Remove Qt sandbox process code
https://bugs.webkit.org/show_bug.cgi?id=122920

Reviewed by Geoffrey Garen.

This code was only used by the Qt port, and the other Linux-based ports are using the seccomp based sandbox.

* Shared/linux/SandboxProcess/SandboxEnvironmentLinux.cpp: Removed.
* Shared/linux/SandboxProcess/SandboxEnvironmentLinux.h: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157538 268f45cc-cd09-0410-ab3c-d52691b4dbfc
llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
https://bugs.webkit.org/show_bug.cgi?id=122667

Reviewed by Geoffrey Garen.

The issue this patch is attempting to fix is that there are places in our codebase
where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
operations that can initiate a garbage collection. Garbage collection then calls 
some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
always necessarily run during garbage collection). This causes a deadlock.
 
To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores 
into a thread-local field that indicates that it is unsafe to perform any operation 
that could trigger garbage collection on the current thread. In debug builds, 
ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly 
detect deadlocks.
 
This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
which uses the DeferGC mechanism to prevent collections from occurring while the 
lock is held.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/DeferGC.h:
(JSC::DisallowGC::DisallowGC):
(JSC::DisallowGC::~DisallowGC):
(JSC::DisallowGC::isGCDisallowedOnCurrentThread):
(JSC::DisallowGC::initialize):
* jit/Repatch.cpp:
(JSC::repatchPutByID):
(JSC::buildPutByIdList):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/ConcurrentJITLock.h:
(JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
(JSC::ConcurrentJITLockerBase::unlockEarly):
(JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
(JSC::GCSafeConcurrentJITLocker::~GCSafeConcurrentJITLocker):
(JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer):
(JSC::ConcurrentJITLocker::ConcurrentJITLocker):
* runtime/InitializeThreading.cpp:
(JSC::initializeThreadingOnce):
* runtime/JSCellInlines.h:
(JSC::allocateCell):
* runtime/JSSymbolTableObject.h:
(JSC::symbolTablePut):
* runtime/Structure.cpp: materializePropertyMapIfNecessary* now has a problem in that it
can start a garbage collection when the GCSafeConcurrentJITLocker goes out of scope, but 
before the caller has a chance to use the newly created PropertyTable. The garbage collection
clears the PropertyTable, and then the caller uses it assuming it's valid. To avoid this,
we must DeferGC until the caller is done getting the newly materialized PropertyTable from 
the Structure.
(JSC::Structure::materializePropertyMap):
(JSC::Structure::despecifyDictionaryFunction):
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::isSealed):
(JSC::Structure::isFrozen):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::removePropertyWithoutTransition):
(JSC::Structure::get):
(JSC::Structure::despecifyFunction):
(JSC::Structure::despecifyAllFunctions):
(JSC::Structure::putSpecificValue):
(JSC::Structure::createPropertyMap):
(JSC::Structure::getPropertyNamesFromStructure):
* runtime/Structure.h:
(JSC::Structure::materializePropertyMapIfNecessary):
(JSC::Structure::materializePropertyMapIfNecessaryForPinning):
* runtime/StructureInlines.h:
(JSC::Structure::get):
* runtime/SymbolTable.h:
(JSC::SymbolTable::find):
(JSC::SymbolTable::end):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157539 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Publish SunSpider 1.0.2
https://bugs.webkit.org/show_bug.cgi?id=122923

Reviewed by Darin Adler.

* perf/sunspider/sunspider.html:
* perf/sunspider/versions.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157540 268f45cc-cd09-0410-ab3c-d52691b4dbfc
r157411 fails run-javascriptcore-tests when run with Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=122902

Reviewed by Mark Hahnenberg.
        
It turns out that this was a long-standing bug in the DFG PutById repatching logic. It's
not legal to patch if the typeInfo tells you that you can't patch. The old JIT's patching
logic did this right, and the DFG's GetById patching logic did it right; but DFG PutById
didn't. Turns out that there's even a helpful method,
Structure::propertyAccessesAreCacheable(), that will even do all of the checks for you!

* jit/Repatch.cpp:
(JSC::tryCachePutByID):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix.

Forgot to svn add DeferGC.cpp

* heap/DeferGC.cpp: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157542 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a useLLInt option to jsc
https://bugs.webkit.org/show_bug.cgi?id=122930

Reviewed by Geoffrey Garen.

* runtime/Executable.cpp:
(JSC::setupLLInt):
(JSC::setupJIT):
(JSC::ScriptExecutable::prepareForExecutionImpl):
* runtime/Options.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157543 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix attempt on EFL port after r157520 and r157523

Source/WebKit2:

* Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
* Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.h:
Removed ArgumentCoder<TransformationMatrix> which caused redefinition build error
in EFL port.

Source/WTF:

* wtf/PassRef.h: includes <utility>

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157544 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore: Implement ES6 spread operator
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Implement the ES6 spread operator

This has a little bit of refactoring to move the enumeration logic out ForOfNode
and into BytecodeGenerator, and then adds the logic to make it nicely callback
driven.

The rest of the logic is just the addition of the SpreadExpressionNode, the parsing,
and actually handling the spread.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitNewArray):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitEnumeration):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrayNode::emitBytecode):
(JSC::ForOfNode::emitBytecode):
(JSC::SpreadExpressionNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::createSpreadExpression):
* parser/Lexer.cpp:
(JSC::::lex):
* parser/NodeConstructors.h:
(JSC::SpreadExpressionNode::SpreadExpressionNode):
* parser/Nodes.h:
(JSC::ExpressionNode::isSpreadExpression):
(JSC::SpreadExpressionNode::expression):
* parser/Parser.cpp:
(JSC::::parseArrayLiteral):
(JSC::::parseArguments):
(JSC::::parseMemberExpression):
* parser/Parser.h:
(JSC::Parser::getTokenName):
(JSC::Parser::updateErrorMessageSpecialCase):
* parser/ParserTokens.h:
* parser/SyntaxChecker.h:
(JSC::SyntaxChecker::createSpreadExpression):

LayoutTests: Implement spread
https://bugs.webkit.org/show_bug.cgi?id=122911

Reviewed by Michael Saboff.

Add testcases

* js/basic-spread-expected.txt: Added.
* js/basic-spread.html: Added.
* js/parser-syntax-check-expected.txt:
* js/script-tests/basic-spread.js: Added.
(f):
(o.f.o.f.o.f.o.f.h.eval.o.h.o.h.o.h.o.h.g):
* js/script-tests/parser-syntax-check.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157545 268f45cc-cd09-0410-ab3c-d52691b4dbfc
transition void cti_op_put_by_val* stubs to JIT operations
https://bugs.webkit.org/show_bug.cgi?id=122903

Reviewed by Geoffrey Garen.

Transitioned cti_op_put_by_val and cti_op_put_by_val_generic to operationPutByVal and
operationPutByValGeneric.

* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::privateCompilePutByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitSlow_op_put_by_val):
* jit/JITStubs.cpp:
* jit/JITStubs.h:
* jit/JSInterfaceJIT.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157546 268f45cc-cd09-0410-ab3c-d52691b4dbfc