[webkit-changes] [252502] trunk/Source/JavaScriptCore

2019-11-15 Thread mark . lam
=> 252502) --- trunk/Source/_javascript_Core/ChangeLog 2019-11-15 21:57:24 UTC (rev 252501) +++ trunk/Source/_javascript_Core/ChangeLog 2019-11-15 22:10:07 UTC (rev 252502) @@ -1,3 +1,36 @@ +2019-11-15 Mark Lam + +Rename InPlaceAbstractState's m_foundConstant to m_shouldTryConstantFold

[webkit-changes] [252247] trunk/Source/JavaScriptCore

2019-11-08 Thread mark . lam
dfg/DFGSpeculativeJIT.cpp Diff Modified: trunk/Source/_javascript_Core/ChangeLog (252246 => 252247) --- trunk/Source/_javascript_Core/ChangeLog 2019-11-08 19:11:14 UTC (rev 252246) +++ trunk/Source/_javascript_Core/ChangeLog 2019-11-08 19:37:54 UTC (rev 252247) @@ -1,3 +1,28 @@ +2019-11-08 Ma

[webkit-changes] [252239] trunk

2019-11-08 Thread mark . lam
sts/ChangeLog 2019-11-08 16:58:49 UTC (rev 252239) @@ -1,3 +1,19 @@ +2019-11-07 Mark Lam + +Add a stack overflow check in Yarr::ByteCompiler::emitDisjunction(). +https://bugs.webkit.org/show_bug.cgi?id=203936 + + +Reviewed by Saam Barati. + +This issue origina

[webkit-changes] [252177] trunk/Source

2019-11-06 Thread mark . lam
unk/Source/_javascript_Core/ChangeLog 2019-11-07 07:21:38 UTC (rev 252176) +++ trunk/Source/_javascript_Core/ChangeLog 2019-11-07 07:27:52 UTC (rev 252177) @@ -1,3 +1,22 @@ +2019-11-06 Mark Lam + +Remove remnants of support code for an upwards growing stack. +https://bugs.webkit.

[webkit-changes] [252160] trunk

2019-11-06 Thread mark . lam
-11-07 00:29:19 UTC (rev 252160) @@ -1,3 +1,13 @@ +2019-11-06 Mark Lam + +JSGlobalObject::fireWatchpointAndMakeAllArrayStructuresSlowPut() should fire its watchpoint as the last step. +https://bugs.webkit.org/show_bug.cgi?id=203867 + + +Reviewed by Saam Bar

[webkit-changes] [252124] trunk/Source

2019-11-05 Thread mark . lam
019-11-05 Mark Lam + +WTF::RunLoop should not depend on isMainThread() idiom. +https://bugs.webkit.org/show_bug.cgi?id=203873 + + +Reviewed by Saam Barati, Ryosuke Niwa, and Devin Rousso. + +* inspector/JSGlobalObjectScriptDebugServer.cpp: +(Inspec

[webkit-changes] [252006] trunk/Source/JavaScriptCore

2019-11-04 Thread mark . lam
rce/_javascript_Core/ChangeLog 2019-11-04 19:19:16 UTC (rev 252005) +++ trunk/Source/_javascript_Core/ChangeLog 2019-11-04 19:23:24 UTC (rev 252006) @@ -1,3 +1,14 @@ +2019-11-04 Mark Lam + +Surpress ASAN in SamplingProfiler's FrameWalker::resetAtMachineFrame(). +https://bugs.webkit.

[webkit-changes] [251790] trunk/Tools

2019-10-30 Thread mark . lam
rev 251790) @@ -1,3 +1,13 @@ +2019-10-30 Mark Lam + +Gardening: fixing broken build. + +Not reviewed. + +JSON appears to not like commas at the end of the last element in an array. + +* Scripts/webkitpy/common/config/contributors.json: + 2019-10-30 Chris Du

[webkit-changes] [251584] trunk/Source

2019-10-25 Thread mark . lam
geLog 2019-10-25 05:45:03 UTC (rev 251583) +++ trunk/Source/_javascript_Core/ChangeLog 2019-10-25 06:59:36 UTC (rev 251584) @@ -1,3 +1,105 @@ +2019-10-24 Mark Lam + +Move JSC::Register inline methods into RegisterInlines.h. +https://bugs.webkit.org/show_bug.cgi?id=2

[webkit-changes] [251456] trunk/Source/JavaScriptCore

2019-10-22 Thread mark . lam
ope): +* runtime/ObjectInitializationScope.h: +(JSC::ObjectInitializationScope::~ObjectInitializationScope): +* runtime/RegExpMatchesArray.cpp: +(JSC::createEmptyRegExpMatchesArray): + +2019-10-22 Mark Lam + Fix incorrect assertion in operationRegExpExecNonGlobalOrSti

[webkit-changes] [251447] trunk

2019-10-22 Thread mark . lam
-in-operationRegExpExecNonGlobalOrSticky.js Diff Modified: trunk/JSTests/ChangeLog (251446 => 251447) --- trunk/JSTests/ChangeLog 2019-10-22 20:23:24 UTC (rev 251446) +++ trunk/JSTests/ChangeLog 2019-10-22 20:27:53 UTC (rev 251447) @@ -1,3 +1,13 @@ +2019-10-22 Mark Lam + +Fix incorr

[webkit-changes] [251418] trunk

2019-10-21 Thread mark . lam
-in-operationRegExpExecNonGlobalOrSticky.js Diff Modified: trunk/JSTests/ChangeLog (251417 => 251418) --- trunk/JSTests/ChangeLog 2019-10-22 04:58:47 UTC (rev 251417) +++ trunk/JSTests/ChangeLog 2019-10-22 05:44:31 UTC (rev 251418) @@ -1,5 +1,14 @@ 2019-10-21 Mark Lam +Rolling

[webkit-changes] [251411] trunk

2019-10-21 Thread mark . lam
251411) --- trunk/JSTests/ChangeLog 2019-10-22 01:48:40 UTC (rev 251410) +++ trunk/JSTests/ChangeLog 2019-10-22 01:55:20 UTC (rev 251411) @@ -1,3 +1,13 @@ +2019-10-21 Mark Lam + +Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky(). +https://bugs.webkit.org/show_bug.

