternal for a and b (useCounts > 1). So, this would emit three separate instructions. But if we removed canBeInternal, it would still be just three separate instructions, and they wouldn't be any more expensive. Suppose the print(b) is removed, above. Then, with the canBeInternal check, it is emitting three instructions. Without the canBeInternal check, it would emit only two (x << C and SBFIZ to compute c). And that would be less expensive. * b3/B3LowerToAir.cpp: 2021-07-01 Yijia Huang Add a new pattern to instruction selector to use EXTR supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227171 Reviewed by Robin Morisset. This patch includes two modifications: 1. Introduce a strength reduction rule to zero extend bitfield. 2. Add Extract Register (EXTR) to Air opcode to serve instruction selector. ------------------------------------------------------- ### Part A zero extend bitfield ### ------------------------------------------------------- A new strength reduction rule is added for the canonical form of the zero-extend bitfield. Turn this: ZShr(Shl(value, amount)), amount) Into this: BitAnd(value, mask) with constraints: 1. 0 <= amount < datasize 2. width = datasize - amount 3. mask is !(mask & (mask + 1)) where bitCount(mask) == width ------------------- ### Part B EXTR ### ------------------- Given instruction: extr Rd, Rn, Rm, lowWidth Extract register (EXTR) extracts a register from a pair of registers, where concat = Rn:Rm and Rd = concat. The equivalent pattern of this instruction is: d = ((n & mask) << highWidth) | (m >> lowWidth) highWidth = datasize - lowWidth mask = (1 << lowWidth) - 1 Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = mask Int @3 = BitAnd(@0, @2) Int @4 = highWidth Int @5 = Shl(@3, @4) Int @6 = lowWidth Int @7 = ZShr(@1, @6) Int @8 = BitOr(@7, @5) Void@9 = Return(@10, Terminal) Before Adding BIC: // Old optimized AIR InsertUnsignedBitfieldInZero %x0, highWidth, lowWidth, %x0, @5 Urshift %x1, lowWidth, %x1, @7 Or %x0, %x1, %x0, @8 Ret %x0, @9 After Adding BIC: // New optimized AIR ExtractRegister %x0, %x1, lowWidth, %x0, @8 Ret %x0, @9 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::extractRegister32): (JSC::MacroAssemblerARM64::extractRegister64): * assembler/testmasm.cpp: (JSC::testExtractRegister32): (JSC::testExtractRegister64): * b3/B3LowerToAir.cpp: * b3/B3ReduceStrength.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testBitfieldZeroExtend32): (testBitfieldZeroExtend64): (testExtractRegister32): (testExtractRegister64): (addBitTests): 2021-06-30 Saam Barati Turn off data ICs by default https://bugs.webkit.org/show_bug.cgi?id=227334 Reviewed by Yusuke Suzuki. There are GC crashes that are caused by access data IC sharing. This patch is both turning off data IC sharing by default, and turning off data ICs by default. We should re-enable this once we figure out the issue: https://bugs.webkit.org/show_bug.cgi?id=227551 Some of our testing modes are still running with data ICs on, so the code doesn't bit rot. And a select few tests are running with data IC sharing on, for similar reasons, even though we know it has issues. If those tests start crashing, we'll just disable sharing completely until the issue is resolved. * bytecode/PolymorphicAccess.cpp: (JSC::PolymorphicAccess::regenerate): * runtime/OptionsList.h: 2021-06-30 Yusuke Suzuki [JSC] Stop generating default parameter code if class constructor is called without 'new' https://bugs.webkit.org/show_bug.cgi?id=227547 rdar://78821453 Reviewed by Mark Lam. We already do not generate body bytecode when class constructor is called without 'new' because many features including "super()" assume that they generate bytecode only when it is called as a constructor. But we are not doing that for default parameters' bytecode generation. This patch stops generating bytecode for default parameters if class constructor is called without 'new'. * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::generate): (JSC::BytecodeGenerator::BytecodeGenerator): * runtime/ConstructorKind.h: 2021-06-30 Yusuke Suzuki [JSC] Private names should be handled by usedVariables mechanism https://bugs.webkit.org/show_bug.cgi?id=227476 rdar://76049469 Reviewed by Saam Barati. Private name handling in the current parser has many problems. 1. The parser backtracks when it sees destructuring assignment, arrow function etc. In that case, the discarded code must not have any effect on the outside of that code. However, private name handling is annotating "used" of the upper scopes, which is wrong. 2. In class expression, private name lookup intentionally skips the class-scope when parsing class heritage. But this is not correct since CodeBlock will perform lookup on the normal scope chain and this will look into the class-scope inconsistently. This means that we could encounter different private name at runtime. (it is tested in the added test). 3. We skip inner function parsing when it is parsed previously. At that case, we must preserve private name annotation, but restored function information does not preserve that. This patch changes how private name is handled. 1. We were anyway defining #XXX variables which holds private symbols. So we track "use" information by the mechanism used for usual variables. We remove Used / Declared bits from PrivateNameEntry since they are not necessary at runtime, and these information is handled / tracked in Parser's Scope. For backtracking, we already have a mechanism to roll-back m_usedVariables, so using variable mechanism automatically fixes the problem. 2. We define class-head-scope separately from class-scope. class-heritage expression can see class name, but it cannot use private names. Previously, our implementation attempted to achieve that by hacky way: skipping this class-scope for private names only while parsing class-heritage. But this was wrong since it does not consider CodeBlock's linking phase as described in the problem (2). Instead, we just define class-head-scope which holds class constructor name. 3. We clean up popScopeInternal to populate lexical-variables and function-stack. Previously, we are stealing them before popping the scope when necessary, but this is a hack and a bit wrong since scope's popping operation needs to access these information in some cases. Instead, popScopeInternal populates them after popping the scope. * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::pushClassHeadLexicalScope): (JSC::BytecodeGenerator::popClassHeadLexicalScope): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::ClassExprNode::emitBytecode): * parser/ASTBuilder.h: (JSC::ASTBuilder::createClassExpr): (JSC::ASTBuilder::createBlockStatement): (JSC::ASTBuilder::createForLoop): (JSC::ASTBuilder::createForInLoop): (JSC::ASTBuilder::createForOfLoop): (JSC::ASTBuilder::createTryStatement): (JSC::ASTBuilder::createSwitchStatement): * parser/NodeConstructors.h: (JSC::ForNode::ForNode): (JSC::TryNode::TryNode): (JSC::ClassExprNode::ClassExprNode): (JSC::SwitchNode::SwitchNode): (JSC::BlockNode::BlockNode): (JSC::EnumerationNode::EnumerationNode): (JSC::ForInNode::ForInNode): (JSC::ForOfNode::ForOfNode): * parser/Nodes.cpp: (JSC::ScopeNode::ScopeNode): (JSC::ProgramNode::ProgramNode): (JSC::ModuleProgramNode::ModuleProgramNode): (JSC::EvalNode::EvalNode): (JSC::FunctionNode::FunctionNode): (JSC::VariableEnvironmentNode::VariableEnvironmentNode): * parser/Nodes.h: (JSC::VariableEnvironmentNode::VariableEnvironmentNode): Deleted. * parser/Parser.cpp: (JSC::isPrivateFieldName): (JSC::Parser::parseInner): (JSC::Parser::parseForStatement): (JSC::Parser::parseSwitchStatement): (JSC::Parser::parseTryStatement): (JSC::Parser::parseBlockStatement): (JSC::Parser::parseFunctionDeclarationStatement): (JSC::Parser::parseFunctionInfo): (JSC::Parser::parseClass): (JSC::Parser::parseBinaryExpression): (JSC::Parser::parseMemberExpression): (JSC::Parser::usePrivateName): Deleted. * parser/Parser.h: (JSC::Scope::finalizeLexicalEnvironment): (JSC::Scope::takeLexicalEnvironment): (JSC::Scope::takeDeclaredVariables): (JSC::Scope::takeFunctionDeclarations): (JSC::Scope::forEachUsedVariable): (JSC::Scope::usePrivateName): (JSC::Scope::currentUsedVariablesSize): (JSC::Parser::popScopeInternal): (JSC::Parser::popScope): (JSC::Parser::parse): (JSC::Scope::copyUndeclaredPrivateNamesTo): Deleted. (JSC::Scope::hasUsedButUndeclaredPrivateNames const): Deleted. (JSC::Parser::privateNameScope): Deleted. (JSC::Parser::copyUndeclaredPrivateNamesToOuterScope): Deleted. * parser/SyntaxChecker.h: (JSC::SyntaxChecker::createClassExpr): (JSC::SyntaxChecker::createBlockStatement): (JSC::SyntaxChecker::createForLoop): (JSC::SyntaxChecker::createForInLoop): (JSC::SyntaxChecker::createForOfLoop): (JSC::SyntaxChecker::createTryStatement): (JSC::SyntaxChecker::createSwitchStatement): * parser/VariableEnvironment.cpp: (JSC::VariableEnvironmentEntry::dump const): (JSC::VariableEnvironment::declarePrivateField): (JSC::VariableEnvironment::declarePrivateAccessor): (JSC::VariableEnvironment::declarePrivateMethod): (JSC::VariableEnvironment::dump const): * parser/VariableEnvironment.h: (JSC::VariableEnvironment::declarePrivateField): (JSC::VariableEnvironment::privateNameEnvironment): (JSC::VariableEnvironment::addPrivateNamesFrom): (JSC::PrivateNameEntry::isUsed const): Deleted. (JSC::PrivateNameEntry::isDeclared const): Deleted. (JSC::PrivateNameEntry::setIsUsed): Deleted. (JSC::PrivateNameEntry::setIsDeclared): Deleted. (JSC::VariableEnvironment::usePrivateName): Deleted. (JSC::VariableEnvironment::copyPrivateNamesTo const): Deleted. (JSC::VariableEnvironment::copyUndeclaredPrivateNamesTo const): Deleted. 2021-06-30 Mark Lam ARM64: Disable selection of BFI instruction variants by default. https://bugs.webkit.org/show_bug.cgi?id=227554 rdar://79978150 Reviewed by Saam Barati. We suspect that this may have caused some hangs. Disabling while we investigate. * b3/B3LowerToAir.cpp: * b3/testb3_2.cpp: (testInsertBitField32): (testInsertBitField64): * runtime/OptionsList.h: 2021-06-29 Joonghun Park Remove "function declared ‘static’ but never defined" build warnings since r278971. https://bugs.webkit.org/show_bug.cgi?id=227436 This patch removes the build warnings below. warning: ‘bool JSC::cannotBeIdentPartOrEscapeStart(LChar)’ declared ‘static’ but never defined [-Wunused-function] Reviewed by Michael Catanzaro. * runtime/LiteralParser.cpp: Add definitions for cannotBeIdentPartOrEscapeStart. (JSC::cannotBeIdentPartOrEscapeStart): 2021-06-29 Yijia Huang Add a new pattern to instruction selector to use SBX and SBFIZ supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227203 Reviewed by Filip Pizlo. This patch includes two modifications: 1. Introduce a strength reduction rule for sign extending bitfield. 2. Add Signed Bitfield Extract (SBFX) and Signed Bitfield Insert in Zero (SBFIZ) to Air opcode to serve instruction selector. ------------------------------------------------------- ### Part A Sign extending from a variable bit-width ### ------------------------------------------------------- According to Bit Twiddling Hacks, there are two ways to sign extend bitfield. (https://graphics.stanford.edu/~seander/bithacks.html#VariableSignExtend) int bf; // sign extend this width-bit number to bfsx int width; // number of bits representing the number in bf int bfsx; // resulting sign-extended number Approach 1 mask1 = (1 << width) - 1 mask2 = 1 << (width - 1) bf = bf & mask1 // zero bits in bf above position width bfsx = (bf ^ mask2) - mask2 Approach 2 amount = CHAR_BIT * sizeof(bf) - width bfsx = (bf << amount) >> amount Then, a new strength reduction rule is introduced: Turn this: ((bf & mask1) ^ mask2) - mask2 Into this: (bf << amount) >> amount ------------------- ### Part B SBFX ### ------------------- Given instruction: sbfx Rd, Rn, lsb, width Signed Bitfield Extract (SBFX) extracts width number of adjacent bits at lsb position from a register Rn, sign-extends them to the size of the register, and writes the result to the destination register Rd. The equivalent patterns of this instruction are: Pattern 1: bf = src >> lsb dst = ((bf & mask1) ^ mask2) - mask2 mask1 = (1 << width) - 1 mask2 = 1 << (width - 1) // (mask2 << 1) - 1 = mask1 Pattern 2: bf = src >> lsb amount = CHAR_BIT * sizeof(bf) - width dst = (bf << amount) >> amount Then, (bf << amount) >> amount is selected as the canonical form with the strength reduction rule introduced above. Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = lsb Int @2 = amount Int @3 = ZShr(@0, @1) Int @4 = Shl(@3, @2) Int @5 = SShr(@4, @2) Void@6 = Return(@5, Terminal) Before Adding BIC: // Old optimized AIR Urshift %x0, lsb, %x0, @3 Lshift %x0, amount, %x0, @4 Rshift %x0, amount, %x0, @5 Ret %x0, @6 After Adding BIC: // New optimized AIR ExtractSignedBitfield %x0, lsb, width, %x0, @5 Ret %x0, @6 -------------------- ### Part B SBFIZ ### -------------------- Given instruction: sbfiz Rd, Rn, lsb, width Signed Bitfield Insert in Zero (SBFIZ) zeroes the destination register Rd and copies width number of contiguous bits from a source register Rn into lsb position in the destination register, sign-extending the most significant bit of the transferred value. The equivalent patterns of this instruction are: Pattern 1: bfsx = ((src & mask1) ^ mask2) - mask2 dst = bfsx << lsb mask1 = (1 << width) - 1 mask2 = 1 << (width - 1) // (mask2 << 1) - 1 = mask1 Pattern 2: amount = CHAR_BIT * sizeof(bf) - width bfsx = (src << amount) >> amount dst = bfsx << lsb Then, ((src << amount) >> amount) << lsb is selected as the canonical form with the strength reduction rule introduced above. Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = lsb Int @2 = amount Int @3 = Shl(@0, @2) Int @4 = SShr(@3, @2) Int @5 = Shl(@4, @1) Void@6 = Return(@5, Terminal) Before Adding BIC: // Old optimized AIR Lshift %x0, amount, %x0, @3 Rshift %x0, amount, %x0, @4 Lshift %x0, lsb, %x0, @5 Ret %x0, @6 After Adding BIC: // New optimized AIR InsertSignedBitfieldInZero %x0, lsb, width, %x0, @5 Ret %x0, @6 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::insertSignedBitfieldInZero32): (JSC::MacroAssemblerARM64::insertSignedBitfieldInZero64): (JSC::MacroAssemblerARM64::extractSignedBitfield32): (JSC::MacroAssemblerARM64::extractSignedBitfield64): * assembler/testmasm.cpp: (JSC::testInsertSignedBitfieldInZero32): (JSC::testInsertSignedBitfieldInZero64): (JSC::testExtractSignedBitfield32): (JSC::testExtractSignedBitfield64): * b3/B3LowerToAir.cpp: * b3/B3ReduceStrength.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (addBitTests): * b3/testb3_3.cpp: (testInsertSignedBitfieldInZero32): (testInsertSignedBitfieldInZero64): (testExtractSignedBitfield32): (testExtractSignedBitfield64): 2021-06-28 Yijia Huang Add a new pattern to instruction selector to use BIC supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227202 Reviewed by Filip Pizlo. This patch includes three modifications: 1. Add bit clear (BIC), or not (ORN), and extract and insert bitfield at the lower end (BFXIL) to Air opcode to serve instruction selector. 2. Add bitfield clear (BFC) to MacroAssembler. 4. Do refactoring - rename Air opcodes added in the previous patches. ------------------ ### Part A BIC ### ------------------ Given the operation: bic Rd, Rn, Rm The BIC (Bit Clear) instruction performs an AND operation on the bits in Rn with the complements of the corresponding bits in the value of Rm. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. The equivalent patterns of this instruction are: Pattern 1: d = n & (-m - 1) Pattern 2: d = n & (m ^ -1) In order to get benefits for complement operation, the current instruction selector uses mvn instruction to lower the pattern value ^ -1. Then, a new strength reduction rule is introduced: Turn this: -value - 1 Into this: value ^ -1 So, d = n & (m ^ -1) is selected as the canonical form. Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = -1 Int @3 = BitXor(@1, @2) Int @4 = BitAnd(@0, @3) Void@5 = Return(@4, Terminal) Before Adding BIC: // Old optimized AIR Not %x1, %x1, @3 And %x0, %x1, %x0, @4 Ret %x0, @5 After Adding BIC: // New optimized AIR Bic %x0, %x1, %x0, @4 Ret %x0, @5 ------------------ ### Part A ORN ### ------------------ Given the operation: orn Rd, Rn, Rm Bitwise OR NOT (shifted register) performs a bitwise (inclusive) OR of a register value Rn and the complement of an optionally-shifted register value Rm, and writes the result to the destination register Rd. The equivalent patterns of this instruction are: Pattern 1: d = n | (-m - 1) Pattern 2: d = n | (m ^ -1) Then, d = n | (m ^ -1) is selected as the canonical form. Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = -1 Int @3 = BitXor(@1, @2) Int @4 = BitOr(@0, @3) Void@5 = Return(@4, Terminal) Before Adding BIC: // Old optimized AIR Not %x1, %x1, @3 Or %x0, %x1, %x0, @4 Ret %x0, @5 After Adding BIC: // New optimized AIR Orn %x0, %x1, %x0, @4 Ret %x0, @5 -------------------- ### Part A BFXIL ### -------------------- Given the operation: bfxil Rd, Rn, lsb, width Bitfield extract and insert at low end(BFXIL) copies any number of low-order bits from a source register into the same number of adjacent bits at the low end in the destination register, leaving other bits unchanged. The equivalent patterns of this instruction are: Pattern 1: mask1 = (1 << width) - 1 mask2 = ~mask1 ((n >> lsb) & mask1) | (d & mask2) Pattern 2: mask1 = ((1 << width) - 1) << lsb mask2 = ~(mask1 >> lsb) ((n & mask1) >> lsb) | (d & mask2) Then, introduce a strength reduction rule for easier recognization. Turn this: (v & maskShift) >> shiftAmount Into this: (v >> shiftAmount) & mask with constraints: 1. maskShift = mask << lsb 2. mask = (1 << width) - 1 3. 0 <= shiftAmount < datasize 4. 0 < width < datasize 5. shiftAmount + width <= datasize The canonical form to match BFXIL is d = ((n >> lsb) & mask1) | (d & mask2). Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = lsb Int @3 = mask1 Int @4 = mask2 Int @5 = BitAnd(@1, @3) Int @6 = BitAnd(@0, @4)) Int @7 = ZShr(@5, @2) Int @8 = BitOr(@7, @6) Void@9 = Return(@8, Terminal) Before Adding BIC: // Old optimized AIR And mask2, %x0, %x0, @6 ExtractUnsignedBitfield %x1, lsb, width, %x1, @7 Or %x0, %x1, %x0, @8 Ret %x0, @9 After Adding BIC: // New optimized AIR ExtractInsertBitfieldAtLowEnd %x1, lsb, width, %x0, @8 Ret64 %x0, @9 -------------- ### Part B ### -------------- The Bitfield Clear (BFC), leaving other bits unchanged, is similar to BFI which is an alias of BFM. Given the operation: bfc Rd, lsb, width The equivalent pattern of this instruction is: mask = ((1 << width) - 1) << lsb d = d & ~mask Since mask is a constant and B3 performs constant fold in the optimization phase, this pattern will directly lower to the BitAnd binary operation. So, no need to match this pattern. -------------- ### Part C ### -------------- At MacroAssembler level, the emitters are exepected to be expressed in english (e.g. something like clearBitField for BFC). Do refactoring to rename Air opcode for UBFX, UBFIZ, BFI, and BIC. * assembler/ARM64Assembler.h: (JSC::ARM64Assembler::bfc): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::extractUnsignedBitfield32): (JSC::MacroAssemblerARM64::extractUnsignedBitfield64): (JSC::MacroAssemblerARM64::insertUnsignedBitfieldInZero32): (JSC::MacroAssemblerARM64::insertUnsignedBitfieldInZero64): (JSC::MacroAssemblerARM64::insertBitField32): (JSC::MacroAssemblerARM64::insertBitField64): (JSC::MacroAssemblerARM64::clearBitField32): (JSC::MacroAssemblerARM64::clearBitField64): (JSC::MacroAssemblerARM64::clearBitsWithMask32): (JSC::MacroAssemblerARM64::clearBitsWithMask64): (JSC::MacroAssemblerARM64::orNot32): (JSC::MacroAssemblerARM64::orNot64): (JSC::MacroAssemblerARM64::ubfx32): Deleted. (JSC::MacroAssemblerARM64::ubfx64): Deleted. (JSC::MacroAssemblerARM64::ubfiz32): Deleted. (JSC::MacroAssemblerARM64::ubfiz64): Deleted. (JSC::MacroAssemblerARM64::bitFieldInsert32): Deleted. (JSC::MacroAssemblerARM64::bitFieldInsert64): Deleted. * assembler/testmasm.cpp: (JSC::testMultiplySignExtend32): (JSC::testMultiplySubSignExtend32): (JSC::testExtractUnsignedBitfield32): (JSC::testExtractUnsignedBitfield64): (JSC::testInsertUnsignedBitfieldInZero32): (JSC::testInsertUnsignedBitfieldInZero64): (JSC::testInsertBitField32): (JSC::testInsertBitField64): (JSC::testClearBitField32): (JSC::testClearBitField64): (JSC::testClearBitsWithMask32): (JSC::testClearBitsWithMask64): (JSC::testOrNot32): (JSC::testOrNot64): (JSC::testMul32SignExtend): Deleted. (JSC::testMulSubSignExtend32): Deleted. (JSC::testUbfx32): Deleted. (JSC::testUbfx64): Deleted. (JSC::testUbfiz32): Deleted. (JSC::testUbfiz64): Deleted. (JSC::testBitFieldInsert32): Deleted. (JSC::testBitFieldInsert64): Deleted. * b3/B3LowerToAir.cpp: * b3/B3ReduceStrength.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testInsertBitField32): (testInsertBitField64): (testBIC32): (testBIC64): (testOrNot32): (testOrNot64): (addBitTests): (testBitFieldInsert32): Deleted. (testBitFieldInsert64): Deleted. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::cageWithoutUntagging): (JSC::AssemblyHelpers::cageConditionallyAndUntag): 2021-06-28 Mikhail R. Gadelha Add LLInt fast path for less, lesseq, greater and greatereq https://bugs.webkit.org/show_bug.cgi?id=226266 Reviewed by Tadeu Zagallo. The motivation is to add fast path for integers and doubles in LLInt, so we don't need to go to slow path for those cases. This patch implements the less, lesseq, greater, greatereq instruction for ARMv7, MIPS and CLoop. Microbenchmarking results: * x86_64: number-comparison-inline definitely 1.3520x faster * ARMv7: number-comparison-inline definitely 1.3520x faster JetStream2 results: * x86_64 jit: 1.015 times better * x86_64 no-jit: 1.018 times better * ARMv7 no-jit: 1.004 times worse * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * llint/LowLevelInterpreter64.asm: * offlineasm/arm.rb: * offlineasm/cloop.rb: * offlineasm/mips.rb: 2021-06-28 Mikhail R. Gadelha Prevent sign-extended casts for 32 bits arch https://bugs.webkit.org/show_bug.cgi?id=227170 Reviewed by Yusuke Suzuki. In a number of places, addresses are reinterpreted as uint64, which can lead to wrong addresses in 32 bits arch. * assembler/testmasm.cpp: (JSC::testBranchTruncateDoubleToInt32): * disassembler/ARM64/A64DOpcode.h: (JSC::ARM64Disassembler::A64DOpcode::appendPCRelativeOffset): * runtime/JSCell.cpp: (JSC::reportZappedCellAndCrash): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitEntryTierUpCheck): (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::emitEntryTierUpCheck): (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): 2021-06-25 Commit Queue Unreviewed, reverting r279266. https://bugs.webkit.org/show_bug.cgi?id=227402 Causes crash loop Reverted changeset: "Remove references to order files" https://bugs.webkit.org/show_bug.cgi?id=227377 https://trac.webkit.org/changeset/279266 2021-06-24 Sihui Liu Remove references to order files https://bugs.webkit.org/show_bug.cgi?id=227377 rdar://76070556 Reviewed by Mark Lam. * Configurations/JavaScriptCore.xcconfig: 2021-06-24 Asumu Takikawa [WASM-Function-References] Add support for (ref null? $t) type constructor https://bugs.webkit.org/show_bug.cgi?id=226296 Reviewed by Yusuke Suzuki. Adds the `ref` type constructor from the typed function references proposal: https://github.com/WebAssembly/function-references/blob/master/proposals/function-references/Overview.md It's also required for the type imports and GC proposals as well. Ref types represent references to any heap type (including existing funcref and externref) with a specified nullability. This requires a new isNullable flag in the type representation. This flag also enables non-null externref and funcrefs, and hence this commit also adds the necessary checks at Wasm/JS boundaries. Non-null reference types also generally cannot be used as function locals. * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::gTypeIdx): (JSC::Wasm::AirIRGenerator::tmpForType): (JSC::Wasm::AirIRGenerator::emitCCall): (JSC::Wasm::AirIRGenerator::moveOpForValueType): (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::addLocal): (JSC::Wasm::AirIRGenerator::addConstant): (JSC::Wasm::AirIRGenerator::addRefFunc): * wasm/WasmCallingConvention.h: (JSC::Wasm::WasmCallingConvention::marshallLocation const): (JSC::Wasm::JSCallingConvention::marshallLocation const): * wasm/WasmFormat.h: (JSC::Wasm::isSubtype): (JSC::Wasm::isValidHeapTypeKind): (JSC::Wasm::isDefaultableType): * wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser::parse): (JSC::Wasm::FunctionParser::parseAnnotatedSelectImmediates): (JSC::Wasm::FunctionParser::checkBranchTarget): (JSC::Wasm::FunctionParser::parseExpression): * wasm/WasmGlobal.cpp: (JSC::Wasm::Global::get const): (JSC::Wasm::Global::set): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::callInformationForCaller): (JSC::Wasm::LLIntGenerator::callInformationForCallee): (JSC::Wasm::LLIntGenerator::addArguments): * wasm/WasmParser.h: (JSC::Wasm::Parser::parseBlockSignature): (JSC::Wasm::Parser::parseValueType): (JSC::Wasm::Parser::parseRefType): * wasm/WasmSectionParser.cpp: (JSC::Wasm::SectionParser::parseType): (JSC::Wasm::SectionParser::parseElement): (JSC::Wasm::SectionParser::parseInitExpr): (JSC::Wasm::SectionParser::parseElementSegmentVectorOfExpressions): (JSC::Wasm::SectionParser::parseGlobalType): * wasm/WasmSignature.cpp: (JSC::Wasm::computeHash): * wasm/generateWasmOpsHeader.py: * wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS): * wasm/js/WebAssemblyFunction.