Update JavaScriptCore to 7604.1.38.1.6

API/APICast.h

@@ -60,6 +60,11 @@ inline JSC::ExecState* toJS(JSGlobalContextRef c)
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
+inline JSC::JSGlobalObject* toJSGlobalObject(JSGlobalContextRef context)
+{
+    return toJS(context)->lexicalGlobalObject();
+}
+
 inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
     ASSERT_UNUSED(exec, exec);

API/APIUtils.h

@@ -26,6 +26,7 @@
 #ifndef APIUtils_h
 #define APIUtils_h
 
+#include "CatchScope.h"
 #include "Exception.h"
 #include "JSCJSValue.h"
 #include "JSGlobalObjectInspectorController.h"

API/JSAPIWrapperObject.mm

@@ -68,7 +68,7 @@ bool JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::
 
 namespace JSC {
     
-template <> const ClassInfo JSCallbackObject<JSAPIWrapperObject>::s_info = { "JSAPIWrapperObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
+template <> const ClassInfo JSCallbackObject<JSAPIWrapperObject>::s_info = { "JSAPIWrapperObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSCallbackObject) };
 
 template<> const bool JSCallbackObject<JSAPIWrapperObject>::needsDestruction = true;
 

API/JSBase.cpp

@@ -62,7 +62,8 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 
     // evaluate sets "this" to the global object if it is NULL
     JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
-    SourceCode source = makeSource(script->string(), sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+    auto sourceURLString = sourceURL ? sourceURL->string() : String();
+    SourceCode source = makeSource(script->string(), SourceOrigin { sourceURLString }, sourceURLString, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
 
     NakedPtr<Exception> evaluationException;
     JSValue returnValue = profiledEvaluate(globalObject->globalExec(), ProfilingReason::API, source, jsThisObject, evaluationException);
@@ -99,7 +100,8 @@ bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourc
 
     startingLineNumber = std::max(1, startingLineNumber);
 
-    SourceCode source = makeSource(script->string(), sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+    auto sourceURLString = sourceURL ? sourceURL->string() : String();
+    SourceCode source = makeSource(script->string(), SourceOrigin { sourceURLString }, sourceURLString, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
     
     JSValue syntaxException;
     bool isValidSyntax = checkSyntax(exec->vmEntryGlobalObject()->globalExec(), source, &syntaxException);
@@ -155,7 +157,7 @@ void JSSynchronousGarbageCollectForDebugging(JSContextRef ctx)
 
     ExecState* exec = toJS(ctx);
     JSLockHolder locker(exec);
-    exec->vm().heap.collectAllGarbage();
+    exec->vm().heap.collectNow(Sync, CollectionScope::Full);
 }
 
 void JSSynchronousEdenCollectForDebugging(JSContextRef ctx)

API/JSBase.h

@@ -138,7 +138,11 @@ JS_EXPORT void JSGarbageCollect(JSContextRef ctx);
 
 /* Enable the Objective-C API for platforms with a modern runtime. */
 #if !defined(JSC_OBJC_API_ENABLED)
-#define JSC_OBJC_API_ENABLED (defined(__clang__) && defined(__APPLE__) && ((defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && !defined(__i386__)) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)))
+#if (defined(__clang__) && defined(__APPLE__) && ((defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && !defined(__i386__)) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)))
+#define JSC_OBJC_API_ENABLED 1
+#else
+#define JSC_OBJC_API_ENABLED 0
+#endif
 #endif
 
 #endif /* JSBase_h */

API/JSCallbackConstructor.cpp

@@ -36,7 +36,7 @@
 
 namespace JSC {
 
-const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackConstructor) };
+const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSCallbackConstructor) };
 
 JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
     : JSDestructibleObject(globalObject->vm(), structure)
@@ -48,7 +48,7 @@ JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Struc
 void JSCallbackConstructor::finishCreation(JSGlobalObject* globalObject, JSClassRef jsClass)
 {
     Base::finishCreation(globalObject->vm());
-    ASSERT(inherits(info()));
+    ASSERT(inherits(*vm(), info()));
     if (m_class)
         JSClassRetain(jsClass);
 }

API/JSCallbackFunction.cpp

@@ -41,7 +41,7 @@ namespace JSC {
 
 STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSCallbackFunction);
 
-const ClassInfo JSCallbackFunction::s_info = { "CallbackFunction", &InternalFunction::s_info, 0, CREATE_METHOD_TABLE(JSCallbackFunction) };
+const ClassInfo JSCallbackFunction::s_info = { "CallbackFunction", &InternalFunction::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSCallbackFunction) };
 
 JSCallbackFunction::JSCallbackFunction(VM& vm, Structure* structure, JSObjectCallAsFunctionCallback callback)
     : InternalFunction(vm, structure)
@@ -52,7 +52,7 @@ JSCallbackFunction::JSCallbackFunction(VM& vm, Structure* structure, JSObjectCal
 void JSCallbackFunction::finishCreation(VM& vm, const String& name)
 {
     Base::finishCreation(vm, name);
-    ASSERT(inherits(info()));
+    ASSERT(inherits(vm, info()));
 }
 
 JSCallbackFunction* JSCallbackFunction::create(VM& vm, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const String& name)

API/JSCallbackObject.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006-2017 Apple Inc.  All rights reserved.
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -34,8 +34,8 @@
 namespace JSC {
 
 // Define the two types of JSCallbackObjects we support.
-template <> const ClassInfo JSCallbackObject<JSDestructibleObject>::s_info = { "CallbackObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
-template <> const ClassInfo JSCallbackObject<JSGlobalObject>::s_info = { "CallbackGlobalObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
+template <> const ClassInfo JSCallbackObject<JSDestructibleObject>::s_info = { "CallbackObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSCallbackObject) };
+template <> const ClassInfo JSCallbackObject<JSGlobalObject>::s_info = { "CallbackGlobalObject", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSCallbackObject) };
 
 template<> const bool JSCallbackObject<JSDestructibleObject>::needsDestruction = true;
 template<> const bool JSCallbackObject<JSGlobalObject>::needsDestruction = false;
@@ -45,7 +45,6 @@ JSCallbackObject<JSGlobalObject>* JSCallbackObject<JSGlobalObject>::create(VM& v
 {
     JSCallbackObject<JSGlobalObject>* callbackObject = new (NotNull, allocateCell<JSCallbackObject<JSGlobalObject>>(vm.heap)) JSCallbackObject(vm, classRef, structure);
     callbackObject->finishCreation(vm);
-    vm.heap.addFinalizer(callbackObject, destroy);
     return callbackObject;
 }
 

API/JSCallbackObject.h

@@ -106,9 +106,9 @@ public:
         void visitChildren(SlotVisitor& visitor)
         {
             LockHolder locker(m_lock);
-            for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
-                if (ptr->value)
-                    visitor.append(ptr->value);
+            for (auto& pair : m_propertyMap) {
+                if (pair.value)
+                    visitor.append(pair.value);
             }
         }
 

API/JSCallbackObjectFunctions.h

@@ -44,15 +44,16 @@ namespace JSC {
 template <class Parent>
 inline JSCallbackObject<Parent>* JSCallbackObject<Parent>::asCallbackObject(JSValue value)
 {
-    ASSERT(asObject(value)->inherits(info()));
+    ASSERT(asObject(value)->inherits(*value.getObject()->vm(), info()));
     return jsCast<JSCallbackObject*>(asObject(value));
 }
 
 template <class Parent>
-inline JSCallbackObject<Parent>* JSCallbackObject<Parent>::asCallbackObject(EncodedJSValue value)
+inline JSCallbackObject<Parent>* JSCallbackObject<Parent>::asCallbackObject(EncodedJSValue encodedValue)
 {
-    ASSERT(asObject(JSValue::decode(value))->inherits(info()));
-    return jsCast<JSCallbackObject*>(asObject(JSValue::decode(value)));
+    JSValue value = JSValue::decode(encodedValue);
+    ASSERT(asObject(value)->inherits(*value.getObject()->vm(), info()));
+    return jsCast<JSCallbackObject*>(asObject(value));
 }
 
 template <class Parent>
@@ -90,8 +91,9 @@ JSCallbackObject<Parent>::~JSCallbackObject()
 template <class Parent>
 void JSCallbackObject<Parent>::finishCreation(ExecState* exec)
 {
-    Base::finishCreation(exec->vm());
-    ASSERT(Parent::inherits(info()));
+    VM& vm = exec->vm();
+    Base::finishCreation(vm);
+    ASSERT(Parent::inherits(vm, info()));
     init(exec);
 }
 
@@ -99,7 +101,7 @@ void JSCallbackObject<Parent>::finishCreation(ExecState* exec)
 template <class Parent>
 void JSCallbackObject<Parent>::finishCreation(VM& vm)
 {
-    ASSERT(Parent::inherits(info()));
+    ASSERT(Parent::inherits(vm, info()));
     ASSERT(Parent::isGlobalObject());
     Base::finishCreation(vm);
     init(jsCast<JSGlobalObject*>(this)->globalExec());

API/JSContext.mm

@@ -43,17 +43,22 @@
 @implementation JSContext {
     JSVirtualMachine *m_virtualMachine;
     JSGlobalContextRef m_context;
-    JSWrapperMap *m_wrapperMap;
     JSC::Strong<JSC::JSObject> m_exception;
 }
 
-@synthesize exceptionHandler;
-
 - (JSGlobalContextRef)JSGlobalContextRef
 {
     return m_context;
 }
 
+- (void)ensureWrapperMap
+{
+    if (!toJS([self JSGlobalContextRef])->lexicalGlobalObject()->wrapperMap()) {
+        // The map will be retained by the GlobalObject in initialization.
+        [[[JSWrapperMap alloc] initWithGlobalContextRef:[self JSGlobalContextRef]] release];
+    }
+}
+
 - (instancetype)init
 {
     return [self initWithVirtualMachine:[[[JSVirtualMachine alloc] init] autorelease]];
@@ -67,12 +72,12 @@
 
     m_virtualMachine = [virtualMachine retain];
     m_context = JSGlobalContextCreateInGroup(getGroupFromVirtualMachine(virtualMachine), 0);
-    m_wrapperMap = [[JSWrapperMap alloc] initWithContext:self];
 
     self.exceptionHandler = ^(JSContext *context, JSValue *exceptionValue) {
         context.exception = exceptionValue;
     };
 
+    [self ensureWrapperMap];
     [m_virtualMachine addContext:self forGlobalContextRef:m_context];
 
     return self;
@@ -81,10 +86,9 @@
 - (void)dealloc
 {
     m_exception.clear();
-    [m_wrapperMap release];
     JSGlobalContextRelease(m_context);
     [m_virtualMachine release];
-    [self.exceptionHandler release];
+    [_exceptionHandler release];
     [super dealloc];
 }
 
@@ -127,7 +131,7 @@
 
 - (JSWrapperMap *)wrapperMap
 {
-    return m_wrapperMap;
+    return toJS(m_context)->lexicalGlobalObject()->wrapperMap();
 }
 
 - (JSValue *)globalObject
@@ -260,7 +264,7 @@
     m_virtualMachine = [[JSVirtualMachine virtualMachineWithContextGroupRef:toRef(&globalObject->vm())] retain];
     ASSERT(m_virtualMachine);
     m_context = JSGlobalContextRetain(context);
-    m_wrapperMap = [[JSWrapperMap alloc] initWithContext:self];
+    [self ensureWrapperMap];
 
     self.exceptionHandler = ^(JSContext *context, JSValue *exceptionValue) {
         context.exception = exceptionValue;
@@ -311,13 +315,13 @@
 - (JSValue *)wrapperForObjCObject:(id)object
 {
     JSC::JSLockHolder locker(toJS(m_context));
-    return [m_wrapperMap jsWrapperForObject:object];
+    return [[self wrapperMap] jsWrapperForObject:object inContext:self];
 }
 
 - (JSValue *)wrapperForJSObject:(JSValueRef)value
 {
     JSC::JSLockHolder locker(toJS(m_context));
-    return [m_wrapperMap objcWrapperForJSValueRef:value];
+    return [[self wrapperMap] objcWrapperForJSValueRef:value inContext:self];
 }
 
 + (JSContext *)contextWithJSGlobalContextRef:(JSGlobalContextRef)globalContext

API/JSContextInternal.h

@@ -59,7 +59,7 @@ private:
 
 @interface JSContext(Internal)
 
-- (id)initWithGlobalContextRef:(JSGlobalContextRef)context;
+- (instancetype)initWithGlobalContextRef:(JSGlobalContextRef)context;
 
 - (void)notifyException:(JSValueRef)exception;
 - (JSValue *)valueFromNotifyException:(JSValueRef)exception;

API/JSContextRef.cpp

@@ -133,12 +133,12 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 {
     initializeThreading();
 
-    RefPtr<VM> vm = group ? PassRefPtr<VM>(toJS(group)) : VM::createContextGroup();
+    Ref<VM> vm = group ? Ref<VM>(*toJS(group)) : VM::createContextGroup();
 
-    JSLockHolder locker(vm.get());
+    JSLockHolder locker(vm.ptr());
 
     if (!globalObjectClass) {
-        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+        JSGlobalObject* globalObject = JSGlobalObject::create(vm.get(), JSGlobalObject::createStructure(vm.get(), jsNull()));
 #if ENABLE(REMOTE_INSPECTOR)
         if (JSRemoteInspectorGetInspectionEnabledByDefault())
             globalObject->setRemoteDebuggingEnabled(true);
@@ -146,12 +146,12 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
         return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
     }
 
-    JSGlobalObject* globalObject = JSCallbackObject<JSGlobalObject>::create(*vm, globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*vm, 0, jsNull()));
+    JSGlobalObject* globalObject = JSCallbackObject<JSGlobalObject>::create(vm.get(), globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(vm.get(), 0, jsNull()));
     ExecState* exec = globalObject->globalExec();
     JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
-    globalObject->resetPrototype(*vm, prototype);
+    globalObject->resetPrototype(vm.get(), prototype);
 #if ENABLE(REMOTE_INSPECTOR)
     if (JSRemoteInspectorGetInspectionEnabledByDefault())
         globalObject->setRemoteDebuggingEnabled(true);
@@ -260,9 +260,11 @@ public:
         if (m_remainingCapacityForFrameCapture) {
             // If callee is unknown, but we've not added any frame yet, we should
             // still add the frame, because something called us, and gave us arguments.
-            JSCell* callee = visitor->callee();
+            if (visitor->callee().isCell()) {
+                JSCell* callee = visitor->callee().asCell();
                 if (!callee && visitor->index())
                     return StackVisitor::Done;
+            }
 
             StringBuilder& builder = m_builder;
             if (!builder.isEmpty())
@@ -281,7 +283,7 @@ public:
                 builder.appendNumber(lineNumber);
             }
 
-            if (!callee)
+            if (!visitor->callee().rawPtr())
                 return StackVisitor::Done;
 
             m_remainingCapacityForFrameCapture--;

API/JSHeapFinalizerPrivate.cpp

@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHeapFinalizerPrivate.h"
+
+#include "APICast.h"
+#include "JSCInlines.h"
+
+using namespace JSC;
+
+void JSContextGroupAddHeapFinalizer(JSContextGroupRef group, JSHeapFinalizer finalizer, void *userData)
+{
+    VM* vm = toJS(group);
+    JSLockHolder locker(vm);
+    vm->heap.addHeapFinalizerCallback(HeapFinalizerCallback(finalizer, userData));
+}
+
+void JSContextGroupRemoveHeapFinalizer(JSContextGroupRef group, JSHeapFinalizer finalizer, void *userData)
+{
+    VM* vm = toJS(group);
+    JSLockHolder locker(vm);
+    vm->heap.removeHeapFinalizerCallback(HeapFinalizerCallback(finalizer, userData));
+}

API/JSHeapFinalizerPrivate.h

@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHeapFinalizerPrivate_h
+#define JSHeapFinalizerPrivate_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*JSHeapFinalizer)(JSContextGroupRef, void *userData);
+
+JS_EXPORT void JSContextGroupAddHeapFinalizer(JSContextGroupRef, JSHeapFinalizer, void *userData);
+JS_EXPORT void JSContextGroupRemoveHeapFinalizer(JSContextGroupRef, JSHeapFinalizer, void *userData);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSHeapFinalizerPrivate_h
+

API/JSMarkingConstraintPrivate.cpp

@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSMarkingConstraintPrivate.h"
+
+#include "APICast.h"
+#include "JSCInlines.h"
+#include "MarkingConstraint.h"
+#include "VisitingTimeout.h"
+
+using namespace JSC;
+
+namespace {
+
+Atomic<unsigned> constraintCounter;
+
+struct Marker : JSMarker {
+    SlotVisitor* visitor;
+};
+
+bool isMarked(JSMarkerRef, JSObjectRef objectRef)
+{
+    if (!objectRef)
+        return true; // Null is an immortal object.
+    
+    return Heap::isMarked(toJS(objectRef));
+}
+
+void mark(JSMarkerRef markerRef, JSObjectRef objectRef)
+{
+    if (!objectRef)
+        return;
+    
+    static_cast<Marker*>(markerRef)->visitor->appendHiddenUnbarriered(toJS(objectRef));
+}
+
+} // anonymous namespace
+
+void JSContextGroupAddMarkingConstraint(JSContextGroupRef group, JSMarkingConstraint constraintCallback, void *userData)
+{
+    VM& vm = *toJS(group);
+    JSLockHolder locker(vm);
+    
+    unsigned constraintIndex = constraintCounter.exchangeAdd(1);
+    
+    // This is a guess. The algorithm should be correct no matter what we pick. This means
+    // that we expect this constraint to mark things even during a stop-the-world full GC, but
+    // we don't expect it to be able to mark anything at the very start of a GC before anything
+    // else gets marked.
+    ConstraintVolatility volatility = ConstraintVolatility::GreyedByMarking;
+    
+    auto constraint = std::make_unique<MarkingConstraint>(
+        toCString("Amc", constraintIndex, "(", RawPointer(bitwise_cast<void*>(constraintCallback)), ")"),
+        toCString("API Marking Constraint #", constraintIndex, " (", RawPointer(bitwise_cast<void*>(constraintCallback)), ", ", RawPointer(userData), ")"),
+        [constraintCallback, userData]
+        (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            Marker marker;
+            marker.IsMarked = isMarked;
+            marker.Mark = mark;
+            marker.visitor = &slotVisitor;
+            
+            constraintCallback(&marker, userData);
+        },
+        volatility);
+    
+    vm.heap.addMarkingConstraint(WTFMove(constraint));
+}

API/JSMarkingConstraintPrivate.h

@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSMarkingConstraintPrivate_h
+#define JSMarkingConstraintPrivate_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct JSMarker;
+typedef struct JSMarker JSMarker;
+typedef JSMarker *JSMarkerRef;
+
+struct JSMarker {
+    bool (*IsMarked)(JSMarkerRef, JSObjectRef);
+    void (*Mark)(JSMarkerRef, JSObjectRef);
+};
+
+typedef void (*JSMarkingConstraint)(JSMarkerRef, void *userData);
+
+JS_EXPORT void JSContextGroupAddMarkingConstraint(JSContextGroupRef, JSMarkingConstraint, void *userData);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSMarkingConstraintPrivate_h
+

API/JSObjectRef.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Kelvin W Sherlock (ksherlock@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -52,6 +52,7 @@
 #include "ObjectConstructor.h"
 #include "ObjectPrototype.h"
 #include "PropertyNameArray.h"
+#include "ProxyObject.h"
 #include "RegExpConstructor.h"
 
 #if ENABLE(REMOTE_INSPECTOR)
@@ -146,7 +147,8 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
         args.append(jsString(exec, parameterNames[i]->string()));
     args.append(jsString(exec, body->string()));
 
-    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+    auto sourceURLString = sourceURL ? sourceURL->string() : String();
+    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, SourceOrigin { sourceURLString }, sourceURLString, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
     if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
         result = 0;
     return toRef(result);
@@ -256,13 +258,14 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
         return;
     }
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
 
-    if (JSProxy* proxy = jsDynamicCast<JSProxy*>(jsObject)) {
-        if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(proxy->target())) {
+    if (JSProxy* proxy = jsDynamicCast<JSProxy*>(vm, jsObject)) {
+        if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(vm, proxy->target())) {
             globalObject->resetPrototype(exec->vm(), jsValue.isObject() ? jsValue : jsNull());
             return;
         }
@@ -384,24 +387,25 @@ bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef pr
 // during destruction.
 static const ClassInfo* classInfoPrivate(JSObject* jsObject)
 {
-    VM* vm = jsObject->vm();
+    VM& vm = *jsObject->vm();
     
-    if (vm->currentlyDestructingCallbackObject != jsObject)
-        return jsObject->classInfo();
+    if (vm.currentlyDestructingCallbackObject != jsObject)
+        return jsObject->classInfo(vm);
 
-    return vm->currentlyDestructingCallbackObjectClassInfo;
+    return vm.currentlyDestructingCallbackObjectClassInfo;
 }
 
 void* JSObjectGetPrivate(JSObjectRef object)
 {
     JSObject* jsObject = uncheckedToJS(object);
+    VM& vm = *jsObject->vm();
 
     const ClassInfo* classInfo = classInfoPrivate(jsObject);
     
     // Get wrapped object if proxied
     if (classInfo->isSubClassOf(JSProxy::info())) {
         jsObject = static_cast<JSProxy*>(jsObject)->target();
-        classInfo = jsObject->classInfo();
+        classInfo = jsObject->classInfo(vm);
     }
 
     if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info()))
@@ -419,13 +423,14 @@ void* JSObjectGetPrivate(JSObjectRef object)
 bool JSObjectSetPrivate(JSObjectRef object, void* data)
 {
     JSObject* jsObject = uncheckedToJS(object);
+    VM& vm = *jsObject->vm();
 
     const ClassInfo* classInfo = classInfoPrivate(jsObject);
     
     // Get wrapped object if proxied
     if (classInfo->isSubClassOf(JSProxy::info())) {
         jsObject = static_cast<JSProxy*>(jsObject)->target();
-        classInfo = jsObject->classInfo();
+        classInfo = jsObject->classInfo(vm);
     }
 
     if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info())) {
@@ -449,21 +454,23 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data)
 JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* jsObject = toJS(object);
     JSValue result;
     Identifier name(propertyName->identifier(&exec->vm()));
 
+
     // Get wrapped object if proxied
-    if (jsObject->inherits(JSProxy::info()))
+    if (jsObject->inherits(vm, JSProxy::info()))
         jsObject = jsCast<JSProxy*>(jsObject)->target();
 
-    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info()))
+    if (jsObject->inherits(vm, JSCallbackObject<JSGlobalObject>::info()))
         result = jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
-    else if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info()))
+    else if (jsObject->inherits(vm, JSCallbackObject<JSDestructibleObject>::info()))
         result = jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivateProperty(name);
 #if JSC_OBJC_API_ENABLED
-    else if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info()))
+    else if (jsObject->inherits(vm, JSCallbackObject<JSAPIWrapperObject>::info()))
         result = jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivateProperty(name);
 #endif
     return toRef(exec, result);
@@ -472,25 +479,26 @@ JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSSt
 bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* jsObject = toJS(object);
     JSValue jsValue = value ? toJS(exec, value) : JSValue();
     Identifier name(propertyName->identifier(&exec->vm()));
 
     // Get wrapped object if proxied
-    if (jsObject->inherits(JSProxy::info()))
+    if (jsObject->inherits(vm, JSProxy::info()))
         jsObject = jsCast<JSProxy*>(jsObject)->target();
 
-    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSGlobalObject>::info())) {
         jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
         return true;
     }
-    if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSDestructibleObject>::info())) {
         jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
         return true;
     }
 #if JSC_OBJC_API_ENABLED
-    if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSAPIWrapperObject>::info())) {
         jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
         return true;
     }
@@ -501,24 +509,25 @@ bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRe
 bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->vm()));
 
     // Get wrapped object if proxied
-    if (jsObject->inherits(JSProxy::info()))
+    if (jsObject->inherits(vm, JSProxy::info()))
         jsObject = jsCast<JSProxy*>(jsObject)->target();
 
-    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSGlobalObject>::info())) {
         jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
         return true;
     }
-    if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSDestructibleObject>::info())) {
         jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->deletePrivateProperty(name);
         return true;
     }
 #if JSC_OBJC_API_ENABLED
-    if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) {
+    if (jsObject->inherits(vm, JSCallbackObject<JSAPIWrapperObject>::info())) {
         jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->deletePrivateProperty(name);
         return true;
     }
@@ -667,3 +676,18 @@ void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStri
     JSLockHolder locker(propertyNames->vm());
     propertyNames->add(propertyName->identifier(propertyNames->vm()));
 }
+
+JSObjectRef JSObjectGetProxyTarget(JSObjectRef objectRef)
+{
+    JSObject* object = toJS(objectRef);
+    if (!object)
+        return nullptr;
+    VM& vm = *object->vm();
+    JSLockHolder locker(vm);
+    JSObject* result = nullptr;
+    if (JSProxy* proxy = jsDynamicCast<JSProxy*>(vm, object))
+        result = proxy->target();
+    else if (ProxyObject* proxy = jsDynamicCast<ProxyObject*>(vm, object))
+        result = proxy->target();
+    return toRef(result);
+}

API/JSObjectRefPrivate.h

@@ -67,6 +67,8 @@ JS_EXPORT JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef ob
  */
 JS_EXPORT bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
 
+JS_EXPORT JSObjectRef JSObjectGetProxyTarget(JSObjectRef);
+
 #ifdef __cplusplus
 }
 #endif

API/JSRemoteInspector.cpp

@@ -50,9 +50,9 @@ void JSRemoteInspectorStart(void)
 #endif
 }
 
-void JSRemoteInspectorSetParentProcessInformation(pid_t pid, const UInt8* auditData, size_t auditLength)
+void JSRemoteInspectorSetParentProcessInformation(pid_t pid, const uint8_t* auditData, size_t auditLength)
 {
-#if ENABLE(REMOTE_INSPECTOR)
+#if ENABLE(REMOTE_INSPECTOR) && PLATFORM(COCOA)
     RetainPtr<CFDataRef> auditDataRef = adoptCF(CFDataCreate(kCFAllocatorDefault, auditData, auditLength));
     RemoteInspector::singleton().setParentProcessInformation(pid, auditDataRef);
 #else

API/JSRemoteInspector.h

@@ -29,6 +29,8 @@
 #include <JavaScriptCore/JSBase.h>
 #include <JavaScriptCore/WebKitAvailability.h>
 
+#include <unistd.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif

API/JSScriptRef.cpp

@@ -41,9 +41,9 @@ using namespace JSC;
 
 struct OpaqueJSScript : public SourceProvider {
 public:
-    static WTF::RefPtr<OpaqueJSScript> create(VM* vm, const String& url, int startingLineNumber, const String& source)
+    static WTF::Ref<OpaqueJSScript> create(VM& vm, const SourceOrigin& sourceOrigin, const String& url, int startingLineNumber, const String& source)
     {
-        return WTF::adoptRef(*new OpaqueJSScript(vm, url, startingLineNumber, source));
+        return WTF::adoptRef(*new OpaqueJSScript(vm, sourceOrigin, url, startingLineNumber, source));
     }
 
     unsigned hash() const override
@@ -56,11 +56,11 @@ public:
         return m_source.get();
     }
 
-    VM* vm() const { return m_vm; }
+    VM& vm() const { return m_vm; }
 
 private:
-    OpaqueJSScript(VM* vm, const String& url, int startingLineNumber, const String& source)
-        : SourceProvider(url, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()), SourceProviderSourceType::Program)
+    OpaqueJSScript(VM& vm, const SourceOrigin& sourceOrigin, const String& url, int startingLineNumber, const String& source)
+        : SourceProvider(sourceOrigin, url, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()), SourceProviderSourceType::Program)
         , m_vm(vm)
         , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
     {
@@ -68,14 +68,14 @@ private:
 
     virtual ~OpaqueJSScript() { }
 
-    VM* m_vm;
+    VM& m_vm;
     Ref<StringImpl> m_source;
 };
 
-static bool parseScript(VM* vm, const SourceCode& source, ParserError& error)
+static bool parseScript(VM& vm, const SourceCode& source, ParserError& error)
 {
     return !!JSC::parse<JSC::ProgramNode>(
-        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        &vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
         JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded,
         error);
 }
@@ -84,8 +84,8 @@ extern "C" {
 
 JSScriptRef JSScriptCreateReferencingImmortalASCIIText(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, const char* source, size_t length, JSStringRef* errorMessage, int* errorLine)
 {
-    VM* vm = toJS(contextGroup);
-    JSLockHolder locker(vm);
+    auto& vm = *toJS(contextGroup);
+    JSLockHolder locker(&vm);
     for (size_t i = 0; i < length; i++) {
         if (!isASCII(source[i]))
             return 0;
@@ -93,10 +93,11 @@ JSScriptRef JSScriptCreateReferencingImmortalASCIIText(JSContextGroupRef context
 
     startingLineNumber = std::max(1, startingLineNumber);
 
-    auto result = OpaqueJSScript::create(vm, url ? url->string() : String(), startingLineNumber, String(StringImpl::createFromLiteral(source, length)));
+    auto sourceURLString = url ? url->string() : String();
+    auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, String(StringImpl::createFromLiteral(source, length)));
 
     ParserError error;
-    if (!parseScript(vm, SourceCode(result), error)) {
+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
         if (errorMessage)
             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
         if (errorLine)
@@ -104,20 +105,21 @@ JSScriptRef JSScriptCreateReferencingImmortalASCIIText(JSContextGroupRef context
         return nullptr;
     }
 
-    return result.leakRef();
+    return &result.leakRef();
 }
 
 JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, JSStringRef source, JSStringRef* errorMessage, int* errorLine)
 {
-    VM* vm = toJS(contextGroup);
-    JSLockHolder locker(vm);
+    auto& vm = *toJS(contextGroup);
+    JSLockHolder locker(&vm);
 
     startingLineNumber = std::max(1, startingLineNumber);
 
-    auto result = OpaqueJSScript::create(vm, url ? url->string() : String(), startingLineNumber, source->string());
+    auto sourceURLString = url ? url->string() : String();
+    auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, source->string());
 
     ParserError error;
-    if (!parseScript(vm, SourceCode(result), error)) {
+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
         if (errorMessage)
             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
         if (errorLine)
@@ -125,18 +127,18 @@ JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef
         return nullptr;
     }
 
-    return result.leakRef();
+    return &result.leakRef();
 }
 
 void JSScriptRetain(JSScriptRef script)
 {
-    JSLockHolder locker(script->vm());
+    JSLockHolder locker(&script->vm());
     script->ref();
 }
 
 void JSScriptRelease(JSScriptRef script)
 {
-    JSLockHolder locker(script->vm());
+    JSLockHolder locker(&script->vm());
     script->deref();
 }
 
@@ -144,13 +146,13 @@ JSValueRef JSScriptEvaluate(JSContextRef context, JSScriptRef script, JSValueRef
 {
     ExecState* exec = toJS(context);
     JSLockHolder locker(exec);
-    if (script->vm() != &exec->vm()) {
+    if (&script->vm() != &exec->vm()) {
         RELEASE_ASSERT_NOT_REACHED();
         return 0;
     }
     NakedPtr<Exception> internalException;
     JSValue thisValue = thisValueRef ? toJS(exec, thisValueRef) : jsUndefined();
-    JSValue result = evaluate(exec, SourceCode(script), thisValue, internalException);
+    JSValue result = evaluate(exec, SourceCode(*script), thisValue, internalException);
     if (internalException) {
         if (exception)
             *exception = toRef(exec, internalException->value());

API/JSStringRef.cpp

@@ -37,7 +37,7 @@ using namespace WTF::Unicode;
 JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars)
 {
     initializeThreading();
-    return &OpaqueJSString::create(chars, numChars).leakRef();
+    return &OpaqueJSString::create(reinterpret_cast<const UChar*>(chars), numChars).leakRef();
 }
 
 JSStringRef JSStringCreateWithUTF8CString(const char* string)
@@ -62,7 +62,7 @@ JSStringRef JSStringCreateWithUTF8CString(const char* string)
 JSStringRef JSStringCreateWithCharactersNoCopy(const JSChar* chars, size_t numChars)
 {
     initializeThreading();
-    return OpaqueJSString::create(StringImpl::createWithoutCopying(chars, numChars)).leakRef();
+    return OpaqueJSString::create(StringImpl::createWithoutCopying(reinterpret_cast<const UChar*>(chars), numChars)).leakRef();
 }
 
 JSStringRef JSStringRetain(JSStringRef string)
@@ -87,7 +87,7 @@ const JSChar* JSStringGetCharactersPtr(JSStringRef string)
 {
     if (!string)
         return nullptr;
-    return string->characters();
+    return reinterpret_cast<const JSChar*>(string->characters());
 }
 
 size_t JSStringGetMaximumUTF8CStringSize(JSStringRef string)

API/JSTypedArray.cpp

@@ -140,6 +140,7 @@ JSTypedArrayType JSValueGetTypedArrayType(JSContextRef ctx, JSValueRef valueRef,
 {
 