[webkit-changes] [251403] trunk

2019-10-21 Thread mark . lam
-exception-check-in-josn-stringifier.js Diff Modified: trunk/JSTests/ChangeLog (251402 => 251403) --- trunk/JSTests/ChangeLog 2019-10-22 00:43:07 UTC (rev 251402) +++ trunk/JSTests/ChangeLog 2019-10-22 00:51:26 UTC (rev 251403) @@ -1,3 +1,13 @@ +2019-10-21 Mark Lam + +Fix miss

[webkit-changes] [251400] trunk/Source/JavaScriptCore

2019-10-21 Thread mark . lam
Modified: trunk/Source/_javascript_Core/ChangeLog (251399 => 251400) --- trunk/Source/_javascript_Core/ChangeLog 2019-10-22 00:04:27 UTC (rev 251399) +++ trunk/Source/_javascript_Core/ChangeLog 2019-10-22 00:17:50 UTC (rev 251400) @@ -1,5 +1,62 @@ 2019-10-21 Mark Lam +Rolling out r251

[webkit-changes] [251399] trunk/Source/JavaScriptCore

2019-10-21 Thread mark . lam
019-10-22 00:04:27 UTC (rev 251399) @@ -1,3 +1,33 @@ +2019-10-21 Mark Lam + +Fix issues when setting public length on ArrayWithContiguous type butterflies. +https://bugs.webkit.org/show_bug.cgi?id=203211 + + +Reviewed by Keith Miller and Saam Bar

[webkit-changes] [251372] trunk/Source

2019-10-21 Thread mark . lam
/_javascript_Core/ChangeLog (251371 => 251372) --- trunk/Source/_javascript_Core/ChangeLog 2019-10-21 19:06:48 UTC (rev 251371) +++ trunk/Source/_javascript_Core/ChangeLog 2019-10-21 19:15:26 UTC (rev 251372) @@ -1,3 +1,14 @@ +2019-10-21 Mark Lam + +Remove all uses of untagCodePtr in debugg

[webkit-changes] [251274] trunk

2019-10-17 Thread mark . lam
274) @@ -1,3 +1,13 @@ +2019-10-17 Mark Lam + +Add missing checks after calls to the sameValue() JSValue comparator. +https://bugs.webkit.org/show_bug.cgi?id=203126 + + +Reviewed by Saam Barati. + +* stress/validate-exception-check-in-proxy-object-put.js: Ad

[webkit-changes] [251264] trunk/Source/JavaScriptCore

2019-10-17 Thread mark . lam
unk/Source/_javascript_Core/ChangeLog 2019-10-17 22:18:57 UTC (rev 251263) +++ trunk/Source/_javascript_Core/ChangeLog 2019-10-17 22:45:35 UTC (rev 251264) @@ -1,5 +1,17 @@ 2019-10-17 Mark Lam +Harden capacity checks in DFG::LocalCSEPhase::SmallMap. +https://bugs.webkit.

[webkit-changes] [251263] trunk

2019-10-17 Thread mark . lam
rce/_javascript_Core/ChangeLog (251262 => 251263) --- trunk/Source/_javascript_Core/ChangeLog 2019-10-17 22:15:09 UTC (rev 251262) +++ trunk/Source/_javascript_Core/ChangeLog 2019-10-17 22:18:57 UTC (rev 251263) @@ -1,3 +1,53 @@ +2019-10-17 Mark Lam + +Use constexpr in more places and

[webkit-changes] [251226] trunk/Source/JavaScriptCore

2019-10-16 Thread mark . lam
ript_Core/ChangeLog 2019-10-17 05:45:58 UTC (rev 251226) @@ -1,3 +1,137 @@ +2019-10-16 Mark Lam + +Reduce the amount of memory needed to store Options. +https://bugs.webkit.org/show_bug.cgi?id=202105 + +Reviewed by Yusuke Suzuki. + +The size of the JSC::Config neede

[webkit-changes] [251178] trunk

2019-10-15 Thread mark . lam
-10-16 02:32:05 UTC (rev 251177) +++ trunk/JSTests/ChangeLog 2019-10-16 04:01:18 UTC (rev 251178) @@ -1,3 +1,17 @@ +2019-10-15 Mark Lam + +operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string. +https://bugs.webkit.org/show_bug.cgi?id=202

[webkit-changes] [250995] trunk/JSTests

2019-10-10 Thread mark . lam
-10-10 23:44:01 UTC (rev 250995) @@ -1,3 +1,17 @@ +2019-10-10 Mark Lam + +Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result. +https://bugs.webkit.org/show_bug.cgi?id=202828 + +Reviewed by Yusuke Suzuki. + +The tests intentiona

[webkit-changes] [250695] trunk/Source/JavaScriptCore

2019-10-03 Thread mark . lam
01:26:26 UTC (rev 250695) @@ -1,3 +1,19 @@ +2019-10-03 Mark Lam + +Fix testmasm failure on ASan builds. +https://bugs.webkit.org/show_bug.cgi?id=202554 + +Reviewed by Yusuke Suzuki. + +Gigacage is disabled on ASan builds. So testmasm is sad. Make the relevant t