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * wasm/js/WebAssemblyFunctionBase.h: (JSC::WebAssemblyFunctionBase::offsetOfSignatureIndex): * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::linkImpl): * wasm/wasm.json: 2021-06-24 Mark Lam Use ldp and stp more for saving / restoring registers on ARM64. https://bugs.webkit.org/show_bug.cgi?id=227039 rdar://79354736 Reviewed by Saam Barati. This patch introduces a spooler abstraction in AssemblyHelpers. The spooler basically batches up load / store operations and emit them as pair instructions if appropriate. There are 4 spooler classes: a. Spooler - template base class for LoadRegSpooler and StoreRegSpooler. - encapsulates the batching strategy for load / store pairs. b. LoadRegSpooler - specializes Spooler to handle load pairs. b. StoreRegSpooler - specializes Spooler to handle store pairs. d. CopySpooler - handles matching loads with stores. - tries to emit loads as load pairs if possible. - tries to emot stores as store pairs if possible. - ensures that pre-requisite loads are emitted before stores are emitted. - other than loads, also support constants and registers as sources of values to be stored. This is useful in OSR exit ramps where we may materialize a stack value to store from constants or registers in addition to values we load from the old stack frame or from a scratch buffer. In this patch, we also do the following: 1. Use spoolers in many places so that we can emit load / store pairs instead of single load / stores. This helps shrink JIT code side, and also potentially improves performance. 2. In DFG::OSRExit::compileExit(), we used to recover constants into a scratch buffer, and then later, load from that scratch buffer to store into the new stack frame(s). This patch changes it so that we defer constant recovery until the final loop where we store the recovered value directly into the new stack frame(s). This saves us the work (and JIT code space) for storing into a scratch buffer and then reloading from the scratch buffer. There is one exception: tmp values used by active checkpoints. We need to call operationMaterializeOSRExitSideState() to materialize the active checkpoint side state before the final loop where we now recover constants. Hence, we need these tmp values recovered before hand. So, we check upfront if we have active checkpoint side state to materialize. If so, we'll eagerly recover the constants for initializing those tmps. We also use the CopySpooler in the final loop to emit load / store pairs for filling in the new stack frame(s). One more thing: it turns out that the vast majority of constants to be recovered is simply the undefined value. So, as an optimization, the final loop keeps the undefined value in a register, and has the spooler store directly from that register when appropriate. This saves on JIT code to repeatedly materialize the undefined JSValue constant. 3. In reifyInlinedCallFrames(), replace the use of GPRInfo::nonArgGPR0 with GPRInfo::regT4. nonArgGPRs are sometimes map to certain regTXs on certain ports. Replacing with regT4 makes it easier to ensure that we're not trashing the register when we use more temp registers. reifyInlinedCallFrames() will be using emitSaveOrCopyLLIntBaselineCalleeSavesFor() later where we need more temp registers. 4. Move the following functions to AssemblyHelpers.cpp. They don't need to be inline functions. Speedometer2 and JetStream2 shows that making these non inline does not hurt performance: AssemblyHelpers::emitSave(const RegisterAtOffsetList&); AssemblyHelpers::emitRestore(const RegisterAtOffsetList&); AssemblyHelpers::emitSaveCalleeSavesFor(const RegisterAtOffsetList*); AssemblyHelpers::emitSaveOrCopyCalleeSavesFor(...); AssemblyHelpers::emitRestoreCalleeSavesFor(const RegisterAtOffsetList*); AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer(...); Also renamed emitSaveOrCopyCalleeSavesFor() to emitSaveOrCopyLLIntBaselineCalleeSavesFor() because it is only used with baseline codeBlocks. Results: Cummulative LinkBuffer profile sizes shrunk by ~2M in aggregate: base new ==== === BaselineJIT: 83827048 (79.943703 MB) => 83718736 (79.840408 MB) DFG: 56594836 (53.973042 MB) => 56603508 (53.981312 MB) InlineCache: 33923900 (32.352352 MB) => 33183156 (31.645924 MB) FTL: 6770956 (6.457287 MB) => 6568964 (6.264652 MB) DFGOSRExit: 5212096 (4.970642 MB) => 3728088 (3.555382 MB) CSSJIT: 748428 (730.886719 KB) => 748428 (730.886719 KB) FTLOSRExit: 692276 (676.050781 KB) => 656884 (641.488281 KB) YarrJIT: 445280 (434.843750 KB) => 512988 (500.964844 KB) FTLThunk: 22908 (22.371094 KB) => 22556 (22.027344 KB) BoundFunctionThunk: 8400 (8.203125 KB) => 10088 (9.851562 KB) ExtraCTIThunk: 6952 (6.789062 KB) => 6824 (6.664062 KB) SpecializedThunk: 4508 (4.402344 KB) => 4508 (4.402344 KB) Thunk: 3912 (3.820312 KB) => 3784 (3.695312 KB) LLIntThunk: 2908 (2.839844 KB) => 2908 (2.839844 KB) VirtualThunk: 1248 (1.218750 KB) => 1248 (1.218750 KB) DFGThunk: 1084 (1.058594 KB) => 444 DFGOSREntry: 216 => 184 JumpIsland: 0 WasmThunk: 0 Wasm: 0 Uncategorized: 0 Total: 188266956 (179.545361 MB) => 185773296 (177.167221 MB) Speedometer2 and JetStream2 results shows that performance is neutral for this patch (as measured on an M1 Mac): Speedometer2: ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |129.037500 |127.212500 |0.985857 | 0.012706 | | VueJS-TodoMVC |28.312500 |27.525000 |0.972185 | 0.240315 | | EmberJS-TodoMVC |132.550000 |132.025000 |0.996039 | 0.538034 | | Flight-TodoMVC |80.762500 |80.875000 |1.001393 | 0.914749 | | BackboneJS-TodoMVC |51.637500 |51.175000 |0.991043 | 0.285427 | | Preact-TodoMVC |21.025000 |22.075000 |1.049941 | 0.206140 | | AngularJS-TodoMVC |142.900000 |142.887500 |0.999913 | 0.990681 | | Inferno-TodoMVC |69.300000 |69.775000 |1.006854 | 0.505201 | | Vanilla-ES2015-TodoMVC |71.500000 |71.225000 |0.996154 | 0.608650 | | Angular2-TypeScript-TodoMVC |43.287500 |43.275000 |0.999711 | 0.987926 | | VanillaJS-TodoMVC |57.212500 |57.812500 |1.010487 | 0.333357 | | jQuery-TodoMVC |276.150000 |276.775000 |1.002263 | 0.614404 | | EmberJS-Debug-TodoMVC |353.612500 |352.762500 |0.997596 | 0.518836 | | React-TodoMVC |93.637500 |92.637500 |0.989321 | 0.036277 | | React-Redux-TodoMVC |158.237500 |156.587500 |0.989573 | 0.042154 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |68.050000 |68.087500 |1.000551 | 0.897149 | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 236.26950 b mean = 236.57964 pValue = 0.7830785938 (Bigger means are better.) 1.001 times better Results ARE NOT significant JetStream2: ------------------------------------------------------------------------------------------------------------------------- | subtest | pts | pts | b / a | pValue (significance using False Discovery Rate) | ------------------------------------------------------------------------------------------------------------------------- | gaussian-blur |542.570057 |542.671885 |1.000188 | 0.982573 | | HashSet-wasm |57.710498 |64.406371 |1.116025 | 0.401424 | | gcc-loops-wasm |44.516009 |44.453535 |0.998597 | 0.973651 | | json-parse-inspector |241.275085 |240.720491 |0.997701 | 0.704732 | | prepack-wtb |62.640114 |63.754878 |1.017796 | 0.205840 | | date-format-xparb-SP |416.976817 |448.921409 |1.076610 | 0.052977 | | WSL |1.555257 |1.570233 |1.009629 | 0.427924 | | OfflineAssembler |177.052352 |179.746511 |1.015217 | 0.112114 | | cdjs |192.517586 |194.598906 |1.010811 | 0.025807 | | UniPoker |514.023694 |526.111500 |1.023516 | 0.269892 | | json-stringify-inspector |227.584725 |223.619390 |0.982576 | 0.102714 | | crypto-sha1-SP |980.728788 |984.192104 |1.003531 | 0.838618 | | Basic |685.148483 |711.590247 |1.038593 | 0.142952 | | chai-wtb |106.256376 |106.590318 |1.003143 | 0.865894 | | crypto-aes-SP |722.308829 |728.702310 |1.008851 | 0.486766 | | Babylon |655.857561 |654.204901 |0.997480 | 0.931520 | | string-unpack-code-SP |407.837271 |405.710752 |0.994786 | 0.729122 | | stanford-crypto-aes |456.906021 |449.993856 |0.984872 | 0.272994 | | raytrace |883.911335 |902.887238 |1.021468 | 0.189785 | | multi-inspector-code-load |409.997347 |405.643639 |0.989381 | 0.644447 | | hash-map |593.590160 |601.576332 |1.013454 | 0.249414 | | stanford-crypto-pbkdf2 |722.178638 |728.283532 |1.008453 | 0.661195 | | coffeescript-wtb |42.393544 |41.869545 |0.987640 | 0.197441 | | Box2D |452.034685 |454.104868 |1.004580 | 0.535342 | | richards-wasm |140.873688 |148.394050 |1.053384 | 0.303651 | | lebab-wtb |61.671318 |62.119403 |1.007266 | 0.620998 | | tsf-wasm |108.592794 |119.498398 |1.100427 | 0.504710 | | base64-SP |629.744643 |603.425565 |0.958207 | 0.049997 | | navier-stokes |740.588523 |739.951662 |0.999140 | 0.871445 | | jshint-wtb |51.938359 |52.651104 |1.013723 | 0.217137 | | regex-dna-SP |459.251148 |463.492489 |1.009235 | 0.371891 | | async-fs |235.853820 |236.031189 |1.000752 | 0.938459 | | first-inspector-code-load |275.298325 |274.172125 |0.995909 | 0.623403 | | segmentation |44.002842 |43.445960 |0.987344 | 0.207134 | | typescript |26.360161 |26.458820 |1.003743 | 0.609942 | | octane-code-load |1126.749036 |1087.132024 |0.964840 | 0.524171 | | float-mm.c |16.691935 |16.721354 |1.001762 | 0.194425 | | quicksort-wasm |461.630091 |450.161127 |0.975156 | 0.371394 | | Air |392.442375 |412.201810 |1.050350 | 0.046887 | | splay |510.111886 |475.131657 |0.931426 | 0.024732 | | ai-astar |607.966974 |626.573181 |1.030604 | 0.468711 | | acorn-wtb |67.510766 |68.143956 |1.009379 | 0.481663 | | gbemu |144.133842 |145.620304 |1.010313 | 0.802154 | | richards |963.475078 |946.658879 |0.982546 | 0.231189 | | 3d-cube-SP |549.426784 |550.479154 |1.001915 | 0.831307 | | espree-wtb |68.707483 |73.762202 |1.073569 | 0.033603 | | bomb-workers |96.882596 |96.116121 |0.992089 | 0.687952 | | tagcloud-SP |309.888767 |303.538511 |0.979508 | 0.187768 | | mandreel |133.667031 |135.009929 |1.010047 | 0.075232 | | 3d-raytrace-SP |491.967649 |492.528992 |1.001141 | 0.957842 | | delta-blue |1066.718312 |1080.230772 |1.012667 | 0.549382 | | ML |139.617293 |140.088630 |1.003376 | 0.661651 | | regexp |351.773956 |351.075935 |0.998016 | 0.769250 | | crypto |1510.474663 |1519.218842 |1.005789 | 0.638420 | | crypto-md5-SP |795.447899 |774.082493 |0.973140 | 0.079728 | | earley-boyer |812.574545 |870.678372 |1.071506 | 0.044081 | | octane-zlib |25.162470 |25.660261 |1.019783 | 0.554591 | | date-format-tofte-SP |395.296135 |398.008992 |1.006863 | 0.650475 | | n-body-SP |1165.386611 |1150.525110 |0.987248 | 0.227908 | | pdfjs |189.060252 |191.015628 |1.010343 | 0.633777 | | FlightPlanner |908.426192 |903.636642 |0.994728 | 0.838821 | | uglify-js-wtb |34.029399 |34.164342 |1.003965 | 0.655652 | | babylon-wtb |81.329869 |80.855680 |0.994170 | 0.854393 | | stanford-crypto-sha256 |826.850533 |838.494164 |1.014082 | 0.579636 | ------------------------------------------------------------------------------------------------------------------------- a mean = 237.91084 b mean = 239.92670 pValue = 0.0657710897 (Bigger means are better.) 1.008 times better Results ARE NOT significant * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * assembler/MacroAssembler.h: (JSC::MacroAssembler::pushToSaveByteOffset): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::pushToSaveByteOffset): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::reifyInlinedCallFrames): * dfg/DFGThunks.cpp: (JSC::DFG::osrExitGenerationThunkGenerator): * ftl/FTLSaveRestore.cpp: (JSC::FTL::saveAllRegisters): (JSC::FTL::restoreAllRegisters): * ftl/FTLSaveRestore.h: * ftl/FTLThunks.cpp: (JSC::FTL::genericGenerationThunkGenerator): (JSC::FTL::slowPathCallThunkGenerator): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer): (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBufferImpl): (JSC::AssemblyHelpers::emitSave): (JSC::AssemblyHelpers::emitRestore): (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor): (JSC::AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer): (JSC::AssemblyHelpers::emitSaveOrCopyLLIntBaselineCalleeSavesFor): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::copyLLIntBaselineCalleeSavesFromFrameOrRegisterToEntryFrameCalleeSavesBuffer): (JSC::AssemblyHelpers::emitSave): Deleted. (JSC::AssemblyHelpers::emitRestore): Deleted. (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor): Deleted. * jit/AssemblyHelpersSpoolers.h: Added. (JSC::AssemblyHelpers::Spooler::Spooler): (JSC::AssemblyHelpers::Spooler::handleGPR): (JSC::AssemblyHelpers::Spooler::finalizeGPR): (JSC::AssemblyHelpers::Spooler::handleFPR): (JSC::AssemblyHelpers::Spooler::finalizeFPR): (JSC::AssemblyHelpers::Spooler::op): (JSC::AssemblyHelpers::LoadRegSpooler::LoadRegSpooler): (JSC::AssemblyHelpers::LoadRegSpooler::loadGPR): (JSC::AssemblyHelpers::LoadRegSpooler::finalizeGPR): (JSC::AssemblyHelpers::LoadRegSpooler::loadFPR): (JSC::AssemblyHelpers::LoadRegSpooler::finalizeFPR): (JSC::AssemblyHelpers::LoadRegSpooler::handlePair): (JSC::AssemblyHelpers::LoadRegSpooler::handleSingle): (JSC::AssemblyHelpers::StoreRegSpooler::StoreRegSpooler): (JSC::AssemblyHelpers::StoreRegSpooler::storeGPR): (JSC::AssemblyHelpers::StoreRegSpooler::finalizeGPR): (JSC::AssemblyHelpers::StoreRegSpooler::storeFPR): (JSC::AssemblyHelpers::StoreRegSpooler::finalizeFPR): (JSC::AssemblyHelpers::StoreRegSpooler::handlePair): (JSC::AssemblyHelpers::StoreRegSpooler::handleSingle): (JSC::RegDispatch::get): (JSC::RegDispatch::temp1): (JSC::RegDispatch::temp2): (JSC::RegDispatch::regToStore): (JSC::RegDispatch::invalid): (JSC::RegDispatch::regSize): (JSC::RegDispatch::isValidLoadPairImm): (JSC::RegDispatch::isValidStorePairImm): (JSC::RegDispatch::get): (JSC::RegDispatch::temp1): (JSC::RegDispatch::temp2): (JSC::RegDispatch::regToStore): (JSC::RegDispatch::invalid): (JSC::RegDispatch::regSize): (JSC::RegDispatch::isValidLoadPairImm): (JSC::RegDispatch::isValidStorePairImm): (JSC::AssemblyHelpers::CopySpooler::Source::getReg): (JSC::AssemblyHelpers::CopySpooler::CopySpooler): (JSC::AssemblyHelpers::CopySpooler::temp1 const): (JSC::AssemblyHelpers::CopySpooler::temp2 const): (JSC::AssemblyHelpers::CopySpooler::regToStore): (JSC::AssemblyHelpers::CopySpooler::invalid): (JSC::AssemblyHelpers::CopySpooler::regSize): (JSC::AssemblyHelpers::CopySpooler::isValidLoadPairImm): (JSC::AssemblyHelpers::CopySpooler::isValidStorePairImm): (JSC::AssemblyHelpers::CopySpooler::load): (JSC::AssemblyHelpers::CopySpooler::move): (JSC::AssemblyHelpers::CopySpooler::copy): (JSC::AssemblyHelpers::CopySpooler::store): (JSC::AssemblyHelpers::CopySpooler::flush): (JSC::AssemblyHelpers::CopySpooler::loadGPR): (JSC::AssemblyHelpers::CopySpooler::copyGPR): (JSC::AssemblyHelpers::CopySpooler::moveConstant): (JSC::AssemblyHelpers::CopySpooler::storeGPR): (JSC::AssemblyHelpers::CopySpooler::finalizeGPR): (JSC::AssemblyHelpers::CopySpooler::loadFPR): (JSC::AssemblyHelpers::CopySpooler::copyFPR): (JSC::AssemblyHelpers::CopySpooler::storeFPR): (JSC::AssemblyHelpers::CopySpooler::finalizeFPR): (JSC::AssemblyHelpers::CopySpooler::loadPair): (JSC::AssemblyHelpers::CopySpooler::storePair): * jit/ScratchRegisterAllocator.cpp: (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing): (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping): (JSC::ScratchRegisterAllocator::preserveRegistersToStackForCall): (JSC::ScratchRegisterAllocator::restoreRegistersFromStackForCall): * jit/ScratchRegisterAllocator.h: * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::addReturn): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addReturn): 2021-06-24 Yusuke Suzuki Unreviewed, build fix for ARM64 https://bugs.webkit.org/show_bug.cgi?id=227201 * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::cageWithoutUntagging): (JSC::AssemblyHelpers::cageConditionallyAndUntag): 2021-06-24 Yijia Huang Add a new pattern to instruction selector to utilize BFI supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227201 Reviewed by Filip Pizlo. Bitfield insert(BFI), leaving other bits unchanged. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. Given the operation: bfi d, n, lsb, width The equivalent pattern would be: Pattern 1: mask1 = ((1 << width) - 1) << lsb mask2 = ~mask1 d = ((n << lsb) & mask1) | (d & mask2); Pattern 2: mask1 = (1 << width) - 1 mask2 = ~(mask1 << lsb) d = ((n & mask1) << lsb) | (d & mask2) Current optimizer already has the strength reduction rule: Turn This: (n << lsb) & mask1) Into This: (n & mask1) << lsb) Then, d = ((n & mask1) << lsb) | (d & mask2) is the canonical form. With constraints: 1. 0 <= lsb < datasize 2. 0 < width < datasize 3. lsb + width <= dataszie Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = ArgumentReg(%x1) Int @2 = lsb Int @3 = mask Int @4 = BitAnd(@1, @3) Int @5 = Shl(@4, @2) Int @6 = BitOr(@0, @5) Int @7 = Return(@6, Terminal) Before Adding BFI: // Old optimized AIR And mask, %x1, %x1, @4 Lshift %x1, lsb, %x1, @5 Or %x1, %x0, %x0, @6 Ret %x0, @7 After Adding BFI: // New optimized AIR BitFieldInsert %x1, lsb, width, %x0, @6 Ret %x0, @7 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::bitFieldInsert32): (JSC::MacroAssemblerARM64::bitFieldInsert64): * assembler/testmasm.cpp: (JSC::testUbfx32): (JSC::testUbfx64): (JSC::testUbfiz32): (JSC::testUbfiz64): (JSC::testBitFieldInsert32): (JSC::testBitFieldInsert64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testBitFieldInsert32): (testBitFieldInsert64): (addBitTests): 2021-06-24 Xan López [JSC] Implement returnEarlyFromInfiniteLoopsForFuzzing for 32bits https://bugs.webkit.org/show_bug.cgi?id=227290 Reviewed by Mark Lam. Mostly a matter of changing the counter type to uintptr_t and making the baseline/dfg/ftl code generation work on both 32 and 64bits, most of it can be shared with minor tweaks. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileLoopHint): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_loop_hint): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LowLevelInterpreter32_64.asm: * runtime/VM.cpp: (JSC::VM::addLoopHintExecutionCounter): (JSC::VM::getLoopHintExecutionCounter): * runtime/VM.h: 2021-06-23 Mark Lam Base Options::useWebAssemblyFastMemory's default value on Gigacage::hasCapacityToUseLargeGigacage. https://bugs.webkit.org/show_bug.cgi?id=227328 Reviewed by Saam Barati. Gigacage::hasCapacityToUseLargeGigacage is determined based on EFFECTIVE_ADDRESS_WIDTH. If we have enough address range to potentially use a large gigacage, then we have enough address range to useWebAssemblyFastMemory. * runtime/Options.cpp: (JSC::canUseWebAssemblyFastMemory): * runtime/OptionsList.h: 2021-06-23 Yijia Huang Add a new pattern to instruction selector to utilize UBFIZ supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227204 Reviewed by Filip Pizlo. This patch includes three parts: A) Add UBFIZ to instruction selector. B) Fix UBFX, introduced in https://bugs.webkit.org/show_bug.cgi?id=226984, to match all patterns. C) Fix error condition in one strength reduction rule introduced in https://bugs.webkit.org/show_bug.cgi?id=227138. Part A Unsigned Bitfield Insert in Zero(UBFIZ), supported by ARM64, zeros the destination register and copies any number of contiguous bits from a source register into any position in the destination register. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. Given the operation: ubfiz d, n, lsb, width This is equivalent to "d = (n << lsb) & (((1 << width) - 1) << lsb)". Since wasm introduces constant folding, then the matched patterns would be: 1.1 d = (n << lsb) & maskShift 1.2 d = maskShift & (n << lsb) 2.1 d = (n & mask) << lsb 2.2 d = (mask & n) << lsb Where: maskShift = mask << lsb mask = (1 << width) - 1 To make the pattern matching in instruction selection beneficial to JIT, these constraints should be introduced: 1. 0 <= lsb < datasize 2. 0 < width < datasize 3. lsb + width <= datasize Choose (n & mask) << lsb as the canonical form and introduce a strength reduction. Turn this: (n << lsb) & maskShift Into this: (n & mask) << lsb Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = lsb Int @2 = 0b0110 Int @3 = Shl(@0, @1) Int @4 = BitAnd(@3, @2) Void@5 = Return(@4, Terminal) Before Adding UBFIZ Pattern: // Old optimized AIR Lshift %x0, $62, %x0, @3 And 0b0110, %x0, %x0, @4 Ret %x0, @5 After Adding UBFIZ Pattern: // New optimized AIR Ubfiz %x0, lsb, 2, %x0, @4 Ret %x0, @5 Part B Fix UBFX to match both patterns: dest = (src >> lsb) & mask dest = mask & (src >> lsb) Where: 1. mask = (1 << width) - 1 2. 0 <= lsb < datasize 3. 0 < width < datasize 4. lsb + width <= datasize Part C Fix one B3 strength reduction. Turn this: (src >> shiftAmount) & mask Into this: src >> shiftAmount With updated constraints: 1. mask = (1 << width) - 1 2. 0 <= shiftAmount < datasize 3. 0 < width < datasize 4. shiftAmount + width >= datasize * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::ubfiz32): (JSC::MacroAssemblerARM64::ubfiz64): * assembler/testmasm.cpp: (JSC::testUbfiz32): (JSC::testUbfiz64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testUbfx32ArgLeft): (testUbfx32ArgRight): (testUbfx64ArgLeft): (testUbfx64ArgRight): (testUbfiz32ArgLeft): (testUbfiz32ArgRight): (testUbfiz64ArgLeft): (testUbfiz64ArgRight): (addBitTests): (testUbfx32): Deleted. (testUbfx32PatternMatch): Deleted. (testUbfx64): Deleted. (testUbfx64PatternMatch): Deleted. 2021-06-23 Keith Miller add/removeManagedReference:withOwner: should have autoreleasepools https://bugs.webkit.org/show_bug.cgi?id=227308 Reviewed by Darin Adler. Since these APIs create autoreleased objects as an implementation detail but don't return any to the caller there's no indication such autoreleased objects could be accumulating. Additionally, it's entirely reasonable to call these methods in a loop an a large set of objects, which further exacerbates the problem. * API/JSVirtualMachine.mm: (-[JSVirtualMachine addManagedReference:withOwner:]): (-[JSVirtualMachine removeManagedReference:withOwner:]): 2021-06-23 Saam Barati Run lazy properties initializers under a DeferTerminationForAWhile scope https://bugs.webkit.org/show_bug.cgi?id=227271 Reviewed by Mark Lam. We don't expect that exceptions can be thrown when initializing a lazy property. Termination exceptions were preventing this from being true. The latest example found is inside JSModuleLoader when it asserts that no exception is thrown when creating its JSMap field. This patch makes it so termination exceptions can't be thrown when running lazy property initializers. * runtime/LazyPropertyInlines.h: (JSC::ElementType>::initLater): (JSC::ElementType>::callFunc): 2021-06-22 Yijia Huang Add a new pattern to instruction selector to utilize SMADDL supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227188 Reviewed by Saam Barati. Signed Multiply-Add Long(SMADDL), supported by ARM64, multiplies two 32-bit register values, adds a 64-bit register value, and writes the result to the 64-bit destination register. