JSC should infer when indexed storage is contiguous, and optimize for it
https://bugs.webkit.org/show_bug.cgi?id=97288

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

This introduces a new kind of indexed property storage called Contiguous,
which has the following properties:
        
- No header bits beyond IndexedHeader. This results in a 16 byte reduction
  in memory usage per array versus an ArrayStorage array. It also means
  that the total memory usage for an empty array is now just 3 * 8 on both
  32-bit and 64-bit. Of that, only 8 bytes are array-specific; the rest is
  our standard object header overhead.
        
- No need for hole checks on store. This results in a ~4% speed-up on
  Kraken and a ~1% speed-up on V8v7.
        
- publicLength <= vectorLength. This means that doing new Array(blah)
  immediately allocates room for blah elements.
        
- No sparse map or index bias.
        
If you ever do things to an array that would require publicLength >
vectorLength, a sparse map, or index bias, then we switch to ArrayStorage
mode. This seems to never happen in any benchmark we track, and is unlikely
to happen very frequently on any website.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::JumpList::append):
* assembler/MacroAssembler.h:
(MacroAssembler):
(JSC::MacroAssembler::patchableBranchTest32):
* bytecode/ByValInfo.h: Added.
(JSC):
(JSC::isOptimizableIndexingType):
(JSC::jitArrayModeForIndexingType):
(JSC::ByValInfo::ByValInfo):
(ByValInfo):
(JSC::getByValInfoBytecodeIndex):
* bytecode/CodeBlock.h:
(CodeBlock):
(JSC::CodeBlock::getByValInfo):
(JSC::CodeBlock::setNumberOfByValInfos):
(JSC::CodeBlock::numberOfByValInfos):
(JSC::CodeBlock::byValInfo):
* bytecode/SamplingTool.h:
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::fromObserved):
(JSC::DFG::modeAlreadyChecked):
(JSC::DFG::modeToString):
* dfg/DFGArrayMode.h:
(DFG):
(JSC::DFG::modeUsesButterfly):
(JSC::DFG::modeIsJSArray):
(JSC::DFG::isInBoundsAccess):
(JSC::DFG::mayStoreToTail):
(JSC::DFG::mayStoreToHole):
(JSC::DFG::modeIsPolymorphic):
(JSC::DFG::polymorphicIncludesContiguous):
(JSC::DFG::polymorphicIncludesArrayStorage):
(JSC::DFG::canCSEStorage):
(JSC::DFG::modeSupportsLength):
(JSC::DFG::benefitsFromStructureCheck):
(JSC::DFG::isEffectful):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsic):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::getArrayLengthElimination):
(JSC::DFG::CSEPhase::getByValLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::checkArray):
(JSC::DFG::FixupPhase::blessArrayOperation):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::byValIsPure):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCacheGetByID):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
(JSC::DFG::SpeculativeJIT::arrayify):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
(DFG):
* dfg/DFGSpeculativeJIT.h:
(DFG):
(JSC::DFG::SpeculativeJIT::callOperation):
(SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
(JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
(DFG):
(JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
(JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
(DFG):
(JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
(JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
(JSC::DFG::SpeculativeJIT::compile):
* interpreter/Interpreter.cpp:
(SamplingScope):
(JSC::SamplingScope::SamplingScope):
(JSC::SamplingScope::~SamplingScope):
(JSC):
(JSC::Interpreter::execute):
* jit/JIT.cpp:
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::privateCompile):
* jit/JIT.h:
(JSC::ByValCompilationInfo::ByValCompilationInfo):
(ByValCompilationInfo):
(JSC):
(JIT):
(JSC::JIT::compileGetByVal):
(JSC::JIT::compilePutByVal):
* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateJSArray):
(JSC::JIT::emitArrayProfileStoreToHoleSpecialCase):
(JSC):
(JSC::arrayProfileSaw):
(JSC::JIT::chooseArrayMode):
* jit/JITOpcodes.cpp:
(JSC::JIT::emitSlow_op_get_argument_by_val):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emitSlow_op_new_array):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emitSlow_op_get_argument_by_val):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC):
(JSC::JIT::emitContiguousGetByVal):
(JSC::JIT::emitArrayStorageGetByVal):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::privateCompilePatchGetArrayLength):
(JSC::JIT::privateCompileGetByVal):
(JSC::JIT::privateCompilePutByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC):
