⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Jul 27, 2014:

11:50 PM Changeset in webkit [171673] by psolanki@apple.com
  • 6 edits in trunk/Source/WebKit

Remove unused preference keys
​https://bugs.webkit.org/show_bug.cgi?id=135280

Reviewed by Darin Adler.

Source/WebKit/mac:

  • WebView/WebPreferenceKeysPrivate.h:
  • WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences _setPageCacheSize:]): Deleted.
(-[WebPreferences _pageCacheSize]): Deleted.
(-[WebPreferences _setObjectCacheSize:]): Deleted.
(-[WebPreferences _objectCacheSize]): Deleted.

  • WebView/WebPreferencesPrivate.h:

Source/WebKit/win:

  • WebPreferenceKeysPrivate.h:
11:47 PM Changeset in webkit [171672] by ryuan.choi@samsung.com
  • 1 edit
    1 delete in trunk/Source/WebCore

Remove GraphicsSurfaceGLX.cpp
​https://bugs.webkit.org/show_bug.cgi?id=135279

Reviewed by Darin Adler.

GraphicsSurfaceGLX.cpp is not used since Qt dropped and Efl port changed at r146458

  • platform/graphics/surfaces/glx/GraphicsSurfaceGLX.cpp: Removed.
7:28 PM Changeset in webkit [171671] by Bruno de Oliveira Abinader
  • 3 edits
    2 adds in trunk

Support for :enabled selector on Anchor & Area elements
​https://bugs.webkit.org/show_bug.cgi?id=134826

Reviewed by Darin Adler.

Source/WebCore:
Updates the PseudoClassEnabled selector checker to check for Anchor & Area
elements with a 'href' attribute.

Spec: ​http://html.spec.whatwg.org/#selector-enabled

Test: fast/css/css-selector-enabled-links.html

  • css/SelectorCheckerTestFunctions.h:

(WebCore::isEnabled): Added check for anchor & area elements.

LayoutTests:
Added tests for :enabled CSS selector on Anchor & Area elements.

  • fast/css/css-selector-enabled-links-expected.txt: Added.
  • fast/css/css-selector-enabled-links.html: Added.
7:24 PM Changeset in webkit [171670] by matthew_hanson@apple.com
  • 5 edits in tags/Safari-600.1.3.1/Source/WebKit2

Merge r171663. <rdar://problem/17818308>

7:16 PM Changeset in webkit [171669] by matthew_hanson@apple.com
  • 5 edits in tags/Safari-600.1.3.1/Source

Versioning.

7:09 PM Changeset in webkit [171668] by matthew_hanson@apple.com
  • 1 copy in tags/Safari-600.1.3.1

New Tag.

7:08 PM Changeset in webkit [171667] by ryuan.choi@samsung.com
  • 3 edits in trunk/Source/WebKit2

[GTK] Keep non-DATABASE_PROCESS build
​https://bugs.webkit.org/show_bug.cgi?id=135321

Patch by Yusuke Suzuki <Yusuke Suzuki> on 2014-07-27
Reviewed by Gyuyoung Kim.

This is the patch for r171622 in non-DATABASE_PROCESS builds.
Change sendToDatabaseProcessRelaunchingIfNecessary to support non-DATABASE_PROCESS implementation.

  • CMakeLists.txt:
  • UIProcess/WebContext.h:

(WebKit::WebContext::sendToDatabaseProcessRelaunchingIfNecessary):

7:02 PM Changeset in webkit [171666] by ryuan.choi@samsung.com
  • 3 edits in trunk/Source/JavaScriptCore

Unreviewed build fix on the EFL port

Build break because of -Werror=return-type

  • bytecode/PutByIdVariant.cpp:

(JSC::PutByIdVariant::oldStructureForTransition):

  • dfg/DFGValueStrength.h:

(JSC::DFG::merge):

5:48 PM Changeset in webkit [171665] by matthew_hanson@apple.com
  • 5 edits
    9 copies in branches/safari-600.1-branch

Merge r171661. <rdar://problem/17315237>

5:45 PM Changeset in webkit [171664] by matthew_hanson@apple.com
  • 5 edits in branches/safari-600.1-branch/Source/WebKit2

Merge r171663. <rdar://problem/17818308>

4:36 PM Changeset in webkit [171663] by barraclough@apple.com
  • 5 edits in trunk/Source/WebKit2

Don't rely on reading applicationState from within DidEnterBackground/WillEnterForeground
​https://bugs.webkit.org/show_bug.cgi?id=135329
rdar://problem/17818308

Reviewed by Sam Weinig.

API may not be stable.

  • UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::isViewVisible):

  • changed to use -[WKContentView isBackground]
  • UIProcess/ios/ProcessAssertionIOS.mm:

(-[WKProcessAssertionBackgroundTaskManager init]):

  • split notification handlers

(-[WKProcessAssertionBackgroundTaskManager _applicationWillEnterForeground:]):
(-[WKProcessAssertionBackgroundTaskManager _applicationDidEnterBackground:]):
(-[WKProcessAssertionBackgroundTaskManager _applicationDidEnterBackgroundOrWillEnterForeground:]): Deleted.

  • Assume application is background is after DidEnterBackground, and not after WillEnterForeground
  • UIProcess/ios/WKContentView.h:
    • added isBackground.
  • UIProcess/ios/WKContentView.mm:

(-[WKContentView initWithFrame:context:configuration:webView:]):

  • check applicationState at init.

(-[WKContentView isBackground]):

  • accessor

(-[WKContentView _applicationDidEnterBackground:]):
(-[WKContentView _applicationWillEnterForeground:]):

  • update isBackground
4:35 PM Changeset in webkit [171662] by fpizlo@apple.com
  • 4 edits in trunk/Source/JavaScriptCore

[REGRESSION][ftlopt merge][32-bit] stress/prune-multi-put-by-offset-replace-or-transition-variant.js.dfg-eager hits an assertion in SpeculativeJIT::silentSavePlanForGPR
​https://bugs.webkit.org/show_bug.cgi?id=135323

Reviewed by Oliver Hunt.

