FTL should be able to convey branch weights to LLVM
https://bugs.webkit.org/show_bug.cgi?id=129054

Reviewed by Michael Saboff.
        
This introduces a really nice way to convey branch weights to LLVM. The basic class
is Weight, which just wraps a float; NaN is used when you are not sure. You can
pass this alongside a LBasicBlock to branching instructions like condbr and switch.
But for simplicity, you can just pass a WeightedTarget, which is a tuple of the
two. And for even greater simplicity, you can create WeightedTargets from
LBasicBlocks by doing:
        
    usually(b)   => WeightedTarget(b, Weight(1))
    rarely(b)    => WeightedTarget(b, Weight(0))
    unsure(b)    => WeightedTarget(b, Weight()) or WeightedTarget(b, Weight(NaN))
        
This allows for constructs like:
        
    m_out.branch(isCell(value), usually(isCellCase), rarely(slowCase));
        
This was intended to be perf-neutral for now, but it did end up creating a ~1%
speed-up on V8v7 and Octane2.

* JavaScriptCore.xcodeproj/project.pbxproj:
* ftl/FTLAbbreviations.h:
(JSC::FTL::mdNode):
* ftl/FTLCommonValues.cpp:
(JSC::FTL::CommonValues::CommonValues):
* ftl/FTLCommonValues.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::lower):
(JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
(JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
(JSC::FTL::LowerDFGToLLVM::compileToThis):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithDiv):
(JSC::FTL::LowerDFGToLLVM::compileArithMod):
(JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
(JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
(JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
(JSC::FTL::LowerDFGToLLVM::compileGetById):
(JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileArrayPush):
(JSC::FTL::LowerDFGToLLVM::compileArrayPop):
(JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
(JSC::FTL::LowerDFGToLLVM::compileToString):
(JSC::FTL::LowerDFGToLLVM::compileToPrimitive):
(JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
(JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
(JSC::FTL::LowerDFGToLLVM::compileBranch):
(JSC::FTL::LowerDFGToLLVM::compileSwitch):
(JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
(JSC::FTL::LowerDFGToLLVM::nonSpeculativeCompare):
(JSC::FTL::LowerDFGToLLVM::allocateCell):
(JSC::FTL::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
(JSC::FTL::LowerDFGToLLVM::boolify):
(JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
(JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
(JSC::FTL::LowerDFGToLLVM::buildSwitch):
(JSC::FTL::LowerDFGToLLVM::doubleToInt32):
(JSC::FTL::LowerDFGToLLVM::sensibleDoubleToInt32):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
(JSC::FTL::LowerDFGToLLVM::speculateStringOrStringObject):
(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
(JSC::FTL::LowerDFGToLLVM::callCheck):
(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
* ftl/FTLOutput.cpp:
(JSC::FTL::Output::initialize):
(JSC::FTL::Output::appendTo):
(JSC::FTL::Output::newBlock):
(JSC::FTL::Output::sensibleDoubleToInt):
(JSC::FTL::Output::load):
(JSC::FTL::Output::store):
(JSC::FTL::Output::baseIndex):
(JSC::FTL::Output::branch):
(JSC::FTL::Output::crashNonTerminal):
* ftl/FTLOutput.h:
(JSC::FTL::Output::branch):
(JSC::FTL::Output::switchInstruction):
* ftl/FTLSwitchCase.h:
(JSC::FTL::SwitchCase::SwitchCase):
(JSC::FTL::SwitchCase::weight):
* ftl/FTLWeight.h: Added.
(JSC::FTL::Weight::Weight):
(JSC::FTL::Weight::isSet):
(JSC::FTL::Weight::operator!):
(JSC::FTL::Weight::value):
(JSC::FTL::Weight::scaleToTotal):
* ftl/FTLWeightedTarget.h: Added.
(JSC::FTL::WeightedTarget::WeightedTarget):
(JSC::FTL::WeightedTarget::target):
(JSC::FTL::WeightedTarget::weight):
(JSC::FTL::usually):
(JSC::FTL::rarely):
(JSC::FTL::unsure):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix after r164374

* llint/LLIntOfflineAsmConfig.h: Added #define OFFLINE_ASM_X86_WIN 0
for ENABLE(LLINT_C_LOOP).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164390 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add WTF_MAKE_FAST_ALLOCATED to more classes
https://bugs.webkit.org/show_bug.cgi?id=129064

Reviewed by Andreas Kling.

