Unreviewed, roll out http://trac.webkit.org/changeset/148999
It broke http://kripken.github.io/ammo.js/examples/new/ammo.html

Source/JavaScriptCore: 

* JavaScriptCore.order:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitNewArray):
(JSC::BytecodeGenerator::emitThrowReferenceError):
(JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::shouldEmitProfileHooks):
(BytecodeGenerator):
* bytecompiler/NodesCodegen.cpp:
(JSC):
(JSC::NullNode::emitBytecode):
(JSC::BooleanNode::emitBytecode):
(JSC::NumberNode::emitBytecode):
(JSC::StringNode::emitBytecode):
(JSC::IfNode::emitBytecode):
(JSC::IfElseNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::createIfStatement):
(ASTBuilder):
* parser/NodeConstructors.h:
(JSC):
(JSC::NullNode::NullNode):
(JSC::BooleanNode::BooleanNode):
(JSC::NumberNode::NumberNode):
(JSC::StringNode::StringNode):
(JSC::IfNode::IfNode):
(JSC::IfElseNode::IfElseNode):
* parser/Nodes.h:
(JSC::ExpressionNode::isPure):
(JSC::ExpressionNode::isSubtract):
(StatementNode):
(NullNode):
(JSC::NullNode::isNull):
(BooleanNode):
(JSC::BooleanNode::isPure):
(NumberNode):
(JSC::NumberNode::value):
(JSC::NumberNode::isPure):
(StringNode):
(JSC::StringNode::isPure):
(JSC::StringNode::isString):
(BinaryOpNode):
(IfNode):
(JSC):
(IfElseNode):
(ContinueNode):
(BreakNode):
* parser/Parser.cpp:
(JSC::::parseIfStatement):
* parser/ResultType.h:
(ResultType):
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::pureToBoolean):
* runtime/JSCell.h:
(JSCell):
* runtime/JSCellInlines.h:
(JSC):

Source/WTF: 

* wtf/TriState.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149158 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add support for Math.imul
https://bugs.webkit.org/show_bug.cgi?id=115143

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Add support for Math.imul, a thunk generator for Math.imul,
and an intrinsic.

Fairly self explanatory set of changes, DFG intrinsics simply
leverages the existing ValueToInt32 nodes.

* create_hash_table:
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsic):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithIMul):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* jit/ThunkGenerators.cpp:
(JSC::imulThunkGenerator):
(JSC):
* jit/ThunkGenerators.h:
(JSC):
* runtime/Intrinsic.h:
* runtime/MathObject.cpp:
(JSC):
(JSC::mathProtoFuncIMul):
* runtime/VM.cpp:
(JSC::thunkGeneratorForIntrinsic):

LayoutTests:

Add a bunch of tests for Math.imul

* fast/js/Object-getOwnPropertyNames-expected.txt:
* fast/js/imul-expected.txt: Added.
* fast/js/imul.html: Added.
* fast/js/regress/imul-double-only-expected.txt: Added.
* fast/js/regress/imul-double-only.html: Added.
* fast/js/regress/imul-int-only-expected.txt: Added.
* fast/js/regress/imul-int-only.html: Added.
* fast/js/regress/imul-mixed-expected.txt: Added.
* fast/js/regress/imul-mixed.html: Added.
* fast/js/regress/script-tests/imul-double-only.js: Added.
(f):
* fast/js/regress/script-tests/imul-int-only.js: Added.
(f):
* fast/js/regress/script-tests/imul-mixed.js: Added.
(f):
* fast/js/script-tests/Object-getOwnPropertyNames.js:
* fast/js/script-tests/imul.js: Added.
(testIMul):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149159 268f45cc-cd09-0410-ab3c-d52691b4dbfc