FTL should be able to convey branch weights to LLVM
https://bugs.webkit.org/show_bug.cgi?id=129054

Reviewed by Michael Saboff.
        
This introduces a really nice way to convey branch weights to LLVM. The basic class
is Weight, which just wraps a float; NaN is used when you are not sure. You can
pass this alongside a LBasicBlock to branching instructions like condbr and switch.
But for simplicity, you can just pass a WeightedTarget, which is a tuple of the
two. And for even greater simplicity, you can create WeightedTargets from
LBasicBlocks by doing:
        
    usually(b)   => WeightedTarget(b, Weight(1))
    rarely(b)    => WeightedTarget(b, Weight(0))
    unsure(b)    => WeightedTarget(b, Weight()) or WeightedTarget(b, Weight(NaN))
        
This allows for constructs like:
        
    m_out.branch(isCell(value), usually(isCellCase), rarely(slowCase));
        
This was intended to be perf-neutral for now, but it did end up creating a ~1%
speed-up on V8v7 and Octane2.

* JavaScriptCore.xcodeproj/project.pbxproj:
* ftl/FTLAbbreviations.h:
(JSC::FTL::mdNode):
* ftl/FTLCommonValues.cpp:
(JSC::FTL::CommonValues::CommonValues):
* ftl/FTLCommonValues.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::lower):
(JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
(JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
(JSC::FTL::LowerDFGToLLVM::compileToThis):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithDiv):
(JSC::FTL::LowerDFGToLLVM::compileArithMod):
(JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
(JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
(JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
(JSC::FTL::LowerDFGToLLVM::compileGetById):
(JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileArrayPush):
(JSC::FTL::LowerDFGToLLVM::compileArrayPop):
(JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
(JSC::FTL::LowerDFGToLLVM::compileToString):
(JSC::FTL::LowerDFGToLLVM::compileToPrimitive):
(JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
(JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
(JSC::FTL::LowerDFGToLLVM::compileBranch):
(JSC::FTL::LowerDFGToLLVM::compileSwitch):
(JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
(JSC::FTL::LowerDFGToLLVM::nonSpeculativeCompare):
(JSC::FTL::LowerDFGToLLVM::allocateCell):
(JSC::FTL::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
(JSC::FTL::LowerDFGToLLVM::boolify):
(JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
(JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
(JSC::FTL::LowerDFGToLLVM::buildSwitch):
(JSC::FTL::LowerDFGToLLVM::doubleToInt32):
(JSC::FTL::LowerDFGToLLVM::sensibleDoubleToInt32):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
(JSC::FTL::LowerDFGToLLVM::speculateStringOrStringObject):
(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
(JSC::FTL::LowerDFGToLLVM::callCheck):
(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
* ftl/FTLOutput.cpp:
(JSC::FTL::Output::initialize):
(JSC::FTL::Output::appendTo):
(JSC::FTL::Output::newBlock):
(JSC::FTL::Output::sensibleDoubleToInt):
(JSC::FTL::Output::load):
(JSC::FTL::Output::store):
(JSC::FTL::Output::baseIndex):
(JSC::FTL::Output::branch):
(JSC::FTL::Output::crashNonTerminal):
* ftl/FTLOutput.h:
(JSC::FTL::Output::branch):
(JSC::FTL::Output::switchInstruction):
* ftl/FTLSwitchCase.h:
(JSC::FTL::SwitchCase::SwitchCase):
(JSC::FTL::SwitchCase::weight):
* ftl/FTLWeight.h: Added.
(JSC::FTL::Weight::Weight):
(JSC::FTL::Weight::isSet):
(JSC::FTL::Weight::operator!):
(JSC::FTL::Weight::value):
(JSC::FTL::Weight::scaleToTotal):
* ftl/FTLWeightedTarget.h: Added.
(JSC::FTL::WeightedTarget::WeightedTarget):
(JSC::FTL::WeightedTarget::target):
(JSC::FTL::WeightedTarget::weight):
(JSC::FTL::usually):
(JSC::FTL::rarely):
(JSC::FTL::unsure):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164389 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix after r164374

* llint/LLIntOfflineAsmConfig.h: Added #define OFFLINE_ASM_X86_WIN 0
for ENABLE(LLINT_C_LOOP).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164390 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add WTF_MAKE_FAST_ALLOCATED to more classes
https://bugs.webkit.org/show_bug.cgi?id=129064

Reviewed by Andreas Kling.

