[webkit-changes] [187347] trunk/Source/JavaScriptCore

Title: [187347] trunk/Source/_javascript_Core Revision 187347 Author fpi...@apple.com Date 2015-07-24 11:23:13 -0700 (Fri, 24 Jul 2015) Log Message DFG::safeToExecute() is wrong for MultiGetByOffset, doesn't consider the structures of the prototypes that get loaded from https://bugs.webki

[webkit-changes] [187214] trunk/Source/JavaScriptCore

Title: [187214] trunk/Source/_javascript_Core Revision 187214 Author fpi...@apple.com Date 2015-07-22 21:58:34 -0700 (Wed, 22 Jul 2015) Log Message Simplify DFG::DesiredIdentifiers and make it possible to turn a UniquedStringImpl* into an identifierNumber at any time https://bugs.webkit.o

[webkit-changes] [187213] trunk/Source/JavaScriptCore

Title: [187213] trunk/Source/_javascript_Core Revision 187213 Author fpi...@apple.com Date 2015-07-22 21:51:48 -0700 (Wed, 22 Jul 2015) Log Message Simplify things like CompareEq(@x,@x) https://bugs.webkit.org/show_bug.cgi?id=145850 Reviewed by Sam Weinig. This simplifies x==x t

[webkit-changes] [187177] trunk/Source/WTF

Title: [187177] trunk/Source/WTF Revision 187177 Author fpi...@apple.com Date 2015-07-22 13:49:20 -0700 (Wed, 22 Jul 2015) Log Message Introduce release assert for using threads before threading is initialized https://bugs.webkit.org/show_bug.cgi?id=147200 Reviewed by Michael Saboff.

[webkit-changes] [187175] trunk/Source/JavaScriptCore

Title: [187175] trunk/Source/_javascript_Core Revision 187175 Author fpi...@apple.com Date 2015-07-22 13:31:07 -0700 (Wed, 22 Jul 2015) Log Message Fixed pool allocation should always be aligned https://bugs.webkit.org/show_bug.cgi?id=147201 Reviewed by Simon Fraser. Passing an

[webkit-changes] [187139] trunk/Source/JavaScriptCore

Title: [187139] trunk/Source/_javascript_Core Revision 187139 Author fpi...@apple.com Date 2015-07-21 17:01:46 -0700 (Tue, 21 Jul 2015) Log Message Unreviewed, fix a lot of tests. Need to initialize WTF threading sooner. * jsc.cpp: (main): Modified Paths trunk/Source/_javascript_Core/C

[webkit-changes] [187125] trunk

Title: [187125] trunk Revision 187125 Author fpi...@apple.com Date 2015-07-21 14:41:30 -0700 (Tue, 21 Jul 2015) Log Message Fixed VM pool allocation should have a reserve for allocations that cannot fail https://bugs.webkit.org/show_bug.cgi?id=147154 rdar://problem/21847618 Reviewed by G

[webkit-changes] [187028] trunk/Source/JavaScriptCore

Title: [187028] trunk/Source/_javascript_Core Revision 187028 Author fpi...@apple.com Date 2015-07-20 12:04:19 -0700 (Mon, 20 Jul 2015) Log Message REGRESSION(186691): OSR entry is broken on loop headers that have no live variables https://bugs.webkit.org/show_bug.cgi?id=147074 rdar://pro

[webkit-changes] [186986] trunk/Source/JavaScriptCore

Title: [186986] trunk/Source/_javascript_Core Revision 186986 Author fpi...@apple.com Date 2015-07-17 22:51:06 -0700 (Fri, 17 Jul 2015) Log Message DFG should have some obvious mitigations against watching structures that are unprofitable to watch https://bugs.webkit.org/show_bug.cgi?id=1

[webkit-changes] [186985] trunk/Source/JavaScriptCore

Title: [186985] trunk/Source/_javascript_Core Revision 186985 Author fpi...@apple.com Date 2015-07-17 22:49:32 -0700 (Fri, 17 Jul 2015) Log Message Remove DFG::DesiredWriteBarriers because it's just a very difficult way of saying "please barrier the machine code block owner" https://bugs.

[webkit-changes] [186923] trunk/Source/JavaScriptCore

Title: [186923] trunk/Source/_javascript_Core Revision 186923 Author fpi...@apple.com Date 2015-07-16 20:33:19 -0700 (Thu, 16 Jul 2015) Log Message Unreviewed, fix build for newer LLVMs. * llvm/LLVMHeaders.h: * llvm/library/LLVMExports.cpp: Modified Paths trunk/Source/_javascript_Core/

[webkit-changes] [186906] trunk

Title: [186906] trunk Revision 186906 Author fpi...@apple.com Date 2015-07-16 13:19:25 -0700 (Thu, 16 Jul 2015) Log Message Unreviewed, roll out http://trac.webkit.org/changeset/186903. It broke the build. Source/WebCore: * CMakeLists.txt: * WebCore.xcodeproj/project.pbxproj: * bindings