SpeculativeJIT::silentSavePlanForGPR likes to believe that if a node is a constant,
then it's a constant that can be represented using that node's current DataFormat.
This doesn't work if the constant had been filled as a JSValue, and then one of the
fillSpeculateBlah() methods had speculated that it's of some type that the constant
isn't. Unless fillSpeculateBlah() specifically defends against this case, we'll have
a constant that claims to have a contradictory data format.

This patch fixes such a bug in the 32-bit fillSpeculateCell(). The 64-bit
fillSpeculateCell() appears to not have this bug, but I added a similar defense
mechanism anyway just in case, since this is one of those mistakes that keeps
reappearing.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):

4:33 PM Changeset in webkit [171661] by dbates@webkit.org
  • 5 edits
    9 adds in trunk

[WK2] Crash when accessing window.localStorage after calling window.close()
​https://bugs.webkit.org/show_bug.cgi?id=135328
<rdar://problem/17315237>

Reviewed by Sam Weinig.

Source/WebCore:
Fixes an issue where accessing local storage for the first time after calling window.close()
causes a crash.

For now, we should disallow accessing local storage after calling window.close() regardless of
whether it's the first access to local storage as this seems like a bad idiom to support. Note,
this represents a change in behavior from WebKit1. If such usage of window.localStorage turns
out to be reasonable then we can visit this decision again in <​https://bugs.webkit.org/show_bug.cgi?id=135330>.

Tests: storage/domstorage/localstorage/access-storage-after-window-close.html

storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close.html
storage/domstorage/localstorage/set-value-in-storage-after-window-close.html

  • page/DOMWindow.cpp:

(WebCore::DOMWindow::localStorage): Modified to only return the cached local storage or
create a new local storage so long as the page isn't being closed. Also, substitute nullptr
for 0.
(WebCore::DOMWindow::close): Call Page::setIsClosing() to mark that the page is closing.

  • page/Page.cpp:

(WebCore::Page::Page): Initialize m_isClosing to false.

  • page/Page.h:

(WebCore::Page::setIsClosing): Added.
(WebCore::Page::isClosing): Added.

LayoutTests:
Added test by Andy Estes, LayoutTests/storage/domstorage/localstorage/access-storage-after-window-close.html,
to ensure that we don't crash when accessing local storage for the first time after calling window.close().

Additionally added tests that ensure that updates to local storage are ignored after calling
window.close() regardless of whether local storage was accessed before the call to window.close().

  • storage/domstorage/localstorage/access-storage-after-window-close-expected.txt: Added.
  • storage/domstorage/localstorage/access-storage-after-window-close.html: Added.
  • storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close-expected.txt: Added.
  • storage/domstorage/localstorage/access-storage-then-set-value-in-storage-after-window-close.html: Added.
  • storage/domstorage/localstorage/resources/access-storage-close-window-and-set-value-in-storage.html: Added.
  • storage/domstorage/localstorage/resources/close-window-and-access-storage.html: Added.
  • storage/domstorage/localstorage/resources/close-window-and-set-value-in-storage.html: Added.
  • storage/domstorage/localstorage/set-value-in-storage-after-window-close-expected.txt: Added.
  • storage/domstorage/localstorage/set-value-in-storage-after-window-close.html: Added.
4:14 PM Changeset in webkit [171660] by fpizlo@apple.com
  • 93 edits
    54 adds
    3 deletes in trunk

Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.

Source/JavaScriptCore:

This fixes the previous mismerge and adds test coverage for the thing that went wrong.

Additional changes listed here:

  • jsc.cpp:

(functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!

  • runtime/Structure.cpp:

(JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.

  • tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.

2014-06-27 Michael Saboff <​msaboff@apple.com>


Unreviewed build fix after r169795.


Fixed ASSERT for 32 bit build.


  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):


2014-06-24 Saam Barati <​sbarati@apple.com>


Web Inspector: debugger should be able to show variable types
​https://bugs.webkit.org/show_bug.cgi?id=133395


Reviewed by Filip Pizlo.


Increase the amount of type information the VM gathers when directed
to do so. This initial commit is working towards the goal of
capturing, and then showing (via the Web Inspector) type information for all
assignment and load operations. This patch doesn't have the feature fully
implemented, but it ensures the VM has no performance regressions
unless the feature is specifically turned on.