(JSC::JIT::emitContiguousGetByVal):
(JSC::JIT::emitArrayStorageGetByVal):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitSlow_op_put_by_val):
* jit/JITStubs.cpp:
(JSC::getByVal):
(JSC):
(JSC::DEFINE_STUB_FUNCTION):
(JSC::putByVal):
* jit/JITStubs.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayConventions.h:
(JSC::isDenseEnoughForVector):
* runtime/ArrayPrototype.cpp:
(JSC):
(JSC::shift):
(JSC::unshift):
(JSC::arrayProtoFuncPush):
(JSC::arrayProtoFuncShift):
(JSC::arrayProtoFuncSplice):
(JSC::arrayProtoFuncUnShift):
* runtime/Butterfly.h:
(Butterfly):
(JSC::Butterfly::fromPointer):
(JSC::Butterfly::pointer):
(JSC::Butterfly::publicLength):
(JSC::Butterfly::vectorLength):
(JSC::Butterfly::setPublicLength):
(JSC::Butterfly::setVectorLength):
(JSC::Butterfly::contiguous):
(JSC::Butterfly::fromContiguous):
* runtime/ButterflyInlineMethods.h:
(JSC::Butterfly::unshift):
(JSC::Butterfly::shift):
* runtime/IndexingHeaderInlineMethods.h:
(JSC::IndexingHeader::indexingPayloadSizeInBytes):
* runtime/IndexingType.cpp: Added.
(JSC):
(JSC::indexingTypeToString):
* runtime/IndexingType.h:
(JSC):
(JSC::hasContiguous):
* runtime/JSArray.cpp:
(JSC::JSArray::setLengthWithArrayStorage):
(JSC::JSArray::setLength):
(JSC):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithArrayStorage):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::sortNumericVector):
(JSC::JSArray::sortNumeric):
(JSC::JSArray::sortCompactedVector):
(JSC::JSArray::sort):
(JSC::JSArray::sortVector):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):
(JSC::JSArray::compactForSorting):
* runtime/JSArray.h:
(JSC::JSArray::shiftCountForShift):
(JSC::JSArray::shiftCountForSplice):
(JSArray):
(JSC::JSArray::shiftCount):
(JSC::JSArray::unshiftCountForShift):
(JSC::JSArray::unshiftCountForSplice):
(JSC::JSArray::unshiftCount):
(JSC::JSArray::isLengthWritable):
(JSC::createContiguousArrayButterfly):
(JSC):
(JSC::JSArray::create):
(JSC::JSArray::tryCreateUninitialized):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
(JSC):
(JSC::JSGlobalObject::haveABadTime):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::arrayStructureWithArrayStorage):
(JSC::JSGlobalObject::addressOfArrayStructureWithArrayStorage):
(JSC::constructEmptyArray):
* runtime/JSObject.cpp:
(JSC::JSObject::visitButterfly):
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::createInitialContiguous):
(JSC):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::ensureContiguousSlow):
(JSC::JSObject::ensureArrayStorageSlow):
(JSC::JSObject::ensureIndexedStorageSlow):
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
(JSC::JSObject::switchToSlowPutArrayStorage):
(JSC::JSObject::setPrototype):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthContiguousWithoutAttributes):
(JSC::JSObject::putByIndexBeyondVectorLength):
(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::putDirectIndexBeyondVectorLength):
(JSC::JSObject::getNewVectorLength):
(JSC::JSObject::countElementsInContiguous):
(JSC::JSObject::increaseVectorLength):
(JSC::JSObject::ensureContiguousLengthSlow):
(JSC::JSObject::getOwnPropertyDescriptor):
* runtime/JSObject.h:
(JSC::JSObject::getArrayLength):
(JSC::JSObject::getVectorLength):
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::canSetIndexQuicklyForPutDirect):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::hasSparseMap):
(JSC::JSObject::inSparseIndexingMode):
(JSObject):
(JSC::JSObject::ensureContiguous):
(JSC::JSObject::ensureIndexedStorage):
(JSC::JSObject::ensureContiguousLength):
(JSC::JSObject::indexingData):
(JSC::JSObject::relevantLength):
* runtime/JSValue.cpp:
(JSC::JSValue::description):
* runtime/Options.cpp:
(JSC::Options::initialize):
* runtime/Structure.cpp:
(JSC::Structure::needsSlowPutIndexing):
(JSC):
(JSC::Structure::suggestedArrayStorageTransition):
* runtime/Structure.h:
(Structure):
* runtime/StructureTransitionTable.h:
(JSC::newIndexingType):

Source/WTF: 

Moved out this helpful math utility to MathExtras, since we now use it in
multiple places.

* wtf/MathExtras.h:
(timesThreePlusOneDividedByTwo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130826 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix coding style of layout test fast/dom/timer-throttling-hidden-page.html
https://bugs.webkit.org/show_bug.cgi?id=98828

Patch by Kiran Muppala <cmuppala@apple.com> on 2012-10-09
Reviewed by Ojan Vafai.