[webkit-changes] [186903] trunk

Title: [186903] trunk Revision 186903 Author fpi...@apple.com Date 2015-07-16 12:30:46 -0700 (Thu, 16 Jul 2015) Log Message Remove leak of objects between isolated worlds on custom events, message events, and pop state events. https://bugs.webkit.org/show_bug.cgi?id=118884 Patch by Keith

[webkit-changes] [186784] trunk/PerformanceTests

Title: [186784] trunk/PerformanceTests Revision 186784 Author fpi...@apple.com Date 2015-07-13 15:09:48 -0700 (Mon, 13 Jul 2015) Log Message Update JetStream version number to 1.1. Rubber stamped by Ryosuke Niwa. * JetStream/create.rb: Modified Paths trunk/PerformanceTests/ChangeLog t

[webkit-changes] [186776] trunk/Source/JavaScriptCore

Title: [186776] trunk/Source/_javascript_Core Revision 186776 Author fpi...@apple.com Date 2015-07-13 13:10:02 -0700 (Mon, 13 Jul 2015) Log Message If Watchpoint::fire() looks at the state of the world, it should definitely see its set invalidated, and maybe it should see the object of in

[webkit-changes] [186745] trunk/Source/JavaScriptCore

Title: [186745] trunk/Source/_javascript_Core Revision 186745 Author fpi...@apple.com Date 2015-07-12 19:16:17 -0700 (Sun, 12 Jul 2015) Log Message Watchpoints should be removed from their owning WatchpointSet before they are fired https://bugs.webkit.org/show_bug.cgi?id=146895 Reviewed

[webkit-changes] [186706] trunk/Source/JavaScriptCore

Title: [186706] trunk/Source/_javascript_Core Revision 186706 Author fpi...@apple.com Date 2015-07-10 23:41:25 -0700 (Fri, 10 Jul 2015) Log Message DFG::DesiredWatchpoints should accept WatchpointSetType's that aren't necessarily pointers https://bugs.webkit.org/show_bug.cgi?id=146875 Re

[webkit-changes] [186705] trunk/Source/JavaScriptCore

Title: [186705] trunk/Source/_javascript_Core Revision 186705 Author fpi...@apple.com Date 2015-07-10 22:52:37 -0700 (Fri, 10 Jul 2015) Log Message Watchpoints should be allocated with FastMalloc https://bugs.webkit.org/show_bug.cgi?id=146874 Reviewed by Dan Bernstein. This is i

[webkit-changes] [186702] trunk/Source/JavaScriptCore

Title: [186702] trunk/Source/_javascript_Core Revision 186702 Author fpi...@apple.com Date 2015-07-10 20:01:20 -0700 (Fri, 10 Jul 2015) Log Message AI folding of IsObjectOrNull is broken for non-object types that may be null https://bugs.webkit.org/show_bug.cgi?id=146867 Reviewed by Ryos

[webkit-changes] [186701] trunk/Source/JavaScriptCore

Title: [186701] trunk/Source/_javascript_Core Revision 186701 Author fpi...@apple.com Date 2015-07-10 19:30:04 -0700 (Fri, 10 Jul 2015) Log Message It should be easy to measure total compile times. https://bugs.webkit.org/show_bug.cgi?id=146857 Reviewed by Sam Weinig. This gives

[webkit-changes] [186691] trunk/Source/JavaScriptCore

Title: [186691] trunk/Source/_javascript_Core Revision 186691 Author fpi...@apple.com Date 2015-07-10 14:19:51 -0700 (Fri, 10 Jul 2015) Log Message DFG fragile frozen values are fundamentally broken https://bugs.webkit.org/show_bug.cgi?id=146602 Reviewed by Mark Lam. This change

[webkit-changes] [186688] trunk

Title: [186688] trunk Revision 186688 Author fpi...@apple.com Date 2015-07-10 14:12:46 -0700 (Fri, 10 Jul 2015) Log Message It should be possible to run the OSR exit fuzzer https://bugs.webkit.org/show_bug.cgi?id=146814 Reviewed by Mark Lam. Source/_javascript_Core: Fix a silly

[webkit-changes] [186605] trunk/Source/JavaScriptCore

Title: [186605] trunk/Source/_javascript_Core Revision 186605 Author fpi...@apple.com Date 2015-07-09 12:43:28 -0700 (Thu, 09 Jul 2015) Log Message OSR exit fuzzing should allow us to select a static exit site https://bugs.webkit.org/show_bug.cgi?id=146601 Reviewed by Geoffrey Garen.

[webkit-changes] [186252] trunk/Source/JavaScriptCore

Title: [186252] trunk/Source/_javascript_Core Revision 186252 Author fpi...@apple.com Date 2015-07-02 18:48:01 -0700 (Thu, 02 Jul 2015) Log Message DFG and FTL should have an OSR exit fuzzer https://bugs.webkit.org/show_bug.cgi?id=146562 Reviewed by Benjamin Poulain. Adds a basi

[webkit-changes] [186215] trunk/Source/JavaScriptCore

Title: [186215] trunk/Source/_javascript_Core Revision 186215 Author fpi...@apple.com Date 2015-07-01 18:30:28 -0700 (Wed, 01 Jul 2015) Log Message DFG::freezeFragile should register the frozen value's structure https://bugs.webkit.org/show_bug.cgi?id=136055 rdar://problem/21042120 Revie