[webkit-changes] [250636] trunk

2019-10-02 Thread mark . lam
UTC (rev 250636) @@ -1,3 +1,13 @@ +2019-10-02 Mark Lam + +DoubleToStringConverter::ToExponential() should null terminate its string. +https://bugs.webkit.org/show_bug.cgi?id=202492 + + +Reviewed by Filip Pizlo. + +* stress/dtoa-AddSubstring-should-uses-strn

[webkit-changes] [250520] trunk/Source/WTF

2019-09-30 Thread mark . lam
Log 2019-09-30 18:15:27 UTC (rev 250520) @@ -1,3 +1,14 @@ +2019-09-30 Mark Lam + +Add some assertions to convertUTF8ToUTF16(). +https://bugs.webkit.org/show_bug.cgi?id=202356 + + +Reviewed by Filip Pizlo. + +* wtf/unicode/UTF8Conversion.cpp: +(WTF::Unic

[webkit-changes] [250383] trunk/Source/JavaScriptCore

2019-09-26 Thread mark . lam
ore/ChangeLog 2019-09-26 09:48:28 UTC (rev 250382) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-26 15:07:17 UTC (rev 250383) @@ -1,3 +1,24 @@ +2019-09-26 Mark Lam + +We need to initialize the Gigacage first in setJITEnabled() when disabling the JIT. +https://bugs.webkit.

[webkit-changes] [250289] trunk/Source/JavaScriptCore

2019-09-24 Thread mark . lam
250288) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-24 07:43:24 UTC (rev 250289) @@ -1,3 +1,23 @@ +2019-09-24 Mark Lam + +Refactor cellSize() out of VMInspector::verifyCellSize(). +https://bugs.webkit.org/show_bug.cgi?id=202132 + +Reviewed by Saam

[webkit-changes] [250285] trunk/Source/JavaScriptCore

2019-09-24 Thread mark . lam
g 2019-09-24 06:02:30 UTC (rev 250285) @@ -1,3 +1,171 @@ +2019-09-23 Mark Lam + +Introducing Integrity audit functions. +https://bugs.webkit.org/show_bug.cgi?id=202085 + +Reviewed by Saam Barati. + +This patch's main goal is to introduce the Integrity audit

[webkit-changes] [250264] trunk

2019-09-23 Thread mark . lam
unk/JSTests/ChangeLog 2019-09-23 23:33:36 UTC (rev 250264) @@ -1,3 +1,13 @@ +2019-09-23 Mark Lam + +Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition. +https://bugs.webkit.org/show_bug.cgi?id=202122 + + +Reviewed by Yusuke Suz

[webkit-changes] [250262] trunk/Source/JavaScriptCore

2019-09-23 Thread mark . lam
trunk/Source/_javascript_Core/ChangeLog (250261 => 250262) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-23 22:54:35 UTC (rev 250261) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-23 22:56:26 UTC (rev 250262) @@ -1,3 +1,125 @@ +2019-09-23 Mark Lam + +Reduce the amount

[webkit-changes] [250189] trunk/Source/JavaScriptCore

2019-09-21 Thread mark . lam
/_javascript_Core/ChangeLog (250188 => 250189) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-22 02:40:44 UTC (rev 250188) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-22 04:01:23 UTC (rev 250189) @@ -1,3 +1,20 @@ +2019-09-21 Mark Lam + +Move JSLexicalEnvironment, DirectArgume

[webkit-changes] [250172] trunk/Source/JavaScriptCore

2019-09-20 Thread mark . lam
:27 UTC (rev 250171) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-21 00:29:13 UTC (rev 250172) @@ -1,3 +1,14 @@ +2019-09-20 Mark Lam + +Harden assertion in StructureIDTable::get(). +https://bugs.webkit.org/show_bug.cgi?id=202067 + + +Reviewed by Keith Mil

[webkit-changes] [250112] trunk/Source/JavaScriptCore

2019-09-19 Thread mark . lam
019-09-20 00:29:56 UTC (rev 250112) @@ -1,5 +1,21 @@ 2019-09-19 Mark Lam +Rename VMInspector::m_list to m_vmList. +https://bugs.webkit.org/show_bug.cgi?id=202015 + +Reviewed by Yusuke Suzuki. + +m_vmList is more descriptive, and this rename helps grep-abil

[webkit-changes] [250107] trunk/Source/JavaScriptCore

2019-09-19 Thread mark . lam
:46:03 UTC (rev 250106) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-19 22:23:50 UTC (rev 250107) @@ -1,5 +1,101 @@ 2019-09-19 Mark Lam +Reduce the number of required tag bits for the JSValue. +https://bugs.webkit.org/show_bug.cgi?id=201990 + +Reviewed by Yusuke Suzu

[webkit-changes] [250099] trunk/Source/JavaScriptCore

2019-09-19 Thread mark . lam
UTC (rev 250098) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-19 19:02:06 UTC (rev 250099) @@ -1,3 +1,19 @@ +2019-09-19 Mark Lam + +Refactoring: fix broken indentation in JSNonDestructibleProxy.h. +https://bugs.webkit.org/show_bug.cgi?id=201989 + +Reviewed by Saam Bar

[webkit-changes] [250097] trunk/Source/JavaScriptCore

2019-09-19 Thread mark . lam
: trunk/Source/_javascript_Core/ChangeLog (250096 => 250097) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-19 18:04:21 UTC (rev 250096) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-19 18:28:19 UTC (rev 250097) @@ -1,5 +1,18 @@ 2019-09-19 Mark Lam +Remove a now unnecess

[webkit-changes] [249875] branches/safari-608.2.11.1-branch/Source/JavaScriptCore

