Get rid of DFG forward exiting
https://bugs.webkit.org/show_bug.cgi?id=125531

Reviewed by Oliver Hunt.
        
This finally gets rid of forward exiting. Forward exiting was always a fragile concept
since it involved the compiler trying to figure out how to "roll forward" the
execution from some DFG node to the next bytecode index. It was always easy to find
counterexamples where it broke, and it has always served as an obstacle to adding
compiler improvements - the latest being http://webkit.org/b/125523, which tried to
make DCE work for more things.
        
This change finishes the work of removing forward exiting. A lot of forward exiting
was already removed in some other bugs, but SetLocal still did forward exits. SetLocal
is in many ways the hardest to remove, since the forward exiting of SetLocal also
implied that any conversion nodes inserted before the SetLocal would then also be
marked as forward-exiting. Hence SetLocal's forward-exiting made a bunch of other
things also forward-exiting, and this was always a source of weirdo bugs.
        
SetLocal must be able to exit in case it performs a hoisted type speculation. Nodes
inserted just before SetLocal must also be able to exit - for example type check
hoisting may insert a CheckStructure, or fixup phase may insert something like
Int32ToDouble. But if any of those nodes tried to backward exit, then this could lead
to the reexecution of a side-effecting operation, for example:
        
    a: Call(...)
    b: SetLocal(@a, r1)
        
For a long time it seemed like SetLocal *had* to exit forward because of this. But
this change side-steps the problem by changing the ByteCodeParser to always emit a
kind of "two-phase commit" for stores to local variables. Now when the ByteCodeParser
wishes to store to a local, it first emits a MovHint and then enqueues a SetLocal.
The SetLocal isn't actually emitted until the beginning of the next bytecode
instruction (which the exception of op_enter and op_ret, which emit theirs immediately
since it's always safe to reexecute those bytecode instructions and since deferring
SetLocals would be weird there - op_enter has many SetLocals and op_ret is a set
followed by a jump in case of inlining, so we'd have to emit the SetLocal "after" the
jump and that would be awkward). This means that the above IR snippet would look
something like:
        
    a: Call(..., bc#42)
    b: MovHint(@a, r1, bc#42)
    c: SetLocal(@a, r1, bc#47)
        
Where the SetLocal exits "backwards" but appears at the beginning of the next bytecode
instruction. This means that by the time we get to that SetLocal, the OSR exit
analysis already knows that r1 is associated with @a, and it means that the SetLocal
or anything hoisted above it can exit backwards as normal.
        
This change also means that the "forward rewiring" can be killed. Previously, we might
have inserted a conversion node on SetLocal and then the SetLocal died (i.e. turned
into a MovHint) and the conversion node either died completely or had its lifetime
truncated to be less than the actual value's bytecode lifetime. This no longer happens
since conversion nodes are only inserted at SetLocals.
        
More precisely, this change introduces two laws that we were basically already
following anyway:
        
1) A MovHint's child should never be changed except if all other uses of that child
   are also replaced. Specifically, this prohibits insertion of conversion nodes at
   MovHints.
        
2) Anytime any child is replaced with something else, and all other uses aren't also
   replaced, we must insert a Phantom use of the original child.