[webkit-changes] [186166] trunk/LayoutTests

Title: [186166] trunk/LayoutTests Revision 186166 Author fpi...@apple.com Date 2015-06-30 22:59:51 -0700 (Tue, 30 Jun 2015) Log Message Unreviewed, skip this test for now. We can unskip it when this feature is enabled. * js/script-tests/intl.js: Modified Paths trunk/LayoutTests/ChangeL

[webkit-changes] [186142] trunk/PerformanceTests

Title: [186142] trunk/PerformanceTests Revision 186142 Author fpi...@apple.com Date 2015-06-30 15:58:13 -0700 (Tue, 30 Jun 2015) Log Message Update the JetStream documentation to reflect the recent changes https://bugs.webkit.org/show_bug.cgi?id=146474 Reviewed by Geoffrey Garen. * JetS

[webkit-changes] [186041] trunk/PerformanceTests

Title: [186041] trunk/PerformanceTests Revision 186041 Author fpi...@apple.com Date 2015-06-27 20:47:00 -0700 (Sat, 27 Jun 2015) Log Message [JetStream] Raise the percentile of mandreel-latency and splay-latency https://bugs.webkit.org/show_bug.cgi?id=146378 Reviewed by Mark Lam.

[webkit-changes] [185941] trunk/Source/JavaScriptCore

Title: [185941] trunk/Source/_javascript_Core Revision 185941 Author fpi...@apple.com Date 2015-06-24 21:06:08 -0700 (Wed, 24 Jun 2015) Log Message DFG::SpeculativeJIT shouldn't use filter==Contradiction when it meant isClear https://bugs.webkit.org/show_bug.cgi?id=146291 rdar://problem/2

[webkit-changes] [185833] trunk

Title: [185833] trunk Revision 185833 Author fpi...@apple.com Date 2015-06-22 10:11:54 -0700 (Mon, 22 Jun 2015) Log Message Run CDjs as part of JSC stress testing https://bugs.webkit.org/show_bug.cgi?id=146174 Reviewed by Geoffrey Garen. PerformanceTests: * JetStream/cdjs/cdjs-tests.ya

[webkit-changes] [185782] trunk/PerformanceTests

Title: [185782] trunk/PerformanceTests Revision 185782 Author fpi...@apple.com Date 2015-06-19 16:55:25 -0700 (Fri, 19 Jun 2015) Log Message Unreviewed, fix a small indentation goof. * JetStream/cdjs/motion.js: (Motion.prototype.findIntersection): Modified Paths trunk/PerformanceTests/

[webkit-changes] [185780] trunk/PerformanceTests

Title: [185780] trunk/PerformanceTests Revision 185780 Author fpi...@apple.com Date 2015-06-19 16:49:38 -0700 (Fri, 19 Jun 2015) Log Message JetStream should include a _javascript_ version of the CDx real-time benchmark https://bugs.webkit.org/show_bug.cgi?id=146156 Reviewed by Geoffrey

[webkit-changes] [185640] trunk

Title: [185640] trunk Revision 185640 Author fpi...@apple.com Date 2015-06-16 22:31:30 -0700 (Tue, 16 Jun 2015) Log Message FTL should eliminate array bounds checks in loops https://bugs.webkit.org/show_bug.cgi?id=145768 Reviewed by Benjamin Poulain. Source/_javascript_Core: Th

[webkit-changes] [185618] trunk/Source/JavaScriptCore

Title: [185618] trunk/Source/_javascript_Core Revision 185618 Author fpi...@apple.com Date 2015-06-16 15:13:19 -0700 (Tue, 16 Jun 2015) Log Message Unreviewed, roll out unintended JSC change from https://trac.webkit.org/changeset/185425. * bytecode/CodeBlock.h: (JSC::CodeBlock::hasExitSi

[webkit-changes] [185600] trunk/Source/JavaScriptCore

Title: [185600] trunk/Source/_javascript_Core Revision 185600 Author fpi...@apple.com Date 2015-06-16 12:17:40 -0700 (Tue, 16 Jun 2015) Log Message FTL boolify() UntypedUse is wrong in the masquerades-as-undefined case https://bugs.webkit.org/show_bug.cgi?id=146002 Reviewed by Darin Adle

[webkit-changes] [185427] trunk/Source/JavaScriptCore

Title: [185427] trunk/Source/_javascript_Core Revision 185427 Author fpi...@apple.com Date 2015-06-10 13:35:14 -0700 (Wed, 10 Jun 2015) Log Message DFG ASSERTION FAILED: !iterate() on stress/singleton-scope-then-overwrite.js.ftl-eager https://bugs.webkit.org/show_bug.cgi?id=145853 Unrevi

[webkit-changes] [185425] trunk

Title: [185425] trunk Revision 185425 Author fpi...@apple.com Date 2015-06-10 11:44:50 -0700 (Wed, 10 Jun 2015) Log Message JetStream should have a more rational story for jitter-oriented latency tests https://bugs.webkit.org/show_bug.cgi?id=145762 Reviewed by Geoffrey Garen. Je

[webkit-changes] [185344] trunk/Source/JavaScriptCore

Title: [185344] trunk/Source/_javascript_Core Revision 185344 Author fpi...@apple.com Date 2015-06-08 17:45:59 -0700 (Mon, 08 Jun 2015) Log Message It should be possible to hoist all constants in DFG SSA https://bugs.webkit.org/show_bug.cgi?id=145769 Reviewed by Geoffrey Garen.