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
     JSValue value = toJS(exec, valueRef);
@@ -147,10 +148,10 @@ JSTypedArrayType JSValueGetTypedArrayType(JSContextRef ctx, JSValueRef valueRef,
         return kJSTypedArrayTypeNone;
     JSObject* object = value.getObject();
 
-    if (jsDynamicCast<JSArrayBuffer*>(object))
+    if (jsDynamicCast<JSArrayBuffer*>(vm, object))
         return kJSTypedArrayTypeArrayBuffer;
 
-    return toJSTypedArrayType(object->classInfo()->typedArrayStorageType);
+    return toJSTypedArrayType(object->classInfo(vm)->typedArrayStorageType);
 }
 
 JSObjectRef JSObjectMakeTypedArray(JSContextRef ctx, JSTypedArrayType arrayType, size_t length, JSValueRef* exception)
@@ -193,12 +194,13 @@ JSObjectRef JSObjectMakeTypedArrayWithBytesNoCopy(JSContextRef ctx, JSTypedArray
 JSObjectRef JSObjectMakeTypedArrayWithArrayBuffer(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
         return nullptr;
 
-    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(toJS(jsBufferRef));
+    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, toJS(jsBufferRef));
     if (!jsBuffer) {
         setException(exec, exception, createTypeError(exec, "JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object"));
         return nullptr;
@@ -216,12 +218,13 @@ JSObjectRef JSObjectMakeTypedArrayWithArrayBuffer(JSContextRef ctx, JSTypedArray
 JSObjectRef JSObjectMakeTypedArrayWithArrayBufferAndOffset(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, size_t offset, size_t length, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
         return nullptr;
 
-    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(toJS(jsBufferRef));
+    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, toJS(jsBufferRef));
     if (!jsBuffer) {
         setException(exec, exception, createTypeError(exec, "JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object"));
         return nullptr;
@@ -236,10 +239,11 @@ JSObjectRef JSObjectMakeTypedArrayWithArrayBufferAndOffset(JSContextRef ctx, JST
 void* JSObjectGetTypedArrayBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object)) {
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object)) {
         ArrayBuffer* buffer = typedArray->possiblySharedBuffer();
         buffer->pinAndLock();
         return buffer->data();
@@ -247,31 +251,37 @@ void* JSObjectGetTypedArrayBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSV
     return nullptr;
 }
 
-size_t JSObjectGetTypedArrayLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+size_t JSObjectGetTypedArrayLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object))
         return typedArray->length();
 
     return 0;
 }
 
-size_t JSObjectGetTypedArrayByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+size_t JSObjectGetTypedArrayByteLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
-        return typedArray->length() * elementSize(typedArray->classInfo()->typedArrayStorageType);
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object))
+        return typedArray->length() * elementSize(typedArray->classInfo(vm)->typedArrayStorageType);
 
     return 0;
 }
 
-size_t JSObjectGetTypedArrayByteOffset(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+size_t JSObjectGetTypedArrayByteOffset(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object))
         return typedArray->byteOffset();
 
     return 0;
@@ -280,10 +290,11 @@ size_t JSObjectGetTypedArrayByteOffset(JSContextRef, JSObjectRef objectRef, JSVa
 JSObjectRef JSObjectGetTypedArrayBuffer(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object))
         return toRef(exec->vm().m_typedArrayController->toJS(exec, typedArray->globalObject(), typedArray->possiblySharedBuffer()));
 
     return nullptr;
@@ -306,25 +317,33 @@ JSObjectRef JSObjectMakeArrayBufferWithBytesNoCopy(JSContextRef ctx, void* bytes
     return toRef(jsBuffer);
 }
 
-void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
+void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(object)) {
+    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, object)) {
         ArrayBuffer* buffer = jsBuffer->impl();
+        if (buffer->isWasmMemory()) {
+            setException(exec, exception, createTypeError(exec, ASCIILiteral("Cannot get the backing buffer for a WebAssembly.Memory")));
+            return nullptr;
+        }
+
         buffer->pinAndLock();
         return buffer->data();
     }
     return nullptr;
 }
 
-size_t JSObjectGetArrayBufferByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+size_t JSObjectGetArrayBufferByteLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
 {
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSObject* object = toJS(objectRef);
 
-    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(object))
+    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, object))
         return jsBuffer->impl()->byteLength();
     
     return 0;

API/JSValue.mm

@@ -571,16 +571,16 @@ NSString * const JSPropertyDescriptorSetKey = @"set";
 
 @end
 
-inline bool isDate(JSObjectRef object, JSGlobalContextRef context)
+inline bool isDate(JSC::VM& vm, JSObjectRef object, JSGlobalContextRef context)
 {
     JSC::JSLockHolder locker(toJS(context));
-    return toJS(object)->inherits(JSC::DateInstance::info());
+    return toJS(object)->inherits(vm, JSC::DateInstance::info());
 }
 
-inline bool isArray(JSObjectRef object, JSGlobalContextRef context)
+inline bool isArray(JSC::VM& vm, JSObjectRef object, JSGlobalContextRef context)
 {
     JSC::JSLockHolder locker(toJS(context));
-    return toJS(object)->inherits(JSC::JSArray::info());
+    return toJS(object)->inherits(vm, JSC::JSArray::info());
 }
 
 @implementation JSValue(Internal)
@@ -656,6 +656,9 @@ static void reportExceptionToInspector(JSGlobalContextRef context, JSC::JSValue
 
 static JSContainerConvertor::Task valueToObjectWithoutCopy(JSGlobalContextRef context, JSValueRef value)
 {
+    JSC::ExecState* exec = toJS(context);
+    JSC::VM& vm = exec->vm();
+
     if (!JSValueIsObject(context, value)) {
         id primitive;
         if (JSValueIsBoolean(context, value))
@@ -685,10 +688,10 @@ static JSContainerConvertor::Task valueToObjectWithoutCopy(JSGlobalContextRef co
     if (id wrapped = tryUnwrapObjcObject(context, object))
         return (JSContainerConvertor::Task){ object, wrapped, ContainerNone };
 
-    if (isDate(object, context))
+    if (isDate(vm, object, context))
         return (JSContainerConvertor::Task){ object, [NSDate dateWithTimeIntervalSince1970:JSValueToNumber(context, object, 0) / 1000.0], ContainerNone };
 
-    if (isArray(object, context))
+    if (isArray(vm, object, context))
         return (JSContainerConvertor::Task){ object, [NSMutableArray array], ContainerArray };
 
     return (JSContainerConvertor::Task){ object, [NSMutableDictionary dictionary], ContainerDictionary };

API/JSValueRef.cpp

@@ -169,9 +169,10 @@ bool JSValueIsArray(JSContextRef ctx, JSValueRef value)
         return false;
     }
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
-    return toJS(exec, value).inherits(JSArray::info());
+    return toJS(exec, value).inherits(vm, JSArray::info());
 }
 
 bool JSValueIsDate(JSContextRef ctx, JSValueRef value)
@@ -181,9 +182,10 @@ bool JSValueIsDate(JSContextRef ctx, JSValueRef value)
         return false;
     }
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
-    return toJS(exec, value).inherits(DateInstance::info());
+    return toJS(exec, value).inherits(vm, DateInstance::info());
 }
 
 bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
@@ -193,20 +195,21 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla
         return false;
     }
     ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
     JSLockHolder locker(exec);
 
     JSValue jsValue = toJS(exec, value);
     
     if (JSObject* o = jsValue.getObject()) {
-        if (o->inherits(JSProxy::info()))
+        if (o->inherits(vm, JSProxy::info()))
             o = jsCast<JSProxy*>(o)->target();
 
-        if (o->inherits(JSCallbackObject<JSGlobalObject>::info()))
+        if (o->inherits(vm, JSCallbackObject<JSGlobalObject>::info()))
             return jsCast<JSCallbackObject<JSGlobalObject>*>(o)->inherits(jsClass);
-        if (o->inherits(JSCallbackObject<JSDestructibleObject>::info()))
+        if (o->inherits(vm, JSCallbackObject<JSDestructibleObject>::info()))
             return jsCast<JSCallbackObject<JSDestructibleObject>*>(o)->inherits(jsClass);
 #if JSC_OBJC_API_ENABLED
-        if (o->inherits(JSCallbackObject<JSAPIWrapperObject>::info()))
+        if (o->inherits(vm, JSCallbackObject<JSAPIWrapperObject>::info()))
             return jsCast<JSCallbackObject<JSAPIWrapperObject>*>(o)->inherits(jsClass);
 #endif
     }

API/JSVirtualMachine.mm

@@ -226,11 +226,6 @@ static id getInternalObjcObject(id object)
     }
 }
 
-- (void)enableSigillCrashAnalyzer
-{
-    JSC::enableSigillCrashAnalyzer();
-}
-
 @end
 
 @implementation JSVirtualMachine(Internal)

API/JSWeakObjectMapRefPrivate.cpp

@@ -61,9 +61,9 @@ void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSO
     JSObject* obj = toJS(object);
     if (!obj)
         return;
-    ASSERT(obj->inherits(JSProxy::info())
-        || obj->inherits(JSCallbackObject<JSGlobalObject>::info()) 
-        || obj->inherits(JSCallbackObject<JSDestructibleObject>::info()));
+    ASSERT(obj->inherits(exec->vm(), JSProxy::info())
+        || obj->inherits(exec->vm(), JSCallbackObject<JSGlobalObject>::info())
+        || obj->inherits(exec->vm(), JSCallbackObject<JSDestructibleObject>::info()));
     map->map().set(key, obj);
 }
 

API/JSWeakPrivate.cpp

@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWeakPrivate.h"
+
+#include "APICast.h"
+#include "JSCInlines.h"
+#include "Weak.h"
+#include <wtf/ThreadSafeRefCounted.h>
+
+using namespace JSC;
+
+struct OpaqueJSWeak : ThreadSafeRefCounted<OpaqueJSWeak> {
+    OpaqueJSWeak(JSObject* object)
+        : weak(object)
+    {
+    }
+    
+    Weak<JSObject> weak;
+};
+
+JSWeakRef JSWeakCreate(JSContextGroupRef contextGroup, JSObjectRef objectRef)
+{
+    VM* vm = toJS(contextGroup);
+    JSLockHolder locker(vm);
+    return new OpaqueJSWeak(toJS(objectRef));
+}
+
+void JSWeakRetain(JSContextGroupRef contextGroup, JSWeakRef weakRef)
+{
+    VM* vm = toJS(contextGroup);
+    JSLockHolder locker(vm);
+    weakRef->ref();
+}
+
+void JSWeakRelease(JSContextGroupRef contextGroup, JSWeakRef weakRef)
+{
+    VM* vm = toJS(contextGroup);
+    JSLockHolder locker(vm);
+    weakRef->deref();
+}
+
+JSObjectRef JSWeakGetObject(JSWeakRef weakRef)
+{
+    return toRef(weakRef->weak.get());
+}
+

API/JSWeakPrivate.h

@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2017 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWeakPrivate_h
+#define JSWeakPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef const struct OpaqueJSWeak* JSWeakRef;
+
+JS_EXPORT JSWeakRef JSWeakCreate(JSContextGroupRef, JSObjectRef);
+
+JS_EXPORT void JSWeakRetain(JSContextGroupRef, JSWeakRef);
+JS_EXPORT void JSWeakRelease(JSContextGroupRef, JSWeakRef);
+
+JS_EXPORT JSObjectRef JSWeakGetObject(JSWeakRef);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSWeakPrivate_h
+

API/JSWrapperMap.h

@@ -31,11 +31,11 @@
 
 @interface JSWrapperMap : NSObject
 
-- (id)initWithContext:(JSContext *)context;
+- (instancetype)initWithGlobalContextRef:(JSGlobalContextRef)context;
 
-- (JSValue *)jsWrapperForObject:(id)object;
+- (JSValue *)jsWrapperForObject:(id)object inContext:(JSContext *)context;
 
-- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value;
+- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value inContext:(JSContext *)context;
 
 @end
 

API/JSWrapperMap.mm

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2015, 2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,7 @@
 #import "JSWrapperMap.h"
 #import "ObjCCallbackFunction.h"
 #import "ObjcRuntimeExtras.h"
+#import "ObjectConstructor.h"
 #import "WeakGCMap.h"
 #import "WeakGCMapInlines.h"
 #import <wtf/Vector.h>
@@ -363,7 +364,6 @@ static void copyPrototypeProperties(JSContext *context, Class objcClass, Protoco
 }
 
 @interface JSObjCClassInfo : NSObject {
-    JSContext *m_context;
     Class m_class;
     bool m_block;
     JSClassRef m_classRef;
@@ -371,23 +371,22 @@ static void copyPrototypeProperties(JSContext *context, Class objcClass, Protoco
     JSC::Weak<JSC::JSObject> m_constructor;
 }
 
-- (id)initWithContext:(JSContext *)context forClass:(Class)cls;
-- (JSC::JSObject *)wrapperForObject:(id)object;
-- (JSC::JSObject *)constructor;
-- (JSC::JSObject *)prototype;
+- (instancetype)initForClass:(Class)cls;
+- (JSC::JSObject *)wrapperForObject:(id)object inContext:(JSContext *)context;
+- (JSC::JSObject *)constructorInContext:(JSContext *)context;
+- (JSC::JSObject *)prototypeInContext:(JSContext *)context;
 
 @end
 
 @implementation JSObjCClassInfo
 
-- (id)initWithContext:(JSContext *)context forClass:(Class)cls
+- (instancetype)initForClass:(Class)cls
 {
     self = [super init];
     if (!self)
         return nil;
 
     const char* className = class_getName(cls);
-    m_context = context;
     m_class = cls;
     m_block = [cls isSubclassOfClass:getNSBlockClass()];
     JSClassDefinition definition;
@@ -413,7 +412,7 @@ static JSC::JSObject* allocateConstructorForCustomClass(JSContext *context, cons
     __block HashMap<String, Protocol *> initTable;
     Protocol *exportProtocol = getJSExportProtocol();
     for (Class currentClass = cls; currentClass; currentClass = class_getSuperclass(currentClass)) {
-        forEachProtocolImplementingProtocol(currentClass, exportProtocol, ^(Protocol *protocol) {
+        forEachProtocolImplementingProtocol(currentClass, exportProtocol, ^(Protocol *protocol, bool&) {
             forEachMethodInProtocol(protocol, YES, YES, ^(SEL selector, const char*) {
                 const char* name = sel_getName(selector);
                 if (!isInitFamilyMethod(@(name)))
@@ -458,9 +457,9 @@ static JSC::JSObject* allocateConstructorForCustomClass(JSContext *context, cons
 
 typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
 
-- (ConstructorPrototypePair)allocateConstructorAndPrototype
+- (ConstructorPrototypePair)allocateConstructorAndPrototypeInContext:(JSContext *)context
 {
-    JSObjCClassInfo* superClassInfo = [m_context.wrapperMap classInfoForClass:class_getSuperclass(m_class)];
+    JSObjCClassInfo* superClassInfo = [context.wrapperMap classInfoForClass:class_getSuperclass(m_class)];
 
     ASSERT(!m_constructor || !m_prototype);
     ASSERT((m_class == [NSObject class]) == !superClassInfo);
@@ -469,39 +468,36 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
     JSC::JSObject* jsConstructor = m_constructor.get();
 
     if (!superClassInfo) {
-        JSContextRef cContext = [m_context JSGlobalContextRef];
-        JSValue *constructor = m_context[@"Object"];
+        JSC::JSGlobalObject* globalObject = toJSGlobalObject([context JSGlobalContextRef]);
         if (!jsConstructor)
-            jsConstructor = toJS(JSValueToObject(cContext, valueInternalValue(constructor), 0));
+            jsConstructor = globalObject->objectConstructor();
 
-        if (!jsPrototype) {
-            JSValue *prototype = constructor[@"prototype"];
-            jsPrototype = toJS(JSValueToObject(cContext, valueInternalValue(prototype), 0));
-        }
+        if (!jsPrototype)
+            jsPrototype = globalObject->objectPrototype();
     } else {
         const char* className = class_getName(m_class);
 
         // Create or grab the prototype/constructor pair.
         if (!jsPrototype)
-            jsPrototype = objectWithCustomBrand(m_context, [NSString stringWithFormat:@"%sPrototype", className]);
+            jsPrototype = objectWithCustomBrand(context, [NSString stringWithFormat:@"%sPrototype", className]);
 
         if (!jsConstructor)
-            jsConstructor = allocateConstructorForCustomClass(m_context, className, m_class);
+            jsConstructor = allocateConstructorForCustomClass(context, className, m_class);
 
-        JSValue* prototype = [JSValue valueWithJSValueRef:toRef(jsPrototype) inContext:m_context];
-        JSValue* constructor = [JSValue valueWithJSValueRef:toRef(jsConstructor) inContext:m_context];
+        JSValue* prototype = [JSValue valueWithJSValueRef:toRef(jsPrototype) inContext:context];
+        JSValue* constructor = [JSValue valueWithJSValueRef:toRef(jsConstructor) inContext:context];
         putNonEnumerable(prototype, @"constructor", constructor);
         putNonEnumerable(constructor, @"prototype", prototype);
 
         Protocol *exportProtocol = getJSExportProtocol();
-        forEachProtocolImplementingProtocol(m_class, exportProtocol, ^(Protocol *protocol){
-            copyPrototypeProperties(m_context, m_class, protocol, prototype);
-            copyMethodsToObject(m_context, m_class, protocol, NO, constructor);
+        forEachProtocolImplementingProtocol(m_class, exportProtocol, ^(Protocol *protocol, bool&){
+            copyPrototypeProperties(context, m_class, protocol, prototype);
+            copyMethodsToObject(context, m_class, protocol, NO, constructor);
         });
 
         // Set [Prototype].
-        JSC::JSObject* superClassPrototype = [superClassInfo prototype];
-        JSObjectSetPrototype([m_context JSGlobalContextRef], toRef(jsPrototype), toRef(superClassPrototype));
+        JSC::JSObject* superClassPrototype = [superClassInfo prototypeInContext:context];
+        JSObjectSetPrototype([context JSGlobalContextRef], toRef(jsPrototype), toRef(superClassPrototype));
     }
 
     m_prototype = jsPrototype;
@@ -509,41 +505,41 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
     return ConstructorPrototypePair(jsConstructor, jsPrototype);
 }
 
-- (JSC::JSObject*)wrapperForObject:(id)object
+- (JSC::JSObject*)wrapperForObject:(id)object inContext:(JSContext *)context
 {
     ASSERT([object isKindOfClass:m_class]);
     ASSERT(m_block == [object isKindOfClass:getNSBlockClass()]);
     if (m_block) {
-        if (JSObjectRef method = objCCallbackFunctionForBlock(m_context, object)) {
-            JSValue *constructor = [JSValue valueWithJSValueRef:method inContext:m_context];
-            JSValue *prototype = [JSValue valueWithNewObjectInContext:m_context];
+        if (JSObjectRef method = objCCallbackFunctionForBlock(context, object)) {
+            JSValue *constructor = [JSValue valueWithJSValueRef:method inContext:context];
+            JSValue *prototype = [JSValue valueWithNewObjectInContext:context];
             putNonEnumerable(constructor, @"prototype", prototype);
             putNonEnumerable(prototype, @"constructor", constructor);
             return toJS(method);
         }
     }
 
-    JSC::JSObject* prototype = [self prototype];
+    JSC::JSObject* prototype = [self prototypeInContext:context];
 
-    JSC::JSObject* wrapper = makeWrapper([m_context JSGlobalContextRef], m_classRef, object);
-    JSObjectSetPrototype([m_context JSGlobalContextRef], toRef(wrapper), toRef(prototype));
+    JSC::JSObject* wrapper = makeWrapper([context JSGlobalContextRef], m_classRef, object);
+    JSObjectSetPrototype([context JSGlobalContextRef], toRef(wrapper), toRef(prototype));
     return wrapper;
 }
 
-- (JSC::JSObject*)constructor
+- (JSC::JSObject*)constructorInContext:(JSContext *)context
 {
     JSC::JSObject* constructor = m_constructor.get();
     if (!constructor)
-        constructor = [self allocateConstructorAndPrototype].first;
+        constructor = [self allocateConstructorAndPrototypeInContext:context].first;
     ASSERT(!!constructor);
     return constructor;
 }
 
-- (JSC::JSObject*)prototype
+- (JSC::JSObject*)prototypeInContext:(JSContext *)context
 {
     JSC::JSObject* prototype = m_prototype.get();
     if (!prototype)
-        prototype = [self allocateConstructorAndPrototype].second;
+        prototype = [self allocateConstructorAndPrototypeInContext:context].second;
     ASSERT(!!prototype);
     return prototype;
 }
@@ -551,13 +547,12 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
 @end
 
 @implementation JSWrapperMap {
-    JSContext *m_context;
     NSMutableDictionary *m_classMap;
     std::unique_ptr<JSC::WeakGCMap<id, JSC::JSObject>> m_cachedJSWrappers;
     NSMapTable *m_cachedObjCWrappers;
 }
 
-- (id)initWithContext:(JSContext *)context
+- (instancetype)initWithGlobalContextRef:(JSGlobalContextRef)context
 {
     self = [super init];
     if (!self)
@@ -567,9 +562,10 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
     NSPointerFunctionsOptions valueOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
     m_cachedObjCWrappers = [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
 
-    m_cachedJSWrappers = std::make_unique<JSC::WeakGCMap<id, JSC::JSObject>>(toJS([context JSGlobalContextRef])->vm());
+    m_cachedJSWrappers = std::make_unique<JSC::WeakGCMap<id, JSC::JSObject>>(toJS(context)->vm());
 
-    m_context = context;
+    ASSERT(!toJSGlobalObject(context)->wrapperMap());
+    toJSGlobalObject(context)->setWrapperMap(self);
     m_classMap = [[NSMutableDictionary alloc] init];
     return self;
 }
@@ -591,23 +587,32 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
         return classInfo;
 
     // Skip internal classes beginning with '_' - just copy link to the parent class's info.
-    if ('_' == *class_getName(cls))
-        return m_classMap[cls] = [self classInfoForClass:class_getSuperclass(cls)];
+    if ('_' == *class_getName(cls)) {
+        bool conformsToExportProtocol = false;
+        forEachProtocolImplementingProtocol(cls, getJSExportProtocol(), [&conformsToExportProtocol](Protocol *, bool& stop) {
+            conformsToExportProtocol = true;
+            stop = true;
+        });
 
-    return m_classMap[cls] = [[[JSObjCClassInfo alloc] initWithContext:m_context forClass:cls] autorelease];
+        if (!conformsToExportProtocol)
+            return m_classMap[cls] = [self classInfoForClass:class_getSuperclass(cls)];
+    }
+
+    return m_classMap[cls] = [[[JSObjCClassInfo alloc] initForClass:cls] autorelease];
 }
 
-- (JSValue *)jsWrapperForObject:(id)object
+- (JSValue *)jsWrapperForObject:(id)object inContext:(JSContext *)context
 {
+    ASSERT(toJSGlobalObject([context JSGlobalContextRef])->wrapperMap() == self);
     JSC::JSObject* jsWrapper = m_cachedJSWrappers->get(object);
     if (jsWrapper)
-        return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:m_context];
+        return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:context];
 
     if (class_isMetaClass(object_getClass(object)))
-        jsWrapper = [[self classInfoForClass:(Class)object] constructor];
+        jsWrapper = [[self classInfoForClass:(Class)object] constructorInContext:context];
     else {
         JSObjCClassInfo* classInfo = [self classInfoForClass:[object class]];
-        jsWrapper = [classInfo wrapperForObject:object];
+        jsWrapper = [classInfo wrapperForObject:object inContext:context];
     }
 
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=105891
@@ -616,14 +621,15 @@ typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
     // (2) A long lived object may rack up many JSValues. When the contexts are released these will unprotect the associated JavaScript objects,
     //     but still, would probably nicer if we made it so that only one associated object was required, broadcasting object dealloc.
     m_cachedJSWrappers->set(object, jsWrapper);
-    return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:m_context];
+    return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:context];
 }
 
-- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value
+- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value inContext:context
 {
+    ASSERT(toJSGlobalObject([context JSGlobalContextRef])->wrapperMap() == self);
     JSValue *wrapper = static_cast<JSValue *>(NSMapGet(m_cachedObjCWrappers, value));
     if (!wrapper) {
-        wrapper = [[[JSValue alloc] initWithValue:value inContext:m_context] autorelease];
+        wrapper = [[[JSValue alloc] initWithValue:value inContext:context] autorelease];
         NSMapInsert(m_cachedObjCWrappers, value, wrapper);
     }
     return wrapper;
@@ -639,9 +645,10 @@ id tryUnwrapObjcObject(JSGlobalContextRef context, JSValueRef value)
     JSObjectRef object = JSValueToObject(context, value, &exception);
     ASSERT(!exception);
     JSC::JSLockHolder locker(toJS(context));
-    if (toJS(object)->inherits(JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::info()))
+    JSC::VM& vm = toJS(context)->vm();
+    if (toJS(object)->inherits(vm, JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::info()))
         return (id)JSC::jsCast<JSC::JSAPIWrapperObject*>(toJS(object))->wrappedObject();
-    if (id target = tryUnwrapConstructor(object))
+    if (id target = tryUnwrapConstructor(&vm, object))
         return target;
     return nil;
 }

API/ObjCCallbackFunction.h

@@ -36,7 +36,7 @@ JSObjectRef objCCallbackFunctionForMethod(JSContext *, Class, Protocol *, BOOL i
 JSObjectRef objCCallbackFunctionForBlock(JSContext *, id);
 JSObjectRef objCCallbackFunctionForInit(JSContext *, Class, Protocol *, SEL, const char* types);
 
-id tryUnwrapConstructor(JSObjectRef);
+id tryUnwrapConstructor(JSC::VM*, JSObjectRef);
 #endif
 
 namespace JSC {

API/ObjCCallbackFunction.mm

@@ -503,7 +503,7 @@ static JSObjectRef objCCallbackFunctionCallAsConstructor(JSContextRef callerCont
     return (JSObjectRef)result;
 }
 
-const JSC::ClassInfo ObjCCallbackFunction::s_info = { "CallbackFunction", &Base::s_info, 0, CREATE_METHOD_TABLE(ObjCCallbackFunction) };
+const JSC::ClassInfo ObjCCallbackFunction::s_info = { "CallbackFunction", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(ObjCCallbackFunction) };
 
 ObjCCallbackFunction::ObjCCallbackFunction(JSC::VM& vm, JSC::Structure* structure, JSObjectCallAsFunctionCallback functionCallback, JSObjectCallAsConstructorCallback constructCallback, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
     : Base(vm, structure)
@@ -523,7 +523,7 @@ ObjCCallbackFunction* ObjCCallbackFunction::create(JSC::VM& vm, JSC::JSGlobalObj
 
 void ObjCCallbackFunction::destroy(JSCell* cell)
 {
-    ObjCCallbackFunction& function = *jsCast<ObjCCallbackFunction*>(cell);
+    ObjCCallbackFunction& function = *static_cast<ObjCCallbackFunction*>(cell);
     function.impl()->destroy(*Heap::heap(cell));
     function.~ObjCCallbackFunction();
 }
@@ -715,9 +715,9 @@ JSObjectRef objCCallbackFunctionForBlock(JSContext *context, id target)
     return objCCallbackFunctionForInvocation(context, invocation, CallbackBlock, nil, signature);
 }
 
-id tryUnwrapConstructor(JSObjectRef object)
+id tryUnwrapConstructor(JSC::VM* vm, JSObjectRef object)
 {
-    if (!toJS(object)->inherits(JSC::ObjCCallbackFunction::info()))
+    if (!toJS(object)->inherits(*vm, JSC::ObjCCallbackFunction::info()))
         return nil;
     JSC::ObjCCallbackFunctionImpl* impl = static_cast<JSC::ObjCCallbackFunction*>(toJS(object))->impl();
     if (!impl->isConstructible())

API/ObjcRuntimeExtras.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@ inline bool protocolImplementsProtocol(Protocol *candidate, Protocol *target)
     return false;
 }
 
-inline void forEachProtocolImplementingProtocol(Class cls, Protocol *target, void (^callback)(Protocol *))
+inline void forEachProtocolImplementingProtocol(Class cls, Protocol *target, void (^callback)(Protocol *, bool& stop))
 {
     ASSERT(cls);
     ASSERT(target);
@@ -56,6 +56,7 @@ inline void forEachProtocolImplementingProtocol(Class cls, Protocol *target, voi
     worklist.append(protocols, protocolsCount);
     free(protocols);
 
+    bool stop = false;
     while (!worklist.isEmpty()) {
         Protocol *protocol = worklist.last();
         worklist.removeLast();
@@ -65,8 +66,11 @@ inline void forEachProtocolImplementingProtocol(Class cls, Protocol *target, voi
             continue;
 
         // If it implements the protocol, make the callback.
-        if (protocolImplementsProtocol(protocol, target))
-            callback(protocol);
+        if (protocolImplementsProtocol(protocol, target)) {
+            callback(protocol, stop);
+            if (stop)
+                break;
+        }
 
         // Add incorporated protocols to the worklist.
         protocols = protocol_copyProtocolList(protocol, &protocolsCount);

API/WebKitAvailability.h

@@ -66,7 +66,7 @@
 #define AVAILABLE_MAC_OS_X_VERSION_10_10_AND_LATER
 #endif
 
-#endif /* __MAC_OS_X_VERSION_MIN_REQUIRED <= 101100 */
+#endif /* !TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED < 101100 */
 
 #if defined(BUILDING_GTK__)
 #undef CF_AVAILABLE

API/tests/CompareAndSwapTest.cpp

@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CompareAndSwapTest.h"
 
+#include <functional>
 #include <stdio.h>
 #include <wtf/Atomics.h>
 #include <wtf/Threading.h>
@@ -96,7 +97,7 @@ void testCompareAndSwap()
 {
     Bitmap bitmap;
     const int numThreads = 5;
-    ThreadIdentifier threadIDs[numThreads];
+    RefPtr<Thread> threads[numThreads];
     Data data[numThreads];
 
     WTF::initializeThreading();
@@ -106,13 +107,12 @@ void testCompareAndSwap()
         data[i].bitmap = &bitmap;
         data[i].id = i;
         data[i].numThreads = numThreads;
-        std::function<void()> threadFunc = std::bind(setBitThreadFunc, &data[i]);
-        threadIDs[i] = createThread("setBitThreadFunc", threadFunc);
+        threads[i] = Thread::create("setBitThreadFunc", std::bind(setBitThreadFunc, &data[i]));
     }
 
     printf("Waiting for %d threads to join\n", numThreads);
     for (int i = 0; i < numThreads; i++)
-        waitForThreadCompletion(threadIDs[i]);
+        threads[i]->waitForCompletion();
 
     printf("PASS: CompareAndSwap test completed without a hang\n");
 }

API/tests/CurrentThisInsideBlockGetterTest.h

@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include <JavaScriptCore/JavaScriptCore.h>
+#include <JavaScriptCore/JavaScript.h>
 
 #if JSC_OBJC_API_ENABLED
 

API/tests/CustomGlobalObjectClassTest.c

@@ -26,8 +26,10 @@
 #include "CustomGlobalObjectClassTest.h"
 
 #include <JavaScriptCore/JSObjectRefPrivate.h>
-#include <JavaScriptCore/JavaScriptCore.h>
+#include <JavaScriptCore/JavaScript.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 
 extern bool assertTrue(bool value, const char* message);
 

API/tests/DateTests.mm

@@ -67,6 +67,7 @@ static unsigned unitFlags = NSCalendarUnitSecond | NSCalendarUnitMinute | NSCale
     JSContext *context = [[JSContext alloc] init];
     NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
     [formatter setDateFormat:@"MMMM dd',' yyyy hh:mm:ss"];
+    [formatter setLocale:[[NSLocale alloc] initWithLocaleIdentifier:@"en_US"]];
     NSDate *februaryFourth2014 = [formatter dateFromString:@"February 4, 2014 11:40:03"];
     NSDateComponents *components = [[NSCalendar currentCalendar] components:unitFlags fromDate:februaryFourth2014];
     // Months are 0-indexed for JavaScript Dates.
@@ -93,6 +94,7 @@ static unsigned unitFlags = NSCalendarUnitSecond | NSCalendarUnitMinute | NSCale
     [context evaluateScript:@"function jsReturnDate(date) { return date; }"];
     NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
     [formatter setDateFormat:@"MMMM dd',' yyyy hh:mm:ss"];
+    [formatter setLocale:[[NSLocale alloc] initWithLocaleIdentifier:@"en_US"]];
     NSDate *februaryFourth2014 = [formatter dateFromString:@"February 4, 2014 11:40:03"];
     NSDateComponents *components = [[NSCalendar currentCalendar] components:unitFlags fromDate:februaryFourth2014];
     