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. Given the operation: smaddl d, n, m, a The equivalent patterns would be: d = a + SExt32(n) * SExt32(m) d = SExt32(n) * SExt32(m) + a Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = SExt32(Trunc(ArgumentReg(%x1))) Int @2 = SExt32(Trunc(ArgumentReg(%x2))) Int @3 = Mul(@1, @2) Int @4 = Add(@0, @3) Void@5 = Return(@4, Terminal) Before Adding SMADDL: // Old optimized AIR SignExtend32ToPtr %x1, %x1, @1 SignExtend32ToPtr %x2, %x2, @2 MultiplyAdd64 %x1, %x2, %x0, %x0, @4 Ret64 %x0, @5 After Adding SMADDL: // New optimized AIR MultiplyAddSignExtend32 %x1, %x2, %x0, %x0, @8 Ret64 %x0, @9 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::multiplyAddSignExtend32): * assembler/testmasm.cpp: (JSC::testMultiplyAddSignExtend32Left): (JSC::testMultiplyAddSignExtend32Right): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testMulAddArg): (testMulAddArgsLeft): (testMulAddArgsRight): (testMulAddSignExtend32ArgsLeft): (testMulAddSignExtend32ArgsRight): (testMulAddArgsLeft32): (testMulAddArgsRight32): * b3/testb3_3.cpp: (addArgTests): 2021-06-22 Saam Barati jitCompileAndSetHeuristics shouldn't return true when we fail to compile https://bugs.webkit.org/show_bug.cgi?id=227155 Reviewed by Tadeu Zagallo. jitCompileAndSetHeuristics should only return true when we've successfully compiled a baseline JIT CodeBlock. However, with the rewrite to using a unified JIT worklist, the code was changed to returning true when a compilation finished, regardless of it being successful or not. This patch fixes that error. This bug was found by our existing executable allocation fuzzer, but at a low hit rate. That fuzzer only ran a single test case. This patch also introduces a new form of the executable fuzzer where we fail to allocate JIT code randomly, and the crash manifests more reliably. And this patch also hooks the new fuzzer into more JSC stress tests. * dfg/DFGLICMPhase.cpp: (JSC::DFG::LICMPhase::run): * jit/ExecutableAllocationFuzz.cpp: (JSC::doExecutableAllocationFuzzing): * jsc.cpp: (runJSC): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): (JSC::LLInt::LLINT_SLOW_PATH_DECL): * runtime/OptionsList.h: 2021-06-22 Angelos Oikonomopoulos Properly set numFPRs on ARM with NEON/VFP_V3_D32 https://bugs.webkit.org/show_bug.cgi?id=227212 Reviewed by Filip Pizlo. Don't hardcode the number of FP regs on ARMv7 to 16; when targetting a CPU with NEON or VFP_V3_d32, the number of FP regs is 32. This also reverts the recent change to add an extra word to RegisterSet which essentially covered up for this mismatch. The reason this bug only manifested on certain compiler versions was that GCC 8.4/8.5 where built using our buildroot infrastructure, whereas the other GCC versions we tested with were debian system toolchains, targetting a lowest common denominator. * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::std::initializer_list): * jit/RegisterSet.h: 2021-06-21 Ross Kirsling [JSC] Add JIT ICs for `#x in obj` feature https://bugs.webkit.org/show_bug.cgi?id=226146 Reviewed by Saam Barati. This patch implements JIT ICs for the new `#x in obj` feature and turns the feature on by default. Implementation closely follows InByVal, though HasPrivateBrand has a few subtleties (namely, it cannot be viewed in terms of a PropertySlot and should not be converted to InById). Microbenchmarks: has-private-name 46.5777+-0.1374 ^ 6.0589+-0.0296 ^ definitely 7.6875x faster has-private-brand 25.8823+-0.0561 ^ 19.1509+-0.0447 ^ definitely 1.3515x faster * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::reset): * bytecode/StructureStubInfo.h: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleInByAsMatchStructure): (JSC::DFG::ByteCodeParser::handleInById): (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileInByVal): (JSC::DFG::SpeculativeJIT::compileHasPrivate): (JSC::DFG::SpeculativeJIT::compileHasPrivateName): (JSC::DFG::SpeculativeJIT::compileHasPrivateBrand): * dfg/DFGSpeculativeJIT.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): * jit/JIT.h: * jit/JITInlineCacheGenerator.cpp: (JSC::JITInByValGenerator::JITInByValGenerator): * jit/JITInlineCacheGenerator.h: * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emit_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emit_op_has_private_brand): (JSC::JIT::emitSlow_op_has_private_brand): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitHasPrivate): (JSC::JIT::emitHasPrivateSlow): (JSC::JIT::emit_op_has_private_name): (JSC::JIT::emitSlow_op_has_private_name): (JSC::JIT::emit_op_has_private_brand): (JSC::JIT::emitSlow_op_has_private_brand): * jit/Repatch.cpp: (JSC::appropriateOptimizingInByFunction): (JSC::appropriateGenericInByFunction): (JSC::tryCacheInBy): (JSC::repatchInBy): (JSC::tryCacheHasPrivateBrand): (JSC::repatchHasPrivateBrand): (JSC::resetInBy): (JSC::resetHasPrivateBrand): * jit/Repatch.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LLIntSlowPaths.h: * llint/LowLevelInterpreter.asm: * runtime/CommonSlowPaths.cpp: * runtime/CommonSlowPaths.h: * runtime/OptionsList.h: 2021-06-21 Don Olmstead Non-unified build fixes late June 2021 edition https://bugs.webkit.org/show_bug.cgi?id=227241 Unreviewed non-unified build fixes. * dfg/DFGDriver.h: 2021-06-21 Xan Lopez [JSC] Fix consistency check during stack splitting in Wasm::LLIntGenerator::addLoop https://bugs.webkit.org/show_bug.cgi?id=226012 Reviewed by Tadeu Zagallo. It is possible for the wasm llint generator to call checkConsistency() on a stack that is only halfway through being properly setup. Specifically, when generating a loop block, we use splitStack() to pop the arguments for the loop into a new stack, and materializeConstantsAndLocals() to materialize the constants and aliases in the loop arguments, but the arguments won't be added back to the stack until the very end of the loop code generation. Since materializeConstantsAndLocals() will check the correctness of the expression stack, which isn't yet fully formed, we'll fail its ASSERT. To workaround this, we create a variant of materializeConstantsAndLocals() that does not check for correctness (similar to what we do in push()), and manually check the correctness of the new split stack in Wasm::LLIntGenerator::addLoop(), which is the place that knows the details of this intermediate state. For more details, see: https://bugs.webkit.org/show_bug.cgi?id=226012#c8 * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::checkConsistencyOfExpressionStack): (JSC::Wasm::LLIntGenerator::checkConsistency): (JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals): (JSC::Wasm::LLIntGenerator::addLoop): 2021-06-21 Yusuke Suzuki Release assert memory in JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount):: https://bugs.webkit.org/show_bug.cgi?id=227180 Reviewed by Keith Miller. When Wasm.Memory is shared, we should allocate bound growable memory even if initial size is 0 bytes, since this range can be later extended by mprotect. If maximum size is also 0 byte, we already have a path that does not allocate anything. * wasm/WasmMemory.cpp: (JSC::Wasm::Memory::tryCreate): 2021-06-21 Yijia Huang Add a new pattern to instruction selector to utilize SMSUBL supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=227195 Reviewed by Keith Miller. Signed Multiply-Subtract Long(SMSUBL), supported by ARM64, multiplies two 32-bit register values, subtracts the product from a 64-bit register value, and writes the result 64-bit destination register. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. Given the operation: smsubl d, n, m, a The equivalent pattern would be: d = a - SExt32(n) * SExt32(m) Given B3 IR: Int @0 = ArgumentReg(%x0) Int @1 = SExt32(Trunc(ArgumentReg(%x1))) Int @2 = SExt32(Trunc(ArgumentReg(%x2))) Int @3 = Mul(@1, @2) Int @4 = Sub(@0, @3) Void@5 = Return(@4, Terminal) Before Adding SMSUBL: // Old optimized AIR SignExtend32ToPtr %x1, %x1, @1 SignExtend32ToPtr %x2, %x2, @2 MultiplySub64 %x1, %x2, %x0, %x0, @4 Ret64 %x0, @5 After Adding SMSUBL: // New optimized AIR MultiplySubSignExtend32 %x1, %x2, %x0, %x0, @4 Ret64 %x0, @5 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::multiplySubSignExtend32): * assembler/testmasm.cpp: (JSC::testMulSubSignExtend32): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testMulSubArgsLeft): (testMulSubArgsRight): (testMulSubArgsLeft32): (testMulSubArgsRight32): (testMulSubSignExtend32Args): * b3/testb3_3.cpp: (addArgTests): 2021-06-21 Kimmo Kinnunen makeUnique cannot be used to instantiate function-local classes https://bugs.webkit.org/show_bug.cgi?id=227163 Reviewed by Antti Koivisto. Make JSC_MAKE_PARSER_ARENA_DELETABLE_ALLOCATED consistent with WTF_MAKE_FAST_ALLOCATED behavior with respect to unused typedefs inside the macro. * parser/Nodes.h: 2021-06-20 Yusuke Suzuki [JSC] Add ValueOf fast path in toPrimitive https://bugs.webkit.org/show_bug.cgi?id=226948 Reviewed by Ross Kirsling. Add fast path for Object.prototype.valueOf function call since we sometimes encounter this case in Speedometer2/EmberJS-Debug-TodoMVC. ToT Patched value-of-call 65.7169+-0.6192 ^ 45.0986+-0.0830 ^ definitely 1.4572x faster * runtime/JSCJSValue.cpp: (JSC::JSValue::toStringSlowCase const): * runtime/JSObject.cpp: (JSC::callToPrimitiveFunction): 2021-06-20 Robin Morisset Fix speculated type in the one-argument overload of speculateNeitherDoubleNorHeapBigIntNorString https://bugs.webkit.org/show_bug.cgi?id=227119 Reviewed by Yusuke Suzuki. Same problem as bug 226786: a missing check for HeapBigInt in the speculateNeitherDoubleNorHeapBigIntNorString function introduced in 226676. I also rewrote the SpeculatedType for NeitherDoubleNorHeapBigIntNorString in typeFilterFor for readability. The old and the new SpeculatedType are perfectly identical, it is just a different (and in my view more readable) way of writing it. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): 2021-06-19 Mark Lam [Revert r278576] Put the Baseline JIT prologue and op_loop_hint code in JIT thunks. https://bugs.webkit.org/show_bug.cgi?id=226375 Not reviewed. Suspect regresses Speedometer2. * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::untagReturnAddress): (JSC::AbstractMacroAssembler::untagReturnAddressWithoutExtraValidation): Deleted. * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagReturnAddress): (JSC::MacroAssemblerARM64E::untagReturnAddressWithoutExtraValidation): Deleted. * assembler/MacroAssemblerARMv7.h: * assembler/MacroAssemblerMIPS.h: * bytecode/CodeBlock.h: (JSC::CodeBlock::addressOfNumParameters): (JSC::CodeBlock::offsetOfNumParameters): (JSC::CodeBlock::offsetOfInstructionsRawPointer): (JSC::CodeBlock::offsetOfNumCalleeLocals): Deleted. (JSC::CodeBlock::offsetOfNumVars): Deleted. (JSC::CodeBlock::offsetOfArgumentValueProfiles): Deleted. (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): Deleted. * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): (JSC::AssemblyHelpers::emitSaveCalleeSavesForBaselineJIT): Deleted. (JSC::AssemblyHelpers::emitRestoreCalleeSavesForBaselineJIT): Deleted. * jit/JIT.cpp: (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::privateCompileExceptionHandlers): (JSC::prologueGeneratorSelector): Deleted. (JSC::JIT::prologueGenerator): Deleted. (JSC::JIT::arityFixupPrologueGenerator): Deleted. * jit/JIT.h: * jit/JITInlines.h: (JSC::JIT::emitNakedNearCall): * jit/JITOpcodes.cpp: (JSC::JIT::op_ret_handlerGenerator): (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_handlerGenerator): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitSlow_op_loop_hint): (JSC::JIT::op_enter_Generator): Deleted. (JSC::JIT::op_enter_canBeOptimized_Generator): Deleted. (JSC::JIT::op_enter_cannotBeOptimized_Generator): Deleted. (JSC::JIT::op_loop_hint_Generator): Deleted. * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_enter): * jit/ThunkGenerators.cpp: (JSC::popThunkStackPreservesAndHandleExceptionGenerator): 2021-06-19 Commit Queue Unreviewed, reverting r278699. https://bugs.webkit.org/show_bug.cgi?id=227174 Regressed JetStream2/WSL Reverted changeset: "[JSC] Remove useDataICInOptimizingJIT option" https://bugs.webkit.org/show_bug.cgi?id=226862 https://trac.webkit.org/changeset/278699 2021-06-18 Yijia Huang Add a new pattern to B3ReduceStrength based on Bug 226984 https://bugs.webkit.org/show_bug.cgi?id=227138 Reviewed by Filip Pizlo. In the previous patch bug 226984, a new pattern could be introduced to B3ReduceStrength.cpp for further optimization, which is that: dest = (src >> shiftAmount) & mask is equivalent to src >> shiftAmount under these constraints: 1. shiftAmount >= 0 2. mask has a binary format in contiguous ones starting from the least significant bit. 3. shiftAmount + bitCount(mask) == maxBitWidth For instance (32-bit): (src >> 12) & 0x000fffff == src >> 12 This reduction is more beneficial than UBFX in this case. // B3 IR Int @0 = ArgumentReg(%0) Int @1 = 12 Int @2 = ZShr(@0, @1) Int @3 = 0x000fffff Int @4 = BitAnd(@2, @3)) Void@5 = Return(@4, Terminal) w/o the pattern: // Old optimized AIR Ubfx %0, $12, $20, %0, @4 Ret %0, @5 w/ the pattern: // New optimized AIR Urshift %0, $12, %0, @3 Ret32 %0, @6 * b3/B3ReduceStrength.cpp: * b3/testb3.h: * b3/testb3_2.cpp: (testBitAndZeroShiftRightImmMask32): (testBitAndZeroShiftRightImmMask64): (addBitTests): 2021-06-18 Robin Morisset [DFG] Untyped branches should eliminate checks based on results from the AbstractInterpreter https://bugs.webkit.org/show_bug.cgi?id=227159 Reviewed by Filip Pizlo. We currently emit a ton of code for Untyped branches, as we use branchIfTruthy which does not know anything about the abstract interpreter. Even worse: we call branchIfTruthy after emitting some fast paths, and branchIfTruthy replicates these fast paths (Int32 and Booleans). While I plan to reduce the number of Untyped branches in some separate patches, there is a very long tail of predicted types visible in benchmarks, so I expect some of them to remain no matter what, justifying making the code emitted in that case more reasonable. The implementation in this patch is fairly straightforward, as it follows very closely branchOnValue() from AssemblyHelpers (which was previously called through branchIfTruthy). It was tested on the JSC stress tests, as well as on JetStream2. On JetStream2, it reduced the average number of bytes emitted for Branch by the DFG from 30.1 to 27.5 (highly significant, it only changes by about 0.1 between runs). Since only about 1.5k branches are untyped out of 34k in that benchmark, it means that this patch reduces the amount of code emitted for untyped branches by about 50 bytes on average. * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::branchDoubleZeroOrNaN): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::emitUntypedBranch): (JSC::DFG::SpeculativeJIT::emitBranch): 2021-06-17 Mark Lam Rename numberOfPACBits to maxNumberOfAllowedPACBits. https://bugs.webkit.org/show_bug.cgi?id=227156 Reviewed by Saam Barati. Just renaming the constant to better describe what it represents. There are no behavior changes. * assembler/MacroAssemblerARM64E.h: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::cageWithoutUntagging): (JSC::AssemblyHelpers::cageConditionallyAndUntag): * llint/LowLevelInterpreter64.asm: 2021-06-17 Mark Lam Define MacroAssemblerARM64E::numberOfPACBits based on OS_CONSTANT(EFFECTIVE_ADDRESS_WIDTH). https://bugs.webkit.org/show_bug.cgi?id=227147 rdar://78785309 Reviewed by Saam Barati. * assembler/MacroAssemblerARM64E.h: * bytecode/CodeOrigin.h: * runtime/JSString.h: * runtime/OptionsList.h: 2021-06-17 Fujii Hironori Reimplement JSC::CachePayload without FileSystem::unmapViewOfFile and FileSystem::MappedFileData::leakHandle https://bugs.webkit.org/show_bug.cgi?id=227014 Reviewed by Yusuke Suzuki. r247542 (Bug 199759) added FileSystem::unmapViewOfFile and FileSystem::MappedFileData::leakHandle for JSC::CachePayload to get the mapped address and to free the address. However, Bug 227011 is going to add a file mapping handle to FileSystem::MappedFileData for Windows port to create a SharedMemory from a MappedFileData. Destruction of MappedFileData should be done only by MappedFileData dtor. * runtime/CachePayload.cpp: (JSC::CachePayload::makeMappedPayload): (JSC::CachePayload::makeMallocPayload): (JSC::CachePayload::makeEmptyPayload): (JSC::CachePayload::CachePayload): (JSC::CachePayload::data const): (JSC::CachePayload::size const): (JSC::CachePayload::~CachePayload): Deleted. (JSC::CachePayload::operator=): Deleted. (JSC::CachePayload::freeData): Deleted. * runtime/CachePayload.h: Use Variant for data. (JSC::CachePayload::data const): Deleted. (JSC::CachePayload::size const): Deleted. (JSC::CachePayload::CachePayload): Deleted. 2021-06-17 Yijia Huang Add a new pattern to instruction selector to utilize UBFX supported by ARM64 https://bugs.webkit.org/show_bug.cgi?id=226984 Reviewed by Filip Pizlo. UBFX, supported by ARM64, copies adjacent bits from the source register into the least significant bits of a destination register in zero extension. The instruction selector can utilize this to lowering certain patterns in B3 IR before further Air optimization. ubfx dest, src, lsb, width tmp, tmp, imm, imm This is equivalent to "dest = (src >> lsb) & ((1 << width) - 1)". Since wasm introduces constant folding, then the pattern would be: dest = (src >> lsb) & mask where the mask should have a binary format in contiguous ones starting from the least significant bit. For example: 0b00111111 To make the pattern matching in instruction selection beneficial to JIT, these constraints should be introduced: 1. lsb >= 0 2. width > 0 3. lsb + width <= bit field limit (32 or 64) Given: // B3 IR Int @0 = ArgumentReg(%0) Int @1 = lsb Int @2 = 0b0011 Int @3 = ZShr(@0, @1) Int @4 = BitAnd(@3, @2) Void@5 = Return(@4, Terminal) w/o UBFX Pattern: // Old optimized AIR Urshift %x0, lsb, %x0, @3 And 0b0011, %x0, %x0, @4 Ret %x0, @5 w/ UBFX Pattern: // New optimized AIR Ubfx %x0, lsb, 2, %x0, @4 Ret %x0, @5 Note: Suppose a 32-bit version of (src >> 20) & 0x0FFF, it is equivalent to src >> 20. In this case, Logical Shift Right should be utilized instead when: lsb + width == bit field limit (32 or 64) This case/pattern should be added and upadated in the future patch. * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::ubfx32): (JSC::MacroAssemblerARM64::ubfx64): * assembler/testmasm.cpp: (JSC::testUbfx32): (JSC::testUbfx64): * b3/B3LowerToAir.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testUbfx64PatternMatch): (testUbfx32PatternMatch): (addBitTests): 2021-06-17 Angelos Oikonomopoulos [JSC] Work around apparent miscompilation on ARM/GCC >=8.4 https://bugs.webkit.org/show_bug.cgi?id=227125 Reviewed by Filip Pizlo. This seems to be a GCC miscompilation, revealed by https://bugs.webkit.org/show_bug.cgi?id=227078. Introduce a workaround for the GCC versions that seem to be affected. * jit/RegisterSet.h: 2021-06-16 Yusuke Suzuki [JSC] Optimize JSON.parse with small data by changing Identifier pool mechanism https://bugs.webkit.org/show_bug.cgi?id=227101 Reviewed by Mark Lam. Found that std::array pool in LiteralParser is too costly for construction and destruction if JSON.parse is invoked for small data. This patch changes this pool mechanism so that we do not waste effort allocating null Identifiers to pre-populate the recent identifiers pool. Instead, we now use a m_recentIdentifiersIndex uint8_t array to indicate whether there's a cached recent identifier for each given first character. We also use KeywordLookup.h's COMPARE_XCHARS to perform "true" / "false" / "null" lexing in JSON parser. Roughly 20% improvement in microbenchmark. And roughly 2-3% improvement in Speedometer2/Flight-TodoMVC. ToT Patched flight-todomvc-json 67.8755+-1.1202 ^ 56.7114+-0.5048 ^ definitely 1.1969x faster * runtime/Identifier.cpp: (JSC::Identifier::add): (JSC::Identifier::add8): * runtime/Identifier.h: (JSC::Identifier::Identifier): (JSC::Identifier::add): * runtime/IdentifierInlines.h: (JSC::Identifier::add): (JSC::Identifier::fromString): * runtime/LiteralParser.cpp: (JSC::compare3Chars): (JSC::compare4Chars): (JSC::LiteralParser::makeIdentifier): (JSC::LiteralParser::Lexer::lex): * runtime/LiteralParser.h: 2021-06-16 Mark Lam Adopt com.apple.security.cs.jit-write-allowlist on internal builds. https://bugs.webkit.org/show_bug.cgi?id=222148 rdar://74284026 Reviewed by Per Arne Vollan. This will prevent various pthread permissions switching APIs from working. We only want to adopt this for internal builds where we use the fast permission switching macro instead. We can't adopt it for open source builds, where we still rely on the pthread API. * Scripts/process-entitlements.sh: 2021-06-16 Robin Morisset Don't look at the (non-existent) child2 of DelById https://bugs.webkit.org/show_bug.cgi?id=227095 Reviewed by Mark Lam. Trivial fix to a broken rebase: while it is ok to share most code between DelById and DelByVal, only the latter has a child2(), so it should not be accessed if we are compiling the former. No new test, as it was caught by one of our existing tests. * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): 2021-06-16 Yijia Huang Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and select this instruction in Air https://bugs.webkit.org/show_bug.cgi?id=226937 Reviewed by Yusuke Suzuki. Previously, Air arm64 sub32/64 utilize sub(Imm, Tmp) at optlevel = 0 and add(Tmp, -Imm) at optlevel > 0 to perform and optimize sub(Tmp, Imm, Tmp). The issue with this is that we were not eliding redundant operations. For example: // B3 IR @0 = Trunc(ArgumentReg(0)) @1 = Const @2 = Sub(@0, @1) @3 = Return(@2) // Old optimized Air IR // OptLevel = 0 Move %x0, %tmp1, @0 Move $Const, %tmp2, @1 Move %tmp1, %tmp0, @2 // Redundant Sub $Const, %tmp0, @2 Move %tmp0, %x0, @3 Ret32 %x0, @3 To remove those redundant instructions, Air arm64 sub32/64 opcode should indicate a new form sub(Tmp, Imm, Tmp). // New optimized Air IR // OptLevel = 0 Move %x0, %tmp1, @0 Move $Const, %tmp2, @1 Sub %tmp1, $Const, %tmp0, @2 Move %tmp0, %x0, @3 Ret32 %x0, @3 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::sub32): (JSC::MacroAssemblerARM64::sub64): * assembler/testmasm.cpp: (JSC::testSub32Args): (JSC::testSub32Imm): (JSC::testSub32ArgImm): (JSC::testSub64Imm32): (JSC::testSub64ArgImm32): (JSC::testSub64Imm64): (JSC::testSub64ArgImm64): * b3/B3ReduceStrength.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testSubArgs32ZeroExtend): * b3/testb3_3.cpp: (addArgTests): 2021-06-16 Robin Morisset Drop the FTL(DFG) graph after lowering to B3 https://bugs.webkit.org/show_bug.cgi?id=226556 Reviewed by Phil Pizlo. This patch originally landed as r278463, was reverted in r278463. I believe that the bug for which it was reverted actually comes from r278371, which was also reverted at the same time. So I am now relanding this. The challenge in this patch was dealing with all of the Patchpoints created by FTLLowerDFGToB3: they get a lambda at that time, which they execute at the end of Air, and many of these lambdas were capturing a pointer to some parts of the DFG graph and reading through it when being executed. In all cases but one it was easily fixed: they were only reading a few bits from a given node, so I just read these bits in FTLLowerDFGToB3, and captured them (by value) instead of the pointer to the node. The exception was compileCallOrConstructVarargsSpread(): its patchpoint generator was walking through the graph, flattening a tree of PhantomSpread/PhantomNewArrayWithSpread/PhantomNewArrayBuffer/PhantomCreateRest, emitting some code along the way. We now do this flattening of the tree in FTLLowerDFGToB3, store just enough information to later emit the required code in a vector, and capture that vector in the lambda (through a move capture, which is allowed since C++14). See `struct VarargsSpreadArgumentToEmit` for the information that we need to store in that vector. I tested this change by completing a full run of JetStream2 with ASAN. I also ran the stress tests with "spread" in their name in Debug mode. * b3/B3SparseCollection.h: (JSC::B3::SparseCollection::clearAll): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::freeDFGIRAfterLowering): * dfg/DFGGraph.h: * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::getPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileTailCall): (JSC::FTL::DFG::LowerDFGToB3::VarargsSpreadArgumentToEmit::VarargsSpreadArgumentToEmit): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs): (JSC::FTL::DFG::LowerDFGToB3::compileCallEval): (JSC::FTL::DFG::LowerDFGToB3::compileInById): (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf): (JSC::FTL::DFG::LowerDFGToB3::getById): (JSC::FTL::DFG::LowerDFGToB3::getByIdWithThis): (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet): (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet): (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet): (JSC::FTL::DFG::LowerDFGToB3::crash): 2021-06-16 Filip Pizlo RegisterSet should be smaller https://bugs.webkit.org/show_bug.cgi?id=227078 Reviewed by Geoff Garen. Previously, every RegisterSet would have an extra 64-bit word in it just to hold state relevant to hashtable keys. But RegisterSet is almost never used as a hashtable key. This patch moves the hashtable key support into a subclass, HashableRegisterSet. That class ends up only being used in one place. On ARM64, this makes RegisterSet use 64 bits instead of 128 bits. On X86_64, this makes RegisterSet use 32 bits instead of 64 bits. * JavaScriptCore.xcodeproj/project.pbxproj: * ftl/FTLSlowPathCallKey.h: (JSC::FTL::SlowPathCallKey::SlowPathCallKey): * jit/HashableRegisterSet.h: Added. (JSC::HashableRegisterSet::HashableRegisterSet): (JSC::HashableRegisterSet::isEmptyValue const): (JSC::HashableRegisterSet::isDeletedValue const): (JSC::RegisterSetHash::hash): (JSC::RegisterSetHash::equal): * jit/RegisterSet.h: (): Deleted. (JSC::RegisterSet::isEmptyValue const): Deleted. (JSC::RegisterSet::isDeletedValue const): Deleted. (JSC::RegisterSetHash::hash): Deleted. (JSC::RegisterSetHash::equal): Deleted. 