[webkit-changes] [185324] trunk/Source

Title: [185324] trunk/Source Revision 185324 Author fpi...@apple.com Date 2015-06-08 12:41:47 -0700 (Mon, 08 Jun 2015) Log Message The tiny set magic in StructureSet should be available in WTF https://bugs.webkit.org/show_bug.cgi?id=145722 Reviewed by Geoffrey Garen. Source/_jav

[webkit-changes] [185267] trunk/Source/JavaScriptCore

Title: [185267] trunk/Source/_javascript_Core Revision 185267 Author fpi...@apple.com Date 2015-06-05 15:00:54 -0700 (Fri, 05 Jun 2015) Log Message speculateRealNumber() should early exit if you're already a real number, not if you're already a real double. Rubber stamped by Mark Lam.

[webkit-changes] [185239] trunk

Title: [185239] trunk Revision 185239 Author fpi...@apple.com Date 2015-06-04 21:59:28 -0700 (Thu, 04 Jun 2015) Log Message Simplify unboxing of double JSValues known to be not NaN and not Int32 https://bugs.webkit.org/show_bug.cgi?id=145618 Reviewed by Geoffrey Garen. Source/_javascript

[webkit-changes] [185216] trunk

Title: [185216] trunk Revision 185216 Author fpi...@apple.com Date 2015-06-04 13:53:01 -0700 (Thu, 04 Jun 2015) Log Message Simplify unboxing of double JSValues known to be not NaN and not Int32 https://bugs.webkit.org/show_bug.cgi?id=145618 Reviewed by Geoffrey Garen. Source/_javascript

[webkit-changes] [185215] trunk/Source/JavaScriptCore

Title: [185215] trunk/Source/_javascript_Core Revision 185215 Author fpi...@apple.com Date 2015-06-04 13:50:20 -0700 (Thu, 04 Jun 2015) Log Message SideState should be a distinct abstract heap from Heap and Stack https://bugs.webkit.org/show_bug.cgi?id=145653 Reviewed by Geoffrey Garen.

[webkit-changes] [185161] trunk/Source/JavaScriptCore

Title: [185161] trunk/Source/_javascript_Core Revision 185161 Author fpi...@apple.com Date 2015-06-03 13:08:01 -0700 (Wed, 03 Jun 2015) Log Message CallLinkStatus should return takesSlowPath if the GC often cleared the IC https://bugs.webkit.org/show_bug.cgi?id=145502 Reviewed by Geoffre

[webkit-changes] [185160] trunk

Title: [185160] trunk Revision 185160 Author fpi...@apple.com Date 2015-06-03 13:04:00 -0700 (Wed, 03 Jun 2015) Log Message GetById and PutById profiling should be more precise about it takes slow path https://bugs.webkit.org/show_bug.cgi?id=145590 Reviewed by Geoffrey Garen. So

[webkit-changes] [185103] trunk/Source/JavaScriptCore

Title: [185103] trunk/Source/_javascript_Core Revision 185103 Author fpi...@apple.com Date 2015-06-01 22:39:11 -0700 (Mon, 01 Jun 2015) Log Message Any exit from any JIT due to profiling for an inline cache should force all future compilations to be wary https://bugs.webkit.org/show_bug.c

[webkit-changes] [185099] trunk/Source/JavaScriptCore

Title: [185099] trunk/Source/_javascript_Core Revision 185099 Author fpi...@apple.com Date 2015-06-01 19:59:39 -0700 (Mon, 01 Jun 2015) Log Message If a call has ever taken the virtual slow path, make sure that the DFG knows this https://bugs.webkit.org/show_bug.cgi?id=145501 Reviewed by

[webkit-changes] [185042] trunk/Source/JavaScriptCore

Title: [185042] trunk/Source/_javascript_Core Revision 185042 Author fpi...@apple.com Date 2015-05-31 11:03:52 -0700 (Sun, 31 May 2015) Log Message Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=145503. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::

[webkit-changes] [185032] trunk

Title: [185032] trunk Revision 185032 Author fpi...@apple.com Date 2015-05-30 14:48:35 -0700 (Sat, 30 May 2015) Log Message FTL codegen for MultiGetByOffset and MultiPutByOffset where the structure set is already proved should have an unreachable default case instead of an exit https://bu

[webkit-changes] [185002] trunk

Title: [185002] trunk Revision 185002 Author fpi...@apple.com Date 2015-05-29 13:26:37 -0700 (Fri, 29 May 2015) Log Message Non-speculative Branch should be fast in the FTL https://bugs.webkit.org/show_bug.cgi?id=145452 Reviewed by Andreas Kling. Source/_javascript_Core: Inline

[webkit-changes] [184997] trunk/LayoutTests

Title: [184997] trunk/LayoutTests Revision 184997 Author fpi...@apple.com Date 2015-05-29 12:27:53 -0700 (Fri, 29 May 2015) Log Message Land some .html/-expected.txt files for some tests that were added without them. Rubber stamped by Andreas Kling. * js/regress/cse-new-array-buffer-exp

[webkit-changes] [184920] trunk/Source/JavaScriptCore

Title: [184920] trunk/Source/_javascript_Core Revision 184920 Author fpi...@apple.com Date 2015-05-27 14:29:09 -0700 (Wed, 27 May 2015) Log Message JIT-generated store barrier code should assume the buffer pointer and capacity to be compile-time constants https://bugs.webkit.org/show_bug.