API/tests/ExecutionTimeLimitTest.cpp

@@ -28,12 +28,20 @@
 
 #include "InitializeThreading.h"
 #include "JSContextRefPrivate.h"
-#include "JavaScriptCore.h"
+#include "JavaScript.h"
 #include "Options.h"
+
 #include <chrono>
+#include <wtf/Atomics.h>
+#include <wtf/Condition.h>
 #include <wtf/CurrentTime.h>
+#include <wtf/Lock.h>
 #include <wtf/text/StringBuilder.h>
 
+#if HAVE(MACH_EXCEPTIONS)
+#include <dispatch/dispatch.h>
+#endif
+
 using namespace std::chrono;
 using JSC::Options;
 
@@ -77,6 +85,15 @@ static bool extendTerminateCallback(JSContextRef ctx, void*)
     return true;
 }
 
+#if HAVE(MACH_EXCEPTIONS)
+bool dispatchTerminateCallbackCalled = false;
+static bool dispatchTermitateCallback(JSContextRef, void*)
+{
+    dispatchTerminateCallbackCalled = true;
+    return true;
+}
+#endif
+
 struct TierOptions {
     const char* tier;
     unsigned timeLimitAdjustmentMillis;
@@ -104,8 +121,8 @@ int testExecutionTimeLimit()
     static const TierOptions tierOptionsList[] = {
         { "LLINT",    0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=false" },
         { "Baseline", 0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=false" },
-        { "DFG",      0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=false" },
-        { "FTL",      200, "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=true" },
+        { "DFG",      200,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=false" },
+        { "FTL",      500, "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=true" },
     };
     
     bool failed = false;
@@ -135,6 +152,38 @@ int testExecutionTimeLimit()
         JSObjectSetProperty(context, globalObject, currentCPUTimeStr, currentCPUTimeFunction, kJSPropertyAttributeNone, nullptr);
         JSStringRelease(currentCPUTimeStr);
 
+        /* Test script on another thread: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, shouldTerminateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+
+            JSStringRef script = JSStringCreateWithUTF8CString("function foo() { while (true) { } } foo();");
+            exception = nullptr;
+            JSValueRef* exn = &exception;
+            shouldTerminateCallbackWasCalled = false;
+            auto thread = Thread::create("Rogue thread", [=] {
+                JSEvaluateScript(context, script, nullptr, nullptr, 1, exn);
+            });
+
+            sleep(Seconds(timeAfterWatchdogShouldHaveFired / 1000.0));
+
+            if (shouldTerminateCallbackWasCalled)
+                printf("PASS: %s script timed out as expected.\n", tierOptions.tier);
+            else {
+                printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
+                exit(1);
+            }
+
+            if (!exception) {
+                printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
+                exit(1);
+            }
+
+            thread->waitForCompletion();
+            testResetAfterTimeout(failed);
+        }
+
         /* Test script timeout: */
         timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
         JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, shouldTerminateCallback, 0);
@@ -365,6 +414,65 @@ int testExecutionTimeLimit()
             }
         }
 
+#if HAVE(MACH_EXCEPTIONS)
+        /* Test script timeout from dispatch queue: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, dispatchTermitateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral(") break; } } foo();");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            dispatchTerminateCallbackCalled = false;
+
+            // We have to do this since blocks can only capture things as const.
+            JSGlobalContextRef& contextRef = context;
+            JSStringRef& scriptRef = script;
+            JSValueRef& exceptionRef = exception;
+
+            Lock syncLock;
+            Lock& syncLockRef = syncLock;
+            Condition synchronize;
+            Condition& synchronizeRef = synchronize;
+            bool didSynchronize = false;
+            bool& didSynchronizeRef = didSynchronize;
+
+            std::chrono::microseconds startTime;
+            std::chrono::microseconds endTime;
+
+            std::chrono::microseconds& startTimeRef = startTime;
+            std::chrono::microseconds& endTimeRef = endTime;
+
+            dispatch_group_t group = dispatch_group_create();
+            dispatch_group_async(group, dispatch_get_global_queue(0, 0), ^{
+                startTimeRef = currentCPUTime();
+                JSEvaluateScript(contextRef, scriptRef, nullptr, nullptr, 1, &exceptionRef);
+                endTimeRef = currentCPUTime();
+                auto locker = WTF::holdLock(syncLockRef);
+                didSynchronizeRef = true;
+                synchronizeRef.notifyAll();
+            });
+
+            auto locker = holdLock(syncLock);
+            synchronize.wait(syncLock, [&] { return didSynchronize; });
+
+            if (((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)) && dispatchTerminateCallbackCalled)
+                printf("PASS: %s script on dispatch queue timed out as expected.\n", tierOptions.tier);
+            else {
+                if ((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired))
+                    printf("FAIL: %s script on dispatch queue did not time out as expected.\n", tierOptions.tier);
+                if (!shouldTerminateCallbackWasCalled)
+                    printf("FAIL: %s script on dispatch queue timeout callback was not called.\n", tierOptions.tier);
+                failed = true;
+            }
+        }
+#endif
+
         JSGlobalContextRelease(context);
 
         Options::setOptions(savedOptionsBuilder.toString().ascii().data());

API/tests/FunctionOverridesTest.cpp

@@ -29,7 +29,7 @@
 #include "FunctionOverrides.h"
 #include "InitializeThreading.h"
 #include "JSContextRefPrivate.h"
-#include "JavaScriptCore.h"
+#include "JavaScript.h"
 #include "Options.h"
 #include <string>
 

API/tests/GlobalContextWithFinalizerTest.cpp

@@ -26,7 +26,8 @@
 #include "config.h"
 #include "GlobalContextWithFinalizerTest.h"
 
-#include "JavaScriptCore.h"
+#include "JavaScript.h"
+#include <stdio.h>
 
 static bool failed = true;
 

API/tests/JSExportTests.mm

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014, 2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -80,6 +80,28 @@ extern "C" void checkResult(NSString *description, bool passed);
 }
 @end
 
+@interface NoUnderscorePrefix : NSObject
+@end
+
+@implementation NoUnderscorePrefix
+@end
+
+@interface _UnderscorePrefixNoExport : NoUnderscorePrefix
+@end
+
+@implementation _UnderscorePrefixNoExport
+@end
+
+@protocol Initializing <JSExport>
+- (instancetype)init;
+@end
+
+@interface _UnderscorePrefixWithExport : NoUnderscorePrefix <Initializing>
+@end
+
+@implementation _UnderscorePrefixWithExport
+@end
+
 @implementation JSExportTests
 + (void) exportInstanceMethodWithIdProtocolTest
 {
@@ -123,15 +145,73 @@ extern "C" void checkResult(NSString *description, bool passed);
     JSValue *value = [context evaluateScript:@"myString.boolValue()"];
     checkResult(@"Dynamically generated JSExport-ed protocols are ignored", [value isUndefined] && !!context.exception);
 }
+
++ (void)classNamePrefixedWithUnderscoreTest
+{
+    JSContext *context = [[JSContext alloc] init];
+
+    context[@"_UnderscorePrefixNoExport"] = [_UnderscorePrefixNoExport class];
+    context[@"_UnderscorePrefixWithExport"] = [_UnderscorePrefixWithExport class];
+
+    checkResult(@"Non-underscore-prefixed ancestor class used when there are no exports", [context[@"_UnderscorePrefixNoExport"] toObject] == [NoUnderscorePrefix class]);
+    checkResult(@"Underscore-prefixed class used when there are exports", [context[@"_UnderscorePrefixWithExport"] toObject] == [_UnderscorePrefixWithExport class]);
+
+    JSValue *withExportInstance = [context evaluateScript:@"new _UnderscorePrefixWithExport()"];
+    checkResult(@"Exports present on underscore-prefixed class", !context.exception && !withExportInstance.isUndefined);
+}
+
 @end
 
+@protocol AJSExport <JSExport>
+- (instancetype)init;
+@end
+
+@interface A : NSObject <AJSExport>
+@end
+
+@implementation A
+@end
+
+static void wrapperLifetimeIsTiedToGlobalObject()
+{
+    JSGlobalContextRef contextRef;
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        contextRef = JSGlobalContextRetain(context.JSGlobalContextRef);
+        context[@"A"] = A.class;
+        checkResult(@"Initial wrapper's constructor is itself", [[context evaluateScript:@"new A().constructor === A"] toBool]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [JSContext contextWithJSGlobalContextRef:contextRef];
+        checkResult(@"New context's wrapper's constructor is itself", [[context evaluateScript:@"new A().constructor === A"] toBool]);
+    }
+
+    JSGlobalContextRelease(contextRef);
+}
+
+static void wrapperForNSObjectisObject()
+{
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"Object"] = [[NSNull alloc] init];
+        context.exception = nil;
+
+        context[@"A"] = NSObject.class;
+        checkResult(@"Should not throw an exception when wrapping NSObject and Object has been changed", ![context exception]);
+    }
+}
+
 void runJSExportTests()
 {
     @autoreleasepool {
         [JSExportTests exportInstanceMethodWithIdProtocolTest];
         [JSExportTests exportInstanceMethodWithClassProtocolTest];
         [JSExportTests exportDynamicallyGeneratedProtocolTest];
+        [JSExportTests classNamePrefixedWithUnderscoreTest];
     }
+    wrapperLifetimeIsTiedToGlobalObject();
+    wrapperForNSObjectisObject();
 }
 
 #endif // JSC_OBJC_API_ENABLED

API/tests/JSObjectGetProxyTargetTest.cpp

@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSObjectGetProxyTargetTest.h"
+
+#include "APICast.h"
+#include "InitializeThreading.h"
+#include "JSCInlines.h"
+#include "JSObjectRefPrivate.h"
+#include "JSProxy.h"
+#include "JavaScript.h"
+#include "Options.h"
+#include "ProxyObject.h"
+
+using namespace JSC;
+
+int testJSObjectGetProxyTarget()
+{
+    bool overallResult = true;
+    
+    printf("JSObjectGetProxyTargetTest:\n");
+    
+    auto test = [&] (const char* description, bool currentResult) {
+        printf("    %s: %s\n", description, currentResult ? "PASS" : "FAIL");
+        overallResult &= currentResult;
+    };
+    
+    JSContextGroupRef group = JSContextGroupCreate();
+    JSContextRef context = JSGlobalContextCreateInGroup(group, nullptr);
+    
+    ExecState* exec = toJS(context);
+    VM& vm = *toJS(group);
+    JSObjectRef globalObjectProxy = JSContextGetGlobalObject(context);
+    JSProxy* globalObjectProxyObject = jsCast<JSProxy*>(toJS(globalObjectProxy));
+    JSGlobalObject* globalObjectObject = jsCast<JSGlobalObject*>(globalObjectProxyObject->target());
+    Structure* proxyStructure = JSProxy::createStructure(vm, globalObjectObject, globalObjectObject->objectPrototype(), PureForwardingProxyType);
+    JSObjectRef globalObject = toRef(globalObjectObject);
+    JSProxy* jsProxyObject = JSProxy::create(vm, proxyStructure);
+    
+    JSObjectRef array = JSObjectMakeArray(context, 0, nullptr, nullptr);
+
+    Structure* emptyObjectStructure = JSFinalObject::createStructure(vm, globalObjectObject, globalObjectObject->objectPrototype(), 0);
+    JSObject* handler = JSFinalObject::create(vm, emptyObjectStructure);
+    ProxyObject* proxyObjectObject = ProxyObject::create(exec, globalObjectObject, toJS(array), handler);
+
+    JSObjectRef jsProxy = toRef(jsProxyObject);
+    JSObjectRef proxyObject = toRef(proxyObjectObject);
+    
+    test("proxy target of null is null", !JSObjectGetProxyTarget(nullptr));
+    test("proxy target of non-proxy is null", !JSObjectGetProxyTarget(array));
+    test("proxy target of uninitialized JSProxy is null", !JSObjectGetProxyTarget(jsProxy));
+    
+    jsProxyObject->setTarget(vm, globalObjectObject);
+    
+    test("proxy target of initialized JSProxy works", JSObjectGetProxyTarget(jsProxy) == globalObject);
+    
+    test("proxy target of ProxyObject works", JSObjectGetProxyTarget(proxyObject) == array);
+    
+    test("proxy target of GlobalObject is the globalObject", JSObjectGetProxyTarget(globalObjectProxy) == globalObject);
+    
+    JSContextGroupRelease(group);
+
+    printf("JSObjectGetProxyTargetTest: %s\n", overallResult ? "PASS" : "FAIL");
+    return !overallResult;
+}
+

API/tests/JSObjectGetProxyTargetTest.h

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int testJSObjectGetProxyTarget(void);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif

API/tests/MultithreadedMultiVMExecutionTest.cpp

@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MultithreadedMultiVMExecutionTest.h"
+
+#include "InitializeThreading.h"
+#include "JSContextRefPrivate.h"
+#include "JavaScript.h"
+#include "Options.h"
+#include <mutex>
+#include <string>
+#include <thread>
+#include <vector>
+#include <wtf/MainThread.h>
+
+static int failuresFound = 0;
+
+static std::vector<std::thread>& threadsList()
+{
+    static std::vector<std::thread>* list;
+    static std::once_flag flag;
+    std::call_once(flag, [] () {
+        list = new std::vector<std::thread>();
+    });
+    return *list;
+}
+
+void startMultithreadedMultiVMExecutionTest()
+{
+    WTF::initializeMainThread();
+    JSC::initializeThreading();
+
+#define CHECK(condition, message) do { \
+        if (!condition) { \
+            printf("FAILED MultithreadedMultiVMExecutionTest: %s\n", message); \
+            failuresFound++; \
+        } \
+    } while (false)
+
+    auto task = [&]() {
+        int ret = 0;
+        std::string scriptString =
+            "const AAA = {A:0, B:1, C:2, D:3};"
+            "class Preconditions { static checkArgument(e,t) { if (!e) throw t }};"
+            "1 + 2";
+
+        for (int i = 0; i < 1000; ++i) {
+            JSClassRef jsClass = JSClassCreate(&kJSClassDefinitionEmpty);
+            CHECK(jsClass, "global object class creation");
+            JSContextGroupRef contextGroup = JSContextGroupCreate();
+            CHECK(contextGroup, "group creation");
+            JSGlobalContextRef context = JSGlobalContextCreateInGroup(contextGroup, jsClass);
+            CHECK(context, "ctx creation");
+
+            JSStringRef jsScriptString = JSStringCreateWithUTF8CString(scriptString.c_str());
+            CHECK(jsScriptString, "script to jsString");
+
+            JSValueRef jsScript = JSEvaluateScript(context, jsScriptString, nullptr, nullptr, 0, nullptr);
+            CHECK(jsScript, "script eval");
+            JSStringRelease(jsScriptString);
+
+            JSGlobalContextRelease(context);
+            JSContextGroupRelease(contextGroup);
+            JSClassRelease(jsClass);
+        }
+
+        return ret;
+    };
+    for (int t = 0; t < 8; ++t)
+        threadsList().push_back(std::thread(task));
+}
+
+int finalizeMultithreadedMultiVMExecutionTest()
+{
+    auto& threads = threadsList();
+    for (auto& thread : threads)
+        thread.join();
+
+    if (failuresFound)
+        printf("FAILED MultithreadedMultiVMExecutionTest\n");
+    return (failuresFound > 0);
+}

API/tests/MultithreadedMultiVMExecutionTest.h

@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern void startMultithreadedMultiVMExecutionTest();
+
+/* Returns 1 if failures were encountered.  Else, returns 0. */
+extern int finalizeMultithreadedMultiVMExecutionTest();
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif

API/tests/PingPongStackOverflowTest.cpp

@@ -28,7 +28,7 @@
 
 #include "InitializeThreading.h"
 #include "JSContextRefPrivate.h"
-#include "JavaScriptCore.h"
+#include "JavaScript.h"
 #include "Options.h"
 #include <wtf/text/StringBuilder.h>
 

API/tests/TypedArrayCTest.cpp

@@ -26,7 +26,10 @@
 #include "config.h"
 #include "TypedArrayCTest.h"
 
-#include "JavaScriptCore.h"
+#include "JavaScript.h"
+#include <limits.h>
+#include <math.h>
+#include <stdio.h>
 #include <wtf/Assertions.h>
 
 extern "C" void JSSynchronousGarbageCollectForDebugging(JSContextRef);

API/tests/testapi.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2015-2016 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006-2017 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,13 +25,25 @@
 
 #include <wtf/Platform.h>
 
+#if USE(CF)
 #include "JavaScriptCore.h"
+#else
+#include "JavaScript.h"
+#endif
+
 #include "JSBasePrivate.h"
 #include "JSContextRefPrivate.h"
+#include "JSHeapFinalizerPrivate.h"
+#include "JSMarkingConstraintPrivate.h"
 #include "JSObjectRefPrivate.h"
 #include "JSScriptRefPrivate.h"
 #include "JSStringRefPrivate.h"
+#include "JSWeakPrivate.h"
 #include <math.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
 #define ASSERT_DISABLED 0
 #include <wtf/Assertions.h>
 
@@ -45,6 +57,8 @@
 #include "FunctionOverridesTest.h"
 #include "GlobalContextWithFinalizerTest.h"
 #include "JSONParseTest.h"
+#include "JSObjectGetProxyTargetTest.h"
+#include "MultithreadedMultiVMExecutionTest.h"
 #include "PingPongStackOverflowTest.h"
 #include "TypedArrayCTest.h"
 
@@ -108,6 +122,7 @@ static void assertEqualsAsCharactersPtr(JSValueRef value, const char* expectedVa
 {
     JSStringRef valueAsString = JSValueToStringCopy(context, value, NULL);
 
+#if USE(CF)
     size_t jsLength = JSStringGetLength(valueAsString);
     const JSChar* jsBuffer = JSStringGetCharactersPtr(valueAsString);
 
@@ -134,6 +149,18 @@ static void assertEqualsAsCharactersPtr(JSValueRef value, const char* expectedVa
     }
 
     free(cfBuffer);
+#else
+    size_t bufferSize = JSStringGetMaximumUTF8CStringSize(valueAsString);
+    char* buffer = (char*)malloc(bufferSize);
+    JSStringGetUTF8CString(valueAsString, buffer, bufferSize);
+
+    if (strcmp(buffer, expectedValue)) {
+        fprintf(stderr, "assertEqualsAsCharactersPtr failed: jsBuffer != cfBuffer\n");
+        failed = 1;
+    }
+
+    free(buffer);
+#endif
     JSStringRelease(valueAsString);
 }
 
@@ -1115,6 +1142,203 @@ static void checkConstnessInJSObjectNames()
     val.name = "something";
 }
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+#ifdef __cplusplus
+}
+#endif
+
+static const unsigned numWeakRefs = 10000;
+
+static void markingConstraint(JSMarkerRef marker, void *userData)
+{
+    JSWeakRef *weakRefs;
+    unsigned i;
+    
+    weakRefs = (JSWeakRef*)userData;
+    
+    for (i = 0; i < numWeakRefs; i += 2) {
+        JSWeakRef weakRef = weakRefs[i];
+        if (weakRef) {
+            JSObjectRef object = JSWeakGetObject(weakRefs[i]);
+            marker->Mark(marker, object);
+            assertTrue(marker->IsMarked(marker, object), "A marked object is marked");
+        }
+    }
+}
+
+static bool didRunHeapFinalizer;
+static JSContextGroupRef expectedContextGroup;
+
+static void heapFinalizer(JSContextGroupRef group, void *userData)
+{
+    assertTrue((uintptr_t)userData == (uintptr_t)42, "Correct userData was passed");
+    assertTrue(group == expectedContextGroup, "Correct context group");
+    
+    didRunHeapFinalizer = true;
+}
+
+static void testMarkingConstraintsAndHeapFinalizers(void)
+{
+    JSContextGroupRef group;
+    JSContextRef context;
+    JSWeakRef *weakRefs;
+    unsigned i;
+    unsigned deadCount;
+    
+    printf("Testing Marking Constraints.\n");
+    
+    group = JSContextGroupCreate();
+    expectedContextGroup = group;
+    
+    context = JSGlobalContextCreateInGroup(group, NULL);
+
+    weakRefs = (JSWeakRef*)calloc(numWeakRefs, sizeof(JSWeakRef));
+
+    JSContextGroupAddMarkingConstraint(group, markingConstraint, weakRefs);
+    JSContextGroupAddHeapFinalizer(group, heapFinalizer, (void*)(uintptr_t)42);
+    
+    for (i = numWeakRefs; i--;)
+        weakRefs[i] = JSWeakCreate(group, JSObjectMakeArray(context, 0, NULL, NULL));
+    
+    JSSynchronousGarbageCollectForDebugging(context);
+    assertTrue(didRunHeapFinalizer, "Did run heap finalizer");
+    
+    deadCount = 0;
+    for (i = 0; i < numWeakRefs; i += 2) {
+        assertTrue(JSWeakGetObject(weakRefs[i]), "Marked objects stayed alive");
+        if (!JSWeakGetObject(weakRefs[i + 1]))
+            deadCount++;
+    }
+    
+    assertTrue(deadCount != 0, "At least some objects died");
+    
+    for (i = numWeakRefs; i--;) {
+        JSWeakRef weakRef = weakRefs[i];
+        weakRefs[i] = NULL;
+        JSWeakRelease(group, weakRef);
+    }
+    
+    didRunHeapFinalizer = false;
+    JSSynchronousGarbageCollectForDebugging(context);
+    assertTrue(didRunHeapFinalizer, "Did run heap finalizer");
+
+    JSContextGroupRemoveHeapFinalizer(group, heapFinalizer, (void*)(uintptr_t)42);
+
+    didRunHeapFinalizer = false;
+    JSSynchronousGarbageCollectForDebugging(context);
+    assertTrue(!didRunHeapFinalizer, "Did not run heap finalizer");
+    
+    JSContextGroupRelease(group);
+
+    printf("PASS: Marking Constraints and Heap Finalizers.\n");
+}
+
+#if USE(CF)
+static void testCFStrings(void)
+{
+    /* The assertion utility functions we use below expects to get the JSGlobalContextRef
+       from the global context variable. */
+    JSGlobalContextRef oldContext = context;
+    context = JSGlobalContextCreate(0);
+
+    UniChar singleUniChar = 65; // Capital A
+    CFMutableStringRef cfString = CFStringCreateMutableWithExternalCharactersNoCopy(kCFAllocatorDefault, &singleUniChar, 1, 1, kCFAllocatorNull);
+
+    JSStringRef jsCFIString = JSStringCreateWithCFString(cfString);
+    JSValueRef jsCFString = JSValueMakeString(context, jsCFIString);
+
+    CFStringRef cfEmptyString = CFStringCreateWithCString(kCFAllocatorDefault, "", kCFStringEncodingUTF8);
+
+    JSStringRef jsCFEmptyIString = JSStringCreateWithCFString(cfEmptyString);
+    JSValueRef jsCFEmptyString = JSValueMakeString(context, jsCFEmptyIString);
+
+    CFIndex cfStringLength = CFStringGetLength(cfString);
+    UniChar* buffer = (UniChar*)malloc(cfStringLength * sizeof(UniChar));
+    CFStringGetCharacters(cfString, CFRangeMake(0, cfStringLength), buffer);
+    JSStringRef jsCFIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, cfStringLength);
+    JSValueRef jsCFStringWithCharacters = JSValueMakeString(context, jsCFIStringWithCharacters);
+
+    JSStringRef jsCFEmptyIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, CFStringGetLength(cfEmptyString));
+    free(buffer);
+    JSValueRef jsCFEmptyStringWithCharacters = JSValueMakeString(context, jsCFEmptyIStringWithCharacters);
+
+    ASSERT(JSValueGetType(context, jsCFString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFStringWithCharacters) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFEmptyString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFEmptyStringWithCharacters) == kJSTypeString);
+
+    JSStringRef emptyString = JSStringCreateWithCFString(CFSTR(""));
+    const JSChar* characters = JSStringGetCharactersPtr(emptyString);
+    if (!characters) {
+        printf("FAIL: Returned null when accessing character pointer of an empty String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned empty when accessing character pointer of an empty String.\n");
+
+    size_t length = JSStringGetLength(emptyString);
+    if (length) {
+        printf("FAIL: Didn't return 0 length for empty String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned 0 length for empty String.\n");
+    JSStringRelease(emptyString);
+
+    assertEqualsAsBoolean(jsCFString, true);
+    assertEqualsAsBoolean(jsCFStringWithCharacters, true);
+    assertEqualsAsBoolean(jsCFEmptyString, false);
+    assertEqualsAsBoolean(jsCFEmptyStringWithCharacters, false);
+
+    assertEqualsAsNumber(jsCFString, nan(""));
+    assertEqualsAsNumber(jsCFStringWithCharacters, nan(""));
+    assertEqualsAsNumber(jsCFEmptyString, 0);
+    assertEqualsAsNumber(jsCFEmptyStringWithCharacters, 0);
+    ASSERT(sizeof(JSChar) == sizeof(UniChar));
+
+    assertEqualsAsCharactersPtr(jsCFString, "A");
+    assertEqualsAsCharactersPtr(jsCFStringWithCharacters, "A");
+    assertEqualsAsCharactersPtr(jsCFEmptyString, "");
+    assertEqualsAsCharactersPtr(jsCFEmptyStringWithCharacters, "");
+
+    assertEqualsAsUTF8String(jsCFString, "A");
+    assertEqualsAsUTF8String(jsCFStringWithCharacters, "A");
+    assertEqualsAsUTF8String(jsCFEmptyString, "");
+    assertEqualsAsUTF8String(jsCFEmptyStringWithCharacters, "");
+
+    CFStringRef cfJSString = JSStringCopyCFString(kCFAllocatorDefault, jsCFIString);
+    CFStringRef cfJSEmptyString = JSStringCopyCFString(kCFAllocatorDefault, jsCFEmptyIString);
+    ASSERT(CFEqual(cfJSString, cfString));
+    ASSERT(CFEqual(cfJSEmptyString, cfEmptyString));
+    CFRelease(cfJSString);
+    CFRelease(cfJSEmptyString);
+
+    JSObjectRef o = JSObjectMake(context, NULL, NULL);
+    JSStringRef jsOneIString = JSStringCreateWithUTF8CString("1");
+    JSObjectSetProperty(context, o, jsOneIString, JSValueMakeNumber(context, 1), kJSPropertyAttributeNone, NULL);
+    JSObjectSetProperty(context, o, jsCFIString,  JSValueMakeNumber(context, 1), kJSPropertyAttributeDontEnum, NULL);
+    JSPropertyNameArrayRef nameArray = JSObjectCopyPropertyNames(context, o);
+    size_t expectedCount = JSPropertyNameArrayGetCount(nameArray);
+    size_t count;
+    for (count = 0; count < expectedCount; ++count)
+        JSPropertyNameArrayGetNameAtIndex(nameArray, count);
+    JSPropertyNameArrayRelease(nameArray);
+    ASSERT(count == 1); // jsCFString should not be enumerated
+
+    JSStringRelease(jsOneIString);
+    JSStringRelease(jsCFIString);
+    JSStringRelease(jsCFEmptyIString);
+    JSStringRelease(jsCFIStringWithCharacters);
+    JSStringRelease(jsCFEmptyIStringWithCharacters);
+    CFRelease(cfString);
+    CFRelease(cfEmptyString);
+
+    JSGlobalContextRelease(context);
+    context = oldContext;
+}
+#endif
+
 int main(int argc, char* argv[])
 {
 #if OS(WINDOWS)
@@ -1125,6 +1349,7 @@ int main(int argc, char* argv[])
 #endif
 
     testCompareAndSwap();
+    startMultithreadedMultiVMExecutionTest();
 
 #if JSC_OBJC_API_ENABLED
     testObjectiveCAPI();
@@ -1144,6 +1369,12 @@ int main(int argc, char* argv[])
 
     ASSERT(Base_didFinalize);
 
+    testMarkingConstraintsAndHeapFinalizers();
+
+#if USE(CF)
+    testCFStrings();
+#endif
+
     JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
     globalObjectClassDefinition.initialize = globalObject_initialize;
     globalObjectClassDefinition.staticValues = globalObject_staticValues;
@@ -1189,34 +1420,6 @@ int main(int argc, char* argv[])
     JSStringRef jsOneIString = JSStringCreateWithUTF8CString("1");
     JSValueRef jsOneString = JSValueMakeString(context, jsOneIString);
 
-    UniChar singleUniChar = 65; // Capital A
-    CFMutableStringRef cfString = 
-        CFStringCreateMutableWithExternalCharactersNoCopy(kCFAllocatorDefault,
-                                                          &singleUniChar,
-                                                          1,
-                                                          1,
-                                                          kCFAllocatorNull);
-
-    JSStringRef jsCFIString = JSStringCreateWithCFString(cfString);
-    JSValueRef jsCFString = JSValueMakeString(context, jsCFIString);
-    
-    CFStringRef cfEmptyString = CFStringCreateWithCString(kCFAllocatorDefault, "", kCFStringEncodingUTF8);
-    
-    JSStringRef jsCFEmptyIString = JSStringCreateWithCFString(cfEmptyString);
-    JSValueRef jsCFEmptyString = JSValueMakeString(context, jsCFEmptyIString);
-
-    CFIndex cfStringLength = CFStringGetLength(cfString);
-    UniChar* buffer = (UniChar*)malloc(cfStringLength * sizeof(UniChar));
-    CFStringGetCharacters(cfString, 
-                          CFRangeMake(0, cfStringLength), 
-                          buffer);
-    JSStringRef jsCFIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, cfStringLength);
-    JSValueRef jsCFStringWithCharacters = JSValueMakeString(context, jsCFIStringWithCharacters);
-    
-    JSStringRef jsCFEmptyIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, CFStringGetLength(cfEmptyString));
-    free(buffer);
-    JSValueRef jsCFEmptyStringWithCharacters = JSValueMakeString(context, jsCFEmptyIStringWithCharacters);
-
     JSChar constantString[] = { 'H', 'e', 'l', 'l', 'o', };
     JSStringRef constantStringRef = JSStringCreateWithCharactersNoCopy(constantString, sizeof(constantString) / sizeof(constantString[0]));
     ASSERT(JSStringGetCharactersPtr(constantStringRef) == constantString);
@@ -1232,10 +1435,6 @@ int main(int argc, char* argv[])
     ASSERT(JSValueGetType(context, jsOneThird) == kJSTypeNumber);
     ASSERT(JSValueGetType(context, jsEmptyString) == kJSTypeString);
     ASSERT(JSValueGetType(context, jsOneString) == kJSTypeString);
-    ASSERT(JSValueGetType(context, jsCFString) == kJSTypeString);
-    ASSERT(JSValueGetType(context, jsCFStringWithCharacters) == kJSTypeString);
-    ASSERT(JSValueGetType(context, jsCFEmptyString) == kJSTypeString);
-    ASSERT(JSValueGetType(context, jsCFEmptyStringWithCharacters) == kJSTypeString);
 
     ASSERT(!JSValueIsBoolean(context, NULL));
     ASSERT(!JSValueIsObject(context, NULL));
@@ -1258,14 +1457,6 @@ int main(int argc, char* argv[])
     } else
         printf("PASS: returned null when accessing character pointer of a null String.\n");
 
-    JSStringRef emptyString = JSStringCreateWithCFString(CFSTR(""));
-    characters = JSStringGetCharactersPtr(emptyString);
-    if (!characters) {
-        printf("FAIL: Returned null when accessing character pointer of an empty String.\n");
-        failed = 1;
-    } else
-        printf("PASS: returned empty when accessing character pointer of an empty String.\n");
-
     size_t length = JSStringGetLength(nullString);
     if (length) {
         printf("FAIL: Didn't return 0 length for null String.\n");
@@ -1274,14 +1465,6 @@ int main(int argc, char* argv[])
         printf("PASS: returned 0 length for null String.\n");
     JSStringRelease(nullString);
 
-    length = JSStringGetLength(emptyString);
-    if (length) {
-        printf("FAIL: Didn't return 0 length for empty String.\n");
-        failed = 1;
-    } else
-        printf("PASS: returned 0 length for empty String.\n");
-    JSStringRelease(emptyString);
-
     JSObjectRef propertyCatchalls = JSObjectMake(context, PropertyCatchalls_class(context), NULL);
     JSStringRef propertyCatchallsString = JSStringCreateWithUTF8CString("PropertyCatchalls");
     JSObjectSetProperty(context, globalObject, propertyCatchallsString, propertyCatchalls, kJSPropertyAttributeNone, NULL);
@@ -1337,7 +1520,8 @@ int main(int argc, char* argv[])
 
     JSGarbageCollect(context);
 