2019-09-14 Thread mark . lam
Title: [249875] branches/safari-608.2.11.1-branch/Source/_javascript_Core Revision 249875 Author mark@apple.com Date 2019-09-14 08:41:13 -0700 (Sat, 14 Sep 2019) Log Message Cherry-pick r249345. rdar://problem/55362909 2019-08-30 Mark Lam Fix a bug in SlotVisitor

[webkit-changes] [249874] branches/safari-608.2.11.1-branch

2019-09-14 Thread mark . lam
to resolve a merge conflict for this patch. * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::zap): Deleted. * heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::zap): Deleted. 2019-08-01 Mark Lam Add crash diagnostics for debugging unexpected zapped cells. https://bugs.webkit.org

[webkit-changes] [249868] trunk/Source/JavaScriptCore

2019-09-13 Thread mark . lam
Diff Modified: trunk/Source/_javascript_Core/ChangeLog (249867 => 249868) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-14 02:16:00 UTC (rev 249867) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-14 02:22:49 UTC (rev 249868) @@ -1,5 +1,20 @@ 2019-09-13 Mark Lam +jsc

[webkit-changes] [249865] trunk/Source/JavaScriptCore

2019-09-13 Thread mark . lam
unk/Source/_javascript_Core/ChangeLog 2019-09-14 01:52:16 UTC (rev 249865) @@ -1,3 +1,13 @@ +2019-09-13 Mark Lam + +watchOS requires PageSize alignment of 16K for JSC::Config. +https://bugs.webkit.org/show_bug.cgi?id=201786 + + +Reviewed by Yusuke Suz

[webkit-changes] [249858] trunk/Source/JavaScriptCore

2019-09-13 Thread mark . lam
bin Morisset. +Re-doing previous fix. + * jit/ExecutableAllocator.h: +(JSC::performJITMemcpy): +(JSC::GigacageAssertScope::GigacageAssertScope): Deleted. +(JSC::GigacageAssertScope::~GigacageAssertScope): Deleted. + +2019-09-13 Mark

[webkit-changes] [249857] trunk/Source/JavaScriptCore

2019-09-13 Thread mark . lam
/_javascript_Core/ChangeLog (249856 => 249857) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-13 22:06:51 UTC (rev 249856) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-13 23:18:51 UTC (rev 249857) @@ -1,3 +1,16 @@ +2019-09-13 Mark Lam + +performJITMemcpy() should do

[webkit-changes] [249856] trunk/Source/bmalloc

2019-09-13 Thread mark . lam
(249855 => 249856) --- trunk/Source/bmalloc/ChangeLog 2019-09-13 21:43:18 UTC (rev 249855) +++ trunk/Source/bmalloc/ChangeLog 2019-09-13 22:06:51 UTC (rev 249856) @@ -1,3 +1,16 @@ +2019-09-13 Mark Lam + +We should never fail to allocate VA for the Gigacage. +https://bugs.webkit.

[webkit-changes] [249841] trunk/Source/JavaScriptCore

2019-09-13 Thread mark . lam
/JSDollarVM.h Diff Modified: trunk/Source/_javascript_Core/ChangeLog (249840 => 249841) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-13 17:30:32 UTC (rev 249840) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-13 17:54:02 UTC (rev 249841) @@ -1,3 +1,205 @@ +2019-09-13 Mark Lam + +

[webkit-changes] [249621] trunk/Source/bmalloc

2019-09-07 Thread mark . lam
/bmalloc/Gigacage.cpp Diff Modified: trunk/Source/bmalloc/ChangeLog (249620 => 249621) --- trunk/Source/bmalloc/ChangeLog 2019-09-07 22:56:32 UTC (rev 249620) +++ trunk/Source/bmalloc/ChangeLog 2019-09-08 01:19:08 UTC (rev 249621) @@ -1,5 +1,25 @@ 2019-09-07 Mark Lam +[Follow up

[webkit-changes] [249613] trunk/Source

2019-09-07 Thread mark . lam
/Source/_javascript_Core/ChangeLog (249612 => 249613) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-07 14:53:21 UTC (rev 249612) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-07 15:01:31 UTC (rev 249613) @@ -1,5 +1,19 @@ 2019-09-07 Mark Lam +performJITMemcpy() source buf

[webkit-changes] [249612] trunk

2019-09-07 Thread mark . lam
/_javascript_Core/ChangeLog trunk/Source/_javascript_Core/jsc.cpp Diff Modified: trunk/JSTests/ChangeLog (249611 => 249612) --- trunk/JSTests/ChangeLog 2019-09-07 10:13:34 UTC (rev 249611) +++ trunk/JSTests/ChangeLog 2019-09-07 14:53:21 UTC (rev 249612) @@ -1,5 +1,18 @@ 2019-09-07 Mark

[webkit-changes] [249611] trunk/JSTests

2019-09-07 Thread mark . lam
-gigacage-typed-arrays.js Diff Modified: trunk/JSTests/ChangeLog (249610 => 249611) --- trunk/JSTests/ChangeLog 2019-09-07 09:50:21 UTC (rev 249610) +++ trunk/JSTests/ChangeLog 2019-09-07 10:13:34 UTC (rev 249611) @@ -1,5 +1,17 @@ 2019-09-07 Mark Lam +Gardening: temporarily skipp

[webkit-changes] [249610] trunk/JSTests

2019-09-07 Thread mark . lam
,13 @@ +2019-09-07 Mark Lam + +Gardening: speculative test fix to green bots [attempt #2]. +https://bugs.webkit.org/show_bug.cgi?id=201529 + + +Not reviewed. + +* stress/test-out-of-memory.js: + 2019-09-06 Mark Lam Gardening: speculative test