  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h: (JSC::computeUsesForBytecodeOffset): (JSC::computeDefsForBytecodeOffset):
  • bytecode/CodeBlock.cpp: (JSC::CodeBlock::dumpBytecode): (JSC::CodeBlock::CodeBlock): (JSC::CodeBlock::finalizeUnconditionally):
  • bytecode/CodeBlock.h:
  • bytecode/Instruction.h:
  • bytecode/TypeLocation.h: Added. (JSC::TypeLocation::TypeLocation):
  • bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitMove): (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): (JSC::BytecodeGenerator::emitPutToScope): (JSC::BytecodeGenerator::emitPutById): (JSC::BytecodeGenerator::emitPutByVal):
  • bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
  • bytecompiler/NodesCodegen.cpp: (JSC::PostfixNode::emitResolve): (JSC::PrefixNode::emitResolve): (JSC::ReadModifyResolveNode::emitBytecode): (JSC::AssignResolveNode::emitBytecode): (JSC::ConstDeclNode::emitCodeSingle): (JSC::ForInNode::emitBytecode):
  • heap/Heap.cpp: (JSC::Heap::collect):
  • inspector/agents/InspectorRuntimeAgent.cpp: (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
  • inspector/agents/InspectorRuntimeAgent.h:
  • inspector/protocol/Runtime.json:
  • jsc.cpp: (GlobalObject::finishCreation): (functionDumpTypesForAllVariables):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL): (JSC::LLInt::putToScopeCommon):
  • llint/LLIntSlowPaths.h:
  • llint/LowLevelInterpreter.asm:
  • runtime/HighFidelityLog.cpp: Added. (JSC::HighFidelityLog::initializeHighFidelityLog): (JSC::HighFidelityLog::~HighFidelityLog): (JSC::HighFidelityLog::recordTypeInformationForLocation): (JSC::HighFidelityLog::processHighFidelityLog): (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
  • runtime/HighFidelityLog.h: Added. (JSC::HighFidelityLog::HighFidelityLog):
  • runtime/HighFidelityTypeProfiler.cpp: Added. (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange): (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange): (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange): (JSC::HighFidelityTypeProfiler::insertNewLocation): (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
  • runtime/HighFidelityTypeProfiler.h: Added.
  • runtime/Options.h:
  • runtime/Structure.cpp: (JSC::Structure::toStructureShape):
  • runtime/Structure.h:
  • runtime/SymbolTable.cpp: (JSC::SymbolTable::SymbolTable): (JSC::SymbolTable::cloneCapturedNames): (JSC::SymbolTable::uniqueIDForVariable): (JSC::SymbolTable::uniqueIDForRegister): (JSC::SymbolTable::globalTypeSetForRegister): (JSC::SymbolTable::globalTypeSetForVariable):
  • runtime/SymbolTable.h: (JSC::SymbolTable::add): (JSC::SymbolTable::set):
  • runtime/TypeSet.cpp: Added. (JSC::TypeSet::TypeSet): (JSC::TypeSet::getRuntimeTypeForValue): (JSC::TypeSet::addTypeForValue): (JSC::TypeSet::removeDuplicatesInStructureHistory): (JSC::TypeSet::seenTypes): (JSC::TypeSet::dumpSeenTypes): (JSC::StructureShape::StructureShape): (JSC::StructureShape::markAsFinal): (JSC::StructureShape::addProperty): (JSC::StructureShape::propertyHash): (JSC::StructureShape::leastUpperBound): (JSC::StructureShape::stringRepresentation):
  • runtime/TypeSet.h: Added. (JSC::StructureShape::create): (JSC::TypeSet::create):
  • runtime/VM.cpp: (JSC::VM::VM): (JSC::VM::getTypesForVariableInRange): (JSC::VM::updateHighFidelityTypeProfileState): (JSC::VM::dumpHighFidelityProfilingTypes):
  • runtime/VM.h: (JSC::VM::isProfilingTypesWithHighFidelity): (JSC::VM::highFidelityLog): (JSC::VM::highFidelityTypeProfiler): (JSC::VM::nextLocation): (JSC::VM::getNextUniqueVariableID):


2014-06-26 Mark Lam <​mark.lam@apple.com>


Remove unused instantiation of the WithScope structure.
<​https://webkit.org/b/134331>


Reviewed by Oliver Hunt.


The WithScope structure instance is the VM is unused, and is now removed.


  • runtime/VM.cpp: (JSC::VM::VM):
  • runtime/VM.h:


2014-06-25 Mark Hahnenberg <​mhahnenberg@apple.com>


Structure bit fields should have a consistent format
​https://bugs.webkit.org/show_bug.cgi?id=134307


Reviewed by Filip Pizlo.


Currently we use C-style bit fields for a number of member variables in Structure to save space.
This makes it difficult to load these fields in the JIT. We should instead use our own bitfield
format to make it easy to load and test these variables in JIT code.


  • runtime/JSObject.cpp: (JSC::JSObject::putDirectNonIndexAccessor): (JSC::JSObject::reifyStaticFunctionsForDelete):
  • runtime/Structure.cpp: (JSC::StructureTransitionTable::contains): (JSC::StructureTransitionTable::get): (JSC::StructureTransitionTable::add): (JSC::Structure::Structure): (JSC::Structure::materializePropertyMap): (JSC::Structure::addPropertyTransition): (JSC::Structure::despecifyFunctionTransition): (JSC::Structure::toDictionaryTransition): (JSC::Structure::freezeTransition): (JSC::Structure::preventExtensionsTransition): (JSC::Structure::takePropertyTableOrCloneIfPinned): (JSC::Structure::nonPropertyTransition): (JSC::Structure::flattenDictionaryStructure): (JSC::Structure::addPropertyWithoutTransition): (JSC::Structure::pin): (JSC::Structure::allocateRareData): (JSC::Structure::cloneRareDataFrom): (JSC::Structure::getConcurrently): (JSC::Structure::putSpecificValue): (JSC::Structure::getPropertyNamesFromStructure): (JSC::Structure::visitChildren): (JSC::Structure::checkConsistency):
  • runtime/Structure.h: (JSC::Structure::isExtensible): (JSC::Structure::isDictionary): (JSC::Structure::isUncacheableDictionary): (JSC::Structure::propertyAccessesAreCacheable): (JSC::Structure::previousID): (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): (JSC::Structure::setContainsReadOnlyProperties): (JSC::Structure::disableSpecificFunctionTracking): (JSC::Structure::objectToStringValue): (JSC::Structure::setObjectToStringValue): (JSC::Structure::setPreviousID): (JSC::Structure::clearPreviousID): (JSC::Structure::previous): (JSC::Structure::rareData): (JSC::Structure::didTransition): Deleted. (JSC::Structure::hasGetterSetterProperties): Deleted. (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted. (JSC::Structure::setHasGetterSetterProperties): Deleted. (JSC::Structure::hasNonEnumerableProperties): Deleted. (JSC::Structure::staticFunctionsReified): Deleted. (JSC::Structure::setStaticFunctionsReified): Deleted.
  • runtime/StructureInlines.h: (JSC::Structure::setEnumerationCache): (JSC::Structure::enumerationCache): (JSC::Structure::checkOffsetConsistency):


2014-06-24 Mark Lam <​mark.lam@apple.com>


[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<​https://webkit.org/b/134273>


Reviewed by Michael Saboff.