-    for (int i = 0; i < 10000; i++)
+    int i;
+    for (i = 0; i < 10000; i++)
         JSObjectMake(context, 0, 0);
 
     aHeapRef = JSValueToObject(context, JSObjectGetPrivateProperty(context, myObject, privatePropertyName), 0);
@@ -1461,10 +1645,6 @@ int main(int argc, char* argv[])
     assertEqualsAsBoolean(jsOneThird, true);
     assertEqualsAsBoolean(jsEmptyString, false);
     assertEqualsAsBoolean(jsOneString, true);
-    assertEqualsAsBoolean(jsCFString, true);
-    assertEqualsAsBoolean(jsCFStringWithCharacters, true);
-    assertEqualsAsBoolean(jsCFEmptyString, false);
-    assertEqualsAsBoolean(jsCFEmptyStringWithCharacters, false);
     
     assertEqualsAsNumber(jsUndefined, nan(""));
     assertEqualsAsNumber(jsNull, 0);
@@ -1475,11 +1655,6 @@ int main(int argc, char* argv[])
     assertEqualsAsNumber(jsOneThird, 1.0 / 3.0);
     assertEqualsAsNumber(jsEmptyString, 0);
     assertEqualsAsNumber(jsOneString, 1);
-    assertEqualsAsNumber(jsCFString, nan(""));
-    assertEqualsAsNumber(jsCFStringWithCharacters, nan(""));
-    assertEqualsAsNumber(jsCFEmptyString, 0);
-    assertEqualsAsNumber(jsCFEmptyStringWithCharacters, 0);
-    ASSERT(sizeof(JSChar) == sizeof(UniChar));
     
     assertEqualsAsCharactersPtr(jsUndefined, "undefined");
     assertEqualsAsCharactersPtr(jsNull, "null");
@@ -1490,10 +1665,6 @@ int main(int argc, char* argv[])
     assertEqualsAsCharactersPtr(jsOneThird, "0.3333333333333333");
     assertEqualsAsCharactersPtr(jsEmptyString, "");
     assertEqualsAsCharactersPtr(jsOneString, "1");
-    assertEqualsAsCharactersPtr(jsCFString, "A");
-    assertEqualsAsCharactersPtr(jsCFStringWithCharacters, "A");
-    assertEqualsAsCharactersPtr(jsCFEmptyString, "");
-    assertEqualsAsCharactersPtr(jsCFEmptyStringWithCharacters, "");
     
     assertEqualsAsUTF8String(jsUndefined, "undefined");
     assertEqualsAsUTF8String(jsNull, "null");
@@ -1504,10 +1675,6 @@ int main(int argc, char* argv[])
     assertEqualsAsUTF8String(jsOneThird, "0.3333333333333333");
     assertEqualsAsUTF8String(jsEmptyString, "");
     assertEqualsAsUTF8String(jsOneString, "1");
-    assertEqualsAsUTF8String(jsCFString, "A");
-    assertEqualsAsUTF8String(jsCFStringWithCharacters, "A");
-    assertEqualsAsUTF8String(jsCFEmptyString, "");
-    assertEqualsAsUTF8String(jsCFEmptyStringWithCharacters, "");
     
     checkConstnessInJSObjectNames();
     
@@ -1517,16 +1684,6 @@ int main(int argc, char* argv[])
     ASSERT(JSValueIsEqual(context, jsOne, jsOneString, NULL));
     ASSERT(!JSValueIsEqual(context, jsTrue, jsFalse, NULL));
     
-    CFStringRef cfJSString = JSStringCopyCFString(kCFAllocatorDefault, jsCFIString);
-    CFStringRef cfJSEmptyString = JSStringCopyCFString(kCFAllocatorDefault, jsCFEmptyIString);
-    ASSERT(CFEqual(cfJSString, cfString));
-    ASSERT(CFEqual(cfJSEmptyString, cfEmptyString));
-    CFRelease(cfJSString);
-    CFRelease(cfJSEmptyString);
-
-    CFRelease(cfString);
-    CFRelease(cfEmptyString);
-    
     jsGlobalValue = JSObjectMake(context, NULL, NULL);
     makeGlobalNumberValue(context);
     JSValueProtect(context, jsGlobalValue);
@@ -1680,17 +1837,6 @@ int main(int argc, char* argv[])
     JSObjectSetProperty(context, globalObject, string, derived2Constructor, kJSPropertyAttributeNone, NULL);
     JSStringRelease(string);
 
-    o = JSObjectMake(context, NULL, NULL);
-    JSObjectSetProperty(context, o, jsOneIString, JSValueMakeNumber(context, 1), kJSPropertyAttributeNone, NULL);
-    JSObjectSetProperty(context, o, jsCFIString,  JSValueMakeNumber(context, 1), kJSPropertyAttributeDontEnum, NULL);
-    JSPropertyNameArrayRef nameArray = JSObjectCopyPropertyNames(context, o);
-    size_t expectedCount = JSPropertyNameArrayGetCount(nameArray);
-    size_t count;
-    for (count = 0; count < expectedCount; ++count)
-        JSPropertyNameArrayGetNameAtIndex(nameArray, count);
-    JSPropertyNameArrayRelease(nameArray);
-    ASSERT(count == 1); // jsCFString should not be enumerated
-
     JSValueRef argumentsArrayValues[] = { JSValueMakeNumber(context, 10), JSValueMakeNumber(context, 20) };
     o = JSObjectMakeArray(context, sizeof(argumentsArrayValues) / sizeof(JSValueRef), argumentsArrayValues, NULL);
     string = JSStringCreateWithUTF8CString("length");
@@ -1814,9 +1960,11 @@ int main(int argc, char* argv[])
         ASSERT((!scriptObject) != (!errorMessage));
         if (!scriptObject) {
             printf("FAIL: Test script did not parse\n\t%s:%d\n\t", scriptPath, errorLine);
+#if USE(CF)
             CFStringRef errorCF = JSStringCopyCFString(kCFAllocatorDefault, errorMessage);
             CFShow(errorCF);
             CFRelease(errorCF);
+#endif
             JSStringRelease(errorMessage);
             failed = 1;
         }
@@ -1829,9 +1977,11 @@ int main(int argc, char* argv[])
         else {
             printf("FAIL: Test script returned unexpected value:\n");
             JSStringRef exceptionIString = JSValueToStringCopy(context, exception, NULL);
+#if USE(CF)
             CFStringRef exceptionCF = JSStringCopyCFString(kCFAllocatorDefault, exceptionIString);
             CFShow(exceptionCF);
             CFRelease(exceptionCF);
+#endif
             JSStringRelease(exceptionIString);
             failed = 1;
         }
@@ -1889,6 +2039,7 @@ int main(int argc, char* argv[])
     failed = testGlobalContextWithFinalizer() || failed;
     failed = testPingPongStackOverflow() || failed;
     failed = testJSONParse() || failed;
+    failed = testJSObjectGetProxyTarget() || failed;
 
     // Clear out local variables pointing at JSObjectRefs to allow their values to be collected
     function = NULL;
@@ -1899,10 +2050,6 @@ int main(int argc, char* argv[])
 
     JSStringRelease(jsEmptyIString);
     JSStringRelease(jsOneIString);
-    JSStringRelease(jsCFIString);
-    JSStringRelease(jsCFEmptyIString);
-    JSStringRelease(jsCFIStringWithCharacters);
-    JSStringRelease(jsCFEmptyIStringWithCharacters);
     JSStringRelease(goodSyntax);
     JSStringRelease(badSyntax);
 
@@ -1941,6 +2088,8 @@ int main(int argc, char* argv[])
     globalObjectSetPrototypeTest();
     globalObjectPrivatePropertyTest();
 
+    failed = finalizeMultithreadedMultiVMExecutionTest() || failed;
+
     if (failed) {
         printf("FAIL: Some tests failed.\n");
         return 1;

API/tests/testapi.mm

@@ -1507,6 +1507,7 @@ static void checkNegativeNSIntegers()
     checkResult(@"Negative number maintained its original value", [[result toString] isEqualToString:@"-1"]);
 }
 
+
 void testObjectiveCAPI()
 {
     NSLog(@"Testing Objective-C API");

CMakeLists.txt

@@ -18,7 +18,7 @@ set(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/dfg"
     "${JAVASCRIPTCORE_DIR}/disassembler"
     "${JAVASCRIPTCORE_DIR}/disassembler/udis86"
-    "${JAVASCRIPTCORE_DIR}/disassembler/arm64"
+    "${JAVASCRIPTCORE_DIR}/disassembler/ARM64"
     "${JAVASCRIPTCORE_DIR}/domjit"
     "${JAVASCRIPTCORE_DIR}/ftl"
     "${JAVASCRIPTCORE_DIR}/heap"
@@ -32,13 +32,12 @@ set(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/llint"
     "${JAVASCRIPTCORE_DIR}/parser"
     "${JAVASCRIPTCORE_DIR}/profiler"
-    "${JAVASCRIPTCORE_DIR}/replay"
     "${JAVASCRIPTCORE_DIR}/runtime"
     "${JAVASCRIPTCORE_DIR}/tools"
     "${JAVASCRIPTCORE_DIR}/wasm"
     "${JAVASCRIPTCORE_DIR}/wasm/js"
     "${JAVASCRIPTCORE_DIR}/yarr"
-    "${DERIVED_SOURCES_DIR}/ForwardingHeaders"
+    "${FORWARDING_HEADERS_DIR}"
     "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}"
     "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector"
 )
@@ -55,15 +54,19 @@ set(JavaScriptCore_SOURCES
     API/JSCallbackObject.cpp
     API/JSClassRef.cpp
     API/JSContextRef.cpp
+    API/JSHeapFinalizerPrivate.cpp
+    API/JSMarkingConstraintPrivate.cpp
     API/JSObjectRef.cpp
     API/JSTypedArray.cpp
     API/JSScriptRef.cpp
     API/JSStringRef.cpp
     API/JSValueRef.cpp
     API/JSWeakObjectMapRefPrivate.cpp
+    API/JSWeakPrivate.cpp
     API/OpaqueJSString.cpp
 
     assembler/ARMAssembler.cpp
+    assembler/AbstractMacroAssembler.cpp
     assembler/LinkBuffer.cpp
     assembler/MacroAssembler.cpp
     assembler/MacroAssemblerARM.cpp
@@ -71,37 +74,46 @@ set(JavaScriptCore_SOURCES
     assembler/MacroAssemblerCodeRef.cpp
     assembler/MacroAssemblerPrinter.cpp
     assembler/MacroAssemblerX86Common.cpp
+    assembler/Printer.cpp
 
-    b3/air/AirAllocateStack.cpp
+    b3/air/AirAllocateRegistersAndStackByLinearScan.cpp
+    b3/air/AirAllocateRegistersByGraphColoring.cpp
+    b3/air/AirAllocateStackByGraphColoring.cpp
     b3/air/AirArg.cpp
     b3/air/AirBasicBlock.cpp
+    b3/air/AirBlockInsertionSet.cpp
+    b3/air/AirBreakCriticalEdges.cpp
     b3/air/AirCCallSpecial.cpp
     b3/air/AirCCallingConvention.cpp
     b3/air/AirCode.cpp
     b3/air/AirCustom.cpp
-    b3/air/AirDumpAsJS.cpp
+    b3/air/AirDisassembler.cpp
     b3/air/AirEliminateDeadCode.cpp
     b3/air/AirEmitShuffle.cpp
     b3/air/AirFixObviousSpills.cpp
     b3/air/AirFixPartialRegisterStalls.cpp
+    b3/air/AirFixSpillsAfterTerminals.cpp
     b3/air/AirGenerate.cpp
     b3/air/AirGenerated.cpp
     b3/air/AirHandleCalleeSaves.cpp
     b3/air/AirInsertionSet.cpp
     b3/air/AirInst.cpp
-    b3/air/AirIteratedRegisterCoalescing.cpp
     b3/air/AirKind.cpp
     b3/air/AirLogRegisterPressure.cpp
     b3/air/AirLowerAfterRegAlloc.cpp
     b3/air/AirLowerEntrySwitch.cpp
     b3/air/AirLowerMacros.cpp
+    b3/air/AirLowerStackArgs.cpp
     b3/air/AirOptimizeBlockOrder.cpp
     b3/air/AirPadInterference.cpp
+    b3/air/AirPhaseInsertionSet.cpp
     b3/air/AirPhaseScope.cpp
+    b3/air/AirPrintSpecial.cpp
+    b3/air/AirRegLiveness.cpp
     b3/air/AirReportUsedRegisters.cpp
     b3/air/AirSimplifyCFG.cpp
     b3/air/AirSpecial.cpp
-    b3/air/AirSpillEverything.cpp
+    b3/air/AirStackAllocation.cpp
     b3/air/AirStackSlot.cpp
     b3/air/AirStackSlotKind.cpp
     b3/air/AirTmp.cpp
@@ -109,6 +121,8 @@ set(JavaScriptCore_SOURCES
     b3/air/AirValidate.cpp
 
     b3/B3ArgumentRegValue.cpp
+    b3/B3AtomicValue.cpp
+    b3/B3Bank.cpp
     b3/B3BasicBlock.cpp
     b3/B3BlockInsertionSet.cpp
     b3/B3BreakCriticalEdges.cpp
@@ -134,7 +148,6 @@ set(JavaScriptCore_SOURCES
     b3/B3FoldPathConstants.cpp
     b3/B3FrequencyClass.cpp
     b3/B3Generate.cpp
-    b3/B3HeapRange.cpp
     b3/B3InferSwitches.cpp
     b3/B3InsertionSet.cpp
     b3/B3Kind.cpp
@@ -174,9 +187,11 @@ set(JavaScriptCore_SOURCES
     b3/B3ValueKey.cpp
     b3/B3ValueRep.cpp
     b3/B3Variable.cpp
+    b3/B3VariableLiveness.cpp
     b3/B3VariableValue.cpp
     b3/B3WasmAddressValue.cpp
     b3/B3WasmBoundsCheckValue.cpp
+    b3/B3Width.cpp
 
     bindings/ScriptFunctionCall.cpp
     bindings/ScriptObject.cpp
@@ -185,11 +200,14 @@ set(JavaScriptCore_SOURCES
     builtins/BuiltinExecutables.cpp
     builtins/BuiltinExecutableCreator.cpp
 
+    bytecode/AccessCase.cpp
+    bytecode/AccessCaseSnippetParams.cpp
     bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp
     bytecode/ArithProfile.cpp
     bytecode/ArrayAllocationProfile.cpp
     bytecode/ArrayProfile.cpp
     bytecode/BytecodeBasicBlock.cpp
+    bytecode/BytecodeDumper.cpp
     bytecode/BytecodeGeneratorification.cpp
     bytecode/BytecodeIntrinsicRegistry.cpp
     bytecode/BytecodeLivenessAnalysis.cpp
@@ -206,7 +224,6 @@ set(JavaScriptCore_SOURCES
     bytecode/CodeType.cpp
     bytecode/ComplexGetStatus.cpp
     bytecode/DFGExitProfile.cpp
-    bytecode/DOMJITAccessCasePatchpointParams.cpp
     bytecode/DataFormat.cpp
     bytecode/DeferredCompilationCallback.cpp
     bytecode/DeferredSourceDump.cpp
@@ -215,16 +232,20 @@ set(JavaScriptCore_SOURCES
     bytecode/ExecutionCounter.cpp
     bytecode/ExitKind.cpp
     bytecode/ExitingJITType.cpp
+    bytecode/FullCodeOrigin.cpp
     bytecode/FunctionCodeBlock.cpp
     bytecode/GetByIdStatus.cpp
     bytecode/GetByIdVariant.cpp
+    bytecode/GetterSetterAccessCase.cpp
     bytecode/InlineAccess.cpp
     bytecode/InlineCallFrame.cpp
     bytecode/InlineCallFrameSet.cpp
+    bytecode/IntrinsicGetterAccessCase.cpp
     bytecode/JumpTable.cpp
     bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
     bytecode/LazyOperandValueProfile.cpp
     bytecode/MethodOfGettingAValueProfile.cpp
+    bytecode/ModuleNamespaceAccessCase.cpp
     bytecode/ModuleProgramCodeBlock.cpp
     bytecode/ObjectPropertyCondition.cpp
     bytecode/ObjectPropertyConditionSet.cpp
@@ -233,6 +254,7 @@ set(JavaScriptCore_SOURCES
     bytecode/PreciseJumpTargets.cpp
     bytecode/ProgramCodeBlock.cpp
     bytecode/PropertyCondition.cpp
+    bytecode/ProxyableAccessCase.cpp
     bytecode/PutByIdFlags.cpp
     bytecode/PutByIdStatus.cpp
     bytecode/PutByIdVariant.cpp
@@ -300,7 +322,6 @@ set(JavaScriptCore_SOURCES
     dfg/DFGConstantHoistingPhase.cpp
     dfg/DFGCriticalEdgeBreakingPhase.cpp
     dfg/DFGDCEPhase.cpp
-    dfg/DFGDOMJITPatchpointParams.cpp
     dfg/DFGDesiredIdentifiers.cpp
     dfg/DFGDesiredTransitions.cpp
     dfg/DFGDesiredWatchpoints.cpp
@@ -335,7 +356,6 @@ set(JavaScriptCore_SOURCES
     dfg/DFGLazyJSValue.cpp
     dfg/DFGLazyNode.cpp
     dfg/DFGLivenessAnalysisPhase.cpp
-    dfg/DFGLongLivedState.cpp
     dfg/DFGLoopPreHeaderCreationPhase.cpp
     dfg/DFGMaximalFlushInsertionPhase.cpp
     dfg/DFGMayExit.cpp
@@ -379,6 +399,7 @@ set(JavaScriptCore_SOURCES
     dfg/DFGSSAConversionPhase.cpp
     dfg/DFGSSALoweringPhase.cpp
     dfg/DFGSafepoint.cpp
+    dfg/DFGSnippetParams.cpp
     dfg/DFGSpeculativeJIT.cpp
     dfg/DFGSpeculativeJIT32_64.cpp
     dfg/DFGSpeculativeJIT64.cpp
@@ -436,7 +457,6 @@ set(JavaScriptCore_SOURCES
     ftl/FTLCapabilities.cpp
     ftl/FTLCommonValues.cpp
     ftl/FTLCompile.cpp
-    ftl/FTLDOMJITPatchpointParams.cpp
     ftl/FTLExceptionTarget.cpp
     ftl/FTLExitArgument.cpp
     ftl/FTLExitArgumentForOperand.cpp
@@ -462,6 +482,7 @@ set(JavaScriptCore_SOURCES
     ftl/FTLSaveRestore.cpp
     ftl/FTLSlowPathCall.cpp
     ftl/FTLSlowPathCallKey.cpp
+    ftl/FTLSnippetParams.cpp
     ftl/FTLState.cpp
     ftl/FTLThunks.cpp
     ftl/FTLValueRange.cpp
@@ -470,6 +491,7 @@ set(JavaScriptCore_SOURCES
     heap/CellContainer.cpp
     heap/CodeBlockSet.cpp
     heap/CollectionScope.cpp
+    heap/CollectorPhase.cpp
     heap/ConservativeRoots.cpp
     heap/DeferGC.cpp
     heap/DestructionMode.cpp
@@ -477,22 +499,21 @@ set(JavaScriptCore_SOURCES
     heap/FullGCActivityCallback.cpp
     heap/FreeList.cpp
     heap/GCActivityCallback.cpp
+    heap/GCConductor.cpp
     heap/GCLogging.cpp
+    heap/GCRequest.cpp
     heap/HandleSet.cpp
     heap/HandleStack.cpp
     heap/Heap.cpp
     heap/HeapCell.cpp
+    heap/HeapFinalizerCallback.cpp
     heap/HeapHelperPool.cpp
     heap/HeapProfiler.cpp
     heap/HeapSnapshot.cpp
     heap/HeapSnapshotBuilder.cpp
-    heap/HeapStatistics.cpp
-    heap/HeapTimer.cpp
-    heap/HeapVerifier.cpp
     heap/IncrementalSweeper.cpp
     heap/JITStubRoutineSet.cpp
     heap/LargeAllocation.cpp
-    heap/LiveObjectList.cpp
     heap/MachineStackMarker.cpp
     heap/MarkStack.cpp
     heap/MarkedAllocator.cpp
@@ -508,6 +529,7 @@ set(JavaScriptCore_SOURCES
     heap/StopIfNecessaryTimer.cpp
     heap/Subspace.cpp
     heap/SynchronousStopTheWorldMutatorScheduler.cpp
+    heap/Synchronousness.cpp
     heap/VisitRaceKey.cpp
     heap/Weak.cpp
     heap/WeakBlock.cpp
@@ -572,7 +594,6 @@ set(JavaScriptCore_SOURCES
     jit/CallFrameShuffler64.cpp
     jit/ExecutableAllocationFuzz.cpp
     jit/ExecutableAllocator.cpp
-    jit/ExecutableAllocatorFixedVMPool.cpp
     jit/GCAwareJITStubRoutine.cpp
     jit/GPRInfo.cpp
     jit/HostCallReturnValue.cpp
@@ -661,7 +682,6 @@ set(JavaScriptCore_SOURCES
     runtime/ArrayBufferView.cpp
     runtime/ArrayConstructor.cpp
     runtime/ArrayConventions.cpp
-    runtime/ArrayIteratorAdaptiveWatchpoint.cpp
     runtime/ArrayIteratorPrototype.cpp
     runtime/ArrayPrototype.cpp
     runtime/AtomicsObject.cpp
@@ -673,6 +693,7 @@ set(JavaScriptCore_SOURCES
     runtime/BooleanPrototype.cpp
     runtime/CallData.cpp
     runtime/CatchScope.cpp
+    runtime/ClassInfo.cpp
     runtime/ClonedArguments.cpp
     runtime/CodeCache.cpp
     runtime/CodeSpecializationKind.cpp
@@ -681,6 +702,7 @@ set(JavaScriptCore_SOURCES
     runtime/CommonSlowPathsExceptions.cpp
     runtime/CompilationResult.cpp
     runtime/Completion.cpp
+    runtime/ConfigFile.cpp
     runtime/ConsoleClient.cpp
     runtime/ConsoleObject.cpp
     runtime/ConstantMode.cpp
@@ -695,6 +717,7 @@ set(JavaScriptCore_SOURCES
     runtime/DirectArguments.cpp
     runtime/DirectArgumentsOffset.cpp
     runtime/DirectEvalExecutable.cpp
+    runtime/DisallowVMReentry.cpp
     runtime/DumpContext.cpp
     runtime/ECMAScriptSpecInternalFunctions.cpp
     runtime/Error.cpp
@@ -729,6 +752,7 @@ set(JavaScriptCore_SOURCES
     runtime/InitializeThreading.cpp
     runtime/InspectorInstrumentationObject.cpp
     runtime/InternalFunction.cpp
+    runtime/Intrinsic.cpp
     runtime/IntlCollator.cpp
     runtime/IntlCollatorConstructor.cpp
     runtime/IntlCollatorPrototype.cpp
@@ -786,12 +810,15 @@ set(JavaScriptCore_SOURCES
     runtime/JSPromiseDeferred.cpp
     runtime/JSPromisePrototype.cpp
     runtime/JSPropertyNameEnumerator.cpp
-    runtime/JSPropertyNameIterator.cpp
     runtime/JSProxy.cpp
+    runtime/JSRunLoopTimer.cpp
     runtime/JSScope.cpp
+    runtime/JSScriptFetcher.cpp
     runtime/JSSegmentedVariableObject.cpp
+    runtime/JSSegmentedVariableObjectSubspace.cpp
     runtime/JSSet.cpp
     runtime/JSSetIterator.cpp
+    runtime/JSSourceCode.cpp
     runtime/JSString.cpp
     runtime/JSStringIterator.cpp
     runtime/JSStringJoiner.cpp
@@ -810,7 +837,6 @@ set(JavaScriptCore_SOURCES
     runtime/LazyClassStructure.cpp
     runtime/LiteralParser.cpp
     runtime/Lookup.cpp
-    runtime/MapBase.cpp
     runtime/MapConstructor.cpp
     runtime/MapIteratorPrototype.cpp
     runtime/MapPrototype.cpp
@@ -830,10 +856,12 @@ set(JavaScriptCore_SOURCES
     runtime/NumberObject.cpp
     runtime/NumberPrototype.cpp
     runtime/ObjectConstructor.cpp
+    runtime/ObjectInitializationScope.cpp
     runtime/ObjectPrototype.cpp
     runtime/Operations.cpp
     runtime/Options.cpp
     runtime/ProgramExecutable.cpp
+    runtime/PromiseDeferredTimer.cpp
     runtime/PropertyDescriptor.cpp
     runtime/PropertySlot.cpp
     runtime/PropertyTable.cpp
@@ -892,6 +920,7 @@ set(JavaScriptCore_SOURCES
     runtime/TypeofType.cpp
     runtime/VM.cpp
     runtime/VMEntryScope.cpp
+    runtime/VMTraps.cpp
     runtime/VarOffset.cpp
     runtime/Watchdog.cpp
     runtime/WeakMapConstructor.cpp
@@ -900,10 +929,12 @@ set(JavaScriptCore_SOURCES
     runtime/WeakSetConstructor.cpp
     runtime/WeakSetPrototype.cpp
 
+    tools/CellList.cpp
     tools/CodeProfile.cpp
     tools/CodeProfiling.cpp
     tools/FunctionOverrides.cpp
     tools/FunctionWhitelist.cpp
+    tools/HeapVerifier.cpp
     tools/JSDollarVM.cpp
     tools/JSDollarVMPrototype.cpp
     tools/SigillCrashAnalyzer.cpp
@@ -911,18 +942,36 @@ set(JavaScriptCore_SOURCES
 
     wasm/JSWebAssembly.cpp
     wasm/WasmB3IRGenerator.cpp
+    wasm/WasmBBQPlan.cpp
     wasm/WasmBinding.cpp
+    wasm/WasmCallee.cpp
     wasm/WasmCallingConvention.cpp
+    wasm/WasmCodeBlock.cpp
+    wasm/WasmContext.cpp
+    wasm/WasmFaultSignalHandler.cpp
     wasm/WasmFormat.cpp
+    wasm/WasmIndexOrName.cpp
+    wasm/WasmMachineThreads.cpp
     wasm/WasmMemory.cpp
     wasm/WasmMemoryInformation.cpp
+    wasm/WasmModule.cpp
+    wasm/WasmModuleInformation.cpp
     wasm/WasmModuleParser.cpp
+    wasm/WasmNameSectionParser.cpp
+    wasm/WasmOMGPlan.cpp
+    wasm/WasmOpcodeOrigin.cpp
+    wasm/WasmPageCount.cpp
     wasm/WasmPlan.cpp
+    wasm/WasmSignature.cpp
+    wasm/WasmThunks.cpp
     wasm/WasmValidate.cpp
+    wasm/WasmWorklist.cpp
 
-    wasm/js/JSWebAssemblyCallee.cpp
+    wasm/js/JSWebAssemblyCodeBlock.cpp
+    wasm/js/JSWebAssemblyCodeBlockSubspace.cpp
     wasm/js/JSWebAssemblyCompileError.cpp
     wasm/js/JSWebAssemblyInstance.cpp
+    wasm/js/JSWebAssemblyLinkError.cpp
     wasm/js/JSWebAssemblyMemory.cpp
     wasm/js/JSWebAssemblyModule.cpp
     wasm/js/JSWebAssemblyRuntimeError.cpp
@@ -930,8 +979,11 @@ set(JavaScriptCore_SOURCES
     wasm/js/WebAssemblyCompileErrorConstructor.cpp
     wasm/js/WebAssemblyCompileErrorPrototype.cpp
     wasm/js/WebAssemblyFunction.cpp
+    wasm/js/WebAssemblyFunctionBase.cpp
     wasm/js/WebAssemblyInstanceConstructor.cpp
     wasm/js/WebAssemblyInstancePrototype.cpp
+    wasm/js/WebAssemblyLinkErrorConstructor.cpp
+    wasm/js/WebAssemblyLinkErrorPrototype.cpp
     wasm/js/WebAssemblyMemoryConstructor.cpp
     wasm/js/WebAssemblyMemoryPrototype.cpp
     wasm/js/WebAssemblyModuleConstructor.cpp
@@ -943,6 +995,7 @@ set(JavaScriptCore_SOURCES
     wasm/js/WebAssemblyTableConstructor.cpp
     wasm/js/WebAssemblyTablePrototype.cpp
     wasm/js/WebAssemblyToJSCallee.cpp
+    wasm/js/WebAssemblyWrapperFunction.cpp
 
     yarr/RegularExpression.cpp
     yarr/YarrCanonicalizeUCS2.cpp
@@ -999,6 +1052,8 @@ set(JavaScriptCore_OBJECT_LUT_SOURCES
     wasm/js/WebAssemblyCompileErrorPrototype.cpp
     wasm/js/WebAssemblyInstanceConstructor.cpp
     wasm/js/WebAssemblyInstancePrototype.cpp
+    wasm/js/WebAssemblyLinkErrorConstructor.cpp
+    wasm/js/WebAssemblyLinkErrorPrototype.cpp
     wasm/js/WebAssemblyMemoryConstructor.cpp
     wasm/js/WebAssemblyMemoryPrototype.cpp
     wasm/js/WebAssemblyModuleConstructor.cpp
@@ -1028,7 +1083,7 @@ set(JavaScriptCore_SCRIPTS_SOURCES_PATHS
 )
 
 # Force JavaScriptCore to run scripts from the same staging path as WebCore.
-set(JavaScriptCore_SCRIPTS_DIR "${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore/Scripts")
+set(JavaScriptCore_SCRIPTS_DIR "${FORWARDING_HEADERS_DIR}/JavaScriptCore/Scripts")
 
 file(MAKE_DIRECTORY ${JavaScriptCore_SCRIPTS_DIR})
 
@@ -1084,7 +1139,6 @@ set(OFFLINE_ASM
     offlineasm/risc.rb
     offlineasm/self_hash.rb
     offlineasm/settings.rb
-    offlineasm/sh4.rb
     offlineasm/transform.rb
     offlineasm/x86.rb
 )
@@ -1150,15 +1204,20 @@ add_custom_command(
 # since it is used in the add_library() call at the end of this file.
 if (MSVC)
     enable_language(ASM_MASM)
-    list(APPEND JavaScriptCore_SOURCES
-        ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
-    )
-    # Win32 needs /safeseh with assembly, but Win64 does not.
     if (CMAKE_SIZEOF_VOID_P EQUAL 4)
-        set_source_files_properties(${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
-            PROPERTIES COMPILE_FLAGS  "/safeseh"
-        )
+        # Win32 needs /safeseh with assembly, but Win64 does not.
+        set(MASM_EXECUTABLE ml)
+        set(LLINT_MASM_FLAGS /safeseh /c /Fo)
+    else ()
+        set(MASM_EXECUTABLE ml64)
+        set(LLINT_MASM_FLAGS /c /Fo)
     endif ()
+    add_custom_command(
+        OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.obj
+        DEPENDS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
+        COMMAND ${MASM_EXECUTABLE} ${LLINT_MASM_FLAGS} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.obj ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
+        VERBATIM)
+    list(APPEND JavaScriptCore_SOURCES ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.obj)
 else ()
     list(APPEND JavaScriptCore_HEADERS
         ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntAssembly.h
@@ -1167,19 +1226,19 @@ endif ()
 
 # WebAssembly generator
 
-macro(GENERATE_PYTHON _generator _input _output)
+macro(GENERATE_PYTHON _generator _additional_deps _input _output)
     add_custom_command(
         OUTPUT ${_output}
         MAIN_DEPENDENCY ${_generator}
-        DEPENDS ${_input}
+        DEPENDS ${_input} ${_additional_deps}
         COMMAND ${PYTHON_EXECUTABLE} ${_generator} ${_input} ${_output}
         VERBATIM)
     list(APPEND JavaScriptCore_HEADERS ${_output})
     ADD_SOURCE_DEPENDENCIES(${_input} ${_output})
 endmacro()
-GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmOpsHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmOps.h)
-GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmValidateInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmValidateInlines.h)
-GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmB3IRGeneratorInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmB3IRGeneratorInlines.h)
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmOpsHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasm.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmOps.h)
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmValidateInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasm.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmValidateInlines.h)
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmB3IRGeneratorInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasm.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmB3IRGeneratorInlines.h)
 
 # LUT generator
 
@@ -1219,8 +1278,8 @@ set(JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES
     llint
     parser
     profiler
-    replay
     runtime
+    wasm
     yarr
 
     collector/handles
@@ -1228,6 +1287,8 @@ set(JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES
     inspector/agents
     inspector/augmentable
     inspector/remote
+
+    wasm/js
 )
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
@@ -1286,6 +1347,7 @@ set(JavaScriptCore_INSPECTOR_PROTOCOL_SCRIPTS
 set(JavaScriptCore_INSPECTOR_DOMAINS
     ${JAVASCRIPTCORE_DIR}/inspector/protocol/ApplicationCache.json
     ${JAVASCRIPTCORE_DIR}/inspector/protocol/CSS.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Canvas.json
     ${JAVASCRIPTCORE_DIR}/inspector/protocol/Console.json
     ${JAVASCRIPTCORE_DIR}/inspector/protocol/DOM.json
     ${JAVASCRIPTCORE_DIR}/inspector/protocol/DOMDebugger.json
@@ -1317,12 +1379,6 @@ if (ENABLE_RESOURCE_USAGE)
     )
 endif ()
 