2021-06-16 Tadeu Zagallo AssemblyHelpers should save/restore callee save FPRs https://bugs.webkit.org/show_bug.cgi?id=227052 Reviewed by Mark Lam. We have 3 functions in AssemblyHelpers to save and restore callee save registers that were filtering out any FPRs. This is an issue since we do have callee save FPRs in arm64 and these functions can be called from the FTL, and FTL uses those callee saves. The test case shows how that's an issue with tail calls on FTL: the callee saves are correctly stored in the prologue and restored in the epilogue, but when emitting a tail call we use AssemblyHelpers::emitRestoreCalleeSaves to restore the callee saves, which doesn't restore FPRs. This results in the callee save FPRs being trashed. To fix this we just need to stop filtering out the FPRs, if they are listed as used by the code block they should be saved/restored accordingly. I also changed DFGOSREntry to stop filtering out the callee save FPRs and instead assert there aren't any, since they aren't currently used in the DFG, but it could help avoid the same issue in the future. * dfg/DFGOSREntry.cpp: (JSC::DFG::prepareOSREntry): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor): (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor): 2021-06-16 Commit Queue Unreviewed, reverting r278846. https://bugs.webkit.org/show_bug.cgi?id=227060 Speculative revert based on failure history of Speedometer2 Reverted changeset: "Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and select this instruction in Air" https://bugs.webkit.org/show_bug.cgi?id=226937 https://trac.webkit.org/changeset/278846 2021-06-15 Yusuke Suzuki [JSC] Optimize JSON.parse with small content by dropping single character Identifier pool https://bugs.webkit.org/show_bug.cgi?id=227057 Reviewed by Sam Weinig. Profiler results and investigation suggest interesting things. 1. Sampling profiler says Flight-TodoMVC is mostly JSON.parse benchmark. 2. Each JSON data of Flight-TodoMVC is small. And JSON.parse is super frequently called. 3. In the case of JSON.parse with small data, LiteralParser's construction / destruction costs much since it has large Identifier pool with std::array<>. As a simple first step, this patch removes single character Identifier pool from LiteralParser since the exact same Identifier data can be retrieved from VM's SmallStrings. We created a microbenchmark from Flight-TodoMVC's data, and the result is roughly 20% better. And we observed 0.6% improvement in Speedometer2. ToT Patched flight-todomvc-json 81.0552+-0.8403 ^ 67.5756+-0.6221 ^ definitely 1.1995x faster ---------------------------------------------------------------------------------------------------------------------------------- | subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) | ---------------------------------------------------------------------------------------------------------------------------------- | Elm-TodoMVC |128.991667 |128.450000 |0.995801 | 0.278228 | | VueJS-TodoMVC |28.487500 |27.925000 |0.980254 | 0.139315 | | EmberJS-TodoMVC |133.950000 |134.175000 |1.001680 | 0.685021 | | BackboneJS-TodoMVC |51.670833 |51.537500 |0.997420 | 0.628993 | | Preact-TodoMVC |21.783333 |21.754167 |0.998661 | 0.944237 | | AngularJS-TodoMVC |143.820833 |143.770833 |0.999652 | 0.933953 | | Vanilla-ES2015-TodoMVC |71.608333 |71.416667 |0.997323 | 0.500591 | | Inferno-TodoMVC |69.179167 |69.525000 |1.004999 | 0.412406 | | Flight-TodoMVC |81.354167 |79.020833 |0.971319 | 0.000053 (significant) | | Angular2-TypeScript-TodoMVC |42.654167 |41.887500 |0.982026 | 0.086053 | | VanillaJS-TodoMVC |57.054167 |56.633333 |0.992624 | 0.176804 | | jQuery-TodoMVC |274.595833 |275.670833 |1.003915 | 0.148812 | | EmberJS-Debug-TodoMVC |358.387500 |357.595833 |0.997791 | 0.323387 | | React-TodoMVC |93.804167 |93.329167 |0.994936 | 0.113410 | | React-Redux-TodoMVC |157.954167 |157.266667 |0.995647 | 0.131298 | | Vanilla-ES2015-Babel-Webpack-TodoMVC |68.687500 |68.054167 |0.990779 | 0.002155 (significant) | ---------------------------------------------------------------------------------------------------------------------------------- a mean = 235.28964 b mean = 236.72163 pValue = 0.0121265559 (Bigger means are better.) 1.006 times better Results ARE significant * runtime/Identifier.h: (JSC::Identifier::canUseSingleCharacterString): * runtime/LiteralParser.cpp: (JSC::LiteralParser::makeIdentifier): * runtime/LiteralParser.h: * runtime/SmallStrings.cpp: (JSC::SmallStrings::singleCharacterStringRep): * runtime/SmallStrings.h: 2021-06-15 Keith Miller Shouldn't drain the micro task queue when calling out to ObjC https://bugs.webkit.org/show_bug.cgi?id=161942 Unreviewed, relanding r278734. * API/tests/testapi.cpp: (TestAPI::promiseDrainDoesNotEatExceptions): (testCAPIViaCpp): * API/tests/testapi.mm: (testMicrotaskWithFunction): (testObjectiveCAPI): * runtime/JSLock.cpp: (JSC::JSLock::willReleaseLock): * runtime/ObjectPrototype.cpp: (JSC::isPokerBros): * runtime/VM.cpp: (JSC::VM::didExhaustMicrotaskQueue): 2021-06-15 Michael Catanzaro -Warray-bounds warning in Packed.h https://bugs.webkit.org/show_bug.cgi?id=226557 Reviewed by Darin Adler. * b3/air/AirAllocateRegistersByGraphColoring.cpp: * jit/JITCall.cpp: (JSC::JIT::compileOpCall): 2021-06-15 Mark Lam Move setting of scratch buffer active lengths to the runtime functions. https://bugs.webkit.org/show_bug.cgi?id=227013 rdar://79325068 Reviewed by Keith Miller. We previously emit JIT'ed code to set and unset the ScratchBuffer active length around calls into C++ runtime functions. This was needed because the runtime functions may allow GC to run, and GC needs to be able to scan the values stored in the ScratchBuffer. In this patch, we change it so that the runtime functions that need it will declare an ActiveScratchBufferScope RAII object that will set the ScratchBuffer active length, and unset it on exit. This allows us to: 1. Emit less JIT code. The runtime function can take care of it. 2. Elide setting the ScratchBuffer active length if not needed. The runtime functions know whether they can GC or not. They only need to set the active length if they can GC. Note that scanning of the active ScratchBuffer is done synchronously on the mutator thread via Heap::gatherScratchBufferRoots(), which is called as part of the GC conservative root scan. This means there is no urgency / sequencing that requires that the active length be set before calling into the runtime function. Setting it in the runtime function itself is fine as long as it is done before the function executes any operations that can GC. This patch also made the following changes: 1. Introduce ActiveScratchBufferScope RAII object used to set/unset the ScratchBuffer length in the runtime functions. ActiveScratchBufferScope takes the active length in units of number of stack slots / Registers / JSValues instead of bytes. 2. Deleted ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall() and ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall(). These functions are unused. The reasoning behind what values to pass to ActiveScratchBufferScope, is any: 1. AssemblyHelpers::debugCall() in AssemblyHelpers.cpp: The ScratchBuffer is only used for operationDebugPrintSpeculationFailure(), which now declares an ActiveScratchBufferScope. The active length is GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters. See scratchSize in AssemblyHelpers::debugCall(). 2. genericGenerationThunkGenerator() in FTLThunks.cpp: The scratch buffer size for determining the active length is requiredScratchMemorySizeInBytes(). However, genericGenerationThunkGenerator() generates code to call either operationCompileFTLOSRExit() or operationCompileFTLLazySlowPath(). Both of these functions will DeferGCForAWhile. Hence, GC cannot run, and we don't need to set the active length here. 3. compileArrayPush() in FTLLowerDFGToB3.cpp: Cases Array::Int32, Array::Contiguous, or Array::Double calls operationArrayPushMultiple() or operationArrayPushDoubleMultiple(). For operationArrayPushMultiple(), the active length is elementCount. See computation of scratchSize. For operationArrayPushDoubleMultiple(), we don't need to set the active length because the ScratchBuffer only contains double values. The GC does not need to scan those. Case Array::ArrayStorage calls operationArrayPushMultiple(). The active length is elementCount. See computation of scratchSize. compileNewArray() in FTLLowerDFGToB3.cpp: Calls operationNewArray(). Active length is m_node->numChildren(), which is passed to operationNewArray() as the size parameter. See computation of scratchSize. compileNewArrayWithSpread() in FTLLowerDFGToB3.cpp: Calls operationNewArrayWithSpreadSlow(). Active length is m_node->numChildren(), which is passes to operationNewArrayWithSpreadSlow() as the numItems parameter. See computation of scratchSize. 4. osrExitGenerationThunkGenerator() in DFGThunks.cpp: Calls operationCompileOSRExit(). Active length is GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters. See computation of scratchSize. 5. compileNewArray() in DFGSpeculativeJIT.cpp: Calls operationNewArray(). Active length is node->numChildren(), which is passed in as the size parameter. compileNewArrayWithSpread() in DFGSpeculativeJIT.cpp: Calls operationNewArrayWithSpreadSlow(). Active length is node->numChildren(), which is passed in as the numItems parameter. compileArrayPush() in DFGSpeculativeJIT.cpp: Calls operationArrayPushMultiple(). Active length is elementCount, which is passed in as the elementCount parameter. Calls operationArrayPushDoubleMultiple(). Active length is elementCount, but we don't need to set it because the ScratchBuffer only contains double values. * dfg/DFGOSRExit.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNewArray): (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): (JSC::DFG::SpeculativeJIT::compileArrayPush): * dfg/DFGThunks.cpp: (JSC::DFG::osrExitGenerationThunkGenerator): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush): (JSC::FTL::DFG::LowerDFGToB3::compileNewArray): (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * ftl/FTLThunks.cpp: (JSC::FTL::genericGenerationThunkGenerator): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::debugCall): * jit/ScratchRegisterAllocator.cpp: (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall): Deleted. (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall): Deleted. * jit/ScratchRegisterAllocator.h: * runtime/VM.h: * runtime/VMInlines.h: (JSC::ActiveScratchBufferScope::ActiveScratchBufferScope): (JSC::ActiveScratchBufferScope::~ActiveScratchBufferScope): 2021-06-14 Yusuke Suzuki [JSC] Workaround ICU uloc_addLikelySubtags / uloc_minimizeSubtags bugs https://bugs.webkit.org/show_bug.cgi?id=226996 rdar://79250513 Reviewed by Ross Kirsling. ICU has bugs that uloc_addLikelySubtags / uloc_minimizeSubtags cannot handle very long locale ID that exceeds ULOC_FULLNAME_CAPACITY, while these functions can take arbitrary sized buffer for output. This can be achieved simply by (1) attaching many unicode extensions, or (2) having many variants. In this patch, we add a workaround: if uloc_addLikelySubtags / uloc_minimizeSubtags failed, we perform them without having locale ID keywords part. After performing the operations, we append these keywords back. This is workaround, and still this workaround is not complete since we could have many variants. In that case, uloc_addLikelySubtags / uloc_minimizeSubtags still fails, and in that case, for now, we give up performing uloc_addLikelySubtags / uloc_minimizeSubtags. Fixing this needs to be done in ICU side: https://unicode-org.atlassian.net/browse/ICU-21639 * runtime/IntlLocale.cpp: (JSC::IntlLocale::keywordValue const): (JSC::IntlLocale::maximal): (JSC::IntlLocale::minimal): (JSC::IntlLocale::baseName): 2021-06-14 Mark Lam Add ldp and stp support for FP registers, plus some bug fixes. https://bugs.webkit.org/show_bug.cgi?id=226998 rdar://79313717 Reviewed by Robin Morisset. This patch does the following: 1. Add ldp and stp support for FP registers. This simply entails providing wrappers that take FPRegisterID and passing true for the V bit to the underlying loadStoreRegisterPairXXX encoding function. V is for vector (aka floating point). This will cause bit 26 in the instruction to be set indicating that it's loading / storing floating point registers. 2. Add ARM64 disassembler support ldp and stp for FP registers. This includes fixing A64DOpcodeLoadStoreRegisterPair::mask to not exclude the FP versions of the instructions. 3. Add ARM64Assembler query methods for determining if an immediate is encodable as the signed 12 bit immediate of ldp and stp instructions. 4. Fix ldp and stp offset form to take an int instead of an unsigned. The immediate it takes is a 12-bit signed int, not unsigned. 5. In loadStoreRegisterPairXXX encoding functions used by the forms of ldp and stp, RELEASE_ASSERT that the passed in immediate is encodable. Unlike ldur / stur, there is no form of ldp / stp that takes the offset in a register that can be used as a fail over. Hence, if the immediate is not encodable, this is a non-recoverable event. The client is responsible for ensuring that the offset is encodable. 6. Added some testmasm tests for testing the offset form (as opposed to PreIndex and PostIndex forms) of ldp and stp. We currently only use the offset form in our JITs. * assembler/ARM64Assembler.h: (JSC::ARM64Assembler::isValidLDPImm): (JSC::ARM64Assembler::isValidLDPFPImm): (JSC::ARM64Assembler::ldp): (JSC::ARM64Assembler::ldnp): (JSC::ARM64Assembler::isValidSTPImm): (JSC::ARM64Assembler::isValidSTPFPImm): (JSC::ARM64Assembler::stp): (JSC::ARM64Assembler::stnp): (JSC::ARM64Assembler::loadStoreRegisterPairPostIndex): (JSC::ARM64Assembler::loadStoreRegisterPairPreIndex): (JSC::ARM64Assembler::loadStoreRegisterPairOffset): (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal): * assembler/AssemblerCommon.h: (JSC::isValidSignedImm7): * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::loadPair64): (JSC::MacroAssemblerARM64::storePair64): * assembler/testmasm.cpp: (JSC::testLoadStorePair64Int64): (JSC::testLoadStorePair64Double): * disassembler/ARM64/A64DOpcode.cpp: (JSC::ARM64Disassembler::A64DOpcodeLoadStoreRegisterPair::format): * disassembler/ARM64/A64DOpcode.h: 2021-06-14 Yijia Huang Add Air opcode sub32/64(Reg, Imm, Reg) form for ARM64 and select this instruction in Air https://bugs.webkit.org/show_bug.cgi?id=226937 Reviewed by Saam Barati. Previously, Air arm64 sub32/64 utilize sub(Imm, Tmp) at optlevel = 0 and add(Tmp, -Imm) at optlevel > 0 to perform and optimize sub(Tmp, Imm, Tmp). The issue with this is that we were not eliding redundant operations. For example: // B3 IR @0 = Trunc(ArgumentReg(0)) @1 = Const @2 = Sub(@0, @1) @3 = Return(@2) // Old optimized Air IR // OptLevel = 0 Move %x0, %tmp1, @0 Move $Const, %tmp2, @1 Move %tmp1, %tmp0, @2 // Redundant Sub $Const, %tmp0, @2 Move %tmp0, %x0, @3 Ret32 %x0, @3 To remove those redundant instructions, Air arm64 sub32/64 opcode should indicate a new form sub(Tmp, Imm, Tmp). // New optimized Air IR // OptLevel = 0 Move %x0, %tmp1, @0 Move $Const, %tmp2, @1 Sub %tmp1, $Const, %tmp0, @2 Move %tmp0, %x0, @3 Ret32 %x0, @3 * assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::sub32): (JSC::MacroAssemblerARM64::sub64): * assembler/testmasm.cpp: (JSC::testSub32Args): (JSC::testSub32Imm): (JSC::testSub32ArgImm): (JSC::testSub64Imm32): (JSC::testSub64ArgImm32): (JSC::testSub64Imm64): (JSC::testSub64ArgImm64): * b3/B3ReduceStrength.cpp: * b3/air/AirOpcode.opcodes: * b3/testb3.h: * b3/testb3_2.cpp: (testSubArgs32ZeroExtend): * b3/testb3_3.cpp: (addArgTests): 2021-06-14 Commit Queue Unreviewed, reverting r278734. https://bugs.webkit.org/show_bug.cgi?id=226973 broke jsc testapi Reverted changeset: "Shouldn't drain the micro task queue when calling out to ObjC" https://bugs.webkit.org/show_bug.cgi?id=161942 https://trac.webkit.org/changeset/278734 2021-06-13 Saam Barati https://bugs.webkit.org/show_bug.cgi?id=226576 Reviewed by Yusuke Suzuki. ShortCircuitReadModifyResolveNode can't emit a value into its result until after it emits a TDZ check. We were temporarily storing the result of the get_from_scope into the dst. Then we'd emit the TDZ check. The TDZ check can throw, and it could lead to us returning TDZ from the eval itself. Instead, we need to use a temporary to emit a TDZ check on. Only after the TDZ check passes can we move the temporary into the result. * bytecompiler/NodesCodegen.cpp: (JSC::ShortCircuitReadModifyResolveNode::emitBytecode): 2021-06-12 Michael Catanzaro -Wnonnull warning in JITCall.cpp https://bugs.webkit.org/show_bug.cgi?id=226643 Reviewed by Darin Adler. This is a false-positive, so suppress it using IGNORE_ERRONEOUS_GCC_NULL_CHECK_WARNINGS_BEGIN. * jit/JITCall.cpp: (JSC::JIT::compileOpCall): 2021-06-12 Robin Morisset We should drop B3 values while running Air https://bugs.webkit.org/show_bug.cgi?id=226187 Reviewed by Saam Barati. NB: this patch first landed as r278371, then was reverted in r278587 as it broke --dumpDisassembly(). I fixed the bug (a missing line setDisassembler()) and am now re-landing it. Below is a copy of the original Changelog. We must keep the following values: - WasmBoundsCheck, to know whether it is Pinned or Maximum, and if it is pinned find its argument. - CCall/Patch/Check/CheckAdd/CheckSub/CheckMul and all of their children, because all of these are lowered to Air::Patchpoint, which needs to know the type of its arguments, and does so by looking at the children of its origin. I intend to fix these in later patches if possible. Finally we must preserve all B3 values in the following cases: - if we dump the disassembly or the Air graph: because otherwise we cannot print the origins - if we are using the sampling profiler, because it relies on PCToCodeOriginMap which we cannot accurately fill without these origins. We must also keep m_tuples alive, as it is used by Patchpoints in Air to understand the types of their arguments. We also don't touch StackSlots (in this patch), because one of them is captured by FTL::State. Also now PCToOriginMap has a Vector with no inline capacity, since it is either quite large (if needed) or empty (otherwise). The performance impact of this is a progression on various RAMification subtests on Mac, but is more mitigated on iPhone7, with various regressions. I suspect these to be noise, and will monitor the performance bots post-landing to make sure of it. * b3/B3LowerToAir.cpp: (JSC::B3::lowerToAir): * b3/B3Procedure.cpp: (JSC::B3::Procedure::freeUnneededB3ValuesAfterLowering): * b3/B3Procedure.h: (JSC::B3::Procedure::releasePCToOriginMap): (JSC::B3::Procedure::setNeedsPCToOriginMap): (JSC::B3::Procedure::needsPCToOriginMap): * b3/B3SparseCollection.h: (JSC::B3::SparseCollection::clearAll): (JSC::B3::SparseCollection::filterAndTransfer): * b3/air/AirCode.cpp: (JSC::B3::Air::Code::Code): * b3/air/AirCode.h: (JSC::B3::Air::Code::shouldPreserveB3Origins const): * b3/air/AirGenerate.cpp: (JSC::B3::Air::generateWithAlreadyAllocatedRegisters): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLState.cpp: (JSC::FTL::State::State): 2021-06-11 Patrick Angle Web Inspector: Add instrumentation to node destruction for InspectorDOMAgent https://bugs.webkit.org/show_bug.cgi?id=226624 Reviewed by Devin Rousso. Add new `DOM.willDestroyDOMNode` event to inform the frontend of DOM nodes that no longer exist, even if they weren't in the DOM tree. This work serves as a prelude to (Web Inspector: preserve DOM.NodeId if a node is removed and re-added) to eventually only forget about nodes upon destruction, instead of removal from the DOM tree. * inspector/protocol/DOM.json: 2021-06-11 Yijia Huang Air ARM64 sub32 opcode should indicate that it zero-extends its result https://bugs.webkit.org/show_bug.cgi?id=226849 Reviewed by Saam Barati. Sub32 was previously not saying that its result is zero defined. However, sub32 on arm64 architectures zero defines its result, so the top 32 bits are zeroed. The issue with this is what we were not eliding provably redundant zero extend operations. For example: // B3 IR @0 = Trunc(ArgumentReg(0)) @1 = Trunc(ArgumentReg(1)) @2 = Sub(@0, @1) @3 = ZExt32(@2) // i64 @4 = Return(@3) or Store(@3, @x) // Old optimized Air IR Sub32 %x0, %x1, %x0, b@2 Move32 %x0, %x0, b@3 Ret64 %x0, b@4 or Move %x0, (%x), b@4 To remove that redundant zero extend instruction (Move32), Air arm64 sub32 opcode should indicate that it zero-extends its result. // New optimized Air IR Sub32 %x0, %x1, %x0, b@2 Ret64 %x0, b@6 or Move %x0, (%x), b@4 * b3/air/AirOpcode.opcodes: 2021-06-10 Keith Miller Shouldn't drain the micro task queue when calling out to ObjC https://bugs.webkit.org/show_bug.cgi?id=161942 Reviewed by Saam Barati. It looks like the issue is that we aren't checking for the presence of dropped locks when deciding to drain microtasks during JSLock::unlock. This meant that when we drop all locks when calling out to API clients we would drain our microtasks at that point. An alternative would be to pass an extra parameter to the unlock function that says not to drain microtasks. I chose not to do that since it seemed a bit less robust. This patch is very likely to break existing API users. So I'm adding a linked on or after check to protect existing Apps. Lastly, change our Poker Bros check to use applicationSDKVersion too so others trying to add a linked on or after check don't use the dyld function directly too. * API/tests/testapi.cpp: (TestAPI::promiseDrainDoesNotEatExceptions): (testCAPIViaCpp): * API/tests/testapi.mm: (testMicrotaskWithFunction): (testObjectiveCAPI): * runtime/JSLock.cpp: (JSC::JSLock::willReleaseLock): * runtime/ObjectPrototype.cpp: (JSC::isPokerBros): * runtime/VM.cpp: (JSC::VM::didExhaustMicrotaskQueue): 2021-06-10 Mark Lam Another speculative build fix for Win32. https://bugs.webkit.org/show_bug.cgi?id=226880 rdar://79124858 Reviewed by Keith Miller. We're getting reports of "warning C4206: nonstandard extension used: translation unit is empty" turning into a build error on Win32 ports. By design, we rely on #define flags to make some translation units empty. Hence, we don't want this warning to turn into an error. * config.h: 2021-06-10 Yusuke Suzuki [JSC] Remove useDataICInOptimizingJIT option https://bugs.webkit.org/show_bug.cgi?id=226862 Reviewed by Mark Lam. Originally this option is added to fix performance problem when using DataIC in DFG / FTL. But it turned out that that performance regression was caused due to disablement of InlineAccess when using DataIC. With the configuration using DataIC and InlineAccess, we do not observe performance regression. So, let's just drop this option. * jit/JITCode.h: (JSC::JITCode::useDataIC): * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: 2021-06-10 Adrian Perez de Castro Non-unified build fixes, early May 2021 edition https://bugs.webkit.org/show_bug.cgi?id=226763 Unreviewed non-unified build fixes. * bytecode/InlineAccess.h: Add missing forward declaration for the CodeBlock type. * jit/JITInlineCacheGenerator.cpp: Add missing CCallHelpers.h header. * runtime/Intrinsic.h: Add missing header. * yarr/YarrUnicodeProperties.h: Ditto. 