The DFG special case checks for isCreatedThisArgument are fragile
https://bugs.webkit.org/show_bug.cgi?id=110535

Reviewed by Oliver Hunt.
        
There may be many situations in which we want to force a variable to never be
unboxed. Capturing is one such case, and the created this argument is another.
Previously all code that dealt with this issue had to query both scenarios.
        
Now DFG::VariableAccessData knows these things. You just have to ask
VariableAccessData for whether a variable should be unboxed. Anyone wishing to
force a variable to never be unboxed just tells VariableAccessData.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::initialize):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(DFG):
* dfg/DFGCFGSimplificationPhase.cpp:
(CFGSimplificationPhase):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.h:
(Graph):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGUnificationPhase.cpp:
(JSC::DFG::UnificationPhase::run):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsCaptured):
(JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
(VariableAccessData):
(JSC::DFG::VariableAccessData::shouldNeverUnbox):
(JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
(JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
(JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143955 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG::Edge should have more bits for UseKind, and DFG::Allocator should be simpler
https://bugs.webkit.org/show_bug.cgi?id=110722

Reviewed by Oliver Hunt.
        
This rolls out the DFG::Allocator part of http://trac.webkit.org/changeset/143654,
and changes Edge to have more room for UseKinds and possibly other things.
        
This is performance-neutral on both 32-bit and 64-bit. It reduces the size of
DFG::Node on 64-bit (by virtue of getting rid of the 16-byte alignment of Node)
and increases it slightly on 32-bit (by 4 bytes total - 16-byte alignment led to
80 bytes, but the base size of Node plus the 12 bytes of new m_encodedWords in
Edge gets 84 bytes). But, it will mean that we don't have to increase Node by
another 16 bytes if we ever want to add more UseKinds or other things to Edge.

* dfg/DFGAllocator.h:
(DFG):
(Allocator):
(JSC::DFG::Allocator::Region::headerSize):
(JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
(JSC::DFG::Allocator::Region::data):
(JSC::DFG::Allocator::Region::isInThisRegion):
(JSC::DFG::::Allocator):
(JSC::DFG::::~Allocator):
(JSC::DFG::::allocate):
(JSC::DFG::::free):
(JSC::DFG::::freeAll):
(JSC::DFG::::reset):
(JSC::DFG::::indexOf):
(JSC::DFG::::allocatorOf):
(JSC::DFG::::bumpAllocate):
(JSC::DFG::::freeListAllocate):
(JSC::DFG::::allocateSlow):
(JSC::DFG::::freeRegionsStartingAt):
(JSC::DFG::::startBumpingIn):
* dfg/DFGEdge.h:
(JSC::DFG::Edge::Edge):
(Edge):
(JSC::DFG::Edge::node):
(JSC::DFG::Edge::setNode):
(JSC::DFG::Edge::useKindUnchecked):
(JSC::DFG::Edge::setUseKind):
(JSC::DFG::Edge::operator==):
(JSC::DFG::Edge::operator!=):
(JSC::DFG::Edge::makeWord):
* dfg/DFGNodeAllocator.h:
(DFG):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143958 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        <rdar://problem/12976385> Remove rule to silence attempts to create the ~/Library/Caches/com.apple.WebKit2.WebProcessService directory

        Reviewed by Anders Carlsson.

        * WebProcess/com.apple.WebProcess.sb.in: Remove the obsolete rule. We no longer
        have a "WebProcessService".



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143959 268f45cc-cd09-0410-ab3c-d52691b4dbfc
6% regression in intl1 page cycler on chromium-mac
https://bugs.webkit.org/show_bug.cgi?id=110784

Reviewed by Eric Seidel.

This patch attempts to heal the regression by reverting all the changes
to the preload scanner up to (and including)
http://trac.webkit.org/changeset/143020/.

* html/parser/BackgroundHTMLParser.cpp:
(WebCore::BackgroundHTMLParser::resumeFrom):
(WebCore::BackgroundHTMLParser::pumpTokenizer):
(WebCore::BackgroundHTMLParser::sendTokensToMainThread):
* html/parser/CSSPreloadScanner.cpp:
(WebCore::CSSPreloadScanner::scan):
(WebCore::CSSPreloadScanner::emitRule):
* html/parser/CSSPreloadScanner.h:
(CSSPreloadScanner):
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::isStartTag):
(WebCore):
(WebCore::isStartOrEndTag):
(WebCore::TokenPreloadScanner::identifierFor):
(WebCore::TokenPreloadScanner::inititatorFor):
(WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
(WebCore::TokenPreloadScanner::StartTagScanner::createPreloadRequest):
(WebCore::TokenPreloadScanner::processPossibleTemplateTag):
(WebCore::TokenPreloadScanner::processPossibleStyleTag):
(WebCore::TokenPreloadScanner::processPossibleBaseTag):
(WebCore::TokenPreloadScanner::scan):
(WebCore::HTMLPreloadScanner::scan):
* html/parser/HTMLPreloadScanner.h:
(TokenPreloadScanner):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143960 268f45cc-cd09-0410-ab3c-d52691b4dbfc