[webkit-changes] [184781] trunk/Source/JavaScriptCore

Title: [184781] trunk/Source/_javascript_Core Revision 184781 Author fpi...@apple.com Date 2015-05-22 11:48:03 -0700 (Fri, 22 May 2015) Log Message Arguments elimination phase mishandles arity check failure in its reduction of LoadVarargs to GetStack/PutStacks https://bugs.webkit.org/show

[webkit-changes] [184755] trunk/Source/JavaScriptCore

Title: [184755] trunk/Source/_javascript_Core Revision 184755 Author fpi...@apple.com Date 2015-05-21 23:32:30 -0700 (Thu, 21 May 2015) Log Message CPS rethreading should really get rid of GetLocals https://bugs.webkit.org/show_bug.cgi?id=145290 Reviewed by Benjamin Poulain. CPS

[webkit-changes] [184646] trunk/Source/JavaScriptCore

Title: [184646] trunk/Source/_javascript_Core Revision 184646 Author fpi...@apple.com Date 2015-05-20 11:40:42 -0700 (Wed, 20 May 2015) Log Message Add some assertions about the CFG in the loop pre-header creation phase https://bugs.webkit.org/show_bug.cgi?id=145205 Reviewed by Geoffrey

[webkit-changes] [184542] trunk/Source/JavaScriptCore

Title: [184542] trunk/Source/_javascript_Core Revision 184542 Author fpi...@apple.com Date 2015-05-18 21:46:26 -0700 (Mon, 18 May 2015) Log Message Better optimize 'if' with ternaries conditional tests. https://bugs.webkit.org/show_bug.cgi?id=144136 Reviewed by Benjamin Poulain.

[webkit-changes] [184540] trunk/Source/JavaScriptCore

Title: [184540] trunk/Source/_javascript_Core Revision 184540 Author fpi...@apple.com Date 2015-05-18 19:30:00 -0700 (Mon, 18 May 2015) Log Message Add SpecBoolInt32 type that means "I'm an int and I'm either 0 or 1" https://bugs.webkit.org/show_bug.cgi?id=145137 Reviewed by Benjamin Pou

[webkit-changes] [184510] trunk

Title: [184510] trunk Revision 184510 Author fpi...@apple.com Date 2015-05-18 13:41:54 -0700 (Mon, 18 May 2015) Log Message Add a Int-or-Boolean speculation to Branch https://bugs.webkit.org/show_bug.cgi?id=145134 Reviewed by Benjamin Poulain. Source/_javascript_Core: After htt

[webkit-changes] [184445] trunk/Source/JavaScriptCore

Title: [184445] trunk/Source/_javascript_Core Revision 184445 Author fpi...@apple.com Date 2015-05-17 20:39:28 -0700 (Sun, 17 May 2015) Log Message Insert store barriers late so that IR transformations don't have to worry about them https://bugs.webkit.org/show_bug.cgi?id=145015 Reviewed

[webkit-changes] [184415] trunk/Source/JavaScriptCore

Title: [184415] trunk/Source/_javascript_Core Revision 184415 Author fpi...@apple.com Date 2015-05-15 14:11:39 -0700 (Fri, 15 May 2015) Log Message Insert store barriers late so that IR transformations don't have to worry about them https://bugs.webkit.org/show_bug.cgi?id=145015 Reviewed

[webkit-changes] [184398] trunk/Source/JavaScriptCore

Title: [184398] trunk/Source/_javascript_Core Revision 184398 Author fpi...@apple.com Date 2015-05-15 11:21:29 -0700 (Fri, 15 May 2015) Log Message Unreviewed, remove an unused declaration. * dfg/DFGSpeculativeJIT.h: Modified Paths trunk/Source/_javascript_Core/ChangeLog trunk/Source/_

[webkit-changes] [184397] trunk/Source/JavaScriptCore

Title: [184397] trunk/Source/_javascript_Core Revision 184397 Author fpi...@apple.com Date 2015-05-15 11:09:07 -0700 (Fri, 15 May 2015) Log Message Remove unused constant-base and constant-value store barrier code in the DFG https://bugs.webkit.org/show_bug.cgi?id=145039 Reviewed by Andr

[webkit-changes] [184368] trunk/Source/JavaScriptCore

Title: [184368] trunk/Source/_javascript_Core Revision 184368 Author fpi...@apple.com Date 2015-05-14 21:14:39 -0700 (Thu, 14 May 2015) Log Message Remove StoreBarrierWithNullCheck, nobody ever generates this. Rubber stamped by Benjamin Poulain and Michael Saboff. If we did brin

[webkit-changes] [184367] trunk/Source/JavaScriptCore

Title: [184367] trunk/Source/_javascript_Core Revision 184367 Author fpi...@apple.com Date 2015-05-14 20:51:52 -0700 (Thu, 14 May 2015) Log Message PutGlobalVar should reference the global object it's storing into https://bugs.webkit.org/show_bug.cgi?id=145036 Reviewed by Michael Saboff.