2021-06-10 Yusuke Suzuki [JSC] Ignore Intl.NumberFormat feature options when linked-ICU is old https://bugs.webkit.org/show_bug.cgi?id=226861 rdar://77393100 Reviewed by Ross Kirsling. Let's just ignore the option when Intl.NumberFormat features cannot be implemented since the linked ICU is old. There is no way not to expose these features since Intl.NumberFormat's these changes are additional ones and Intl.NumberFormat existed before. * runtime/IntlNumberFormat.cpp: (JSC::IntlNumberFormat::initializeNumberFormat): 2021-06-09 Ross Kirsling [JSC] Rename *ByIdVariant to *ByVariant and *ByKind::Normal to *ByKind::ById https://bugs.webkit.org/show_bug.cgi?id=226750 Reviewed by Yusuke Suzuki. Cleanup patch following r278445. 1. {Get, Delete, In}ByStatus (but not `Put`) have had `Id` removed from their names; likewise, remove `Id` from the names of {Get, Delete, In}ByIdVariant. These are used *before* ByVal has been converted to ById. 2. The {Get, Del, In}ByKind enum classes shouldn't really call ById `Normal` -- let's say `ById` explicitly. 3. Bonus: In DFGBytecodeParser, move some *Status::computeFor calls inside the conditional that uses them. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/DeleteByStatus.cpp: (JSC::DeleteByStatus::appendVariant): (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback): (JSC::DeleteByStatus::visitAggregateImpl): (JSC::DeleteByStatus::markIfCheap): * bytecode/DeleteByStatus.h: * bytecode/DeleteByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/DeleteByIdVariant.cpp. (JSC::DeleteByVariant::DeleteByVariant): (JSC::DeleteByVariant::~DeleteByVariant): (JSC::DeleteByVariant::operator=): (JSC::DeleteByVariant::attemptToMerge): (JSC::DeleteByVariant::writesStructures const): (JSC::DeleteByVariant::visitAggregateImpl): (JSC::DeleteByVariant::markIfCheap): (JSC::DeleteByVariant::dump const): (JSC::DeleteByVariant::finalize): (JSC::DeleteByVariant::dumpInContext const): * bytecode/DeleteByVariant.h: Renamed from Source/JavaScriptCore/bytecode/DeleteByIdVariant.h. (JSC::DeleteByVariant::overlaps): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::appendVariant): (JSC::GetByStatus::computeFromLLInt): (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback): (JSC::GetByStatus::computeFor): (JSC::GetByStatus::merge): (JSC::GetByStatus::visitAggregateImpl): (JSC::GetByStatus::markIfCheap): (JSC::GetByStatus::finalize): * bytecode/GetByStatus.h: * bytecode/GetByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/GetByIdVariant.cpp. (JSC::GetByVariant::GetByVariant): (JSC::GetByVariant::~GetByVariant): (JSC::GetByVariant::operator=): (JSC::GetByVariant::canMergeIntrinsicStructures const): (JSC::GetByVariant::attemptToMerge): (JSC::GetByVariant::visitAggregateImpl): (JSC::GetByVariant::markIfCheap): (JSC::GetByVariant::finalize): (JSC::GetByVariant::dump const): (JSC::GetByVariant::dumpInContext const): * bytecode/GetByVariant.h: Renamed from Source/JavaScriptCore/bytecode/GetByIdVariant.h. (JSC::GetByVariant::overlaps): * bytecode/InByStatus.cpp: (JSC::InByStatus::appendVariant): (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): (JSC::InByStatus::merge): (JSC::InByStatus::markIfCheap): (JSC::InByStatus::finalize): * bytecode/InByStatus.h: * bytecode/InByVariant.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdVariant.cpp. (JSC::InByVariant::InByVariant): (JSC::InByVariant::attemptToMerge): (JSC::InByVariant::markIfCheap): (JSC::InByVariant::finalize): (JSC::InByVariant::dump const): (JSC::InByVariant::dumpInContext const): * bytecode/InByVariant.h: Renamed from Source/JavaScriptCore/bytecode/InByIdVariant.h. (JSC::InByVariant::overlaps): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::reset): * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicGetter): (JSC::DFG::ByteCodeParser::handleDOMJITGetter): (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::handleGetPrivateNameById): (JSC::DFG::ByteCodeParser::handleDeleteById): (JSC::DFG::ByteCodeParser::handleInById): (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitGetByOffset): (JSC::DFG::ConstantFoldingPhase::emitDeleteByOffset): * dfg/DFGNode.h: * dfg/DFGValidate.cpp: * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileDeleteById): (JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal): (JSC::FTL::DFG::LowerDFGToB3::compileMultiDeleteByOffset): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/Repatch.cpp: (JSC::appropriateOptimizingGetByFunction): (JSC::appropriateGetByFunction): (JSC::tryCacheGetBy): (JSC::repatchDeleteBy): (JSC::tryCacheInBy): (JSC::repatchInBy): (JSC::resetGetBy): (JSC::resetDelBy): (JSC::resetInBy): * jit/Repatch.h: 2021-06-09 Fujii Hironori clang-cl: JIT.h(966,67): error: no viable conversion from 'JSC::AbstractMacroAssembler::Address' to 'FunctionPtr' https://bugs.webkit.org/show_bug.cgi?id=226850 Reviewed by Yusuke Suzuki. WinCairo clang-cl builds got broken since r278656 (Bug 226072). * jit/JIT.h: Use the common callOperation(Address, Args...) for x64 Windows. Added static_assert to check the return type. 2021-06-09 Mark Lam Speculative build fix for Win32. https://bugs.webkit.org/show_bug.cgi?id=226793 rdar://79032803 Reviewed by Saam Barati. * API/JSCallbackObject.h: 2021-06-09 Xan Lopez [JSC] Fix incorrect register reuse in 32bit after r278568 https://bugs.webkit.org/show_bug.cgi?id=226817 Reviewed by Caio Araujo Neponoceno de Lima. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): The JSVALUE32_64 branch potentially needs both the tag and payload registers for both left/right nodes, so we cannot reuse any of them for the result since the first thing the code does is set it zero. Just remove the Reuse construction. 2021-06-09 Mikhail R. Gadelha Fix inadvertent tag corruption in functionAddressOf https://bugs.webkit.org/show_bug.cgi?id=226503 Reviewed by Darin Adler. Original patch by Angelos Oikonomopoulos. The cast was sign-extending the JSValue address in 32 bits, so that addresses that had the most significant set gave us a sign-extended result in asNumber which was then converted to an invalid NaN by the bitcast. Instead, cast the address to uintptr_t, and the result will be promoted uint64_t without sign-extending the address. * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): 2021-06-08 Yusuke Suzuki [JSC] Use DataIC for AccessCase https://bugs.webkit.org/show_bug.cgi?id=226072 Reviewed by Saam Barati and Filip Pizlo. This patch adds non-repatching IC for Baseline JIT in ARM64. This does not work in non-ARM64 architectures (including X64) due to the use of link-register. 1. We add non-repatching IC, which is enabled only in Baseline due to performance reason. We are using the existing IC in DFG and FTL. Non-repatching includes fast-path, and slow-path's operation function. 2. We still keep InlineAccess in all tiers. Removing that causes 0.3 ~ 1.0% regression in Speedometer2. This means that we still need some repatching when we first introduce stubs. 3. We add a mechanism to share generated code stubs in non-repatching IC. Currently, getter / setter / custom accessors are excluded since their code relies on JSGlobalObject, CodeBlock etc. which are not included in AccessCase's data structure. 4. This patch still relies on that CodeBlock will be destroyed synchronously since we need to ensure that sharing-hash-table does not include already-dead JIT code stubs. We can fix it (e.g. annotating epoch to these stubs, bump them in finalizeUnconditionally), but we avoid doing that to prevent from further enlarging this patch. This patch is already significant in its size. 5. Added callOperation(Address) support in CCallHelpers, which can save the target in nonArgGPR0, and call it so that we can use Address including GPR which is also used for arguments. Performance is neutral in JetStream2 and Speedometer2. But it offers the way to remove some code generation in Baseline. * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::call): * bytecode/AccessCase.cpp: (JSC::AccessCase::create): (JSC::AccessCase::createTransition): (JSC::AccessCase::createDelete): (JSC::AccessCase::createCheckPrivateBrand): (JSC::AccessCase::createSetPrivateBrand): (JSC::AccessCase::fromStructureStubInfo): (JSC::AccessCase::clone const): (JSC::AccessCase::generateWithGuard): (JSC::AccessCase::generateImpl): (JSC::AccessCase::canBeShared): * bytecode/AccessCase.h: (JSC::AccessCase::hash const): (JSC::AccessCase::AccessCase): (JSC::SharedJITStubSet::Hash::Key::Key): (JSC::SharedJITStubSet::Hash::Key::isHashTableDeletedValue const): (JSC::SharedJITStubSet::Hash::Key::operator==): (JSC::SharedJITStubSet::Hash::hash): (JSC::SharedJITStubSet::Hash::equal): (JSC::SharedJITStubSet::Searcher::Translator::hash): (JSC::SharedJITStubSet::Searcher::Translator::equal): (JSC::SharedJITStubSet::PointerTranslator::hash): (JSC::SharedJITStubSet::PointerTranslator::equal): (JSC::SharedJITStubSet::add): (JSC::SharedJITStubSet::remove): (JSC::SharedJITStubSet::find): * bytecode/ByValInfo.h: (JSC::ByValInfo::setUp): (JSC::ByValInfo::offsetOfSlowOperation): (JSC::ByValInfo::offsetOfNotIndexJumpTarget): (JSC::ByValInfo::offsetOfBadTypeJumpTarget): * bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::initializeDirectCall): (JSC::CallLinkInfo::setDirectCallTarget): * bytecode/CodeBlock.h: (JSC::CodeBlock::useDataIC const): * bytecode/GetterSetterAccessCase.cpp: (JSC::GetterSetterAccessCase::create): (JSC::GetterSetterAccessCase::clone const): (JSC::GetterSetterAccessCase::emitDOMJITGetter): * bytecode/GetterSetterAccessCase.h: * bytecode/InlineAccess.cpp: (JSC::getScratchRegister): (JSC::InlineAccess::rewireStubAsJumpInAccessNotUsingInlineAccess): (JSC::InlineAccess::rewireStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccess): (JSC::InlineAccess::resetStubAsJumpInAccessNotUsingInlineAccess): (JSC::InlineAccess::rewireStubAsJump): Deleted. * bytecode/InlineAccess.h: * bytecode/InstanceOfAccessCase.cpp: (JSC::InstanceOfAccessCase::create): (JSC::InstanceOfAccessCase::clone const): * bytecode/InstanceOfAccessCase.h: * bytecode/IntrinsicGetterAccessCase.cpp: (JSC::IntrinsicGetterAccessCase::create): (JSC::IntrinsicGetterAccessCase::clone const): * bytecode/IntrinsicGetterAccessCase.h: * bytecode/ModuleNamespaceAccessCase.cpp: (JSC::ModuleNamespaceAccessCase::create): (JSC::ModuleNamespaceAccessCase::clone const): * bytecode/ModuleNamespaceAccessCase.h: * bytecode/ObjectPropertyConditionSet.h: (JSC::ObjectPropertyConditionSet::hash const): (JSC::ObjectPropertyConditionSet::operator==): (JSC::ObjectPropertyConditionSet::operator!=): * bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::installWatchpoint): (JSC::AccessGenerationState::succeed): (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): (JSC::PolymorphicAccess::addCases): (JSC::PolymorphicAccess::addCase): (JSC::PolymorphicAccess::visitWeak const): (JSC::PolymorphicAccess::regenerate): * bytecode/PolymorphicAccess.h: (JSC::AccessGenerationState::AccessGenerationState): (JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): * bytecode/ProxyableAccessCase.cpp: (JSC::ProxyableAccessCase::create): (JSC::ProxyableAccessCase::clone const): * bytecode/ProxyableAccessCase.h: * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::StructureStubInfo): (JSC::StructureStubInfo::addAccessCase): (JSC::StructureStubInfo::reset): * bytecode/StructureStubInfo.h: (JSC::StructureStubInfo::offsetOfCodePtr): (JSC::StructureStubInfo::offsetOfSlowPathStartLocation): (JSC::StructureStubInfo::offsetOfSlowOperation): (JSC::StructureStubInfo::patchableJump): Deleted. * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::appendCall): * dfg/DFGSlowPathGenerator.h: (JSC::DFG::slowPathICCall): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetById): (JSC::DFG::SpeculativeJIT::compileGetByIdFlush): (JSC::DFG::SpeculativeJIT::compileDeleteById): (JSC::DFG::SpeculativeJIT::compileDeleteByVal): (JSC::DFG::SpeculativeJIT::compileInById): (JSC::DFG::SpeculativeJIT::compileInByVal): (JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal): (JSC::DFG::SpeculativeJIT::compileGetPrivateNameById): (JSC::DFG::SpeculativeJIT::compilePutPrivateNameById): (JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand): (JSC::DFG::SpeculativeJIT::compileSetPrivateBrand): (JSC::DFG::SpeculativeJIT::compileInstanceOfForCells): (JSC::DFG::SpeculativeJIT::compileInstanceOf): (JSC::DFG::SpeculativeJIT::compilePutByIdFlush): (JSC::DFG::SpeculativeJIT::compilePutById): (JSC::DFG::SpeculativeJIT::compilePutByIdDirect): (JSC::DFG::SpeculativeJIT::cachedPutById): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::callOperation): (JSC::DFG::SpeculativeJIT::appendCall): (JSC::DFG::SpeculativeJIT::appendCallSetResult): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::getPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLSlowPathCall.cpp: (JSC::FTL::SlowPathCallContext::SlowPathCallContext): (JSC::FTL::SlowPathCallContext::keyWithTarget const): (JSC::FTL::SlowPathCallContext::makeCall): * ftl/FTLSlowPathCall.h: (JSC::FTL::callOperation): * ftl/FTLSlowPathCallKey.cpp: (JSC::FTL::SlowPathCallKey::dump const): * ftl/FTLSlowPathCallKey.h: (JSC::FTL::SlowPathCallKey::SlowPathCallKey): (JSC::FTL::SlowPathCallKey::indirectOffset const): (JSC::FTL::SlowPathCallKey::withCallTarget): (JSC::FTL::SlowPathCallKey::operator== const): (JSC::FTL::SlowPathCallKey::hash const): * ftl/FTLThunks.cpp: (JSC::FTL::genericGenerationThunkGenerator): (JSC::FTL::slowPathCallThunkGenerator): * jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitVirtualCall): * jit/CCallHelpers.cpp: (JSC::CCallHelpers::emitJITCodeOver): * jit/CCallHelpers.h: (JSC::CCallHelpers::ArgCollection::ArgCollection): (JSC::CCallHelpers::ArgCollection::pushRegArg): (JSC::CCallHelpers::ArgCollection::pushExtraRegArg): (JSC::CCallHelpers::ArgCollection::pushNonArg): (JSC::CCallHelpers::ArgCollection::addGPRArg): (JSC::CCallHelpers::ArgCollection::addGPRExtraArg): (JSC::CCallHelpers::ArgCollection::addStackArg): (JSC::CCallHelpers::ArgCollection::addPoke): (JSC::CCallHelpers::calculatePokeOffset): (JSC::CCallHelpers::pokeForArgument): (JSC::CCallHelpers::stackAligned): (JSC::CCallHelpers::marshallArgumentRegister): (JSC::CCallHelpers::setupArgumentsImpl): (JSC::CCallHelpers::pokeArgumentsAligned): (JSC::CCallHelpers::std::is_integral::value): (JSC::CCallHelpers::std::is_pointer::value): (JSC::CCallHelpers::setupArgumentsEntryImpl): (JSC::CCallHelpers::setupArguments): (JSC::CCallHelpers::setupArgumentsForIndirectCall): * jit/GCAwareJITStubRoutine.cpp: (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine): (JSC::GCAwareJITStubRoutine::makeGCAware): (JSC::GCAwareJITStubRoutine::observeZeroRefCount): (JSC::PolymorphicAccessJITStubRoutine::PolymorphicAccessJITStubRoutine): (JSC::PolymorphicAccessJITStubRoutine::observeZeroRefCount): (JSC::PolymorphicAccessJITStubRoutine::computeHash): (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine): (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler): (JSC::createICJITStubRoutine): (JSC::createJITStubRoutine): Deleted. * jit/GCAwareJITStubRoutine.h: (JSC::GCAwareJITStubRoutine::create): (JSC::PolymorphicAccessJITStubRoutine::cases const): (JSC::PolymorphicAccessJITStubRoutine::weakStructures const): (JSC::PolymorphicAccessJITStubRoutine::hash const): * jit/GPRInfo.h: * jit/JIT.cpp: (JSC::JIT::link): * jit/JIT.h: * jit/JITCall.cpp: (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emitSlow_op_iterator_open): (JSC::JIT::emit_op_iterator_next): (JSC::JIT::emitSlow_op_iterator_next): * jit/JITCall32_64.cpp: (JSC::JIT::emit_op_iterator_open): (JSC::JIT::emit_op_iterator_next): * jit/JITCode.h: (JSC::JITCode::useDataIC): * jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITInlineCacheGenerator::finalize): (JSC::JITByIdGenerator::JITByIdGenerator): (JSC::JITByIdGenerator::finalize): (JSC::JITByIdGenerator::generateFastCommon): (JSC::JITGetByIdGenerator::JITGetByIdGenerator): (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator): (JSC::JITPutByIdGenerator::JITPutByIdGenerator): (JSC::JITDelByValGenerator::JITDelByValGenerator): (JSC::JITDelByValGenerator::generateFastPath): (JSC::JITDelByValGenerator::finalize): (JSC::JITDelByIdGenerator::JITDelByIdGenerator): (JSC::JITDelByIdGenerator::generateFastPath): (JSC::JITDelByIdGenerator::finalize): (JSC::JITInByValGenerator::JITInByValGenerator): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByValGenerator::finalize): (JSC::JITInByIdGenerator::JITInByIdGenerator): (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator): (JSC::JITInstanceOfGenerator::generateFastPath): (JSC::JITInstanceOfGenerator::finalize): (JSC::JITGetByValGenerator::JITGetByValGenerator): (JSC::JITGetByValGenerator::generateFastPath): (JSC::JITGetByValGenerator::finalize): (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator): (JSC::JITPrivateBrandAccessGenerator::generateFastPath): (JSC::JITPrivateBrandAccessGenerator::finalize): * jit/JITInlineCacheGenerator.h: (JSC::JITGetByIdGenerator::JITGetByIdGenerator): Deleted. (JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator): Deleted. (JSC::JITPutByIdGenerator::JITPutByIdGenerator): Deleted. (JSC::JITDelByValGenerator::JITDelByValGenerator): Deleted. (JSC::JITDelByValGenerator::slowPathJump const): Deleted. (JSC::JITDelByIdGenerator::JITDelByIdGenerator): Deleted. (JSC::JITDelByIdGenerator::slowPathJump const): Deleted. (JSC::JITInByIdGenerator::JITInByIdGenerator): Deleted. (JSC::JITInstanceOfGenerator::JITInstanceOfGenerator): Deleted. (JSC::JITGetByValGenerator::JITGetByValGenerator): Deleted. (JSC::JITGetByValGenerator::slowPathJump const): Deleted. (JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator): Deleted. (JSC::JITPrivateBrandAccessGenerator::slowPathJump const): Deleted. * jit/JITInlines.h: (JSC::JIT::emitLoadForArrayMode): (JSC::JIT::appendCallWithExceptionCheck): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult): (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile): * jit/JITOpcodes.cpp: (JSC::JIT::emit_op_instanceof): (JSC::JIT::emitSlow_op_instanceof): (JSC::JIT::privateCompileHasIndexedProperty): (JSC::JIT::emit_op_has_enumerable_indexed_property): (JSC::JIT::emitSlow_op_has_enumerable_indexed_property): * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_instanceof): (JSC::JIT::privateCompileHasIndexedProperty): (JSC::JIT::emit_op_has_enumerable_indexed_property): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::slow_op_get_by_val_prepareCallGenerator): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emitSlow_op_get_private_name): (JSC::JIT::slow_op_get_private_name_prepareCallGenerator): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emitSlow_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emitSlow_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitGenericContiguousPutByVal): (JSC::JIT::emitArrayStoragePutByVal): (JSC::JIT::emitPutByValWithCachedId): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::slow_op_put_by_val_prepareCallGenerator): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emitSlow_op_put_private_name): (JSC::JIT::slow_op_put_private_name_prepareCallGenerator): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emitSlow_op_del_by_id): (JSC::JIT::slow_op_del_by_id_prepareCallGenerator): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emitSlow_op_del_by_val): (JSC::JIT::slow_op_del_by_val_prepareCallGenerator): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emitSlow_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emitSlow_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::slow_op_get_by_id_prepareCallGenerator): (JSC::JIT::emitSlow_op_get_by_id_with_this): (JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::slow_op_put_by_id_prepareCallGenerator): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emitSlow_op_in_by_id): (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): (JSC::JIT::privateCompilePutByVal): (JSC::JIT::privateCompilePutPrivateNameWithCachedId): (JSC::JIT::privateCompilePutByValWithCachedId): (JSC::JIT::emitDoubleLoad): (JSC::JIT::emitContiguousLoad): (JSC::JIT::emitArrayStorageLoad): (JSC::JIT::emitIntTypedArrayPutByVal): (JSC::JIT::emitFloatTypedArrayPutByVal): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_del_by_val): (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_get_private_name): (JSC::JIT::emit_op_set_private_brand): (JSC::JIT::emit_op_check_private_brand): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitGenericContiguousPutByVal): (JSC::JIT::emitArrayStoragePutByVal): (JSC::JIT::emit_op_try_get_by_id): (JSC::JIT::emit_op_get_by_id_direct): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emit_op_get_by_id_with_this): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emit_op_in_by_id): (JSC::JIT::emit_op_in_by_val): * jit/JITStubRoutine.h: * jit/PolymorphicCallStubRoutine.cpp: (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine): * jit/Repatch.cpp: (JSC::readPutICCallTarget): (JSC::repatchSlowPathCall): (JSC::tryCacheGetBy): (JSC::repatchGetBy): (JSC::tryCacheArrayGetByVal): (JSC::repatchArrayGetByVal): (JSC::tryCachePutByID): (JSC::repatchPutByID): (JSC::tryCacheDeleteBy): (JSC::repatchDeleteBy): (JSC::tryCacheInBy): (JSC::repatchInBy): (JSC::tryCacheCheckPrivateBrand): (JSC::repatchCheckPrivateBrand): (JSC::tryCacheSetPrivateBrand): (JSC::repatchSetPrivateBrand): (JSC::tryCacheInstanceOf): (JSC::repatchInstanceOf): (JSC::linkSlowFor): (JSC::linkVirtualFor): (JSC::resetGetBy): (JSC::resetPutByID): (JSC::resetDelBy): (JSC::resetInBy): (JSC::resetInstanceOf): (JSC::resetCheckPrivateBrand): (JSC::resetSetPrivateBrand): (JSC::resetPatchableJump): Deleted. * jit/Repatch.h: * runtime/Options.cpp: (JSC::Options::recomputeDependentOptions): * runtime/OptionsList.h: * runtime/StructureIDTable.h: * runtime/VM.cpp: (JSC::VM::VM): (JSC::VM::~VM): * runtime/VM.h: 2021-06-08 Robin Morisset Fix speculated type in speculateNeitherDoubleNorHeapBigIntNorString https://bugs.webkit.org/show_bug.cgi?id=226786 Reviewed by Mark Lam. I had forgotten the HeapBigInt part. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): 2021-06-06 Yusuke Suzuki [JSC] Use ResolvedClosureVar to get brand from scope https://bugs.webkit.org/show_bug.cgi?id=226677 rdar://78802869 Reviewed by Saam Barati. Private brand lookup is doing wrong way to get scope. 1. op_resolve_scope with private name (e.g. #x) 2. then, doing op_get_from_scope with (1)'s scope with different name (e.g. @privateBrand) This is wrong in JSC. We resolve scope at link-time in CodeBlock. So we need to ensure that both op_resolve_scope and op_get_from_scope starts with the current scope-register. As a result, private-brand lookup is broken right now. Let's see the buggy case. class D { #x() {} m() { class C { #yy; #z() { } a() { this.#x(); // <===== This point. } } let c = new C(); c.a(); } } In the above point, we first lookup the scope with #x, and we get the D's class-scope. But our get_from_scope is using privateBrand, and privateBrand property exists too in C's class-scope too since C also has #yy and #z. As a result, CodeBlock linking configures the offset for C's class-scope in get_from_scope. And this offset is different from D's class-scope's privateBrand. Only allowed case for the above usage is ResolvedClosureVar. And generatorification uses it too. In this patch, 1. We ensure that class-scope (with private name) must have @privateBrand and @privateClassBrand with offset 1 and 0. 