This is a slight compile-time regression but has no effect on code-gen. It unlocks a
bunch of optimization opportunities so I think it's worth it.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpAssumingJITType):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::instructionCount):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGArrayifySlowPathGenerator.h:
(JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::setDirect):
(JSC::DFG::ByteCodeParser::DelayedSetLocal::DelayedSetLocal):
(JSC::DFG::ByteCodeParser::DelayedSetLocal::execute):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::eliminate):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCommon.h:
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::run):
(JSC::DFG::DCEPhase::fixupBlock):
(JSC::DFG::DCEPhase::cleanVariables):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixEdge):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
* dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::run):
(JSC::DFG::LICMPhase::attemptHoist):
* dfg/DFGMinifiedNode.cpp:
(JSC::DFG::MinifiedNode::fromNode):
* dfg/DFGMinifiedNode.h:
(JSC::DFG::belongsInMinifiedGraph):
(JSC::DFG::MinifiedNode::constantNumber):
(JSC::DFG::MinifiedNode::weakConstant):
* dfg/DFGNode.cpp:
(JSC::DFG::Node::hasVariableAccessData):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPhantom):
(JSC::DFG::Node::convertToPhantomUnchecked):
(JSC::DFG::Node::convertToIdentity):
(JSC::DFG::Node::containsMovHint):
(JSC::DFG::Node::hasUnlinkedLocal):
(JSC::DFG::Node::willHaveCodeGenOrOSR):
* dfg/DFGNodeFlags.cpp:
(JSC::DFG::dumpNodeFlags):
* dfg/DFGNodeFlags.h:
* dfg/DFGNodeType.h:
* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::OSRAvailabilityAnalysisPhase::run):
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGOSRExit.cpp:
* dfg/DFGOSRExit.h:
* dfg/DFGOSRExitBase.cpp:
* dfg/DFGOSRExitBase.h:
(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
(JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculationCheck):
(JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
(JSC::DFG::SpeculativeJIT::typeCheck):
(JSC::DFG::SpeculativeJIT::compileMovHint):
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
(JSC::DFG::SpeculativeJIT::needsTypeCheck):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::run):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validateCPS):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::VariableAccessData):
* dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStream::reconstruct):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileGetArgument):
(JSC::FTL::LowerDFGToLLVM::compileSetLocal):
(JSC::FTL::LowerDFGToLLVM::compileMovHint):
(JSC::FTL::LowerDFGToLLVM::compileZombieHint):
(JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::typeCheck):
(JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
(JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
* ftl/FTLOSRExit.cpp:
* ftl/FTLOSRExit.h:
* tests/stress/dead-int32-to-double.js: Added.
(foo):
* tests/stress/dead-uint32-to-number.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161126 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Remove Node::attached()
https://bugs.webkit.org/show_bug.cgi?id=126276

Reviewed by Sam Weinig.

Node::attached() is poorly defined. Replace it with renderer() and inRenderedDocument() tests as appropriate.
        
Also remove some unnecessary explicit attachRenderTree/detachRenderTree calls from the tree builders.

LayoutTests: Remove Node::attached()
https://bugs.webkit.org/show_bug.cgi?id=126276
        
Reviewed by Sam Weinig.

* platform/mac/fast/table/dynamic-caption-add-before-child-expected.png:
* platform/mac/fast/table/dynamic-caption-add-before-child-expected.txt:
        
    This test result change is a progression. Dynamic captions are now correctly in document order.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161127 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build.

* xml/parser/XMLDocumentParser.cpp:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161128 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert the results change. It depended on xml parser changes which were not landed.

* platform/mac/fast/table/dynamic-caption-add-before-child-expected.png:
* platform/mac/fast/table/dynamic-caption-add-before-child-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161129 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Interrupted test runs should not count at build.webkit.org/dashboard
https://bugs.webkit.org/show_bug.cgi?id=126279

Reviewed by Timothy Hatcher.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotIteration.js:
(BuildbotIteration.prototype.get productive):
(BuildbotIteration.prototype.get previousProductiveIteration): Replaced previous with
this accessor to skips iterations that don't have relevant data. We still want to
display them, but revision ranges should not be affected.
(BuildbotIteration.prototype.update): Record whether the iteration was up for retry.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueueView.js:
Use latest productive iteration instead of latest iteration for pending revision
count and popovers.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161130 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pending revision popover is slightly misplaced at build.webkit.org/dashboard
https://bugs.webkit.org/show_bug.cgi?id=126278

Reviewed by Timothy Hatcher.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueueView.js:
(BuildbotQueueView.prototype._appendPendingRevisionCount): Create a span for the text,
as StatusLineView message element has extra padding, and doesn't fit the text snugly.
(BuildbotQueueView.prototype._revisionPopoverContentForIteration): Added bug number to a FIXME.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/StatusLineView.js:
(StatusLineView.prototype.set messageElement): Removed the getter, as we no longer need it.

* BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Styles/StatusLineView.css:
Removed display:inline-block hack for messageElement div, as we no longer use it for measuring text bounds.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161131 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove some accidental commented out code.

* testing/Internals.cpp:
(WebCore::Internals::mallocStatistics):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161132 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build error on 64bit debug build.
https://bugs.webkit.org/show_bug.cgi?id=126248

r161076 used ‘%lli’(for long long int) for int64_t(aka long int).
However, in a 64bit compile, int64_t is 'long int', not a 'long long int'.
To support 32bit and 64bit, we use static_cast<long long>.