  • CMakeLists.txt:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • debugger/DebuggerActivation.cpp: Removed.
  • debugger/DebuggerActivation.h: Removed.
  • debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp. (JSC::DebuggerScope::DebuggerScope): (JSC::DebuggerScope::finishCreation): (JSC::DebuggerScope::visitChildren): (JSC::DebuggerScope::className): (JSC::DebuggerScope::getOwnPropertySlot): (JSC::DebuggerScope::put): (JSC::DebuggerScope::deleteProperty): (JSC::DebuggerScope::getOwnPropertyNames): (JSC::DebuggerScope::defineOwnProperty): (JSC::DebuggerActivation::DebuggerActivation): Deleted. (JSC::DebuggerActivation::finishCreation): Deleted. (JSC::DebuggerActivation::visitChildren): Deleted. (JSC::DebuggerActivation::className): Deleted. (JSC::DebuggerActivation::getOwnPropertySlot): Deleted. (JSC::DebuggerActivation::put): Deleted. (JSC::DebuggerActivation::deleteProperty): Deleted. (JSC::DebuggerActivation::getOwnPropertyNames): Deleted. (JSC::DebuggerActivation::defineOwnProperty): Deleted.
  • debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h. (JSC::DebuggerScope::create): (JSC::DebuggerActivation::create): Deleted.
  • runtime/VM.cpp: (JSC::VM::VM):
  • runtime/VM.h:


2014-06-24 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
​https://bugs.webkit.org/show_bug.cgi?id=134265


Reviewed by Geoffrey Garen.


More assertion fallout from the PutById folding work.


  • dfg/DFGNode.h: (JSC::DFG::Node::convertToPutByOffset):


2014-06-24 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] GC should notify us if it resets to_this
​https://bugs.webkit.org/show_bug.cgi?id=128231


Reviewed by Geoffrey Garen.


  • CMakeLists.txt:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/BytecodeList.json:
  • bytecode/CodeBlock.cpp: (JSC::CodeBlock::dumpBytecode): (JSC::CodeBlock::finalizeUnconditionally):
  • bytecode/Instruction.h:
  • bytecode/ToThisStatus.cpp: Added. (JSC::merge): (WTF::printInternal):
  • bytecode/ToThisStatus.h: Added.
  • bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator):
  • dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL):


2014-06-24 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
​https://bugs.webkit.org/show_bug.cgi?id=134256


Reviewed by Michael Saboff.


This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
point is to be able to precisely model what goes on in the snippets of code between a
side-effect and an InvalidationPoint.


This patch also cleans up onlyStructure() by delegating more work to
StructureSet::onlyStructure().


  • dfg/DFGStructureAbstractValue.h: (JSC::DFG::StructureAbstractValue::onlyStructure):


2014-06-24 Filip Pizlo <​fpizlo@apple.com>


[ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
​https://bugs.webkit.org/show_bug.cgi?id=134260


Reviewed by Geoffrey Garen.


This was causing loads of assertion failures in debug builds.


  • dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):


2014-06-21 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
​https://bugs.webkit.org/show_bug.cgi?id=134090


Reviewed by Oliver Hunt.


This pretty much finishes off the work to eliminate the special-casing of singleton
structure sets by making it possible to fold GetById and PutById to various polymorphic
forms of the ByOffset nodes.


  • bytecode/GetByIdStatus.cpp: (JSC::GetByIdStatus::computeForStubInfo): (JSC::GetByIdStatus::computeFor):
  • bytecode/GetByIdStatus.h:
  • bytecode/PutByIdStatus.cpp: (JSC::PutByIdStatus::computeFor):
  • bytecode/PutByIdStatus.h:
  • bytecode/PutByIdVariant.h: (JSC::PutByIdVariant::constantChecks):
  • dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  • dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
  • dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitPutByOffset): (JSC::DFG::ConstantFoldingPhase::addChecks):
  • dfg/DFGNode.h: (JSC::DFG::Node::convertToMultiGetByOffset): (JSC::DFG::Node::convertToMultiPutByOffset):
  • dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging. (JSC::DFG::SpeculativeJIT::fillJSValue): (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal): (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict): (JSC::DFG::SpeculativeJIT::fillSpeculateInt52): (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): (JSC::DFG::SpeculativeJIT::fillSpeculateCell): (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): (JSC::DFG::SpeculativeJIT::compileLogicalNot): (JSC::DFG::SpeculativeJIT::emitBranch): (JSC::DFG::SpeculativeJIT::compile):
  • dfg/DFGStructureAbstractValue.h: (JSC::DFG::StructureAbstractValue::set):


2014-06-19 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
​https://bugs.webkit.org/show_bug.cgi?id=134077


Reviewed by Sam Weinig.


This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
in the abstract interpreter.


  • bytecode/StructureSet.h: (JSC::StructureSet::onlyStructure):


2014-06-18 Filip Pizlo <​fpizlo@apple.com>


DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
​https://bugs.webkit.org/show_bug.cgi?id=133918


Reviewed by Mark Hahnenberg.


This also adds pruning of PutStructure, since I basically had no choice but
to implement such logic within MultiPutByOffset.


Also adds a bunch of PutById cache status dumping to bytecode dumping.


  • bytecode/GetByIdVariant.cpp: (JSC::GetByIdVariant::dumpInContext):
  • bytecode/GetByIdVariant.h: (JSC::GetByIdVariant::structureSet):
  • bytecode/PutByIdVariant.h: (JSC::PutByIdVariant::oldStructure):
  • bytecode/StructureSet.cpp: (JSC::StructureSet::filter): (JSC::StructureSet::filterArrayModes):
  • bytecode/StructureSet.h:
  • dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  • dfg/DFGAbstractValue.cpp: (JSC::DFG::AbstractValue::changeStructure): (JSC::DFG::AbstractValue::contains):
  • dfg/DFGAbstractValue.h: (JSC::DFG::AbstractValue::couldBeType): (JSC::DFG::AbstractValue::isType):
  • dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitGetByOffset): (JSC::DFG::ConstantFoldingPhase::emitPutByOffset): (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
  • dfg/DFGGraph.cpp: (JSC::DFG::Graph::freezeStrong):
  • dfg/DFGGraph.h:
  • dfg/DFGStructureAbstractValue.h: (JSC::DFG::StructureAbstractValue::operator=):
  • ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
  • tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added. (foo): (fu): (bar): (baz): (.bar): (.baz):
  • tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added. (foo): (fu): (bar): (baz): (.bar): (.baz):
  • tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added. (foo): (fu): (bar): (baz): (.bar): (.baz):


2014-06-18 Mark Hahnenberg <​mhahnenberg@apple.com>


Remove CompoundType and LeafType
​https://bugs.webkit.org/show_bug.cgi?id=134037


Reviewed by Filip Pizlo.