[webkit-changes] [249608] trunk/Source

2019-09-06 Thread mark . lam
rce/_javascript_Core/ChangeLog (249607 => 249608) --- trunk/Source/_javascript_Core/ChangeLog 2019-09-07 04:19:52 UTC (rev 249607) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-07 05:42:11 UTC (rev 249608) @@ -1,3 +1,20 @@ +2019-09-06 Mark Lam + +Harden protection of the Gig

[webkit-changes] [249599] trunk/JSTests

2019-09-06 Thread mark . lam
-06 Mark Lam + +Gardening: speculative test fix to green bots. +https://bugs.webkit.org/show_bug.cgi?id=201529 + + +Not reviewed. + +* stress/test-out-of-memory.js: + 2019-09-06 Ross Kirsling Math.round() produces wrong result for value prior to

[webkit-changes] [249588] trunk/Source/bmalloc

2019-09-06 Thread mark . lam
588) --- trunk/Source/bmalloc/ChangeLog 2019-09-06 20:08:56 UTC (rev 249587) +++ trunk/Source/bmalloc/ChangeLog 2019-09-06 20:23:31 UTC (rev 249588) @@ -1,5 +1,23 @@ 2019-09-06 Mark Lam +Use FailureAction everywhere in bmalloc instead of a crashOnFailure boolean. +ht

[webkit-changes] [249587] trunk/JSTests

2019-09-06 Thread mark . lam
-constructors-should-not-override-global-object-property.js Diff Modified: trunk/JSTests/ChangeLog (249586 => 249587) --- trunk/JSTests/ChangeLog 2019-09-06 19:11:20 UTC (rev 249586) +++ trunk/JSTests/ChangeLog 2019-09-06 20:08:56 UTC (rev 249587) @@ -1,5 +1,17 @@ 2019-09-06 Mark

[webkit-changes] [249578] trunk

2019-09-06 Thread mark . lam
/ChangeLog (249577 => 249578) --- trunk/JSTests/ChangeLog 2019-09-06 17:03:28 UTC (rev 249577) +++ trunk/JSTests/ChangeLog 2019-09-06 17:04:13 UTC (rev 249578) @@ -1,3 +1,13 @@ +2019-09-06 Mark Lam + +Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate. +ht

[webkit-changes] [249556] trunk/Source

2019-09-05 Thread mark . lam
Log 2019-09-05 23:42:52 UTC (rev 249555) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-06 00:03:52 UTC (rev 249556) @@ -1,3 +1,20 @@ +2019-09-05 Mark Lam + +Refactor the Gigacage code to require less pointer casting. +https://bugs.webkit.org/show_bug.cgi?id=201

[webkit-changes] [249499] trunk/Source/JavaScriptCore

2019-09-04 Thread mark . lam
unk/Source/_javascript_Core/ChangeLog 2019-09-04 21:12:47 UTC (rev 249499) @@ -1,3 +1,17 @@ +2019-09-03 Mark Lam + +Structure::storedPrototype() and storedPrototypeObject() should assert with isCompilationThread(), not !isMainThread(). +https://bugs.webkit.org/show_bug.cgi?id=201

[webkit-changes] [249495] trunk/Source/JavaScriptCore

2019-09-04 Thread mark . lam
-09-04 19:53:41 UTC (rev 249494) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-04 20:08:24 UTC (rev 249495) @@ -1,3 +1,15 @@ +2019-09-04 Mark Lam + +Disambiguate a symbol used in JSDollarVM. +https://bugs.webkit.org/show_bug.cgi?id=201466 + + +Reviewed by Ta

[webkit-changes] [249488] branches/safari-608-branch/Source/JavaScriptCore

2019-09-04 Thread mark . lam
Title: [249488] branches/safari-608-branch/Source/_javascript_Core Revision 249488 Author mark@apple.com Date 2019-09-04 11:15:18 -0700 (Wed, 04 Sep 2019) Log Message Cherry-pick 249345. rdar://problem/55000994 2019-08-30 Mark Lam Fix a bug in SlotVisitor

[webkit-changes] [249484] branches/safari-608-branch

2019-09-04 Thread mark . lam
a merge conflict for this patch. * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::zap): Deleted. * heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::zap): Deleted. 2019-08-02 Mark Lam Gardening: build fix. https://bugs.webkit.org/show_bug.cgi?id=200149 Not reviewed

[webkit-changes] [249458] trunk

2019-09-04 Thread mark . lam
/JSTests/ChangeLog (249457 => 249458) --- trunk/JSTests/ChangeLog 2019-09-04 06:13:40 UTC (rev 249457) +++ trunk/JSTests/ChangeLog 2019-09-04 06:13:46 UTC (rev 249458) @@ -1,3 +1,13 @@ +2019-09-03 Mark Lam + +Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thr

[webkit-changes] [249449] trunk/Source/JavaScriptCore

2019-09-03 Thread mark . lam
ore/ChangeLog 2019-09-04 01:47:02 UTC (rev 249449) @@ -1,3 +1,54 @@ +2019-09-03 Mark Lam + +Remove the need to pass performJITMemcpy as a pointer. +https://bugs.webkit.org/show_bug.cgi?id=201413 + +Reviewed by Michael Saboff. + +We want performJITMemcpy to alw

[webkit-changes] [249365] trunk/Source/JavaScriptCore

2019-09-01 Thread mark . lam
364) +++ trunk/Source/_javascript_Core/ChangeLog 2019-09-01 16:31:51 UTC (rev 249365) @@ -1,3 +1,13 @@ +2019-09-01 Mark Lam + +Speculative build fix for ARMv7 and MIPS. +https://bugs.webkit.org/show_bug.cgi?id=201389 + +Not reviewed. + +* bytecode/CodeBlock.cpp: +(