2. Use ResolvedClosureVar with the above pre-defined offset Since CodeBlock's linking does not resolve the scope for get_from_scope if it is ResolvedClosureVar, we can just perform the desired ResolvedClosureVar lookup with the given scope with the compiled offset. * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator): (JSC::BytecodeGenerator::instantiateLexicalVariables): (JSC::BytecodeGenerator::pushLexicalScope): (JSC::BytecodeGenerator::pushLexicalScopeInternal): (JSC::BytecodeGenerator::emitCreatePrivateBrand): (JSC::BytecodeGenerator::emitGetPrivateBrand): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::BaseDotNode::emitGetPropertyValue): (JSC::BaseDotNode::emitPutProperty): (JSC::PostfixNode::emitDot): (JSC::PrefixNode::emitDot): (JSC::InNode::emitBytecode): (JSC::BlockNode::emitBytecode): (JSC::ForNode::emitBytecode): (JSC::ForInNode::emitBytecode): (JSC::ForOfNode::emitBytecode): (JSC::SwitchNode::emitBytecode): (JSC::ClassExprNode::emitBytecode): * parser/Parser.cpp: (JSC::Parser::parseClass): * parser/VariableEnvironment.h: 2021-06-07 Alexey Shvayka Unreviewed, reland r276592 with a fix for put() override in prototype chain of a JSProxy https://bugs.webkit.org/show_bug.cgi?id=226185 The API test added in r278366 revealed a flaw in JSObject::definePropertyOnReceiver() that caused putDirectInternal() to be performed on a JSProxy instead of it's target. Remedies that via a type check, ensuring the test and iOS apps are functional. The issue was originally missed because the prototype chain of a global object is immutable and none of the global object's prototypes override put(). OpaqueJSClass::prototype() sets the [[Prototype]] directly, ignoring the IsImmutablePrototypeExoticObject type info flag. Also, excludes an invariant from the original patch that required put() to be overriden when implementing custom [[DefineOwnProperty]]. It is now broken by WindowProperties object. * API/JSCallbackObject.h: * API/JSCallbackObjectFunctions.h: (JSC::JSCallbackObject::put): * API/tests/testapiScripts/testapi.js: * debugger/DebuggerScope.h: * runtime/ClassInfo.h: * runtime/ClonedArguments.h: * runtime/CustomGetterSetter.cpp: (JSC::callCustomSetter): Deleted. * runtime/CustomGetterSetter.h: * runtime/ErrorConstructor.h: * runtime/ErrorInstance.h: * runtime/GenericArguments.h: * runtime/GenericArgumentsInlines.h: (JSC::GenericArguments::put): * runtime/GetterSetter.h: * runtime/JSArray.cpp: (JSC::JSArray::put): * runtime/JSArray.h: * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::put): Deleted. * runtime/JSArrayBufferView.h: * runtime/JSCJSValue.cpp: (JSC::JSValue::putToPrimitive): * runtime/JSCell.cpp: (JSC::JSCell::doPutPropertySecurityCheck): Deleted. * runtime/JSCell.h: * runtime/JSFunction.cpp: (JSC::JSFunction::put): * runtime/JSFunction.h: * runtime/JSGenericTypedArrayView.h: * runtime/JSGlobalLexicalEnvironment.h: * runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::put): * runtime/JSGlobalObject.h: * runtime/JSLexicalEnvironment.h: * runtime/JSModuleEnvironment.h: * runtime/JSModuleNamespaceObject.h: * runtime/JSObject.cpp: (JSC::JSObject::getOwnPropertySlot): (JSC::JSObject::putInlineSlow): (JSC::definePropertyOnReceiverSlow): (JSC::JSObject::definePropertyOnReceiver): (JSC::JSObject::putInlineFastReplacingStaticPropertyIfNeeded): (JSC::JSObject::doPutPropertySecurityCheck): Deleted. (JSC::JSObject::prototypeChainMayInterceptStoreTo): Deleted. * runtime/JSObject.h: (JSC::JSObject::putByIndexInline): (JSC::JSObject::hasNonReifiedStaticProperties): (JSC::JSObject::getOwnPropertySlot): (JSC::JSObject::putDirect): (JSC::JSObject::doPutPropertySecurityCheck): Deleted. * runtime/JSObjectInlines.h: (JSC::JSObject::canPerformFastPutInlineExcludingProto): (JSC::JSObject::putInlineForJSObject): (JSC::JSObject::putInlineFast): (JSC::JSObject::putDirectInternal): * runtime/JSProxy.h: * runtime/JSTypeInfo.h: (JSC::TypeInfo::hasStaticPropertyTable const): (JSC::TypeInfo::overridesPut const): (JSC::TypeInfo::getOwnPropertySlotMayBeWrongAboutDontEnum const): (JSC::TypeInfo::hasPutPropertySecurityCheck const): Deleted. * runtime/Lookup.h: (JSC::putEntry): Deleted. (JSC::lookupPut): Deleted. * runtime/PropertySlot.h: * runtime/ProxyObject.cpp: (JSC::ProxyObject::put): * runtime/ProxyObject.h: * runtime/PutPropertySlot.h: (JSC::PutPropertySlot::PutPropertySlot): (JSC::PutPropertySlot::context const): (JSC::PutPropertySlot::isTaintedByOpaqueObject const): (JSC::PutPropertySlot::setIsTaintedByOpaqueObject): * runtime/ReflectObject.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/RegExpObject.cpp: (JSC::RegExpObject::put): * runtime/RegExpObject.h: * runtime/StringObject.cpp: (JSC::StringObject::put): * runtime/StringObject.h: * runtime/StringPrototype.cpp: (JSC::StringPrototype::finishCreation): (JSC::StringPrototype::create): * runtime/StringPrototype.h: * runtime/Structure.cpp: (JSC::Structure::validateFlags): * runtime/Structure.h: (JSC::Structure::hasNonReifiedStaticProperties const): * tools/JSDollarVM.cpp: 2021-06-07 Alexey Shvayka Introduce LexicalScopeFeatures to enable future bytecode optimizations https://bugs.webkit.org/show_bug.cgi?id=224072 Reviewed by Keith Miller. Before this patch, BytecodeGenerator was capable of reasoning about the presence of `with` statements, direct `eval`, or any other code features only within the current executable: ``` with (foo) { (function() { // There was no way to detect WithScope during generation of this function. })(); } ``` This change is required for op_to_this rewrite (#225397): if FunctionCallResolveNode and friends knew there is no WithScope, op_call could be emitted with |this| value of `undefined` as per spec [1], instead of resolved scope. This would: - simplify op_to_this on all tiers, likely resulting in minor perf boost; - save 1 instruction per strict function by removing op_to_this; - remove toThis() from the method table and ~30 its call sites from built-ins; - fix built-in methods that were observably lacking toThis(); - fix __proto__ getter / setter called on global scope; - fix WebIDL accessors called with |this| value of `undefined` and `null`. Also, if ResolveNode knew that unforgeable global properties are not shadowed and there is no `with` statement or sloppy mode direct `eval`, then `undefined` / `Infinity` / `NaN` lookups could be constant-folded. This would save up to 3 bytecode ops per each usage and allow emitting op_is_undefined_or_null for `x === undefined || x === null`. V8 performs this optimization [2]. This patch introduces LexicalScopeFeatures to allow passing such information from Parser to BytecodeGenerator with a minimal code diff. These features are kept separate from CodeFeature to simplify reasoning about feature's scope and because we need to propagate lexical features from parent to child scope. Strict mode is the first use case of LexicalScopeFeatures, which this change carefully fits into existing abstractions without increasing their memory usage even by 1 byte. [1]: https://tc39.es/ecma262/#sec-evaluatecall (step 2) [2]: https://medium.com/@bmeurer/sometimes-undefined-is-defined-7701e1c9eff8 * builtins/BuiltinExecutables.cpp: (JSC::BuiltinExecutables::createExecutable): * bytecode/UnlinkedCodeBlock.cpp: (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): * bytecode/UnlinkedCodeBlock.h: (JSC::UnlinkedCodeBlock::recordParse): (JSC::UnlinkedCodeBlock::lexicalScopeFeatures const): * bytecode/UnlinkedFunctionExecutable.cpp: (JSC::generateUnlinkedFunctionCodeBlock): (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable): (JSC::UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets): * bytecode/UnlinkedFunctionExecutable.h: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator): (JSC::BytecodeGenerator::emitNewClassFieldInitializerFunction): * bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::lexicalScopeFeatures const): (JSC::BytecodeGenerator::generate): * parser/ASTBuilder.h: (JSC::ASTBuilder::createFunctionMetadata): * parser/Nodes.cpp: (JSC::ScopeNode::ScopeNode): (JSC::ProgramNode::ProgramNode): (JSC::ModuleProgramNode::ModuleProgramNode): (JSC::EvalNode::EvalNode): (JSC::FunctionMetadataNode::FunctionMetadataNode): (JSC::FunctionMetadataNode::operator== const): (JSC::FunctionMetadataNode::dump const): (JSC::FunctionNode::FunctionNode): * parser/Nodes.h: (JSC::ScopeNode::lexicalScopeFeatures): (JSC::ScopeNode::isStrictMode const): * parser/Parser.cpp: (JSC::Parser::parseInner): (JSC::Parser::parseGeneratorFunctionSourceElements): (JSC::Parser::parseAsyncFunctionSourceElements): (JSC::Parser::parseAsyncGeneratorFunctionSourceElements): (JSC::Parser::parseFunctionBody): (JSC::Parser::parseFunctionInfo): * parser/Parser.h: (JSC::Scope::Scope): (JSC::Scope::lexicalScopeFeatures const): (JSC::Scope::setStrictMode): (JSC::Scope::strictMode const): (JSC::Scope::fillParametersForSourceProviderCache): (JSC::Scope::restoreFromSourceProviderCache): (JSC::Parser::pushScope): (JSC::Parser::lexicalScopeFeatures): (JSC::Parser::parse): * parser/ParserModes.h: * parser/SourceProviderCacheItem.h: (JSC::SourceProviderCacheItem::lexicalScopeFeatures const): (JSC::SourceProviderCacheItem::SourceProviderCacheItem): * parser/SyntaxChecker.h: (JSC::SyntaxChecker::createFunctionMetadata): * runtime/CachedBytecode.cpp: (JSC::CachedBytecode::addFunctionUpdate): * runtime/CachedTypes.cpp: (JSC::CachedFunctionExecutable::lexicalScopeFeatures const): (JSC::CachedCodeBlock::lexicalScopeFeatures const): (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): (JSC::CachedFunctionExecutable::encode): (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable): (JSC::CachedCodeBlock::encode): (JSC::CachedFunctionExecutable::isInStrictContext const): Deleted. * runtime/CachedTypes.h: * runtime/CodeCache.cpp: (JSC::generateUnlinkedCodeBlockImpl): (JSC::CodeCache::getUnlinkedGlobalCodeBlock): * runtime/ECMAMode.h: (JSC::ECMAMode::fromBool): * runtime/FunctionExecutable.cpp: (JSC::FunctionExecutable::FunctionExecutable): * runtime/GlobalExecutable.h: (JSC::GlobalExecutable::recordParse): (JSC::GlobalExecutable::GlobalExecutable): * runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::ScriptExecutable): (JSC::ScriptExecutable::newCodeBlockFor): (JSC::ScriptExecutable::recordParse): * runtime/ScriptExecutable.h: (JSC::ScriptExecutable::isInStrictContext const): (JSC::ScriptExecutable::recordParse): 2021-06-07 Commit Queue Unreviewed, reverting r278371 and r278463. https://bugs.webkit.org/show_bug.cgi?id=226749 Break dumpDisassembly in JetStream2 Reverted changesets: "We should drop B3 values while running Air" https://bugs.webkit.org/show_bug.cgi?id=226187 https://trac.webkit.org/changeset/278371 "Drop the FTL(DFG) graph after lowering to B3" https://bugs.webkit.org/show_bug.cgi?id=226556 https://trac.webkit.org/changeset/278463 2021-06-07 Alexey Shvayka Window should behave like a legacy platform object without indexed setter https://bugs.webkit.org/show_bug.cgi?id=225894 Reviewed by Darin Adler. * runtime/TypeError.h: (JSC::typeError): 2021-06-07 Saam Barati Short circuit read modify write nodes emit byte code that uses the wrong locals https://bugs.webkit.org/show_bug.cgi?id=226576 Reviewed by Yusuke Suzuki. It's never a good idea to use the wrong local :-) This patch also adds support for dumping predecessors of basic blocks in the bytecode dump. * bytecode/BytecodeDumper.cpp: (JSC::CodeBlockBytecodeDumper::dumpGraph): * bytecompiler/NodesCodegen.cpp: (JSC::ShortCircuitReadModifyResolveNode::emitBytecode): (JSC::ShortCircuitReadModifyDotNode::emitBytecode): (JSC::ShortCircuitReadModifyBracketNode::emitBytecode): 2021-06-07 Mark Lam Put the Baseline JIT prologue and op_loop_hint code in JIT thunks. https://bugs.webkit.org/show_bug.cgi?id=226375 Reviewed by Keith Miller and Robin Morisset. Baseline JIT prologue code varies in behavior based on several variables. These variables include (1) whether the prologue does any arguments value profiling, (2) whether the prologue is for a constructor, and (3) whether the compiled CodeBlock will have such a large frame that it is greater than the stack reserved zone (aka red zone) which would require additional stack check logic. The pre-existing code would generate specialized code based on these (and other variables). In converting to using thunks for the prologue, we opt not to convert these specializations into runtime checks. Instead, the implementation uses 1 of 8 possible specialized thunks to reduce the need to pass arguments for runtime checks. The only needed argument passed to the prologue thunks is the codeBlock pointer. There are 8 possible thunks because we specialize based on 3 variables: 1. doesProfiling 2. isConstructor 3. hasHugeFrame 2**3 yields 8 permutations of prologue thunk specializations. Similarly, there are also 8 analogous arity fixup prologues that work similarly. The op_loop_hint thunk only takes 1 runtime argument: the bytecode offset. We've tried doing the loop_hint optimization check in the thunk (in order to move both the fast and slow path into the thunk for maximum space savings). However, this seems to have some slight negative impact on benchmark performance. We ended up just keeping the fast path and instead have the slow path call a thunk to do its work. This realizes the bulk of the size savings without the perf impact. This patch also optimizes op_enter a bit more by eliminating the need to pass any arguments to the thunk. The thunk previously took 2 arguments: localsToInit and canBeOptimized. localsToInit is now computed in the thunk at runtime, and canBeOptimized is used as a specialization argument to generate 2 variants of the op_enter thunk: op_enter_canBeOptimized_Generator and op_enter_cannotBeOptimized_Generator, thereby removing the need to pass it as a runtime argument. LinkBuffer size results (from a single run of Speedometer2): BaselineJIT: 93319628 (88.996532 MB) => 83851824 (79.967331 MB) 0.90x ExtraCTIThunk: 5992 (5.851562 KB) => 6984 (6.820312 KB) 1.17x ... Total: 197530008 (188.379295 MB) => 188459444 (179.728931 MB) 0.95x Speedometer2 and JetStream2 results (as measured on an M1 Mac) are neutral. * assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::untagReturnAddressWithoutExtraValidation): * assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagReturnAddress): (JSC::MacroAssemblerARM64E::untagReturnAddressWithoutExtraValidation): * assembler/MacroAssemblerARMv7.h: (JSC::MacroAssemblerARMv7::branchAdd32): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::branchAdd32): * bytecode/CodeBlock.h: (JSC::CodeBlock::offsetOfNumCalleeLocals): (JSC::CodeBlock::offsetOfNumVars): (JSC::CodeBlock::offsetOfArgumentValueProfiles): (JSC::CodeBlock::offsetOfShouldAlwaysBeInlined): * jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): (JSC::AssemblyHelpers::emitSaveCalleeSavesForBaselineJIT): (JSC::AssemblyHelpers::emitRestoreCalleeSavesForBaselineJIT): * jit/JIT.cpp: (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::prologueGenerator): (JSC::JIT::arityFixupPrologueGenerator): (JSC::JIT::privateCompileExceptionHandlers): * jit/JIT.h: * jit/JITInlines.h: (JSC::JIT::emitNakedNearCall): * jit/JITOpcodes.cpp: (JSC::JIT::op_ret_handlerGenerator): (JSC::JIT::emit_op_enter): (JSC::JIT::op_enter_Generator): (JSC::JIT::op_enter_canBeOptimized_Generator): (JSC::JIT::op_enter_cannotBeOptimized_Generator): (JSC::JIT::emit_op_loop_hint): (JSC::JIT::emitSlow_op_loop_hint): (JSC::JIT::op_loop_hint_Generator): (JSC::JIT::op_enter_handlerGenerator): Deleted. * jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_enter): * jit/ThunkGenerators.cpp: (JSC::popThunkStackPreservesAndHandleExceptionGenerator): 2021-06-07 Robin Morisset Optimize compareStrictEq when neither side is a double and at least one is neither a string nor a BigInt https://bugs.webkit.org/show_bug.cgi?id=226676 Reviewed by Filip Pizlo. There is exactly one case where x === y must return false despite x and y being JSValues with the same bits: NaN === NaN There are a few cases where x === y must return true despite x and y being JSValues with potentially different bits: Double === Int32 String === String HeapBigInt === HeapBigInt HeapBigInt === BigInt32 (if they are enabled) If we don't have a double on either side, at least one side has neither a String nor a HeapBigInt, and BigInt32 are disabled, we can clearly ignore all of these pathological cases. This optimization was decided based on looking at DFG graphs of Speedometer2; here is a sample of the compareStrictEq(Untyped, Untyped), courtesy of Phil: Final|Array|String|Bool, Final|Array|String|Bool Array|String|Bool, String|Bool (twice) Array|String|Bool, String|Int32 (once in DFG, once in FTL) ! Array|String|Bool, Array|Bool ! Final|Other, Final|Other ! Int32|Other, Int32 Final|StringIdent, Final|StringIdent (3 times) Final|StringIdent|BoolInt32, StringIdent|BoolInt32 (twice) String|Bool, String|Bool (4 times) DoublePureNaN, String|Bool ! Other, Function|Other ! Final|Other, Final|Function|Other (twice) Final|String|Bool|Other, Final|String|Bool|Other (3 times, two in the FTL) Final|String|Int32, String|Int32 (four times) String|Int32|Bool, Function|String|Int32|Bool (twice) String|DoublePureNaN, String|Bool (twice) ! Final|Bool|Other, Final|Function|Other (four times, twice in FTL) I marked with a ! those for which this optimization should apply. The only slightly interesting part of this patch is DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString where I took care to skip every test whose result we can predict from the abstract interpreter. Results on microbenchmarks: poly-stricteq-not-double 45.5793+-0.5304 ? 46.0306+-0.5621 ? poly-stricteq-not-double-nor-string 45.5829+-0.5750 ^ 16.9089+-0.3070 ^ definitely 2.6958x faster poly-stricteq 49.9719+-0.6450 48.9855+-0.5227 might be 1.0201x faster I also measured the amount of code that we generate in the DFG on JetStream2. The results here are disappointing but still measurable. Before: DFG_fast_CompareStrictEq totalBytes: 468425 count: 10951 avg: 42.774632 DFG_fast_CompareStrictEq totalBytes: 468020 count: 10917 avg: 42.870752 DFG_fast_CompareStrictEq totalBytes: 467424 count: 10888 avg: 42.930198 After: DFG_fast_CompareStrictEq totalBytes: 463946 count: 10917 avg: 42.497573 DFG_fast_CompareStrictEq totalBytes: 474492 count: 11138 avg: 42.601185 DFG_fast_CompareStrictEq totalBytes: 467138 count: 10970 avg: 42.583227 * bytecode/SpeculatedType.h: (JSC::isNeitherDoubleNorHeapBigIntNorStringSpeculation): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue): * dfg/DFGNode.h: (JSC::DFG::Node::shouldSpeculateNeitherDoubleNorHeapBigIntNorString): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileStrictEq): (JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): (JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality): (JSC::DFG::SpeculativeJIT::speculateNotDouble): (JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::checkMayCrashIfInputIsEmpty): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): (JSC::FTL::DFG::LowerDFGToB3::speculate): (JSC::FTL::DFG::LowerDFGToB3::speculateNeitherDoubleNorHeapBigIntNorString): 2021-06-07 Tuomas Karkkainen $vm should have a function for checking if security assertions are enabled similar to $vm.assertEnabled https://bugs.webkit.org/show_bug.cgi?id=226020 Reviewed by Mark Lam. Add method $vm.securityAssertEnabled() which parallels $vm.assertEnabled(), and allows checking at runtime whether the current JavaScriptCore build has security assertions enabled. * tools/JSDollarVM.cpp: 2021-06-04 Chris Dumez FileSystem::readFromFile() should return data as `void*` https://bugs.webkit.org/show_bug.cgi?id=226671 Reviewed by Darin Adler. FileSystem::readFromFile() should return data as `void*` instead of `char*`. This is more flexible and consistent with FileSystem::writeToFile(). * inspector/remote/socket/RemoteInspectorSocket.cpp: (Inspector::RemoteInspector::backendCommands const): 2021-06-04 Devin Rousso Web Inspector: mark recently added protocol commands/events as page-only https://bugs.webkit.org/show_bug.cgi?id=226661 Reviewed by Joseph Pecoraro. * inspector/protocol/CSS.json: * inspector/protocol/Network.json: These commands are not implemented in ITML. By not specifying `"targetTypes": ["page"]` it's implicitly saying that the command/event is supported by ITML since the command/event will fall back to the domain's `"targetTypes"`, which includes ITML. 2021-06-04 Yusuke Suzuki [JSC] Private static method should define privateClassBrandIdentifier in class-scope https://bugs.webkit.org/show_bug.cgi?id=226656 rdar://78313139 Reviewed by Keith Miller. We accidentally made `declaresStaticPrivateMethod` always `false`. This patch fixes that so that we properly define privateClassBrandIdentifier field in the class-scope if static-private-method is defined. * parser/Parser.cpp: (JSC::Parser::parseClass): 2021-06-04 Filip Pizlo Don't emit the NotDouble checks if we're already NotDouble. Rubber stamped by Saam Barati. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateNotDouble): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble): 2021-06-04 Mark Lam Placate exception checker validation in objectPrototypeHasOwnProperty. https://bugs.webkit.org/show_bug.cgi?id=226651 rdar://78861296 Reviewed by Keith Miller. * runtime/ObjectPrototype.cpp: (JSC::objectPrototypeHasOwnProperty): 2021-06-03 Filip Pizlo DFG should speculate on CompareStrictEq(@x, @x) https://bugs.webkit.org/show_bug.cgi?id=226621 Reviewed by Mark Lam. Introduces a NotDouble: speculation. We use it to speculate on CompareStrictEq(@x, @x). * bytecode/SpeculatedType.h: (JSC::isNotDoubleSpeculation): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue): * dfg/DFGNode.h: (JSC::DFG::Node::shouldSpeculateNotDouble): * dfg/DFGSafeToExecute.h: (JSC::DFG::SafeToExecuteEdge::operator()): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculateNotDouble): (JSC::DFG::SpeculativeJIT::speculate): * dfg/DFGSpeculativeJIT.h: * dfg/DFGUseKind.cpp: (WTF::printInternal): * dfg/DFGUseKind.h: (JSC::DFG::typeFilterFor): (JSC::DFG::checkMayCrashIfInputIsEmpty): * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::speculate): (JSC::FTL::DFG::LowerDFGToB3::speculateNotDouble): 2021-06-04 Robin Morisset Drop the FTL(DFG) graph after lowering to B3 https://bugs.webkit.org/show_bug.cgi?id=226556 Reviewed by Phil Pizlo. The challenge in this patch was dealing with all of the Patchpoints created by FTLLowerDFGToB3: they get a lambda at that time, which they execute at the end of Air, and many of these lambdas were capturing a pointer to some parts of the DFG graph and reading through it when being executed. In all cases but one it was easily fixed: they were only reading a few bits from a given node, so I just read these bits in FTLLowerDFGToB3, and captured them (by value) instead of the pointer to the node. The exception was compileCallOrConstructVarargsSpread(): its patchpoint generator was walking through the graph, flattening a tree of PhantomSpread/PhantomNewArrayWithSpread/PhantomNewArrayBuffer/PhantomCreateRest, emitting some code along the way. We now do this flattening of the tree in FTLLowerDFGToB3, store just enough information to later emit the required code in a vector, and capture that vector in the lambda (through a move capture, which is allowed since C++14). See `struct VarargsSpreadArgumentToEmit` for the information that we need to store in that vector. I tested this change by completing a full run of JetStream2 with ASAN. I also ran the stress tests with "spread" in their name in Debug mode. * b3/B3SparseCollection.h: (JSC::B3::SparseCollection::clearAll): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::freeDFGIRAfterLowering): * dfg/DFGGraph.h: * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::getPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileTailCall): (JSC::FTL::DFG::LowerDFGToB3::VarargsSpreadArgumentToEmit::VarargsSpreadArgumentToEmit): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs): (JSC::FTL::DFG::LowerDFGToB3::compileCallEval): (JSC::FTL::DFG::LowerDFGToB3::compileInById): (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf): (JSC::FTL::DFG::LowerDFGToB3::getById): (JSC::FTL::DFG::LowerDFGToB3::getByIdWithThis): (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet): (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet): (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet): (JSC::FTL::DFG::LowerDFGToB3::crash): 2021-06-04 Tadeu Zagallo Optimize Function.prototype.toString https://bugs.webkit.org/show_bug.cgi?id=226418 Reviewed by Saam Barati. Add caching to Function.prototype.toString. This is used heavily in Speedometer2, and repeatedly recomputing a string which is a constant is costly. We cache the results of toString in all cases except for bound functions. To make this work for bound functions, we'd need to add a new field they can use for this cache. For other functions, we cache it on the executable (either NativeExecutable or FunctionExecutable). The reason we can't do this on the executable for bound functions is that all bound functions share the same executable, but individual bound functions can have different names. The reason it's valid to cache the results in general is that a function's name field can't be changed from JS code -- it's non-writable. This patch also makes Function.prototype.toString an intrinsic in the DFG/FTL. We emit code on the fast path which reads the cached value if it's present. If not, we call into the slow path, which will compute the cached value for non bound functions, or compute the result for bound functions. I added a new microbenchmark that speeds up by >35x: function-to-string 2197.5952+-30.7118 ^ 59.9861+-2.5550 ^ definitely 36.6350x faster * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicCall): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGNodeType.h: * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * dfg/DFGOperations.h: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::getExecutable): (JSC::DFG::SpeculativeJIT::compileFunctionToString): (JSC::DFG::SpeculativeJIT::compileGetExecutable): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLAbstractHeapRepository.h: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::getExecutable): (JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable): (JSC::FTL::DFG::LowerDFGToB3::compileFunctionToString): * runtime/FunctionExecutable.cpp: (JSC::FunctionExecutable::visitChildrenImpl): (JSC::FunctionExecutable::toStringSlow): * runtime/FunctionExecutable.h: * runtime/FunctionExecutableInlines.h: (JSC::FunctionExecutable::toString): * runtime/FunctionPrototype.cpp: (JSC::FunctionPrototype::addFunctionProperties): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/Intrinsic.cpp: (JSC::intrinsicName): * runtime/Intrinsic.h: * runtime/JSFunction.cpp: (JSC::JSFunction::toString): * runtime/JSFunction.h: * runtime/JSFunctionInlines.h: (JSC::JSFunction::asStringConcurrently const): * runtime/JSStringInlines.h: * runtime/NativeExecutable.cpp: (JSC::NativeExecutable::toStringSlow): (JSC::NativeExecutable::visitChildrenImpl): * runtime/NativeExecutable.h: 2021-06-04 Michael Catanzaro Fix more GCC warnings https://bugs.webkit.org/show_bug.cgi?id=226193 Reviewed by Adrian Perez de Castro. Fix -Wreturn-type warnings due to missing RELEASE_ASSERT_NOT_REACHED() where expected. * jit/JITPlan.cpp: (JSC::JITPlan::tier const): * jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): 2021-06-03 Ross Kirsling [JSC] Implement JIT ICs for InByVal https://bugs.webkit.org/show_bug.cgi?id=226563 Reviewed by Saam Barati. Until now, InByVal has had few optimizations implemented: DFG would attempt to convert string index lookups to InById and int32 lookups to HasIndexedProperty, but there has been no inline caching nor any special handling for symbol lookups. This has become a more urgent problem now, as `#x in obj` (i.e. HasPrivateName / HasPrivateBrand) will need to mimic InByVal's inline caching strategy in order to be deemed performant enough to ship. This patch thus implements inline caching for InByVal at all JIT tiers. The result is a night-and-day difference for symbols, a nice boost for string indices, and no change for int32s: in-by-val-symbol 203.5572+-2.7647 ^ 19.1035+-0.7498 ^ definitely 10.6555x faster in-by-val-string-index 87.0368+-44.7766 45.9971+-32.0007 might be 1.8922x faster in-by-val-int32 110.9904+-1.7109 ? 