We don't use them for anything. We'll replace them with a generic CellType type for all
the objects that are JSCells, aren't JSObjects, and for which we generally don't care about
their JSType at runtime.


  • llint/LLIntData.cpp: (JSC::LLInt::Data::performAssertions):
  • runtime/ArrayBufferNeuteringWatchpoint.cpp: (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
  • runtime/Executable.h: (JSC::ExecutableBase::createStructure): (JSC::NativeExecutable::createStructure):
  • runtime/JSPromiseDeferred.h: (JSC::JSPromiseDeferred::createStructure):
  • runtime/JSPromiseReaction.h: (JSC::JSPromiseReaction::createStructure):
  • runtime/JSPropertyNameIterator.h: (JSC::JSPropertyNameIterator::createStructure):
  • runtime/JSType.h:
  • runtime/JSTypeInfo.h: (JSC::TypeInfo::TypeInfo):
  • runtime/MapData.h: (JSC::MapData::createStructure):
  • runtime/PropertyMapHashTable.h: (JSC::PropertyTable::createStructure):
  • runtime/RegExp.h: (JSC::RegExp::createStructure):
  • runtime/SparseArrayValueMap.cpp: (JSC::SparseArrayValueMap::createStructure):
  • runtime/Structure.cpp: (JSC::Structure::Structure):
  • runtime/StructureChain.h: (JSC::StructureChain::createStructure):
  • runtime/StructureRareData.cpp: (JSC::StructureRareData::createStructure):
  • runtime/SymbolTable.h: (JSC::SymbolTable::createStructure):
  • runtime/WeakMapData.h: (JSC::WeakMapData::createStructure):


2014-06-17 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
​https://bugs.webkit.org/show_bug.cgi?id=134002


Reviewed by Mark Hahnenberg.


The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
of the structure if that structure was watchable.


Also kill PhantomPutStructure.


  • dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition): (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
  • dfg/DFGClobberize.h: (JSC::DFG::clobberize):
  • dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC):
  • dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode):
  • dfg/DFGGraph.cpp: (JSC::DFG::Graph::visitChildren):
  • dfg/DFGNode.h: (JSC::DFG::Node::hasTransition):
  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate):
  • dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute):
  • dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • dfg/DFGStructureAbstractValue.cpp: (JSC::DFG::StructureAbstractValue::observeTransition): (JSC::DFG::StructureAbstractValue::observeTransitions):
  • dfg/DFGValidate.cpp: (JSC::DFG::Validate::validate):
  • dfg/DFGWatchableStructureWatchingPhase.cpp: (JSC::DFG::WatchableStructureWatchingPhase::run):
  • ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile):
  • ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileNode): (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.


2014-06-17 Filip Pizlo <​fpizlo@apple.com>


[ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
​https://bugs.webkit.org/show_bug.cgi?id=133964


Reviewed by Mark Hahnenberg.


  • bytecode/PutByIdStatus.cpp: (JSC::PutByIdStatus::appendVariant): (JSC::PutByIdStatus::computeForStubInfo):
  • bytecode/PutByIdVariant.cpp: (JSC::PutByIdVariant::oldStructureForTransition): (JSC::PutByIdVariant::writesStructures): (JSC::PutByIdVariant::reallocatesStorage): (JSC::PutByIdVariant::attemptToMerge): (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): (JSC::PutByIdVariant::dumpInContext):
  • bytecode/PutByIdVariant.h: (JSC::PutByIdVariant::PutByIdVariant): (JSC::PutByIdVariant::replace): (JSC::PutByIdVariant::transition): (JSC::PutByIdVariant::structure): (JSC::PutByIdVariant::oldStructure):
  • dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
  • dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handlePutById): (JSC::DFG::ByteCodeParser::parseBlock):
  • dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
  • dfg/DFGGraph.cpp: (JSC::DFG::Graph::visitChildren):
  • dfg/DFGNode.cpp: (JSC::DFG::MultiPutByOffsetData::writesStructures): (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
  • ftl/FTLAbbreviations.h: (JSC::FTL::getLinkage):
  • ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset): (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):

Source/WebCore:

This fixes the previous mismerge and adds test coverage for the thing that went wrong.
Also, this adds some helpers for making it easier to inspect JavaScript values.

  • testing/Internals.cpp:

(WebCore::Internals::description):

  • testing/Internals.h:
  • testing/Internals.idl:

2014-07-25 Mark Lam <​mark.lam@apple.com>


[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<​https://webkit.org/b/134273>


Reviewed by Michael Saboff.


No new tests.


  • ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
  • Removed because this is not used.

Source/WebKit/mac:

2014-07-25 Mark Lam <​mark.lam@apple.com>


[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<​https://webkit.org/b/134273>


Reviewed by Michael Saboff.


  • WebView/WebScriptDebugDelegate.mm:
  • Removed unneeded #include.

Source/WTF:

  • wtf/text/WTFString.h:

LayoutTests:

  • js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
  • js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
  • js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
  • js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
  • js/regress/fold-put-structure-expected.txt: Added.
  • js/regress/fold-put-structure.html: Added.
  • js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
  • js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
  • js/regress/hoist-poly-check-structure-expected.txt: Added.
  • js/regress/hoist-poly-check-structure.html: Added.
  • js/regress/put-by-id-replace-and-transition-expected.txt: Added.
  • js/regress/put-by-id-replace-and-transition.html: Added.
  • js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
  • js/regress/put-by-id-slightly-polymorphic.html: Added.
  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.

(foo):
(fu):
(bar):
(.bar):
(Number):

  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):
(Number):

  • js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/fold-put-structure.js: Added.

(foo):
(fu):
(bar):
(.bar):

  • js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.

(foo):
(test):

  • js/regress/script-tests/hoist-poly-check-structure.js: Added.