[webkit-changes] [184338] trunk/LayoutTests

Title: [184338] trunk/LayoutTests Revision 184338 Author fpi...@apple.com Date 2015-05-14 09:31:23 -0700 (Thu, 14 May 2015) Log Message Unreviewed, skip js/regress-141098.html. The fix will be tracked in https://bugs.webkit.org/show_bug.cgi?id=145007 * TestExpectations: Modified Paths

[webkit-changes] [184318] trunk/Source/JavaScriptCore

Title: [184318] trunk/Source/_javascript_Core Revision 184318 Author fpi...@apple.com Date 2015-05-13 16:57:17 -0700 (Wed, 13 May 2015) Log Message Creating a new blank document in icloud pages causes an AI error: Abstract value (CellBytecodedoubleBoolOther, TOP, TOP) for double node has

[webkit-changes] [184311] trunk/Source/JavaScriptCore

Title: [184311] trunk/Source/_javascript_Core Revision 184311 Author fpi...@apple.com Date 2015-05-13 15:14:25 -0700 (Wed, 13 May 2015) Log Message The liveness pruning done by ObjectAllocationSinkingPhase ignores the possibility of an object's bytecode liveness being longer than its DFG

[webkit-changes] [184288] trunk/Source/JavaScriptCore

Title: [184288] trunk/Source/_javascript_Core Revision 184288 Author fpi...@apple.com Date 2015-05-13 10:39:02 -0700 (Wed, 13 May 2015) Log Message REGRESSION(r184260): arguments elimination has stopped working because of Check(UntypedUse:) from SSAConversionPhase https://bugs.webkit.org/

[webkit-changes] [184260] trunk

Title: [184260] trunk Revision 184260 Author fpi...@apple.com Date 2015-05-12 22:21:16 -0700 (Tue, 12 May 2015) Log Message js/dom/stack-trace.html fails with eager compilation https://bugs.webkit.org/show_bug.cgi?id=144853 Reviewed by Benjamin Poulain. Source/_javascript_Core:

[webkit-changes] [184206] trunk/Source/JavaScriptCore

Title: [184206] trunk/Source/_javascript_Core Revision 184206 Author fpi...@apple.com Date 2015-05-12 11:01:28 -0700 (Tue, 12 May 2015) Log Message OSR availability analysis would be more scalable (and correct) if it did more liveness pruning https://bugs.webkit.org/show_bug.cgi?id=143078

[webkit-changes] [184128] trunk/Source/JavaScriptCore

Title: [184128] trunk/Source/_javascript_Core Revision 184128 Author fpi...@apple.com Date 2015-05-11 15:42:49 -0700 (Mon, 11 May 2015) Log Message CPS rethreading phase's flush detector flushes way too many SetLocals https://bugs.webkit.org/show_bug.cgi?id=144819 Reviewed by Geoffrey Ga

[webkit-changes] [184127] trunk/Source/JavaScriptCore

Title: [184127] trunk/Source/_javascript_Core Revision 184127 Author fpi...@apple.com Date 2015-05-11 15:41:36 -0700 (Mon, 11 May 2015) Log Message gmail and google maps fail to load with eager compilation: Failed to insert inline cache for varargs call (specifically, CallForwardVarargs)

[webkit-changes] [184111] trunk/Source/JavaScriptCore

Title: [184111] trunk/Source/_javascript_Core Revision 184111 Author fpi...@apple.com Date 2015-05-11 11:30:18 -0700 (Mon, 11 May 2015) Log Message Make it easy to enable eager/non-concurrent JIT compilation https://bugs.webkit.org/show_bug.cgi?id=144877 Reviewed by Michael Saboff. * ru

[webkit-changes] [184110] trunk

Title: [184110] trunk Revision 184110 Author fpi...@apple.com Date 2015-05-11 11:18:10 -0700 (Mon, 11 May 2015) Log Message We shouldn't promote LoadVarargs to a sequence of GetStacks and PutStacks if doing so would exceed the LoadVarargs' limit https://bugs.webkit.org/show_bug.cgi?id=144

[webkit-changes] [184032] trunk/Source/JavaScriptCore

Title: [184032] trunk/Source/_javascript_Core Revision 184032 Author fpi...@apple.com Date 2015-05-08 17:18:43 -0700 (Fri, 08 May 2015) Log Message Extend the SaneChain optimization to Contiguous arrays https://bugs.webkit.org/show_bug.cgi?id=144664 Reviewed by Mark Lam. Previou