Source/JavaScriptCore:

* dfg/DFGSpeculativeJIT.h:
* heap/CopyWorkList.h:
* heap/Region.h:
* runtime/Arguments.h:
* runtime/SymbolTable.h:
* runtime/WriteBarrier.h:

Source/WebCore:

* dom/EventContext.h:
* platform/graphics/Region.h:
* platform/text/BidiResolver.h:
* rendering/LayoutState.h:

Source/WTF:

* wtf/Bitmap.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164391 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, fix comment.

* ftl/FTLWeight.h:
(JSC::FTL::Weight::scaleToTotal):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164392 268f45cc-cd09-0410-ab3c-d52691b4dbfc
FTL should allow LLVM to allocate data sections with alignment > 8
https://bugs.webkit.org/show_bug.cgi?id=129066

Reviewed by Geoffrey Garen.
        
We were previously using the native allocator's alignment guarantees (which we presumed
to be 8 bytes), and further hinting our desires by using the LSectionWord type (which
was 8 bytes). This breaks now that LLVM will sometimes ask for 16 byte alignment on
some sections.
        
This changes our data section allocation strategy to use the new FTL::DataSection,
which can handle arbitrary 2^k alignment.

* JavaScriptCore.xcodeproj/project.pbxproj:
* ftl/FTLCompile.cpp:
(JSC::FTL::mmAllocateDataSection):
(JSC::FTL::dumpDataSection):
(JSC::FTL::compile):
* ftl/FTLDataSection.cpp: Added.
(JSC::FTL::DataSection::DataSection):
(JSC::FTL::DataSection::~DataSection):
* ftl/FTLDataSection.h: Added.
(JSC::FTL::DataSection::base):
(JSC::FTL::DataSection::size):
* ftl/FTLJITCode.cpp:
(JSC::FTL::JITCode::addDataSection):
* ftl/FTLJITCode.h:
(JSC::FTL::JITCode::dataSections):
* ftl/FTLState.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164393 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Another Windows update to quiet the bots.

* platform/win/TestExpectations: Add more flakes and pass lint-test-expectations.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164394 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Add performance test for stacked floats with shape-outsides
https://bugs.webkit.org/show_bug.cgi?id=128821

Reviewed by Brent Fulgham.

This tests generate stacked floats content with shape-outsides.
The test is skipped by default.

* Layout/Shapes/ShapeOutsideStackedPolygons.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164395 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[JS] Convert Promise.prototype.catch to be a built-in
https://bugs.webkit.org/show_bug.cgi?id=129052

Patch by Sam Weinig <sam@webkit.org> on 2014-02-19
Reviewed by Geoffrey Garen.

* GNUmakefile.list.am:
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/Promise.prototype.js: Added.
(catch): Add JS based implementation of Promise.prototype.catch.

* runtime/JSPromisePrototype.cpp:
Remove the C++ implementation of Promise.prototype.catch.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164396 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Need to align sp before calling operationLoadVarargs on 32-bit platforms.
<https://webkit.org/b/129056>

Reviewed by Michael Saboff.

In JIT::compileLoadVarargs(), we'll call operationSizeFrameForVarargs()
to compute the amount of stack space we need for the varargs, adjust the
stack pointer to make room for those varargs, and then call
operationLoadVarargs() to fill in the varargs. Currently, the stack
pointer adjustment takes care of allocating space for the varargs, but
does not align the stack pointer for the call to operationLoadVarargs().
The fix is to align the stack pointer there.

