Merge lp:~mitya57/ubuntu/saucy/qtwebkit-opensource-src/merge into lp:ubuntu/saucy/qtwebkit-opensource-src

[Dmitry Shachnev]

This is a Debian merge. I've also deleted the old changelog entries, like Debian did.

This is all committed to lp:~kubuntu-packagers/kubuntu-packaging/qtwebkit-opensource-src.

Note that I had to modify dd_experimentalDevicePixelRatio.patch to get it applying correctly, it would be nice if someone made sure that that patch still does what it is expected to do.

[Timo Jyrinki (timo-jyrinki)]

Thanks a lot for the merge, and also the 5.1 adaptation of it committed to the packaging branch.

We have been conservative with qtwebkit so far, because of that add_experimentalDevicePixelRatio.patch which is going away with 5.1 and which the author hasn't rebased himself (bug #1178443). Your modification at least on a first glance looks similar to what I did at http://bazaar.launchpad.net/~kubuntu-packagers/kubuntu-packaging/qtwebkit-opensource-src/revision/27, which was proven to be faulty.

The fix for bug #1171553 also shouldn't be dropped, so I took your branch, added it back and rebuilt. I'm now also building it at qt5-beta2 PPA (although using orig tarball plus packaging branch lp:~kubuntu-packagers/kubuntu-packaging/qtbase-opensource-src_5.0.2, which should be identical). It may then be tested, but if the DPR is still broken it would be best if we stayed at qtwebkit 5.0.1 until Qt 5.1.x, unless a correct rebasing of that patch is done by someone.

[Timo Jyrinki (timo-jyrinki)]

(I meant lp:~kubuntu-packagers/kubuntu-packaging/qtwebkit-opensource-src_5.0.2 of course)

[Dmitry Shachnev (mitya57)]

Thanks for the review, even if we stay on 5.0.1, I would still like to merge changes from Debian (i.e. because qtdoc build-depends on qtwebkit5-doc). Please let me know if I should do a separate 5.0.1-based merge.

[Timo Jyrinki (timo-jyrinki)]

Dmitry: I haven't gotten the 5.0.2 armhf build working, but the first build log seemed like possibly some random hitch somewhere, so I'm trying another one https://launchpad.net/~canonical-qt5-edgers/+archive/qt5-beta2/+build/4769687

The 5.0.2 testing could also take some time better spent on preparing for 5.1.1, so maybe the 5.0.1 + qtdoc merge would be the best route.

[Timo Jyrinki (timo-jyrinki)]

(I just noticed the armhf build problems may be caused by toolchain, as even 5.0.1 is failing to build now: https://launchpad.net/ubuntu/+source/qtwebkit-opensource-src/5.0.1-0ubuntu3)

Unmerged revisions

4. By Dmitry Shachnev on 2013-06-30

* Merge with Debian experimental, remaining changes:
  - Build-depend on qtsensors and qtlocation
  - Add patches:
    + add_experimentalDevicePixelRatio.patch
    + add_module_version.patch
    + devicePixelResolution.patch
    + DidFirstLayout.patch
    + disable_geolocation_501.diff
    + disabling_jit_for_arm.patch
    + file_access.patch
    + fix_gcc48.patch
    + fixTriggerOSKonWebPages.patch
    + LLIntCLoop32BigEndian.patch
  - Add Vcs-Bzr field
* Refresh patches.

=== modified file '.pc/DidFirstLayout.patch/Source/WebKit2/WebProcess/WebPage/WebPage.cpp'
--- .pc/DidFirstLayout.patch/Source/WebKit2/WebProcess/WebPage/WebPage.cpp	2013-05-20 12:00:17 +0000
+++ .pc/DidFirstLayout.patch/Source/WebKit2/WebProcess/WebPage/WebPage.cpp	2013-06-30 08:18:25 +0000
@@ -1018,13 +1018,13 @@
     // Recalculate the recommended layout size, when the available size (device pixel) changes.
     Settings* settings = m_page->settings();
 
-    int minimumLayoutFallbackWidth = std::max(settings->layoutFallbackWidth(), int(m_viewportSize.width() / m_page->deviceScaleFactor()));
+    int minimumLayoutFallbackWidth = std::max(settings->layoutFallbackWidth(), m_viewportSize.width());
 
     // If unset  we use the viewport dimensions. This fits with the behavior of desktop browsers.
     int deviceWidth = (settings->deviceWidth() > 0) ? settings->deviceWidth() : m_viewportSize.width();
     int deviceHeight = (settings->deviceHeight() > 0) ? settings->deviceHeight() : m_viewportSize.height();
 
-    ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, m_page->deviceScaleFactor(), m_viewportSize);
+    ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, 1, m_viewportSize);
     attr.initialScale = m_page->viewportArguments().zoom; // Resets auto (-1) if no value was set by user.
 
     // This also takes care of the relayout.