(foo):
(test):

  • js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
  • js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.
2:07 PM Changeset in webkit [171659] by matthew_hanson@apple.com
  • 7 edits in branches/safari-600.1-branch/Source/WebKit2

Merge r171651. <rdar://problem/17682120>

11:45 AM Changeset in webkit [171658] by matthew_hanson@apple.com
  • 7 edits in branches/safari-600.1-branch/Source

Merge r171647. <rdar://problem/17315168>

11:42 AM Changeset in webkit [171657] by matthew_hanson@apple.com
  • 3 edits
    2 copies in branches/safari-600.1-branch

Merge r171640. <rdar://problem/17812921>

11:37 AM Changeset in webkit [171656] by matthew_hanson@apple.com
  • 5 edits in branches/safari-600.1-branch/Source

Merge r171635. <rdar://problem/17782407>

11:33 AM Changeset in webkit [171655] by matthew_hanson@apple.com
  • 9 edits
    1 copy in branches/safari-600.1-branch

Merge r171626. <rdar://problem/17730536>

11:30 AM Changeset in webkit [171654] by matthew_hanson@apple.com
  • 8 edits
    2 copies in branches/safari-600.1-branch

Merge r171624. <rdar://problem/17715503>

11:19 AM Changeset in webkit [171653] by matthew_hanson@apple.com
  • 4 edits in branches/safari-600.1-branch/Source/WebCore

Merge r171616. <rdar://problem/17736875>

10:58 AM Changeset in webkit [171652] by matthew_hanson@apple.com
  • 3 edits
    3 copies in branches/safari-600.1-branch

Merge r171609. <rdar://problem/17043792>

10:25 AM Changeset in webkit [171651] by enrica@apple.com
  • 7 edits in trunk/Source/WebKit2

[WebKit2 iOS]Add support for caret movement for the 3rd party keyboard protocol.
​https://bugs.webkit.org/show_bug.cgi?id=135325
<rdar://problem/17682120>

Reviewed by Sam Weinig.

WKContentView now implements moveByOffset to support the
protocol for 3rd party keyboards.

  • UIProcess/WebPageProxy.h:
  • UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView moveByOffset:]):

  • UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::moveSelectionByOffset):

  • WebProcess/WebPage/WebPage.h:
  • WebProcess/WebPage/WebPage.messages.in:
  • WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::moveSelectionByOffset):

Jul 26, 2014:

12:48 PM Changeset in webkit [171650] by Brian Burg
  • 3 edits in trunk/Source/WebCore

Web Replay: log and enforce session/segment state machine transitions
​https://bugs.webkit.org/show_bug.cgi?id=135224

Reviewed by Timothy Hatcher.

For debugging purposes, log session and segment state transitions.
Assert that segment state transitions are valid.

No new tests. No behavior was changed.

  • replay/ReplayController.cpp:

(WebCore::logDispatchedDOMEvent):
(WebCore::sessionStateToString):
(WebCore::segmentStateToString):
(WebCore::ReplayController::setSessionState):
(WebCore::ReplayController::setSegmentState):
(WebCore::ReplayController::createSegment):
(WebCore::ReplayController::completeSegment): Remove a wrong state transition.
(WebCore::ReplayController::loadSegmentAtIndex):
(WebCore::ReplayController::unloadSegment): Fix a now-erroneous assertion.
(WebCore::ReplayController::startPlayback):
(WebCore::ReplayController::pausePlayback):
(WebCore::ReplayController::willDispatchEvent):
(WebCore::ReplayController::cancelPlayback):

  • replay/ReplayController.h:
12:43 PM Changeset in webkit [171649] by Brian Burg
  • 2 edits in trunk/Source/WebInspectorUI

Web Inspector: ReplayManager uses undefined events and inconsistent event data
​https://bugs.webkit.org/show_bug.cgi?id=135222

Reviewed by Timothy Hatcher.

  • UserInterface/Controllers/ReplayManager.js:

(WebInspector.ReplayManager.prototype.sessionCreated.this):
(WebInspector.ReplayManager.prototype.sessionCreated):
(WebInspector.ReplayManager.prototype.segmentLoaded):
(WebInspector.ReplayManager.prototype.segmentUnloaded):
(WebInspector.ReplayManager.prototype.stopCapturing):
(WebInspector.ReplayManager.prototype.replayToMarkIndex):
(WebInspector.ReplayManager.prototype.segmentCompleted.set catch):
(WebInspector.ReplayManager.prototype.segmentCompleted):
(WebInspector.ReplayManager.prototype.startCapturing):
(WebInspector.ReplayManager.prototype._changeSessionState):

12:06 PM Changeset in webkit [171648] by fpizlo@apple.com
  • 89 edits
    3 adds
    53 deletes in trunk

Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
reland later.

Source/JavaScriptCore:

  • CMakeLists.txt:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
  • JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::printPutByIdCacheStatus): Deleted.

  • bytecode/CodeBlock.h:
  • bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeFor):

  • bytecode/GetByIdStatus.h:
  • bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::dumpInContext):

  • bytecode/GetByIdVariant.h:

(JSC::GetByIdVariant::structureSet):

  • bytecode/Instruction.h:
  • bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):

  • bytecode/PutByIdStatus.h:
  • bytecode/PutByIdVariant.cpp:

(JSC::PutByIdVariant::dumpInContext):
(JSC::PutByIdVariant::oldStructureForTransition): Deleted.
(JSC::PutByIdVariant::writesStructures): Deleted.
(JSC::PutByIdVariant::reallocatesStorage): Deleted.
(JSC::PutByIdVariant::attemptToMerge): Deleted.
(JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.

  • bytecode/PutByIdVariant.h:

(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::constantChecks):

  • bytecode/StructureSet.cpp:

(JSC::StructureSet::filter): Deleted.
(JSC::StructureSet::filterArrayModes): Deleted.

  • bytecode/StructureSet.h:

(JSC::StructureSet::onlyStructure):

  • bytecode/ToThisStatus.cpp: Removed.
  • bytecode/ToThisStatus.h: Removed.
  • bytecode/TypeLocation.h: Removed.
  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitPutByVal):
(JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.

  • bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.

  • bytecompiler/NodesCodegen.cpp:

(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):

  • debugger/DebuggerActivation.cpp: Added.