Note: The stack pointer adjustment is based on the new CallFrame pointer
value returned by operationSizeFrameForVarargs(). On 64-bit platforms,
both the stack pointer and call frame pointer are similarly aligned
(i.e. low nibbles are 0). Hence, no additional adjustment is needed.
Only the 32-bit code needs the fix.

Note: The LLINT also works this way i.e. aligns the stack pointer before
calling llint_slow_path_call_varargs().

* jit/JITCall32_64.cpp:
(JSC::JIT::compileLoadVarargs):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164397 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add WK2 SPI to get bytecode profile from web process
https://bugs.webkit.org/show_bug.cgi?id=129069

Reviewed by Anders Carlsson.

Simple patch to allow asynchronous fetching of the
bytecode profiler output from the WebProcess.

* UIProcess/API/C/WKPage.cpp:
(WKPageGetBytecodeProfile):
* UIProcess/API/C/WKPagePrivate.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::getBytecodeProfile):
* UIProcess/WebPageProxy.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::getBytecodeProfile):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164398 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed build fix after r164391

* runtime/Arguments.h: Make SlowArgumentData public so template libraries can
access its methods.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164399 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash after -[JSContext evaluateScript:] when initializing JSContext with JSVirtualMachine
https://bugs.webkit.org/show_bug.cgi?id=129070

Reviewed by Mark Hahnenberg.

Clear our exception explicitly before throwing away the VM because our
exception references VM memory.

* API/JSContext.mm:
(-[JSContext dealloc]):
* API/tests/testapi.mm:
(testObjectiveCAPI):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164400 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Changing selection shouldn't synchronously update editor UI components
https://bugs.webkit.org/show_bug.cgi?id=129024

Reviewed by Brent Fulgham.

Source/WebCore: 

Make updates to spellchecker, alternative text controller (correction pane), and delete button controller
asynchronous for programmatically triggered selection changes.

We continue to update their states synchronously immediately after we have applied, unapplied, or reapplied
editing commands to keep states in spell checker and alternative text controller consistent. We should be
able to make them asynchronous as well in the future but that should be done in a separate patch.

* WebCore.exp.in:
* editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::respondToChangedSelection): This function used to enumerate all document
makers and call respondToMarkerAtEndOfWord on each one of them only to exit early when SetSelectionOptions
had DictationTriggered. This condition is now checked in Editor::respondToChangedSelection to avoid all the
unnecessary work and remove the dependency on SetSelectionOptions.
(WebCore::AlternativeTextController::respondToMarkerAtEndOfWord): Ditto.
* editing/AlternativeTextController.h:

* editing/Editor.cpp:
(WebCore::Editor::appliedEditing): Calls updateEditorUINowIfScheduled before calling respondToAppliedEditing
on the alternative text controller.
(WebCore::Editor::unappliedEditing): Ditto.
(WebCore::Editor::reappliedEditing): Ditto.
(WebCore::Editor::Editor): Initializes newly added booleans.
(WebCore::Editor::respondToChangedSelection): Continue to call respondToChangedSelection (for API consistency)
and setStartNewKillRingSequence but defer the "editor UI updates" to spellchecker, alternative text controller
and delete button controller by firing a newly added one shot timer.
(WebCore::Editor::updateEditorUINowIfScheduled): Synchronously update the pending editor UI updates.
(WebCore::Editor::editorUIUpdateTimerFired): Extracted from respondToChangedSelection.
* editing/Editor.h:

* testing/Internals.cpp:
(WebCore::Internals::markerCountForNode): Calls updateEditorUINowIfScheduled() to update document markers.
(WebCore::Internals::markerAt): Ditto.
(WebCore::Internals::updateEditorUINowIfScheduled): Added.
(WebCore::Internals::findEditingDeleteButton): Added. Updates delete button controller synchronously.
(WebCore::Internals::hasSpellingMarker): Calls updateEditorUINowIfScheduled() to update document markers.
(WebCore::Internals::hasAutocorrectedMarker): Ditto.
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit: 

Added symbols for internals.