111.3431+-1.7558 ? * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/CheckPrivateBrandStatus.cpp: (JSC::CheckPrivateBrandStatus::singleIdentifier const): * bytecode/DeleteByStatus.cpp: (JSC::DeleteByStatus::singleIdentifier const): * bytecode/GetByStatus.cpp: (JSC::GetByStatus::singleIdentifier const): * bytecode/ICStatusMap.h: * bytecode/ICStatusUtils.h: (JSC::singleIdentifierForICStatus): * bytecode/InByIdVariant.cpp: (JSC::InByIdVariant::InByIdVariant): (JSC::InByIdVariant::attemptToMerge): (JSC::InByIdVariant::dumpInContext const): * bytecode/InByIdVariant.h: (JSC::InByIdVariant::identifier const): (JSC::InByIdVariant::overlaps): * bytecode/InByStatus.cpp: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.cpp. (JSC::InByStatus::appendVariant): (JSC::InByStatus::shrinkToFit): (JSC::InByStatus::computeFor): (JSC::InByStatus::computeForStubInfo): (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback): (JSC::InByStatus::merge): (JSC::InByStatus::filter): (JSC::InByStatus::markIfCheap): (JSC::InByStatus::finalize): (JSC::InByStatus::singleIdentifier const): (JSC::InByStatus::dump const): * bytecode/InByStatus.h: Renamed from Source/JavaScriptCore/bytecode/InByIdStatus.h. * bytecode/RecordedStatuses.cpp: (JSC::RecordedStatuses::addInByStatus): Renamed from addInByIdStatus. * bytecode/RecordedStatuses.h: * bytecode/SetPrivateBrandStatus.cpp: (JSC::SetPrivateBrandStatus::singleIdentifier const): * bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::reset): * bytecode/StructureStubInfo.h: * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): (JSC::DFG::AbstractInterpreter::filterICStatus): * dfg/DFGArgumentsEliminationPhase.cpp: * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleInById): (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGClobberize.h: (JSC::DFG::clobberize): * dfg/DFGClobbersExitState.cpp: (JSC::DFG::clobbersExitState): * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGGraph.cpp: (JSC::DFG::Graph::dump): * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): * dfg/DFGJITCompiler.h: (JSC::DFG::JITCompiler::addInByVal): * dfg/DFGMayExit.cpp: * dfg/DFGNode.h: (JSC::DFG::Node::hasInByStatus): Renamed from hasInByIdStatus. (JSC::DFG::Node::inByStatus): Renamed from inByIdStatus. * dfg/DFGNodeType.h: * dfg/DFGObjectAllocationSinkingPhase.cpp: * dfg/DFGPredictionPropagationPhase.cpp: * dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileInByVal): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGVarargsForwardingPhase.cpp: * ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compileInBy): (JSC::FTL::DFG::LowerDFGToB3::compileInById): (JSC::FTL::DFG::LowerDFGToB3::compileInByVal): * jit/ICStats.h: * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::link): * jit/JIT.h: * jit/JITInlineCacheGenerator.cpp: (JSC::JITInByValGenerator::JITInByValGenerator): (JSC::JITInByValGenerator::generateFastPath): (JSC::JITInByValGenerator::finalize): (JSC::JITInByIdGenerator::JITInByIdGenerator): * jit/JITInlineCacheGenerator.h: (JSC::JITDelByIdGenerator::slowPathJump const): (JSC::JITInByValGenerator::JITInByValGenerator): (JSC::JITInByValGenerator::slowPathJump const): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITOperations.h: * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): * jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_in_by_val): (JSC::JIT::emitSlow_op_in_by_val): * jit/Repatch.cpp: (JSC::tryCacheInBy): Renamed from tryCacheInByID. (JSC::repatchInBy): Renamed from repatchInByID. (JSC::resetInBy): Renamed from resetInByID. * jit/Repatch.h: * llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): * llint/LLIntSlowPaths.h: * llint/LowLevelInterpreter.asm: * runtime/CommonSlowPaths.cpp: * runtime/CommonSlowPaths.h: 2021-06-03 Mark Lam Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException. https://bugs.webkit.org/show_bug.cgi?id=226609 rdar://78465046 Reviewed by Robin Morisset. * runtime/ObjectPrototype.cpp: (JSC::objectPrototypeHasOwnProperty): 2021-06-03 Yusuke Suzuki [JSC] Make $vm's accessor test functions robust against primitive |this| https://bugs.webkit.org/show_bug.cgi?id=226591 Reviewed by Saam Barati. These functions are testing-purpose, and they are not robust against passing primitive as |this|. This patch makes them robust so that we throw an error instead of crash. * tools/JSDollarVM.cpp: 2021-06-03 Commit Queue Unreviewed, reverting r278356. https://bugs.webkit.org/show_bug.cgi?id=226606 "Breaks jsc tests". Reverted changeset: "Convert small JIT pool tests into executable fuzzing" https://bugs.webkit.org/show_bug.cgi?id=226279 https://trac.webkit.org/changeset/278356 2021-06-03 Filip Pizlo DFG should eliminate obvious store barriers https://bugs.webkit.org/show_bug.cgi?id=226604 Reviewed by Mark Lam. This has a couple changes: - PutByOffset doesn't GC! So let's not say that it does. - The store barrier clustering phase is no longer called the store barrier fencing phase in dumps. Small Speedometer2 speed-up. Definite speed-up for Elm. * dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * dfg/DFGStoreBarrierClusteringPhase.cpp: 2021-06-03 Patrick Angle Web Inspector: [Cocoa] `RemoteInspector` won't connect to a new relay if it hasn't yet failed to communicate with a previously connected relay https://bugs.webkit.org/show_bug.cgi?id=226539 Reviewed by Devin Rousso. `RemoteInspector` communicates with a relay daemon running on the same device in order to send updates like new or removed inspectable targets and receive changes to settings like automatic debugging. The relay daemon then communicates with a client that connects for debugging. Only one relay daemon should ever be running at a time, and its lifecycle is managed separately from JavaScriptCore. RemoteInspector holds a RefPtr to its connection to this relay, and only clears this pointer upon a failure to communicate over the XPC connection or a known disconnection. However, it is possible, and in some cases likely (for example the relay restarting from a brief client disconnection and reconnection), that we can be informed of a newly launched relay being available while still thinking we are connected to the old relay, as we have not yet sent a message and triggered a failure in the interim period of time. To correct this we now send a simple message any time `setupXPCConnectionIfNeeded` is called if we have an existing RefPtr to a relay connection in order to verify the connection is still functional. We now also retry to connect to a relay upon failure in order to create a new connection to the current relay. In order to prevent entering a retry loop where every subsequent retry's failure results in another retry forever, a flag to retry connecting is set when a call to setupXPCConnectionIfNeeded is made while we already have a RefPtr to a relay connection. On failure if we are in this special state we will retry once to connect but subsequent failures will not automatically reattempt a connection. * inspector/remote/RemoteInspector.h: * inspector/remote/cocoa/RemoteInspectorCocoa.mm: (Inspector::RemoteInspector::stopInternal): - Clear the retry connection flag when stopping in an orderly fashion. (Inspector::RemoteInspector::setupXPCConnectionIfNeeded): - Set the retry connection flag and send a simple message if we already have a relay connection in order to make sure the connection is either still valid or is torn down properly on failure. (Inspector::RemoteInspector::xpcConnectionFailed): - If the retry flag is set, schedule a retry and clear the retry flag. 2021-06-02 Robin Morisset B3MoveConstants should filter directly on Values, and only create ValueKeys when useful https://bugs.webkit.org/show_bug.cgi?id=226420 Reviewed by Phil Pizlo. I did a few runs of JetStream2 to measure results, the time spent in B3MoveConstants goes from 160-180ms to 100-110ms. The total time spent in B3+Air is in the 6 to 8s range, so this is approximately a 1% speedup. * b3/B3MoveConstants.cpp: 2021-06-02 Robin Morisset Merge B3::StackSlot and Air::StackSlot https://bugs.webkit.org/show_bug.cgi?id=226362 Reviewed by Filip Pizlo. This is a very simple and safe (although small) memory saving, since every B3StackSlot eventually becomes an AirStackSlot with an exact copy of all the same information. Simply dropping the B3StackSlot past that point is tricky, because one of them might be retained by FTLState (and modified by Air). It is much simpler to just use Air::StackSlot throughout. It saves us: - 16 bytes per B3StackSlot (for the structure itself) - another 8 bytes per B3StackSlot (for the pointer in the SparseCollection) - 8 bytes per AirStackSlot (for the pointer to the B3::StackSlot) I also took the opportunity to save an extra 8 bytes per AirStackSlot, by shrinking the bytesize field to a uint16_t (with a RELEASE_ASSERT that we never overflow it) and moving the StackSlotKind in the hole this creates. Total savings: 16 bytes per spill slot and 40 bytes per locked (by B3) slot. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * b3/B3LowerToAir.cpp: * b3/B3Procedure.cpp: (JSC::B3::Procedure::addStackSlot): (JSC::B3::Procedure::dump const): * b3/B3Procedure.h: * b3/B3ProcedureInlines.h: (JSC::B3::Procedure::stackSlots): (JSC::B3::Procedure::stackSlots const): * b3/B3SlotBaseValue.cpp: * b3/B3SlotBaseValue.h: * b3/B3StackSlot.cpp: Removed. * b3/B3StackSlot.h: Removed. * b3/B3Value.cpp: * b3/air/AirCode.cpp: (JSC::B3::Air::Code::addStackSlot): * b3/air/AirCode.h: * b3/air/AirStackSlot.cpp: (JSC::B3::Air::StackSlot::setOffsetFromFP): (JSC::B3::Air::StackSlot::deepDump const): (JSC::B3::Air::StackSlot::StackSlot): * b3/air/AirStackSlot.h: (JSC::B3::Air::StackSlot::ensureSize): * b3/testb3.h: * ftl/FTLCompile.cpp: * ftl/FTLState.h: 2021-06-02 Pablo Saavedra Fix build error with ENABLE_DFG_JIT=OFF https://bugs.webkit.org/show_bug.cgi?id=226550 Reviewed by Mark Lam. * jit/JITPlan.cpp: (JSC::JITPlan::compileInThread): 2021-06-02 Robin Morisset We should drop B3 values while running Air https://bugs.webkit.org/show_bug.cgi?id=226187 Reviewed by Saam Barati. We must keep the following values: - WasmBoundsCheck, to know whether it is Pinned or Maximum, and if it is pinned find its argument. - CCall/Patch/Check/CheckAdd/CheckSub/CheckMul and all of their children, because all of these are lowered to Air::Patchpoint, which needs to know the type of its arguments, and does so by looking at the children of its origin. I intend to fix these in later patches if possible. Finally we must preserve all B3 values in the following cases: - if we dump the disassembly or the Air graph: because otherwise we cannot print the origins - if we are using the sampling profiler, because it relies on PCToCodeOriginMap which we cannot accurately fill without these origins. We must also keep m_tuples alive, as it is used by Patchpoints in Air to understand the types of their arguments. We also don't touch StackSlots (in this patch), because one of them is captured by FTL::State. Also now PCToOriginMap has a Vector with no inline capacity, since it is either quite large (if needed) or empty (otherwise). The performance impact of this is a progression on various RAMification subtests on Mac, but is more mitigated on iPhone7, with various regressions. I suspect these to be noise, and will monitor the performance bots post-landing to make sure of it. * b3/B3LowerToAir.cpp: (JSC::B3::lowerToAir): * b3/B3Procedure.cpp: (JSC::B3::Procedure::freeUnneededB3ValuesAfterLowering): * b3/B3Procedure.h: (JSC::B3::Procedure::releasePCToOriginMap): (JSC::B3::Procedure::setNeedsPCToOriginMap): (JSC::B3::Procedure::needsPCToOriginMap): * b3/B3SparseCollection.h: (JSC::B3::SparseCollection::clearAll): (JSC::B3::SparseCollection::filterAndTransfer): * b3/air/AirCode.cpp: (JSC::B3::Air::Code::Code): * b3/air/AirCode.h: (JSC::B3::Air::Code::shouldPreserveB3Origins const): * b3/air/AirGenerate.cpp: (JSC::B3::Air::generateWithAlreadyAllocatedRegisters): * ftl/FTLCompile.cpp: (JSC::FTL::compile): * ftl/FTLState.cpp: (JSC::FTL::State::State): 2021-06-02 Chris Dumez Drop Checked::safeGet() https://bugs.webkit.org/show_bug.cgi?id=226537 Reviewed by Geoffrey Garen. Drop Checked::safeGet() and replace with uses of Checked::operator T() or Checked::value(). safeGet() is a bit akward, having both a return value and an out-parameter. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * runtime/JSArray.cpp: (JSC::JSArray::appendMemcpy): (JSC::JSArray::unshiftCountWithAnyIndexingType): * runtime/JSStringJoiner.cpp: (JSC::JSStringJoiner::joinedLength const): * wasm/WasmFormat.cpp: (JSC::Wasm::Segment::create): * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmTable.cpp: (JSC::Wasm::Table::grow): 2021-06-02 Keith Miller Add globalObject API set property test https://bugs.webkit.org/show_bug.cgi?id=226542 Reviewed by Alexey Shvayka. * API/tests/testapi.cpp: (TestAPI::testJSObjectSetOnGlobalObjectSubclassDefinition): (testCAPIViaCpp): 2021-06-02 Keith Miller Convert small JIT pool tests into executable fuzzing https://bugs.webkit.org/show_bug.cgi?id=226279 Right now, we try to test our engine on a small JIT pool. This isn't a known configuration for any actual ports and causes issues if we run out of JIT memory when we need to compile an OSR exit. Instead of testing such a small pool we should just fuzz each executable allocation that says it can fail. The current fuzzing doesn't do a good job tracking the number of DFG/FTL compiles when allocations fail, so when enabled those tests will just exit early. Also, right now we use a random seed picked by the engine for these tests, which makes it hard to reproduce crashes on the bots. If we see flakiness on the bots we can have the harness pass in a number so it gets logged in the repro command. Reviewed by Michael Saboff. * bytecode/CodeBlock.cpp: (JSC::CodeBlock::numberOfDFGCompiles): * jit/ExecutableAllocationFuzz.cpp: (JSC::doExecutableAllocationFuzzing): * jsc.cpp: (runJSC): 2021-06-02 Chris Dumez Use Checked aliases instead of Checked https://bugs.webkit.org/show_bug.cgi?id=226535 Reviewed by Keith Miller. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter::executeEffects): * ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * runtime/JSArray.cpp: (JSC::JSArray::appendMemcpy): (JSC::JSArray::unshiftCountWithAnyIndexingType): * runtime/JSStringJoiner.cpp: (JSC::JSStringJoiner::joinedLength const): * runtime/JSStringJoiner.h: * runtime/StringPrototype.cpp: (JSC::jsSpliceSubstringsWithSeparators): * wasm/WasmFormat.cpp: (JSC::Wasm::Segment::create): * wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * wasm/WasmTable.cpp: (JSC::Wasm::Table::grow): * yarr/YarrInterpreter.cpp: (JSC::Yarr::ByteCompiler::emitDisjunction): * yarr/YarrParser.h: (JSC::Yarr::Parser::consumeNumber): * yarr/YarrPattern.cpp: 2021-06-01 Darin Adler Remove https://bugs.webkit.org/show_bug.cgi?id=226437 Reviewed by Chris Dumez. * : Remove include of . * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py: (CppBackendDispatcherHeaderGenerator._generate_secondary_header_includes): Don't generate an include of wtf/Optional.h; including WTFString.h takes care of this anyway. * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py: (CppFrontendDispatcherHeaderGenerator._generate_secondary_header_includes): Ditto. * inspector/scripts/codegen/generate_cpp_protocol_types_header.py: (CppProtocolTypesHeaderGenerator._generate_secondary_header_includes): Ditto. * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py: (CppProtocolTypesImplementationGenerator.generate_output): Generate an include of instead of . * inspector/scripts/tests/expected/*: Regenerate. 2021-06-01 Chris Dumez Rename Checked::unsafeGet() to Checked::value() https://bugs.webkit.org/show_bug.cgi?id=226514 Reviewed by Darin Adler. Rename Checked::unsafeGet() to Checked::value(). The "unsafeGet" naming is confusing as this function isn't really unsafe since it will crash if the value has overflowed. Also add an `operator T()` to implicitly convert a Checked to its underlying type without needing to call value(). * b3/B3Const32Value.cpp: (JSC::B3::Const32Value::checkAddConstant const): (JSC::B3::Const32Value::checkSubConstant const): (JSC::B3::Const32Value::checkMulConstant const): * b3/B3Const64Value.cpp: (JSC::B3::Const64Value::checkAddConstant const): (JSC::B3::Const64Value::checkSubConstant const): (JSC::B3::Const64Value::checkMulConstant const): * bytecompiler/BytecodeGenerator.h: (JSC::FinallyContext::numberOfBreaksOrContinues const): * dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread): (JSC::FTL::DFG::LowerDFGToB3::compileSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread): * ftl/FTLOperations.cpp: (JSC::FTL::JSC_DEFINE_JIT_OPERATION): * heap/Heap.cpp: (JSC::Heap::deprecatedReportExtraMemorySlowCase): (JSC::Heap::extraMemorySize): (JSC::Heap::updateAllocationLimits): (JSC::Heap::reportExtraMemoryVisited): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::propagateExternalMemoryVisitedIfNecessary): * runtime/ArgList.cpp: (JSC::MarkedArgumentBuffer::slowEnsureCapacity): (JSC::MarkedArgumentBuffer::expandCapacity): * runtime/ArrayPrototype.cpp: (JSC::concatAppendOne): (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH): * runtime/DirectArguments.h: * runtime/HashMapImpl.h: (JSC::HashMapBuffer::allocationSize): (JSC::HashMapImpl::HashMapImpl): * runtime/HashMapImplInlines.h: (JSC::nextCapacity): (JSC::HashMapImpl::finishCreation): * runtime/JSBigInt.cpp: (JSC::JSBigInt::parseInt): * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::tryCreate): * runtime/JSLexicalEnvironment.h: (JSC::JSLexicalEnvironment::offsetOfVariable): (JSC::JSLexicalEnvironment::allocationSizeForScopeSize): * runtime/JSObject.h: * runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::create): * runtime/JSString.h: * runtime/ScopedArguments.cpp: (JSC::ScopedArguments::createUninitialized): * runtime/StringPrototype.cpp: (JSC::jsSpliceSubstrings): (JSC::jsSpliceSubstringsWithSeparators): * runtime/StructureChain.cpp: (JSC::StructureChain::create): * runtime/VM.h: (JSC::ScratchBuffer::allocationSize): * runtime/WeakMapImpl.h: (JSC::WeakMapBuffer::allocationSize): * wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::AirIRGenerator): (JSC::Wasm::AirIRGenerator::emitCallPatchpoint): * wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): * wasm/WasmInstance.cpp: * wasm/WasmInstance.h: (JSC::Wasm::Instance::allocationSize): * wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::push): (JSC::Wasm::LLIntGenerator::getDropKeepCount): (JSC::Wasm::LLIntGenerator::walkExpressionStack): (JSC::Wasm::LLIntGenerator::finalize): (JSC::Wasm::LLIntGenerator::callInformationForCaller): (JSC::Wasm::LLIntGenerator::addLoop): (JSC::Wasm::LLIntGenerator::addTopLevel): (JSC::Wasm::LLIntGenerator::addBlock): (JSC::Wasm::LLIntGenerator::addIf): (JSC::Wasm::LLIntGenerator::addElseToUnreachable): * wasm/WasmSignature.h: (JSC::Wasm::Signature::allocatedSize): * wasm/WasmStreamingParser.cpp: (JSC::Wasm::StreamingParser::addBytes): * wasm/WasmTable.cpp: (JSC::Wasm::Table::Table): (JSC::Wasm::Table::grow): (JSC::Wasm::FuncRefTable::FuncRefTable): * yarr/YarrInterpreter.cpp: (JSC::Yarr::Interpreter::DisjunctionContext::allocationSize): (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::allocationSize): (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext): (JSC::Yarr::ByteCompiler::atomCharacterClass): (JSC::Yarr::ByteCompiler::atomBackReference): (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd): (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd): (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd): (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd): (JSC::Yarr::ByteCompiler::emitDisjunction): * yarr/YarrInterpreter.h: (JSC::Yarr::ByteTerm::ByteTerm): (JSC::Yarr::ByteTerm::CheckInput): (JSC::Yarr::ByteTerm::UncheckInput): * yarr/YarrJIT.cpp: * yarr/YarrParser.h: (JSC::Yarr::Parser::consumeNumber): * yarr/YarrPattern.cpp: (JSC::Yarr::PatternTerm::dumpQuantifier): 2021-06-01 Adrian Perez de Castro [WPE][GTK] Support building against uClibc https://bugs.webkit.org/show_bug.cgi?id=226244 Reviewed by Michael Catanzaro. * assembler/MacroAssemblerARM64.cpp: (getauxval): Provide a fallback implementation of getauxval() for systems which do not provide , like those using uClibc as their C library. 2021-05-30 Chris Dumez Drop UncheckedCondition / UncheckedLock https://bugs.webkit.org/show_bug.cgi?id=226432 Reviewed by Darin Adler. Drop one remaining use of UncheckedLock in favor of Lock. * jit/JITSafepoint.cpp: * jit/JITWorklistThread.h: 2021-05-30 Darin Adler Remove WTF::Optional synonym for std::optional, using that class template directly instead https://bugs.webkit.org/show_bug.cgi?id=226433 Reviewed by Chris Dumez. * : Let the do-webcore-rename script rename Optional<> to std::optional<>. * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py: (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_payload): Use auto instead of Optional<>. Also use * instead of value() and nest the definition of the local inside an if statement in the case where it's an optional. * inspector/scripts/tests/expected/*: Regenerated these results. 2021-05-29 Chris Dumez Stop using UncheckedLock in JSC::VMInspector https://bugs.webkit.org/show_bug.cgi?id=226427 Reviewed by Mark Lam. Stop using UncheckedLock in JSC::VMInspector, as it is being phased out in favor of Lock, which supports Clang thread safety analysis. * tools/HeapVerifier.cpp: (JSC::HeapVerifier::checkIfRecorded): * tools/SigillCrashAnalyzer.cpp: (JSC::SigillCrashAnalyzer::analyze): * tools/VMInspector.cpp: (JSC::VMInspector::isValidExecutableMemory): (JSC::VMInspector::codeBlockForMachinePC): (JSC::VMInspector::lock): Deleted. * tools/VMInspector.h: (JSC::VMInspector::WTF_RETURNS_LOCK): (JSC::VMInspector::WTF_REQUIRES_LOCK): (JSC::VMInspector::getLock): Deleted. (JSC::VMInspector::iterate): Deleted. 