=== removed file '.pc/LLIntCLoop32BigEndian.patch/Source/JavaScriptCore/ChangeLog'
--- .pc/LLIntCLoop32BigEndian.patch/Source/JavaScriptCore/ChangeLog	2013-05-20 12:00:17 +0000
+++ .pc/LLIntCLoop32BigEndian.patch/Source/JavaScriptCore/ChangeLog	1970-01-01 00:00:00 +0000
@@ -1,9047 +0,0 @@
-2012-12-17  Jonathan Liu  <[e-mail]>
-
-        Fix Math.pow implementation with MinGW-w64
-        https://bugs.webkit.org/show_bug.cgi?id=105087
-
-        Reviewed by Simon Hausmann.
-
-        The MinGW-w64 runtime has different behaviour for pow()
-        compared to other C runtimes. This results in the following
-        test262 tests failing with the latest MinGW-w64 runtime:
-        - S15.8.2.13_A14
-        - S15.8.2.13_A16
-        - S15.8.2.13_A20
-        - S15.8.2.13_A22
-
-        Handle the special cases that are different with MinGW-w64.
-
-        * runtime/MathObject.cpp:
-        (JSC::mathPow):
-
-2012-12-07  Jonathan Liu  <[e-mail]>
-
-        Add missing forward declaration for JSC::ArrayAllocationProfile
-        https://bugs.webkit.org/show_bug.cgi?id=104425
-
-        Reviewed by Kentaro Hara.
-
-        The header for the JSC::ArrayConstructor class is missing a forward
-        declaration for the JSC::ArrayAllocationProfile class which causes
-        compilation to fail when compiling with MinGW-w64.
-
-        * runtime/ArrayConstructor.h:
-        (JSC):
-
-2012-12-07  Jonathan Liu  <[e-mail]>
-
-        Add missing const qualifier to JSC::CodeBlock::getJITType()
-        https://bugs.webkit.org/show_bug.cgi?id=104424
-
-        Reviewed by Laszlo Gombos.
-
-        JSC::CodeBlock::getJITType() has the const qualifier when JIT is
-        enabled but is missing the const qualifier when JIT is disabled.
-
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::getJITType):
-
-2012-11-30  Pierre Rossi  <[e-mail]>
-
-        [Qt] Unreviewed speculative Mac build fix after r136232
-
-        Update the include path so that LLIntAssembly.h is picked up.
-        The bot didn't break until later when a clean build was triggered.
-
-        * JavaScriptCore.pri:
-
-2012-11-30  Allan Sandfeld Jensen  <[e-mail]>
-
-        Crash in conversion of empty OpaqueJSString to Identifier 
-        https://bugs.webkit.org/show_bug.cgi?id=101867
-
-        Reviewed by NOBODY (OOPS!).
-
-        The constructor call used for both null and empty OpaqueJSStrings results
-        in an assertion voilation and crash. This patch instead uses the Identifier
-        constructors which are specifically for null and empty Identifier.
-
-        * API/OpaqueJSString.cpp:
-        (OpaqueJSString::identifier):
-
-2012-11-30  Tor Arne Vestbø  <[e-mail]>
-
-        [Qt] Place the LLIntOffsetsExtractor binaries in debug/release subdirs on Mac
-
-        Otherwise we'll end up using the same LLIntAssembly.h for both build
-        configs of JavaScriptCore -- one of them which will be for the wrong
-        config.
-
-        Reviewed by Simon Hausmann.
-
-        * LLIntOffsetsExtractor.pro:
-
-2012-11-30  Julien BRIANCEAU   <[e-mail]>
-
-        [sh4] Fix compilation warnings in JavaScriptCore JIT for sh4 arch
-        https://bugs.webkit.org/show_bug.cgi?id=103378
-
-        Reviewed by Filip Pizlo.
-
-        * assembler/MacroAssemblerSH4.h:
-        (JSC::MacroAssemblerSH4::branchTest32):
-        (JSC::MacroAssemblerSH4::branchAdd32):
-        (JSC::MacroAssemblerSH4::branchMul32):
-        (JSC::MacroAssemblerSH4::branchSub32):
-        (JSC::MacroAssemblerSH4::branchOr32):
-
-2012-11-29  Rafael Weinstein  <[e-mail]>
-
-        [HTMLTemplateElement] Add feature flag
-        https://bugs.webkit.org/show_bug.cgi?id=103694
-
-        Reviewed by Adam Barth.
-
-        This flag will guard the implementation of the HTMLTemplateElement.
-        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-29  Filip Pizlo  <[e-mail]>
-
-        It should be easy to find code blocks in debug dumps
-        https://bugs.webkit.org/show_bug.cgi?id=103623
-
-        Reviewed by Goeffrey Garen.
-
-        This gives CodeBlock a relatively strong, but also relatively compact, hash. We compute
-        it lazily so that it only impacts run-time when debug support is enabled. We stringify
-        it smartly so that it's short and easy to type. We base it on the source code so that
-        the optimization level is irrelevant. And, we use SHA1 since it's already in our code
-        base. Now, when a piece of code wants to print some debugging to say that it's operating
-        on some code block, it can use this CodeBlockHash instead of memory addresses.
-
-        This also takes CodeBlock debugging into the new world of print() and dataLog(). In
-        particular, CodeBlock::dump() corresponds to the thing you want printed if you do:
-
-        dataLog("I heart ", *myCodeBlock);
-
-        Probably, you want to just print some identifying information at this point rather than
-        the full bytecode dump. So, the existing CodeBlock::dump() has been renamed to
-        CodeBlock::dumpBytecode(), and CodeBlock::dump() now prints the CodeBlockHash plus just
-        a few little tidbits.
-        
-        Here's an example of CodeBlock::dump() output:
-        
-        EkILzr:[0x103883a00, BaselineFunctionCall]
-        
-        EkILzr is the CodeBlockHash. 0x103883a00 is the CodeBlock's address in memory. The other
-        part is self-explanatory.
-
-        Finally, this new notion of CodeBlockHash is available for other purposes like bisecting
-        breakage. As such CodeBlockHash has all of the comparison operator overloads. When
-        bisecting in DFGDriver.cpp, you can now say things like:
-        
-        if (codeBlock->hash() < CodeBlockHash("CAAAAA"))
-            return false;
-        
-        And yes, CAAAAA is near the median hash, and the largest one is smaller than E99999. Such
-        is life when you use base 62 to encode a 32-bit number.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * bytecode/CallLinkInfo.h:
-        (CallLinkInfo):
-        (JSC::CallLinkInfo::specializationKind):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::hash):
-        (JSC):
-        (JSC::CodeBlock::dumpAssumingJITType):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::dumpBytecode):
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::finalizeUnconditionally):
-        (JSC::CodeBlock::resetStubInternal):
-        (JSC::CodeBlock::reoptimize):
-        (JSC::ProgramCodeBlock::jettison):
-        (JSC::EvalCodeBlock::jettison):
-        (JSC::FunctionCodeBlock::jettison):
-        (JSC::CodeBlock::shouldOptimizeNow):
-        (JSC::CodeBlock::tallyFrequentExitSites):
-        (JSC::CodeBlock::dumpValueProfiles):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::specializationKind):
-        (CodeBlock):
-        (JSC::CodeBlock::getJITType):
-        * bytecode/CodeBlockHash.cpp: Added.
-        (JSC):
-        (JSC::CodeBlockHash::CodeBlockHash):
-        (JSC::CodeBlockHash::dump):
-        * bytecode/CodeBlockHash.h: Added.
-        (JSC):
-        (CodeBlockHash):
-        (JSC::CodeBlockHash::CodeBlockHash):
-        (JSC::CodeBlockHash::hash):
-        (JSC::CodeBlockHash::operator==):
-        (JSC::CodeBlockHash::operator!=):
-        (JSC::CodeBlockHash::operator<):
-        (JSC::CodeBlockHash::operator>):
-        (JSC::CodeBlockHash::operator<=):
-        (JSC::CodeBlockHash::operator>=):
-        * bytecode/CodeBlockWithJITType.h: Added.
-        (JSC):
-        (CodeBlockWithJITType):
-        (JSC::CodeBlockWithJITType::CodeBlockWithJITType):
-        (JSC::CodeBlockWithJITType::dump):
-        * bytecode/CodeOrigin.cpp: Added.
-        (JSC):
-        (JSC::CodeOrigin::inlineDepthForCallFrame):
-        (JSC::CodeOrigin::inlineDepth):
-        (JSC::CodeOrigin::inlineStack):
-        (JSC::InlineCallFrame::hash):
-        * bytecode/CodeOrigin.h:
-        (InlineCallFrame):
-        (JSC::InlineCallFrame::specializationKind):
-        (JSC):
-        * bytecode/CodeType.cpp: Added.
-        (WTF):
-        (WTF::printInternal):
-        * bytecode/CodeType.h:
-        (WTF):
-        * bytecode/ExecutionCounter.cpp:
-        (JSC::ExecutionCounter::dump):
-        * bytecode/ExecutionCounter.h:
-        (ExecutionCounter):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseCodeBlock):
-        * dfg/DFGDisassembler.cpp:
-        (JSC::DFG::Disassembler::dump):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::Graph::dumpCodeOrigin):
-        * dfg/DFGOSRExitCompiler.cpp:
-        * dfg/DFGOperations.cpp:
-        * dfg/DFGRepatch.cpp:
-        (JSC::DFG::generateProtoChainAccessStub):
-        (JSC::DFG::tryCacheGetByID):
-        (JSC::DFG::tryBuildGetByIDList):
-        (JSC::DFG::emitPutReplaceStub):
-        (JSC::DFG::emitPutTransitionStub):
-        (JSC::DFG::dfgLinkClosureCall):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::dumpCallFrame):
-        * jit/JITCode.cpp: Added.
-        (WTF):
-        (WTF::printInternal):
-        * jit/JITCode.h:
-        (JSC::JITCode::jitType):
-        (WTF):
-        * jit/JITDisassembler.cpp:
-        (JSC::JITDisassembler::dump):
-        (JSC::JITDisassembler::dumpForInstructions):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompileGetByVal):
-        (JSC::JIT::privateCompilePutByVal):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/CodeSpecializationKind.cpp: Added.
-        (WTF):
-        (WTF::printInternal):
-        * runtime/CodeSpecializationKind.h:
-        (JSC::specializationFromIsCall):
-        (JSC):
-        (JSC::specializationFromIsConstruct):
-        (WTF):
-        * runtime/Executable.cpp:
-        (JSC::ExecutableBase::hashFor):
-        (JSC):
-        (JSC::NativeExecutable::hashFor):
-        (JSC::ScriptExecutable::hashFor):
-        * runtime/Executable.h:
-        (ExecutableBase):
-        (NativeExecutable):
-        (ScriptExecutable):
-        (JSC::ScriptExecutable::source):
-
-2012-11-29  Michael Saboff  <[e-mail]>
-
-        Speculative Windows build fix after r136086.
-
-        Unreviewed build fix.
-
-        Suspect that ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z needs to be removed from Windows
-        export list since the symbol was removed in r136086.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2012-11-28  Filip Pizlo  <[e-mail]>
-
-        SpeculatedType dumping should not use the static char buffer[thingy] idiom
-        https://bugs.webkit.org/show_bug.cgi?id=103584
-
-        Reviewed by Michael Saboff.
-
-        Changed SpeculatedType to be "dumpable" by saying things like:
-        
-        dataLog("thingy = ", SpeculationDump(thingy))
-        
-        Removed the old stringification functions, and changed all code that referred to them
-        to use the new dataLog()/print() style.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * bytecode/SpeculatedType.cpp:
-        (JSC::dumpSpeculation):
-        (JSC::speculationToAbbreviatedString):
-        (JSC::dumpSpeculationAbbreviated):
-        * bytecode/SpeculatedType.h:
-        * bytecode/ValueProfile.h:
-        (JSC::ValueProfileBase::dump):
-        * bytecode/VirtualRegister.h:
-        (WTF::printInternal):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::dump):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
-        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::Graph::dump):
-        (JSC::DFG::Graph::predictArgumentTypes):
-        * dfg/DFGGraph.h:
-        (Graph):
-        * dfg/DFGStructureAbstractValue.h:
-        * dfg/DFGVariableAccessDataDump.cpp: Added.
-        (JSC::DFG::VariableAccessDataDump::VariableAccessDataDump):
-        (JSC::DFG::VariableAccessDataDump::dump):
-        * dfg/DFGVariableAccessDataDump.h: Added.
-        (VariableAccessDataDump):
-
-2012-11-28  Michael Saboff  <[e-mail]>
-
-        Change Bytecompiler s_dumpsGeneratedCode to an Options value
-        https://bugs.webkit.org/show_bug.cgi?id=103588
-
-        Reviewed by Filip Pizlo.
-
-        Moved the control of dumping bytecodes to Options::dumpGeneratedBytecodes.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        * bytecompiler/BytecodeGenerator.cpp:
-        * bytecompiler/BytecodeGenerator.h:
-        * jsc.cpp:
-        (runWithScripts):
-        * runtime/Options.h:
-
-2012-11-28  Mark Hahnenberg  <[e-mail]>
-
-        Copying phase should use work lists
-        https://bugs.webkit.org/show_bug.cgi?id=101390
-
-        Reviewed by Filip Pizlo.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * heap/BlockAllocator.cpp:
-        (JSC::BlockAllocator::BlockAllocator):
-        * heap/BlockAllocator.h: New RegionSet for CopyWorkListSegments.
-        (BlockAllocator):
-        (JSC::CopyWorkListSegment):
-        * heap/CopiedBlock.h: Added a per-block CopyWorkList to keep track of the JSCells that need to be revisited during the copying
-        phase to copy their backing stores.
-        (CopiedBlock):
-        (JSC::CopiedBlock::CopiedBlock): 
-        (JSC::CopiedBlock::didSurviveGC):
-        (JSC::CopiedBlock::didEvacuateBytes): There is now a one-to-one relationship between GCThreads and the CopiedBlocks they're 
-        responsible for evacuating, we no longer need any of that fancy compare and swap stuff. 
-        (JSC::CopiedBlock::pin):
-        (JSC::CopiedBlock::hasWorkList): 
-        (JSC::CopiedBlock::workList):
-        * heap/CopiedBlockInlines.h: Added.
-        (JSC::CopiedBlock::reportLiveBytes): Since we now have to grab a SpinLock to perform operations on the CopyWorkList during marking,
-        we don't need to do any of that fancy compare and swap stuff we were doing for tracking live bytes.
-        * heap/CopiedSpace.h:
-        (CopiedSpace):
-        * heap/CopiedSpaceInlines.h:
-        (JSC::CopiedSpace::pin):
-        * heap/CopyVisitor.cpp:
-        (JSC::CopyVisitor::copyFromShared): We now iterate over a range of CopiedBlocks rather than MarkedBlocks and revisit the cells in those
-        blocks' CopyWorkLists.
-        * heap/CopyVisitor.h:
-        (CopyVisitor):
-        * heap/CopyVisitorInlines.h:
-        (JSC::CopyVisitor::visitCell): The function responsible for calling the correct copyBackingStore() function for each JSCell from 
-        a CopiedBlock's CopyWorkList.
-        (JSC::CopyVisitor::didCopy): We no longer need to check if the block is empty here because we know exactly when we're done 
-        evacuating a CopiedBlock, which is when we've gone through all of the CopiedBlock's CopyWorkList.
-        * heap/CopyWorkList.h: Added.
-        (CopyWorkListSegment): Individual chunk of a CopyWorkList that is allocated from the BlockAllocator.
-        (JSC::CopyWorkListSegment::create):
-        (JSC::CopyWorkListSegment::size):
-        (JSC::CopyWorkListSegment::isFull):
-        (JSC::CopyWorkListSegment::get):
-        (JSC::CopyWorkListSegment::append):
-        (JSC::CopyWorkListSegment::CopyWorkListSegment):
-        (JSC::CopyWorkListSegment::data):
-        (JSC::CopyWorkListSegment::endOfBlock):
-        (CopyWorkListIterator): Responsible for giving CopyVisitors a contiguous notion of access across the separate CopyWorkListSegments
-        that make up each CopyWorkList.
-        (JSC::CopyWorkListIterator::get):
-        (JSC::CopyWorkListIterator::operator*):
-        (JSC::CopyWorkListIterator::operator->):
-        (JSC::CopyWorkListIterator::operator++):
-        (JSC::CopyWorkListIterator::operator==):
-        (JSC::CopyWorkListIterator::operator!=):
-        (JSC::CopyWorkListIterator::CopyWorkListIterator):
-        (CopyWorkList): Data structure that keeps track of the JSCells that need copying in a particular CopiedBlock.
-        (JSC::CopyWorkList::CopyWorkList):
-        (JSC::CopyWorkList::~CopyWorkList):
-        (JSC::CopyWorkList::append):
-        (JSC::CopyWorkList::begin):
-        (JSC::CopyWorkList::end):
-        * heap/GCThreadSharedData.cpp:
-        (JSC::GCThreadSharedData::GCThreadSharedData): We no longer use the m_blockSnapshot from the Heap during the copying phase.
-        (JSC::GCThreadSharedData::didStartCopying): We now copy the set of all blocks in the CopiedSpace to a separate vector for 
-        iterating over during the copying phase since the set stored in the CopiedSpace will change as blocks are evacuated and 
-        recycled throughout the copying phase.
-        * heap/GCThreadSharedData.h:
-        (GCThreadSharedData): 
-        * heap/Heap.h:
-        (Heap):
-        * heap/SlotVisitor.h: We now need to know the object who is being marked that has a backing store so that we can store it 
-        in a CopyWorkList to revisit later during the copying phase.
-        * heap/SlotVisitorInlines.h:
-        (JSC::SlotVisitor::copyLater):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::visitButterfly):
-
-2012-11-28  Filip Pizlo  <[e-mail]>
-
-        Disassembly methods should be able to disassemble to any PrintStream& rather than always using WTF::dataFile()
-        https://bugs.webkit.org/show_bug.cgi?id=103492
-
-        Reviewed by Mark Hahnenberg.
-
-        Switched disassembly code to use PrintStream&, and to use print() rather than printf().
-
-        * dfg/DFGDisassembler.cpp:
-        (JSC::DFG::Disassembler::dump):
-        (DFG):
-        (JSC::DFG::Disassembler::dumpDisassembly):
-        * dfg/DFGDisassembler.h:
-        (Disassembler):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::printWhiteSpace):
-        (JSC::DFG::Graph::dumpCodeOrigin):
-        (JSC::DFG::Graph::printNodeWhiteSpace):
-        (JSC::DFG::Graph::dump):
-        (DFG):
-        (JSC::DFG::Graph::dumpBlockHeader):
-        * dfg/DFGGraph.h:
-        (Graph):
-        * jit/JITDisassembler.cpp:
-        (JSC::JITDisassembler::dump):
-        (JSC::JITDisassembler::dumpForInstructions):
-        (JSC::JITDisassembler::dumpDisassembly):
-        * jit/JITDisassembler.h:
-        (JITDisassembler):
-
-2012-11-28  Filip Pizlo  <[e-mail]>
-
-        It should be possible to say dataLog("count = ", count, "\n") instead of dataLogF("count = %d\n", count)
-        https://bugs.webkit.org/show_bug.cgi?id=103009
-
-        Reviewed by Michael Saboff.
-
-        Instead of converting all of JSC to use the new dataLog()/print() methods, I just changed
-        one place: dumping of abstract values. This is mainly just to ensure that the code I
-        added to WTF is actually doing things.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::dump):
-        (WTF):
-        (WTF::printInternal):
-        * dfg/DFGStructureAbstractValue.h:
-        (JSC::DFG::StructureAbstractValue::dump):
-        (WTF):
-        (WTF::printInternal):
-
-2012-11-28  Oliver Hunt  <[e-mail]>
-
-        Make source cache include more information about the function extent.
-        https://bugs.webkit.org/show_bug.cgi?id=103552
-
-        Reviewed by Gavin Barraclough.
-
-        Add a bit more information to the source cache.
-
-        * parser/Parser.cpp:
-        (JSC::::parseFunctionInfo):
-           Store the function start offset
-        * parser/SourceProviderCacheItem.h:
-        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
-        (SourceProviderCacheItem):
-           Add additional field for the start of the real function string, and re-arrange
-           fields to avoid growing the struct.
-
-2012-11-27  Filip Pizlo  <[e-mail]>
-
-        Convert some remaining uses of FILE* to PrintStream&.
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * bytecode/ValueProfile.h:
-        (JSC::ValueProfileBase::dump):
-        * bytecode/ValueRecovery.h:
-        (JSC::ValueRecovery::dump):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseCodeBlock):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::dumpChildren):
-
-2012-11-27  Filip Pizlo  <[e-mail]>
-
-        Fix indentation in JSValue.h
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/JSValue.h:
-
-2012-11-26  Filip Pizlo  <[e-mail]>
-
-        DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
-        https://bugs.webkit.org/show_bug.cgi?id=103353
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        Made it possible to use forward speculations for most of the operand classes. Changed the conditional
-        direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
-        to use forward speculations and got rid of its half-baked version of same.
-        
-        Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.
-
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGDisassembler.cpp:
-        (JSC::DFG::Disassembler::dump):
-        * dfg/DFGDriver.cpp:
-        (JSC::DFG::compile):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::speculationCheck):
-        (DFG):
-        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
-        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
-        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
-        (JSC::DFG::SpeculativeJIT::fillStorage):
-        * dfg/DFGSpeculativeJIT.h:
-        (SpeculativeJIT):
-        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
-        (JSC::DFG::SpeculateIntegerOperand::gpr):
-        (SpeculateIntegerOperand):
-        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
-        (JSC::DFG::SpeculateDoubleOperand::fpr):
-        (SpeculateDoubleOperand):
-        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
-        (JSC::DFG::SpeculateCellOperand::gpr):
-        (SpeculateCellOperand):
-        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
-        (JSC::DFG::SpeculateBooleanOperand::gpr):
-        (SpeculateBooleanOperand):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
-        (JSC::DFG::SpeculativeJIT::compile):
-        * runtime/Options.h:
-        (JSC):
-
-2012-11-26  Daniel Bates  <[e-mail]>
-
-        Substitute "allSeparators8Bit" for "allSeperators8Bit" in JSC::jsSpliceSubstringsWithSeparators()
-        <https://bugs.webkit.org/show_bug.cgi?id=103303>
-
-        Reviewed by Simon Fraser.
-
-        Fix misspelled word, "Seperators" [sic], in a local variable name in JSC::jsSpliceSubstringsWithSeparators().
-
-        * runtime/StringPrototype.cpp:
-        (JSC::jsSpliceSubstringsWithSeparators):
-
-2012-11-26  Daniel Bates  <[e-mail]>
-
-        JavaScript fails to handle String.replace() with large replacement string
-        https://bugs.webkit.org/show_bug.cgi?id=102956
-        <rdar://problem/12738012>
-
-        Reviewed by Oliver Hunt.
-
-        Fix an issue where we didn't check for overflow when computing the length
-        of the result of String.replace() with a large replacement string.
-
-        * runtime/StringPrototype.cpp:
-        (JSC::jsSpliceSubstringsWithSeparators):
-
-2012-11-26  Zeno Albisser  <[e-mail]>
-
-        [Qt] Fix the LLInt build on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=97587
-
-        Reviewed by Simon Hausmann.
-
-        * DerivedSources.pri:
-        * JavaScriptCore.pro:
-
-2012-11-26  Oliver Hunt  <[e-mail]>
-
-        32-bit build fix.  Move the method decalration outside of the X86_64 only section.
-
-        * assembler/MacroAssembler.h:
-        (MacroAssembler):
-        (JSC::MacroAssembler::shouldConsiderBlinding):
-
-2012-11-26  Oliver Hunt  <[e-mail]>
-
-        Don't blind all the things.
-        https://bugs.webkit.org/show_bug.cgi?id=102572
-
-        Reviewed by Gavin Barraclough.
-
-        No longer blind all the constants in the instruction stream.  We use a
-        simple non-deterministic filter to avoid blinding everything.  Also modified
-        the basic integer blinding logic to avoid blinding small negative values.
-
-        * assembler/MacroAssembler.h:
-        (MacroAssembler):
-        (JSC::MacroAssembler::shouldConsiderBlinding):
-        (JSC::MacroAssembler::shouldBlind):
-
-2012-11-26  Mark Hahnenberg  <[e-mail]>
-
-        JSObject::copyButterfly doesn't handle undecided indexing types correctly
-        https://bugs.webkit.org/show_bug.cgi?id=102573
-
-        Reviewed by Filip Pizlo.
-
-        We don't do any copying into the newly allocated vector and we don't zero-initialize CopiedBlocks 
-        during the copying phase, so we end up with uninitialized memory in arrays which have undecided indexing 
-        types. We should just do the actual memcpy from the old block to the new one. 
-
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::copyButterfly): Just do the same thing that we do for other contiguous indexing types.
