DFG should inline code blocks that use new_array_buffer
https://bugs.webkit.org/show_bug.cgi?id=98996

Reviewed by Geoffrey Garen.

This adds plumbing to drop in constant buffers from the inlinees to the inliner.
It's smart about not duplicating buffers needlessly but doesn't try to completely
hash-cons them, either.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::numberOfConstantBuffers):
(JSC::CodeBlock::addConstantBuffer):
(JSC::CodeBlock::constantBufferAsVector):
(JSC::CodeBlock::constantBuffer):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(ConstantBufferKey):
(JSC::DFG::ConstantBufferKey::ConstantBufferKey):
(JSC::DFG::ConstantBufferKey::operator==):
(JSC::DFG::ConstantBufferKey::hash):
(JSC::DFG::ConstantBufferKey::isHashTableDeletedValue):
(JSC::DFG::ConstantBufferKey::codeBlock):
(JSC::DFG::ConstantBufferKey::index):
(DFG):
(JSC::DFG::ConstantBufferKeyHash::hash):
(JSC::DFG::ConstantBufferKeyHash::equal):
(ConstantBufferKeyHash):
(WTF):
(ByteCodeParser):
(InlineStackEntry):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGCapabilities.h:
(JSC::DFG::canInlineOpcode):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131087 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removed ASSERT_CLASS_FITS_IN_CELL
https://bugs.webkit.org/show_bug.cgi?id=97634

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

Our collector now supports arbitrarily sized objects, so the ASSERT is not needed.

* API/JSCallbackFunction.cpp:
* API/JSCallbackObject.cpp:
* heap/MarkedSpace.h:
* jsc.cpp:
* runtime/Arguments.cpp:
* runtime/ArrayConstructor.cpp:
* runtime/ArrayPrototype.cpp:
* runtime/BooleanConstructor.cpp:
* runtime/BooleanObject.cpp:
* runtime/BooleanPrototype.cpp:
* runtime/DateConstructor.cpp:
* runtime/DatePrototype.cpp:
* runtime/Error.cpp:
* runtime/ErrorConstructor.cpp:
* runtime/ErrorPrototype.cpp:
* runtime/FunctionConstructor.cpp:
* runtime/FunctionPrototype.cpp:
* runtime/InternalFunction.cpp:
* runtime/JSActivation.cpp:
* runtime/JSArray.cpp:
* runtime/JSBoundFunction.cpp:
* runtime/JSFunction.cpp:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalThis.cpp:
* runtime/JSNameScope.cpp:
* runtime/JSNotAnObject.cpp:
* runtime/JSONObject.cpp:
* runtime/JSObject.cpp:
* runtime/JSPropertyNameIterator.cpp:
* runtime/JSScope.cpp:
* runtime/JSWithScope.cpp:
* runtime/JSWrapperObject.cpp:
* runtime/MathObject.cpp:
* runtime/NameConstructor.cpp:
* runtime/NamePrototype.cpp:
* runtime/NativeErrorConstructor.cpp:
* runtime/NativeErrorPrototype.cpp:
* runtime/NumberConstructor.cpp:
* runtime/NumberObject.cpp:
* runtime/NumberPrototype.cpp:
* runtime/ObjectConstructor.cpp:
* runtime/ObjectPrototype.cpp:
* runtime/RegExpConstructor.cpp:
* runtime/RegExpMatchesArray.cpp:
* runtime/RegExpObject.cpp:
* runtime/RegExpPrototype.cpp:
* runtime/StringConstructor.cpp:
* runtime/StringObject.cpp:
* runtime/StringPrototype.cpp:
* testRegExp.cpp: Removed the ASSERT.

Source/WebCore: 

* bindings/js/JSDOMWindowShell.cpp:
(WebCore):
* bindings/js/JSImageConstructor.cpp:
(WebCore):
* bindings/js/JSNodeFilterCondition.cpp:
(WebCore):
* bindings/js/JSWorkerContextBase.cpp:
(WebCore):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSFloat64Array.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore):
* bridge/runtime_method.cpp:
(JSC):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131088 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Enable RUNTIME_HEURISTICS all the time, for easier testing
https://bugs.webkit.org/show_bug.cgi?id=99090

Reviewed by Filip Pizlo.

I find myself using this a lot, and there doesn't seem to be an obvious
reason to compile it out, since it only runs once at startup.

* runtime/Options.cpp:
(JSC::overrideOptionWithHeuristic):
(JSC::Options::initialize):
* runtime/Options.h: Removed the #ifdef.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] WTR needs an implementation of setAsynchronousSpellCheckingEnabled
https://bugs.webkit.org/show_bug.cgi?id=81042

Unreviewed, skipped a test that requires setAsynchronousSpellCheckingEnabled

* platform/wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@131090 268f45cc-cd09-0410-ab3c-d52691b4dbfc