Source/JavaScriptCore:

* dfg/DFGSpeculativeJIT.h:
* heap/CopyWorkList.h:
* heap/Region.h:
* runtime/Arguments.h:
* runtime/SymbolTable.h:
* runtime/WriteBarrier.h:

Source/WebCore:

* dom/EventContext.h:
* platform/graphics/Region.h:
* platform/text/BidiResolver.h:
* rendering/LayoutState.h:

Source/WTF:

* wtf/Bitmap.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164391 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix comment.

* ftl/FTLWeight.h:
(JSC::FTL::Weight::scaleToTotal):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164392 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL should allow LLVM to allocate data sections with alignment > 8
https://bugs.webkit.org/show_bug.cgi?id=129066

Reviewed by Geoffrey Garen.
        
We were previously using the native allocator's alignment guarantees (which we presumed
to be 8 bytes), and further hinting our desires by using the LSectionWord type (which
was 8 bytes). This breaks now that LLVM will sometimes ask for 16 byte alignment on
some sections.
        
This changes our data section allocation strategy to use the new FTL::DataSection,
which can handle arbitrary 2^k alignment.

* JavaScriptCore.xcodeproj/project.pbxproj:
* ftl/FTLCompile.cpp:
(JSC::FTL::mmAllocateDataSection):
(JSC::FTL::dumpDataSection):
(JSC::FTL::compile):
* ftl/FTLDataSection.cpp: Added.
(JSC::FTL::DataSection::DataSection):
(JSC::FTL::DataSection::~DataSection):
* ftl/FTLDataSection.h: Added.
(JSC::FTL::DataSection::base):
(JSC::FTL::DataSection::size):
* ftl/FTLJITCode.cpp:
(JSC::FTL::JITCode::addDataSection):
* ftl/FTLJITCode.h:
(JSC::FTL::JITCode::dataSections):
* ftl/FTLState.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164393 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Another Windows update to quiet the bots.

* platform/win/TestExpectations: Add more flakes and pass lint-test-expectations.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164394 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Add performance test for stacked floats with shape-outsides
https://bugs.webkit.org/show_bug.cgi?id=128821

Reviewed by Brent Fulgham.

This tests generate stacked floats content with shape-outsides.
The test is skipped by default.

* Layout/Shapes/ShapeOutsideStackedPolygons.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164395 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[JS] Convert Promise.prototype.catch to be a built-in
https://bugs.webkit.org/show_bug.cgi?id=129052

Patch by Sam Weinig <sam@webkit.org> on 2014-02-19
Reviewed by Geoffrey Garen.

* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/Promise.prototype.js: Added.
(catch): Add JS based implementation of Promise.prototype.catch.

* runtime/JSPromisePrototype.cpp:
Remove the C++ implementation of Promise.prototype.catch.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164396 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Need to align sp before calling operationLoadVarargs on 32-bit platforms.
<https://webkit.org/b/129056>

Reviewed by Michael Saboff.

In JIT::compileLoadVarargs(), we'll call operationSizeFrameForVarargs()
to compute the amount of stack space we need for the varargs, adjust the
stack pointer to make room for those varargs, and then call
operationLoadVarargs() to fill in the varargs. Currently, the stack
pointer adjustment takes care of allocating space for the varargs, but
does not align the stack pointer for the call to operationLoadVarargs().
The fix is to align the stack pointer there.

Note: The stack pointer adjustment is based on the new CallFrame pointer
value returned by operationSizeFrameForVarargs(). On 64-bit platforms,
both the stack pointer and call frame pointer are similarly aligned
(i.e. low nibbles are 0). Hence, no additional adjustment is needed.
Only the 32-bit code needs the fix.

Note: The LLINT also works this way i.e. aligns the stack pointer before
calling llint_slow_path_call_varargs().

* jit/JITCall32_64.cpp:
(JSC::JIT::compileLoadVarargs):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164397 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add WK2 SPI to get bytecode profile from web process
https://bugs.webkit.org/show_bug.cgi?id=129069

Reviewed by Anders Carlsson.

Simple patch to allow asynchronous fetching of the
bytecode profiler output from the WebProcess.