-
-2012-11-26  Julien BRIANCEAU   <[e-mail]>
-
-        [sh4] JavaScriptCore JIT build is broken since r135330
-        Add missing implementation for sh4 arch.
-        https://bugs.webkit.org/show_bug.cgi?id=103145
-
-        Reviewed by Oliver Hunt.
-
-        * assembler/MacroAssemblerSH4.h:
-        (JSC::MacroAssemblerSH4::canJumpReplacePatchableBranchPtrWithPatch):
-        (MacroAssemblerSH4):
-        (JSC::MacroAssemblerSH4::startOfBranchPtrWithPatchOnRegister):
-        (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch):
-        (JSC::MacroAssemblerSH4::startOfPatchableBranchPtrWithPatchOnAddress):
-        (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranchPtrWithPatch):
-        * assembler/SH4Assembler.h:
-        (JSC::SH4Assembler::revertJump):
-        (SH4Assembler):
-        (JSC::SH4Assembler::printInstr):
-
-2012-11-26  Yuqiang Xian  <[e-mail]>
-
-        Use load64 instead of loadPtr to load a JSValue on JSVALUE64 platforms
-        https://bugs.webkit.org/show_bug.cgi?id=100909
-
-        Reviewed by Brent Fulgham.
-
-        This is a (trivial) fix after r132701.
-
-        * dfg/DFGOSRExitCompiler64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-
-2012-11-26  Gabor Ballabas  <[e-mail]>
-
-        [Qt][ARM] REGRESSION(r130826): It made 33 JSC test and 466 layout tests crash
-        https://bugs.webkit.org/show_bug.cgi?id=98857
-
-        Reviewed by Zoltan Herczeg.
-
-        Implement a new version of patchableBranch32 to fix crashing JSC
-        tests.
-
-        * assembler/MacroAssembler.h:
-        (MacroAssembler):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::patchableBranch32):
-        (MacroAssemblerARM):
-
-2012-11-21  Filip Pizlo  <[e-mail]>
-
-        Any function that can log things should be able to easily log them to a memory buffer as well
-        https://bugs.webkit.org/show_bug.cgi?id=103000
-
-        Reviewed by Sam Weinig.
-
-        Change all users of WTF::dataFile() to expect a PrintStream& rather than a FILE*.
-
-        * bytecode/Operands.h:
-        (JSC::OperandValueTraits::dump):
-        (JSC::dumpOperands):
-        (JSC):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::dump):
-        * dfg/DFGAbstractState.h:
-        (AbstractState):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::dump):
-        * dfg/DFGCommon.h:
-        (JSC::DFG::NodeIndexTraits::dump):
-        * dfg/DFGStructureAbstractValue.h:
-        (JSC::DFG::StructureAbstractValue::dump):
-        * dfg/DFGVariableEvent.cpp:
-        (JSC::DFG::VariableEvent::dump):
-        (JSC::DFG::VariableEvent::dumpFillInfo):
-        (JSC::DFG::VariableEvent::dumpSpillInfo):
-        * dfg/DFGVariableEvent.h:
-        (VariableEvent):
-        * disassembler/Disassembler.h:
-        (JSC):
-        (JSC::tryToDisassemble):
-        * disassembler/UDis86Disassembler.cpp:
-        (JSC::tryToDisassemble):
-
-2012-11-23  Alexis Menard  <[e-mail]>
-
-        [CSS3 Backgrounds and Borders] Implement new CSS3 background-position parsing.
-        https://bugs.webkit.org/show_bug.cgi?id=102104
-
-        Reviewed by Julien Chaffraix.
-
-        Protect the new feature behind a feature flag.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-23  Gabor Ballabas  <[e-mail]>
-
-        Fix the ARM traditional build after r135330
-        https://bugs.webkit.org/show_bug.cgi?id=102871
-
-        Reviewed by Zoltan Herczeg.
-
-        Added missing functionality to traditional ARM architecture.
-
-        * assembler/ARMAssembler.h:
-        (JSC::ARMAssembler::revertJump):
-        (ARMAssembler):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
-        (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
-        (MacroAssemblerARM):
-        (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
-
-2012-11-16  Yury Semikhatsky  <[e-mail]>
-
-        Memory instrumentation: extract MemoryObjectInfo declaration into a separate file
-        https://bugs.webkit.org/show_bug.cgi?id=102510
-
-        Reviewed by Pavel Feldman.
-
-        Added new symbols for the methods that have moved into .../wtf/MemoryInstrumentation.cpp
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2012-11-23  Julien BRIANCEAU   <[e-mail]>
-
-        [sh4] JavaScriptCore JIT build is broken since r130839
-        Add missing implementation for sh4 arch.
-        https://bugs.webkit.org/show_bug.cgi?id=101479
-
-        Reviewed by Filip Pizlo.
-
-        * assembler/MacroAssemblerSH4.h:
-        (JSC::MacroAssemblerSH4::load8Signed):
-        (MacroAssemblerSH4):
-        (JSC::MacroAssemblerSH4::load16Signed):
-        (JSC::MacroAssemblerSH4::store8):
-        (JSC::MacroAssemblerSH4::store16):
-        (JSC::MacroAssemblerSH4::moveDoubleToInts):
-        (JSC::MacroAssemblerSH4::moveIntsToDouble):
-        (JSC::MacroAssemblerSH4::loadFloat):
-        (JSC::MacroAssemblerSH4::loadDouble):
-        (JSC::MacroAssemblerSH4::storeFloat):
-        (JSC::MacroAssemblerSH4::storeDouble):
-        (JSC::MacroAssemblerSH4::addDouble):
-        (JSC::MacroAssemblerSH4::convertFloatToDouble):
-        (JSC::MacroAssemblerSH4::convertDoubleToFloat):
-        (JSC::MacroAssemblerSH4::urshift32):
-        * assembler/SH4Assembler.h:
-        (JSC::SH4Assembler::sublRegReg):
-        (JSC::SH4Assembler::subvlRegReg):
-        (JSC::SH4Assembler::floatfpulfrn):
-        (JSC::SH4Assembler::fldsfpul):
-        (JSC::SH4Assembler::fstsfpul):
-        (JSC::SH4Assembler::dcnvsd):
-        (SH4Assembler):
-        (JSC::SH4Assembler::movbRegMem):
-        (JSC::SH4Assembler::sizeOfConstantPool):
-        (JSC::SH4Assembler::linkJump):
-        (JSC::SH4Assembler::printInstr):
-        (JSC::SH4Assembler::printBlockInstr):
-
-2012-11-22  Balazs Kilvady  <[e-mail]>
-
-        Fix the MIPS build after r135330
-        https://bugs.webkit.org/show_bug.cgi?id=102872
-
-        Reviewed by Gavin Barraclough.
-
-        Revert/replace functions added to MIPS port.
-
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::revertJumpToMove):
-        (MIPSAssembler):
-        (JSC::MIPSAssembler::replaceWithJump):
-        * assembler/MacroAssemblerMIPS.h:
-        (MacroAssemblerMIPS):
-        (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
-        (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
-        (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
-
-2012-11-21  Filip Pizlo  <[e-mail]>
-
-        Rename dataLog() and dataLogV() to dataLogF() and dataLogFV()
-        https://bugs.webkit.org/show_bug.cgi?id=103001
-
-        Rubber stamped by Dan Bernstein.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * assembler/LinkBuffer.cpp:
-        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
-        (JSC::LinkBuffer::dumpLinkStatistics):
-        (JSC::LinkBuffer::dumpCode):
-        * assembler/LinkBuffer.h:
-        (JSC):
-        * assembler/SH4Assembler.h:
-        (JSC::SH4Assembler::vprintfStdoutInstr):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
-        (JSC::CodeBlock::printUnaryOp):
-        (JSC::CodeBlock::printBinaryOp):
-        (JSC::CodeBlock::printConditionalJump):
-        (JSC::CodeBlock::printGetByIdOp):
-        (JSC::dumpStructure):
-        (JSC::dumpChain):
-        (JSC::CodeBlock::printGetByIdCacheStatus):
-        (JSC::CodeBlock::printCallOp):
-        (JSC::CodeBlock::printPutByIdOp):
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::dumpStatistics):
-        (JSC::CodeBlock::finalizeUnconditionally):
-        (JSC::CodeBlock::resetStubInternal):
-        (JSC::CodeBlock::reoptimize):
-        (JSC::ProgramCodeBlock::jettison):
-        (JSC::EvalCodeBlock::jettison):
-        (JSC::FunctionCodeBlock::jettison):
-        (JSC::CodeBlock::shouldOptimizeNow):
-        (JSC::CodeBlock::tallyFrequentExitSites):
-        (JSC::CodeBlock::dumpValueProfiles):
-        * bytecode/Opcode.cpp:
-        (JSC::OpcodeStats::~OpcodeStats):
-        * bytecode/SamplingTool.cpp:
-        (JSC::SamplingFlags::stop):
-        (JSC::SamplingRegion::dumpInternal):
-        (JSC::SamplingTool::dump):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::initialize):
-        (JSC::DFG::AbstractState::endBasicBlock):
-        (JSC::DFG::AbstractState::mergeStateAtTail):
-        (JSC::DFG::AbstractState::mergeToSuccessors):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::dump):
-        * dfg/DFGArgumentsSimplificationPhase.cpp:
-        (JSC::DFG::ArgumentsSimplificationPhase::run):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
-        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
-        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
-        (JSC::DFG::ByteCodeParser::makeSafe):
-        (JSC::DFG::ByteCodeParser::makeDivSafe):
-        (JSC::DFG::ByteCodeParser::handleCall):
-        (JSC::DFG::ByteCodeParser::handleInlining):
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        (JSC::DFG::ByteCodeParser::processPhiStack):
-        (JSC::DFG::ByteCodeParser::linkBlock):
-        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
-        (JSC::DFG::ByteCodeParser::parseCodeBlock):
-        (JSC::DFG::ByteCodeParser::parse):
-        * dfg/DFGCFAPhase.cpp:
-        (JSC::DFG::CFAPhase::performBlockCFA):
-        (JSC::DFG::CFAPhase::performForwardCFA):
-        * dfg/DFGCFGSimplificationPhase.cpp:
-        (JSC::DFG::CFGSimplificationPhase::run):
-        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
-        (JSC::DFG::CFGSimplificationPhase::fixPhis):
-        (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
-        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
-        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
-        * dfg/DFGCSEPhase.cpp:
-        (JSC::DFG::CSEPhase::endIndexForPureCSE):
-        (JSC::DFG::CSEPhase::setReplacement):
-        (JSC::DFG::CSEPhase::eliminate):
-        (JSC::DFG::CSEPhase::performNodeCSE):
-        * dfg/DFGCapabilities.cpp:
-        (JSC::DFG::debugFail):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
-        * dfg/DFGDisassembler.cpp:
-        (JSC::DFG::Disassembler::dump):
-        * dfg/DFGDriver.cpp:
-        (JSC::DFG::compile):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        (JSC::DFG::FixupPhase::fixDoubleEdge):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::printWhiteSpace):
-        (JSC::DFG::Graph::dumpCodeOrigin):
-        (JSC::DFG::Graph::dump):
-        (JSC::DFG::Graph::dumpBlockHeader):
-        (JSC::DFG::Graph::predictArgumentTypes):
-        * dfg/DFGJITCompiler.cpp:
-        (JSC::DFG::JITCompiler::link):
-        * dfg/DFGOSREntry.cpp:
-        (JSC::DFG::prepareOSREntry):
-        * dfg/DFGOSRExitCompiler.cpp:
-        * dfg/DFGOSRExitCompiler32_64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-        * dfg/DFGOSRExitCompiler64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-        * dfg/DFGOperations.cpp:
-        * dfg/DFGPhase.cpp:
-        (JSC::DFG::Phase::beginPhase):
-        * dfg/DFGPhase.h:
-        (JSC::DFG::runAndLog):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        (JSC::DFG::PredictionPropagationPhase::propagateForward):
-        (JSC::DFG::PredictionPropagationPhase::propagateBackward):
-        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
-        * dfg/DFGRegisterBank.h:
-        (JSC::DFG::RegisterBank::dump):
-        * dfg/DFGScoreBoard.h:
-        (JSC::DFG::ScoreBoard::use):
-        (JSC::DFG::ScoreBoard::dump):
-        * dfg/DFGSlowPathGenerator.h:
-        (JSC::DFG::SlowPathGenerator::generate):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
-        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
-        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
-        (JSC::DFG::SpeculativeJIT::dump):
-        (JSC::DFG::SpeculativeJIT::checkConsistency):
-        (JSC::DFG::SpeculativeJIT::compile):
-        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
-        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
-        * dfg/DFGStructureCheckHoistingPhase.cpp:
-        (JSC::DFG::StructureCheckHoistingPhase::run):
-        * dfg/DFGValidate.cpp:
-        (Validate):
-        (JSC::DFG::Validate::reportValidationContext):
-        (JSC::DFG::Validate::dumpData):
-        (JSC::DFG::Validate::dumpGraphIfAppropriate):
-        * dfg/DFGVariableEventStream.cpp:
-        (JSC::DFG::VariableEventStream::logEvent):
-        (JSC::DFG::VariableEventStream::reconstruct):
-        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
-        (JSC::DFG::VirtualRegisterAllocationPhase::run):
-        * heap/Heap.cpp:
-        * heap/HeapStatistics.cpp:
-        (JSC::HeapStatistics::logStatistics):
-        (JSC::HeapStatistics::showObjectStatistics):
-        * heap/MarkStack.h:
-        * heap/MarkedBlock.h:
-        * heap/SlotVisitor.cpp:
-        (JSC::SlotVisitor::validate):
-        * interpreter/CallFrame.cpp:
-        (JSC::CallFrame::dumpCaller):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::dumpRegisters):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        * jit/JITDisassembler.cpp:
-        (JSC::JITDisassembler::dump):
-        (JSC::JITDisassembler::dumpForInstructions):
-        * jit/JITStubRoutine.h:
-        (JSC):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JumpReplacementWatchpoint.cpp:
-        (JSC::JumpReplacementWatchpoint::fireInternal):
-        * llint/LLIntExceptions.cpp:
-        (JSC::LLInt::interpreterThrowInCaller):
-        (JSC::LLInt::returnToThrow):
-        (JSC::LLInt::callToThrow):
-        * llint/LLIntSlowPaths.cpp:
-        (JSC::LLInt::llint_trace_operand):
-        (JSC::LLInt::llint_trace_value):
-        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
-        (JSC::LLInt::traceFunctionPrologue):
-        (JSC::LLInt::jitCompileAndSetHeuristics):
-        (JSC::LLInt::entryOSR):
-        (JSC::LLInt::handleHostCall):
-        (JSC::LLInt::setUpCall):
-        * profiler/Profile.cpp:
-        (JSC::Profile::debugPrintData):
-        (JSC::Profile::debugPrintDataSampleStyle):
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::debugPrintData):
-        (JSC::ProfileNode::debugPrintDataSampleStyle):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::dumpRegExpTrace):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::matchCompareWithInterpreter):
-        * runtime/SamplingCounter.cpp:
-        (JSC::AbstractSamplingCounter::dump):
-        * runtime/Structure.cpp:
-        (JSC::Structure::dumpStatistics):
-        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
-        * tools/CodeProfile.cpp:
-        (JSC::CodeProfile::report):
-        * tools/ProfileTreeNode.h:
-        (JSC::ProfileTreeNode::dumpInternal):
-        * yarr/YarrInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::dumpDisjunction):
-
-2012-11-21  Filip Pizlo  <[e-mail]>
-
-        It should be possible to say disassemble(stuff) instead of having to say if (!tryToDisassemble(stuff)) dataLog("I failed")
-        https://bugs.webkit.org/show_bug.cgi?id=103010
-
-        Reviewed by Anders Carlsson.
-
-        You can still say tryToDisassemble(), which will tell you if it failed; you can then
-        decide what to do instead. But it's better to say disassemble(), which will just print
-        the instruction ranges if tryToDisassemble() failed. This is particularly appropriate
-        since that's what all previous users of tryToDisassemble() would have done in some
-        form or another.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * assembler/LinkBuffer.cpp:
-        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
-        * dfg/DFGDisassembler.cpp:
-        (JSC::DFG::Disassembler::dumpDisassembly):
-        * disassembler/Disassembler.cpp: Added.
-        (JSC):
-        (JSC::disassemble):
-        * disassembler/Disassembler.h:
-        (JSC):
-        * jit/JITDisassembler.cpp:
-        (JSC::JITDisassembler::dumpDisassembly):
-
-2012-11-21  Filip Pizlo  <[e-mail]>
-
-        dumpOperands() claims that it needs a non-const Operands& when that is completely false
-        https://bugs.webkit.org/show_bug.cgi?id=103005
-
-        Reviewed by Eric Carlson.
-
-        * bytecode/Operands.h:
-        (JSC::dumpOperands):
-        (JSC):
-
-2012-11-20  Filip Pizlo  <[e-mail]>
-
-        Baseline JIT's disassembly should be just as pretty as the DFG's
-        https://bugs.webkit.org/show_bug.cgi?id=102873
-
-        Reviewed by Sam Weinig.
-
-        Integrated the CodeBlock's bytecode dumper with the JIT's disassembler. Also fixed
-        some type goof-ups (instructions are not in a Vector<Instruction> so using a Vector
-        iterator makes no sense) and stream-lined some things (you don't actually need a
-        full-fledged ExecState* to dump bytecode).
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::printUnaryOp):
-        (JSC::CodeBlock::printBinaryOp):
-        (JSC::CodeBlock::printConditionalJump):
-        (JSC::CodeBlock::printGetByIdOp):
-        (JSC::CodeBlock::printCallOp):
-        (JSC::CodeBlock::printPutByIdOp):
-        (JSC::CodeBlock::dump):
-        (JSC):
-        (JSC::CodeBlock::CodeBlock):
-        * bytecode/CodeBlock.h:
-        (CodeBlock):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::dumpCallFrame):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JIT):
-        * jit/JITDisassembler.cpp: Added.
-        (JSC):
-        (JSC::JITDisassembler::JITDisassembler):
-        (JSC::JITDisassembler::~JITDisassembler):
-        (JSC::JITDisassembler::dump):
-        (JSC::JITDisassembler::dumpForInstructions):
-        (JSC::JITDisassembler::dumpDisassembly):
-        * jit/JITDisassembler.h: Added.
-        (JSC):
-        (JITDisassembler):
-        (JSC::JITDisassembler::setStartOfCode):
-        (JSC::JITDisassembler::setForBytecodeMainPath):
-        (JSC::JITDisassembler::setForBytecodeSlowPath):
-        (JSC::JITDisassembler::setEndOfSlowPath):
-        (JSC::JITDisassembler::setEndOfCode):
-
-2012-11-21  Daniel Bates  <[e-mail]>
-
-        JavaScript fails to concatenate large strings
-        <https://bugs.webkit.org/show_bug.cgi?id=102963>
-
-        Reviewed by Michael Saboff.
-
-        Fixes an issue where we inadvertently didn't check the length of
-        a JavaScript string for overflow.
-
-        * runtime/Operations.h:
-        (JSC::jsString):
-        (JSC::jsStringFromArguments):
-
-2012-11-20  Filip Pizlo  <[e-mail]>
-
-        DFG should be able to cache closure calls (part 2/2)
-        https://bugs.webkit.org/show_bug.cgi?id=102662
-
-        Reviewed by Gavin Barraclough.
-
-        Added caching of calls where the JSFunction* varies, but the Structure* and ExecutableBase*
-        stay the same. This is accomplished by replacing the branch that compares against a constant
-        JSFunction* with a jump to a closure call stub. The closure call stub contains a fast path,
-        and jumps slow directly to the virtual call thunk.
-
-        Looks like a 1% win on V8v7.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * bytecode/CallLinkInfo.cpp:
-        (JSC::CallLinkInfo::unlink):
-        * bytecode/CallLinkInfo.h:
-        (CallLinkInfo):
-        (JSC::CallLinkInfo::isLinked):
-        (JSC::getCallLinkInfoBytecodeIndex):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::finalizeUnconditionally):
-        (JSC):
-        (JSC::CodeBlock::findClosureCallForReturnPC):
-        (JSC::CodeBlock::bytecodeOffset):
-        (JSC::CodeBlock::codeOriginForReturn):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::getCallLinkInfo):
-        (CodeBlock):
-        (JSC::CodeBlock::isIncomingCallAlreadyLinked):
-        * dfg/DFGJITCompiler.cpp:
-        (JSC::DFG::JITCompiler::link):
-        * dfg/DFGJITCompiler.h:
-        (JSC::DFG::JITCompiler::addJSCall):
-        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
-        (JSCallRecord):
-        * dfg/DFGOperations.cpp:
-        * dfg/DFGOperations.h:
-        * dfg/DFGRepatch.cpp:
-        (JSC::DFG::linkSlowFor):
-        (DFG):
-        (JSC::DFG::dfgLinkFor):
-        (JSC::DFG::dfgLinkSlowFor):
-        (JSC::DFG::dfgLinkClosureCall):
-        * dfg/DFGRepatch.h:
-        (DFG):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::emitCall):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::emitCall):
-        * dfg/DFGThunks.cpp:
-        (DFG):
-        (JSC::DFG::linkClosureCallThunkGenerator):
-        * dfg/DFGThunks.h:
-        (DFG):
-        * heap/Heap.h:
-        (Heap):
-        (JSC::Heap::jitStubRoutines):
-        * heap/JITStubRoutineSet.h:
-        (JSC::JITStubRoutineSet::size):
-        (JSC::JITStubRoutineSet::at):
-        (JITStubRoutineSet):
-        * jit/ClosureCallStubRoutine.cpp: Added.
-        (JSC):
-        (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
-        (JSC::ClosureCallStubRoutine::~ClosureCallStubRoutine):
-        (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
-        * jit/ClosureCallStubRoutine.h: Added.
-        (JSC):
-        (ClosureCallStubRoutine):
-        (JSC::ClosureCallStubRoutine::structure):
-        (JSC::ClosureCallStubRoutine::executable):
-        (JSC::ClosureCallStubRoutine::codeOrigin):
-        * jit/GCAwareJITStubRoutine.cpp:
-        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
-        * jit/GCAwareJITStubRoutine.h:
-        (GCAwareJITStubRoutine):
-        (JSC::GCAwareJITStubRoutine::isClosureCall):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-
-2012-11-20  Filip Pizlo  <[e-mail]>
-
-        DFG should be able to cache closure calls (part 1/2)
-        https://bugs.webkit.org/show_bug.cgi?id=102662
-
-        Reviewed by Gavin Barraclough.
-
-        Add ability to revert a jump replacement back to
-        branchPtrWithPatch(Condition, RegisterID, TrustedImmPtr). This is meant to be
-        a mandatory piece of functionality for all assemblers. I also renamed some of
-        the functions for reverting jump replacements back to
-        patchableBranchPtrWithPatch(Condition, Address, TrustedImmPtr), so as to avoid
-        confusion.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::BadReg):
-        (ARMv7Assembler):
-        (JSC::ARMv7Assembler::revertJumpTo_movT3):
-        * assembler/LinkBuffer.h:
-        (JSC):
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
-        (MacroAssemblerARMv7):
-        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
-        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
-        * assembler/MacroAssemblerX86.h:
-        (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
-        (MacroAssemblerX86):
-        (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
-        (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
-        * assembler/MacroAssemblerX86_64.h:
-        (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
-        (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
-        (MacroAssemblerX86_64):
-        (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
-        * assembler/RepatchBuffer.h:
-        (JSC::RepatchBuffer::startOfBranchPtrWithPatchOnRegister):
-        (RepatchBuffer):
-        (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatchOnAddress):
-        (JSC::RepatchBuffer::revertJumpReplacementToBranchPtrWithPatch):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::revertJumpTo_cmpl_ir_force32):
-        (X86Assembler):
-        * dfg/DFGRepatch.cpp:
-        (JSC::DFG::replaceWithJump):
-        (JSC::DFG::dfgResetGetByID):
-        (JSC::DFG::dfgResetPutByID):
-
-2012-11-20  Yong Li  <[e-mail]>
-
-        [ARMv7] Neither linkCall() nor linkPointer() should flush code.
-        https://bugs.webkit.org/show_bug.cgi?id=99213
-
-        Reviewed by George Staikos.
-
-        LinkBuffer doesn't need to flush code during linking. It will
-        eventually flush the whole executable. Fixing this gives >%5
-        sunspider boost (on QNX).
-
-        Also make replaceWithLoad() and replaceWithAddressComputation() flush
-        only when necessary.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::linkCall):
-        (JSC::ARMv7Assembler::linkPointer):
-        (JSC::ARMv7Assembler::relinkCall):
-        (JSC::ARMv7Assembler::repatchInt32):
-        (JSC::ARMv7Assembler::repatchPointer):
-        (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