[webkit-changes] [183974] trunk

Title: [183974] trunk Revision 183974 Author fpi...@apple.com Date 2015-05-07 19:12:35 -0700 (Thu, 07 May 2015) Log Message GC has trouble with pathologically large array allocations https://bugs.webkit.org/show_bug.cgi?id=144609 Reviewed by Geoffrey Garen. Source/_javascript_Core: The

[webkit-changes] [183897] trunk/Source/JavaScriptCore

Title: [183897] trunk/Source/_javascript_Core Revision 183897 Author fpi...@apple.com Date 2015-05-06 16:14:14 -0700 (Wed, 06 May 2015) Log Message Sane chain and string watchpoints should be set in FixupPhase or the backend rather than WatchpointCollectionPhase https://bugs.webkit.org/sh

[webkit-changes] [183852] trunk/Source/JavaScriptCore

Title: [183852] trunk/Source/_javascript_Core Revision 183852 Author fpi...@apple.com Date 2015-05-05 22:56:43 -0700 (Tue, 05 May 2015) Log Message PutGlobalVar shouldn't have an unconditional store barrier https://bugs.webkit.org/show_bug.cgi?id=133104 Reviewed by Benjamin Poulain.

[webkit-changes] [183851] trunk/Source/JavaScriptCore

Title: [183851] trunk/Source/_javascript_Core Revision 183851 Author fpi...@apple.com Date 2015-05-05 22:52:52 -0700 (Tue, 05 May 2015) Log Message CopiedBlock::reportLiveBytes() should be totally cool with oversize blocks https://bugs.webkit.org/show_bug.cgi?id=144667 Reviewed by Andrea

[webkit-changes] [183847] trunk/Source/JavaScriptCore

Title: [183847] trunk/Source/_javascript_Core Revision 183847 Author fpi...@apple.com Date 2015-05-05 20:39:20 -0700 (Tue, 05 May 2015) Log Message GC has trouble with pathologically large array allocations https://bugs.webkit.org/show_bug.cgi?id=144609 Reviewed by Mark Lam. * heap/Heap

[webkit-changes] [183825] trunk/Source/JavaScriptCore

Title: [183825] trunk/Source/_javascript_Core Revision 183825 Author fpi...@apple.com Date 2015-05-05 13:42:44 -0700 (Tue, 05 May 2015) Log Message FTL SwitchString slow case creates duplicate switch cases https://bugs.webkit.org/show_bug.cgi?id=144634 Reviewed by Geoffrey Garen.

[webkit-changes] [183793] trunk/Source/JavaScriptCore

Title: [183793] trunk/Source/_javascript_Core Revision 183793 Author fpi...@apple.com Date 2015-05-04 21:24:23 -0700 (Mon, 04 May 2015) Log Message Unreviewed, fix stale comment. * tests/mozilla/js1_5/Array/regress-101964.js: Modified Paths trunk/Source/_javascript_Core/ChangeLog trunk

[webkit-changes] [183792] trunk/Source/JavaScriptCore

Title: [183792] trunk/Source/_javascript_Core Revision 183792 Author fpi...@apple.com Date 2015-05-04 21:16:50 -0700 (Mon, 04 May 2015) Log Message Large array shouldn't be slow https://bugs.webkit.org/show_bug.cgi?id=144617 Rubber stamped by Mark Lam. * tests/mozilla/js1_5/Array/regres

[webkit-changes] [183791] trunk/Source/JavaScriptCore

Title: [183791] trunk/Source/_javascript_Core Revision 183791 Author fpi...@apple.com Date 2015-05-04 20:51:35 -0700 (Mon, 04 May 2015) Log Message Large array shouldn't be slow https://bugs.webkit.org/show_bug.cgi?id=144617 Rubber stamped by Mark Lam. * tests/mozilla/js1_5/Array/regres

[webkit-changes] [183787] trunk

Title: [183787] trunk Revision 183787 Author fpi...@apple.com Date 2015-05-04 19:40:28 -0700 (Mon, 04 May 2015) Log Message Large array shouldn't be slow https://bugs.webkit.org/show_bug.cgi?id=144617 Reviewed by Geoffrey Garen. PerformanceTests: Add the hash-map benchmark to L

[webkit-changes] [183724] trunk/Source/JavaScriptCore

Title: [183724] trunk/Source/_javascript_Core Revision 183724 Author fpi...@apple.com Date 2015-05-02 17:15:27 -0700 (Sat, 02 May 2015) Log Message TypeOf should be fast https://bugs.webkit.org/show_bug.cgi?id=144396 Reviewed by Geoffrey Garen. Adds comprehensive support for fas

[webkit-changes] [183719] trunk/Source/JavaScriptCore

Title: [183719] trunk/Source/_javascript_Core Revision 183719 Author fpi...@apple.com Date 2015-05-02 11:36:24 -0700 (Sat, 02 May 2015) Log Message Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=144527. * dfg/DFGLICMPhase.cpp: (JSC::DFG::LICMPhase::attemptHoi

[webkit-changes] [183718] trunk/Source/JavaScriptCore

Title: [183718] trunk/Source/_javascript_Core Revision 183718 Author fpi...@apple.com Date 2015-05-02 10:33:36 -0700 (Sat, 02 May 2015) Log Message Unreviewed, add FIXMEs referencing https://bugs.webkit.org/show_bug.cgi?id=144524 and https://bugs.webkit.org/show_bug.cgi?id=144525. * dfg/