-if (ENABLE_WEB_REPLAY)
-    list(APPEND JavaScriptCore_INSPECTOR_DOMAINS
-        ${JAVASCRIPTCORE_DIR}/inspector/protocol/Replay.json
-    )
-endif ()
-
 add_custom_command(
     OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/CombinedDomains.json
     MAIN_DEPENDENCY ${JavaScriptCore_SCRIPTS_DIR}/generate-combined-inspector-json.py
@@ -1442,23 +1498,6 @@ add_custom_command(
 
 list(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.h)
 
-# Web Replay inputs generator
-if (ENABLE_WEB_REPLAY)
-    set(JavaScript_WEB_REPLAY_INPUTS ${CMAKE_CURRENT_SOURCE_DIR}/replay/JSInputs.json)
-    add_custom_command(
-        OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.cpp
-        MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/replay/scripts/CodeGeneratorReplayInputs.py
-        DEPENDS ${JavaScript_WEB_REPLAY_INPUTS}
-        COMMAND ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/replay/scripts/CodeGeneratorReplayInputs.py --outputDir ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/ --framework JavaScriptCore ${JavaScript_WEB_REPLAY_INPUTS}
-        VERBATIM)
-
-    list(APPEND JavaScriptCore_SOURCES
-        replay/EncodedValue.cpp
-        ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.cpp
-    )
-    list(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.h)
-endif ()
-
 if (WTF_CPU_ARM)
 elseif (WTF_CPU_ARM64)
 elseif (WTF_CPU_HPPA)
@@ -1484,7 +1523,7 @@ else ()
     message(FATAL_ERROR "Unknown CPU")
 endif ()
 
-
+WEBKIT_FRAMEWORK_DECLARE(JavaScriptCore)
 WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 WEBKIT_CREATE_FORWARDING_HEADERS(JavaScriptCore DIRECTORIES ${JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES} FILES ${JavaScriptCore_FORWARDING_HEADERS_FILES})

Configurations/Base.xcconfig

@@ -1,4 +1,4 @@
-// Copyright (C) 2009, 2010, 2011, 2013, 2014 Apple Inc. All rights reserved.
+// Copyright (C) 2009-2017 Apple Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions
@@ -28,6 +28,8 @@ USE_INTERNAL_SDK_Production = YES;
 USE_INTERNAL_SDK_Debug = $(HAVE_INTERNAL_SDK);
 USE_INTERNAL_SDK_Release = $(HAVE_INTERNAL_SDK);
 
+ALWAYS_SEARCH_USER_PATHS = NO;
+
 CLANG_CXX_LANGUAGE_STANDARD = gnu++14;
 CLANG_CXX_LIBRARY = libc++;
 CLANG_WARN_BOOL_CONVERSION = YES;
@@ -55,7 +57,7 @@ GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
 GCC_NO_COMMON_BLOCKS = YES;
 GCC_OBJC_CALL_CXX_CDTORS = YES;
 GCC_PRECOMPILE_PREFIX_HEADER = YES;
-GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) $(inherited);
+GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) U_HIDE_DEPRECATED_API U_DISABLE_RENAMING=1 U_SHOW_CPLUSPLUS_API=0 $(inherited);
 GCC_STRICT_ALIASING = YES;
 GCC_THREADSAFE_STATICS = NO;
 GCC_TREAT_WARNINGS_AS_ERRORS = YES;
@@ -67,6 +69,7 @@ GCC_WARN_64_TO_32_BIT_CONVERSION_armv7 = YES;
 GCC_WARN_64_TO_32_BIT_CONVERSION_armv7k = YES;
 GCC_WARN_64_TO_32_BIT_CONVERSION_armv7s = YES;
 GCC_WARN_64_TO_32_BIT_CONVERSION_arm64 = NO;
+GCC_WARN_64_TO_32_BIT_CONVERSION_arm64e = NO;
 GCC_WARN_64_TO_32_BIT_CONVERSION_i386 = YES;
 GCC_WARN_64_TO_32_BIT_CONVERSION_x86_64 = NO;
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
@@ -83,19 +86,13 @@ CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
 PREBINDING = NO;
 WARNING_CFLAGS = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare -Wimplicit-fallthrough;
 
-LLVM_LOCAL_HEADER_PATH[sdk=macosx*] = "$(BUILT_PRODUCTS_DIR)/usr/local/LLVMForJavaScriptCore/include";
-LLVM_LOCAL_HEADER_PATH[sdk=iphoneos*] = "$(BUILT_PRODUCTS_DIR)/usr/local/include";
-
-LLVM_SYSTEM_HEADER_PATH[sdk=macosx*] = /usr/local/LLVMForJavaScriptCore/include;
-LLVM_SYSTEM_HEADER_PATH[sdk=iphoneos*] = /usr/local/include;
-
-HEADER_SEARCH_PATHS = . $(LLVM_LOCAL_HEADER_PATH) "${BUILT_PRODUCTS_DIR}/ExtraIncludesForLocalLLVMBuild" $(LLVM_SYSTEM_HEADER_PATH) "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
+HEADER_SEARCH_PATHS = . "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 
 TARGET_MAC_OS_X_VERSION_MAJOR = $(TARGET_MAC_OS_X_VERSION_MAJOR$(MACOSX_DEPLOYMENT_TARGET:suffix:identifier));
-TARGET_MAC_OS_X_VERSION_MAJOR_10 = 101000;
 TARGET_MAC_OS_X_VERSION_MAJOR_11 = 101100;
 TARGET_MAC_OS_X_VERSION_MAJOR_12 = 101200;
 TARGET_MAC_OS_X_VERSION_MAJOR_13 = 101300;
+TARGET_MAC_OS_X_VERSION_MAJOR_14 = 101400;
 
 AD_HOC_CODE_SIGNING_ALLOWED = YES;
 CODE_SIGN_IDENTITY = -;
@@ -103,8 +100,8 @@ CODE_SIGN_IDENTITY = -;
 SUPPORTED_PLATFORMS = iphoneos iphonesimulator macosx appletvos appletvsimulator watchos watchsimulator;
 
 WK_XCODE_SUPPORTS_TEXT_BASED_STUBS = $(WK_NOT_$(WK_EMPTY_$(TAPI_VERIFY_MODE)));
-WK_PRIVATE_FRAMEWORK_STUBS_DIR[sdk=iphoneos*] = $(WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphoneos_$(WK_XCODE_SUPPORTS_TEXT_BASED_STUBS)_$(USE_INTERNAL_SDK));
-WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphoneos_YES_ = $(SRCROOT)/../../WebKitLibraries/WebKitPrivateFrameworkStubs/iOS/$(IPHONEOS_DEPLOYMENT_TARGET:base);
+WK_PRIVATE_FRAMEWORK_STUBS_DIR[sdk=iphone*] = $(WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphone_$(WK_XCODE_SUPPORTS_TEXT_BASED_STUBS)_$(USE_INTERNAL_SDK));
+WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphone_YES_ = $(SRCROOT)/../../WebKitLibraries/WebKitPrivateFrameworkStubs/iOS/$(IPHONEOS_DEPLOYMENT_TARGET:base);
 
 FRAMEWORK_SEARCH_PATHS = $(WK_QUOTED_OVERRIDE_FRAMEWORKS_DIR) $(WK_PRIVATE_FRAMEWORK_STUBS_DIR);
 
@@ -140,8 +137,8 @@ DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
 
 SDKROOT = macosx.internal;
 
-OTHER_CFLAGS = $(ASAN_OTHER_CFLAGS) -isystem icu;
-OTHER_CPLUSPLUSFLAGS = $(ASAN_OTHER_CPLUSPLUSFLAGS) -isystem icu;
+OTHER_CFLAGS = $(ASAN_OTHER_CFLAGS);
+OTHER_CPLUSPLUSFLAGS = $(ASAN_OTHER_CPLUSPLUSFLAGS) -isystem $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders;
 OTHER_LDFLAGS = $(ASAN_OTHER_LDFLAGS);
 
 WK_EMPTY_ = YES;

Configurations/DebugRelease.xcconfig

@@ -30,10 +30,10 @@ ONLY_ACTIVE_ARCH = YES;
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-MACOSX_DEPLOYMENT_TARGET_macosx_101000 = 10.10;
 MACOSX_DEPLOYMENT_TARGET_macosx_101100 = 10.11;
 MACOSX_DEPLOYMENT_TARGET_macosx_101200 = 10.12;
 MACOSX_DEPLOYMENT_TARGET_macosx_101300 = 10.13;
+MACOSX_DEPLOYMENT_TARGET_macosx_101400 = 10.14;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 DEBUG_INFORMATION_FORMAT = dwarf;
@@ -41,3 +41,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 SDKROOT = $(SDKROOT_$(USE_INTERNAL_SDK));
 SDKROOT_ = macosx;
 SDKROOT_YES = macosx.internal;
+
+WK_CCACHE_DIR = $(SRCROOT)/../../Tools/ccache;
+#include "../../../Tools/ccache/ccache.xcconfig"

Configurations/FeatureDefines.xcconfig

@@ -1,4 +1,4 @@
-// Copyright (C) 2009, 2010, 2014, 2015, 2016 Apple Inc. All rights reserved.
+// Copyright (C) 2009-2017 Apple Inc. All rights reserved.
 // Copyright (C) 2009 Google Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
@@ -32,18 +32,19 @@
 // Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
 
 TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000 = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_101000 = YES;
 TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_101100 = YES;
 
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000 = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000_101100 = YES;
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000_101200 = YES;
+
 ENABLE_3D_TRANSFORMS = ENABLE_3D_TRANSFORMS;
 ENABLE_ACCELERATED_2D_CANVAS = ;
 ENABLE_ACCELERATED_OVERFLOW_SCROLLING[sdk=iphone*] = ENABLE_ACCELERATED_OVERFLOW_SCROLLING;
 
-ENABLE_APPLE_PAY[sdk=embedded*] = $(ENABLE_APPLE_PAY_$(PLATFORM_NAME));
+ENABLE_APPLE_PAY[sdk=iphone*] = $(ENABLE_APPLE_PAY_$(PLATFORM_NAME));
 ENABLE_APPLE_PAY_iphoneos = ENABLE_APPLE_PAY;
 ENABLE_APPLE_PAY_iphonesimulator = ENABLE_APPLE_PAY;
-ENABLE_APPLE_PAY[sdk=iphoneos9*] = ;
-ENABLE_APPLE_PAY[sdk=iphonesimulator9*] = ;
 
 DISABLE_APPLE_PAY_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000);
 ENABLE_APPLE_PAY[sdk=macosx*] = $(ENABLE_APPLE_PAY_IF_NOT_$(DISABLE_APPLE_PAY_macosx));
@@ -51,6 +52,18 @@ ENABLE_APPLE_PAY_IF_NOT_ = $(ENABLE_APPLE_PAY_IF_NOT_NO);
 ENABLE_APPLE_PAY_IF_NOT_NO = ENABLE_APPLE_PAY;
 ENABLE_APPLE_PAY_IF_NOT_YES = ;
 
+ENABLE_APPLE_PAY_SESSION_V3[sdk=iphone*] = $(ENABLE_APPLE_PAY_SESSION_V3_$(PLATFORM_NAME));
+ENABLE_APPLE_PAY_SESSION_V3_iphoneos = ENABLE_APPLE_PAY_SESSION_V3;
+ENABLE_APPLE_PAY_SESSION_V3_iphonesimulator = ENABLE_APPLE_PAY_SESSION_V3;
+ENABLE_APPLE_PAY_SESSION_V3[sdk=iphoneos10*] = ;
+ENABLE_APPLE_PAY_SESSION_V3[sdk=iphonesimulator10*] = ;
+
+DISABLE_APPLE_PAY_SESSION_V3_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000);
+ENABLE_APPLE_PAY_SESSION_V3[sdk=macosx*] = $(ENABLE_APPLE_PAY_SESSION_V3_IF_NOT_$(DISABLE_APPLE_PAY_SESSION_V3_macosx));
+ENABLE_APPLE_PAY_SESSION_V3_IF_NOT_ = $(ENABLE_APPLE_PAY_SESSION_V3_IF_NOT_NO);
+ENABLE_APPLE_PAY_SESSION_V3_IF_NOT_NO = ENABLE_APPLE_PAY_SESSION_V3;
+ENABLE_APPLE_PAY_SESSION_V3_IF_NOT_YES = ;
+
 ENABLE_ATTACHMENT_ELEMENT = ENABLE_ATTACHMENT_ELEMENT;
 ENABLE_AVF_CAPTIONS = ENABLE_AVF_CAPTIONS;
 ENABLE_CACHE_PARTITIONING = ENABLE_CACHE_PARTITIONING;
@@ -61,38 +74,33 @@ ENABLE_ENCRYPTED_MEDIA = ;
 ENABLE_CONTENT_FILTERING[sdk=appletv*] = ;
 ENABLE_CONTENT_FILTERING[sdk=iphone*] = ENABLE_CONTENT_FILTERING;
 ENABLE_CONTENT_FILTERING[sdk=macosx*] = ENABLE_CONTENT_FILTERING;
-ENABLE_CSP_NEXT = ;
 ENABLE_CSS_ANIMATIONS_LEVEL_2 = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_DEVICE_ADAPTATION = ;
-ENABLE_CSS_GRID_LAYOUT = ENABLE_CSS_GRID_LAYOUT;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
-ENABLE_CSS_SELECTORS_LEVEL4 = ;
+ENABLE_CSS_SELECTORS_LEVEL4 = ENABLE_CSS_SELECTORS_LEVEL4;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CURSOR_VISIBILITY = ENABLE_CURSOR_VISIBILITY;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT[sdk=macosx*] = ENABLE_DASHBOARD_SUPPORT;
 ENABLE_DATALIST_ELEMENT = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
-ENABLE_DETAILS_ELEMENT = ENABLE_DETAILS_ELEMENT;
 ENABLE_DEVICE_ORIENTATION[sdk=iphone*] = ENABLE_DEVICE_ORIENTATION;
 ENABLE_FETCH_API = ENABLE_FETCH_API;
 ENABLE_FILTERS_LEVEL_2 = ENABLE_FILTERS_LEVEL_2;
-ENABLE_FONT_LOAD_EVENTS = ;
 ENABLE_FULLSCREEN_API[sdk=macosx*] = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ENABLE_GAMEPAD;
 ENABLE_GAMEPAD[sdk=watch*] = ;
 ENABLE_GAMEPAD_DEPRECATED = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
 ENABLE_ICONDATABASE[sdk=macosx*] = ENABLE_ICONDATABASE;
-ENABLE_INTERSECTION_OBSERVER = ;
+ENABLE_INTERSECTION_OBSERVER = ENABLE_INTERSECTION_OBSERVER;
 ENABLE_SERVICE_CONTROLS[sdk=macosx*] = ENABLE_SERVICE_CONTROLS;
 ENABLE_INDEXED_DATABASE = ENABLE_INDEXED_DATABASE;
 ENABLE_INDEXED_DATABASE_IN_WORKERS = ENABLE_INDEXED_DATABASE_IN_WORKERS;
-ENABLE_INDIE_UI = ;
 ENABLE_INPUT_TYPE_COLOR[sdk=macosx*] = ;
 ENABLE_INPUT_TYPE_COLOR_POPOVER[sdk=macosx*] = ;
 ENABLE_INPUT_TYPE_DATE[sdk=iphone*] = ENABLE_INPUT_TYPE_DATE;
@@ -104,12 +112,7 @@ ENABLE_INPUT_TYPE_WEEK[sdk=iphone*] = ENABLE_INPUT_TYPE_WEEK;
 
 ENABLE_INSPECTOR_ALTERNATE_DISPATCHERS = ENABLE_INSPECTOR_ALTERNATE_DISPATCHERS;
 
-ENABLE_WIRELESS_PLAYBACK_TARGET[sdk=iphone*] = ENABLE_WIRELESS_PLAYBACK_TARGET;
-ENABLE_WIRELESS_PLAYBACK_TARGET[sdk=macosx*] = $(ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR))
-ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101000 = ;
-ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101100 = ENABLE_WIRELESS_PLAYBACK_TARGET;
-ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101200 = ENABLE_WIRELESS_PLAYBACK_TARGET;
-ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101300 = ENABLE_WIRELESS_PLAYBACK_TARGET;
+ENABLE_WIRELESS_PLAYBACK_TARGET = ENABLE_WIRELESS_PLAYBACK_TARGET;
 
 ENABLE_INTL = ENABLE_INTL;
 
@@ -127,9 +130,10 @@ ENABLE_DATA_DETECTION = ENABLE_DATA_DETECTION;
 ENABLE_IOS_TOUCH_EVENTS[sdk=iphone*] = $(ENABLE_IOS_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
 ENABLE_IOS_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_YES = ENABLE_IOS_TOUCH_EVENTS;
 
+ENABLE_KEYBOARD_KEY_ATTRIBUTE = ENABLE_KEYBOARD_KEY_ATTRIBUTE;
+ENABLE_KEYBOARD_CODE_ATTRIBUTE = ENABLE_KEYBOARD_CODE_ATTRIBUTE;
 ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
-ENABLE_LEGACY_ENCRYPTED_MEDIA[sdk=macosx*] = ENABLE_LEGACY_ENCRYPTED_MEDIA;
-ENABLE_LEGACY_NOTIFICATIONS[sdk=macosx*] = ENABLE_LEGACY_NOTIFICATIONS;
+ENABLE_LEGACY_ENCRYPTED_MEDIA = ENABLE_LEGACY_ENCRYPTED_MEDIA;
 ENABLE_LEGACY_VENDOR_PREFIXES = ENABLE_LEGACY_VENDOR_PREFIXES;
 ENABLE_LETTERPRESS[sdk=iphone*] = ENABLE_LETTERPRESS;
 ENABLE_LINK_PREFETCH = ;
@@ -141,22 +145,19 @@ ENABLE_MEDIA_SESSION = ;
 ENABLE_MEDIA_SOURCE[sdk=macosx*] = ENABLE_MEDIA_SOURCE;
 
 ENABLE_MEDIA_STATISTICS = ;
-ENABLE_MEDIA_STREAM = ;
+ENABLE_MEDIA_STREAM = ENABLE_MEDIA_STREAM;
 ENABLE_METER_ELEMENT = ENABLE_METER_ELEMENT;
 ENABLE_MHTML = ;
 ENABLE_MOUSE_CURSOR_SCALE[sdk=macosx*] = ENABLE_MOUSE_CURSOR_SCALE;
 ENABLE_NAVIGATOR_CONTENT_UTILS = ;
-ENABLE_NAVIGATOR_HWCONCURRENCY = ENABLE_NAVIGATOR_HWCONCURRENCY;
-ENABLE_NOSNIFF = ;
+ENABLE_NAVIGATOR_STANDALONE[sdk=iphone*] = ENABLE_NAVIGATOR_STANDALONE;
 ENABLE_NOTIFICATIONS[sdk=macosx*] = ENABLE_NOTIFICATIONS;
 ENABLE_PDFKIT_PLUGIN[sdk=macosx*] = ENABLE_PDFKIT_PLUGIN;
 ENABLE_POINTER_LOCK[sdk=macosx*] = ENABLE_POINTER_LOCK;
 ENABLE_PROXIMITY_EVENTS = ;
 ENABLE_PUBLIC_SUFFIX_LIST = ENABLE_PUBLIC_SUFFIX_LIST;
 ENABLE_QUOTA = ;
-ENABLE_READABLE_STREAM_API = ENABLE_READABLE_STREAM_API;
-ENABLE_READABLE_BYTE_STREAM_API = ENABLE_READABLE_BYTE_STREAM_API;
-ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_STREAMS_API = ENABLE_STREAMS_API;
 ENABLE_REQUEST_AUTOCOMPLETE = ;
 ENABLE_REMOTE_INSPECTOR = ENABLE_REMOTE_INSPECTOR;
 ENABLE_RESOLUTION_MEDIA_QUERY = ;
@@ -166,8 +167,24 @@ ENABLE_CSS_SCROLL_SNAP = ENABLE_CSS_SCROLL_SNAP;
 ENABLE_SPEECH_SYNTHESIS = ENABLE_SPEECH_SYNTHESIS;
 ENABLE_SUBTLE_CRYPTO = ENABLE_SUBTLE_CRYPTO;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
-ENABLE_WEB_RTC = ;
-ENABLE_WRITABLE_STREAM_API = ENABLE_WRITABLE_STREAM_API;
+
+ENABLE_MAC_VIDEO_TOOLBOX = ;
+ENABLE_MAC_VIDEO_TOOLBOX[sdk=macosx*] = $(ENABLE_MAC_VIDEO_TOOLBOX_macosx_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
+ENABLE_MAC_VIDEO_TOOLBOX_macosx_WITH_INTERNAL_SDK_YES = ENABLE_MAC_VIDEO_TOOLBOX;
+
+ENABLE_WEB_RTC[sdk=watch*] = ;
+ENABLE_WEB_RTC[sdk=appletv*] = ;
+ENABLE_WEB_RTC[sdk=iphone*] = $(ENABLE_WEB_RTC_ios);
+ENABLE_WEB_RTC_ios[arch=arm64*] = $(ENABLE_WEB_RTC_ios_$(IPHONEOS_DEPLOYMENT_TARGET:base)_$(CONFIGURATION))
+ENABLE_WEB_RTC_ios[arch=x86_64] = $(ENABLE_WEB_RTC_ios_$(IPHONEOS_DEPLOYMENT_TARGET:base)_$(CONFIGURATION))
+ENABLE_WEB_RTC_ios_10_Production = ;
+ENABLE_WEB_RTC_ios_10_Debug = ENABLE_WEB_RTC;
+ENABLE_WEB_RTC_ios_10_Release = ENABLE_WEB_RTC;
+ENABLE_WEB_RTC_ios_11_Production = ENABLE_WEB_RTC;
+ENABLE_WEB_RTC_ios_11_Debug = ENABLE_WEB_RTC;
+ENABLE_WEB_RTC_ios_11_Release = ENABLE_WEB_RTC;
+ENABLE_WEB_RTC[sdk=macosx*] = $(ENABLE_WEB_RTC_macosx);
+ENABLE_WEB_RTC_macosx[arch=x86_64] = ENABLE_WEB_RTC;
 
 ENABLE_TELEPHONE_NUMBER_DETECTION = ENABLE_TELEPHONE_NUMBER_DETECTION;
 
@@ -185,17 +202,17 @@ ENABLE_VIDEO_PRESENTATION_MODE[sdk=iphone*] = ENABLE_VIDEO_PRESENTATION_MODE;
 ENABLE_VIDEO_PRESENTATION_MODE[sdk=macosx*] = $(ENABLE_VIDEO_PRESENTATION_MODE_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR))
 ENABLE_VIDEO_PRESENTATION_MODE_macosx_101200 = ENABLE_VIDEO_PRESENTATION_MODE;
 ENABLE_VIDEO_PRESENTATION_MODE_macosx_101300 = ENABLE_VIDEO_PRESENTATION_MODE;
+ENABLE_VIDEO_PRESENTATION_MODE_macosx_101400 = ENABLE_VIDEO_PRESENTATION_MODE;
 ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
 ENABLE_DATACUE_VALUE = ENABLE_DATACUE_VALUE;
 ENABLE_VIEW_MODE_CSS_MEDIA = ;
 ENABLE_WEBASSEMBLY = ;
 ENABLE_WEBGL = ENABLE_WEBGL;
-ENABLE_WEBGL2 = ENABLE_WEBGL2;
+ENABLE_WEBGL2 = ;
+ENABLE_WEBGPU = ENABLE_WEBGPU;
+ENABLE_WEBGPU[sdk=iphonesimulator*] = ;
 ENABLE_WEB_ANIMATIONS = ;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
-ENABLE_WEB_REPLAY = $(ENABLE_WEB_REPLAY_$(PLATFORM_NAME)_$(CONFIGURATION));
-ENABLE_WEB_REPLAY_macosx_Debug = ;
-ENABLE_WEB_REPLAY_macosx_Release = ;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 
 ENABLE_WEB_TIMING = ENABLE_WEB_TIMING;
@@ -205,16 +222,27 @@ ENABLE_XSLT = ENABLE_XSLT;
 ENABLE_FTL_JIT[sdk=macosx*] = ENABLE_FTL_JIT;
 ENABLE_FTL_JIT[sdk=iphoneos*] = ENABLE_FTL_JIT;
 
-ENABLE_VARIATION_FONTS[sdk=embedded*] = ;
+ENABLE_FAST_JIT_PERMISSIONS[sdk=iphone*] = $(ENABLE_FAST_JIT_PERMISSIONS_ios);
+ENABLE_FAST_JIT_PERMISSIONS[sdk=iphoneos10*] = ;
+ENABLE_FAST_JIT_PERMISSIONS[sdk=iphonesimulator10*] = ;
+ENABLE_FAST_JIT_PERMISSIONS_ios[arch=arm64*] = $(ENABLE_FAST_JIT_PERMISSIONS_ios_$(USE_INTERNAL_SDK))
+ENABLE_FAST_JIT_PERMISSIONS_ios_YES = ENABLE_FAST_JIT_PERMISSIONS;
+
+ENABLE_VARIATION_FONTS[sdk=iphone*] = $(ENABLE_VARIATION_FONTS_$(PLATFORM_NAME));
 ENABLE_VARIATION_FONTS_iphoneos = ENABLE_VARIATION_FONTS;
 ENABLE_VARIATION_FONTS_iphonesimulator = ENABLE_VARIATION_FONTS;
-ENABLE_VARIATION_FONTS[sdk=iphoneos9*] = ;
-ENABLE_VARIATION_FONTS[sdk=iphonesimulator9*] = ;
+ENABLE_VARIATION_FONTS[sdk=iphoneos10*] = ;
+ENABLE_VARIATION_FONTS[sdk=iphonesimulator10*] = ;
 
-DISABLE_VARIATION_FONTS_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000);
-ENABLE_VARIATION_FONTS[sdk=macosx*] = ;
+DISABLE_VARIATION_FONTS_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1013000);
+ENABLE_VARIATION_FONTS[sdk=macosx*] = $(ENABLE_VARIATION_FONTS_IF_NOT_$(DISABLE_VARIATION_FONTS_macosx));
 ENABLE_VARIATION_FONTS_IF_NOT_ = $(ENABLE_VARIATION_FONTS_IF_NOT_NO);
 ENABLE_VARIATION_FONTS_IF_NOT_NO = ENABLE_VARIATION_FONTS;
 ENABLE_VARIATION_FONTS_IF_NOT_YES = ;
 
-FEATURE_DEFINES = $(ENABLE_3D_TRANSFORMS) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ACCELERATED_OVERFLOW_SCROLLING) $(ENABLE_APPLE_PAY) $(ENABLE_ATTACHMENT_ELEMENT) $(ENABLE_AVF_CAPTIONS) $(ENABLE_CACHE_PARTITIONING) $(ENABLE_CANVAS_PATH) $(ENABLE_CANVAS_PROXY) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CONTENT_FILTERING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_ANIMATIONS_LEVEL_2) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SCROLL_SNAP) $(ENABLE_CSS_SELECTORS_LEVEL4) $(ENABLE_CSS_TRAILING_WORD) $(ENABLE_CSS3_TEXT) $(ENABLE_CURSOR_VISIBILITY) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DATACUE_VALUE) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FETCH_API) $(ENABLE_FILTERS_LEVEL_2) $(ENABLE_FONT_LOAD_EVENTS) $(ENABLE_FTL_JIT) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD_DEPRECATED) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE_IN_WORKERS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INDIE_UI) $(ENABLE_INPUT_TYPE_COLOR_POPOVER) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_INTERSECTION_OBSERVER) $(ENABLE_INTL) $(ENABLE_IOS_GESTURE_EVENTS) $(ENABLE_IOS_TOUCH_EVENTS) $(ENABLE_JIT) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_ENCRYPTED_MEDIA) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LETTERPRESS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MAC_GESTURE_EVENTS) $(ENABLE_MATHML) $(ENABLE_MEDIA_CAPTURE) $(ENABLE_MEDIA_CONTROLS_SCRIPT) $(ENABLE_MEDIA_SESSION) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_MEDIA_STREAM) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MOUSE_CURSOR_SCALE) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NAVIGATOR_HWCONCURRENCY) $(ENABLE_NOTIFICATIONS) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_POINTER_LOCK) $(ENABLE_PROXIMITY_EVENTS) $(ENABLE_PUBLIC_SUFFIX_LIST) $(ENABLE_QUOTA) $(ENABLE_READABLE_STREAM_API) $(ENABLE_READABLE_BYTE_STREAM_API) $(ENABLE_REMOTE_INSPECTOR) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_REQUEST_AUTOCOMPLETE) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_RESOURCE_USAGE) $(ENABLE_RUBBER_BANDING) $(ENABLE_SERVICE_CONTROLS) $(ENABLE_SPEECH_SYNTHESIS) $(ENABLE_SUBTLE_CRYPTO) $(ENABLE_SVG_FONTS) $(ENABLE_TELEPHONE_NUMBER_DETECTION) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TOUCH_EVENTS) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VARIATION_FONTS) $(ENABLE_VIDEO_PRESENTATION_MODE) $(ENABLE_VIDEO_TRACK) $(ENABLE_VIDEO) $(ENABLE_VIEW_MODE_CSS_MEDIA) $(ENABLE_WEB_ANIMATIONS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_REPLAY) $(ENABLE_WEB_RTC) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WEBASSEMBLY) $(ENABLE_WEBGL) $(ENABLE_WEBGL2) $(ENABLE_WIRELESS_PLAYBACK_TARGET) $(ENABLE_WRITABLE_STREAM_API) $(ENABLE_XSLT);
+ENABLE_DRAG_SUPPORT[sdk=iphoneos11*] = ENABLE_DRAG_SUPPORT;
+ENABLE_DRAG_SUPPORT[sdk=iphonesimulator11*] = ENABLE_DRAG_SUPPORT;
+ENABLE_DATA_INTERACTION[sdk=iphoneos11*] = ENABLE_DATA_INTERACTION;
+ENABLE_DATA_INTERACTION[sdk=iphonesimulator11*] = ENABLE_DATA_INTERACTION;
+
+FEATURE_DEFINES = $(ENABLE_3D_TRANSFORMS) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ACCELERATED_OVERFLOW_SCROLLING) $(ENABLE_APPLE_PAY) $(ENABLE_APPLE_PAY_SESSION_V3) $(ENABLE_ATTACHMENT_ELEMENT) $(ENABLE_AVF_CAPTIONS) $(ENABLE_CACHE_PARTITIONING) $(ENABLE_CANVAS_PATH) $(ENABLE_CANVAS_PROXY) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CONTENT_FILTERING) $(ENABLE_CSS_ANIMATIONS_LEVEL_2) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SCROLL_SNAP) $(ENABLE_CSS_SELECTORS_LEVEL4) $(ENABLE_CSS_TRAILING_WORD) $(ENABLE_CSS3_TEXT) $(ENABLE_CURSOR_VISIBILITY) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATA_INTERACTION) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DATACUE_VALUE) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DRAG_SUPPORT) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FAST_JIT_PERMISSIONS) $(ENABLE_FETCH_API) $(ENABLE_FILTERS_LEVEL_2) $(ENABLE_FTL_JIT) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD_DEPRECATED) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE_IN_WORKERS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR_POPOVER) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_INTERSECTION_OBSERVER) $(ENABLE_INTL) $(ENABLE_IOS_GESTURE_EVENTS) $(ENABLE_IOS_TOUCH_EVENTS) $(ENABLE_JIT) $(ENABLE_KEYBOARD_KEY_ATTRIBUTE) $(ENABLE_KEYBOARD_CODE_ATTRIBUTE) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_ENCRYPTED_MEDIA) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LETTERPRESS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MAC_GESTURE_EVENTS) $(ENABLE_MATHML) $(ENABLE_MEDIA_CAPTURE) $(ENABLE_MEDIA_CONTROLS_SCRIPT) $(ENABLE_MEDIA_SESSION) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_MEDIA_STREAM) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MOUSE_CURSOR_SCALE) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NAVIGATOR_STANDALONE) $(ENABLE_NOTIFICATIONS) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_POINTER_LOCK) $(ENABLE_PROXIMITY_EVENTS) $(ENABLE_PUBLIC_SUFFIX_LIST) $(ENABLE_QUOTA) $(ENABLE_REMOTE_INSPECTOR) $(ENABLE_REQUEST_AUTOCOMPLETE) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_RESOURCE_USAGE) $(ENABLE_RUBBER_BANDING) $(ENABLE_SERVICE_CONTROLS) $(ENABLE_SPEECH_SYNTHESIS) $(ENABLE_STREAMS_API) $(ENABLE_SUBTLE_CRYPTO) $(ENABLE_SVG_FONTS) $(ENABLE_TELEPHONE_NUMBER_DETECTION) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TOUCH_EVENTS) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VARIATION_FONTS) $(ENABLE_VIDEO_PRESENTATION_MODE) $(ENABLE_MAC_VIDEO_TOOLBOX) $(ENABLE_VIDEO_TRACK) $(ENABLE_VIDEO) $(ENABLE_VIEW_MODE_CSS_MEDIA) $(ENABLE_WEB_ANIMATIONS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_RTC) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WEBASSEMBLY) $(ENABLE_WEBGL) $(ENABLE_WEBGL2) $(ENABLE_WEBGPU) $(ENABLE_WIRELESS_PLAYBACK_TARGET) $(ENABLE_XSLT);

Configurations/JSC.xcconfig

@@ -32,6 +32,7 @@ WK_RELOCATABLE_FRAMEWORKS_LDFLAGS_YES = -Wl,-dyld_env,DYLD_FRAMEWORK_PATH=@execu
 
 PRODUCT_NAME = jsc;
 CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = entitlements.plist;
+OTHER_CODE_SIGN_FLAGS[sdk=iphone*] = -i com.apple.jsc;
 
 // Explicitly add the PrivateHeaders directory to the search path so that generated header files can be found in production builds.
 HEADER_SEARCH_PATHS = "$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders" $(inherited);

Configurations/JavaScriptCore.xcconfig

@@ -1,4 +1,4 @@
-// Copyright (C) 2009, 2014 Apple Inc. All rights reserved.
+// Copyright (C) 2009-2017 Apple Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@ JSVALUE_MODEL_armv7 = 32_64;
 JSVALUE_MODEL_armv7k = 32_64;
 JSVALUE_MODEL_armv7s = 32_64;
 JSVALUE_MODEL_arm64 = 64;
+JSVALUE_MODEL_arm64e = 64;
 JSVALUE_MODEL_i386 = 32_64;
 JSVALUE_MODEL_x86_64 = 64;
 
@@ -46,6 +47,8 @@ SECTORDER_FLAGS_Production[sdk=macosx*] = -Wl,-order_file,JavaScriptCore.order;
 
 GCC_PREFIX_HEADER = JavaScriptCorePrefix.h;
 GCC_SYMBOLS_PRIVATE_EXTERN = YES;
+OTHER_CFLAGS = $(inherited) --system-header-prefix=unicode/;
+OTHER_CPLUSPLUSFLAGS = $(inherited) --system-header-prefix=unicode/;
 HEADER_SEARCH_PATHS = "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
 INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR);

Configurations/ToolExecutable.xcconfig

@@ -1,4 +1,4 @@
-// Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+// Copyright (C) 2011-2017 Apple Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions
@@ -34,6 +34,8 @@ CODE_SIGN_ENTITLEMENTS_ios_testb3 = entitlements.plist;
 CODE_SIGN_ENTITLEMENTS_ios_testWasm = entitlements.plist;
 CODE_SIGN_ENTITLEMENTS_ios_testRegExp = entitlements.plist;
 
+OTHER_CODE_SIGN_FLAGS[sdk=iphone*] = -i com.apple.jsc;
+
 SKIP_INSTALL = $(SKIP_INSTALL_$(FORCE_TOOL_INSTALL));
 SKIP_INSTALL_ = YES;
 SKIP_INSTALL_NO = YES;
@@ -46,9 +48,9 @@ CLANG_ENABLE_OBJC_ARC_armv7 = YES;
 CLANG_ENABLE_OBJC_ARC_armv7k = YES;
 CLANG_ENABLE_OBJC_ARC_armv7s = YES;
 CLANG_ENABLE_OBJC_ARC_arm64 = YES;
+CLANG_ENABLE_OBJC_ARC_arm64e = YES;
 
 OTHER_CFLAGS = $(ASAN_OTHER_CFLAGS) -isystem icu;
-OTHER_CPLUSPLUSFLAGS = $(ASAN_OTHER_CPLUSPLUSFLAGS) -isystem icu;
 OTHER_LDFLAGS = $(ASAN_OTHER_LDFLAGS);
 
 // Explicitly add the PrivateHeaders directory to the search path so that generated header files can be found in production builds.