-        (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
-        (JSC::ARMv7Assembler::setInt32):
-        (JSC::ARMv7Assembler::setPointer):
-
-2012-11-19  Filip Pizlo  <[e-mail]>
-
-        Remove support for ARMv7 errata from the jump code
-        https://bugs.webkit.org/show_bug.cgi?id=102759
-
-        Reviewed by Oliver Hunt.
-
-        The jump replacement code was wrong to begin with since it wasn't doing
-        a cache flush on the inserted padding. And, to my knowledge, we don't need
-        this anymore, so this patch removes all errata code from the ARMv7 port.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::computeJumpType):
-        (JSC::ARMv7Assembler::replaceWithJump):
-        (JSC::ARMv7Assembler::maxJumpReplacementSize):
-        (JSC::ARMv7Assembler::canBeJumpT3):
-        (JSC::ARMv7Assembler::canBeJumpT4):
-
-2012-11-19  Patrick Gansterer  <[e-mail]>
-
-        [CMake] Create JavaScriptCore ForwardingHeaders
-        https://bugs.webkit.org/show_bug.cgi?id=92665
-
-        Reviewed by Brent Fulgham.
-
-        When using CMake to build the Windows port, we need
-        to generate the forwarding headers with it too.
-
-        * CMakeLists.txt:
-
-2012-11-19  Kihong Kwon  <[e-mail]>
-
-        Add PROXIMITY_EVENTS feature
-        https://bugs.webkit.org/show_bug.cgi?id=102658
-
-        Reviewed by Kentaro Hara.
-
-        Add PROXIMITY_EVENTS feature to xcode project for JavaScriptCore.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-18  Dan Bernstein  <[e-mail]>
-
-        Try to fix the DFG build after r135099.
-
-        * dfg/DFGCommon.h:
-        (JSC::DFG::shouldShowDisassembly):
-
-2012-11-18  Filip Pizlo  <[e-mail]>
-
-        Unreviewed, build fix for !ENABLE(DFG_JIT).
-
-        * dfg/DFGCommon.h:
-        (JSC::DFG::shouldShowDisassembly):
-        (DFG):
-
-2012-11-18  Filip Pizlo  <[e-mail]>
-
-        JSC should have more logging in structure-related code
-        https://bugs.webkit.org/show_bug.cgi?id=102630
-
-        Reviewed by Simon Fraser.
-
-        - JSValue::description() now tells you if something is a structure, and if so,
-          what kind of structure it is.
-        
-        - Jettisoning logic now tells you why things are being jettisoned.
-        
-        - It's now possible to turn off GC-triggered jettisoning entirely.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::finalizeUnconditionally):
-        (JSC::CodeBlock::reoptimize):
-        (JSC::ProgramCodeBlock::jettison):
-        (JSC::EvalCodeBlock::jettison):
-        (JSC::FunctionCodeBlock::jettison):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
-        * runtime/JSValue.cpp:
-        (JSC::JSValue::description):
-        * runtime/Options.h:
-        (JSC):
-
-2012-11-18  Filip Pizlo  <[e-mail]>
-
-        DFG constant folding phase should say 'changed = true' whenever it changes the graph
-        https://bugs.webkit.org/show_bug.cgi?id=102550
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-
-2012-11-17  Elliott Sprehn  <[e-mail]>
-
-        Expose JSObject removeDirect and PrivateName to WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=102546
-
-        Reviewed by Geoffrey Garen.
-
-        Export removeDirect for use in WebCore so JSDependentRetained works.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2012-11-16  Filip Pizlo  <[e-mail]>
-
-        Given a PutById or GetById with a proven structure, the DFG should be able to emit a PutByOffset or GetByOffset instead
-        https://bugs.webkit.org/show_bug.cgi?id=102327
-
-        Reviewed by Mark Hahnenberg.
-
-        If the profiler tells us that a GetById or PutById may be polymorphic but our
-        control flow analysis proves that it isn't, we should trust the control flow
-        analysis over the profiler. This arises in cases where GetById or PutById were
-        inlined: the inlined function may have been called from other places that led
-        to polymorphism, but in the current inlined context, there is no polymorphism.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/GetByIdStatus.cpp:
-        (JSC::GetByIdStatus::computeFor):
-        (JSC):
-        * bytecode/GetByIdStatus.h:
-        (JSC::GetByIdStatus::GetByIdStatus):
-        (GetByIdStatus):
-        * bytecode/PutByIdStatus.cpp:
-        (JSC::PutByIdStatus::computeFor):
-        (JSC):
-        * bytecode/PutByIdStatus.h:
-        (JSC):
-        (JSC::PutByIdStatus::PutByIdStatus):
-        (PutByIdStatus):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::bestProvenStructure):
-        (AbstractValue):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
-        (ConstantFoldingPhase):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::convertToGetByOffset):
-        (Node):
-        (JSC::DFG::Node::convertToPutByOffset):
-        (JSC::DFG::Node::hasStorageResult):
-        * runtime/JSGlobalObject.h:
-        (JSC::Structure::prototypeChain):
-        (JSC):
-        (JSC::Structure::isValid):
-        * runtime/Operations.h:
-        (JSC::isPrototypeChainNormalized):
-        (JSC):
-        * runtime/Structure.h:
-        (Structure):
-        (JSC::Structure::transitionDidInvolveSpecificValue):
-
-2012-11-16  Tony Chang  <[e-mail]>
-
-        Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
-        https://bugs.webkit.org/show_bug.cgi?id=102554
-
-        Reviewed by Andreas Kling.
-
-        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
-        we're going to revist this feature once additional vendor support is
-        achieved.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-16  Patrick Gansterer  <[e-mail]>
-
-        Build fix for WinCE after r133688.
-
-        Use numeric_limits<uint32_t>::max() instead of UINT32_MAX.
-
-        * runtime/CodeCache.h:
-        (JSC::CacheMap::CacheMap):
-
-2012-11-15  Filip Pizlo  <[e-mail]>
-
-        ClassInfo.h should have correct indentation.
-
-        Rubber stamped by Mark Hahnenberg.
-
-        ClassInfo.h had some true creativity in its use of whitespace. Some things within
-        the namespace were indented four spaces and others where not. One #define had its
-        contents indented four spaces, while another didn't. I applied the following rule:
-        
-        - Non-macro things in the namespace should not be indented (that's our current
-          accepted practice).
-        
-        - Macros should never be indented but if they are multi-line then their subsequent
-          bodies should be indented four spaces. I believe that is consistent with what we
-          do elsewhere.
-
-        * runtime/ClassInfo.h:
-        (JSC):
-        (MethodTable):
-        (ClassInfo):
-        (JSC::ClassInfo::propHashTable):
-        (JSC::ClassInfo::isSubClassOf):
-        (JSC::ClassInfo::hasStaticProperties):
-
-2012-11-15  Filip Pizlo  <[e-mail]>
-
-        DFG should copy propagate trivially no-op ConvertThis
-        https://bugs.webkit.org/show_bug.cgi?id=102445
-
-        Reviewed by Oliver Hunt.
-
-        Copy propagation is always a good thing, since it reveals must-alias relationships
-        to the CFA and CSE. This accomplishes copy propagation for ConvertThis by first
-        converting it to an Identity node (which is done by the constant folder since it
-        has access to CFA results) and then performing substitution of references to
-        Identity with references to Identity's child in the CSE.
-        
-        I'm not aiming for a big speed-up here; I just think that this will be useful for
-        the work on https://bugs.webkit.org/show_bug.cgi?id=102327.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGCSEPhase.cpp:
-        (JSC::DFG::CSEPhase::performNodeCSE):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        * dfg/DFGNodeType.h:
-        (DFG):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-
-2012-11-15  Filip Pizlo  <[e-mail]>
-
-        CallData.h should have correct indentation.
-
-        Rubber stamped by Mark Hahneberg.
-
-        * runtime/CallData.h:
-        (JSC):
-
-2012-11-15  Filip Pizlo  <[e-mail]>
-
-        Remove methodCallDummy since it is not used anymore.
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        (JSC):
-        (JSC::JSGlobalObject::visitChildren):
-        * runtime/JSGlobalObject.h:
-        (JSGlobalObject):
-
-2012-11-14  Filip Pizlo  <[e-mail]>
-
-        Structure should be able to easily tell if the prototype chain might intercept a store
-        https://bugs.webkit.org/show_bug.cgi?id=102326
-
-        Reviewed by Geoffrey Garen.
-
-        This improves our ability to reason about the correctness of the more optimized
-        prototype chain walk in JSObject::put(), while also making it straight forward to
-        check if the prototype chain will do strange things to a property store by just
-        looking at the structure.
-
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::put):
-        * runtime/Structure.cpp:
-        (JSC::Structure::prototypeChainMayInterceptStoreTo):
-        (JSC):
-        * runtime/Structure.h:
-        (Structure):
-
-2012-11-15  Thiago Marcos P. Santos  <[e-mail]>
-
-        [CMake] Do not regenerate LLIntAssembly.h on every incremental build
-        https://bugs.webkit.org/show_bug.cgi?id=102248
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Update LLIntAssembly.h's mtime after running asm.rb to make the build
-        system dependency tracking consistent.
-
-        * CMakeLists.txt:
-
-2012-11-15  Thiago Marcos P. Santos  <[e-mail]>
-
-        Fix compiler warnings about signed/unsigned comparison on i386
-        https://bugs.webkit.org/show_bug.cgi?id=102249
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Add casting to unsigned to shut up gcc warnings. Build was broken on
-        JSVALUE32_64 ports compiling with -Werror.
-
-        * llint/LLIntData.cpp:
-        (JSC::LLInt::Data::performAssertions):
-
-2012-11-14  Brent Fulgham  <[e-mail]>
-
-        [Windows, WinCairo] Unreviewed build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        Missed one of the exports that was part of the WebKit2.def.
-
-2012-11-14  Brent Fulgham  <[e-mail]>
-
-        [Windows, WinCairo] Correct build failure.
-        https://bugs.webkit.org/show_bug.cgi?id=102302
-
-        WebCore symbols were mistakenly added to the JavaScriptCore
-        library definition file.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove
-        WebCore symbols that were incorrectly added to the export file.
-
-2012-11-14  Mark Lam  <[e-mail]>
-
-        Change JSEventListener::m_jsFunction to be a weak ref.
-        https://bugs.webkit.org/show_bug.cgi?id=101989.
-
-        Reviewed by Geoffrey Garen.
-
-        Added infrastructure for scanning weak ref slots.
-
-        * heap/SlotVisitor.cpp: Added #include "SlotVisitorInlines.h".
-        * heap/SlotVisitor.h:
-        (SlotVisitor): Added SlotVisitor::appendUnbarrieredWeak().
-        * heap/SlotVisitorInlines.h: Added #include "Weak.h".
-        (JSC::SlotVisitor::appendUnbarrieredWeak): Added.
-        * heap/Weak.h:
-        (JSC::operator==): Added operator==() for Weak.
-        * runtime/JSCell.h: Removed #include "SlotVisitorInlines.h".
-        * runtime/JSObject.h: Added #include "SlotVisitorInlines.h".
-
-2012-11-14  Filip Pizlo  <[e-mail]>
-
-        Read-only properties created with putDirect() should tell the structure that there are read-only properties
-        https://bugs.webkit.org/show_bug.cgi?id=102292
-
-        Reviewed by Gavin Barraclough.
-
-        This mostly affects things like function.length.
-
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirectInternal):
-
-2012-11-13  Filip Pizlo  <[e-mail]>
-
-        Don't access Node& after adding nodes to the graph.
-        https://bugs.webkit.org/show_bug.cgi?id=102005
-
-        Reviewed by Oliver Hunt.
-
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-
-2012-11-14  Valery Ignatyev  <[e-mail]>
-
-        Replace (typeof(x) != <"object", "undefined", ...>) with
-        !(typeof(x) == <"object",..>). Later is_object, is_<...>  bytecode operation
-        will be used.
-
-        https://bugs.webkit.org/show_bug.cgi?id=98893
-
-        Reviewed by Filip Pizlo.
-
-        This eliminates expensive  typeof implementation and
-        allows to use DFG optimizations, which doesn't support 'typeof'.
-
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::BinaryOpNode::emitBytecode):
-
-2012-11-14  Peter Gal  <[e-mail]>
-
-        [Qt][ARM]REGRESSION(r133985): It broke the build
-        https://bugs.webkit.org/show_bug.cgi?id=101740
-
-        Reviewed by Csaba Osztrogonác.
-
-        Changed the emitGenericContiguousPutByVal to accept the additional IndexingType argument.
-        This information was passed as a template parameter.        
-
-        * jit/JIT.h:
-        (JSC::JIT::emitInt32PutByVal):
-        (JSC::JIT::emitDoublePutByVal):
-        (JSC::JIT::emitContiguousPutByVal):
-        (JIT):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emitGenericContiguousPutByVal):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emitGenericContiguousPutByVal):
-
-2012-11-14  Peter Gal  <[e-mail]>
-
-        Fix the MIPS build after r134332
-        https://bugs.webkit.org/show_bug.cgi?id=102227
-
-        Reviewed by Csaba Osztrogonác.
-
-        Added missing methods for the MacroAssemblerMIPS, based on the MacroAssemblerARMv7.
-
-        * assembler/MacroAssemblerMIPS.h:
-        (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranchPtrWithPatch):
-        (MacroAssemblerMIPS):
-        (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
-
-2012-11-14  Peter Gal  <[e-mail]>
-
-        Fix the [-Wreturn-type] warning in JavaScriptCore/assembler/MacroAssemblerARM.h
-        https://bugs.webkit.org/show_bug.cgi?id=102206
-
-        Reviewed by Csaba Osztrogonác.
-
-        Add a return value for the function to suppress the warning.
-
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
-
-2012-11-14  Sheriff Bot  <[e-mail]>
-
-        Unreviewed, rolling out r134599.
-        http://trac.webkit.org/changeset/134599
-        https://bugs.webkit.org/show_bug.cgi?id=102225
-
-        It broke the 32 bit EFL build (Requested by Ossy on #webkit).
-
-        * jit/JITPropertyAccess.cpp:
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC):
-        (JSC::JIT::emitGenericContiguousPutByVal):
-
-2012-11-14  Balazs Kilvady  <[e-mail]>
-
-        [Qt][ARM]REGRESSION(r133985): It broke the build
-        https://bugs.webkit.org/show_bug.cgi?id=101740
-
-        Reviewed by Csaba Osztrogonác.
-
-        Template function body moved to fix VALUE_PROFILER disabled case.
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC):
-        (JSC::JIT::emitGenericContiguousPutByVal):
-        * jit/JITPropertyAccess32_64.cpp:
-
-2012-11-13  Filip Pizlo  <[e-mail]>
-
-        DFG CreateThis should be able to statically account for the structure of the object it creates, if profiling indicates that this structure is always the same
-        https://bugs.webkit.org/show_bug.cgi?id=102017
-
-        Reviewed by Geoffrey Garen.
-
-        This adds a watchpoint in JSFunction on the cached inheritor ID. It also changes
-        NewObject to take a structure as an operand (previously it implicitly used the owning
-        global object's empty object structure). Any GetCallee where the callee is predictable
-        is turned into a CheckFunction + WeakJSConstant, and any CreateThis on a WeakJSConstant
-        where the inheritor ID watchpoint is still valid is turned into an InheritorIDWatchpoint
-        followed by a NewObject. NewObject already accounts for the structure it uses for object
-        creation in the CFA.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGCSEPhase.cpp:
-        (JSC::DFG::CSEPhase::checkFunctionElimination):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::Graph::dump):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::hasFunction):
-        (JSC::DFG::Node::function):
-        (JSC::DFG::Node::hasStructure):
-        * dfg/DFGNodeType.h:
-        (DFG):
-        * dfg/DFGOperations.cpp:
-        * dfg/DFGOperations.h:
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        * dfg/DFGSpeculativeJIT.h:
-        (JSC::DFG::SpeculativeJIT::callOperation):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * runtime/Executable.h:
-        (JSC::JSFunction::JSFunction):
-        * runtime/JSBoundFunction.cpp:
-        (JSC):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::put):
-        (JSC::JSFunction::defineOwnProperty):
-        * runtime/JSFunction.h:
-        (JSC::JSFunction::tryGetKnownInheritorID):
-        (JSFunction):
-        (JSC::JSFunction::addInheritorIDWatchpoint):
-
-2012-11-13  Filip Pizlo  <[e-mail]>
-
-        JSFunction and its descendants should be destructible
-        https://bugs.webkit.org/show_bug.cgi?id=102062
-
-        Reviewed by Mark Hahnenberg.
-
-        This will make it easy to place an InlineWatchpointSet inside JSFunction. In the
-        future, we could make JSFunction non-destructible again by making a version of
-        WatchpointSet that is entirely GC'd, but this seems like overkill for now.
-        
-        This is performance-neutral.
-
-        * runtime/JSBoundFunction.cpp:
-        (JSC::JSBoundFunction::destroy):
-        (JSC):
-        * runtime/JSBoundFunction.h:
-        (JSBoundFunction):
-        * runtime/JSFunction.cpp:
-        (JSC):
-        (JSC::JSFunction::destroy):
-        * runtime/JSFunction.h:
-        (JSFunction):
-
-2012-11-13  Cosmin Truta  <[e-mail]>
-
-        Uninitialized fields in class JSLock
-        https://bugs.webkit.org/show_bug.cgi?id=101695
-
-        Reviewed by Mark Hahnenberg.
-
-        Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
-
-        * runtime/JSLock.cpp:
-        (JSC::JSLock::JSLock):
-
-2012-11-13  Peter Gal  <[e-mail]>
-
-        Fix the ARM traditional build after r134332
-        https://bugs.webkit.org/show_bug.cgi?id=102044
-
-        Reviewed by Zoltan Herczeg.
-
-        Added missing methods for the MacroAssemblerARM, based on the MacroAssemblerARMv7.
-
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::canJumpReplacePatchableBranchPtrWithPatch):
-        (MacroAssemblerARM):
-        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
-
-2012-11-12  Filip Pizlo  <[e-mail]>
-
-        op_get_callee should have value profiling
-        https://bugs.webkit.org/show_bug.cgi?id=102047
-
-        Reviewed by Sam Weinig.
-
-        This will allow us to detect if the callee is always the same, which is probably
-        the common case for a lot of constructors.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        * bytecode/Opcode.h:
-        (JSC):
-        (JSC::padOpcodeName):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_callee):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_callee):
-        * llint/LowLevelInterpreter32_64.asm:
-        * llint/LowLevelInterpreter64.asm:
-
-2012-11-12  Filip Pizlo  <[e-mail]>
-
-        The act of getting the callee during 'this' construction should be explicit in bytecode
-        https://bugs.webkit.org/show_bug.cgi?id=102016
-
-        Reviewed by Michael Saboff.
-
-        This is mostly a rollout of http://trac.webkit.org/changeset/116673, but also includes
-        changes to have create_this use the result of get_callee.
-        
-        No performance or behavioral impact. This is just meant to allow us to profile
-        get_callee in the future.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
-        (JSC):
-        (JSC::padOpcodeName):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGCapabilities.h:
-        (JSC::DFG::canCompileOpcode):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        (JIT):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_callee):
-        (JSC):
-        (JSC::JIT::emit_op_create_this):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_callee):
-        (JSC):
-        (JSC::JIT::emit_op_create_this):
-        * llint/LLIntSlowPaths.cpp:
-        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
-        * llint/LowLevelInterpreter32_64.asm:
-        * llint/LowLevelInterpreter64.asm:
-
-2012-11-12  Filip Pizlo  <[e-mail]>
-
-        Unreviewed, fix ARMv7 build.
-
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
-
-2012-11-12  Filip Pizlo  <[e-mail]>
-
-        Patching of jumps to stubs should use jump replacement rather than branch destination overwrite
-        https://bugs.webkit.org/show_bug.cgi?id=101909
-
-        Reviewed by Geoffrey Garen.
-
-        This saves a few instructions in inline cases, on those architectures where it is
-        easy to figure out where to put the jump replacement. Sub-1% speed-up across the
-        board.
-
-        * assembler/MacroAssemblerARMv7.h:
-        (MacroAssemblerARMv7):
-        (JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
-        * assembler/MacroAssemblerX86.h:
-        (JSC::MacroAssemblerX86::canJumpReplacePatchableBranchPtrWithPatch):
-        (MacroAssemblerX86):
-        (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
-        * assembler/MacroAssemblerX86_64.h:
-        (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
-        (MacroAssemblerX86_64):
-        (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatch):
-        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
-        * assembler/RepatchBuffer.h:
-        (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatch):
-        (RepatchBuffer):
-        (JSC::RepatchBuffer::replaceWithJump):
-        (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranchPtrWithPatch):
-        * assembler/X86Assembler.h:
-        (X86Assembler):
-        (JSC::X86Assembler::revertJumpTo_movq_i64r):
-        (JSC::X86Assembler::revertJumpTo_cmpl_im_force32):
-        (X86InstructionFormatter):
-        * bytecode/StructureStubInfo.h:
-        * dfg/DFGRepatch.cpp:
-        (JSC::DFG::replaceWithJump):
-        (DFG):
-        (JSC::DFG::tryCacheGetByID):
-        (JSC::DFG::tryBuildGetByIDList):
-        (JSC::DFG::tryBuildGetByIDProtoList):
-        (JSC::DFG::tryCachePutByID):
-        (JSC::DFG::dfgResetGetByID):
-        (JSC::DFG::dfgResetPutByID):
-
-2012-11-11  Filip Pizlo  <[e-mail]>
-
-        DFG ArithMul overflow check elimination is too aggressive
-        https://bugs.webkit.org/show_bug.cgi?id=101871
-
-        Reviewed by Oliver Hunt.
-
-        The code was ignoring the fact that ((a * b) | 0) == (((a | 0) * (b | 0)) | 0)
-        only holds if a * b < 2^53. So, I changed it to only enable the optimization
-        when a < 2^22 and b is an int32 (and vice versa), using a super trivial peephole
-        analysis to prove the inequality. I considered writing an epic forward flow
-        formulation that tracks the ranges of integer values but then I thought better
-        of it.
-        
-        This also rewires the ArithMul integer speculation logic. Previously, we would
-        assume that an ArithMul was only UsedAsNumber if it escaped, and separately we
-        would decide whether to speculate integer based on a proof of the <2^22
-        inequality. Now, we treat the double rounding behavior of ArithMul as if the
-        result was UsedAsNumber even if it did not escape. Then we try to prove that
-        double rounding cannot happen by attemping to prove that a < 2^22. This then
-        feeds back into the decision of whether or not to speculate integer (if we fail
-        to prove a < 2^22 then we're UsedAsNumber, and if we're also MayOverflow then
-        that forces double speculation).
-        
-        No performance impact. It just fixes a bug.
-
-        * dfg/DFGGraph.h:
-        (JSC::DFG::Graph::mulShouldSpeculateInteger):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (PredictionPropagationPhase):
-        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
-        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
-        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-
-2012-11-11  Filip Pizlo  <[e-mail]>
-
-        DFG should not emit function checks if we've already proved that the operand is that exact function
-        https://bugs.webkit.org/show_bug.cgi?id=101885
-
-        Reviewed by Oliver Hunt.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::filterByValue):