[webkit-changes] [249347] trunk/Source/JavaScriptCore

2019-08-30 Thread mark . lam
019-08-30 22:02:37 UTC (rev 249347) @@ -1,5 +1,21 @@ 2019-08-30 Mark Lam +Remove some obsolete statements that have no effect. +https://bugs.webkit.org/show_bug.cgi?id=201357 + +Reviewed by Saam Barati. + +This patch removes 3 statements that loo

[webkit-changes] [249345] trunk/Source/JavaScriptCore

2019-08-30 Thread mark . lam
/ChangeLog (249344 => 249345) --- trunk/Source/_javascript_Core/ChangeLog 2019-08-30 20:33:44 UTC (rev 249344) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-30 21:18:16 UTC (rev 249345) @@ -1,3 +1,26 @@ +2019-08-30 Mark Lam + +Fix a bug in SlotVisitor::reportZappedCellAndCrash() and a

[webkit-changes] [249279] trunk/Source/JavaScriptCore

2019-08-29 Thread mark . lam
17:01:28 UTC (rev 249278) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-29 17:04:07 UTC (rev 249279) @@ -1,3 +1,62 @@ +2019-08-29 Mark Lam + +Remove a bad assertion in ByteCodeParser::inlineCall(). +https://bugs.webkit.org/show_bug.cgi?id=201292 + + +Reviewed b

[webkit-changes] [249247] trunk

2019-08-29 Thread mark . lam
9247) --- trunk/JSTests/ChangeLog 2019-08-29 06:46:27 UTC (rev 249246) +++ trunk/JSTests/ChangeLog 2019-08-29 06:49:28 UTC (rev 249247) @@ -1,5 +1,15 @@ 2019-08-28 Mark Lam +DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane check

[webkit-changes] [249225] trunk

2019-08-28 Thread mark . lam
/missing-exception-check-in-operationHasGenericProperty.js Diff Modified: trunk/JSTests/ChangeLog (249224 => 249225) --- trunk/JSTests/ChangeLog 2019-08-28 23:07:40 UTC (rev 249224) +++ trunk/JSTests/ChangeLog 2019-08-28 23:11:17 UTC (rev 249225) @@ -1,3 +1,13 @@ +2019-08-28 Mark

[webkit-changes] [249221] trunk/Source/JavaScriptCore

2019-08-28 Thread mark . lam
/_javascript_Core/ChangeLog (249220 => 249221) --- trunk/Source/_javascript_Core/ChangeLog 2019-08-28 21:23:01 UTC (rev 249220) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-28 21:24:47 UTC (rev 249221) @@ -1,3 +1,26 @@ +2019-08-28 Mark Lam + +Wasm's AirIRGenerator::addLocal() and B3IRGenera

[webkit-changes] [249199] trunk/Source/JavaScriptCore

2019-08-28 Thread mark . lam
198) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-28 15:36:37 UTC (rev 249199) @@ -1,3 +1,18 @@ +2019-08-28 Mark Lam + +Gardening: Rebase test results after r249175. +https://bugs.webkit.org/show_bug.cgi?id=201172 + +Not reviewed. + +* Scripts/tests/builtins/expec

[webkit-changes] [249164] trunk

2019-08-27 Thread mark . lam
rev 249163) +++ trunk/JSTests/ChangeLog 2019-08-27 20:10:40 UTC (rev 249164) @@ -1,3 +1,13 @@ +2019-08-27 Mark Lam + +constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM. +https://bugs.webkit.org/show_bug.cgi?id=201196 + + +Revie

[webkit-changes] [249065] trunk/Source/bmalloc

2019-08-23 Thread mark . lam
rce/bmalloc/ChangeLog (249064 => 249065) --- trunk/Source/bmalloc/ChangeLog 2019-08-23 20:31:08 UTC (rev 249064) +++ trunk/Source/bmalloc/ChangeLog 2019-08-23 20:55:28 UTC (rev 249065) @@ -1,3 +1,18 @@ +2019-08-22 Mark Lam + +Undo disabling of IsoHeaps when Gigacage is off. +

[webkit-changes] [249052] trunk/Source/JavaScriptCore

2019-08-23 Thread mark . lam
angeLog 2019-08-23 17:15:42 UTC (rev 249051) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-23 17:21:19 UTC (rev 249052) @@ -1,3 +1,27 @@ +2019-08-22 Mark Lam + +VirtualRegister::dump() can use more informative CallFrame header slot names. +https://bugs.webkit.org/show

[webkit-changes] [248992] trunk/Source/WTF

2019-08-21 Thread mark . lam
WTF/ChangeLog 2019-08-22 02:33:40 UTC (rev 248991) +++ trunk/Source/WTF/ChangeLog 2019-08-22 02:44:01 UTC (rev 248992) @@ -1,3 +1,16 @@ +2019-08-21 Mark Lam + +Fix infinite recursion in WTFCrashWithInfo() after r248930. +https://bugs.webkit.org/show_bug.cgi?id=201

[webkit-changes] [248989] trunk

2019-08-21 Thread mark . lam
/too-many-locals.js Diff Modified: trunk/JSTests/ChangeLog (248988 => 248989) --- trunk/JSTests/ChangeLog 2019-08-22 01:25:48 UTC (rev 248988) +++ trunk/JSTests/ChangeLog 2019-08-22 01:42:22 UTC (rev 248989) @@ -1,3 +1,14 @@ +2019-08-21 Mark Lam + +Wasm::FunctionParser is fail