Configurations/Version.xcconfig

@@ -21,11 +21,11 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 603;
+MAJOR_VERSION = 604;
 MINOR_VERSION = 1;
-TINY_VERSION = 30;
-MICRO_VERSION = 0;
-NANO_VERSION = 34;
+TINY_VERSION = 38;
+MICRO_VERSION = 1;
+NANO_VERSION = 6;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
 
 // The bundle version and short version string are set based on the current build configuration, see below.
@@ -35,10 +35,10 @@ SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
 // The system version prefix is based on the current system version.
 SYSTEM_VERSION_PREFIX[sdk=iphone*] = 8;
 SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(PLATFORM_NAME)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-SYSTEM_VERSION_PREFIX_macosx_101000 = 10;
 SYSTEM_VERSION_PREFIX_macosx_101100 = 11;
 SYSTEM_VERSION_PREFIX_macosx_101200 = 12;
 SYSTEM_VERSION_PREFIX_macosx_101300 = 13;
+SYSTEM_VERSION_PREFIX_macosx_101400 = 14;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);

DerivedSources.make

@@ -56,7 +56,6 @@ all : \
     InitBytecodes.asm \
     InjectedScriptSource.h \
     InspectorFrontendDispatchers.h \
-    JSReplayInputs.h \
     JSCBuiltins.h \
     Lexer.lut.h \
     KeywordLookup.h \
@@ -169,6 +168,8 @@ OBJECT_LUT_HEADERS = \
     WebAssemblyCompileErrorPrototype.lut.h \
     WebAssemblyInstanceConstructor.lut.h \
     WebAssemblyInstancePrototype.lut.h \
+    WebAssemblyLinkErrorConstructor.lut.h \
+    WebAssemblyLinkErrorPrototype.lut.h \
     WebAssemblyMemoryConstructor.lut.h \
     WebAssemblyMemoryPrototype.lut.h \
     WebAssemblyModuleConstructor.lut.h \
@@ -212,6 +213,7 @@ InitBytecodes.asm: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/b
 INSPECTOR_DOMAINS = \
     $(JavaScriptCore)/inspector/protocol/ApplicationCache.json \
     $(JavaScriptCore)/inspector/protocol/CSS.json \
+    $(JavaScriptCore)/inspector/protocol/Canvas.json \
     $(JavaScriptCore)/inspector/protocol/Console.json \
     $(JavaScriptCore)/inspector/protocol/DOM.json \
     $(JavaScriptCore)/inspector/protocol/DOMDebugger.json \
@@ -239,10 +241,6 @@ ifeq ($(findstring ENABLE_RESOURCE_USAGE,$(FEATURE_DEFINES)), ENABLE_RESOURCE_US
     INSPECTOR_DOMAINS := $(INSPECTOR_DOMAINS) $(JavaScriptCore)/inspector/protocol/Memory.json
 endif
 
-ifeq ($(findstring ENABLE_WEB_REPLAY,$(FEATURE_DEFINES)), ENABLE_WEB_REPLAY)
-    INSPECTOR_DOMAINS := $(INSPECTOR_DOMAINS) $(JavaScriptCore)/inspector/protocol/Replay.json
-endif
-
 INSPECTOR_GENERATOR_SCRIPTS = \
 	$(JavaScriptCore)/inspector/scripts/codegen/__init__.py \
 	$(JavaScriptCore)/inspector/scripts/codegen/cpp_generator_templates.py \
@@ -281,20 +279,6 @@ InjectedScriptSource.h : inspector/InjectedScriptSource.js $(JavaScriptCore_SCRI
 	$(PERL) $(JavaScriptCore_SCRIPTS_DIR)/xxd.pl InjectedScriptSource_js ./InjectedScriptSource.min.js InjectedScriptSource.h
 	$(DELETE) InjectedScriptSource.min.js
 
-# Web Replay inputs generator
-
-INPUT_GENERATOR_SCRIPTS = \
-    $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputs.py \
-    $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputsTemplates.py \
-#
-
-INPUT_GENERATOR_SPECIFICATIONS = \
-    $(JavaScriptCore)/replay/JSInputs.json \
-#
-
-JSReplayInputs.h : $(INPUT_GENERATOR_SPECIFICATIONS) $(INPUT_GENERATOR_SCRIPTS)
-	$(PYTHON) $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputs.py --outputDir . --framework JavaScriptCore $(INPUT_GENERATOR_SPECIFICATIONS)
-
 AirOpcode.h: $(JavaScriptCore)/b3/air/opcode_generator.rb $(JavaScriptCore)/b3/air/AirOpcode.opcodes
 	$(RUBY) $^
 

JavaScriptCore.order

@@ -198,7 +198,6 @@ __ZN3WTF6VectorIPN3JSC7JSValueELm0ENS_15CrashOnOverflowEE14expandCapacityEm
 __ZN3JSC13DFGCodeBlocksC1Ev
 __ZN3JSC17JITStubRoutineSetC1Ev
 __ZN3JSC25DefaultGCActivityCallbackC1EPNS_4HeapE
-__ZN3JSC9HeapTimerC2EPNS_2VMEP11__CFRunLoop
 __ZN3JSCL13retainAPILockEPKv
 __ZN3JSC18IncrementalSweeper6createEPNS_4HeapE
 __ZN3JSC11CopiedSpace4initEv
@@ -491,7 +490,6 @@ __ZNK3WTF13StringBuilder11reifyStringEv
 __ZN3WTF6String6numberEi
 __ZN3WTF22charactersToUIntStrictEPKtmPbi
 __ZN3WTFL14toIntegralTypeIjtEET_PKT0_mPbi
-__ZN3JSC9HeapTimer12timerDidFireEP16__CFRunLoopTimerPv
 __ZN3JSC4Heap16activityCallbackEv
 __ZN3JSC4Heap7sweeperEv
 __ZN3JSC14MachineThreads16addCurrentThreadEv
@@ -4509,7 +4507,6 @@ __ZN3JSC3DFG14LongLivedStateD1Ev
 __ZN3JSC4HeapD1Ev
 __ZN3JSC4HeapD2Ev
 __ZN3JSC18IncrementalSweeperD0Ev
-__ZN3JSC9HeapTimerD2Ev
 __ZN3JSC25DefaultGCActivityCallbackD0Ev
 __ZN3JSC17JITStubRoutineSetD1Ev
 __ZN3JSC17JITStubRoutineSetD2Ev

PlatformEfl.cmake

@@ -1,20 +0,0 @@
-list(APPEND JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
-    ${ECORE_EVAS_INCLUDE_DIRS}
-    ${ECORE_IMF_INCLUDE_DIRS}
-    ${ECORE_INCLUDE_DIRS}
-    ${EINA_INCLUDE_DIRS}
-    ${EO_INCLUDE_DIRS}
-)
-
-add_definitions(-DSTATICALLY_LINKED_WITH_WTF)
-
-install(FILES API/JavaScript.h
-              API/JSBase.h
-              API/JSContextRef.h
-              API/JSObjectRef.h
-              API/JSStringRef.h
-              API/JSValueRef.h
-              API/JSTypedArray.h
-              API/WebKitAvailability.h
-        DESTINATION "${HEADER_INSTALL_DIR}/JavaScriptCore"
-)

PlatformGTK.cmake

@@ -1,8 +1,26 @@
 set(JavaScriptCore_OUTPUT_NAME javascriptcoregtk-${WEBKITGTK_API_VERSION})
 
+list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
+    "${JAVASCRIPTCORE_DIR}/inspector/remote/glib"
+)
+
 configure_file(javascriptcoregtk.pc.in ${CMAKE_BINARY_DIR}/Source/JavaScriptCore/javascriptcoregtk-${WEBKITGTK_API_VERSION}.pc @ONLY)
 configure_file(JavaScriptCore.gir.in ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir @ONLY)
 
+list(APPEND JavaScriptCore_SOURCES
+    API/JSRemoteInspector.cpp
+
+    inspector/remote/RemoteAutomationTarget.cpp
+    inspector/remote/RemoteControllableTarget.cpp
+    inspector/remote/RemoteInspectionTarget.cpp
+    inspector/remote/RemoteInspector.cpp
+
+    inspector/remote/glib/RemoteConnectionToTargetGlib.cpp
+    inspector/remote/glib/RemoteInspectorGlib.cpp
+    inspector/remote/glib/RemoteInspectorServer.cpp
+    inspector/remote/glib/RemoteInspectorUtils.cpp
+)
+
 add_custom_command(
     OUTPUT ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.typelib
     DEPENDS ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir

PlatformJSCOnly.cmake

@@ -8,3 +8,9 @@ if (USE_GLIB)
         ${GLIB_LIBRARIES}
     )
 endif ()
+
+if (APPLE)
+    list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
+        ${JAVASCRIPTCORE_DIR}/icu
+    )
+endif ()

PlatformMac.cmake

@@ -10,11 +10,13 @@ list(APPEND JavaScriptCore_SOURCES
     API/ObjCCallbackFunction.mm
 
     inspector/remote/RemoteAutomationTarget.cpp
-    inspector/remote/RemoteConnectionToTarget.mm
     inspector/remote/RemoteControllableTarget.cpp
     inspector/remote/RemoteInspectionTarget.cpp
-    inspector/remote/RemoteInspector.mm
-    inspector/remote/RemoteInspectorXPCConnection.mm
+    inspector/remote/RemoteInspector.cpp
+
+    inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm
+    inspector/remote/cocoa/RemoteInspectorCocoa.mm
+    inspector/remote/cocoa/RemoteInspectorXPCConnection.mm
 )
 add_definitions(-DSTATICALLY_LINKED_WITH_WTF -D__STDC_WANT_LIB_EXT1__)
 
@@ -26,6 +28,7 @@ list(APPEND JavaScriptCore_LIBRARIES
 list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
     ${JAVASCRIPTCORE_DIR}/disassembler/udis86
     ${JAVASCRIPTCORE_DIR}/icu
+    ${JAVASCRIPTCORE_DIR}/inspector/remote/cocoa
 )
 
 set(CMAKE_SHARED_LINKER_FLAGS ${CMAKE_SHARED_LINKER_FLAGS} "-compatibility_version 1 -current_version ${WEBKIT_MAC_VERSION}")

PlatformWPE.cmake

@@ -0,0 +1,37 @@
+list(APPEND JavaScriptCore_LIBRARIES
+    ${GLIB_LIBRARIES}
+)
+list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
+    ${GLIB_INCLUDE_DIRS}
+    ${WTF_DIR}
+)
+
+list(APPEND JavaScriptCore_SOURCES
+    API/JSRemoteInspector.cpp
+
+    inspector/remote/RemoteAutomationTarget.cpp
+    inspector/remote/RemoteControllableTarget.cpp
+    inspector/remote/RemoteInspectionTarget.cpp
+    inspector/remote/RemoteInspector.cpp
+
+    inspector/remote/glib/RemoteConnectionToTargetGlib.cpp
+    inspector/remote/glib/RemoteInspectorGlib.cpp
+    inspector/remote/glib/RemoteInspectorServer.cpp
+    inspector/remote/glib/RemoteInspectorUtils.cpp
+)
+
+set(WPE_INSTALLED_JAVASCRIPTCORE_HEADERS
+    API/JSBase.h
+    API/JSContextRef.h
+    API/JSObjectRef.h
+    API/JSStringRef.h
+    API/JSTypedArray.h
+    API/JSValueRef.h
+    API/JavaScript.h
+    API/WebKitAvailability.h
+)
+
+install(FILES ${WPE_INSTALLED_JAVASCRIPTCORE_HEADERS}
+    DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/wpe-${WPE_API_VERSION}/WPE/JavaScriptCore"
+    COMPONENT "Development"
+)

PlatformWin.cmake

@@ -29,16 +29,16 @@ file(COPY
     ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
 )
 
-file(MAKE_DIRECTORY ${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore)
+file(MAKE_DIRECTORY ${FORWARDING_HEADERS_DIR}/JavaScriptCore)
 
 set(JavaScriptCore_PRE_BUILD_COMMAND "${CMAKE_BINARY_DIR}/DerivedSources/JavaScriptCore/preBuild.cmd")
 file(REMOVE "${JavaScriptCore_PRE_BUILD_COMMAND}")
 foreach (_directory ${JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES})
-    file(APPEND "${JavaScriptCore_PRE_BUILD_COMMAND}" "@xcopy /y /d /f \"${JAVASCRIPTCORE_DIR}/${_directory}/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
+    file(APPEND "${JavaScriptCore_PRE_BUILD_COMMAND}" "@xcopy /y /d /f \"${JAVASCRIPTCORE_DIR}/${_directory}/*.h\" \"${FORWARDING_HEADERS_DIR}/JavaScriptCore\" >nul 2>nul\n")
 endforeach ()
 
 set(JavaScriptCore_POST_BUILD_COMMAND "${CMAKE_BINARY_DIR}/DerivedSources/JavaScriptCore/postBuild.cmd")
-file(WRITE "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
-file(APPEND "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/inspector/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
+file(WRITE "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/*.h\" \"${FORWARDING_HEADERS_DIR}/JavaScriptCore\" >nul 2>nul\n")
+file(APPEND "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/inspector/*.h\" \"${FORWARDING_HEADERS_DIR}/JavaScriptCore\" >nul 2>nul\n")
 
 set(JavaScriptCore_OUTPUT_NAME JavaScriptCore${DEBUG_SUFFIX})

README.md

@@ -1 +0,0 @@
-# darling-JavaScriptCore

Scripts/builtins/builtins_generate_internals_wrapper_header.py

@@ -106,8 +106,7 @@ class BuiltinsInternalsWrapperHeaderGenerator(BuiltinsGenerator):
         return '\n'.join(lines)
 
     def generate_members(self):
-        guards = set([object.annotations.get('conditional') for object in self.internals if 'conditional' in object.annotations])
-        lines = [BuiltinsGenerator.wrap_with_guard(" || ".join(guards), "    JSC::VM& m_vm;")]
+        lines = ["    JSC::VM& m_vm;"]
         for object in self.internals:
             member = "    %s %s;" % (self.member_type(object), self.member_name(object))
             lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), member))

Scripts/builtins/builtins_generate_internals_wrapper_implementation.py

@@ -101,7 +101,7 @@ class BuiltinsInternalsWrapperImplementationGenerator(BuiltinsGenerator):
     def generate_constructor(self):
         guards = set([object.annotations.get('conditional') for object in self.internals if 'conditional' in object.annotations])
         lines = ["JSBuiltinInternalFunctions::JSBuiltinInternalFunctions(JSC::VM& vm)",
-                 BuiltinsGenerator.wrap_with_guard(" || ".join(guards), "    : m_vm(vm)")]
+                 "    : m_vm(vm)"]
         for object in self.internals:
             initializer = "    , %s(m_vm)" % self.member_name(object)
             lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), initializer))

Scripts/builtins/builtins_templates.py

@@ -132,7 +132,7 @@ public:
     explicit ${objectName}BuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/make-js-file-arrays.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python
+# Copyright (C) 2014 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import io
+import os
+from optparse import OptionParser
+from StringIO import StringIO
+from jsmin import JavascriptMinify
+
+
+def stringifyCodepoint(code):
+    if code < 128:
+        return '{0:d}'.format(code)
+    else:
+        return "'\\x{0:02x}'".format(code)
+
+
+def chunk(list, chunkSize):
+    for i in xrange(0, len(list), chunkSize):
+        yield list[i:i + chunkSize]
+
+
+def main():
+    parser = OptionParser(usage="usage: %prog [options] header source [input [input...]]")
+    parser.add_option('--no-minify', action='store_true', help='Do not run the input files through jsmin')
+    parser.add_option('-n', '--namespace', help='Namespace to use')
+    (options, arguments) = parser.parse_args()
+    if not options.namespace:
+        print 'Error: must provide a namespace'
+        parser.print_usage()
+        exit(-1)
+    if len(arguments) < 3:
+        print 'Error: must provide at least 3 arguments'
+        parser.print_usage()
+        exit(-1)
+
+    namespace = options.namespace
+    headerPath = arguments[0]
+    sourcePath = arguments[1]
+    inputPaths = arguments[2:]
+
+    headerFile = open(headerPath, 'w')
+    print >> headerFile, 'namespace {0:s} {{'.format(namespace)
+
+    sourceFile = open(sourcePath, 'w')
+    print >> sourceFile, '#include "{0:s}"'.format(os.path.basename(headerPath))
+    print >> sourceFile, 'namespace {0:s} {{'.format(namespace)
+
+    jsm = JavascriptMinify()
+
+    for inputFileName in inputPaths:
+        inputStream = io.FileIO(inputFileName)
+        outputStream = StringIO()
+
+        if not options.no_minify:
+            jsm.minify(inputStream, outputStream)
+            characters = outputStream.getvalue()
+        else:
+            characters = inputStream.read()
+
+        size = len(characters)
+        variableName = os.path.splitext(os.path.basename(inputFileName))[0]
+
+        print >> headerFile, 'extern const char {0:s}JavaScript[{1:d}];'.format(variableName, size)
+        print >> sourceFile, 'const char {0:s}JavaScript[{1:d}] = {{'.format(variableName, size)
+
+        codepoints = map(ord, characters)
+        for codepointChunk in chunk(codepoints, 16):
+            print >> sourceFile, '    {0:s},'.format(','.join(map(stringifyCodepoint, codepointChunk)))
+
+        print >> sourceFile, '};'
+
+    print >> headerFile, '}} // namespace {0:s}'.format(namespace)
+    print >> sourceFile, '}} // namespace {0:s}'.format(namespace)
+
+if __name__ == '__main__':
+    main()

Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result

@@ -70,7 +70,7 @@ public:
     explicit AnotherGuardedInternalBuiltinBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result

@@ -71,7 +71,7 @@ public:
     explicit ArbitraryConditionalGuardBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result

@@ -71,7 +71,7 @@ public:
     explicit GuardedBuiltinBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result

@@ -71,7 +71,7 @@ public:
     explicit GuardedInternalBuiltinBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result

@@ -69,7 +69,7 @@ public:
     explicit UnguardedBuiltinBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result

@@ -85,7 +85,7 @@ public:
     explicit xmlCasingTestBuiltinsWrapper(JSC::VM* vm)
         : m_vm(*vm)
         WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
-#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length), { }))
         WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
 #undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
     {

Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result

@@ -213,9 +213,7 @@ public:
 #endif // ENABLE(STREAMS_API)
 
 private:
-#if ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
     JSC::VM& m_vm;
-#endif // ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
 #if ENABLE(FETCH_API)
     AnotherGuardedInternalBuiltinBuiltinFunctions m_anotherGuardedInternalBuiltin;
 #endif // ENABLE(FETCH_API)
@@ -274,9 +272,7 @@ private:
 namespace WebCore {
 
 JSBuiltinInternalFunctions::JSBuiltinInternalFunctions(JSC::VM& vm)
-#if ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
     : m_vm(vm)
-#endif // ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
 #if ENABLE(FETCH_API)
     , m_anotherGuardedInternalBuiltin(m_vm)
 #endif // ENABLE(FETCH_API)

assembler/ARM64Assembler.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2014, 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,9 +35,11 @@
 #include <stdint.h>
 
 #define CHECK_DATASIZE_OF(datasize) ASSERT(datasize == 32 || datasize == 64)
+#define CHECK_MEMOPSIZE_OF(size) ASSERT(size == 8 || size == 16 || size == 32 || size == 64 || size == 128);
 #define DATASIZE_OF(datasize) ((datasize == 64) ? Datasize_64 : Datasize_32)
 #define MEMOPSIZE_OF(datasize) ((datasize == 8 || datasize == 128) ? MemOpSize_8_or_128 : (datasize == 16) ? MemOpSize_16 : (datasize == 32) ? MemOpSize_32 : MemOpSize_64)
 #define CHECK_DATASIZE() CHECK_DATASIZE_OF(datasize)
+#define CHECK_MEMOPSIZE() CHECK_MEMOPSIZE_OF(datasize)
 #define CHECK_VECTOR_DATASIZE() ASSERT(datasize == 64 || datasize == 128)
 #define DATASIZE DATASIZE_OF(datasize)
 #define MEMOPSIZE MEMOPSIZE_OF(datasize)
@@ -621,7 +623,19 @@ private:
     };
 
     enum SIMD3Same {
-        SIMD_LogicalOp_AND = 0x03
+        SIMD_LogicalOp = 0x03
+    };
+
+    enum SIMD3SameLogical {
+        // This includes both the U bit and the "size" / opc for convience.
+        SIMD_LogicalOp_AND = 0x00,
+        SIMD_LogicalOp_BIC = 0x01,
+        SIMD_LogicalOp_ORR = 0x02,
+        SIMD_LogicalOp_ORN = 0x03,
+        SIMD_LogacalOp_EOR = 0x80,
+        SIMD_LogicalOp_BSL = 0x81,
+        SIMD_LogicalOp_BIT = 0x82,
+        SIMD_LogicalOp_BIF = 0x83,
     };
 
     enum FPIntConvOp {
@@ -683,6 +697,21 @@ private:
         LdrLiteralOp_128BIT = 2
     };
     
+    enum ExoticLoadFence {
+        ExoticLoadFence_None,
+        ExoticLoadFence_Acquire
+    };
+    
+    enum ExoticLoadAtomic {
+        ExoticLoadAtomic_Link,
+        ExoticLoadAtomic_None
+    };
+
+    enum ExoticStoreFence {
+        ExoticStoreFence_None,
+        ExoticStoreFence_Release,
+    };
+
     static unsigned memPairOffsetShift(bool V, MemPairOpSize size)
     {
         // return the log2 of the size in bytes, e.g. 64 bit size returns 3
@@ -856,6 +885,14 @@ public:
         insn(excepnGeneration(ExcepnOp_BREAKPOINT, imm, 0));
     }
     
+    ALWAYS_INLINE static bool isBrk(void* address)
+    {
+        int expected = excepnGeneration(ExcepnOp_BREAKPOINT, 0, 0);
+        int immediateMask = excepnGenerationImmMask();
+        int candidateInstruction = *reinterpret_cast<int*>(address);
+        return (candidateInstruction & ~immediateMask) == expected;
+    }
+
     template<int datasize>
     ALWAYS_INLINE void cbnz(RegisterID rt, int32_t offset = 0)
     {
@@ -1512,6 +1549,55 @@ public:
         insn(0xd5033abf);
     }
     
+    template<int datasize>
+    void ldar(RegisterID dst, RegisterID src)
+    {
+        CHECK_MEMOPSIZE();
+        insn(exoticLoad(MEMOPSIZE, ExoticLoadFence_Acquire, ExoticLoadAtomic_None, dst, src));
+    }
+
+    template<int datasize>
+    void ldxr(RegisterID dst, RegisterID src)
+    {
+        CHECK_MEMOPSIZE();
+        insn(exoticLoad(MEMOPSIZE, ExoticLoadFence_None, ExoticLoadAtomic_Link, dst, src));
+    }
+
+    template<int datasize>
+    void ldaxr(RegisterID dst, RegisterID src)
+    {
+        CHECK_MEMOPSIZE();
+        insn(exoticLoad(MEMOPSIZE, ExoticLoadFence_Acquire, ExoticLoadAtomic_Link, dst, src));
+    }
+    
+    template<int datasize>
+    void stxr(RegisterID result, RegisterID src, RegisterID dst)
+    {
+        CHECK_MEMOPSIZE();
+        insn(exoticStore(MEMOPSIZE, ExoticStoreFence_None, result, src, dst));
+    }
+
+    template<int datasize>
+    void stlr(RegisterID src, RegisterID dst)
+    {
+        CHECK_MEMOPSIZE();
+        insn(storeRelease(MEMOPSIZE, src, dst));
+    }
+
+    template<int datasize>
+    void stlxr(RegisterID result, RegisterID src, RegisterID dst)
+    {
+        CHECK_MEMOPSIZE();
+        insn(exoticStore(MEMOPSIZE, ExoticStoreFence_Release, result, src, dst));
+    }
+    
+#if ENABLE(FAST_TLS_JIT)
+    void mrs_TPIDRRO_EL0(RegisterID dst)
+    {
+        insn(0xd53bd060 | dst); // Thanks, otool -t!
+    }
+#endif
+
     template<int datasize>
     ALWAYS_INLINE void orn(RegisterID rd, RegisterID rn, RegisterID rm)
     {
@@ -2228,7 +2314,14 @@ public:
     ALWAYS_INLINE void vand(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
     {
         CHECK_VECTOR_DATASIZE();
-        insn(vectorDataProcessing2Source(SIMD_LogicalOp_AND, vm, vn, vd));
+        insn(vectorDataProcessingLogical(SIMD_LogicalOp_AND, vm, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void vorr(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_VECTOR_DATASIZE();
+        insn(vectorDataProcessingLogical(SIMD_LogicalOp_ORR, vm, vn, vd));
     }
 
     template<int datasize>
@@ -2509,6 +2602,14 @@ public:
         linkPointer(addressOf(code, where), valuePtr);
     }
 
+    static void replaceWithVMHalt(void* where)
+    {
+        // This should try to write to null which should always Segfault.
+        int insn = dataCacheZeroVirtualAddress(ARM64Registers::zr);
+        performJITMemcpy(where, &insn, sizeof(int));
+        cacheFlush(where, sizeof(int));
+    }
+
     static void replaceWithJump(void* where, void* to)
     {
         intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(where)) >> 2;
@@ -3263,6 +3364,11 @@ private:
         const int op2 = 0;
         return (0xd4000000 | opc << 21 | imm16 << 5 | op2 << 2 | LL);
     }
+    ALWAYS_INLINE static int excepnGenerationImmMask()
+    {
+        uint16_t imm16 =  std::numeric_limits<uint16_t>::max();
+        return (static_cast<int>(imm16) << 5);
+    }
 
     ALWAYS_INLINE static int extract(Datasize sf, RegisterID rm, int imms, RegisterID rn, RegisterID rd)
     {
@@ -3334,18 +3440,12 @@ private:
         return (0x1e200800 | M << 31 | S << 29 | type << 22 | rm << 16 | opcode << 12 | rn << 5 | rd);
     }
 
-    ALWAYS_INLINE static int vectorDataProcessing2Source(SIMD3Same opcode, unsigned size, FPRegisterID vm, FPRegisterID vn, FPRegisterID vd)
+    ALWAYS_INLINE static int vectorDataProcessingLogical(SIMD3SameLogical uAndSize, FPRegisterID vm, FPRegisterID vn, FPRegisterID vd)
     {
         const int Q = 0;
-        return (0xe201c00 | Q << 30 | size << 22 | vm << 16 | opcode << 11 | vn << 5 | vd);
+        return (0xe200400 | Q << 30 | uAndSize << 22 | vm << 16 | SIMD_LogicalOp << 11 | vn << 5 | vd);
     }
 
-    ALWAYS_INLINE static int vectorDataProcessing2Source(SIMD3Same opcode, FPRegisterID vm, FPRegisterID vn, FPRegisterID vd)
-    {
-        return vectorDataProcessing2Source(opcode, 0, vm, vn, vd);
-    }
-
-
     // 'o1' means negate
     ALWAYS_INLINE static int floatingPointDataProcessing3Source(Datasize type, bool o1, FPRegisterID rm, AddOp o2, FPRegisterID ra, FPRegisterID rn, FPRegisterID rd)
     {
@@ -3557,6 +3657,11 @@ private:
         return hintPseudo(0);
     }
 
+    ALWAYS_INLINE static int dataCacheZeroVirtualAddress(RegisterID rt)
+    {
+        return system(0, 1, 0x3, 0x7, 0x4, 0x1, rt);
+    }
+    
     // 'op' means negate
     ALWAYS_INLINE static int testAndBranchImmediate(bool op, int b50, int imm14, RegisterID rt)
     {
@@ -3576,6 +3681,21 @@ private:
         return (0xd6000000 | opc << 21 | op2 << 16 | op3 << 10 | xOrZr(rn) << 5 | op4);
     }
     
+    static int exoticLoad(MemOpSize size, ExoticLoadFence fence, ExoticLoadAtomic atomic, RegisterID dst, RegisterID src)
+    {
+        return 0x085f7c00 | size << 30 | fence << 15 | atomic << 23 | src << 5 | dst;
+    }
+    
+    static int storeRelease(MemOpSize size, RegisterID src, RegisterID dst)
+    {
+        return 0x089ffc00 | size << 30 | dst << 5 | src;
+    }
+    
+    static int exoticStore(MemOpSize size, ExoticStoreFence fence, RegisterID result, RegisterID src, RegisterID dst)
+    {
+        return 0x08007c00 | size << 30 | result << 16 | fence << 15 | dst << 5 | src;
+    }
+    
     // Workaround for Cortex-A53 erratum (835769). Emit an extra nop if the
     // last instruction in the buffer is a load, store or prefetch. Needed
     // before 64-bit multiply-accumulate instructions.

assembler/ARMAssembler.h

@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009, 2010 University of Szeged
+ * Copyright (C) 2017 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -701,6 +702,14 @@ namespace JSC {
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
         }
 
+        static bool isBkpt(void* address)
+        {
+            ARMWord expected = BKPT;
+            ARMWord immediateMask = (0xff0 << 4) | 0xf;
+            ARMWord candidateInstruction = *reinterpret_cast<ARMWord*>(address);
+            return (candidateInstruction & ~immediateMask) == expected;
+        }
+
         void nop()
         {
             m_buffer.putInt(NOP);

assembler/ARMv7Assembler.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010, 2012, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
  * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
@@ -987,6 +987,14 @@ public:
         m_formatter.oneWordOp8Imm8(OP_BKPT, imm);
     }
 