* UIProcess/API/C/WKPage.cpp:
(WKPageGetBytecodeProfile):
* UIProcess/API/C/WKPagePrivate.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::getBytecodeProfile):
* UIProcess/WebPageProxy.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::getBytecodeProfile):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164398 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix after r164391

* runtime/Arguments.h: Make SlowArgumentData public so template libraries can
access its methods.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164399 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash after -[JSContext evaluateScript:] when initializing JSContext with JSVirtualMachine
https://bugs.webkit.org/show_bug.cgi?id=129070

Reviewed by Mark Hahnenberg.

Clear our exception explicitly before throwing away the VM because our
exception references VM memory.

* API/JSContext.mm:
(-[JSContext dealloc]):
* API/tests/testapi.mm:
(testObjectiveCAPI):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164400 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Changing selection shouldn't synchronously update editor UI components
https://bugs.webkit.org/show_bug.cgi?id=129024

Reviewed by Brent Fulgham.

Source/WebCore: 

Make updates to spellchecker, alternative text controller (correction pane), and delete button controller
asynchronous for programmatically triggered selection changes.

We continue to update their states synchronously immediately after we have applied, unapplied, or reapplied
editing commands to keep states in spell checker and alternative text controller consistent. We should be
able to make them asynchronous as well in the future but that should be done in a separate patch.

* WebCore.exp.in:
* editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::respondToChangedSelection): This function used to enumerate all document
makers and call respondToMarkerAtEndOfWord on each one of them only to exit early when SetSelectionOptions
had DictationTriggered. This condition is now checked in Editor::respondToChangedSelection to avoid all the
unnecessary work and remove the dependency on SetSelectionOptions.
(WebCore::AlternativeTextController::respondToMarkerAtEndOfWord): Ditto.
* editing/AlternativeTextController.h:

* editing/Editor.cpp:
(WebCore::Editor::appliedEditing): Calls updateEditorUINowIfScheduled before calling respondToAppliedEditing
on the alternative text controller.
(WebCore::Editor::unappliedEditing): Ditto.
(WebCore::Editor::reappliedEditing): Ditto.
(WebCore::Editor::Editor): Initializes newly added booleans.
(WebCore::Editor::respondToChangedSelection): Continue to call respondToChangedSelection (for API consistency)
and setStartNewKillRingSequence but defer the "editor UI updates" to spellchecker, alternative text controller
and delete button controller by firing a newly added one shot timer.
(WebCore::Editor::updateEditorUINowIfScheduled): Synchronously update the pending editor UI updates.
(WebCore::Editor::editorUIUpdateTimerFired): Extracted from respondToChangedSelection.
* editing/Editor.h:

* testing/Internals.cpp:
(WebCore::Internals::markerCountForNode): Calls updateEditorUINowIfScheduled() to update document markers.
(WebCore::Internals::markerAt): Ditto.
(WebCore::Internals::updateEditorUINowIfScheduled): Added.
(WebCore::Internals::findEditingDeleteButton): Added. Updates delete button controller synchronously.
(WebCore::Internals::hasSpellingMarker): Calls updateEditorUINowIfScheduled() to update document markers.
(WebCore::Internals::hasAutocorrectedMarker): Ditto.
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit: 

Added symbols for internals.

* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:

LayoutTests: 

Many tests now calls internals.updateEditorUINowIfScheduled() to update the spellchecker states, and uses
setTimeout() to make things testable in the browser.

* editing/spelling/script-tests/spelling-backspace-between-lines.js:
(testTwoLinesMisspellings): Uses updateEditorUINowIfScheduled and setTimeout to make spellchecker recognize
two selection changes. This is okay since the user never moves selection multiple times in a single task.
* editing/spelling/spellcheck-attribute.html: Ditto.

* platform/mac/editing/deleting/deletionUI-click-on-delete-button.html: Use intenals.findEditingDeleteButton
which updates delete button controller states synchronously instead of getElementById which doesn't do that.
* platform/mac/editing/deleting/id-in-deletebutton-expected.txt:
* platform/mac/editing/deleting/id-in-deletebutton.html: Ditto. Also did some cleanups.
* platform/mac/editing/deleting/resources/deletionUI-helpers.js:
(deletionUIDeleteButtonForElement): Ditto.

* platform/mac/editing/spelling/editing-word-with-marker-1.html: Again, we must notify the spellchecker
synchronously here because we're expecting spellchecker to use the old selection set by setSelectionRange
in Editor::editorUIUpdateTimerFired triggered by the pasting command. This is, again, not a problem in
practice since user never pastes content synchronously after changing selection like this in a single task.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164401 268f45cc-cd09-0410-ab3c-d52691b4dbfc