-        (AbstractValue):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-
-2012-11-12  Kentaro Hara  <[e-mail]>
-
-        [V8][JSC] ScriptProfileNode::callUID needs not to be [Custom]
-        https://bugs.webkit.org/show_bug.cgi?id=101892
-
-        Reviewed by Adam Barth.
-
-        Added callUID(), which enables us to kill custom bindings for ScriptProfileNode::callUID.
-
-        * profiler/ProfileNode.h:
-        (JSC::ProfileNode::callUID):
-
-2012-11-12  Carlos Garcia Campos  <[e-mail]>
-
-        Unreviewed. Fix make distcheck.
-
-        * GNUmakefile.list.am: Add missing header.
-
-2012-11-11  Michael Pruett  <[e-mail]>
-
-        Fix assertion failure in JSObject::tryGetIndexQuickly()
-        https://bugs.webkit.org/show_bug.cgi?id=101869
-
-        Reviewed by Filip Pizlo.
-
-        Currently JSObject::tryGetIndexQuickly() triggers an assertion
-        failure when the object has an undecided indexing type. This
-        case should be treated the same as a blank indexing type.
-
-        * runtime/JSObject.h:
-        (JSC::JSObject::tryGetIndexQuickly):
-
-2012-11-11  Filip Pizlo  <[e-mail]>
-
-        DFG register allocation should be greedy rather than round-robin
-        https://bugs.webkit.org/show_bug.cgi?id=101870
-
-        Reviewed by Geoffrey Garen.
-
-        This simplifies the code, reduces some code duplication, and shows some slight
-        performance improvements in a few places, likely due to the fact that lower-numered
-        registers also typically have smaller encodings.
-
-        * dfg/DFGRegisterBank.h:
-        (JSC::DFG::RegisterBank::RegisterBank):
-        (JSC::DFG::RegisterBank::tryAllocate):
-        (JSC::DFG::RegisterBank::allocate):
-        (JSC::DFG::RegisterBank::allocateInternal):
-        (RegisterBank):
-
-2012-11-11  Kenichi Ishibashi  <[e-mail]>
-
-        WTFString::utf8() should have a mode of conversion to use replacement character
-        https://bugs.webkit.org/show_bug.cgi?id=101678
-
-        Reviewed by Alexey Proskuryakov.
-
-        Follow the change on String::utf8()
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode): Pass String::StrictConversion instead of true to String::utf8().
-
-2012-11-10  Filip Pizlo  <[e-mail]>
-
-        DFG should optimize out the NaN check on loads from double arrays if the array prototype chain is having a great time
-        https://bugs.webkit.org/show_bug.cgi?id=101718
-
-        Reviewed by Geoffrey Garen.
-
-        If we're reading from a JSArray in double mode, where the array's structure is
-        primordial (all aspects of the structure are unchanged except for indexing type),
-        and the result of the load is used in arithmetic that is known to not distinguish
-        between NaN and undefined, then we should not emit a NaN check. Looks like a 5%
-        win on navier-stokes.
-        
-        Also fixed an OpInfo initialization goof for String ops that was revealed by this
-        change.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::arraySpeculationToString):
-        * dfg/DFGArrayMode.h:
-        (JSC::DFG::ArrayMode::isSaneChain):
-        (ArrayMode):
-        (JSC::DFG::ArrayMode::isInBounds):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::handleIntrinsic):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        * dfg/DFGNodeFlags.cpp:
-        (JSC::DFG::nodeFlagsAsString):
-        * dfg/DFGNodeFlags.h:
-        (DFG):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
-        (JSC):
-        * runtime/JSGlobalObject.h:
-        (JSGlobalObject):
-
-2012-11-10  Filip Pizlo  <[e-mail]>
-
-        DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
-        https://bugs.webkit.org/show_bug.cgi?id=101511
-
-        Reviewed by Geoffrey Garen.
-        
-        This is the second attempt at this patch, which fixes the !"" case.
-
-        To make life easier, this moves BranchDirection into BasicBlock so that after
-        running the CFA, we always know, for each block, what direction the CFA
-        proved. CFG simplification now both uses and preserves cfaBranchDirection in
-        its transformations.
-        
-        Also made both LogicalNot and Branch check whether the operand is a known cell
-        with a known structure, and if so, made them do the appropriate folding.
-        
-        5% speed-up on V8/raytrace because it makes raytrace's own null checks
-        evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
-        that we were already doing structure check hoisting.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::endBasicBlock):
-        (JSC::DFG::AbstractState::execute):
-        (JSC::DFG::AbstractState::mergeToSuccessors):
-        * dfg/DFGAbstractState.h:
-        (AbstractState):
-        * dfg/DFGBasicBlock.h:
-        (JSC::DFG::BasicBlock::BasicBlock):
-        (BasicBlock):
-        * dfg/DFGBranchDirection.h: Added.
-        (DFG):
-        (JSC::DFG::branchDirectionToString):
-        (JSC::DFG::isKnownDirection):
-        (JSC::DFG::branchCondition):
-        * dfg/DFGCFGSimplificationPhase.cpp:
-        (JSC::DFG::CFGSimplificationPhase::run):
-        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
-
-2012-11-10  Sheriff Bot  <[e-mail]>
-
-        Unreviewed, rolling out r133971.
-        http://trac.webkit.org/changeset/133971
-        https://bugs.webkit.org/show_bug.cgi?id=101839
-
-        Causes WebProcess to hang at 100% on www.apple.com (Requested
-        by kling on #webkit).
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::endBasicBlock):
-        (JSC::DFG::AbstractState::execute):
-        (JSC::DFG::AbstractState::mergeToSuccessors):
-        * dfg/DFGAbstractState.h:
-        (JSC::DFG::AbstractState::branchDirectionToString):
-        (AbstractState):
-        * dfg/DFGBasicBlock.h:
-        (JSC::DFG::BasicBlock::BasicBlock):
-        (BasicBlock):
-        * dfg/DFGBranchDirection.h: Removed.
-        * dfg/DFGCFGSimplificationPhase.cpp:
-        (JSC::DFG::CFGSimplificationPhase::run):
-        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        If the DFG ArrayMode says that an access is on an OriginalArray, then the checks should always enforce this
-        https://bugs.webkit.org/show_bug.cgi?id=101720
-
-        Reviewed by Mark Hahnenberg.
-
-        Previously, "original" arrays was just a hint that we could find the structure
-        of the array if we needed to even if the array profile didn't have it due to
-        polymorphism. Now, "original" arrays are a property that is actually checked:
-        if an array access has ArrayMode::arrayClass() == Array::OriginalArray, then we
-        can be sure that the code performing the access is dealing with not just a
-        JSArray, but a JSArray that has no named properties, no indexed accessors, and
-        the ArrayPrototype as its prototype. This will be useful for optimizations that
-        are being done as part of https://bugs.webkit.org/show_bug.cgi?id=101720.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::ArrayMode::originalArrayStructure):
-        (DFG):
-        (JSC::DFG::ArrayMode::alreadyChecked):
-        * dfg/DFGArrayMode.h:
-        (JSC):
-        (DFG):
-        (JSC::DFG::ArrayMode::withProfile):
-        (ArrayMode):
-        (JSC::DFG::ArrayMode::benefitsFromOriginalArray):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::checkArray):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
-        (JSC::DFG::SpeculativeJIT::checkArray):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
-        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
-        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        Fix indentation of BooleanPrototype.h
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/BooleanPrototype.h:
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        Fix indentation of BooleanObject.h
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/BooleanObject.h:
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        Fix indentation of BooleanConstructor.h
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/BooleanConstructor.h:
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        Fix indentation of BatchedTransitionOptimizer.h
-
-        Rubber stamped by Mark Hahnenberg.
-
-        * runtime/BatchedTransitionOptimizer.h:
-
-2012-11-09  Oliver Hunt  <[e-mail]>
-
-        So Thingy probably isn't the best name for a class, so
-        renamed to CacheMap.
-
-        RS=Geoff
-
-        * runtime/CodeCache.h:
-        (JSC::CacheMap::CacheMap):
-
-2012-11-09  Filip Pizlo  <[e-mail]>
-
-        ArrayPrototype should start out with a blank indexing type
-        https://bugs.webkit.org/show_bug.cgi?id=101719
-
-        Reviewed by Mark Hahnenberg.
-
-        This allows us to track if the array prototype ever ends up with indexed
-        properties.
-
-        * runtime/ArrayPrototype.cpp:
-        (JSC::ArrayPrototype::create):
-        (JSC::ArrayPrototype::ArrayPrototype):
-        * runtime/ArrayPrototype.h:
-        (ArrayPrototype):
-        (JSC::ArrayPrototype::createStructure):
-
-2012-11-08  Mark Hahnenberg  <[e-mail]>
-
-        MarkStackArray should use the BlockAllocator instead of the MarkStackSegmentAllocator
-        https://bugs.webkit.org/show_bug.cgi?id=101642
-
-        Reviewed by Filip Pizlo.
-
-        MarkStackSegmentAllocator is like a miniature version of the BlockAllocator. Now that the BlockAllocator has support 
-        for a variety of block sizes, we should get rid of the MarkStackSegmentAllocator in favor of the BlockAllocator.
-
-        * heap/BlockAllocator.h: Add new specializations of regionSetFor for the new MarkStackSegments.
-        (JSC):
-        (JSC::MarkStackSegment):
-        * heap/GCThreadSharedData.cpp:
-        (JSC::GCThreadSharedData::GCThreadSharedData):
-        (JSC::GCThreadSharedData::reset):
-        * heap/GCThreadSharedData.h:
-        (GCThreadSharedData):
-        * heap/MarkStack.cpp: 
-        (JSC::MarkStackArray::MarkStackArray): We now have a doubly linked list of MarkStackSegments, so we need to refactor 
-        all the places that used the old custom tail/previous logic.
-        (JSC::MarkStackArray::~MarkStackArray):
-        (JSC::MarkStackArray::expand):
-        (JSC::MarkStackArray::refill):
-        (JSC::MarkStackArray::donateSomeCellsTo): Refactor to use the new linked list.
-        (JSC::MarkStackArray::stealSomeCellsFrom): Ditto.
-        * heap/MarkStack.h:
-        (JSC):
-        (MarkStackSegment):
-        (JSC::MarkStackSegment::MarkStackSegment):
-        (JSC::MarkStackSegment::sizeFromCapacity):
-        (MarkStackArray):
-        * heap/MarkStackInlines.h:
-        (JSC::MarkStackSegment::create):
-        (JSC):
-        (JSC::MarkStackArray::postIncTop):
-        (JSC::MarkStackArray::preDecTop):
-        (JSC::MarkStackArray::setTopForFullSegment):
-        (JSC::MarkStackArray::setTopForEmptySegment):
-        (JSC::MarkStackArray::top):
-        (JSC::MarkStackArray::validatePrevious):
-        (JSC::MarkStackArray::append):
-        (JSC::MarkStackArray::removeLast):
-        (JSC::MarkStackArray::isEmpty):
-        (JSC::MarkStackArray::size):
-        * heap/SlotVisitor.cpp:
-        (JSC::SlotVisitor::SlotVisitor):
-
-2012-11-09  Gabor Ballabas  <[e-mail]>
-
-        [Qt] r133953 broke the ARM_TRADITIONAL build
-        https://bugs.webkit.org/show_bug.cgi?id=101706
-
-        Reviewed by Csaba Osztrogonác.
-
-        Fix for both hardfp and softfp.
-
-        * dfg/DFGCCallHelpers.h:
-        (CCallHelpers):
-        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
-
-2012-11-09  Sheriff Bot  <[e-mail]>
-
-        Unreviewed, rolling out r134051.
-        http://trac.webkit.org/changeset/134051
-        https://bugs.webkit.org/show_bug.cgi?id=101757
-
-        It didn't fix the build (Requested by Ossy on #webkit).
-
-        * dfg/DFGCCallHelpers.h:
-        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
-
-2012-11-09  Gabor Ballabas  <[e-mail]>
-
-        [Qt] r133953 broke the ARM_TRADITIONAL build
-        https://bugs.webkit.org/show_bug.cgi?id=101706
-
-        Reviewed by Csaba Osztrogonác.
-
-        Fix the ARM_TRADITIONAL build after r133953
-
-        * dfg/DFGCCallHelpers.h:
-        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
-        (CCallHelpers):
-
-2012-11-09  Csaba Osztrogonác  <[e-mail]>
-
-        [Qt] Fix the LLINT build from ARMv7 platform
-        https://bugs.webkit.org/show_bug.cgi?id=101712
-
-        Reviewed by Simon Hausmann.
-
-        Enable generating of LLIntAssembly.h on ARM platforms.
-
-        * DerivedSources.pri:
-        * JavaScriptCore.pro:
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        ArrayPrototype.h should have correct indentation
-
-        Rubber stamped by Sam Weinig.
-
-        * runtime/ArrayPrototype.h:
-
-2012-11-08  Mark Lam  <[e-mail]>
-
-        Renamed ...InlineMethods.h files to ...Inlines.h.
-        https://bugs.webkit.org/show_bug.cgi?id=101145.
-
-        Reviewed by Geoffrey Garen.
-
-        This is only a refactoring effort to rename the files. There are no
-        functionality changes.
-
-        * API/JSObjectRef.cpp:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        * dfg/DFGOperations.cpp:
-        * heap/ConservativeRoots.cpp:
-        * heap/CopiedBlock.h:
-        * heap/CopiedSpace.cpp:
-        * heap/CopiedSpaceInlineMethods.h: Removed.
-        * heap/CopiedSpaceInlines.h: Copied from Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h.
-        * heap/CopyVisitor.cpp:
-        * heap/CopyVisitorInlineMethods.h: Removed.
-        * heap/CopyVisitorInlines.h: Copied from Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h.
-        * heap/GCThread.cpp:
-        * heap/GCThreadSharedData.cpp:
-        * heap/HandleStack.cpp:
-        * heap/Heap.cpp:
-        * heap/HeapRootVisitor.h:
-        * heap/MarkStack.cpp:
-        * heap/MarkStackInlineMethods.h: Removed.
-        * heap/MarkStackInlines.h: Copied from Source/JavaScriptCore/heap/MarkStackInlineMethods.h.
-        * heap/SlotVisitor.cpp:
-        * heap/SlotVisitor.h:
-        * heap/SlotVisitorInlineMethods.h: Removed.
-        * heap/SlotVisitorInlines.h: Copied from Source/JavaScriptCore/heap/SlotVisitorInlineMethods.h.
-        * jit/HostCallReturnValue.cpp:
-        * jit/JIT.cpp:
-        * jit/JITArithmetic.cpp:
-        * jit/JITArithmetic32_64.cpp:
-        * jit/JITCall.cpp:
-        * jit/JITCall32_64.cpp:
-        * jit/JITInlineMethods.h: Removed.
-        * jit/JITInlines.h: Copied from Source/JavaScriptCore/jit/JITInlineMethods.h.
-        * jit/JITOpcodes.cpp:
-        * jit/JITOpcodes32_64.cpp:
-        * jit/JITPropertyAccess.cpp:
-        * jit/JITPropertyAccess32_64.cpp:
-        * jsc.cpp:
-        * runtime/ArrayConstructor.cpp:
-        * runtime/ArrayPrototype.cpp:
-        * runtime/ButterflyInlineMethods.h: Removed.
-        * runtime/ButterflyInlines.h: Copied from Source/JavaScriptCore/runtime/ButterflyInlineMethods.h.
-        * runtime/IndexingHeaderInlineMethods.h: Removed.
-        * runtime/IndexingHeaderInlines.h: Copied from Source/JavaScriptCore/runtime/IndexingHeaderInlineMethods.h.
-        * runtime/JSActivation.h:
-        * runtime/JSArray.cpp:
-        * runtime/JSArray.h:
-        * runtime/JSCell.h:
-        * runtime/JSObject.cpp:
-        * runtime/JSValueInlineMethods.h: Removed.
-        * runtime/JSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlineMethods.h.
-        * runtime/LiteralParser.cpp:
-        * runtime/ObjectConstructor.cpp:
-        * runtime/Operations.h:
-        * runtime/RegExpMatchesArray.cpp:
-        * runtime/RegExpObject.cpp:
-        * runtime/StringPrototype.cpp:
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        ArrayConstructor.h should have correct indentation
-
-        Rubber stamped by Sam Weinig.
-
-        * runtime/ArrayConstructor.h:
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        DFG should know that int == null is always false
-        https://bugs.webkit.org/show_bug.cgi?id=101665
-
-        Reviewed by Oliver Hunt.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        Arguments.h should have correct indentation
-
-        Rubber stamped by Sam Weinig.
-
-        * runtime/Arguments.h:
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        It should be possible to JIT compile get_by_vals and put_by_vals even if the DFG is disabled.
-
-        Reviewed by Oliver Hunt.
-
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::chooseArrayMode):
-
-2012-11-08  Filip Pizlo  <[e-mail]>
-
-        op_call should have LLInt call link info even if the DFG is disabled
-        https://bugs.webkit.org/show_bug.cgi?id=101672
-
-        Reviewed by Oliver Hunt.
-
-        Get rid of the evil uses of fall-through.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-
-2012-11-08  Oliver Hunt  <[e-mail]>
-
-        Improve effectiveness of function-level caching
-        https://bugs.webkit.org/show_bug.cgi?id=101667
-
-        Reviewed by Filip Pizlo.
-
-        Added a random-eviction based cache for unlinked functions, and switch
-        UnlinkedFunctionExecutable's code references to Weak<>, thereby letting
-        us remove the explicit UnlinkedFunctionExecutable::clearCode() calls that
-        were being triggered by GC.
-
-        Refactored the random eviction part of the CodeCache into a separate data
-        structure so that I didn't have to duplicate the code again, and then used
-        that for the new function cache.
-
-        * bytecode/UnlinkedCodeBlock.cpp:
-        (JSC::UnlinkedFunctionExecutable::visitChildren):
-        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
-        * bytecode/UnlinkedCodeBlock.h:
-        (JSC::UnlinkedFunctionExecutable::clearCodeForRecompilation):
-        (UnlinkedFunctionExecutable):
-        * debugger/Debugger.cpp:
-        * runtime/CodeCache.cpp:
-        (JSC::CodeCache::getCodeBlock):
-        (JSC::CodeCache::generateFunctionCodeBlock):
-        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
-        (JSC::CodeCache::usedFunctionCode):
-        (JSC):
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilationIfNotCompiling):
-        (JSC::FunctionExecutable::clearCode):
-        * runtime/Executable.h:
-        (FunctionExecutable):
-
-2012-11-07  Filip Pizlo  <[e-mail]>
-
-        DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
-        https://bugs.webkit.org/show_bug.cgi?id=101511
-
-        Reviewed by Oliver Hunt.
-
-        To make life easier, this moves BranchDirection into BasicBlock so that after
-        running the CFA, we always know, for each block, what direction the CFA
-        proved. CFG simplification now both uses and preserves cfaBranchDirection in
-        its transformations.
-        
-        Also made both LogicalNot and Branch check whether the operand is a known cell
-        with a known structure, and if so, made them do the appropriate folding.
-        
-        5% speed-up on V8/raytrace because it makes raytrace's own null checks
-        evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
-        that we were already doing structure check hoisting.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::endBasicBlock):
-        (JSC::DFG::AbstractState::execute):
-        (JSC::DFG::AbstractState::mergeToSuccessors):
-        * dfg/DFGAbstractState.h:
-        (AbstractState):
-        * dfg/DFGBasicBlock.h:
-        (JSC::DFG::BasicBlock::BasicBlock):
-        (BasicBlock):
-        * dfg/DFGBranchDirection.h: Added.
-        (DFG):
-        (JSC::DFG::branchDirectionToString):
-        (JSC::DFG::isKnownDirection):
-        (JSC::DFG::branchCondition):
-        * dfg/DFGCFGSimplificationPhase.cpp:
-        (JSC::DFG::CFGSimplificationPhase::run):
-        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
-
-2012-11-08  Christophe Dumez  <[e-mail]>
-
-        [JSC] HTML extensions to String.prototype should escape " as &quot; in argument values
-        https://bugs.webkit.org/show_bug.cgi?id=90667
-
-        Reviewed by Benjamin Poulain.
-
-        Escape quotation mark as &quot; in argument values to:
-        - String.prototype.anchor(name)
-        - String.prototype.fontcolor(color)
-        - String.prototype.fontsize(size)
-        - String.prototype.link(href)
-
-        This behavior matches Chromium/V8 and Firefox/Spidermonkey
-        implementations and is requited by:
-        http://mathias.html5.org/specs/javascript/#escapeattributevalue
-
-        This also fixes a potential security risk (XSS vector).
-
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncFontcolor):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncAnchor):
-        (JSC::stringProtoFuncLink):
-
-2012-11-08  Anders Carlsson  <[e-mail]>
-
-        HeapStatistics::s_pauseTimeStarts and s_pauseTimeEnds should be Vectors
-        https://bugs.webkit.org/show_bug.cgi?id=101651
-
-        Reviewed by Andreas Kling.
-
-        HeapStatistics uses Deques when Vectors would work just as good.
-
-        * heap/HeapStatistics.cpp:
-        * heap/HeapStatistics.h:
-        (HeapStatistics):
-
-2012-11-07  Filip Pizlo  <[e-mail]>
-
-        DFG should not assume that something is a double just because it might be undefined
-        https://bugs.webkit.org/show_bug.cgi?id=101438
-
-        Reviewed by Oliver Hunt.
-
-        This changes all non-bitop arithmetic to (a) statically expect that variables are
-        defined prior to use in arithmetic and (b) not fall off into double paths just
-        because a value may not be a number. This is accomplished with two new notions of
-        speculation:
-        
-        shouldSpeculateIntegerExpectingDefined: Should we speculate that the value is an
-        integer if we ignore undefined (i.e. SpecOther) predictions?
-        
-        shouldSpeculateIntegerForArithmetic: Should we speculate that the value is an
-        integer if we ignore non-numeric predictions?
-        
-        This is a ~2x speed-up on programs that seem to our prediction propagator to have
-        paths in which otherwise numeric variables are undefined.
-
-        * bytecode/SpeculatedType.h:
-        (JSC::isInt32SpeculationForArithmetic):
-        (JSC):
-        (JSC::isInt32SpeculationExpectingDefined):
-        (JSC::isDoubleSpeculationForArithmetic):
-        (JSC::isNumberSpeculationExpectingDefined):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        * dfg/DFGGraph.h:
-        (JSC::DFG::Graph::addShouldSpeculateInteger):
-        (JSC::DFG::Graph::mulShouldSpeculateInteger):
-        (JSC::DFG::Graph::negateShouldSpeculateInteger):
-        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
-        (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
-        (Node):
-        (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
-        (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
-        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::compileAdd):
-        (JSC::DFG::SpeculativeJIT::compileArithMod):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_div):
-
-2012-11-06  Filip Pizlo  <[e-mail]>
-
-        JSC should infer when indexed storage contains only integers or doubles
-        https://bugs.webkit.org/show_bug.cgi?id=98606
-
-        Reviewed by Oliver Hunt.
-
-        This adds two new indexing types: int32 and double. It also adds array allocation profiling,
-        which allows array allocations to converge to allocating arrays using those types to which
-        those arrays would have been converted.
-        
-        20% speed-up on navier-stokes. 40% speed-up on various Kraken DSP tests. Some slow-downs too,
-        but a performance win overall on all benchmarks we track.
-
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeArray):
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * assembler/AbstractMacroAssembler.h:
-        (JumpList):
-        (JSC::AbstractMacroAssembler::JumpList::JumpList):
-        * assembler/MacroAssemblerX86Common.h:
-        (JSC::MacroAssemblerX86Common::branchDouble):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::jnp):
-        (X86Assembler):
-        (JSC::X86Assembler::X86InstructionFormatter::emitRex):
-        * bytecode/ArrayAllocationProfile.cpp: Added.
-        (JSC):
-        (JSC::ArrayAllocationProfile::updateIndexingType):