+    static bool isBkpt(void* address)
+    {
+        unsigned short expected = OP_BKPT;
+        unsigned short immediateMask = 0xff;
+        unsigned short candidateInstruction = *reinterpret_cast<unsigned short*>(address);
+        return (candidateInstruction & ~immediateMask) == expected;
+    }
+
     ALWAYS_INLINE void clz(RegisterID rd, RegisterID rm)
     {
         ASSERT(!BadReg(rd));

assembler/AbortReason.h

@@ -76,4 +76,12 @@ enum AbortReason {
     YARRNoInputConsumed                               = 340,
 };
 
+// This enum is for CRASH_WITH_SECURITY_IMPLICATION_AND_INFO so we can easily identify which assertion
+// we are looking at even if the calls to crash get coalesed. The same numbering rules above for
+// AbortReason apply here.
+enum CompilerAbortReason {
+    AbstractInterpreterInvalidType                =  10,
+    ObjectAllocationSinkingAssertionFailure       = 100,
+};
+
 } // namespace JSC

assembler/AbstractMacroAssembler.cpp

@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MacroAssembler.h" // Have to break with style because AbstractMacroAssembler.h is a shady header.
+
+#if ENABLE(ASSEMBLER)
+
+#include <wtf/PrintStream.h>
+
+using namespace JSC;
+
+namespace WTF {
+
+void printInternal(PrintStream& out, AbstractMacroAssemblerBase::StatusCondition condition)
+{
+    switch (condition) {
+    case AbstractMacroAssemblerBase::Success:
+        out.print("Success");
+        return;
+    case AbstractMacroAssemblerBase::Failure:
+        out.print("Failure");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(ASSEMBLER)

assembler/AbstractMacroAssembler.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2012, 2014-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,12 +36,18 @@
 #include <wtf/CryptographicallyRandomNumber.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/SharedTask.h>
+#include <wtf/Vector.h>
 #include <wtf/WeakRandom.h>
 
 namespace JSC {
 
 #if ENABLE(ASSEMBLER)
 
+#if ENABLE(MASM_PROBE)
+struct ProbeContext;
+typedef void (*ProbeFunction)(struct ProbeContext*);
+#endif
+    
 class AllowMacroScratchRegisterUsage;
 class DisallowMacroScratchRegisterUsage;
 class LinkBuffer;
@@ -50,10 +56,30 @@ namespace DFG {
 struct OSRExit;
 }
 
-template <class AssemblerType, class MacroAssemblerType>
-class AbstractMacroAssembler {
+class AbstractMacroAssemblerBase {
 public:
-    typedef AbstractMacroAssembler<AssemblerType, MacroAssemblerType> AbstractMacroAssemblerType;
+    enum StatusCondition {
+        Success,
+        Failure
+    };
+    
+    static StatusCondition invert(StatusCondition condition)
+    {
+        switch (condition) {
+        case Success:
+            return Failure;
+        case Failure:
+            return Success;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return Success;
+    }
+};
+
+template <class AssemblerType>
+class AbstractMacroAssembler : public AbstractMacroAssemblerBase {
+public:
+    typedef AbstractMacroAssembler<AssemblerType> AbstractMacroAssemblerType;
     typedef AssemblerType AssemblerType_T;
 
     typedef MacroAssemblerCodePtr CodePtr;
@@ -91,6 +117,15 @@ public:
     
     struct BaseIndex;
     
+    static RegisterID withSwappedRegister(RegisterID original, RegisterID left, RegisterID right)
+    {
+        if (original == left)
+            return right;
+        if (original == right)
+            return left;
+        return original;
+    }
+    
     // Address:
     //
     // Describes a simple base-offset address.
@@ -106,6 +141,11 @@ public:
             return Address(base, offset + additionalOffset);
         }
         
+        Address withSwappedRegister(RegisterID left, RegisterID right)
+        {
+            return Address(AbstractMacroAssembler::withSwappedRegister(base, left, right), offset);
+        }
+        
         BaseIndex indexedBy(RegisterID index, Scale) const;
         
         RegisterID base;
@@ -175,6 +215,11 @@ public:
         {
             return BaseIndex(base, index, scale, offset + additionalOffset);
         }
+
+        BaseIndex withSwappedRegister(RegisterID left, RegisterID right)
+        {
+            return BaseIndex(AbstractMacroAssembler::withSwappedRegister(base, left, right), AbstractMacroAssembler::withSwappedRegister(index, left, right), scale, offset);
+        }
     };
 
     // AbsoluteAddress:
@@ -326,8 +371,7 @@ public:
     // A Label records a point in the generated instruction stream, typically such that
     // it may be used as a destination for a jump.
     class Label {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend struct DFG::OSRExit;
         friend class Jump;
         friend class MacroAssemblerCodeRef;
@@ -363,8 +407,7 @@ public:
     //
     // addPtr(TrustedImmPtr(i), a, b)
     class ConvertibleLoadLabel {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend class LinkBuffer;
         
     public:
@@ -387,8 +430,7 @@ public:
     // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
     // patched after the code has been generated.
     class DataLabelPtr {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend class LinkBuffer;
     public:
         DataLabelPtr()
@@ -411,8 +453,7 @@ public:
     // A DataLabel32 is used to refer to a location in the code containing a 32-bit constant to be
     // patched after the code has been generated.
     class DataLabel32 {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend class LinkBuffer;
     public:
         DataLabel32()
@@ -435,8 +476,7 @@ public:
     // A DataLabelCompact is used to refer to a location in the code containing a
     // compact immediate to be patched after the code has been generated.
     class DataLabelCompact {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend class LinkBuffer;
     public:
         DataLabelCompact()
@@ -466,8 +506,7 @@ public:
     // relative offset such that when executed it will call to the desired
     // destination.
     class Call {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
 
     public:
         enum Flags {
@@ -512,8 +551,7 @@ public:
     // relative offset such that when executed it will jump to the desired
     // destination.
     class Jump {
-        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
-        friend class AbstractMacroAssembler;
+        friend class AbstractMacroAssembler<AssemblerType>;
         friend class Call;
         friend struct DFG::OSRExit;
         friend class LinkBuffer;
@@ -557,12 +595,6 @@ public:
         {
             ASSERT((type == ARM64Assembler::JumpTestBit) || (type == ARM64Assembler::JumpTestBitFixedSize));
         }
-#elif CPU(SH4)
-        Jump(AssemblerLabel jmp, SH4Assembler::JumpType type = SH4Assembler::JumpFar)
-            : m_label(jmp)
-            , m_type(type)
-        {
-        }
 #else
         Jump(AssemblerLabel jmp)    
             : m_label(jmp)
@@ -594,8 +626,6 @@ public:
                 masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition, m_bitNumber, m_compareRegister);
             else
                 masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition);
-#elif CPU(SH4)
-            masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type);
 #else
             masm->m_assembler.linkJump(m_label, masm->m_assembler.label());
 #endif
@@ -634,9 +664,6 @@ public:
         bool m_is64Bit;
         unsigned m_bitNumber;
         ARM64Assembler::RegisterID m_compareRegister;
-#endif
-#if CPU(SH4)
-        SH4Assembler::JumpType m_type;
 #endif
     };
 
@@ -687,6 +714,7 @@ public:
         
         void append(Jump jump)
         {
+            if (jump.isSet())
                 m_jumps.append(jump);
         }
         
@@ -807,106 +835,6 @@ public:
         AssemblerType::cacheFlush(code, size);
     }
 
-#if ENABLE(MASM_PROBE)
-
-    struct CPUState {
-        #define DECLARE_REGISTER(_type, _regName) \
-            _type _regName;
-        FOR_EACH_CPU_REGISTER(DECLARE_REGISTER)
-        #undef DECLARE_REGISTER
-
-        static const char* gprName(RegisterID regID)
-        {
-            switch (regID) {
-                #define DECLARE_REGISTER(_type, _regName) \
-                case RegisterID::_regName: \
-                    return #_regName;
-                FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
-                #undef DECLARE_REGISTER
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-            }
-        }
-
-        static const char* fprName(FPRegisterID regID)
-        {
-            switch (regID) {
-                #define DECLARE_REGISTER(_type, _regName) \
-                case FPRegisterID::_regName: \
-                    return #_regName;
-                FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
-                #undef DECLARE_REGISTER
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-            }
-        }
-
-        void*& gpr(RegisterID regID)
-        {
-            switch (regID) {
-                #define DECLARE_REGISTER(_type, _regName) \
-                case RegisterID::_regName: \
-                    return _regName;
-                FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
-                #undef DECLARE_REGISTER
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-            }
-        }
-
-        double& fpr(FPRegisterID regID)
-        {
-            switch (regID) {
-                #define DECLARE_REGISTER(_type, _regName) \
-                case FPRegisterID::_regName: \
-                    return _regName;
-                FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
-                #undef DECLARE_REGISTER
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-            }
-        }
-    };
-
-    struct ProbeContext;
-    typedef void (*ProbeFunction)(struct ProbeContext*);
-
-    struct ProbeContext {
-        ProbeFunction probeFunction;
-        void* arg1;
-        void* arg2;
-        CPUState cpu;
-
-        // Convenience methods:
-        void*& gpr(RegisterID regID) { return cpu.gpr(regID); }
-        double& fpr(FPRegisterID regID) { return cpu.fpr(regID); }
-        const char* gprName(RegisterID regID) { return cpu.gprName(regID); }
-        const char* fprName(FPRegisterID regID) { return cpu.fprName(regID); }
-    };
-
-    // This function emits code to preserve the CPUState (e.g. registers),
-    // call a user supplied probe function, and restore the CPUState before
-    // continuing with other JIT generated code.
-    //
-    // The user supplied probe function will be called with a single pointer to
-    // a ProbeContext struct (defined above) which contains, among other things,
-    // the preserved CPUState. This allows the user probe function to inspect
-    // the CPUState at that point in the JIT generated code.
-    //
-    // If the user probe function alters the register values in the ProbeContext,
-    // the altered values will be loaded into the CPU registers when the probe
-    // returns.
-    //
-    // The ProbeContext is stack allocated and is only valid for the duration
-    // of the call to the user probe function.
-    //
-    // Note: probe() should be implemented by the target specific MacroAssembler.
-    // This prototype is only provided here to document the interface.
-
-    void probe(ProbeFunction, void* arg1, void* arg2);
-
-#endif // ENABLE(MASM_PROBE)
-
     AssemblerType m_assembler;
     
     static void linkJump(void* code, Jump jump, CodeLocationLabel target)
@@ -1098,6 +1026,7 @@ protected:
     }
 
     friend class AllowMacroScratchRegisterUsage;
+    friend class AllowMacroScratchRegisterUsageIf;
     friend class DisallowMacroScratchRegisterUsage;
     unsigned m_tempRegistersValidBits;
     bool m_allowScratchRegister { true };
@@ -1107,11 +1036,11 @@ protected:
     friend class LinkBuffer;
 }; // class AbstractMacroAssembler
 
-template <class AssemblerType, class MacroAssemblerType>
-inline typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::BaseIndex
-AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::Address::indexedBy(
-    typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::RegisterID index,
-    typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::Scale scale) const
+template <class AssemblerType>
+inline typename AbstractMacroAssembler<AssemblerType>::BaseIndex
+AbstractMacroAssembler<AssemblerType>::Address::indexedBy(
+    typename AbstractMacroAssembler<AssemblerType>::RegisterID index,
+    typename AbstractMacroAssembler<AssemblerType>::Scale scale) const
 {
     return BaseIndex(base, index, scale, offset);
 }
@@ -1119,3 +1048,16 @@ AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::Address::indexedBy(
 #endif // ENABLE(ASSEMBLER)
 
 } // namespace JSC
+
+#if ENABLE(ASSEMBLER)
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream& out, JSC::AbstractMacroAssemblerBase::StatusCondition);
+
+} // namespace WTF
+
+#endif // ENABLE(ASSEMBLER)
+

assembler/AllowMacroScratchRegisterUsageIf.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+class AllowMacroScratchRegisterUsageIf {
+public:
+    AllowMacroScratchRegisterUsageIf(MacroAssembler& masm, bool allowIfTrue)
+        : m_masm(masm)
+        , m_allowIfTrue(allowIfTrue)
+        , m_oldValueOfAllowScratchRegister(masm.m_allowScratchRegister)
+    {
+        if (m_allowIfTrue)
+            masm.m_allowScratchRegister = true;
+    }
+
+    ~AllowMacroScratchRegisterUsageIf()
+    {
+        if (m_allowIfTrue)
+            m_masm.m_allowScratchRegister = m_oldValueOfAllowScratchRegister;
+    }
+
+private:
+    MacroAssembler& m_masm;
+    bool m_allowIfTrue;
+    bool m_oldValueOfAllowScratchRegister;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)

assembler/CPU.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,7 @@
 
 namespace JSC {
 
-inline bool isARMv7IDIVSupported()
+constexpr bool isARMv7IDIVSupported()
 {
 #if HAVE(ARM_IDIV_INSTRUCTIONS)
     return true;
@@ -38,7 +38,7 @@ inline bool isARMv7IDIVSupported()
 #endif
 }
 
-inline bool isARM64()
+constexpr bool isARM64()
 {
 #if CPU(ARM64)
     return true;
@@ -47,7 +47,7 @@ inline bool isARM64()
 #endif
 }
 
-inline bool isX86()
+constexpr bool isX86()
 {
 #if CPU(X86_64) || CPU(X86)
     return true;
@@ -56,7 +56,7 @@ inline bool isX86()
 #endif
 }
 
-inline bool isX86_64()
+constexpr bool isX86_64()
 {
 #if CPU(X86_64)
     return true;
@@ -65,6 +65,29 @@ inline bool isX86_64()
 #endif
 }
 
+constexpr bool is64Bit()
+{
+#if USE(JSVALUE64)
+    return true;
+#else
+    return false;
+#endif
+}
+
+constexpr bool is32Bit()
+{
+    return !is64Bit();
+}
+
+constexpr bool isMIPS()
+{
+#if CPU(MIPS)
+    return true;
+#else
+    return false;
+#endif
+}
+
 inline bool optimizeForARMv7IDIVSupported()
 {
     return isARMv7IDIVSupported() && Options::useArchitectureSpecificOptimizations();
@@ -85,5 +108,10 @@ inline bool optimizeForX86_64()
     return isX86_64() && Options::useArchitectureSpecificOptimizations();
 }
 
+inline bool hasSensibleDoubleToInt()
+{
+    return optimizeForX86();
+}
+
 } // namespace JSC
 

assembler/LinkBuffer.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,10 +29,10 @@
 #if ENABLE(ASSEMBLER)
 
 #include "CodeBlock.h"
+#include "Disassembler.h"
 #include "JITCode.h"
 #include "JSCInlines.h"
 #include "Options.h"
-#include "VM.h"
 #include <wtf/CompilationThread.h>
 
 namespace JSC {
@@ -50,7 +50,7 @@ LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithoutDisassembly()
     
     ASSERT(m_didAllocate);
     if (m_executableMemory)
-        return CodeRef(m_executableMemory);
+        return CodeRef(*m_executableMemory);
     
     return CodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(m_code));
 }
@@ -196,6 +196,9 @@ void LinkBuffer::copyCompactAndLinkCode(MacroAssembler& macroAssembler, void* ow
 
 void LinkBuffer::linkCode(MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort)
 {
+    // Ensure that the end of the last invalidation point does not extend beyond the end of the buffer.
+    macroAssembler.label();
+
 #if !ENABLE(BRANCH_COMPACTION)
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
     macroAssembler.m_assembler.buffer().flushConstantPool(false);
@@ -234,8 +237,12 @@ void LinkBuffer::allocate(MacroAssembler& macroAssembler, void* ownerUID, JITCom
         return;
     }
     
-    ASSERT(m_vm != nullptr);
-    m_executableMemory = m_vm->executableAllocator.allocate(*m_vm, initialSize, ownerUID, effort);
+    while (initialSize % jitAllocationGranule) {
+        macroAssembler.breakpoint();
+        initialSize = macroAssembler.m_assembler.codeSize();
+    }
+    
+    m_executableMemory = ExecutableAllocator::singleton().allocate(initialSize, ownerUID, effort);
     if (!m_executableMemory)
         return;
     m_code = m_executableMemory->start();

assembler/LinkBuffer.h

@@ -43,7 +43,6 @@
 namespace JSC {
 
 class CodeBlock;
-class VM;
 
 // LinkBuffer:
 //
@@ -79,11 +78,10 @@ class LinkBuffer {
 #endif
 
 public:
-    LinkBuffer(VM& vm, MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort = JITCompilationMustSucceed)
+    LinkBuffer(MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort = JITCompilationMustSucceed)
         : m_size(0)
         , m_didAllocate(false)
         , m_code(0)
-        , m_vm(&vm)
 #ifndef NDEBUG
         , m_completed(false)
 #endif
@@ -95,7 +93,6 @@ public:
         : m_size(size)
         , m_didAllocate(false)
         , m_code(code)
-        , m_vm(0)
 #ifndef NDEBUG
         , m_completed(false)
 #endif
@@ -253,8 +250,6 @@ public:
     bool wasAlreadyDisassembled() const { return m_alreadyDisassembled; }
     void didAlreadyDisassemble() { m_alreadyDisassembled = true; }
 
-    VM& vm() { return *m_vm; }
-
 private:
 #if ENABLE(BRANCH_COMPACTION)
     int executableOffsetFor(int location)
@@ -305,7 +300,6 @@ private:
 #endif
     bool m_didAllocate;
     void* m_code;
-    VM* m_vm;
 #ifndef NDEBUG
     bool m_completed;
 #endif

assembler/MIPSAssembler.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
  * Copyright (C) 2009 University of Szeged
  * All rights reserved.
  * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
@@ -32,6 +32,7 @@
 
 #include "AssemblerBuffer.h"
 #include "JITCompilationEffort.h"
+#include <limits.h>
 #include <wtf/Assertions.h>
 #include <wtf/SegmentedVector.h>
 
@@ -192,8 +193,23 @@ public:
         emitInst(0x00000000);
     }
     
+    static void fillNops(void* base, size_t size, bool isCopyingToExecutableMemory)
+    {
+        UNUSED_PARAM(isCopyingToExecutableMemory);
+        RELEASE_ASSERT(!(size % sizeof(int32_t)));
+
+        int32_t* ptr = static_cast<int32_t*>(base);
+        const size_t num32s = size / sizeof(int32_t);
+        const int32_t insn = 0x00000000;
+        for (size_t i = 0; i < num32s; i++)
+            *ptr++ = insn;
+    }
+    
     void sync()
     {
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=169984
+        // We might get a performance improvements by using SYNC_MB in some or
+        // all cases.
         emitInst(0x0000000f);
     }
 
@@ -447,6 +463,14 @@ public:
         emitInst(0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
     }
 
+    static bool isBkpt(void* address)
+    {
+        int value = 512; /* BRK_BUG */
+        MIPSWord expected = (0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
+        MIPSWord candidateInstruction = *reinterpret_cast<MIPSWord*>(address);
+        return candidateInstruction == expected;
+    }
+
     void bgez(RegisterID rs, int imm)
     {
         emitInst(0x04010000 | (rs << OP_SH_RS) | (imm & 0xffff));
@@ -815,6 +839,11 @@ public:
         cacheFlush(insn, flushSize);
     }
 
+    static void relinkJumpToNop(void* from)
+    {
+        relinkJump(from, from);
+    }
+
     static void relinkCall(void* from, void* to)
     {
         void* start;
@@ -888,6 +917,11 @@ public:
         return sizeof(MIPSWord) * 4;
     }
 
+    static constexpr ptrdiff_t patchableJumpSize()
+    {
+        return sizeof(MIPSWord) * 8;
+    }
+
     static void revertJumpToMove(void* instructionStart, RegisterID rt, int imm)
     {
         MIPSWord* insn = static_cast<MIPSWord*>(instructionStart);

assembler/MacroAssembler.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,15 +35,15 @@ namespace JSC {
 const double MacroAssembler::twoToThe32 = (double)0x100000000ull;
 
 #if ENABLE(MASM_PROBE)
-static void stdFunctionCallback(MacroAssembler::ProbeContext* context)
+static void stdFunctionCallback(ProbeContext* context)
 {
-    auto func = static_cast<const std::function<void (MacroAssembler::ProbeContext*)>*>(context->arg1);
+    auto func = static_cast<const std::function<void(ProbeContext*)>*>(context->arg);
     (*func)(context);
 }
     
-void MacroAssembler::probe(std::function<void (MacroAssembler::ProbeContext*)> func)
+void MacroAssembler::probe(std::function<void(ProbeContext*)> func)
 {
-    probe(stdFunctionCallback, new std::function<void (MacroAssembler::ProbeContext*)>(func), 0);
+    probe(stdFunctionCallback, new std::function<void(ProbeContext*)>(func));
 }
 #endif // ENABLE(MASM_PROBE)
 

assembler/MacroAssembler.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -55,12 +55,6 @@ namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
-#elif CPU(SH4)
-#include "MacroAssemblerSH4.h"
-namespace JSC {
-typedef MacroAssemblerSH4 MacroAssemblerBase;
-};
-
 #else
 #error "The MacroAssembler is not supported on this platform."
 #endif
@@ -69,6 +63,13 @@ typedef MacroAssemblerSH4 MacroAssemblerBase;
 
 namespace JSC {
 
+namespace Printer {
+
+struct PrintRecord;
+typedef Vector<PrintRecord> PrintRecordList;
+
+}
+
 class MacroAssembler : public MacroAssemblerBase {
 public:
 
@@ -117,12 +118,13 @@ public:
     using MacroAssemblerBase::branch32;
     using MacroAssemblerBase::compare32;
     using MacroAssemblerBase::move;
+    using MacroAssemblerBase::moveDouble;
     using MacroAssemblerBase::add32;
     using MacroAssemblerBase::mul32;
     using MacroAssemblerBase::and32;
     using MacroAssemblerBase::branchAdd32;
     using MacroAssemblerBase::branchMul32;
-#if CPU(ARM64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(X86_64)
+#if CPU(ARM64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(X86_64) || CPU(MIPS)
     using MacroAssemblerBase::branchPtr;
 #endif
     using MacroAssemblerBase::branchSub32;
@@ -142,6 +144,7 @@ public:
     static const double twoToThe32; // This is super useful for some double code.
 
     // Utilities used by the DFG JIT.
+    using AbstractMacroAssemblerBase::invert;
     using MacroAssemblerBase::invert;
     
     static DoubleCondition invert(DoubleCondition cond)
@@ -492,6 +495,30 @@ public:
         return !(random() & (BlindingModulus - 1));
     }
 
+    void move(Address src, Address dest, RegisterID scratch)
+    {
+        loadPtr(src, scratch);
+        storePtr(scratch, dest);
+    }
+    
+    void move32(Address src, Address dest, RegisterID scratch)
+    {
+        load32(src, scratch);
+        store32(scratch, dest);
+    }
+    
+    void moveFloat(Address src, Address dest, FPRegisterID scratch)
+    {
+        loadFloat(src, scratch);
+        storeFloat(scratch, dest);
+    }
+    
+    void moveDouble(Address src, Address dest, FPRegisterID scratch)
+    {
+        loadDouble(src, scratch);
+        storeDouble(scratch, dest);
+    }
+
     // Ptr methods
     // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
     // FIXME: should this use a test for 32-bitness instead of this specific exception?
@@ -616,6 +643,10 @@ public:
         xor32(imm, srcDest);
     }
 
+    void xorPtr(Address src, RegisterID dest)
+    {
+        xor32(src, dest);
+    }
 
     void loadPtr(ImplicitAddress address, RegisterID dest)
     {
@@ -632,6 +663,18 @@ public:
         load32(address, dest);
     }
 
+#if ENABLE(FAST_TLS_JIT)
+    void loadFromTLSPtr(uint32_t offset, RegisterID dst)
+    {
+        loadFromTLS32(offset, dst);
+    }
+
+    void storeToTLSPtr(RegisterID src, uint32_t offset)
+    {
+        storeToTLS32(src, offset);
+    }
+#endif
+
     DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
     {
         return load32WithAddressOffsetPatch(address, dest);
@@ -782,7 +825,7 @@ public:
         return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
     }
 
-#else // !CPU(X86_64)
+#else // !CPU(X86_64) && !CPU(ARM64)
 
     void addPtr(RegisterID src, RegisterID dest)
     {
@@ -914,6 +957,11 @@ public:
         xor64(src, dest);
     }
     
+    void xorPtr(Address src, RegisterID dest)
+    {
+        xor64(src, dest);
+    }
+    
     void xorPtr(RegisterID src, Address dest)
     {
         xor64(src, dest);
@@ -939,6 +987,17 @@ public:
         load64(address, dest);
     }
 
+#if ENABLE(FAST_TLS_JIT)
+    void loadFromTLSPtr(uint32_t offset, RegisterID dst)
+    {
+        loadFromTLS64(offset, dst);
+    }
+    void storeToTLSPtr(RegisterID src, uint32_t offset)
+    {
+        storeToTLS64(src, offset);
+    }
+#endif
+
     DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
     {
         return load64WithAddressOffsetPatch(address, dest);
@@ -1278,6 +1337,14 @@ public:
             move(imm.asTrustedImm64(), dest);
     }
 
+#if CPU(X86_64) || CPU(ARM64)
+    void moveDouble(Imm64 imm, FPRegisterID dest)
+    {
+        move(imm, scratchRegister());
+        move64ToDouble(scratchRegister(), dest);
+    }
+#endif
+
     void and64(Imm32 imm, RegisterID dest)
     {
         if (shouldBlind(imm)) {
@@ -1768,17 +1835,128 @@ public:
     }
 
 #if ENABLE(MASM_PROBE)
-    using MacroAssemblerBase::probe;
+    struct CPUState;
+
+    // This function emits code to preserve the CPUState (e.g. registers),
+    // call a user supplied probe function, and restore the CPUState before
+    // continuing with other JIT generated code.
+    //
+    // The user supplied probe function will be called with a single pointer to
+    // a ProbeContext struct (defined below) which contains, among other things,
+    // the preserved CPUState. This allows the user probe function to inspect
+    // the CPUState at that point in the JIT generated code.
+    //
+    // If the user probe function alters the register values in the ProbeContext,
+    // the altered values will be loaded into the CPU registers when the probe
+    // returns.
+    //
+    // The ProbeContext is stack allocated and is only valid for the duration
+    // of the call to the user probe function.
+    //
+    // Note: this version of probe() should be implemented by the target specific
+    // MacroAssembler.
+    void probe(ProbeFunction, void* arg);
+
+    void probe(std::function<void(ProbeContext*)>);
+#endif // ENABLE(MASM_PROBE)
 
     // Let's you print from your JIT generated code.
+    // This only works if ENABLE(MASM_PROBE). Otherwise, print() is a no-op.
     // See comments in MacroAssemblerPrinter.h for examples of how to use this.
     template<typename... Arguments>
-    void print(Arguments... args);
+    void print(Arguments&&... args);
 
-    void probe(std::function<void (ProbeContext*)>);
-#endif
+    void print(Printer::PrintRecordList*);
 };
 
+#if ENABLE(MASM_PROBE)
+
+#define DECLARE_REGISTER(_type, _regName) \
+    _type _regName;
+
+struct MacroAssembler::CPUState {
+    FOR_EACH_CPU_REGISTER(DECLARE_REGISTER)
+
+    static inline const char* gprName(RegisterID);
+    static inline const char* fprName(FPRegisterID);
+    inline void*& gpr(RegisterID);
+    inline double& fpr(FPRegisterID);
+};
+#undef DECLARE_REGISTER
+
+inline const char* MacroAssembler::CPUState::gprName(RegisterID regID)
+{
+#define DECLARE_REGISTER(_type, _regName) \
+    case RegisterID::_regName: \
+        return #_regName;
+
+    switch (regID) {
+        FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+#undef DECLARE_REGISTER
+}
+
+inline const char* MacroAssembler::CPUState::fprName(FPRegisterID regID)
+{
+#define DECLARE_REGISTER(_type, _regName) \
+    case FPRegisterID::_regName: \
+        return #_regName;
+
+    switch (regID) {
+        FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+#undef DECLARE_REGISTER
+}
+
+inline void*& MacroAssembler::CPUState::gpr(RegisterID regID)
+{
+#define DECLARE_REGISTER(_type, _regName) \
+    case RegisterID::_regName: \
+        return _regName;
+
+    switch (regID) {
+        FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+#undef DECLARE_REGISTER
+}
+
+inline double& MacroAssembler::CPUState::fpr(FPRegisterID regID)
+{
+#define DECLARE_REGISTER(_type, _regName) \
+    case FPRegisterID::_regName: \
+        return _regName;
+
+    switch (regID) {
+        FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+#undef DECLARE_REGISTER
+}
+
+struct ProbeContext {
+    using CPUState = MacroAssembler::CPUState;
+    using RegisterID = MacroAssembler::RegisterID;
+    using FPRegisterID = MacroAssembler::FPRegisterID;
+
+    ProbeFunction probeFunction;
+    void* arg;
+    CPUState cpu;
+
+    // Convenience methods:
+    void*& gpr(RegisterID regID) { return cpu.gpr(regID); }
+    double& fpr(FPRegisterID regID) { return cpu.fpr(regID); }
+    const char* gprName(RegisterID regID) { return cpu.gprName(regID); }
+    const char* fprName(FPRegisterID regID) { return cpu.fprName(regID); }
+};
+#endif // ENABLE(MASM_PROBE)
+    
 } // namespace JSC
 
 namespace WTF {

assembler/MacroAssemblerARM.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc.
+ * Copyright (C) 2013-2017 Apple Inc.
  * Copyright (C) 2009 University of Szeged
  * All rights reserved.
  *
@@ -28,8 +28,7 @@
 #include "config.h"
 
 #if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
-
-#include "MacroAssemblerARM.h"
+#include "MacroAssembler.h"
 
 #include <wtf/InlineASM.h>
 
@@ -103,15 +102,14 @@ extern "C" void ctiMasmProbeTrampoline();
 
 #if COMPILER(GCC_OR_CLANG)
     
-// The following are offsets for MacroAssemblerARM::ProbeContext fields accessed
+// The following are offsets for ProbeContext fields accessed
 // by the ctiMasmProbeTrampoline stub.
 