Replaced tab characters with spaces, fixed position of braces and renamed
variables to be more explanatory.

* fast/dom/timer-throttling-hidden-page.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130827 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, adding forgotten files.

* bytecode/ByValInfo.h: Added.
(JSC):
(JSC::isOptimizableIndexingType):
(JSC::jitArrayModeForIndexingType):
(JSC::ByValInfo::ByValInfo):
(ByValInfo):
(JSC::getByValInfoBytecodeIndex):
* runtime/IndexingType.cpp: Added.
(JSC):
(JSC::indexingTypeToString):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130828 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update the CSS property used to support draggable regions.
https://bugs.webkit.org/show_bug.cgi?id=97156

Reviewed by Adam Barth.

Source/JavaScriptCore:

The CSS property to support draggable regions, guarded under
WIDGET_REGION is now disabled from Mac WebKit, in order not to cause
confusion with DASHBOARD_SUPPORT feature.

* Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.

Source/WebCore:

The CSS property to support draggable regions has been changed from
"-webkit-widget-region" to "-webkit-app-region" in the following syntax:
   -webkit-app-region: drag|no-drag

The CSS parsing code for draggable regions is now different from the CSS
parsing code for dashboard regions since we have quite different syntax.

We still try to share as much rendering update code as possible for
these two features. To make the shared code easier to understand for
both features, the name "DashboardRegions" in the shared code is changed
to "AnnotatedRegions" to work for both dashboard regions and draggable
regions.

Note that we still using WIDGET_REGION as feature name in order not to
add more changes to this patch. It will be renamed to a more appropriate
name in next patch. WIDGET_REGION is now only turned on for the chromium
port.

Test: fast/css/draggable-region-parser.html

* Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.
* WebCore.exp.in: Update the exported symbol due to renaming.
* css/CSSComputedStyleDeclaration.cpp: Update the CSS parsing.
(WebCore):
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
* css/CSSParser.cpp: Update the CSS parsing.
(WebCore::CSSParser::parseValue):
(WebCore):
(WebCore::CSSParser::parseDashboardRegions):
* css/CSSParserValues.cpp: Update the CSS parsing.
(WebCore::CSSParserValue::createCSSValue):
* css/CSSPrimitiveValue.cpp: Update the CSS parsing.
(WebCore::isValidCSSUnitTypeForDoubleConversion):
(WebCore):
(WebCore::CSSPrimitiveValue::cleanup):
(WebCore::CSSPrimitiveValue::customCssText):
(WebCore::CSSPrimitiveValue::cloneForCSSOM):
(WebCore::CSSPrimitiveValue::reportDescendantMemoryUsage):
* css/CSSPrimitiveValue.h: Update the CSS parsing.
(CSSPrimitiveValue):
* css/CSSProperty.cpp:
(WebCore::CSSProperty::isInheritedProperty):
* css/CSSPropertyNames.in: Rename the CSS property for draggable region.
* css/CSSValueKeywords.in: Add the keywords supported for the draggable region.
* css/DashboardRegion.h: Remove WIDGET_REGION guard.
(DashboardRegion):
* css/StyleResolver.cpp: Update the CSS parsing.
(WebCore::StyleResolver::collectMatchingRulesForList):
* dom/Document.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::Document::Document):
(WebCore::Document::annotatedRegions):
(WebCore::Document::setAnnotatedRegions):
(WebCore::Document::reportMemoryUsage):
* dom/Document.h: Rename dashboardRegions to annotatedRegions.
(WebCore):
(WebCore::Document::setAnnotatedRegionsDirty):
(WebCore::Document::annotatedRegionsDirty):
(WebCore::Document::hasAnnotatedRegions):
(WebCore::Document::setHasAnnotatedRegions):
(Document):
* page/Chrome.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::ChromeClient::annotatedRegionsChanged):
* page/ChromeClient.h: Rename dashboardRegions to annotatedRegions.
(ChromeClient):
* page/FrameView.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::FrameView::layout):
(WebCore::FrameView::updateAnnotatedRegions):
(WebCore::FrameView::paintContents):
* page/FrameView.h: Rename dashboardRegions to annotatedRegions.
(FrameView):
* rendering/RenderInline.cpp:
(WebCore::RenderInline::addAnnotatedRegions):
* rendering/RenderInline.h: Rename dashboardRegions to annotatedRegions.
(RenderInline):
* rendering/RenderLayer.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::RenderLayer::scrollTo):
(WebCore::RenderLayer::setHasHorizontalScrollbar):
(WebCore::RenderLayer::setHasVerticalScrollbar):
(WebCore::RenderLayer::updateScrollbarsAfterLayout):
* rendering/RenderListBox.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::RenderListBox::setHasVerticalScrollbar):
* rendering/RenderObject.cpp: Rename dashboardRegions to annotatedRegions.
(WebCore::RenderObject::styleWillChange):
(WebCore::RenderObject::addAnnotatedRegions):
(WebCore::RenderObject::collectAnnotatedRegions):
* rendering/RenderObject.h: Rename dashboardRegions to annotatedRegions.
(WebCore::AnnotatedRegionValue::operator==):
(WebCore::AnnotatedRegionValue::operator!=):
(AnnotatedRegionValue):
(RenderObject):
* rendering/style/RenderStyle.cpp: Update the CSS parsing.
(WebCore::RenderStyle::diff):
(WebCore):
* rendering/style/RenderStyle.h: Update the CSS parsing.
* rendering/style/RenderStyleConstants.h: Update the CSS parsing.
* rendering/style/StyleDashboardRegion.h: Update the CSS parsing.
* rendering/style/StyleRareNonInheritedData.cpp: Update the CSS parsing.
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):
* rendering/style/StyleRareNonInheritedData.h: Update the CSS parsing.
(WebCore):
(StyleRareNonInheritedData):