-        * bytecode/ArrayAllocationProfile.h: Added.
-        (JSC):
-        (ArrayAllocationProfile):
-        (JSC::ArrayAllocationProfile::ArrayAllocationProfile):
-        (JSC::ArrayAllocationProfile::selectIndexingType):
-        (JSC::ArrayAllocationProfile::updateLastAllocation):
-        (JSC::ArrayAllocationProfile::selectIndexingTypeFor):
-        (JSC::ArrayAllocationProfile::updateLastAllocationFor):
-        * bytecode/ArrayProfile.cpp:
-        (JSC::ArrayProfile::updatedObservedArrayModes):
-        (JSC):
-        * bytecode/ArrayProfile.h:
-        (JSC):
-        (JSC::arrayModesInclude):
-        (JSC::shouldUseSlowPutArrayStorage):
-        (JSC::shouldUseFastArrayStorage):
-        (JSC::shouldUseContiguous):
-        (JSC::shouldUseDouble):
-        (JSC::shouldUseInt32):
-        (ArrayProfile):
-        * bytecode/ByValInfo.h:
-        (JSC::isOptimizableIndexingType):
-        (JSC::jitArrayModeForIndexingType):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
-        (JSC):
-        (JSC::CodeBlock::updateAllValueProfilePredictions):
-        (JSC::CodeBlock::updateAllArrayPredictions):
-        (JSC::CodeBlock::updateAllPredictions):
-        (JSC::CodeBlock::shouldOptimizeNow):
-        * bytecode/CodeBlock.h:
-        (CodeBlock):
-        (JSC::CodeBlock::numberOfArrayAllocationProfiles):
-        (JSC::CodeBlock::addArrayAllocationProfile):
-        (JSC::CodeBlock::updateAllValueProfilePredictions):
-        (JSC::CodeBlock::updateAllArrayPredictions):
-        * bytecode/DFGExitProfile.h:
-        (JSC::DFG::exitKindToString):
-        * bytecode/Instruction.h:
-        (JSC):
-        (JSC::Instruction::Instruction):
-        * bytecode/Opcode.h:
-        (JSC):
-        (JSC::padOpcodeName):
-        * bytecode/SpeculatedType.h:
-        (JSC):
-        (JSC::isRealNumberSpeculation):
-        * bytecode/UnlinkedCodeBlock.cpp:
-        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
-        * bytecode/UnlinkedCodeBlock.h:
-        (JSC):
-        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile):
-        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles):
-        (UnlinkedCodeBlock):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::newArrayAllocationProfile):
-        (JSC):
-        (JSC::BytecodeGenerator::emitNewArray):
-        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
-        * bytecompiler/BytecodeGenerator.h:
-        (BytecodeGenerator):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::ArrayMode::fromObserved):
-        (JSC::DFG::ArrayMode::refine):
-        (DFG):
-        (JSC::DFG::ArrayMode::alreadyChecked):
-        (JSC::DFG::arrayTypeToString):
-        * dfg/DFGArrayMode.h:
-        (JSC::DFG::ArrayMode::withType):
-        (ArrayMode):
-        (JSC::DFG::ArrayMode::withTypeAndConversion):
-        (JSC::DFG::ArrayMode::usesButterfly):
-        (JSC::DFG::ArrayMode::isSpecific):
-        (JSC::DFG::ArrayMode::supportsLength):
-        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::getArrayMode):
-        (ByteCodeParser):
-        (JSC::DFG::ByteCodeParser::handleIntrinsic):
-        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGCCallHelpers.h:
-        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
-        (CCallHelpers):
-        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
-        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
-        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        (JSC::DFG::FixupPhase::checkArray):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::Graph::dump):
-        * dfg/DFGGraph.h:
-        (JSC::DFG::Graph::byValIsPure):
-        * dfg/DFGNode.h:
-        (NewArrayBufferData):
-        (JSC::DFG::Node::hasIndexingType):
-        (Node):
-        (JSC::DFG::Node::indexingType):
-        (JSC::DFG::Node::setIndexingType):
-        * dfg/DFGOperations.cpp:
-        * dfg/DFGOperations.h:
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
-        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
-        (DFG):
-        (JSC::DFG::SpeculativeJIT::checkArray):
-        (JSC::DFG::SpeculativeJIT::arrayify):
-        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
-        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
-        * dfg/DFGSpeculativeJIT.h:
-        (JSC::DFG::SpeculativeJIT::callOperation):
-        (SpeculativeJIT):
-        (SpeculateIntegerOperand):
-        (JSC::DFG::SpeculateIntegerOperand::use):
-        (SpeculateDoubleOperand):
-        (JSC::DFG::SpeculateDoubleOperand::use):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (DFG):
-        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * jit/JIT.h:
-        (JSC::JIT::emitInt32GetByVal):
-        (JIT):
-        (JSC::JIT::emitInt32PutByVal):
-        (JSC::JIT::emitDoublePutByVal):
-        (JSC::JIT::emitContiguousPutByVal):
-        * jit/JITExceptions.cpp:
-        (JSC::genericThrow):
-        * jit/JITInlineMethods.h:
-        (JSC::arrayProfileSaw):
-        (JSC::JIT::chooseArrayMode):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_new_array):
-        (JSC::JIT::emit_op_new_array_with_size):
-        (JSC::JIT::emit_op_new_array_buffer):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emitDoubleGetByVal):
-        (JSC):
-        (JSC::JIT::emitContiguousGetByVal):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::emitGenericContiguousPutByVal):
-        (JSC::JIT::emitSlow_op_put_by_val):
-        (JSC::JIT::privateCompileGetByVal):
-        (JSC::JIT::privateCompilePutByVal):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emitContiguousGetByVal):
-        (JSC::JIT::emitDoubleGetByVal):
-        (JSC):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::emitGenericContiguousPutByVal):
-        (JSC::JIT::emitSlow_op_put_by_val):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        (JSC):
-        * jsc.cpp:
-        (GlobalObject::finishCreation):
-        * llint/LLIntSlowPaths.cpp:
-        (JSC::LLInt::jitCompileAndSetHeuristics):
-        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
-        * llint/LowLevelInterpreter.asm:
-        * llint/LowLevelInterpreter32_64.asm:
-        * llint/LowLevelInterpreter64.asm:
-        * offlineasm/x86.rb:
-        * runtime/ArrayConstructor.cpp:
-        (JSC::constructArrayWithSizeQuirk):
-        * runtime/ArrayConstructor.h:
-        (JSC):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncConcat):
-        (JSC::arrayProtoFuncSlice):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        * runtime/Butterfly.h:
-        (JSC::Butterfly::contiguousInt32):
-        (JSC::Butterfly::contiguousDouble):
-        (JSC::Butterfly::fromContiguous):
-        * runtime/ButterflyInlineMethods.h:
-        (JSC::Butterfly::createUninitializedDuringCollection):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncBind):
-        * runtime/IndexingHeaderInlineMethods.h:
-        (JSC::IndexingHeader::indexingPayloadSizeInBytes):
-        * runtime/IndexingType.cpp:
-        (JSC::leastUpperBoundOfIndexingTypes):
-        (JSC):
-        (JSC::leastUpperBoundOfIndexingTypeAndType):
-        (JSC::leastUpperBoundOfIndexingTypeAndValue):
-        (JSC::indexingTypeToString):
-        * runtime/IndexingType.h:
-        (JSC):
-        (JSC::hasUndecided):
-        (JSC::hasInt32):
-        (JSC::hasDouble):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::shiftCountWithAnyIndexingType):
-        (JSC::JSArray::unshiftCountWithAnyIndexingType):
-        (JSC::compareNumbersForQSortWithInt32):
-        (JSC):
-        (JSC::compareNumbersForQSortWithDouble):
-        (JSC::JSArray::sortNumericVector):
-        (JSC::JSArray::sortNumeric):
-        (JSC::JSArray::sortCompactedVector):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::sortVector):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToArguments):
-        (JSC::JSArray::compactForSorting):
-        * runtime/JSArray.h:
-        (JSArray):
-        (JSC::createContiguousArrayButterfly):
-        (JSC::JSArray::create):
-        (JSC::JSArray::tryCreateUninitialized):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        (JSC):
-        (JSC::JSGlobalObject::haveABadTime):
-        (JSC::JSGlobalObject::visitChildren):
-        * runtime/JSGlobalObject.h:
-        (JSGlobalObject):
-        (JSC::JSGlobalObject::originalArrayStructureForIndexingType):
-        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
-        (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
-        (JSC::JSGlobalObject::isOriginalArrayStructure):
-        (JSC::constructEmptyArray):
-        (JSC::constructArray):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::copyButterfly):
-        (JSC::JSObject::getOwnPropertySlotByIndex):
-        (JSC::JSObject::putByIndex):
-        (JSC::JSObject::enterDictionaryIndexingMode):
-        (JSC::JSObject::createInitialIndexedStorage):
-        (JSC):
-        (JSC::JSObject::createInitialUndecided):
-        (JSC::JSObject::createInitialInt32):
-        (JSC::JSObject::createInitialDouble):
-        (JSC::JSObject::createInitialContiguous):
-        (JSC::JSObject::convertUndecidedToInt32):
-        (JSC::JSObject::convertUndecidedToDouble):
-        (JSC::JSObject::convertUndecidedToContiguous):
-        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
-        (JSC::JSObject::convertUndecidedToArrayStorage):
-        (JSC::JSObject::convertInt32ToDouble):
-        (JSC::JSObject::convertInt32ToContiguous):
-        (JSC::JSObject::convertInt32ToArrayStorage):
-        (JSC::JSObject::convertDoubleToContiguous):
-        (JSC::JSObject::convertDoubleToArrayStorage):
-        (JSC::JSObject::convertContiguousToArrayStorage):
-        (JSC::JSObject::convertUndecidedForValue):
-        (JSC::JSObject::convertInt32ForValue):
-        (JSC::JSObject::setIndexQuicklyToUndecided):
-        (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
-        (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
-        (JSC::JSObject::ensureInt32Slow):
-        (JSC::JSObject::ensureDoubleSlow):
-        (JSC::JSObject::ensureContiguousSlow):
-        (JSC::JSObject::ensureArrayStorageSlow):
-        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
-        (JSC::JSObject::switchToSlowPutArrayStorage):
-        (JSC::JSObject::deletePropertyByIndex):
-        (JSC::JSObject::getOwnPropertyNames):
-        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
-        (JSC::JSObject::putByIndexBeyondVectorLength):
-        (JSC::JSObject::putDirectIndexBeyondVectorLength):
-        (JSC::JSObject::getNewVectorLength):
-        (JSC::JSObject::countElements):
-        (JSC::JSObject::ensureLengthSlow):
-        (JSC::JSObject::getOwnPropertyDescriptor):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getArrayLength):
-        (JSC::JSObject::getVectorLength):
-        (JSC::JSObject::canGetIndexQuickly):
-        (JSC::JSObject::getIndexQuickly):
-        (JSC::JSObject::tryGetIndexQuickly):
-        (JSC::JSObject::canSetIndexQuickly):
-        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
-        (JSC::JSObject::setIndexQuickly):
-        (JSC::JSObject::initializeIndex):
-        (JSC::JSObject::hasSparseMap):
-        (JSC::JSObject::inSparseIndexingMode):
-        (JSObject):
-        (JSC::JSObject::ensureInt32):
-        (JSC::JSObject::ensureDouble):
-        (JSC::JSObject::ensureLength):
-        (JSC::JSObject::indexingData):
-        (JSC::JSObject::currentIndexingData):
-        (JSC::JSObject::getHolyIndexQuickly):
-        (JSC::JSObject::relevantLength):
-        (JSC::JSObject::currentRelevantLength):
-        * runtime/JSValue.cpp:
-        (JSC::JSValue::description):
-        * runtime/LiteralParser.cpp:
-        (JSC::::parse):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::objectConstructorGetOwnPropertyNames):
-        (JSC::objectConstructorKeys):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSplit):
-        * runtime/Structure.cpp:
-        (JSC::Structure::nonPropertyTransition):
-        * runtime/StructureTransitionTable.h:
-        (JSC::newIndexingType):
-
-2012-11-08  Balazs Kilvady  <[e-mail]>
-
-        ASSERT problem on MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=100589
-
-        Reviewed by Oliver Hunt.
-
-        ASSERT fix for MIPS arch.
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_resolve_operations):
-
-2012-11-08  Michael Saboff  <[e-mail]>
-
-        OpaqueJSClassContextData() should use StringImpl::isolatedCopy() to make string copies
-        https://bugs.webkit.org/show_bug.cgi?id=101507
-
-        Reviewed by Andreas Kling.
-
-        Changed to use isolatedCopy() for key Strings.
-
-        * API/JSClassRef.cpp:
-        (OpaqueJSClassContextData::OpaqueJSClassContextData):
-
-2012-11-07  Mark Hahnenberg  <[e-mail]>
-
-        WeakBlocks should be HeapBlocks
-        https://bugs.webkit.org/show_bug.cgi?id=101411
-
-        Reviewed by Oliver Hunt.
-
-        Currently WeakBlocks use fastMalloc memory. They are very similar to the other HeapBlocks, however, 
-        so we should change them to being allocated with the BlockAllocator.
-
-        * heap/BlockAllocator.cpp:
-        (JSC::BlockAllocator::BlockAllocator):
-        * heap/BlockAllocator.h: Added a new RegionSet for WeakBlocks.
-        (JSC):
-        (BlockAllocator):
-        (JSC::WeakBlock):
-        * heap/Heap.h: Friended WeakSet to allow access to the BlockAllocator.
-        (Heap):
-        * heap/WeakBlock.cpp:
-        (JSC::WeakBlock::create): Refactored to use HeapBlocks rather than fastMalloc.
-        (JSC::WeakBlock::WeakBlock):
-        * heap/WeakBlock.h: Changed the WeakBlock size to 4 KB so that it divides evenly into the Region size.
-        (JSC):
-        (WeakBlock):
-        * heap/WeakSet.cpp:
-        (JSC::WeakSet::~WeakSet):
-        (JSC::WeakSet::addAllocator):
-
-2012-11-07  Filip Pizlo  <[e-mail]>
-
-        Indentation of ArgList.h is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=101441
-
-        Reviewed by Andreas Kling.
-
-        Just unindented by 4 spaces.
-
-        * runtime/ArgList.h:
-
-2012-11-07  Gabor Ballabas  <[e-mail]>
-
-        [Qt][ARM] REGRESSION(r133688): It made all JSC and layout tests crash on ARM traditional platform
-        https://bugs.webkit.org/show_bug.cgi?id=101465
-
-        Reviewed by Oliver Hunt.
-
-        Fix failing javascriptcore tests on ARM after r133688
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-
-2012-11-06  Oliver Hunt  <[e-mail]>
-
-        Reduce parser overhead in JSC
-        https://bugs.webkit.org/show_bug.cgi?id=101127
-
-        Reviewed by Filip Pizlo.
-
-        An exciting journey into the world of architecture in which our hero
-        adds yet another layer to JSC codegeneration.
-
-        This patch adds a marginally more compact form of bytecode that is
-        free from any data specific to a given execution context, and that
-        does store any data structures necessary for execution.  To actually
-        execute this UnlinkedBytecode we still need to instantiate a real
-        CodeBlock, but this is a much faster linear time operation than any
-        of the earlier parsing or code generation passes.
-
-        As the unlinked code is context free we can then simply use a cache
-        from source to unlinked code mapping to completely avoid all of the
-        old parser overhead.  The cache is currently very simple and memory
-        heavy, using the complete source text as a key (rather than SourceCode
-        or equivalent), and a random eviction policy.
-
-        This seems to produce a substantial win when loading identical content
-        in different contexts.
-
-        * API/tests/testapi.c:
-        (main):
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        * bytecode/CodeBlock.h:
-            Moved a number of fields, and a bunch of logic to UnlinkedCodeBlock.h/cpp
-        * bytecode/Opcode.h:
-            Added a global const init no op instruction needed to get correct
-            behaviour without any associated semantics.
-        * bytecode/UnlinkedCodeBlock.cpp: Added.
-        * bytecode/UnlinkedCodeBlock.h: Added.
-            A fairly shallow, GC allocated version of the old CodeBlock
-            classes with a 32bit instruction size, and just metadata
-            size tracking.
-        * bytecompiler/BytecodeGenerator.cpp:
-        * bytecompiler/BytecodeGenerator.h:
-            Replace direct access to m_symbolTable with access through
-            symbolTable().  ProgramCode no longer has a symbol table at
-            all so some previously unconditional (and pointless) uses
-            of symbolTable get null checks.
-            A few other changes to deal with type changes due to us generating
-            unlinked code (eg. pointer free, so profile indices rather than
-            pointers).
-        * dfg/DFGByteCodeParser.cpp:
-        * dfg/DFGCapabilities.h:
-            Support global_init_nop        
-        * interpreter/Interpreter.cpp:
-            Now get the ProgramExecutable to initialise new global properties
-            before starting execution.        
-        * jit/JIT.cpp:
-        * jit/JITDriver.h:
-        * jit/JITStubs.cpp:
-        * llint/LLIntData.cpp:
-        * llint/LLIntSlowPaths.cpp:
-        * llint/LowLevelInterpreter.asm:
-        * llint/LowLevelInterpreter32_64.asm:
-        * llint/LowLevelInterpreter64.asm:
-            Adding init_global_const_nop everywhere else
-        * parser/Parser.h:
-        * parser/ParserModes.h: Added.
-        * parser/ParserTokens.h:
-            Parser no longer needs a global object or callframe to function        
-        * runtime/CodeCache.cpp: Added.
-        * runtime/CodeCache.h: Added.
-            A simple, random eviction, Source->UnlinkedCode cache        
-        * runtime/Executable.cpp:
-        * runtime/Executable.h:
-            Executables now reference their unlinked counterparts, and
-            request code specifically for the target global object.        
-        * runtime/JSGlobalData.cpp:
-        * runtime/JSGlobalData.h:
-            GlobalData now owns a CodeCache and a set of new structures
-            for the unlinked code types.  
-        * runtime/JSGlobalObject.cpp:
-        * runtime/JSGlobalObject.h:
-            Utility functions used by executables to perform compilation
- 
-        * runtime/JSType.h:
-          Add new JSTypes for unlinked code
-
-2012-11-06  Michael Saboff  <[e-mail]>
-
-        JSStringCreateWithCFString() Should create an 8 bit String if possible
-        https://bugs.webkit.org/show_bug.cgi?id=101104
-
-        Reviewed by Darin Adler.
-
-        Try converting the CFString to an 8 bit string using CFStringGetBytes(...,
-        kCFStringEncodingISOLatin1, ...) and return the 8 bit string if successful.
-        If not proceed with 16 bit conversion.
-
-        * API/JSStringRefCF.cpp:
-        (JSStringCreateWithCFString):
-
-2012-11-06  Oliver Hunt  <[e-mail]>
-
-        Reduce direct m_symbolTable usage in CodeBlock
-        https://bugs.webkit.org/show_bug.cgi?id=101391
-
-        Reviewed by Sam Weinig.
-
-        Simple refactoring.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::dumpStatistics):
-        (JSC::CodeBlock::nameForRegister):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::isCaptured):
-
-2012-11-06  Michael Saboff  <[e-mail]>
-
-        Lexer::scanRegExp, create 8 bit pattern and flag Identifiers from 16 bit source when possible
-        https://bugs.webkit.org/show_bug.cgi?id=101013
-
-        Reviewed by Darin Adler.
-
-        Changed scanRegExp so that it will create 8 bit identifiers from 8 bit sources and from 16 bit sources
-        whan all the characters are 8 bit.  Using two templated helpers, the "is all 8 bit" check is only performed
-        on 16 bit sources.  The first helper is orCharacter() that will accumulate the or value of all characters
-        only for 16 bit sources.  Replaced the helper Lexer::makeIdentifierSameType() with Lexer::makeRightSizedIdentifier().
-
-        * parser/Lexer.cpp:
-        (JSC::orCharacter<LChar>): Explicit template that serves as a placeholder.
-        (JSC::orCharacter<UChar>): Explicit template that actually or accumulates characters.
-        (JSC::Lexer::scanRegExp):
-        * parser/Lexer.h:
-        (Lexer):
-        (JSC::Lexer::makeRightSizedIdentifier<LChar>): New template that always creates an 8 bit Identifier.
-        (JSC::Lexer::makeRightSizedIdentifier<UChar>): New template that creates an 8 bit Identifier for 8 bit
-        data in a 16 bit source.
-
-2012-11-06  Filip Pizlo  <[e-mail]>
-
-        Indentation of JSCell.h is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=101379
-
-        Rubber stamped by Alexey Proskuryakov.
-
-        Just removed four spaces on a bunch of lines.
-
-        * runtime/JSCell.h:
-
-2012-11-05  Filip Pizlo  <[e-mail]>
-
-        Indentation of JSObject.h is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=101313
-
-        Rubber stamped by Alexey Proskuryakov.
-
-        Just unindented code, since namespace bodies shouldn't be indented.
-
-        * runtime/JSObject.h:
-
-2012-11-05  Filip Pizlo  <[e-mail]>
-
-        Indentation of JSArray.h is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=101314
-
-        Rubber stamped by Alexey Proskuryakov.
-
-        Just removing the indentation inside the namespace body.
-
-        * runtime/JSArray.h:
-
-2012-11-05  Filip Pizlo  <[e-mail]>
-
-        DFG should not fall down to patchable GetById just because a prototype had things added to it
-        https://bugs.webkit.org/show_bug.cgi?id=101299
-
-        Reviewed by Geoffrey Garen.
-
-        This looks like a slight win on V8v7 and SunSpider.
-
-        * bytecode/DFGExitProfile.h:
-        (JSC::DFG::exitKindToString):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-
-2012-11-05  Filip Pizlo  <[e-mail]>
-
-        Get rid of method_check
-        https://bugs.webkit.org/show_bug.cgi?id=101147
-
-        Reviewed by Geoffrey Garen.
-
-        op_method_check no longer buys us anything, since get_by_id proto caching
-        gives just as much profiling information and the DFG inlines monomorphic
-        proto accesses anyway.
-        
-        This also has the potential for a speed-up since it makes parsing of
-        profiling data easier. No longer do we have to deal with the confusion of
-        the get_by_id portion of a method_check appearing monomorphic even though
-        we're really dealing with a bimorphic access (method_check specializes for
-        one case and get_by_id for another).
-
-        This looks like a 1% speed-up on both SunSpider and V8v7.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * Target.pri:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::printGetByIdCacheStatus):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::finalizeUnconditionally):
-        (JSC::CodeBlock::shrinkToFit):
-        (JSC::CodeBlock::unlinkCalls):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::getCallLinkInfo):
-        (JSC::CodeBlock::callLinkInfo):
-        (CodeBlock):
-        * bytecode/GetByIdStatus.cpp:
-        (JSC::GetByIdStatus::computeFromLLInt):
-        * bytecode/MethodCallLinkInfo.cpp: Removed.
-        * bytecode/MethodCallLinkInfo.h: Removed.
-        * bytecode/MethodCallLinkStatus.cpp: Removed.
-        * bytecode/MethodCallLinkStatus.h: Removed.
-        * bytecode/Opcode.h:
-        (JSC):
-        (JSC::padOpcodeName):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC):
-        * bytecompiler/BytecodeGenerator.h:
-        (BytecodeGenerator):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::FunctionCallDotNode::emitBytecode):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGCapabilities.h:
-        (JSC::DFG::canCompileOpcode):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JSC::PropertyStubCompilationInfo::slowCaseInfo):
-        (PropertyStubCompilationInfo):
-        (JSC):
-        (JIT):
-        * jit/JITPropertyAccess.cpp:
-        (JSC):
-        (JSC::JIT::emitSlow_op_get_by_id):
-        (JSC::JIT::compileGetByIdSlowCase):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC):
-        (JSC::JIT::compileGetByIdSlowCase):
-        * jit/JITStubs.cpp:
-        (JSC):