2021-05-29 Chris Dumez Stop using UncheckedLock in JSC::ConcurrentJSLock https://bugs.webkit.org/show_bug.cgi?id=226428 Reviewed by Darin Adler. Stop using UncheckedLock in JSC::ConcurrentJSLock as it is being phased out in favor of Lock, which supports Clang thread safety analysis. * runtime/ConcurrentJSLock.h: (JSC::ConcurrentJSLockerBase::ConcurrentJSLockerBase): * runtime/Structure.cpp: (JSC::Structure::findStructuresAndMapForMaterialization): (JSC::Structure::materializePropertyTable): * runtime/Structure.h: * runtime/StructureInlines.h: (JSC::Structure::forEachPropertyConcurrently): * yarr/YarrInterpreter.cpp: 2021-05-28 Darin Adler Clients of optional should use has_value instead of relying on hasValue macro https://bugs.webkit.org/show_bug.cgi?id=226395 Reviewed by Chris Dumez. * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): Don't use hasValue. 2021-05-29 Chris Dumez Stop using UncheckedLock in JSC::SamplingProfiler https://bugs.webkit.org/show_bug.cgi?id=226414 Reviewed by Darin Adler. Stop using UncheckedLock in JSC::SamplingProfiler as it is being phased out in favor of Lock, which supports clang thread safety analysis. * heap/Heap.cpp: (JSC::visitSamplingProfiler): * inspector/agents/InspectorScriptProfilerAgent.cpp: (Inspector::InspectorScriptProfilerAgent::startTracking): (Inspector::InspectorScriptProfilerAgent::trackingComplete): (Inspector::InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting): * runtime/JSGlobalObject.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * runtime/SamplingProfiler.cpp: (JSC::SamplingProfiler::createThreadIfNecessary): (JSC::SamplingProfiler::timerLoop): (JSC::SamplingProfiler::takeSample): (JSC::SamplingProfiler::processUnverifiedStackTraces): (JSC::SamplingProfiler::start): (JSC::SamplingProfiler::startWithLock): (JSC::SamplingProfiler::pause): (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThreadWithLock): (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread): (JSC::SamplingProfiler::noticeJSLockAcquisition): (JSC::SamplingProfiler::noticeVMEntry): (JSC::SamplingProfiler::clearData): (JSC::SamplingProfiler::releaseStackTraces): (JSC::SamplingProfiler::stackTracesAsJSON): (JSC::SamplingProfiler::reportTopFunctions): (JSC::SamplingProfiler::reportTopBytecodes): * runtime/SamplingProfiler.h: (JSC::SamplingProfiler::WTF_RETURNS_LOCK): (JSC::SamplingProfiler::WTF_REQUIRES_LOCK): 2021-05-29 Chris Dumez Stop using UncheckedLock in JSC::dumpJITMemory() https://bugs.webkit.org/show_bug.cgi?id=226413 Reviewed by Darin Adler. Stop using UncheckedLock in JSC::dumpJITMemory() as it is being phased out in favor of Lock, which supports Clang thread safety analysis. * jit/ExecutableAllocator.cpp: (JSC::dumpJITMemory): 2021-05-29 Chris Dumez Stop using UncheckedLock in JSC::WasmCalleeRegistry https://bugs.webkit.org/show_bug.cgi?id=226412 Reviewed by Darin Adler. Stop using UncheckedLock in JSC::WasmCalleeRegistry, as it is being phased out in favor of Lock, which supports Clang thread safety analysis. * runtime/SamplingProfiler.cpp: (JSC::FrameWalker::FrameWalker): (JSC::FrameWalker::recordJITFrame): (JSC::CFrameWalker::CFrameWalker): (JSC::SamplingProfiler::takeSample): * wasm/WasmCalleeRegistry.h: (JSC::Wasm::CalleeRegistry::WTF_RETURNS_LOCK): (JSC::Wasm::CalleeRegistry::WTF_REQUIRES_LOCK): (JSC::Wasm::CalleeRegistry::getLock): Deleted. (JSC::Wasm::CalleeRegistry::isValidCallee): Deleted. * wasm/WasmFaultSignalHandler.cpp: (JSC::Wasm::trapHandler): 2021-05-29 Mark Lam VM::isTerminationException() should only be run on a non-null exception value. https://bugs.webkit.org/show_bug.cgi?id=226417 rdar://78646170 Reviewed by Filip Pizlo. * jsc.cpp: (runInteractive): 2021-05-29 Adrian Perez de Castro Non-unified build fixes, late-ish May 2021 edition redux https://bugs.webkit.org/show_bug.cgi?id=226401 Unreviewed non-unified build fixes. * jit/JITSizeStatistics.cpp: Add missing LinkBuffer.h header. * jit/JITSizeStatistics.h: Add missing CCallHelpers.h and wtf/text/WTFString.h headers; remove unneeded CCallHelpers forward declaration. 2021-05-28 Chris Dumez Stop using UncheckedLock in WTF::MetaAllocator https://bugs.webkit.org/show_bug.cgi?id=226396 Reviewed by Darin Adler. Stop using UncheckedLock in WTF::MetaAllocator, as it is being phased out in favor on Lock, which supports Clang thread safety analysis. * jit/ExecutableAllocator.cpp: (JSC::ExecutableAllocator::getLock const): * jit/ExecutableAllocator.h: (JSC::ExecutableAllocatorBase::WTF_RETURNS_LOCK): * tools/VMInspector.cpp: (JSC::VMInspector::isValidExecutableMemory): 2021-05-28 Chris Dumez Stop using UncheckedLock in JSDOMGlobalObject https://bugs.webkit.org/show_bug.cgi?id=226281 Reviewed by Darin Adler. Drop JSC::lockDuringMarking() and its now empty header given that it does conditional locking and it is not compatible with Clang thread safety analysis. * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/UnlinkedCodeBlock.h: * heap/LockDuringMarking.h: Removed. 2021-05-28 Saam Barati Add the ability to dump statistics about cumulative counts and code sizes of Baseline JIT opcodes and DFG nodes https://bugs.webkit.org/show_bug.cgi?id=226200 Reviewed by Robin Morisset. * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * dfg/DFGSlowPathGenerator.h: (JSC::DFG::SlowPathGenerator::currentNode const): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::runSlowPathGenerators): (JSC::DFG::SpeculativeJIT::compileCurrentBlock): * jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::compileAndLinkWithoutFinalizing): * jit/JITSizeStatistics.cpp: Added. (JSC::JITSizeStatistics::markStart): (JSC::JITSizeStatistics::markEnd): (JSC::JITSizeStatistics::dump const): * jit/JITSizeStatistics.h: Added. (JSC::JITSizeStatistics::reset): * jsc.cpp: (runJSC): * runtime/OptionsList.h: * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/JSDollarVM.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSDollarVM::finishCreation): 2021-05-28 Saam Barati Don't sink arguments past the context of the inline call frame they were created in https://bugs.webkit.org/show_bug.cgi?id=226363 Reviewed by Filip Pizlo. DFG OSR exit isn't set up to allow materializing phantom arguments objects when the inline call frame is no longer present in the exit metadata. There may be multiple reasons for this, but there's at least one I discovered: We don't analyze any locals when reconstructing the variable event stream if that local is past the extent of the inline call frame. This patch makes it so we treat it as an escape if between the definition and the last use of a sink candidate (either via an IR use or bytecode liveness) there is an exit to a place in the graph where the inline call frame of the definition is no longer present. * dfg/DFGVarargsForwardingPhase.cpp: 2021-05-28 Stephan Szabo Regenerate builtins generator expectations after optional changes https://bugs.webkit.org/show_bug.cgi?id=226381 Reviewed by Chris Dumez. * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result: * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result: * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result: * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: 2021-05-28 Mark Lam The jsc shell should not continue executing after a termination has been received. https://bugs.webkit.org/show_bug.cgi?id=226368 rdar://78013374 Reviewed by Saam Barati. This patch makes the jsc shell forbid execution in all the places that it has caught and seen a TerminationException. * jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): (checkException): (runWithOptions): (runInteractive): 2021-05-27 Robin Morisset AirAllocateStackByGraphColoring should use the optimized interference graphs from AirAllocateRegistersByGraphColoring https://bugs.webkit.org/show_bug.cgi?id=226258 Reviewed by Phil Pizlo. The main change in this patch is that AirAllocateStackByGraphColoring is now using the optimized datastructures in wtf/InterferenceGraph.h. This required templating most of it over the interference graph used (Small/Large/Huge), but I tried keeping some common parts out of the templated class to minimize the impact on compile times and binary size. A consequence of that change is that coalescableMoves and remappedStackSlots now store indices instead of direct pointers to StackSlots, resulting in a memory reduction of about 3x as well. Another consequence is that I had to slightly alter the way that coalescing works: instead of carefully removing the interference edges of the killed slot, we simply use mayClear() which is not guaranteed to remove anything. I believe that this is sound, because every subsequent access to m_interference checks whether a slot has been coalesced first, so dropping these edges is purely a memory saving, but has no logical effect. The new code was tested in a few ways: - running on JetStream2 with asan - running on JetStream2 with TEST_OPTIMIZED_INTERFERENCE_GRAPH - running on JetStream2 and logging the frame sizes at the end of this phase, and comparing to the results of doing the same on ToT (same average frame size) The two functions where this code had the largest memory footprint in JetStream2 were both in tsf-wasm. One has 751 stack slots, and had an interference graph of 2.1MB and a coalescableMoves vector of 440kB The other has 673 stack slots, and had an interference graph of 1.9MB and a coalescableMoves vector of 421kB. With this patch, they respectively use 79kB+146kB and 67kB+140kB The effect on the rest of JetStream2 is less likely to matter as few functions used more than a few dozens of kB in this phase, but in percentages are just as huge. More importantly (and the reason I wrote this patch in the first place), I checked mruby-wasm.aotoki.dev which with a few other pages forced us to lower Options::maximumTmpsForGraphColoring because of jetsams. It has two massive functions that reach this phase if I increase Options::maximumTmpsForGraphColoring: - about 6k stack slots -> 215MB + 6MB (interference graph + coalescableMoves) - about 9k stack slots -> 395MB + 4MB After this patch, they respectively use 4.5MB+2MB and 9MB+1.5MB, or roughly a 40x improvement. Combined with the recent improvements to the register allocator, I hope to be able to increase Options::maximumTmpsForGraphColoring soon (in a different patch for easier bisection if either cause a perf regression). This would be helpful, since its lowering cratered our performance on some other wasm application by 8x. In terms of compile times, this patch lowered the time spent in AllocateStackByGraphColoring over the course of a run of JetStream2 from roughly 350ms to roughly 270ms. This is almost certainly negligible, but at least it guarantees that it did not regress. * b3/air/AirAllocateRegistersByGraphColoring.cpp: * b3/air/AirAllocateStackByGraphColoring.cpp: (JSC::B3::Air::allocateStackByGraphColoring): 2021-05-27 Darin Adler Next step toward using std::optional directly instead of through WTF::Optional typedef https://bugs.webkit.org/show_bug.cgi?id=226280 Reviewed by Chris Dumez. * : Accept the renaming done by do-webcore-rename. * yarr/YarrSyntaxChecker.cpp: Since the style checker complained about this file, tweaked style to make it happy after the renaming done by do-webcore-rename, and also hand-updated Optional to std::optional as long as we were touching it. 2021-05-27 Adrian Perez de Castro Non-unified build fixes, late May 2021 edition https://bugs.webkit.org/show_bug.cgi?id=226322 Unreviewed non-unified build fixes. * jit/JITPlan.cpp: Add missing HeapInlines.h and VMInlines.h headers. * jit/JITWorklist.cpp: Add missing HeapInlines.h and SlotVisitorInlines.h headers, remove SlotVisitor.h which is now unneeded. * jit/JITWorklistThread.cpp: Add missing HeapInlines.h header. 2021-05-27 Daniel Kolesa [JSC] Fix crash on 32-bit big endian systems. https://bugs.webkit.org/show_bug.cgi?id=226264 Reviewed by Caio Araujo Neponoceno de Lima. This is an instance where properly offsetting was missed since the issue was not present in 2.30 series and therefore not fixed by r273104. * llint/LowLevelInterpreter32_64.asm: 2021-05-26 Chris Dumez Leverage the new Vector(const T*, size_t) constructor https://bugs.webkit.org/show_bug.cgi?id=226304 Reviewed by Darin Adler. Leverage the new Vector(const T*, size_t) constructor in existing code. * wasm/WasmStreamingParser.cpp: (JSC::Wasm::StreamingParser::consume): 2021-05-26 Tadeu Zagallo REGRESSION: ASSERTION FAILED: !isCompilationThread() in JSC::Profiler::Database::addCompilation() https://bugs.webkit.org/show_bug.cgi?id=226302 Reviewed by Saam Barati. We started linking the JIT code in the compiler thread, which now triggers this assertion. The assertion was introduce before a lock was held to modify the data structures in the profiler database, but it's safe to remove it now. * profiler/ProfilerDatabase.cpp: (JSC::Profiler::Database::addCompilation): 2021-05-26 Chris Dumez Use UncheckedLock even less in JavaScriptCore https://bugs.webkit.org/show_bug.cgi?id=226278 Reviewed by Darin Adler. Use UncheckedLock even less in JavaScriptCore as it is being phased out in favor of Lock, which supports Clang thread safety analysis. * heap/BlockDirectory.h: (JSC::BlockDirectory::WTF_RETURNS_LOCK): * heap/CodeBlockSet.h: (JSC::CodeBlockSet::WTF_RETURNS_LOCK): * heap/Heap.h: * heap/MarkedSpace.h: (JSC::MarkedSpace::directoryLock): * heap/MarkingConstraintSolver.h: * heap/SlotVisitor.cpp: (JSC::SlotVisitor::donateKnownParallel): * heap/SlotVisitor.h: * jit/JITWorklist.cpp: * jit/JITWorklist.h: * jsc.cpp: * profiler/ProfilerDatabase.h: * runtime/DeferredWorkTimer.h: * runtime/VMTraps.cpp: (JSC::VMTraps::invalidateCodeBlocksOnStack): * runtime/VMTraps.h: * tools/FunctionOverrides.cpp: (JSC::FunctionOverrides::FunctionOverrides): (JSC::FunctionOverrides::reinstallOverrides): (JSC::FunctionOverrides::parseOverridesInFile): * tools/FunctionOverrides.h: (JSC::FunctionOverrides::WTF_REQUIRES_LOCK): * tools/VMInspector.cpp: (JSC::ensureIsSafeToLock): (JSC::VMInspector::codeBlockForMachinePC): * wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::work): (JSC::Wasm::BBQPlan::compileFunction): (JSC::Wasm::BBQPlan::didCompleteCompilation): * wasm/WasmBBQPlan.h: * wasm/WasmEntryPlan.cpp: (JSC::Wasm::EntryPlan::parseAndValidateModule): (JSC::Wasm::EntryPlan::prepare): (JSC::Wasm::EntryPlan::ThreadCountHolder::~ThreadCountHolder): (JSC::Wasm::EntryPlan::complete): * wasm/WasmEntryPlan.h: (JSC::Wasm::EntryPlan::tryReserveCapacity): * wasm/WasmLLIntPlan.cpp: (JSC::Wasm::LLIntPlan::compileFunction): (JSC::Wasm::LLIntPlan::didCompleteCompilation): (JSC::Wasm::LLIntPlan::completeInStreaming): (JSC::Wasm::LLIntPlan::didFailInStreaming): * wasm/WasmLLIntPlan.h: * wasm/WasmOMGForOSREntryPlan.cpp: (JSC::Wasm::OMGForOSREntryPlan::work): * wasm/WasmOMGForOSREntryPlan.h: * wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work): * wasm/WasmOMGPlan.h: * wasm/WasmPlan.cpp: (JSC::Wasm::Plan::runCompletionTasks): (JSC::Wasm::Plan::tryRemoveContextAndCancelIfLast): (JSC::Wasm::Plan::fail): * wasm/WasmPlan.h: * wasm/WasmStreamingCompiler.cpp: (JSC::Wasm::StreamingCompiler::didCompileFunction): (JSC::Wasm::StreamingCompiler::completeIfNecessary): (JSC::Wasm::StreamingCompiler::didComplete): (JSC::Wasm::StreamingCompiler::finalize): * wasm/WasmStreamingCompiler.h: * wasm/WasmStreamingPlan.cpp: (JSC::Wasm::StreamingPlan::work): * wasm/WasmStreamingPlan.h: * wasm/WasmThunks.h: 2021-05-26 Chris Dumez Stop using UncheckedLock in WTF::AutomaticThread https://bugs.webkit.org/show_bug.cgi?id=226255 Reviewed by Keith Miller. Some code in JSC had to be ported from UncheckedLock to Lock as a result of WTF::AutomaticThread using the Lock type. * dfg/DFGWorklist.cpp: (JSC::DFG::Worklist::Worklist): * dfg/DFGWorklist.h: * heap/Heap.cpp: (JSC::Heap::Heap): * heap/Heap.h: * jit/JITWorklist.cpp: (JSC::JITWorklist::JITWorklist): * jit/JITWorklist.h: * runtime/VMTraps.cpp: (JSC::VMTraps::VMTraps): * runtime/VMTraps.h: * wasm/WasmWorklist.cpp: (JSC::Wasm::Worklist::Worklist): * wasm/WasmWorklist.h: 2021-05-26 Tadeu Zagallo Merge all the JIT worklists into a shared worklist https://bugs.webkit.org/show_bug.cgi?id=226207 Reviewed by Saam Barati. Delete the DFG and FTL worklists and refactor JITWorklist to handle the compilation for all tiers. This reduces the total number of compiler threads while allowing each tier to use more threads whenever necessary. The default configuration is for the worklist to have 3 threads, baseline can use up to all 3 threads and DFG and FTL follow the previous limits set through JSC::Options. Right now, the worklist will only do work on upper tiers when all lower tiers have no pending tasks or have exceeded the maximum number of concurrent compilations. i.e. by default we only DFG compile when there are no baseline tasks in the queue and we only FTL compile when we either have no DFG tasks in the queue OR there are already 2 DFG compilations in progress. * API/JSVirtualMachine.mm: (+[JSVirtualMachine setNumberOfDFGCompilerThreads:]): (+[JSVirtualMachine setNumberOfFTLCompilerThreads:]): * API/tests/testapi.mm: (runJITThreadLimitTests): * CMakeLists.txt: * JavaScriptCore.xcodeproj/project.pbxproj: * Sources.txt: * bytecode/CodeBlock.cpp: (JSC::CodeBlock::checkIfOptimizationThresholdReached): * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock): * dfg/DFGCommon.h: (JSC::DFG::verboseCompilationEnabled): (JSC::DFG::logCompilationChanges): (JSC::DFG::shouldDumpGraphAtEachPhase): (JSC::DFG::shouldDumpDisassembly): * dfg/DFGDriver.cpp: (JSC::DFG::compileImpl): (JSC::DFG::compile): * dfg/DFGDriver.h: * dfg/DFGGraph.h: * dfg/DFGGraphSafepoint.h: * dfg/DFGOSRAvailabilityAnalysisPhase.cpp: (JSC::DFG::OSRAvailabilityAnalysisPhase::run): * dfg/DFGOSREntrypointCreationPhase.cpp: (JSC::DFG::OSREntrypointCreationPhase::run): * dfg/DFGOperations.cpp: (JSC::DFG::triggerFTLReplacementCompile): (JSC::DFG::tierUpCommon): * dfg/DFGPlan.cpp: (JSC::DFG::Plan::Plan): (JSC::DFG::Plan::codeSize const): (JSC::DFG::Plan::finalizeInGC): (JSC::DFG::Plan::notifyReady): (JSC::DFG::Plan::cancel): (JSC::DFG::Plan::compileInThreadImpl): (JSC::DFG::Plan::finalize): (JSC::DFG::Plan::iterateCodeBlocksForGC): (JSC::DFG::Plan::checkLivenessAndVisitChildren): (JSC::DFG::Plan::isKnownToBeLiveDuringGC): (JSC::DFG::Plan::isKnownToBeLiveAfterGC): * dfg/DFGPlan.h: * dfg/DFGPlanInlines.h: Removed. * dfg/DFGTierUpCheckInjectionPhase.cpp: (JSC::DFG::TierUpCheckInjectionPhase::run): * dfg/DFGWorklist.cpp: Removed. * dfg/DFGWorklist.h: Removed. * dfg/DFGWorklistInlines.h: Removed. * ftl/FTLCompile.h: * ftl/FTLLink.cpp: (JSC::FTL::link): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::lower): (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments): * ftl/FTLState.cpp: (JSC::FTL::State::State): * ftl/FTLState.h: (JSC::FTL::verboseCompilationEnabled): (JSC::FTL::shouldDumpDisassembly): * heap/Heap.cpp: (JSC::Heap::completeAllJITPlans): (JSC::Heap::iterateExecutingAndCompilingCodeBlocks): (JSC::Heap::removeDeadCompilerWorklistEntries): (JSC::Heap::stopThePeriphery): (JSC::Heap::suspendCompilerThreads): (JSC::Heap::resumeCompilerThreads): (JSC::Heap::addCoreConstraints): * heap/Heap.h: * heap/RootMarkReason.h: * jit/JIT.cpp: (JSC::JIT::compileAndLinkWithoutFinalizing): (JSC::JIT::codeSize const): (JSC::JIT::compileTimeStats): * jit/JIT.h: * jit/JITBaselinePlan.cpp: Copied from Source/JavaScriptCore/ftl/FTLState.cpp. (JSC::JITBaselinePlan::JITBaselinePlan): (JSC::JITBaselinePlan::compileInThreadImpl): (JSC::JITBaselinePlan::codeSize const): (JSC::JITBaselinePlan::finalize): * jit/JITBaselinePlan.h: Copied from Source/JavaScriptCore/dfg/DFGScannable.h. * jit/JITCompilationKey.cpp: Renamed from Source/JavaScriptCore/dfg/DFGCompilationKey.cpp. (JSC::JITCompilationKey::dump const): * jit/JITCompilationKey.h: Renamed from Source/JavaScriptCore/dfg/DFGCompilationKey.h. (JSC::JITCompilationKey::JITCompilationKey): (JSC::JITCompilationKey::operator! const): (JSC::JITCompilationKey::isHashTableDeletedValue const): (JSC::JITCompilationKey::mode const): (JSC::JITCompilationKey::operator== const): (JSC::JITCompilationKey::hash const): (JSC::JITCompilationKeyHash::hash): (JSC::JITCompilationKeyHash::equal): * jit/JITCompilationMode.cpp: Renamed from Source/JavaScriptCore/dfg/DFGCompilationMode.cpp. (WTF::printInternal): * jit/JITCompilationMode.h: Renamed from Source/JavaScriptCore/dfg/DFGCompilationMode.h. (JSC::isFTL): * jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): * jit/JITPlan.cpp: Added. (JSC::JITPlan::JITPlan): (JSC::JITPlan::cancel): (JSC::JITPlan::notifyCompiling): (JSC::JITPlan::notifyReady): (JSC::JITPlan::tier const): (JSC::JITPlan::key): (JSC::JITPlan::isKnownToBeLiveAfterGC): (JSC::JITPlan::isKnownToBeLiveDuringGC): (JSC::JITPlan::iterateCodeBlocksForGC): (JSC::JITPlan::checkLivenessAndVisitChildren): (JSC::JITPlan::computeCompileTimes const): (JSC::JITPlan::reportCompileTimes const): (JSC::JITPlan::compileInThread): * jit/JITPlan.h: Added. (JSC::JITPlan::~JITPlan): (JSC::JITPlan::vm const): (JSC::JITPlan::codeBlock const): (JSC::JITPlan::thread const): (JSC::JITPlan::mode const): (JSC::JITPlan::stage const): (JSC::JITPlan::isFTL const): (JSC::JITPlan::finalizeInGC): * jit/JITPlanStage.h: Renamed from Source/JavaScriptCore/dfg/DFGThreadData.cpp. * jit/JITSafepoint.cpp: Renamed from Source/JavaScriptCore/dfg/DFGSafepoint.cpp. (JSC::Safepoint::Safepoint): (JSC::Safepoint::~Safepoint): (JSC::Safepoint::begin): (JSC::Safepoint::cancel): * jit/JITSafepoint.h: Renamed from Source/JavaScriptCore/dfg/DFGSafepoint.h. * jit/JITScannable.h: Copied from Source/JavaScriptCore/dfg/DFGScannable.h. * jit/JITWorklist.cpp: (JSC::JITWorklist::JITWorklist): (JSC::JITWorklist::~JITWorklist): (JSC::JITWorklist::existingGlobalWorklistOrNull): (JSC::JITWorklist::ensureGlobalWorklist): (JSC::JITWorklist::enqueue): (JSC::JITWorklist::queueLength const): (JSC::JITWorklist::suspendAllThreads): (JSC::JITWorklist::resumeAllThreads): (JSC::JITWorklist::compilationState): (JSC::JITWorklist::completeAllReadyPlansForVM): (JSC::JITWorklist::waitUntilAllPlansForVMAreReady): (JSC::JITWorklist::completeAllPlansForVM): (JSC::JITWorklist::cancelAllPlansForVM): (JSC::JITWorklist::removeDeadPlans): (JSC::JITWorklist::setMaximumNumberOfConcurrentDFGCompilations): (JSC::JITWorklist::setMaximumNumberOfConcurrentFTLCompilations): (JSC::JITWorklist::visitWeakReferences): (JSC::JITWorklist::dump const): (JSC::JITWorklist::removeAllReadyPlansForVM): (JSC::JITWorklist::removeMatchingPlansForVM): * jit/JITWorklist.h: (JSC::JITWorklist::static_cast): * jit/JITWorklistInlines.h: Renamed from Source/JavaScriptCore/dfg/DFGScannable.h. (JSC::JITWorklist::iterateCodeBlocksForGC): * jit/JITWorklistThread.cpp: Added. (JSC::JITWorklistThread::JITWorklistThread): (JSC::JITWorklistThread::name const): (JSC::JITWorklistThread::poll): (JSC::JITWorklistThread::work): (JSC::JITWorklistThread::threadDidStart): (JSC::JITWorklistThread::threadIsStopping): * jit/JITWorklistThread.h: Renamed from Source/JavaScriptCore/dfg/DFGThreadData.h. * llint/LLIntSlowPaths.cpp: (JSC::LLInt::jitCompileAndSetHeuristics): * runtime/OptionsList.h: * runtime/VM.cpp: (JSC::VM::~VM): 2021-05-25 Fujii Hironori Clang can't compile Optional since r278035 because GPRTemporary has non-const copy constructor https://bugs.webkit.org/show_bug.cgi?id=226251 Reviewed by Chris Dumez. WinCairo clang-cl builds reported a compilation error since r278035. > include\optional(95,5): error: the parameter for this explicitly-defaulted copy constructor is const, but a member or base requires it to be non-const * dfg/DFGSpeculativeJIT.h: Deleted the const copy ctor instead of the non-const copy ctor. 2021-05-25 Chris Dumez Use UncheckedLock less in JavaScriptCore https://bugs.webkit.org/show_bug.cgi?id=226212 Reviewed by Saam Barati. Use UncheckedLock less in JavaScriptCore as it is being phased out in favor of Lock, which enables Clang thread safety analysis. * assembler/testmasm.cpp: * dfg/DFGCommon.cpp: * dynbench.cpp: * heap/Heap.cpp: * heap/Heap.h: * inspector/remote/socket/RemoteInspectorSocketEndpoint.h: * runtime/JSLock.cpp: * runtime/JSLock.h: * runtime/VM.h: 2021-05-25 Devin Rousso [Modern Media Controls] REGRESSION(r254389) media controls needs the full list of language preferences for ordering tracks https://bugs.webkit.org/show_bug.cgi?id=226038 Reviewed by Myles C. Maxfield and Eric Carlson. Media controls need access to the full list of language preferences in order to properly sort/order the list of tracks in the controls UI. For example, if a `