(JSC::DebuggerActivation::DebuggerActivation):
(JSC::DebuggerActivation::finishCreation):
(JSC::DebuggerActivation::visitChildren):
(JSC::DebuggerActivation::className):
(JSC::DebuggerActivation::getOwnPropertySlot):
(JSC::DebuggerActivation::put):
(JSC::DebuggerActivation::deleteProperty):
(JSC::DebuggerActivation::getOwnPropertyNames):
(JSC::DebuggerActivation::defineOwnProperty):

  • debugger/DebuggerActivation.h: Added.

(JSC::DebuggerActivation::create):
(JSC::DebuggerActivation::createStructure):

  • debugger/DebuggerScope.cpp: Removed.
  • debugger/DebuggerScope.h: Removed.
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):

  • dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::changeStructure): Deleted.
(JSC::DFG::AbstractValue::contains): Deleted.

  • dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::couldBeType):
(JSC::DFG::AbstractValue::isType):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
(JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::visitChildren):
(JSC::DFG::Graph::freezeStrong):

  • dfg/DFGGraph.h:
  • dfg/DFGNode.cpp:

(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):

  • dfg/DFGNode.h:

(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::hasTransition):
(JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
(JSC::DFG::Node::convertToMultiPutByOffset): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGStructureAbstractValue.cpp:

(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):

  • dfg/DFGStructureAbstractValue.h:

(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::operator=): Deleted.
(JSC::DFG::StructureAbstractValue::set): Deleted.

  • dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validate):

  • dfg/DFGWatchableStructureWatchingPhase.cpp:

(JSC::DFG::WatchableStructureWatchingPhase::run):

  • ftl/FTLAbbreviations.h:

(JSC::FTL::getLinkage): Deleted.

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):

  • heap/Heap.cpp:

(JSC::Heap::collect):

  • inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.

  • inspector/agents/InspectorRuntimeAgent.h:
  • inspector/protocol/Runtime.json:
  • jsc.cpp:

(GlobalObject::finishCreation):
(functionDumpTypesForAllVariables): Deleted.

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::putToScopeCommon): Deleted.

  • llint/LLIntSlowPaths.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/ArrayBufferNeuteringWatchpoint.cpp:

(JSC::ArrayBufferNeuteringWatchpoint::createStructure):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/Executable.h:

(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):

  • runtime/HighFidelityLog.cpp: Removed.
  • runtime/HighFidelityLog.h: Removed.
  • runtime/HighFidelityTypeProfiler.cpp: Removed.
  • runtime/HighFidelityTypeProfiler.h: Removed.
  • runtime/JSObject.cpp:

(JSC::JSObject::putDirectCustomAccessor):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::reifyStaticFunctionsForDelete):

  • runtime/JSPromiseDeferred.h:

(JSC::JSPromiseDeferred::createStructure):

  • runtime/JSPromiseReaction.h:

(JSC::JSPromiseReaction::createStructure):

  • runtime/JSPropertyNameIterator.h:

(JSC::JSPropertyNameIterator::createStructure):

  • runtime/JSType.h:
  • runtime/JSTypeInfo.h:

(JSC::TypeInfo::TypeInfo):

  • runtime/MapData.h:

(JSC::MapData::createStructure):

  • runtime/Options.h:
  • runtime/PropertyMapHashTable.h:

(JSC::PropertyTable::createStructure):

  • runtime/RegExp.h:

(JSC::RegExp::createStructure):

  • runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayValueMap::createStructure):

  • runtime/Structure.cpp:

(JSC::StructureTransitionTable::contains):
(JSC::StructureTransitionTable::get):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::allocateRareData):
(JSC::Structure::cloneRareDataFrom):
(JSC::Structure::getConcurrently):
(JSC::Structure::putSpecificValue):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::visitChildren):
(JSC::Structure::checkConsistency):
(JSC::Structure::toStructureShape): Deleted.

  • runtime/Structure.h:

(JSC::Structure::isExtensible):
(JSC::Structure::didTransition):
(JSC::Structure::isDictionary):
(JSC::Structure::isUncacheableDictionary):
(JSC::Structure::hasBeenFlattenedBefore):
(JSC::Structure::propertyAccessesAreCacheable):
(JSC::Structure::previousID):
(JSC::Structure::hasGetterSetterProperties):
(JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
(JSC::Structure::setHasGetterSetterProperties):
(JSC::Structure::hasCustomGetterSetterProperties):
(JSC::Structure::setHasCustomGetterSetterProperties):
(JSC::Structure::setContainsReadOnlyProperties):
(JSC::Structure::hasNonEnumerableProperties):
(JSC::Structure::disableSpecificFunctionTracking):
(JSC::Structure::objectToStringValue):
(JSC::Structure::setObjectToStringValue):
(JSC::Structure::staticFunctionsReified):
(JSC::Structure::setStaticFunctionsReified):
(JSC::Structure::transitionWatchpointSet):
(JSC::Structure::setPreviousID):
(JSC::Structure::clearPreviousID):
(JSC::Structure::previous):
(JSC::Structure::rareData):
(JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
(JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.

  • runtime/StructureChain.h:

(JSC::StructureChain::createStructure):

  • runtime/StructureInlines.h:

(JSC::Structure::setEnumerationCache):
(JSC::Structure::enumerationCache):
(JSC::Structure::checkOffsetConsistency):

  • runtime/StructureRareData.cpp:

(JSC::StructureRareData::createStructure):

  • runtime/SymbolTable.cpp:

(JSC::SymbolTable::SymbolTable):
(JSC::SymbolTable::cloneCapturedNames):
(JSC::SymbolTable::uniqueIDForVariable): Deleted.
(JSC::SymbolTable::uniqueIDForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForVariable): Deleted.

  • runtime/SymbolTable.h:

(JSC::SymbolTable::createStructure):
(JSC::SymbolTable::add):
(JSC::SymbolTable::set):

  • runtime/TypeSet.cpp: Removed.
  • runtime/TypeSet.h: Removed.
  • runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::getTypesForVariableInRange): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.
(JSC::VM::dumpHighFidelityProfilingTypes): Deleted.

  • runtime/VM.h:

(JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
(JSC::VM::highFidelityLog): Deleted.
(JSC::VM::highFidelityTypeProfiler): Deleted.
(JSC::VM::nextLocation): Deleted.
(JSC::VM::getNextUniqueVariableID): Deleted.