[webkit-changes] [248930] trunk/Source/WTF

2019-08-20 Thread mark . lam
/Assertions.h Diff Modified: trunk/Source/WTF/ChangeLog (248929 => 248930) --- trunk/Source/WTF/ChangeLog 2019-08-21 01:13:02 UTC (rev 248929) +++ trunk/Source/WTF/ChangeLog 2019-08-21 01:36:41 UTC (rev 248930) @@ -1,3 +1,19 @@ +2019-08-20 Mark Lam + +Make it easier to pass point

[webkit-changes] [248929] trunk/Source/JavaScriptCore

2019-08-20 Thread mark . lam
929) @@ -1,5 +1,35 @@ 2019-08-20 Mark Lam +Remove superfluous size argument to allocateCell() for fixed size objects. +https://bugs.webkit.org/show_bug.cgi?id=200958 + +Reviewed by Yusuke Suzuki. + +The size is already automatically computed by the allocateC

[webkit-changes] [248927] trunk/Source/JavaScriptCore

2019-08-20 Thread mark . lam
rce/_javascript_Core/ChangeLog 2019-08-21 00:39:02 UTC (rev 248927) @@ -1,3 +1,19 @@ +2019-08-20 Mark Lam + +JSBigInt::m_length should be immutable. +https://bugs.webkit.org/show_bug.cgi?id=200956 + +Reviewed by Yusuke Suzuki. + +This is because the JSBigInt cell s

[webkit-changes] [248802] trunk

2019-08-16 Thread mark . lam
(248801 => 248802) --- trunk/JSTests/ChangeLog 2019-08-16 23:02:16 UTC (rev 248801) +++ trunk/JSTests/ChangeLog 2019-08-16 23:49:27 UTC (rev 248802) @@ -1,5 +1,18 @@ 2019-08-16 Mark Lam +More missing exception checks in string comparison operators. +https://bugs.webkit.

[webkit-changes] [248800] trunk

2019-08-16 Thread mark . lam
nk/JSTests/stress/codeblock-should-clear-watchpoints-on-destruction.js Diff Modified: trunk/JSTests/ChangeLog (248799 => 248800) --- trunk/JSTests/ChangeLog 2019-08-16 22:14:26 UTC (rev 248799) +++ trunk/JSTests/ChangeLog 2019-08-16 22:49:26 UTC (rev 248800) @@ -1,3 +1,13 @@ +2019-08

[webkit-changes] [248796] trunk

2019-08-16 Thread mark . lam
Diff Modified: trunk/JSTests/ChangeLog (248795 => 248796) --- trunk/JSTests/ChangeLog 2019-08-16 20:59:29 UTC (rev 248795) +++ trunk/JSTests/ChangeLog 2019-08-16 21:03:44 UTC (rev 248796) @@ -1,3 +1,14 @@ +2019-08-16 Mark Lam + +[Re-land] ProxyObject should not be allow to access

[webkit-changes] [248716] trunk

2019-08-15 Thread mark . lam
715) +++ trunk/JSTests/ChangeLog 2019-08-15 16:31:19 UTC (rev 248716) @@ -1,3 +1,15 @@ +2019-08-15 Mark Lam + +More missing exception checks in String.prototype. +https://bugs.webkit.org/show_bug.cgi?id=200762 + + +Reviewed by Michael Saboff. + +* stress/miss

[webkit-changes] [248709] trunk

2019-08-15 Thread mark . lam
ress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js Diff Modified: trunk/JSTests/ChangeLog (248708 => 248709) --- trunk/JSTests/ChangeLog 2019-08-15 06:11:35 UTC (rev 248708) +++ trunk/JSTests/ChangeLog 2019-08-15 06:20:11 UTC (rev 248709) @@ -1,5 +1,16 @@ 2019-08-14

[webkit-changes] [248694] trunk

2019-08-14 Thread mark . lam
-exception-check-in-string-compare.js Diff Modified: trunk/JSTests/ChangeLog (248693 => 248694) --- trunk/JSTests/ChangeLog 2019-08-14 23:33:24 UTC (rev 248693) +++ trunk/JSTests/ChangeLog 2019-08-14 23:36:28 UTC (rev 248694) @@ -1,3 +1,13 @@ +2019-08-14 Mark Lam + +Missing except

[webkit-changes] [248642] trunk/Source/JavaScriptCore

2019-08-13 Thread mark . lam
epReductionPhase.cpp Diff Modified: trunk/Source/_javascript_Core/ChangeLog (248641 => 248642) --- trunk/Source/_javascript_Core/ChangeLog 2019-08-13 23:03:44 UTC (rev 248641) +++ trunk/Source/_javascript_Core/ChangeLog 2019-08-13 23:31:19 UTC (rev 248642) @@ -1,3 +1,84 @@ +2019-08-

[webkit-changes] [248192] trunk/Source

2019-08-02 Thread mark . lam
t_Core/ChangeLog 2019-08-03 00:31:31 UTC (rev 248192) @@ -1,3 +1,75 @@ +2019-08-02 Mark Lam + +[ARM64E] Harden the diversity of the DOMJIT::Signature::unsafeFunction pointer. +https://bugs.webkit.org/show_bug.cgi?id=200292 + + +Reviewed by Geoffrey

[webkit-changes] [248162] trunk/Source/JavaScriptCore

2019-08-02 Thread mark . lam
ore/ChangeLog 2019-08-02 18:16:52 UTC (rev 248162) @@ -1,3 +1,14 @@ +2019-08-02 Mark Lam + +Gardening: build fix. +https://bugs.webkit.org/show_bug.cgi?id=200149 + + +Not reviewed. + +* assembler/CPU.cpp: +(JSC::hwPhysicalCPUMax): + 2019-08-01 Yusuke Suz