* Modules/indexeddb/IDBTransactionBackend.cpp:
(WebCore::IDBTransactionBackend::commit):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161133 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Remove ewk_view_tiled
https://bugs.webkit.org/show_bug.cgi?id=125961

Reviewed by Gyuyoung Kim.

Source/WebKit:

* PlatformEfl.cmake: Removed ewk_view_tiled related files.

Source/WebKit/efl:

We didn't use ewk_view_tiled very long time while we focused webkit2/efl.
There are many bugs and we don't have plan to fix them.
Instead, We will use WebCore's TiledBackingStore and it looks more stable.

* WebCoreSupport/FrameLoaderClientEfl.cpp:
(WebCore::FrameLoaderClientEfl::transitionToCommittedForNewPage):
* ewk/ewk_tiled_backing_store.cpp: Removed.
* ewk/ewk_tiled_backing_store_private.h: Removed.
* ewk/ewk_tiled_matrix.cpp: Removed.
* ewk/ewk_tiled_matrix_private.h: Removed.
* ewk/ewk_tiled_model.cpp: Removed.
* ewk/ewk_tiled_model_private.h: Removed.
* ewk/ewk_view.cpp:
* ewk/ewk_view.h:
* ewk/ewk_view_private.h:
* ewk/ewk_view_tiled.cpp: Removed.
* tests/UnitTestUtils/EWKTestView.cpp:
(EWKUnitTests::EWKTestView::init):

Tools:

* DumpRenderTree/efl/DumpRenderTreeChrome.cpp:
(shouldUseTiledBackingStore):
Moved from DumpRenderTreeChrome to enable WebCore's TiledBackingStore
instead of switching ewk_view_tiled.
(DumpRenderTreeChrome::createView):
* DumpRenderTree/efl/DumpRenderTreeView.cpp:
(drtViewAdd):
* EWebLauncher/main.c: Removed ewk_view_tiled option.
(windowCreate):
(parseUserArguments):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161134 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] Disable geolocation API test
https://bugs.webkit.org/show_bug.cgi?id=125851

Reviewed by Gyuyoung Kim.

Geolocation is turned off by default in EFL port, so it shouldn't be tested.

* TestWebKitAPI/PlatformEfl.cmake: Move Geolocation to test_webkit2_api_fail_BINARIES.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unused functions in GraphicsContext3D.cpp
https://bugs.webkit.org/show_bug.cgi?id=126265

Reviewed by Andreas Kling.

platformGraphicsContext3D, platformTexture and platformLayer in GC3D.cpp
seem not used by any ports.

No new tests, no functionality changed.

* platform/graphics/GraphicsContext3D.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161136 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reverted r156742. The same fix was reverted from Blink due to heap-use-after-free on ClusterFuzz.
https://bugs.webkit.org/show_bug.cgi?id=126275

https://codereview.chromium.org/102993011

Reviewed by Darin Adler.

Source/WebCore:

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateFirstLetter):

LayoutTests:

* fast/css/first-letter-block-change.html: Removed.
* platform/gtk-wk1/fast/css/first-letter-block-change-expected.png: Removed.
* platform/gtk-wk2/fast/css/first-letter-block-change-expected.png: Removed.
* platform/gtk/fast/css/first-letter-block-change-expected.txt: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161137 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Split WebKit2APITests/TestWebKitWebView
https://bugs.webkit.org/show_bug.cgi?id=126284

Reviewed by Philippe Normand.

Source/WebKit2:

WebKitWebView test is too big already making more difficult to
handle timeouts and skipped tests. Split it in 3 by moving
UIClient and auth tests to their own files.