[webkit-changes] [183708] trunk/Source/JavaScriptCore

Title: [183708] trunk/Source/_javascript_Core Revision 183708 Author fpi...@apple.com Date 2015-05-01 18:59:46 -0700 (Fri, 01 May 2015) Log Message FTL should use AI more https://bugs.webkit.org/show_bug.cgi?id=144500 Reviewed by Oliver Hunt. This makes our type check folding ev

[webkit-changes] [183656] trunk/Source/JavaScriptCore

Title: [183656] trunk/Source/_javascript_Core Revision 183656 Author fpi...@apple.com Date 2015-04-30 17:06:48 -0700 (Thu, 30 Apr 2015) Log Message Move all of the branchIs helpers from SpeculativeJIT into AssemblyHelpers https://bugs.webkit.org/show_bug.cgi?id=144462 Reviewed by Geoffre

[webkit-changes] [183650] trunk

Title: [183650] trunk Revision 183650 Author fpi...@apple.com Date 2015-04-30 16:02:33 -0700 (Thu, 30 Apr 2015) Log Message js/regress/is-string-fold-tricky.html and js/regress/is-string-fold.html are crashing https://bugs.webkit.org/show_bug.cgi?id=144463 Reviewed by Benjamin Poulain.

[webkit-changes] [183643] trunk/LayoutTests

Title: [183643] trunk/LayoutTests Revision 183643 Author fpi...@apple.com Date 2015-04-30 13:55:00 -0700 (Thu, 30 Apr 2015) Log Message Unreviewed, skip new tests js/regress/is-string-fold.html and js/regress/is-string-fold-tricky.html because they are crashing in RJST as well. * js/regr

[webkit-changes] [183638] trunk/LayoutTests

Title: [183638] trunk/LayoutTests Revision 183638 Author fpi...@apple.com Date 2015-04-30 11:54:02 -0700 (Thu, 30 Apr 2015) Log Message Unreviewed, skip new tests js/regress/is-string-fold.html and js/regress/is-string-fold-tricky.html because they are crashing. * TestExpectations: Modi

[webkit-changes] [183631] trunk/Source/JavaScriptCore

Title: [183631] trunk/Source/_javascript_Core Revision 183631 Author fpi...@apple.com Date 2015-04-30 10:44:23 -0700 (Thu, 30 Apr 2015) Log Message Unreviewed, add a FIXME comment referencing https://bugs.webkit.org/show_bug.cgi?id=144458. * jit/JITOperations.cpp: Modified Paths trunk/

[webkit-changes] [183630] trunk/Source/JavaScriptCore

Title: [183630] trunk/Source/_javascript_Core Revision 183630 Author fpi...@apple.com Date 2015-04-30 10:40:31 -0700 (Thu, 30 Apr 2015) Log Message Add a comment clarifying the behavior and semantics of getCallData/getConstructData, in particular that they cannot change their minds and ma

[webkit-changes] [183629] trunk

Title: [183629] trunk Revision 183629 Author fpi...@apple.com Date 2015-04-30 10:36:26 -0700 (Thu, 30 Apr 2015) Log Message DFG Is versions of TypeOf should fold based on proven input type https://bugs.webkit.org/show_bug.cgi?id=144409 Reviewed by Geoffrey Garen. Source/_javascript_Core:

[webkit-changes] [183575] trunk/Source

Title: [183575] trunk/Source Revision 183575 Author fpi...@apple.com Date 2015-04-29 14:27:48 -0700 (Wed, 29 Apr 2015) Log Message Source/_javascript_Core: JSTypeInfo should have an inline type flag to indicate of getCallData() has been overridden https://bugs.webkit.org/show_bug.cgi?id=

[webkit-changes] [183557] trunk/Source/JavaScriptCore

Title: [183557] trunk/Source/_javascript_Core Revision 183557 Author fpi...@apple.com Date 2015-04-29 10:38:28 -0700 (Wed, 29 Apr 2015) Log Message Evict IsEnvironmentRecord from inline type flags https://bugs.webkit.org/show_bug.cgi?id=144398 Reviewed by Mark Lam and Michael Saboff.

[webkit-changes] [183548] trunk/Source/JavaScriptCore

Title: [183548] trunk/Source/_javascript_Core Revision 183548 Author fpi...@apple.com Date 2015-04-29 08:55:54 -0700 (Wed, 29 Apr 2015) Log Message TypeOf should return SpecStringIdent and the DFG should know this https://bugs.webkit.org/show_bug.cgi?id=144376 Reviewed by Andreas Kling.

[webkit-changes] [183525] trunk/Source/JavaScriptCore

Title: [183525] trunk/Source/_javascript_Core Revision 183525 Author fpi...@apple.com Date 2015-04-28 20:34:43 -0700 (Tue, 28 Apr 2015) Log Message FTL should fully support Switch (it currently lacks the SwitchString variant) https://bugs.webkit.org/show_bug.cgi?id=144348 Reviewed by Ben

<    5   6   7   8   9   10   11   12   13   14   >