[webkit-changes] [248143] trunk/Source

2019-08-01 Thread mark . lam
Log 2019-08-02 01:58:11 UTC (rev 248143) @@ -1,3 +1,72 @@ +2019-08-01 Mark Lam + +Add crash diagnostics for debugging unexpected zapped cells. +https://bugs.webkit.org/show_bug.cgi?id=200149 + + +Reviewed by Yusuke Suzuki. + +Add a check for zapped ce

[webkit-changes] [248105] trunk/Source

2019-08-01 Thread mark . lam
105) @@ -1,3 +1,36 @@ +2019-07-31 Mark Lam + +Rename DOMJIT safe/unsafeFunction to functionWithTypeChecks and functionWithoutTypeChecks. +https://bugs.webkit.org/show_bug.cgi?id=200323 + +Reviewed by Yusuke Suzuki. + +The DOMJIT has a notion of a safeFunct

[webkit-changes] [247886] trunk/Source

2019-07-26 Thread mark . lam
885) +++ trunk/Source/_javascript_Core/ChangeLog 2019-07-27 00:43:54 UTC (rev 247886) @@ -1,3 +1,60 @@ +2019-07-26 Mark Lam + +Add crash diagnostics for debugging unexpected zapped cells. +https://bugs.webkit.org/show_bug.cgi?id=200149 + + +Reviewed by Yusuke Suzuki, S

[webkit-changes] [247801] trunk/Source/JavaScriptCore

2019-07-24 Thread mark . lam
rce/_javascript_Core/ChangeLog 2019-07-25 00:10:51 UTC (rev 247801) @@ -1,5 +1,19 @@ 2019-07-24 Mark Lam +Remove some unused code. +https://bugs.webkit.org/show_bug.cgi?id=200101 + +Reviewed by Yusuke Suzuki. + +* heap/MarkedBlock.cpp: +(JSC::MarkedBlock::Handle::

[webkit-changes] [247799] trunk/Source/JavaScriptCore

2019-07-24 Thread mark . lam
rev 247798) +++ trunk/Source/_javascript_Core/ChangeLog 2019-07-24 23:51:13 UTC (rev 247799) @@ -1,3 +1,34 @@ +2019-07-24 Mark Lam + +performJITMemcpy should be PACed with a non-zero diversifier when passed and called via a pointer. +https://bugs.webkit.org/show_bug.cgi?id=200

[webkit-changes] [247532] trunk

2019-07-17 Thread mark . lam
sts/ChangeLog 2019-07-17 20:30:52 UTC (rev 247532) @@ -1,3 +1,13 @@ +2019-07-16 Mark Lam + +ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds. +https://bugs.webkit.org/show_bug.cgi?id=199821 + + +Reviewed by Filip Pi

[webkit-changes] [247183] trunk

2019-07-05 Thread mark . lam
22:24:07 UTC (rev 247182) +++ trunk/JSTests/ChangeLog 2019-07-05 23:05:56 UTC (rev 247183) @@ -1,3 +1,13 @@ +2019-07-05 Mark Lam + +ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero. +https://bugs.webkit.org/show_bug.cgi?id=199

[webkit-changes] [246910] trunk/Source/JavaScriptCore

2019-06-27 Thread mark . lam
,26 @@ +2019-06-27 Mark Lam + +FTL keepAlive()'s patchpoint should also declare that it reads HeapRange::top(). +https://bugs.webkit.org/show_bug.cgi?id=199291 + +Reviewed by Yusuke Suzuki and Filip Pizlo. + +The sole purpose of keepAlive() is to communicate to

[webkit-changes] [246740] trunk

2019-06-24 Thread mark . lam
trunk/JSTests/ChangeLog 2019-06-24 17:38:12 UTC (rev 246740) @@ -1,3 +1,13 @@ +2019-06-21 Mark Lam + +ArraySlice needs to keep the source array alive. +https://bugs.webkit.org/show_bug.cgi?id=197374 + + +Reviewed by Michael Saboff and Filip Pizlo. + +* stres

[webkit-changes] [243420] trunk

2019-03-23 Thread mark . lam
Log 2019-03-24 01:35:13 UTC (rev 243419) +++ trunk/JSTests/ChangeLog 2019-03-24 04:15:56 UTC (rev 243420) @@ -1,3 +1,13 @@ +2019-03-23 Mark Lam + +Rolling out r243032 and r243071 because the fix is incorrect. +https://bugs.webkit.org/show_bug.cgi?id=195

[webkit-changes] [243391] trunk

2019-03-22 Thread mark . lam
rev 243391) @@ -1,5 +1,19 @@ 2019-03-22 Mark Lam +Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf(). +https://bugs.webkit.org/show_bug.cgi?id=196154 + + +Reviewed by Filip Pizlo. + +Also added //@ runDefault constraint to

[webkit-changes] [243386] trunk

2019-03-22 Thread mark . lam
386) @@ -1,3 +1,13 @@ +2019-03-22 Mark Lam + +Placate exception check validation in constructJSWebAssemblyLinkError(). +https://bugs.webkit.org/show_bug.cgi?id=196152 + + +Reviewed by Michael Saboff. + +* stress/web-assembly-link-error-exception-check.js: Ad

[webkit-changes] [243344] trunk

2019-03-21 Thread mark . lam
rev 243343) +++ trunk/JSTests/ChangeLog 2019-03-21 23:34:31 UTC (rev 243344) @@ -1,3 +1,13 @@ +2019-03-21 Mark Lam + +Remove an invalid assertion in DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(). +https://bugs.webkit.org/show_bug.cgi?id=196

  1   2   3   4   5   6   7   8   9   10   >