* UIProcess/API/gtk/tests/GNUmakefile.am:
* UIProcess/API/gtk/tests/TestAuthentication.cpp: Added.
(testWebViewAuthenticationRequest):
(testWebViewAuthenticationCancel):
(testWebViewAuthenticationLoadCancelled):
(testWebViewAuthenticationFailure):
(testWebViewAuthenticationNoCredential):
(testWebViewAuthenticationStorage):
(testWebViewAuthenticationSuccess):
(serverCallback):
(beforeAll):
(afterAll):
* UIProcess/API/gtk/tests/TestUIClient.cpp: Added.
(testWebViewCreateReadyClose):
(checkMimeTypeForFilter):
(testWebViewAllowModalDialogs):
(testWebViewDisallowModalDialogs):
(testWebViewJavaScriptDialogs):
(testWebViewWindowProperties):
(testWebViewMouseTarget):
(testWebViewPermissionRequests):
(testWebViewFileChooserRequest):
(beforeAll):
(afterAll):
* UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
(beforeAll):
(afterAll):

Tools:

Skip only WebKitWebView/mouse-target and all TestAuthentication
tests that are timing out when running under xvfb.

* Scripts/run-gtk-tests:
(TestRunner):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161138 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] Replace ecore_main_loop_iterate with waitUntilTrue in ewk tests
https://bugs.webkit.org/show_bug.cgi?id=125919

Reviewed by Gyuyoung Kim.

Using ecore_main_loop_iterate in while loop may result in tests hang-up when
condition is not met. Replacing it with waitUntilTrue introduces a timer
after which internal loop is canceled. This will cause test to fail instead
of running infinitely.

* UIProcess/API/efl/tests/test_ewk2_auth_request.cpp:
(TEST_F):
* UIProcess/API/efl/tests/test_ewk2_color_picker.cpp:
(TEST_F):
* UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp:
(TEST_F):
* UIProcess/API/efl/tests/test_ewk2_view.cpp:
(EWK2ViewTest::onVibrate):
(EWK2ViewTest::onCancelVibration):
(EWK2ViewTest::loadVibrationHTMLString):
(TEST_F):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161139 268f45cc-cd09-0410-ab3c-d52691b4dbfc
XML document builder should create render tree asynchronously
https://bugs.webkit.org/show_bug.cgi?id=126285

Source/WebCore: 

Reviewed by Andreas Kling.
        
Stop creating renderers explicitly. 
Fix SVG <use> element to not rely on parse time render tree construction.

* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::svgAttributeChanged):
        
    Remove renderer check, we may not have created the render tree yet.

(WebCore::SVGUseElement::willAttachRenderers):
        
    Switch to willAttachRenderers from willRecalcStyle. The latter is only called as long as style
    recalc doesn't start creating new renderers.

(WebCore::SVGUseElement::invalidateShadowTree):
        
    Remove renderer check, we may not have created the render tree yet. 
    Invalidate with ReconstructRenderTree so willAttachRenderers will always get called.

* svg/SVGUseElement.h:
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::exitText):
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::startElementNs):
(WebCore::XMLDocumentParser::cdataBlock):
        
    Remove explicit call to attachRenderTree. The render tree will be created lazily.

LayoutTests: 

Reviewed by Andreas Kling.

* platform/mac/fast/table/dynamic-caption-add-before-child-expected.png:
* platform/mac/fast/table/dynamic-caption-add-before-child-expected.txt:
        
    This is progression. Captions are now correctly in document order.

* svg/custom/object-no-size-attributes-expected.txt:
        
    Unnecessary text renderer disappears.

* svg/custom/resource-invalidation-crash-expected.txt:
        
    Progression, the dump has the correct fill.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161140 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderLayer: Store corner and resizer renderers in RenderPtrs.
<https://webkit.org/b/126274>

Turn RenderLayer::m_scrollCorner and m_resizer into RenderPtrs.
Removed manual destroy() calls as appropriate. Also tweaked some
code to reduce nesting.

Reviewed by Anders Carlsson.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove attachChild
https://bugs.webkit.org/show_bug.cgi?id=126288

Reviewed by Andreas Kling.

* dom/ContainerNode.cpp:
(WebCore::destroyRenderTreeIfNeeded):
        
    Rename detachChild and move the tests here.

(WebCore::ContainerNode::takeAllChildrenFrom):
        
    No need to call attachRenderTree explicitly anymore.

(WebCore::ContainerNode::removeBetween):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161142 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Text::createTextRenderer() should return a RenderPtr.
<https://webkit.org/b/126292>

Make createTextRenderer() return a RenderPtr and remove one manual
destroy() call. Also, since it should always return a valid object,
I turned a null check into an assertion instead.

Reviewed by Antti Koivisto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@161143 268f45cc-cd09-0410-ab3c-d52691b4dbfc