* WebKit.vcxproj/WebKitExportGenerator/WebKitExports.def.in:

LayoutTests: 

Many tests now calls internals.updateEditorUINowIfScheduled() to update the spellchecker states, and uses
setTimeout() to make things testable in the browser.

* editing/spelling/script-tests/spelling-backspace-between-lines.js:
(testTwoLinesMisspellings): Uses updateEditorUINowIfScheduled and setTimeout to make spellchecker recognize
two selection changes. This is okay since the user never moves selection multiple times in a single task.
* editing/spelling/spellcheck-attribute.html: Ditto.

* platform/mac/editing/deleting/deletionUI-click-on-delete-button.html: Use intenals.findEditingDeleteButton
which updates delete button controller states synchronously instead of getElementById which doesn't do that.
* platform/mac/editing/deleting/id-in-deletebutton-expected.txt:
* platform/mac/editing/deleting/id-in-deletebutton.html: Ditto. Also did some cleanups.
* platform/mac/editing/deleting/resources/deletionUI-helpers.js:
(deletionUIDeleteButtonForElement): Ditto.

* platform/mac/editing/spelling/editing-word-with-marker-1.html: Again, we must notify the spellchecker
synchronously here because we're expecting spellchecker to use the old selection set by setSelectionRange
in Editor::editorUIUpdateTimerFired triggered by the pasting command. This is, again, not a problem in
practice since user never pastes content synchronously after changing selection like this in a single task.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164401 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove -[WKContentView setViewportSize:]
https://bugs.webkit.org/show_bug.cgi?id=129071

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-02-19
Reviewed by Enrica Casucci.

I forgot to clean that up.

* UIProcess/API/ios/WKContentView.h:
* UIProcess/API/ios/WKContentView.mm:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164402 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fieldset:disabled > legend:first-child legend input should not be disabled
https://bugs.webkit.org/show_bug.cgi?id=129068

Reviewed by Andreas Kling.

Source/WebCore: 

An input element inside a disabled fieldset element is ordinarily disabled unless it's inside
a legend element that is the first of its kind to appear in the fieldset's child node list.

Prior to this patch, an input element inside such a legend element was erroneously disabled if
we had another legend element between the two as in <fieldset disabled><legend><legend><input>.

Fixed the bug by correcting the algorithm in updateAncestorDisabledState.

Test: fast/forms/fieldset/fieldset-disabled-2.html

* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::updateAncestorDisabledState):

LayoutTests: 

Added a new regression test.

* fast/forms/fieldset/fieldset-disabled-2-expected.txt: Added.
* fast/forms/fieldset/fieldset-disabled-2.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164403 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Debug build fix after r164401. Removed a bogus assertion in comparePositions.
When either position is anchored at a detached node, they don't have a tree scope in common.

* editing/htmlediting.cpp:
(WebCore::comparePositions):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164404 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[UI-Side Compositing] 6% of main thread time spent copying LayerProperties when adding to hash table
https://bugs.webkit.org/show_bug.cgi?id=129074

Reviewed by Tim Horton.

Make RemoteLayerTreeTransaction::LayerProperties smaller and not copied by
value everywhere.

Put some big members into unique_ptrs, and store unique_ptrs
in the hash of layerID to properties.

Clean up member variable order of LayerProperties to improve packing.

Also have applyPropertiesToLayer() take references to things to avoid
copies.