-        * jit/JITStubs.h:
-        * llint/LowLevelInterpreter.asm:
-
-2012-11-05  Yuqiang Xian  <[e-mail]>
-
-        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
-        https://bugs.webkit.org/show_bug.cgi?id=100321
-
-        Reviewed by Filip Pizlo.
-
-        We have refactored the MacroAssembler and JIT compilers to distinguish
-        the pointer operations from the 64-bit integer operations (see bug #99154).
-        Now we want to do the similar work for LLInt, and the goal is same as
-        the one mentioned in 99154.
-
-        This is the second part of the modification: in the low level interpreter,
-        changing the operations on 64-bit integers to use the "<foo>q" instructions.
-        This also removes some unused/meaningless "<foo>p" instructions.
-
-        * llint/LowLevelInterpreter.asm:
-        * llint/LowLevelInterpreter.cpp:
-        (JSC::CLoop::execute):
-        * llint/LowLevelInterpreter64.asm:
-        * offlineasm/armv7.rb:
-        * offlineasm/cloop.rb:
-        * offlineasm/instructions.rb:
-        * offlineasm/x86.rb:
-
-2012-11-05  Filip Pizlo  <[e-mail]>
-
-        Prototype chain caching should check that the path from the base object to the slot base involves prototype hops only
-        https://bugs.webkit.org/show_bug.cgi?id=101276
-
-        Reviewed by Gavin Barraclough.
-
-        Changed normalizePrototypeChain() to report an invalid prototype chain if any object is a proxy.
-        This catches cases where our prototype chain checks would have been insufficient to guard against
-        newly introduced properties, despecialized properties, or deleted properties in the chain of
-        objects involved in the access.
-
-        * dfg/DFGRepatch.cpp:
-        (JSC::DFG::tryCacheGetByID):
-        (JSC::DFG::tryBuildGetByIDProtoList):
-        (JSC::DFG::tryCachePutByID):
-        (JSC::DFG::tryBuildPutByIdList):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCachePutByID):
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * llint/LLIntSlowPaths.cpp:
-        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
-        * runtime/Operations.h:
-        (JSC):
-        (JSC::normalizePrototypeChain):
-
-2012-11-05  Dima Gorbik  <[e-mail]>
-
-        Back out controversial changes from Bug 98665.
-        https://bugs.webkit.org/show_bug.cgi?id=101244
-
-        Reviewed by David Kilzer.
-
-        Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
-
-        * API/tests/minidom.c:
-        * API/tests/testapi.c:
-
-2012-11-04  Filip Pizlo  <[e-mail]>
-
-        Reduce the verbosity of referring to QNaN in JavaScriptCore
-        https://bugs.webkit.org/show_bug.cgi?id=101174
-
-        Reviewed by Geoffrey Garen.
-
-        Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
-        std::numeric_limits<double>::quiet_NaN() with QNaN.
-
-        * API/JSValueRef.cpp:
-        (JSValueMakeNumber):
-        (JSValueToNumber):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emitFloatTypedArrayGetByVal):
-        * runtime/CachedTranscendentalFunction.h:
-        (JSC::CachedTranscendentalFunction::initialize):
-        * runtime/DateConstructor.cpp:
-        (JSC::constructDate):
-        * runtime/DateInstanceCache.h:
-        (JSC::DateInstanceData::DateInstanceData):
-        (JSC::DateInstanceCache::reset):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::InterruptedExecutionError::defaultValue):
-        (JSC::TerminatedExecutionError::defaultValue):
-        * runtime/JSCell.h:
-        (JSC::JSValue::getPrimitiveNumber):
-        * runtime/JSDateMath.cpp:
-        (JSC::parseDateFromNullTerminatedCharacters):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::resetDateCache):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt):
-        (JSC::jsStrDecimalLiteral):
-        (JSC::toDouble):
-        (JSC::jsToNumber):
-        (JSC::parseFloat):
-        * runtime/JSValue.cpp:
-        (JSC::JSValue::toNumberSlowCase):
-        * runtime/JSValue.h:
-        (JSC):
-        * runtime/JSValueInlineMethods.h:
-        (JSC::jsNaN):
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncMax):
-        (JSC::mathProtoFuncMin):
-
-2012-11-03  Filip Pizlo  <[e-mail]>
-
-        Baseline JIT should use structure watchpoints whenever possible
-        https://bugs.webkit.org/show_bug.cgi?id=101146
-
-        Reviewed by Sam Weinig.
-
-        No speed-up yet except on toy programs. I think that it will start to show
-        speed-ups with https://bugs.webkit.org/show_bug.cgi?id=101147, which this is
-        a step towards.
-
-        * jit/JIT.h:
-        (JIT):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::addStructureTransitionCheck):
-        (JSC):
-        (JSC::JIT::testPrototype):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-
-2012-11-04  Csaba Osztrogonác  <[e-mail]>
-
-        [Qt] udis86_itab.c is always regenerated
-        https://bugs.webkit.org/show_bug.cgi?id=100756
-
-        Reviewed by Simon Hausmann.
-
-        * DerivedSources.pri: Generate sources to the generated directory.
-        * disassembler/udis86/differences.txt:
-        * disassembler/udis86/itab.py: Add --outputDir option.
-        (UdItabGenerator.__init__):
-        (genItabH):
-        (genItabC):
-        (main):
-
-2012-11-02  Filip Pizlo  <[e-mail]>
-
-        LLInt 32-bit put_by_val ArrayStorage case should use the right register (t3, not t2) for the index in the publicLength updating path
-        https://bugs.webkit.org/show_bug.cgi?id=101118
-
-        Reviewed by Gavin Barraclough.
-
-        * llint/LowLevelInterpreter32_64.asm:
-
-2012-11-02  Filip Pizlo  <[e-mail]>
-
-        DFG::Node::converToStructureTransitionWatchpoint should take kindly to ArrayifyToStructure
-        https://bugs.webkit.org/show_bug.cgi?id=101117
-
-        Reviewed by Gavin Barraclough.
-
-        We have logic to convert ArrayifyToStructure to StructureTransitionWatchpoint, which is awesome, except
-        that previously convertToStructureTransitionWatchpoint was (a) asserting that it never saw an
-        ArrayifyToStructure and (b) would incorrectly create a ForwardStructureTransitionWatchpoint if it did.
-
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
-
-2012-11-02  Filip Pizlo  <[e-mail]>
-
-        DFG::SpeculativeJIT::typedArrayDescriptor should use the Float64Array descriptor for Float64Arrays
-        https://bugs.webkit.org/show_bug.cgi?id=101114
-
-        Reviewed by Gavin Barraclough.
-
-        As in https://bugs.webkit.org/show_bug.cgi?id=101112, this was only wrong when Float64Array descriptors
-        hadn't been initialized yet. That happens rarely, but when it does happen, we would crash.
-        
-        This would also become much more wrong if we ever put type size info (num bytes, etc) in the descriptor
-        and used that directly. So it's good to fix it.
-
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
-
-2012-11-02  Filip Pizlo  <[e-mail]>
-
-        JIT::privateCompileGetByVal should use the uint8ClampedArrayDescriptor for compiling accesses to Uint8ClampedArrays
-        https://bugs.webkit.org/show_bug.cgi?id=101112
-
-        Reviewed by Gavin Barraclough.
-
-        The only reason why the code was wrong to use uint8ArrayDescriptor instead is that if we're just using
-        Uint8ClampedArrays then the descriptor for Uint8Array may not have been initialized.
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompileGetByVal):
-
-2012-11-02  Mark Hahnenberg  <[e-mail]>
-
-        MarkedBlocks should use something other than the mark bits to indicate liveness for newly allocated objects
-        https://bugs.webkit.org/show_bug.cgi?id=100877
-
-        Reviewed by Filip Pizlo.
-
-        Currently when we canonicalize cell liveness data in MarkedBlocks, we set the mark bit for every cell in the 
-        block except for those in the free list. This allows us to consider objects that were allocated since the 
-        previous collection to be considered live until they have a chance to be properly marked by the collector.
-
-        If we want to use the mark bits to signify other types of information, e.g. using sticky mark bits for generational 
-        collection, we will have to keep track of newly allocated objects in a different fashion when we canonicalize cell liveness.
-
-        One method would be to allocate a separate set of bits while canonicalizing liveness data. These bits would 
-        track the newly allocated objects in the block separately from those objects who had already been marked. We would 
-        then check these bits, along with the mark bits, when determining liveness. 
-
-        * heap/Heap.h:
-        (Heap):
-        (JSC::Heap::isLive): We now check for the presence of the newlyAllocated Bitmap.
-        (JSC):
-        * heap/MarkedBlock.cpp:
-        (JSC::MarkedBlock::specializedSweep): We clear the newlyAllocated Bitmap if we're creating a free list. This 
-        will happen if we canonicalize liveness data for some other reason than collection (e.g. forEachCell) and 
-        then start allocating again.
-        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): 
-        (SetNewlyAllocatedFunctor):
-        (JSC::SetNewlyAllocatedFunctor::operator()): We set the newlyAllocated bits for all the objects 
-        that aren't already marked. We undo the bits for the objects in the free list later in canonicalizeCellLivenessData.
-        (JSC::MarkedBlock::canonicalizeCellLivenessData): We should never have a FreeListed block with a newlyAllocated Bitmap.
-        We allocate the new Bitmap, set the bits for all the objects that aren't already marked, and then unset all of the 
-        bits for the items currently in the FreeList.
-        * heap/MarkedBlock.h:
-        (JSC::MarkedBlock::clearMarks): We clear the newlyAllocated bitmap if it exists because at this point we don't need it
-        any more.
-        (JSC::MarkedBlock::isEmpty): If we have some objects that are newlyAllocated, we are not empty.
-        (JSC::MarkedBlock::isNewlyAllocated): 
-        (JSC):
-        (JSC::MarkedBlock::setNewlyAllocated):
-        (JSC::MarkedBlock::clearNewlyAllocated):
-        (JSC::MarkedBlock::isLive): We now check the newlyAllocated Bitmap, if it exists, when determining liveness of a cell in 
-        a block that is Marked.
-        * heap/WeakBlock.cpp:
-        (JSC::WeakBlock::visit): We need to make sure we don't finalize objects that are in the newlyAllocated Bitmap.
-        (JSC::WeakBlock::reap): Ditto.
-
-2012-11-02  Filip Pizlo  <[e-mail]>
-
-        JIT::privateCompileGetByVal should use MacroAssemblerCodePtr::createFromExecutableAddress like JIT::privateCompilePutByVal
-        https://bugs.webkit.org/show_bug.cgi?id=101109
-
-        Reviewed by Gavin Barraclough.
-
-        This fixes crashes on ARMv7 resulting from the return address already being tagged with the THUMB2 bit.
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompileGetByVal):
-
-2012-11-02  Simon Fraser  <[e-mail]>
-
-        Enable SUBPIXEL_LAYOUT on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=101076
-
-        Reviewed by Dave Hyatt.
-
-        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-02  Michael Saboff  <[e-mail]>
-
-        RegExp.prototype.toString Should Produce an 8 bit JSString if possible.
-        https://bugs.webkit.org/show_bug.cgi?id=101003
-
-        Reviewed by Geoffrey Garen.
-
-        Took the logic of regExpObjectSource() and created two templated helpers that uses the
-        source character type when appending to the StringBuilder.
-
-        * runtime/RegExpObject.cpp:
-        (JSC::appendLineTerminatorEscape): Checks line terminate type to come up with escaped version.
-        (JSC::regExpObjectSourceInternal): Templated version of original.
-        (JSC::regExpObjectSource): Wrapper function.
-
-2012-11-02  Adam Barth  <[e-mail]>
-
-        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
-        https://bugs.webkit.org/show_bug.cgi?id=100711
-
-        Reviewed by Eric Seidel.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-11-02  Simon Hausmann  <[e-mail]>
-
-        [Qt] Fix build on Windows when Qt is configured with -release
-        https://bugs.webkit.org/show_bug.cgi?id=101041
-
-        Reviewed by Jocelyn Turcotte.
-
-        When Qt is configured with -debug or -release, the release/debug build of for example
-        QtCore is not available by default. For LLIntExtractor we always need to build debug
-        _and_ release versions, but we do not actually need any Qt libraries nor qtmain(d).lib.
-        Therefore we can disable all these features but need to keep $$QT.core.includes in the
-        INCLUDEPATH for some defines from qglobal.h.
-
-        * LLIntOffsetsExtractor.pro:
-
-2012-11-01  Mark Lam  <[e-mail]>
-
-        A llint workaround for a toolchain issue.
-        https://bugs.webkit.org/show_bug.cgi?id=101012.
-
-        Reviewed by Michael Saboff.
-
-        * llint/LowLevelInterpreter.asm:
-          - use a local label to workaround the toolchain issue with undeclared
-            global labels.
-
-2012-11-01  Oliver Hunt  <[e-mail]>
-
-        Remove GlobalObject constant register that is typically unused
-        https://bugs.webkit.org/show_bug.cgi?id=101005
-
-        Reviewed by Geoffrey Garen.
-
-        The GlobalObject constant register is frequently allocated even when it
-        is not used, it is also getting in the way of some other optimisations.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        * bytecode/CodeBlock.h:
-        (CodeBlock):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseResolveOperations):
-
-2012-10-31  Filip Pizlo  <[e-mail]>
-
-        DFG optimized string access code should be enabled
-        https://bugs.webkit.org/show_bug.cgi?id=100825
-
-        Reviewed by Oliver Hunt.
-
-        - Removes prediction checks from the parser.
-        
-        - Fixes the handling of array mode refinement for strings. I.e. we don't do
-          any refinement - we already know it's going to be a string. We could
-          revisit this in the future, but for now the DFG lacks the ability to
-          handle any array modes other than Array::String for string intrinsics, so
-          this is as good as it gets.
-        
-        - Removes uses of isBlahSpeculation for checking if a mode is already
-          checked. isBlahSpeculation implicitly checks if the SpeculatedType is not
-          BOTTOM ("empty"), which breaks for checking if a mode is already checked
-          since a mode may already be "checked" in the sense that we've proven that
-          the code is unreachable.
-        
-        ~1% speed-up on V8v7, mostly from a speed-up on crypto, which uses string
-        intrinsics in one of the hot functions.
-
-        * bytecode/SpeculatedType.h:
-        (JSC::speculationChecked):
-        (JSC):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::ArrayMode::alreadyChecked):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::handleIntrinsic):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
-
-2012-10-31  Filip Pizlo  <[e-mail]>
-
-        Sparse array size threshold should be increased to 100000
-        https://bugs.webkit.org/show_bug.cgi?id=100827
-
-        Reviewed by Oliver Hunt.
-
-        This enables the use of contiguous arrays in programs that previously
-        couldn't use them. And I so far can't see any examples of this being
-        a downside. To the extent that there is a downside, it ought to be
-        addressed by GC: https://bugs.webkit.org/show_bug.cgi?id=100828
-
-        * runtime/ArrayConventions.h:
-        (JSC):
-
-2012-10-31  Mark Lam  <[e-mail]>
-
-        C++ llint 64-bit backend needs to zero extend results of int32 operations.
-        https://bugs.webkit.org/show_bug.cgi?id=100899.
-
-        Reviewed by Filip Pizlo.
-
-        llint asm instructions ending in "i" for a 64-bit machine expects the
-        high 32-bit of registers to be zero'ed out when a 32-bit instruction
-        writes into a register. Fixed the C++ llint to honor this.
-
-        Fixed the index register used in BaseIndex addressing to be of size
-        intptr_t as expected.
-
-        Updated CLoopRegister to handle different endiannesss configurations.
-
-        * llint/LowLevelInterpreter.cpp:
-        (JSC::CLoopRegister::clearHighWord):
-          - new method to clear the high 32-bit of a 64-bit register.
-            It's a no-op for the 32-bit build. 
-        (CLoopRegister):
-          - CLoopRegister now takes care of packing and byte endianness order.
-        (JSC::CLoop::execute): - Added an assert.
-        * offlineasm/cloop.rb:
-          - Add calls to clearHighWord() wherever needed.
-
-2012-10-31  Mark Lam  <[e-mail]>
-
-        A JSC printf (support for %J+s and %b).
-        https://bugs.webkit.org/show_bug.cgi?id=100566.
-
-        Reviewed by Michael Saboff.
-
-        Added VMInspector::printf(), fprintf(), sprintf(), and snprintf().
-        - %b prints ints as boolean TRUE (non-zero) or FALSE (zero).
-        - %Js prints a WTF::String* like a %s prints a char*.
-          Also works for 16bit WTF::Strings (prints wchar_t* using %S).
-        - '+' is a modifier meaning 'use verbose mode', and %J+s is an example
-          of its use.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * interpreter/VMInspector.cpp:
-        (FormatPrinter):
-        (JSC::FormatPrinter::~FormatPrinter):
-        (JSC::FormatPrinter::print):
-        (JSC::FormatPrinter::printArg):
-        (JSC::FormatPrinter::printWTFString):
-        (JSC::FileFormatPrinter::FileFormatPrinter):
-        (JSC::FileFormatPrinter::printArg):
-        (JSC::StringFormatPrinter::StringFormatPrinter):
-        (JSC::StringFormatPrinter::printArg):
-        (JSC::StringNFormatPrinter::StringNFormatPrinter):
-        (JSC::StringNFormatPrinter::printArg):
-        (JSC::VMInspector::fprintf):
-        (JSC::VMInspector::printf):
-        (JSC::VMInspector::sprintf):
-        (JSC::VMInspector::snprintf):
-        * interpreter/VMInspector.h:
-        (VMInspector):
-
-2012-10-31  Mark Lam  <[e-mail]>
-
-        64-bit llint PC offset can be negative: using an unsigned shift is a bug.
-        https://bugs.webkit.org/show_bug.cgi?id=100896.
-
-        Reviewed by Filip Pizlo.
-
-        Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
-
-        * llint/LowLevelInterpreter64.asm:
-
-2012-10-30  Yuqiang Xian  <[e-mail]>
-
-        glsl-function-atan.html WebGL conformance test fails after https://bugs.webkit.org/show_bug.cgi?id=99154
-        https://bugs.webkit.org/show_bug.cgi?id=100789
-
-        Reviewed by Filip Pizlo.
-
-        We accidently missed a bitwise double to int64 conversion.
-
-        * dfg/DFGSpeculativeJIT.h:
-        (JSC::DFG::SpeculativeJIT::silentFill):
-
-2012-10-30  Joseph Pecoraro  <[e-mail]>
-
-        [Mac] Sync up FeatureDefine Configuration Files
-        https://bugs.webkit.org/show_bug.cgi?id=100171
-
-        Reviewed by David Kilzer.
-
-        Follow up to better coordinate with iOS feature defines. Make:
-
-          - ENABLE_FILTERS always on
-          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-30  Joseph Pecoraro  <[e-mail]>
-
-        [Mac] Sync up FeatureDefine Configuration Files
-        https://bugs.webkit.org/show_bug.cgi?id=100171
-
-        Reviewed by David Kilzer.
-
-        Ensure an identical FeatureDefine files across all projects. Changes:
-
-          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
-          - ENABLE_PDFKIT_PLUGIN should be in all
-          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
-          - ENABLE_ENCRYPTED_MEDIA should be in all
-          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
-          - Some alphabetical ordering cleanup
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-30  Mark Hahnenberg  <[e-mail]>
-
-        Arrays can change IndexingType in the middle of sorting
-        https://bugs.webkit.org/show_bug.cgi?id=100773
-
-        Reviewed by Filip Pizlo.
-
-        Instead of giving up, we just fetch the appropriate vector based on the current 
-        IndexingType of the array.
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sortVector):
-        * runtime/JSObject.h:
-        (JSObject):
-        (JSC::JSObject::currentIndexingData):
-        (JSC::JSObject::currentRelevantLength):
-
-2012-10-29  Anders Carlsson  <[e-mail]>
-
-        Build WebKit as C++11 on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=100720
-
-        Reviewed by Daniel Bates.
-
-        * Configurations/Base.xcconfig:
-        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::pushFinallyContext):
-        (JSC::BytecodeGenerator::beginSwitch):
-        * llint/LLIntOffsetsExtractor.cpp:
-        * runtime/Identifier.cpp:
-        (JSC::Identifier::add8):
-        * runtime/Identifier.h:
-        (JSC::Identifier::add):
-        * runtime/JSONObject.cpp:
-        (JSC::appendStringToStringBuilder):
-        * runtime/StringPrototype.cpp:
-        (JSC::replaceUsingStringSearch):
-        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
-
-2012-10-28  Mark Rowe  <[e-mail]>
-
-        Simplify Xcode configuration settings that used to vary between OS versions.
-
-        Reviewed by Dan Bernstein.
-
-        * Configurations/Base.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
-        * Configurations/JavaScriptCore.xcconfig:
-
-2012-10-28  Mark Rowe  <[e-mail]>
-
-        Remove references to unsupported OS and Xcode versions.
-
-        Reviewed by Anders Carlsson.
-
-        * Configurations/Base.xcconfig:
-        * Configurations/CompilerVersion.xcconfig: Removed.
-        * Configurations/DebugRelease.xcconfig:
-        * Configurations/Version.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2012-10-29  Michael Saboff  <[e-mail]>
-
-        Non-special escape character sequences cause JSC::Lexer::parseString to create 16 bit strings
-        https://bugs.webkit.org/show_bug.cgi?id=100576
-
-        Reviewed by Darin Adler.
-
-        Changed singleEscape() processing to be based on a lookup of a static table.  The table
-        covers ASCII characters SPACE through DEL.  If a character can be a single character escape,
-        then the table provides the non-zero result of that escape.  Updated the result of
-        singleEscape to be an LChar to make the table as small as possible.
-        Added a new test fast/js/normal-character-escapes-in-string-literals.html to validated
-        the behavior.
-
-        * parser/Lexer.cpp:
-        (JSC::singleEscape):
-        (JSC::Lexer::parseString):
-        (JSC::Lexer::parseStringSlowCase):
-
-2012-10-29  Enrica Casucci  <[e-mail]>
-
-        Add ENABLE_USERSELECT_ALL feature flag.
-        https://bugs.webkit.org/show_bug.cgi?id=100559
-
-        Reviewed by Eric Seidel.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-28  Filip Pizlo  <[e-mail]>
-
-        DFG should be able to emit effectful structure checks
-        https://bugs.webkit.org/show_bug.cgi?id=99260
-
-        Reviewed by Oliver Hunt.
-
-        This change allows us to find out if an array access that has gone polymorphic
-        is operating over known structures - i.e. the primordial array structures of the
-        global object that the code block containing the array access belongs to. We
-        term this state "OriginalArray" for short. The fact that the access has gone
-        polymorphic means that the array profile will not be able to report the set of
-        structures it had seen - but if it can tell us that all of the structures were
-        primordial then it just so happens that we can deduce what the structure set
-        would have been by just querying the code block's global object. This allows us
-        to emit an ArrayifyToStructure instead of an Arrayify if we find that we need to
-        do conversions. The fast path of an ArrayifyToStructure is exactly like the fast
-        path of a CheckStructure and is mostly subject to the same optimizations. It
-        also burns one fewer registers.
-        
-        Essentially the notion of OriginalArray is a super cheap way of getting the
-        array profile to tell us a structure set instead of a singleton structure.
-        Currently, the array profile can only tell us the structure seen at an array