Source/WebKit/chromium:

Update the code to use the new name annotatedRegions to work for
both features.

* public/WebDraggableRegion.h: Rename dashboardRegions to annotatedRegions.
(WebDraggableRegion):
* src/ChromeClientImpl.cpp: Rename dashboardRegions to annotatedRegions.
(WebKit::ChromeClientImpl::annotatedRegionsChanged):
* src/ChromeClientImpl.h: Rename dashboardRegions to annotatedRegions.
(ChromeClientImpl):
* src/WebDocument.cpp: Rename dashboardRegions to annotatedRegions.
(WebKit::WebDocument::draggableRegions):

Source/WebKit/mac:

The CSS property to support draggable regions, guarded under
WIDGET_REGION is now disabled from Mac WebKit, in order not to cause
confusion with DASHBOARD_SUPPORT feature.

Also update the code to use the new name annotatedRegions to work for
both features.

* Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.
* WebCoreSupport/WebChromeClient.h: Rename dashboardRegions to annotatedRegions.
* WebCoreSupport/WebChromeClient.mm: Rename dashboardRegions to annotatedRegions.
(WebChromeClient::annotatedRegionsChanged):
* WebView/WebView.mm: Rename dashboardRegions to annotatedRegions.
(-[WebView _dashboardRegions]):

Source/WebKit2:

The CSS property to support draggable regions, guarded under
WIDGET_REGION is now disabled from Mac WebKit, in order not to cause
confusion with DASHBOARD_SUPPORT feature.

Also update the code to use the new name annotatedRegions to work for
both features.

* Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.
* WebProcess/WebCoreSupport/WebChromeClient.cpp: Rename dashboardRegions to annotatedRegions.
(WebKit::WebChromeClient::annotatedRegionsChanged):
* WebProcess/WebCoreSupport/WebChromeClient.h: Rename dashboardRegions to annotatedRegions.
(WebChromeClient):

LayoutTests:

Update the test and rename the files due to CSS property name and
syntax changes.

* fast/css/draggable-region-parser-expected.txt: Added.
* fast/css/draggable-region-parser.html: Added.
* fast/css/widget-region-parser-expected.txt: Removed.
* fast/css/widget-region-parser.html: Removed.
* platform/efl/TestExpectations: Rename the skipped test.
* platform/gtk/TestExpectations: Rename the skipped test.
* platform/mac/TestExpectations: Skip the renamed test since WIDGET_REGION is off.
* platform/qt/TestExpectations: Rename the skipped test.
* platform/win/TestExpectations: Rename the skipped test.
* platform/wincairo/TestExpectations: Rename the skipped test.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130829 268f45cc-cd09-0410-ab3c-d52691b4dbfc
filesystem-url-in-iframe test is flaky
https://bugs.webkit.org/show_bug.cgi?id=95246

Reviewed by Eric Seidel.

This test was assuming that the navigation would complete before the
async JavaScript executed, which is true usually (but not always).

* http/tests/security/mixedContent/filesystem-url-in-iframe.html:
* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130830 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed Chromium Windows build fix after r130823.

* DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp:
(roleToString): Re-added the 'default' label as some cases are not handled.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130831 268f45cc-cd09-0410-ab3c-d52691b4dbfc