* Shared/mac/RemoteLayerTreePropertyApplier.h:
* Shared/mac/RemoteLayerTreePropertyApplier.mm:
(WebKit::RemoteLayerTreePropertyApplier::applyPropertiesToLayer):
* Shared/mac/RemoteLayerTreeTransaction.h:
(WebKit::RemoteLayerTreeTransaction::changedLayers):
* Shared/mac/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::LayerProperties::LayerProperties):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::encode):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):
(WebKit::RemoteLayerTreeTransaction::encode):
(WebKit::RemoteLayerTreeTransaction::decode):
(WebKit::RemoteLayerTreeTransaction::layerPropertiesChanged):
(WebKit::dumpChangedLayers):
* UIProcess/mac/RemoteLayerTreeHost.h:
* UIProcess/mac/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::updateLayerTree):
(WebKit::RemoteLayerTreeHost::createLayer):
* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(PlatformCALayerRemote::create):
(PlatformCALayerRemote::PlatformCALayerRemote):
(PlatformCALayerRemote::clone):
(PlatformCALayerRemote::recursiveBuildTransaction):
(PlatformCALayerRemote::ensureBackingStore):
(PlatformCALayerRemote::setNeedsDisplay):
(PlatformCALayerRemote::transform):
(PlatformCALayerRemote::setTransform):
(PlatformCALayerRemote::sublayerTransform):
(PlatformCALayerRemote::setSublayerTransform):
(PlatformCALayerRemote::setFilters):
(PlatformCALayerRemote::enumerateRectsBeingDrawn):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164405 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Avoid sending redundant layer properties to the UI process, and avoid allocation of RemoteLayerBackingStore unless we need it
https://bugs.webkit.org/show_bug.cgi?id=129076

Reviewed by Tim Horton.

Normally we rely on GraphicsLayerCA to avoid redundant property
setting on PlatformCALayers, but for contents layers GraphicsLayerCA
sets properties on every update.

Make PlatformCALayerRemote more efficient in this case by not
setting dirty flags for unchanged property sets.

Also avoid creation of RemoteLayerBackingStore unless we
actually need one.

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
(PlatformCALayerRemote::ensureBackingStore):
(PlatformCALayerRemote::updateBackingStore):
(PlatformCALayerRemote::setBounds):
(PlatformCALayerRemote::setPosition):
(PlatformCALayerRemote::setAnchorPoint):
(PlatformCALayerRemote::setMasksToBounds):
(PlatformCALayerRemote::setAcceleratesDrawing):
(PlatformCALayerRemote::setBorderWidth):
(PlatformCALayerRemote::setBorderColor):
(PlatformCALayerRemote::setContentsScale):
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fieldset:disabled fieldset > legend:first-child input should be disabled
https://bugs.webkit.org/show_bug.cgi?id=129077

Reviewed by Antti Koivisto.

Source/WebCore: 

Similar to r164403. When a fieldset inside a disabled fieldset, input elements inside
the inner fieldset's first legend element child should be disabled.

Test: fast/forms/fieldset/fieldset-disabled-2.html

* html/HTMLFieldSetElement.cpp:
(WebCore::HTMLFieldSetElement::legend): Fixed the bug where it was returning the first
legend element descendent. It should be the first legend element _child_.
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::updateAncestorDisabledState): Fixed the algorithm
to look for any ancestor fieldset that has been disabled instead of the first fieldset
ancestor and checking its disabledness.

LayoutTests: 

Added a test case.o

* fast/forms/fieldset/fieldset-disabled-2-expected.txt:
* fast/forms/fieldset/fieldset-disabled-2.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164407 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in WTF::StringBuilder::append()

https://bugs.webkit.org/show_bug.cgi?id=125817
<rdar://problem/15671883>

Reviewed by Oliver Hunt.

* wtf/text/StringBuilder.cpp:
(WTF::expandedCapacity):
Ensure that we return a new capacity of at least 'requiredLength' in
the case where requiredLength is large. Also, use unsigned rather than
size_t for the parameters and the return value, as callers pass
unsigned arguments and treat the result as an unsigned int.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164408 268f45cc-cd09-0410-ab3c-d52691b4dbfc