  • runtime/WeakMapData.h:

(JSC::WeakMapData::createStructure):

  • tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
  • tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
  • tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.

Source/WebCore:

  • ForwardingHeaders/debugger/DebuggerActivation.h: Added.

Source/WebKit/mac:

  • WebView/WebScriptDebugDelegate.mm:

Source/WTF:

  • wtf/text/WTFString.h:

LayoutTests:

  • js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
  • js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
  • js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
  • js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
  • js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
  • js/regress/fold-put-structure-expected.txt: Removed.
  • js/regress/fold-put-structure.html: Removed.
  • js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
  • js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
  • js/regress/hoist-poly-check-structure-expected.txt: Removed.
  • js/regress/hoist-poly-check-structure.html: Removed.
  • js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
  • js/regress/put-by-id-replace-and-transition.html: Removed.
  • js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
  • js/regress/put-by-id-slightly-polymorphic.html: Removed.
  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
  • js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
  • js/regress/script-tests/fold-put-structure.js: Removed.
  • js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
  • js/regress/script-tests/hoist-poly-check-structure.js: Removed.
  • js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
  • js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.
11:45 AM Changeset in webkit [171647] by timothy_horton@apple.com
  • 7 edits in trunk/Source

Crash in Web Content Process under ~PDFDocument under clearTouchEventListeners at topDocument()
​https://bugs.webkit.org/show_bug.cgi?id=135319
<rdar://problem/17315168>

Reviewed by Darin Adler and Antti Koivisto.

  • WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::committedLoad):
Allow data through to WebCore for frames with custom content providers;
the only custom content provider currently implemented is main frame PDF
on iOS, which will end up creating a PDFDocument in WebCore, which drops all
data on the floor immediately, so this won't result in WebCore doing anything
with the data, but makes sure that more of the normal document lifecycle is maintained.

In the future, we might want to consider ensuring that all custom content providers
end up creating a SinkDocument or something similarly generic to ensure that
WebCore doesn't try to do anything with their data, but for now, the only client is covered.

  • dom/Document.h:
  • dom/Document.cpp:

(WebCore::Document::Document):
(WebCore::Document::prepareForDestruction):
Add a flag on Document, m_hasPreparedForDestruction, which ensures
that each Document only goes through prepareForDestruction() once.
prepareForDestruction() can be called a number of times during teardown,
but it's only necessary to actually execute it once.

This was previously achieved by virtue of all callers of prepareForDestruction()
first checking hasLivingRenderTree, and prepareForDestruction() tearing down
the render tree, but that meant that prepareForDestruction() was not called
for Documents who never had a render tree in the first place.

The only part of prepareForDestruction() that is now predicated on hasLivingRenderTree()
is the call to destroyRenderTree(); the rest of the function has the potential to be relevant
for non-rendered placeholder documents and can safely deal with them in other ways.

It is important to call prepareForDestruction() on non-rendered placeholder documents
because some of the cleanup (like disconnectFromFrame()) is critical to safe destruction.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::clear):
Call prepareForDestruction() even if we don't have a living render tree.
For the sake of minimizing change, removeFocusedNodeOfSubtree still
depends on having a living render tree before calling prepareForDestruction().

  • page/Frame.cpp:

(WebCore::Frame::setView):
(WebCore::Frame::setDocument):
Call prepareForDestruction() even if we don't have a living render tree.

9:44 AM Changeset in webkit [171646] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebInspectorUI

Remove accidental debugging console.log
​https://bugs.webkit.org/show_bug.cgi?id=135315

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-26
Reviewed by Alexey Proskuryakov.

  • UserInterface/Views/ApplicationCacheFrameContentView.js:

(WebInspector.ApplicationCacheFrameContentView.prototype._sortDataGrid):

9:42 AM Changeset in webkit [171645] by commit-queue@webkit.org
  • 6 edits in trunk/Source/WebInspectorUI

Web Inspector: Timelines performance is very slow, has many forced layouts
​https://bugs.webkit.org/show_bug.cgi?id=135313

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-26
Reviewed by Timothy Hatcher.

  • UserInterface/Views/NavigationItem.js:

(WebInspector.NavigationItem):
(WebInspector.NavigationItem.prototype.get hidden):
(WebInspector.NavigationItem.prototype.set hidden):
Don't have the parent navigation bar update layout if the hidden state did not change.
This greatly reduces the number of forced layouts as timeline nodes are added.

  • UserInterface/Views/NavigationSidebarPanel.js:

(WebInspector.NavigationSidebarPanel.prototype.showEmptyContentPlaceholder):
(WebInspector.NavigationSidebarPanel.prototype.hideEmptyContentPlaceholder):
Don't do any work if this is not changing the view.

(WebInspector.NavigationSidebarPanel.prototype._updateContentOverflowShadowVisibilitySoon):
(WebInspector.NavigationSidebarPanel.prototype._updateContentOverflowShadowVisibility):
(WebInspector.NavigationSidebarPanel.prototype._treeElementAddedOrChanged):
When first selecting a specific timeline (Layout / Scripts) we would have a very long hang
updating the content. Most of this was time spent updating the overflow shadow visibility
because every single tree element addition was causing a layout invalidation and forced layout.
Coalesce all of the tree element adds into a single update at the end.

  • UserInterface/Views/TimelineOverview.js:

(WebInspector.TimelineOverview.prototype.updateLayout):
Calculating the visible duration checks offsetLeft. Calculate this once, outside
of a loop down below, to prevent or reduce possible forced layouts.

  • UserInterface/Views/TreeOutline.js:

(TreeElement.prototype.revealed):
Prevent doing any work for timeline tree elements outside of the selected time range.
Previously they were considered revealed if a parent was expanded, even though that
parent was hidden. This greatly reduces the amount of work during a recording, since
previously we were potentially doing a forced layout for hidden nodes.

  • UserInterface/Views/TimelineSidebarPanel.js:

(WebInspector.TimelineSidebarPanel.prototype.treeElementForRepresentedObject.looselyCompareRepresentedObjects):
Ignore ProfileNode, which may happen here in the Script timeline.

Note: See TracTimeline for information about the timeline view.