 #define PTR_SIZE 4
 #define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
-#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
-#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+#define PROBE_ARG_OFFSET (1 * PTR_SIZE)
 
-#define PROBE_FIRST_GPREG_OFFSET (4 * PTR_SIZE)
+#define PROBE_FIRST_GPREG_OFFSET (2 * PTR_SIZE)
 
 #define GPREG_SIZE 4
 #define PROBE_CPU_R0_OFFSET (PROBE_FIRST_GPREG_OFFSET + (0 * GPREG_SIZE))
@@ -155,13 +153,15 @@ extern "C" void ctiMasmProbeTrampoline();
 #define PROBE_CPU_D15_OFFSET (PROBE_FIRST_FPREG_OFFSET + (15 * FPREG_SIZE))
 
 #define PROBE_SIZE (PROBE_FIRST_FPREG_OFFSET + (16 * FPREG_SIZE))
+#define PROBE_ALIGNED_SIZE (PROBE_SIZE)
 
 // These ASSERTs remind you that if you change the layout of ProbeContext,
 // you need to change ctiMasmProbeTrampoline offsets above to match.
-#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerARM::ProbeContext, x)
+#define PROBE_OFFSETOF(x) offsetof(struct ProbeContext, x)
 COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
-COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
-COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg) == PROBE_ARG_OFFSET, ProbeContext_arg_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(!(PROBE_CPU_R0_OFFSET & 0x3), ProbeContext_cpu_r0_offset_should_be_4_byte_aligned);
 
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r0) == PROBE_CPU_R0_OFFSET, ProbeContext_cpu_r0_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r1) == PROBE_CPU_R1_OFFSET, ProbeContext_cpu_r1_offset_matches_ctiMasmProbeTrampoline);
@@ -183,6 +183,8 @@ COMPILE_ASSERT(PROBE_OFFSETOF(cpu.pc) == PROBE_CPU_PC_OFFSET, ProbeContext_cpu_p
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.apsr) == PROBE_CPU_APSR_OFFSET, ProbeContext_cpu_apsr_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fpscr) == PROBE_CPU_FPSCR_OFFSET, ProbeContext_cpu_fpscr_offset_matches_ctiMasmProbeTrampoline);
 
+COMPILE_ASSERT(!(PROBE_CPU_D0_OFFSET & 0xf), ProbeContext_cpu_d0_offset_should_be_16_byte_aligned);
+
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d0) == PROBE_CPU_D0_OFFSET, ProbeContext_cpu_d0_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d1) == PROBE_CPU_D1_OFFSET, ProbeContext_cpu_d1_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d2) == PROBE_CPU_D2_OFFSET, ProbeContext_cpu_d2_offset_matches_ctiMasmProbeTrampoline);
@@ -199,7 +201,9 @@ COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d12) == PROBE_CPU_D12_OFFSET, ProbeContext_cpu
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d13) == PROBE_CPU_D13_OFFSET, ProbeContext_cpu_d13_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d14) == PROBE_CPU_D14_OFFSET, ProbeContext_cpu_d14_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d15) == PROBE_CPU_D15_OFFSET, ProbeContext_cpu_d15_offset_matches_ctiMasmProbeTrampoline);
-COMPILE_ASSERT(sizeof(MacroAssemblerARM::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(sizeof(ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(!(PROBE_ALIGNED_SIZE & 0xf), ProbeContext_aligned_size_offset_should_be_16_byte_aligned);
 #undef PROBE_OFFSETOF
 
 asm (
@@ -212,16 +216,15 @@ asm (
     // MacroAssemblerARM::probe() has already generated code to store some values.
     // The top of stack now looks like this:
     //     esp[0 * ptrSize]: probeFunction
-    //     esp[1 * ptrSize]: arg1
-    //     esp[2 * ptrSize]: arg2
-    //     esp[3 * ptrSize]: saved r3 / S0
-    //     esp[4 * ptrSize]: saved ip
-    //     esp[5 * ptrSize]: saved lr
-    //     esp[6 * ptrSize]: saved sp
+    //     esp[1 * ptrSize]: arg
+    //     esp[2 * ptrSize]: saved r3 / S0
+    //     esp[3 * ptrSize]: saved ip
+    //     esp[4 * ptrSize]: saved lr
+    //     esp[5 * ptrSize]: saved sp
 
     "mov       ip, sp" "\n"
     "mov       r3, sp" "\n"
-    "sub       r3, r3, #" STRINGIZE_VALUE_OF(PROBE_SIZE) "\n"
+    "sub       r3, r3, #" STRINGIZE_VALUE_OF(PROBE_ALIGNED_SIZE) "\n"
 
     // The ARM EABI specifies that the stack needs to be 16 byte aligned.
     "bic       r3, r3, #0xf" "\n"
@@ -238,16 +241,14 @@ asm (
     "ldr       lr, [ip, #0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
     "ldr       lr, [ip, #1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
-    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG_OFFSET) "]" "\n"
     "ldr       lr, [ip, #2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
-    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "]" "\n"
-    "ldr       lr, [ip, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R3_OFFSET) "]" "\n"
-    "ldr       lr, [ip, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       lr, [ip, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
-    "ldr       lr, [ip, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       lr, [ip, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
-    "ldr       lr, [ip, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       lr, [ip, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
 
     "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
@@ -348,15 +349,14 @@ asm (
 );
 #endif // COMPILER(GCC_OR_CLANG)
 
-void MacroAssemblerARM::probe(MacroAssemblerARM::ProbeFunction function, void* arg1, void* arg2)
+void MacroAssembler::probe(ProbeFunction function, void* arg)
 {
     push(RegisterID::sp);
     push(RegisterID::lr);
     push(RegisterID::ip);
     push(RegisterID::S0);
     // The following uses RegisterID::S0. So, they must come after we push S0 above.
-    push(trustedImm32FromPtr(arg2));
-    push(trustedImm32FromPtr(arg1));
+    push(trustedImm32FromPtr(arg));
     push(trustedImm32FromPtr(function));
 
     move(trustedImm32FromPtr(ctiMasmProbeTrampoline), RegisterID::S0);

assembler/MacroAssemblerARM.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2013-2016 Apple Inc.
+ * Copyright (C) 2008-2017 Apple Inc.
  * Copyright (C) 2009, 2010 University of Szeged
  * All rights reserved.
  *
@@ -34,7 +34,7 @@
 
 namespace JSC {
 
-class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler, MacroAssemblerARM> {
+class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
     static const int DoubleConditionMask = 0x0f;
     static const int DoubleConditionBitSpecial = 0x10;
     COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
@@ -358,6 +358,12 @@ public:
         m_assembler.eors(dest, op1, op2);
     }
 
+    void xor32(Address src, RegisterID dest)
+    {
+        load32(src, ARMRegisters::S1);
+        xor32(ARMRegisters::S1, dest);
+    }
+
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
         if (imm.m_value == -1)
@@ -955,6 +961,8 @@ public:
         m_assembler.bkpt(0);
     }
 
+    static bool isBreakpoint(void* address) { return ARMAssembler::isBkpt(address); }
+
     Call nearCall()
     {
         m_assembler.loadBranchTarget(ARMRegisters::S1, ARMAssembler::AL, true);
@@ -1183,6 +1191,12 @@ public:
     static bool supportsFloatingPointAbs() { return false; }
     static bool supportsFloatingPointRounding() { return false; }
 
+
+    void loadFloat(ImplicitAddress address, FPRegisterID dest)
+    {
+        m_assembler.dataTransferFloat(ARMAssembler::LoadFloat, dest, address.base, address.offset);
+    }
+
     void loadFloat(BaseIndex address, FPRegisterID dest)
     {
         m_assembler.baseIndexTransferFloat(ARMAssembler::LoadFloat, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
@@ -1222,6 +1236,11 @@ public:
         CRASH();
     }
 
+    void storeFloat(FPRegisterID src, ImplicitAddress address)
+    {
+        m_assembler.dataTransferFloat(ARMAssembler::StoreFloat, src, address.base, address.offset);
+    }
+
     void storeFloat(FPRegisterID src, BaseIndex address)
     {
         m_assembler.baseIndexTransferFloat(ARMAssembler::StoreFloat, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
@@ -1540,10 +1559,6 @@ public:
         ARMAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
     }
 
-#if ENABLE(MASM_PROBE)
-    void probe(ProbeFunction, void* arg1, void* arg2);
-#endif // ENABLE(MASM_PROBE)
-
 protected:
     ARMAssembler::Condition ARMCondition(RelationalCondition cond)
     {
@@ -1571,37 +1586,6 @@ protected:
         m_assembler.blx(ARMRegisters::S1);
     }
 
-private:
-    friend class LinkBuffer;
-
-    void internalCompare32(RegisterID left, TrustedImm32 right)
-    {
-        ARMWord tmp = (static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
-        if (tmp != ARMAssembler::InvalidImmediate)
-            m_assembler.cmn(left, tmp);
-        else
-            m_assembler.cmp(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
-    }
-
-    void internalCompare32(Address left, TrustedImm32 right)
-    {
-        ARMWord tmp = (static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
-        load32(left, ARMRegisters::S1);
-        if (tmp != ARMAssembler::InvalidImmediate)
-            m_assembler.cmn(ARMRegisters::S1, tmp);
-        else
-            m_assembler.cmp(ARMRegisters::S1, m_assembler.getImm(right.m_value, ARMRegisters::S0));
-    }
-
-    static void linkCall(void* code, Call call, FunctionPtr function)
-    {
-        if (call.isFlagSet(Call::Tail))
-            ARMAssembler::linkJump(code, call.m_label, function.value());
-        else
-            ARMAssembler::linkCall(code, call.m_label, function.value());
-    }
-
-
 #if ENABLE(MASM_PROBE)
     inline TrustedImm32 trustedImm32FromPtr(void* ptr)
     {
@@ -1619,6 +1603,36 @@ private:
     }
 #endif
 
+private:
+    friend class LinkBuffer;
+
+    void internalCompare32(RegisterID left, TrustedImm32 right)
+    {
+        ARMWord tmp = (!right.m_value || static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        if (tmp != ARMAssembler::InvalidImmediate)
+            m_assembler.cmn(left, tmp);
+        else
+            m_assembler.cmp(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+    }
+
+    void internalCompare32(Address left, TrustedImm32 right)
+    {
+        ARMWord tmp = (!right.m_value || static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        load32(left, ARMRegisters::S1);
+        if (tmp != ARMAssembler::InvalidImmediate)
+            m_assembler.cmn(ARMRegisters::S1, tmp);
+        else
+            m_assembler.cmp(ARMRegisters::S1, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+    }
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            ARMAssembler::linkJump(code, call.m_label, function.value());
+        else
+            ARMAssembler::linkCall(code, call.m_label, function.value());
+    }
+
     static const bool s_isVFPPresent;
 };
 

assembler/MacroAssemblerARM64.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if ENABLE(ASSEMBLER) && CPU(ARM64)
-#include "MacroAssemblerARM64.h"
+#include "MacroAssembler.h"
 
 #include <wtf/InlineASM.h>
 
@@ -40,14 +40,13 @@ using namespace ARM64Registers;
 
 #if COMPILER(GCC_OR_CLANG)
 
-// The following are offsets for MacroAssemblerARM64::ProbeContext fields accessed
+// The following are offsets for ProbeContext fields accessed
 // by the ctiMasmProbeTrampoline stub.
 #define PTR_SIZE 8
 #define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
-#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
-#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+#define PROBE_ARG_OFFSET (1 * PTR_SIZE)
 
-#define PROBE_FIRST_GPREG_OFFSET (3 * PTR_SIZE)
+#define PROBE_FIRST_GPREG_OFFSET (2 * PTR_SIZE)
 
 #define GPREG_SIZE 8
 #define PROBE_CPU_X0_OFFSET (PROBE_FIRST_GPREG_OFFSET + (0 * GPREG_SIZE))
@@ -125,13 +124,15 @@ using namespace ARM64Registers;
 #define PROBE_SIZE (PROBE_FIRST_FPREG_OFFSET + (32 * FPREG_SIZE))
 #define SAVED_CALLER_SP PROBE_SIZE
 #define PROBE_SIZE_PLUS_SAVED_CALLER_SP (SAVED_CALLER_SP + PTR_SIZE)
+#define PROBE_ALIGNED_SIZE (PROBE_SIZE_PLUS_SAVED_CALLER_SP)
 
 // These ASSERTs remind you that if you change the layout of ProbeContext,
 // you need to change ctiMasmProbeTrampoline offsets above to match.
-#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerARM64::ProbeContext, x)
+#define PROBE_OFFSETOF(x) offsetof(struct ProbeContext, x)
 COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
-COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
-COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg) == PROBE_ARG_OFFSET, ProbeContext_arg_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(!(PROBE_CPU_X0_OFFSET & 0x7), ProbeContext_cpu_r0_offset_should_be_8_byte_aligned);
 
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x0) == PROBE_CPU_X0_OFFSET, ProbeContext_cpu_x0_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x1) == PROBE_CPU_X1_OFFSET, ProbeContext_cpu_x1_offset_matches_ctiMasmProbeTrampoline);
@@ -171,6 +172,8 @@ COMPILE_ASSERT(PROBE_OFFSETOF(cpu.pc) == PROBE_CPU_PC_OFFSET, ProbeContext_cpu_p
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.nzcv) == PROBE_CPU_NZCV_OFFSET, ProbeContext_cpu_nzcv_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fpsr) == PROBE_CPU_FPSR_OFFSET, ProbeContext_cpu_fpsr_offset_matches_ctiMasmProbeTrampoline);
 
+COMPILE_ASSERT(!(PROBE_CPU_Q0_OFFSET & 0x7), ProbeContext_cpu_q0_offset_should_be_8_byte_aligned);
+
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q0) == PROBE_CPU_Q0_OFFSET, ProbeContext_cpu_q0_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q1) == PROBE_CPU_Q1_OFFSET, ProbeContext_cpu_q1_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q2) == PROBE_CPU_Q2_OFFSET, ProbeContext_cpu_q2_offset_matches_ctiMasmProbeTrampoline);
@@ -205,7 +208,8 @@ COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q29) == PROBE_CPU_Q29_OFFSET, ProbeContext_cpu
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q30) == PROBE_CPU_Q30_OFFSET, ProbeContext_cpu_q30_offset_matches_ctiMasmProbeTrampoline);
 COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q31) == PROBE_CPU_Q31_OFFSET, ProbeContext_cpu_q31_offset_matches_ctiMasmProbeTrampoline);
 
-COMPILE_ASSERT(sizeof(MacroAssemblerARM64::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(sizeof(ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(!(PROBE_ALIGNED_SIZE & 0xf), ProbeContext_aligned_size_offset_should_be_16_byte_aligned);
 
 #undef PROBE_OFFSETOF
 
@@ -220,17 +224,16 @@ asm (
     // The top of stack (the caller save buffer) now looks like this:
     //     sp[0 * ptrSize]: probeFunction
     //     sp[1 * ptrSize]: arg1
-    //     sp[2 * ptrSize]: arg2
-    //     sp[3 * ptrSize]: address of arm64ProbeTrampoline()
-    //     sp[4 * ptrSize]: saved x27
-    //     sp[5 * ptrSize]: saved x28
-    //     sp[6 * ptrSize]: saved lr
-    //     sp[7 * ptrSize]: saved sp
+    //     sp[2 * ptrSize]: address of arm64ProbeTrampoline()
+    //     sp[3 * ptrSize]: saved x27
+    //     sp[4 * ptrSize]: saved x28
+    //     sp[5 * ptrSize]: saved lr
+    //     sp[6 * ptrSize]: saved sp
 
     "mov       x27, sp" "\n"
     "mov       x28, sp" "\n"
 
-    "sub       x28, x28, #" STRINGIZE_VALUE_OF(PROBE_SIZE_PLUS_SAVED_CALLER_SP) "\n"
+    "sub       x28, x28, #" STRINGIZE_VALUE_OF(PROBE_ALIGNED_SIZE) "\n"
 
     // The ARM EABI specifies that the stack needs to be 16 byte aligned.
     "bic       x28, x28, #0xf" "\n"
@@ -266,16 +269,16 @@ asm (
     "str       x25, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X25_OFFSET) "]" "\n"
     "str       x26, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X26_OFFSET) "]" "\n"
 
-    "ldr       x0, [x27, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       x0, [x27, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X27_OFFSET) "]" "\n"
-    "ldr       x0, [x27, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       x0, [x27, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X28_OFFSET) "]" "\n"
 
     "str       fp, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FP_OFFSET) "]" "\n"
 
-    "ldr       x0, [x27, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       x0, [x27, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
-    "ldr       x0, [x27, #7 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "ldr       x0, [x27, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
 
     "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
@@ -288,9 +291,7 @@ asm (
     "ldr       x0, [x27, #0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
     "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
     "ldr       x0, [x27, #1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
-    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "]" "\n"
-    "ldr       x0, [x27, #2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
-    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG_OFFSET) "]" "\n"
 
     "str       d0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q0_OFFSET) "]" "\n"
     "str       d1, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q1_OFFSET) "]" "\n"
@@ -454,7 +455,7 @@ asm (
 );
 #endif // COMPILER(GCC_OR_CLANG)
 
-static void arm64ProbeTrampoline(MacroAssemblerARM64::ProbeContext* context)
+static void arm64ProbeTrampoline(ProbeContext* context)
 {
     void* origSP = context->cpu.sp;
     void* origPC = context->cpu.pc;
@@ -471,33 +472,31 @@ static void arm64ProbeTrampoline(MacroAssemblerARM64::ProbeContext* context)
     }
 }
 
-void MacroAssemblerARM64::probe(MacroAssemblerARM64::ProbeFunction function, void* arg1, void* arg2)
+void MacroAssembler::probe(ProbeFunction function, void* arg)
 {
-    sub64(TrustedImm32(8 * 8), sp);
+    sub64(TrustedImm32(7 * 8), sp);
 
-    store64(x27, Address(sp, 4 * 8));
-    store64(x28, Address(sp, 5 * 8));
-    store64(lr, Address(sp, 6 * 8));
+    store64(x27, Address(sp, 3 * 8));
+    store64(x28, Address(sp, 4 * 8));
+    store64(lr, Address(sp, 5 * 8));
 
-    add64(TrustedImm32(8 * 8), sp, x28);
-    store64(x28, Address(sp, 7 * 8)); // Save original sp value.
+    add64(TrustedImm32(7 * 8), sp, x28);
+    store64(x28, Address(sp, 6 * 8)); // Save original sp value.
 
     move(TrustedImmPtr(reinterpret_cast<void*>(function)), x28);
     store64(x28, Address(sp));
-    move(TrustedImmPtr(arg1), x28);
+    move(TrustedImmPtr(arg), x28);
     store64(x28, Address(sp, 1 * 8));
-    move(TrustedImmPtr(arg2), x28);
-    store64(x28, Address(sp, 2 * 8));
     move(TrustedImmPtr(reinterpret_cast<void*>(arm64ProbeTrampoline)), x28);
-    store64(x28, Address(sp, 3 * 8));
+    store64(x28, Address(sp, 2 * 8));
 
     move(TrustedImmPtr(reinterpret_cast<void*>(ctiMasmProbeTrampoline)), x28);
     m_assembler.blr(x28);
 
     // ctiMasmProbeTrampoline should have restored every register except for
     // lr and the sp.
-    load64(Address(sp, 6 * 8), lr);
-    add64(TrustedImm32(8 * 8), sp);
+    load64(Address(sp, 5 * 8), lr);
+    add64(TrustedImm32(7 * 8), sp);
 }
 #endif // ENABLE(MASM_PROBE)
 

assembler/MacroAssemblerARM64.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2014-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,13 @@
 
 namespace JSC {
 
-class MacroAssemblerARM64 : public AbstractMacroAssembler<ARM64Assembler, MacroAssemblerARM64> {
+class MacroAssemblerARM64 : public AbstractMacroAssembler<ARM64Assembler> {
 public:
     static const unsigned numGPRs = 32;
     static const unsigned numFPRs = 32;
     
-    static const RegisterID dataTempRegister = ARM64Registers::ip0;
-    static const RegisterID memoryTempRegister = ARM64Registers::ip1;
+    static constexpr RegisterID dataTempRegister = ARM64Registers::ip0;
+    static constexpr RegisterID memoryTempRegister = ARM64Registers::ip1;
 
     RegisterID scratchRegister()
     {
@@ -909,6 +909,12 @@ public:
         xor32(dest, src, dest);
     }
 
+    void xor32(Address src, RegisterID dest)
+    {
+        load32(src, getCachedDataTempRegisterIDAndInvalidate());
+        xor32(dataTempRegister, dest);
+    }
+
     void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
     {
         m_assembler.eor<32>(dest, op1, op2);
@@ -992,6 +998,12 @@ public:
         }
     }
     
+    void xor64(Address src, RegisterID dest)
+    {
+        load64(src, getCachedDataTempRegisterIDAndInvalidate());
+        xor64(dataTempRegister, dest);
+    }
+
     void not32(RegisterID src, RegisterID dest)
     {
         m_assembler.mvn<32>(dest, src);
@@ -1947,6 +1959,16 @@ public:
         andDouble(op1, op2, dest);
     }
 
+    void orDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vorr<64>(dest, op1, op2);
+    }
+
+    void orFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        orDouble(op1, op2, dest);
+    }
+
     void negateDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.fneg<64>(dest, src);
@@ -2223,13 +2245,13 @@ public:
     void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID src, RegisterID dest)
     {
         m_assembler.cmp<32>(left, right);
-        m_assembler.csel<32>(dest, src, dest, ARM64Condition(cond));
+        m_assembler.csel<64>(dest, src, dest, ARM64Condition(cond));
     }
 
     void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
     {
         m_assembler.cmp<32>(left, right);
-        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
     }
 
     void moveConditionally32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
@@ -2287,19 +2309,19 @@ public:
     void moveConditionallyTest32(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
     {
         m_assembler.tst<32>(testReg, mask);
-        m_assembler.csel<32>(dest, src, dest, ARM64Condition(cond));
+        m_assembler.csel<64>(dest, src, dest, ARM64Condition(cond));
     }
 
     void moveConditionallyTest32(ResultCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
     {
         m_assembler.tst<32>(left, right);
-        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
     }
 
     void moveConditionallyTest32(ResultCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
     {
         test32(left, right);
-        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
     }
 
     void moveConditionallyTest64(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
@@ -2539,12 +2561,17 @@ public:
         return branch64(cond, memoryTempRegister, right);
     }
 
-    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    Jump branch64(RelationalCondition cond, BaseIndex left, RegisterID right)
     {
         load64(left, getCachedMemoryTempRegisterIDAndInvalidate());
         return branch64(cond, memoryTempRegister, right);
     }
 
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    {
+        return branch64(cond, left, right);
+    }
+
     Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
     {
         TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
@@ -3077,6 +3104,12 @@ public:
         return Call(label, Call::LinkableNearTail);
     }
 
+    ALWAYS_INLINE Call threadSafePatchableNearCall()
+    {
+        m_assembler.bl();
+        return Call(m_assembler.label(), Call::LinkableNear);
+    }
+
     ALWAYS_INLINE void ret()
     {
         m_assembler.ret();
@@ -3338,6 +3371,8 @@ public:
         m_assembler.brk(imm);
     }
 
+    static bool isBreakpoint(void* address) { return ARM64Assembler::isBrk(address); }
+
     void nop()
     {
         m_assembler.nop();
@@ -3364,6 +3399,290 @@ public:
         m_assembler.dmbISH();
     }
     
+    void loadAcq8SignedExtendTo32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldar<8>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadAcq8(ImplicitAddress address, RegisterID dest)
+    {
+        loadAcq8SignedExtendTo32(address, dest);
+        and32(TrustedImm32(0xff), dest);
+    }
+    
+    void storeRel8(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.stlr<8>(src, extractSimpleAddress(address));
+    }
+    
+    void loadAcq16SignedExtendTo32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldar<16>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadAcq16(ImplicitAddress address, RegisterID dest)
+    {
+        loadAcq16SignedExtendTo32(address, dest);
+        and32(TrustedImm32(0xffff), dest);
+    }
+    
+    void storeRel16(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.stlr<16>(src, extractSimpleAddress(address));
+    }
+    
+    void loadAcq32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldar<32>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadAcq64(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldar<64>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeRel32(RegisterID dest, ImplicitAddress address)
+    {
+        m_assembler.stlr<32>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeRel64(RegisterID dest, ImplicitAddress address)
+    {
+        m_assembler.stlr<64>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadLink8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldxr<8>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadLinkAcq8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldaxr<8>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeCond8(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stxr<8>(result, src, extractSimpleAddress(address));
+    }
+    
+    void storeCondRel8(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stlxr<8>(result, src, extractSimpleAddress(address));
+    }
+    
+    void loadLink16(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldxr<16>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadLinkAcq16(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldaxr<16>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeCond16(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stxr<16>(result, src, extractSimpleAddress(address));
+    }
+    
+    void storeCondRel16(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stlxr<16>(result, src, extractSimpleAddress(address));
+    }
+    
+    void loadLink32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldxr<32>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadLinkAcq32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldaxr<32>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeCond32(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stxr<32>(result, src, extractSimpleAddress(address));
+    }
+    
+    void storeCondRel32(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stlxr<32>(result, src, extractSimpleAddress(address));
+    }
+    
+    void loadLink64(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldxr<64>(dest, extractSimpleAddress(address));
+    }
+    
+    void loadLinkAcq64(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.ldaxr<64>(dest, extractSimpleAddress(address));
+    }
+    
+    void storeCond64(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stxr<64>(result, src, extractSimpleAddress(address));
+    }
+    
+    void storeCondRel64(RegisterID src, ImplicitAddress address, RegisterID result)
+    {
+        m_assembler.stlxr<64>(result, src, extractSimpleAddress(address));
+    }
+    
+    template<typename AddressType>
+    void atomicStrongCAS8(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicStrongCAS<8>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicStrongCAS16(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicStrongCAS<16>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicStrongCAS32(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicStrongCAS<32>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicStrongCAS64(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicStrongCAS<64>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicRelaxedStrongCAS8(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicRelaxedStrongCAS<8>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicRelaxedStrongCAS16(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicRelaxedStrongCAS<16>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicRelaxedStrongCAS32(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicRelaxedStrongCAS<32>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    void atomicRelaxedStrongCAS64(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        atomicRelaxedStrongCAS<64>(cond, expectedAndResult, newValue, address, result);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicWeakCAS8(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicWeakCAS<8>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicWeakCAS16(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicWeakCAS<16>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicWeakCAS32(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicWeakCAS<32>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicWeakCAS64(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicWeakCAS<64>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicRelaxedWeakCAS8(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicRelaxedWeakCAS<8>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicRelaxedWeakCAS16(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicRelaxedWeakCAS<16>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicRelaxedWeakCAS32(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicRelaxedWeakCAS<32>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    template<typename AddressType>
+    JumpList branchAtomicRelaxedWeakCAS64(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        return branchAtomicRelaxedWeakCAS<64>(cond, expectedAndClobbered, newValue, address);
+    }
+    
+    void depend32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.eor<32>(dest, src, src);
+    }
+    
+    void depend64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.eor<64>(dest, src, src);
+    }
+    
+#if ENABLE(FAST_TLS_JIT)
+    // This will use scratch registers if the offset is not legal.
+
+    void loadFromTLS32(uint32_t offset, RegisterID dst)
+    {
+        m_assembler.mrs_TPIDRRO_EL0(dst);
+        and64(TrustedImm32(~7), dst);
+        load32(Address(dst, offset), dst);
+    }
+    
+    void loadFromTLS64(uint32_t offset, RegisterID dst)
+    {
+        m_assembler.mrs_TPIDRRO_EL0(dst);
+        and64(TrustedImm32(~7), dst);
+        load64(Address(dst, offset), dst);
+    }
+
+    static bool loadFromTLSPtrNeedsMacroScratchRegister()
+    {
+        return true;
+    }
+
+    void storeToTLS32(RegisterID src, uint32_t offset)
+    {
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        ASSERT(src != tmp);
+        m_assembler.mrs_TPIDRRO_EL0(tmp);
+        and64(TrustedImm32(~7), tmp);
+        store32(src, Address(tmp, offset));
+    }
+    
+    void storeToTLS64(RegisterID src, uint32_t offset)
+    {
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        ASSERT(src != tmp);
+        m_assembler.mrs_TPIDRRO_EL0(tmp);
+        and64(TrustedImm32(~7), tmp);
+        store64(src, Address(tmp, offset));
+    }
+
+    static bool storeToTLSPtrNeedsMacroScratchRegister()
+    {
+        return true;
+    }
+#endif // ENABLE(FAST_TLS_JIT)
+    
     // Misc helper functions.
 
     // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
@@ -3394,6 +3713,11 @@ public:
         return FunctionPtr(reinterpret_cast<void(*)()>(ARM64Assembler::readCallTarget(call.dataLocation())));
     }
 
+    static void replaceWithVMHalt(CodeLocationLabel instructionStart)
+    {
+        ARM64Assembler::replaceWithVMHalt(instructionStart.executableAddress());
+    }
+
     static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
     {
         ARM64Assembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
@@ -3461,10 +3785,6 @@ public:
         ARM64Assembler::repatchPointer(call.dataLabelPtrAtOffset(REPATCH_OFFSET_CALL_TO_POINTER).dataLocation(), destination.executableAddress());
     }
 
-#if ENABLE(MASM_PROBE)
-    void probe(ProbeFunction, void* arg1, void* arg2);
-#endif // ENABLE(MASM_PROBE)
-
 protected:
     ALWAYS_INLINE Jump makeBranch(ARM64Assembler::Condition cond)
     {
@@ -3866,6 +4186,169 @@ private:
         return false;
     }
     
+    template<int datasize>
+    void loadLink(RegisterID src, RegisterID dest)
+    {
+        m_assembler.ldxr<datasize>(dest, src);
+    }
+    
+    template<int datasize>
+    void loadLinkAcq(RegisterID src, RegisterID dest)
+    {
+        m_assembler.ldaxr<datasize>(dest, src);
+    }
+    
+    template<int datasize>
+    void storeCond(RegisterID src, RegisterID dest, RegisterID result)
+    {
+        m_assembler.stxr<datasize>(src, dest, result);
+    }
+    
+    template<int datasize>
+    void storeCondRel(RegisterID src, RegisterID dest, RegisterID result)
+    {
+        m_assembler.stlxr<datasize>(result, src, dest);
+    }
+    
+    template<int datasize>
+    void signExtend(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+    
+    template<int datasize>
+    Jump branch(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        return branch32(cond, left, right);
+    }
+    
+    template<int datasize>
+    void atomicStrongCAS(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, Address address, RegisterID result)
+    {
+        signExtend<datasize>(expectedAndResult, expectedAndResult);
+        
+        RegisterID simpleAddress = extractSimpleAddress(address);
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        
+        Label reloop = label();
+        loadLinkAcq<datasize>(simpleAddress, tmp);
+        Jump failure = branch<datasize>(NotEqual, expectedAndResult, tmp);
+        
+        storeCondRel<datasize>(newValue, simpleAddress, result);
+        branchTest32(NonZero, result).linkTo(reloop, this);
+        move(TrustedImm32(cond == Success), result);
+        Jump done = jump();
+        
+        failure.link(this);
+        move(tmp, expectedAndResult);
+        storeCondRel<datasize>(tmp, simpleAddress, result);
+        branchTest32(NonZero, result).linkTo(reloop, this);
+        move(TrustedImm32(cond == Failure), result);
+        
+        done.link(this);
+    }
+    
+    template<int datasize, typename AddressType>
+    void atomicRelaxedStrongCAS(StatusCondition cond, RegisterID expectedAndResult, RegisterID newValue, AddressType address, RegisterID result)
+    {
+        signExtend<datasize>(expectedAndResult, expectedAndResult);
+        
+        RegisterID simpleAddress = extractSimpleAddress(address);
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        
+        Label reloop = label();
+        loadLink<datasize>(simpleAddress, tmp);
+        Jump failure = branch<datasize>(NotEqual, expectedAndResult, tmp);
+        
+        storeCond<datasize>(newValue, simpleAddress, result);
+        branchTest32(NonZero, result).linkTo(reloop, this);
+        move(TrustedImm32(cond == Success), result);
+        Jump done = jump();
+        
+        failure.link(this);
+        move(tmp, expectedAndResult);
+        move(TrustedImm32(cond == Failure), result);
+        
+        done.link(this);
+    }
+    
+    template<int datasize, typename AddressType>
+    JumpList branchAtomicWeakCAS(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        signExtend<datasize>(expectedAndClobbered, expectedAndClobbered);
+        
+        RegisterID simpleAddress = extractSimpleAddress(address);
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        
+        JumpList success;
+        JumpList failure;
+
+        loadLinkAcq<datasize>(simpleAddress, tmp);
+        failure.append(branch<datasize>(NotEqual, expectedAndClobbered, tmp));
+        storeCondRel<datasize>(newValue, simpleAddress, expectedAndClobbered);
+        
+        switch (cond) {
+        case Success:
+            success.append(branchTest32(Zero, expectedAndClobbered));
+            failure.link(this);
+            return success;
+        case Failure:
+            failure.append(branchTest32(NonZero, expectedAndClobbered));
+            return failure;
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    template<int datasize, typename AddressType>
+    JumpList branchAtomicRelaxedWeakCAS(StatusCondition cond, RegisterID expectedAndClobbered, RegisterID newValue, AddressType address)
+    {
+        signExtend<datasize>(expectedAndClobbered, expectedAndClobbered);
+        
+        RegisterID simpleAddress = extractSimpleAddress(address);
+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
+        
+        JumpList success;
+        JumpList failure;
+
+        loadLink<datasize>(simpleAddress, tmp);
+        failure.append(branch<datasize>(NotEqual, expectedAndClobbered, tmp));
+        storeCond<datasize>(newValue, simpleAddress, expectedAndClobbered);
+        
+        switch (cond) {
+        case Success:
+            success.append(branchTest32(Zero, expectedAndClobbered));
+            failure.link(this);
+            return success;
+        case Failure:
+            failure.append(branchTest32(NonZero, expectedAndClobbered));
+            return failure;
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    RegisterID extractSimpleAddress(ImplicitAddress address)
+    {
+        if (!address.offset)
+            return address.base;
+        
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        add64(address.base, memoryTempRegister);
+        return memoryTempRegister;
+    }
+
+    // This uses both the memory and data temp, but only returns the memorty temp. So you can use the
+    // data temp after this finishes.
+    RegisterID extractSimpleAddress(BaseIndex address)
+    {
+        RegisterID result = getCachedMemoryTempRegisterIDAndInvalidate();
+        lshift64(address.index, TrustedImm32(address.scale), result);
+        add64(address.base, result);
+        add64(TrustedImm32(address.offset), result);
+        return result;
+    }
+
     Jump jumpAfterFloatingPointCompare(DoubleCondition cond)
     {
         if (cond == DoubleNotEqual) {
@@ -3977,6 +4460,24 @@ ALWAYS_INLINE void MacroAssemblerARM64::storeUnscaledImmediate<16>(RegisterID rt
     m_assembler.sturh(rt, rn, simm);
 }
 
+template<>
+inline void MacroAssemblerARM64::signExtend<8>(RegisterID src, RegisterID dest)
+{
+    signExtend8To32(src, dest);
+}
+
+template<>
+inline void MacroAssemblerARM64::signExtend<16>(RegisterID src, RegisterID dest)
+{
+    signExtend16To32(src, dest);
+}
+
+template<>
+inline MacroAssemblerARM64::Jump MacroAssemblerARM64::branch<64>(RelationalCondition cond, RegisterID left, RegisterID right)
+{
+    return branch64(cond, left, right);
+}
+
 } // namespace JSC
 
 #endif // ENABLE(ASSEMBLER)