-        access if there was exactly one structure. If there were multiple structures, it
-        won't tell us anything other than the array modes and other auxiliary profiling
-        data (whether there were stores to holes, for example). With OriginalArray, we
-        cheaply get a structure set if all of the structures were primordial for the
-        code block's global object, since in that case the array mode set (ArrayModes)
-        can directly tell us the structure set. In the future, we might consider adding
-        complete structure sets to the array profiles, but I suspect that we would hit
-        diminishing returns if we did so - it would only help if we have array accesses
-        that are both polymorphic and are cross-global-object accesses (rare) or if the
-        arrays had named properties or other structure transitions that are unrelated to
-        indexing type (also rare).
-        
-        This also does away with Arrayify (and the new ArrayifyToStructure) returning
-        the butterfly pointer. This turns out to be faster and easier to CSE.
-        
-        And, this also changes constant folding to be able to eliminate CheckStructure,
-        ForwardCheckStructure, and ArrayifyToStructure in addition to being able to
-        transform them into structure transition watchpoints. This is great for
-        ArrayifyToStructure because then CSE and CFA know that there is no side effect.
-        Converting CheckStructure and ForwardCheckStructure to also behave this way is
-        just a matter of elegance.
-        
-        This has no performance impact right now. It's intended to alleviate some of the
-        regressions seen in the early implementation of
-        https://bugs.webkit.org/show_bug.cgi?id=98606.
-
-        * bytecode/ArrayProfile.cpp:
-        (JSC::ArrayProfile::computeUpdatedPrediction):
-        * bytecode/ArrayProfile.h:
-        (JSC):
-        (JSC::ArrayProfile::ArrayProfile):
-        (ArrayProfile):
-        (JSC::ArrayProfile::usesOriginalArrayStructures):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::ArrayMode::fromObserved):
-        (JSC::DFG::ArrayMode::alreadyChecked):
-        (JSC::DFG::arrayClassToString):
-        * dfg/DFGArrayMode.h:
-        (JSC::DFG::ArrayMode::withProfile):
-        (JSC::DFG::ArrayMode::isJSArray):
-        (ArrayMode):
-        (JSC::DFG::ArrayMode::isJSArrayWithOriginalStructure):
-        (JSC::DFG::ArrayMode::supportsLength):
-        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::getArrayMode):
-        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
-        (JSC::DFG::ByteCodeParser::handleGetByOffset):
-        * dfg/DFGCSEPhase.cpp:
-        (JSC::DFG::CSEPhase::checkStructureElimination):
-        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
-        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
-        (JSC::DFG::CSEPhase::checkArrayElimination):
-        (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        (JSC::DFG::FixupPhase::checkArray):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::hasStructure):
-        (JSC::DFG::Node::hasArrayMode):
-        (JSC::DFG::Node::arrayMode):
-        * dfg/DFGNodeType.h:
-        (DFG):
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
-        (JSC::DFG::SpeculativeJIT::arrayify):
-        * dfg/DFGSpeculativeJIT.h:
-        (SpeculativeJIT):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::isOriginalArrayStructure):
-        * runtime/Structure.cpp:
-        (JSC::Structure::nonPropertyTransition):
-
-2012-10-28  Filip Pizlo  <[e-mail]>
-
-        There should not be blind spots in array length array profiling
-        https://bugs.webkit.org/show_bug.cgi?id=100620
-
-        Reviewed by Oliver Hunt.
-
-        I don't think this has any performance impact. But it's good to not have random
-        programs occasionally emit a GetById for array length accesses.
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-
-2012-10-28  Filip Pizlo  <[e-mail]>
-
-        Unreviewed, make always-true enum-to-int comparisons use casts.
-
-        * dfg/DFGFPRInfo.h:
-        (JSC::DFG::FPRInfo::debugName):
-        * dfg/DFGGPRInfo.h:
-        (JSC::DFG::JSValueSource::tagGPR):
-        (JSC::DFG::GPRInfo::toIndex):
-        (JSC::DFG::GPRInfo::debugName):
-        * runtime/JSTypeInfo.h:
-        (JSC::TypeInfo::TypeInfo):
-
-2012-10-27  Filip Pizlo  <[e-mail]>
-
-        OSR exit compilation should defend against argument recoveries from code blocks that are no longer on the inline stack
-        https://bugs.webkit.org/show_bug.cgi?id=100601
-
-        Reviewed by Oliver Hunt.
-
-        This happened to me while I was fixing bugs for https://bugs.webkit.org/show_bug.cgi?id=100599.
-        I'm not sure how to reproduce this.
-
-        * dfg/DFGAssemblyHelpers.h:
-        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
-        (AssemblyHelpers):
-        * dfg/DFGOSRExitCompiler32_64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-        * dfg/DFGOSRExitCompiler64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-
-2012-10-27  Filip Pizlo  <[e-mail]>
-
-        DFG::Array::Mode needs to be cleaned up
-        https://bugs.webkit.org/show_bug.cgi?id=100599
-
-        Reviewed by Oliver Hunt.
-
-        Turn the previous massive Array::Mode enum into a class that contains four
-        fields, the type, whether it's a JSArray, the level of speculation, and the
-        kind of conversion to perform.
-        
-        No performance or behavioral change.
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArgumentsSimplificationPhase.cpp:
-        (JSC::DFG::ArgumentsSimplificationPhase::run):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::ArrayMode::fromObserved):
-        (JSC::DFG::ArrayMode::refine):
-        (JSC::DFG::ArrayMode::alreadyChecked):
-        (JSC::DFG::arrayTypeToString):
-        (JSC::DFG::arrayClassToString):
-        (DFG):
-        (JSC::DFG::arraySpeculationToString):
-        (JSC::DFG::arrayConversionToString):
-        (JSC::DFG::ArrayMode::toString):
-        * dfg/DFGArrayMode.h:
-        (DFG):
-        (ArrayMode):
-        (JSC::DFG::ArrayMode::ArrayMode):
-        (JSC::DFG::ArrayMode::type):
-        (JSC::DFG::ArrayMode::arrayClass):
-        (JSC::DFG::ArrayMode::speculation):
-        (JSC::DFG::ArrayMode::conversion):
-        (JSC::DFG::ArrayMode::asWord):
-        (JSC::DFG::ArrayMode::fromWord):
-        (JSC::DFG::ArrayMode::withSpeculation):
-        (JSC::DFG::ArrayMode::usesButterfly):
-        (JSC::DFG::ArrayMode::isJSArray):
-        (JSC::DFG::ArrayMode::isInBounds):
-        (JSC::DFG::ArrayMode::mayStoreToHole):
-        (JSC::DFG::ArrayMode::isOutOfBounds):
-        (JSC::DFG::ArrayMode::isSlowPut):
-        (JSC::DFG::ArrayMode::canCSEStorage):
-        (JSC::DFG::ArrayMode::lengthNeedsStorage):
-        (JSC::DFG::ArrayMode::modeForPut):
-        (JSC::DFG::ArrayMode::isSpecific):
-        (JSC::DFG::ArrayMode::supportsLength):
-        (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
-        (JSC::DFG::ArrayMode::doesConversion):
-        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
-        (JSC::DFG::ArrayMode::operator==):
-        (JSC::DFG::ArrayMode::operator!=):
-        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
-        (JSC::DFG::canCSEStorage):
-        (JSC::DFG::lengthNeedsStorage):
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::getArrayMode):
-        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
-        (JSC::DFG::ByteCodeParser::handleIntrinsic):
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGCSEPhase.cpp:
-        (JSC::DFG::CSEPhase::getArrayLengthElimination):
-        (JSC::DFG::CSEPhase::checkArrayElimination):
-        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
-        (JSC::DFG::CSEPhase::performNodeCSE):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        (JSC::DFG::FixupPhase::checkArray):
-        (JSC::DFG::FixupPhase::blessArrayOperation):
-        * dfg/DFGGraph.cpp:
-        (JSC::DFG::Graph::dump):
-        * dfg/DFGGraph.h:
-        (JSC::DFG::Graph::byValIsPure):
-        * dfg/DFGNode.h:
-        (JSC::DFG::Node::arrayMode):
-        (JSC::DFG::Node::setArrayMode):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
-        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
-        (JSC::DFG::SpeculativeJIT::checkArray):
-        (JSC::DFG::SpeculativeJIT::arrayify):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
-        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
-        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
-        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
-        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
-        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
-        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
-        * dfg/DFGSpeculativeJIT.h:
-        (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
-        (SpeculativeJIT):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-
-2012-10-27  Dan Bernstein  <[e-mail]>
-
-        REAL_PLATFORM_NAME build setting is no longer needed
-        https://bugs.webkit.org/show_bug.cgi?id=100587
-
-        Reviewed by Mark Rowe.
-
-        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
-        to PLATFORM_NAME.
-
-        * Configurations/Base.xcconfig:
-        * Configurations/CompilerVersion.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
-        * Configurations/FeatureDefines.xcconfig:
-        * Configurations/JSC.xcconfig:
-        * Configurations/JavaScriptCore.xcconfig:
-        * Configurations/ToolExecutable.xcconfig:
-
-2012-10-25  Filip Pizlo  <[e-mail]>
-
-        Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
-        https://bugs.webkit.org/show_bug.cgi?id=100461
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        This does a couple of things. First, it removes the part of the change in r131822 that made the forward
-        OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
-        blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
-        there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
-        recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
-        op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
-        set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
-        any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
-        SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
-        mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
-        a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
-        forward exit while also ensuring that prior to exiting we set the appropriate locals.
-
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGOSRExit.cpp:
-        (JSC::DFG::OSRExit::OSRExit):
-        * dfg/DFGOSRExit.h:
-        (OSRExit):
-        * dfg/DFGOSRExitCompiler.cpp:
-        * dfg/DFGOSRExitCompiler32_64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-        * dfg/DFGOSRExitCompiler64.cpp:
-        (JSC::DFG::OSRExitCompiler::compileExit):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
-
-2012-10-26  Simon Hausmann  <[e-mail]>
-
-        [Qt] Fix the LLInt build on Windows
-        https://bugs.webkit.org/show_bug.cgi?id=97648
-
-        Reviewed by Tor Arne Vestbø.
-
-        The main change for the port on Windows is changing the way offsets are extracted
-        and the LLIntAssembly.h is generated to accomodate release and debug configurations.
-
-        Firstly the LLIntOffsetsExtractor binary is now built as-is (no DESTDIR set) and
-        placed into debug\LLIntOffsetsExtractor.exe and release\LLIntOffsetsExtractor.exe
-        on Windows debug_and_release builds. On other patforms it remainds in the regular
-        out directory.
-
-        Secondly the LLIntAssembly.h files must be different for different build types,
-        so the LLIntAssembly.h generator in DerivedSources.pri operates no on the extractor
-        binary files as input. Using a simple exists() check we verify the presence of either
-        a regular, a debug\LLIntOffsetsExtractor and a release\LLIntOffsetsExtractor binary
-        and process all of them. The resulting assembly files consequently end up in
-        generated\debug\LLIntAssembly.h and generated\release\LLIntAssembly.h.
-
-        In Target.pri we have to also make sure that those directories are in the include
-        path according to the release or debug configuration.
-
-        Lastly a small tweak - swapping WTF.pri and JSC.pri inclusions - in the
-        LLIntOffsetsExtractor build was needed to make sure that we include
-        JavaScriptCore/config.h instead of WTF/config.h, required to fix the
-        build issues originally pasted in bug #97648.
-
-        * DerivedSources.pri:
-        * JavaScriptCore.pro:
-        * LLIntOffsetsExtractor.pro:
-        * Target.pri:
-
-2012-10-26  Gabor Ballabas  <[e-mail]>
-
-        [Qt] Enable JSC's disassembler on x86, x86_64 Linux
-        https://bugs.webkit.org/show_bug.cgi?id=100386
-
-        Reviewed by Simon Hausmann.
-
-        It works fine on Linux x86, x86_64 just needs to be enabled in the
-        QtWebKit build system.
-
-        * DerivedSources.pri:
-        * JavaScriptCore.pri:
-        * Target.pri:
-
-2012-10-26  Thiago Marcos P. Santos  <[e-mail]>
-
-        Add feature flags for CSS Device Adaptation
-        https://bugs.webkit.org/show_bug.cgi?id=95960
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-26  Simon Hausmann  <[e-mail]>
-
-        [WIN] Make LLInt offsets extractor work on Windows
-        https://bugs.webkit.org/show_bug.cgi?id=100369
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Open the input file explicitly in binary mode to prevent ruby/Windows from thinking that
-        it's a text mode file that needs even new line conversions. The binary mode parameter is
-        ignored on other platforms.
-
-        * offlineasm/offsets.rb:
-
-2012-10-25  Michael Saboff  <[e-mail]>
-
-        SymbolTableIndexHashTraits::needsDestruction should be set to true
-        https://bugs.webkit.org/show_bug.cgi?id=100437
-
-        Reviewed by Mark Hahnenberg.
-
-        For correctness, set SymbolTableIndexHashTraits::needsDestruction to true since SymbolTableEntry's do
-        need to have their destructor called due to the possibility of rare data.
-
-        * runtime/SymbolTable.h:
-        (SymbolTableIndexHashTraits):
-
-2012-10-25  Filip Pizlo  <[e-mail]>
-
-        DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
-        https://bugs.webkit.org/show_bug.cgi?id=100441
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        Made array profiler's to-string helper behave correctly.
-        
-        Made Arrayify elimination do the right thing (convert to GetButterfly).
-        
-        Made CFA's interference analysis track clobbered array modes correctly, mostly by
-        simplifying the machinery.
-
-        * bytecode/ArrayProfile.cpp:
-        (JSC::arrayModesToString):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::clobberArrayModes):
-        (AbstractValue):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-
-2012-10-25  Filip Pizlo  <[e-mail]>
-
-        REGRESSION (r131793-r131826): Crash going to wikifonia.org
-        https://bugs.webkit.org/show_bug.cgi?id=100281
-
-        Reviewed by Oliver Hunt.
-
-        Restore something that got lost in the resolve refactoring: the ability to give up on life if
-        we see a resolve of 'arguments'.
-
-        * runtime/JSScope.cpp:
-        (JSC::JSScope::resolveContainingScopeInternal):
-
-2012-10-25  Dominik Röttsches  <[e-mail]>
-
-        Conditionalize XHR timeout support
-        https://bugs.webkit.org/show_bug.cgi?id=100356
-
-        Reviewed by Adam Barth.
-
-        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-25  Michael Saboff  <[e-mail]>
-
-        REGRESSION (r131836): failures in list styles tests on EFL, GTK
-        https://bugs.webkit.org/show_bug.cgi?id=99824
-
-        Reviewed by Oliver Hunt.
-
-        Saved start of string since it is modified by call convertUTF8ToUTF16().
-
-        * API/JSStringRef.cpp:
-        (JSStringCreateWithUTF8CString):
-
-2012-10-24  Filip Pizlo  <[e-mail]>
-
-        DFG NewArrayBuffer node should keep its data in a structure on the side to free up one of the opInfos
-        https://bugs.webkit.org/show_bug.cgi?id=100328
-
-        Reviewed by Oliver Hunt.
-
-        * dfg/DFGByteCodeParser.cpp:
-        (JSC::DFG::ByteCodeParser::parseBlock):
-        * dfg/DFGGraph.h:
-        (Graph):
-        * dfg/DFGNode.h:
-        (NewArrayBufferData):
-        (DFG):
-        (JSC::DFG::Node::newArrayBufferData):
-        (Node):
-        (JSC::DFG::Node::startConstant):
-        (JSC::DFG::Node::numConstants):
-
-2012-10-25  Mark Lam  <[e-mail]>
-
-        Update the C++ llint to work with the latest op_resolve... changes.
-        https://bugs.webkit.org/show_bug.cgi?id=100345.
-
-        Reviewed by Oliver Hunt.
-
-        * llint/LowLevelInterpreter.cpp:
-        (JSC::CLoop::execute):
-        - emit opcode name as label when not using COMPUTED_GOTOs. The new op_resolve
-          opcodes have jumps to these labels.
-        - declare all opcode labels as UNUSED_LABEL()s to keep the compiler happy
-          for opcodes that are not referenced by anyone.
-        * offlineasm/asm.rb:
-        - strip llint_ prefix from opcode names used as labels.
-
-2012-10-24  Yuqiang Xian  <[e-mail]>
-
-        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
-        https://bugs.webkit.org/show_bug.cgi?id=100321
-
-        Reviewed by Filip Pizlo.
-
-        We have refactored the MacroAssembler and JIT compilers to distinguish
-        the pointer operations from the 64-bit integer operations (see bug #99154).
-        Now we want to do the similar work for LLInt, and the goal is same as
-        the one mentioned in 99154.
-
-        This is the first part of the modification: in the offline assembler,
-        adding the support of the "<foo>q" instructions which will be used for
-        64-bit integer operations.
-
-        * llint/LowLevelInterpreter.cpp:
-        (JSC::CLoop::execute):
-        * offlineasm/cloop.rb:
-        * offlineasm/instructions.rb:
-        * offlineasm/x86.rb:
-
-2012-10-24  Filip Pizlo  <[e-mail]>
-
-        DFG compileBlahBlahByVal methods for Contiguous and ArrayStorage have only one caller and should be removed
-        https://bugs.webkit.org/show_bug.cgi?id=100311
-
-        Reviewed by Mark Hahnenberg.
-
-        Just trying to simplify things before I make them more complicated again.
-
-        * dfg/DFGSpeculativeJIT.h:
-        (SpeculativeJIT):
-        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (DFG):
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (DFG):
-        (JSC::DFG::SpeculativeJIT::compile):
-
-2012-10-23  Andreas Kling  <[e-mail]>
-
-        CodeBlock: Give m_putToBaseOperations an inline capacity.
-        <http://webkit.org/b/100190>
-        <rdar://problem/12562466>
-
-        Reviewed by Oliver Hunt.
-
-        Since the CodeBlock constructor always inserts a single PutToBaseOperation, but there's no
-        guarantee that more will follow, give the m_putToBaseOperations vector an inline capacity of 1.
-        There are 4009 of these Vectors on Membuster3, and only 126 of them have more than a single entry.
-
-        This change yields a 1.90MB reduction in memory usage.
-
-        * bytecode/CodeBlock.h:
-        (CodeBlock):
-
-2012-10-23  Christophe Dumez  <[e-mail]>
-
-        Regression(r132143): Assertion hit in JSC::Interpreter::StackPolicy::StackPolicy(JSC::Interpreter&, const WTF::StackBounds&)
-        https://bugs.webkit.org/show_bug.cgi?id=100109
-
-        Reviewed by Oliver Hunt.
-
-        Fix possible integer overflow in StackPolicy constructor by
-        using size_t type instead of int for stack sizes. The value
-        returned by StackBounds::size() is of type size_t but was
-        assigned to an int, which may overflow.
-
-        * interpreter/Interpreter.cpp:
-        (JSC):
-        (JSC::Interpreter::StackPolicy::StackPolicy):
-
-2012-10-23  Carlos Garcia Campos  <[e-mail]>
-
-        Unreviewed. Fix make distcheck.
-
-        * GNUmakefile.list.am: Add missing header file.
-
-2012-10-23  Mark Lam  <[e-mail]>
-
-        Make topCallFrame reliable.
-        https://bugs.webkit.org/show_bug.cgi?id=98928.
-
-        Reviewed by Geoffrey Garen.
-
-        - VM entry points and the GC now uses topCallFrame.
-        - The callerFrame value in CallFrames are now always the previous
-          frame on the stack, except for the first frame which has a
-          callerFrame of 0 (not counting the HostCallFrameFlag).
-          Hence, we can now traverse every frame on the stack all the way
-          back to the first frame.
-        - GlobalExec's will no longer be used as the callerFrame values in
-          call frames.
-        - Added fences and traps for debugging the JSStack in debug builds.
-
-        * bytecode/SamplingTool.h:
-        (SamplingTool):
-        (JSC::SamplingTool::CallRecord::CallRecord):
-        * dfg/DFGOperations.cpp:
-        - Fixed 2 DFG helper functions to flush topCallFrame as expected.
-        * dfg/DFGSpeculativeJIT.h:
-        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::callerFrameNoFlags):
-        (ExecState):
-        (JSC::ExecState::argIndexForRegister):
-        (JSC::ExecState::getArgumentUnsafe):
-        * interpreter/CallFrameClosure.h:
-        (CallFrameClosure):
-        * interpreter/Interpreter.cpp:
-        (JSC):
-        (JSC::eval):
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::endRepeatCall):
-        * interpreter/Interpreter.h:
-        (JSC):
-        (Interpreter):
-        * interpreter/JSStack.cpp:
-        (JSC::JSStack::JSStack):
-        (JSC::JSStack::gatherConservativeRoots):
-        (JSC::JSStack::disableErrorStackReserve):
-        * interpreter/JSStack.h:
-        (JSC):
-        (JSStack):
-        (JSC::JSStack::installFence):
-        (JSC::JSStack::validateFence):
-        (JSC::JSStack::installTrapsAfterFrame):
-        * interpreter/JSStackInlines.h: Added.
-        (JSC):
-        (JSC::JSStack::getTopOfFrame):
-        (JSC::JSStack::getTopOfStack):
-        (JSC::JSStack::getStartOfFrame):
-        (JSC::JSStack::pushFrame):
-        (JSC::JSStack::popFrame):
-        (JSC::JSStack::generateFenceValue):
-        (JSC::JSStack::installFence):
-        (JSC::JSStack::validateFence):
-        (JSC::JSStack::installTrapsAfterFrame):
-        * jit/JITStubs.cpp:
-        (JSC::jitCompileFor):
-        (JSC::lazyLinkFor):
-        - Set frame->codeBlock to 0 for both the above because they are called
-          with partially intitialized frames (cb uninitialized), but may
-          trigger a GC.
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-
-2012-10-22  Filip Pizlo  <[e-mail]>
-
-        DFG::Array::Undecided should be called DFG::Array::SelectUsingPredictions
-        https://bugs.webkit.org/show_bug.cgi?id=100052
-
-        Reviewed by Oliver Hunt.
-
-        No functional change, just renaming. It's a clearer name that more accurately
-        reflects the meaning, and it eliminates the namespace confusion that will happen
-        with the Undecided indexing type in https://bugs.webkit.org/show_bug.cgi?id=98606
-
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::fromObserved):
-        (JSC::DFG::refineArrayMode):
-        (JSC::DFG::modeAlreadyChecked):
-        (JSC::DFG::modeToString):
-        * dfg/DFGArrayMode.h:
-        (JSC::DFG::canCSEStorage):
-        (JSC::DFG::modeIsSpecific):
-        (JSC::DFG::modeSupportsLength):
-        (JSC::DFG::benefitsFromStructureCheck):
-        * dfg/DFGFixupPhase.cpp:
-        (JSC::DFG::FixupPhase::fixupNode):
-        (JSC::DFG::FixupPhase::blessArrayOperation):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::arrayify):
-        * dfg/DFGSpeculativeJIT32_64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-        * dfg/DFGSpeculativeJIT64.cpp:
-        (JSC::DFG::SpeculativeJIT::compile):
-
-2012-10-22  Mark Lam  <[e-mail]>
-
-        Change stack recursion checks to be based on stack availability.
-        https://bugs.webkit.org/show_bug.cgi?id=99872.
-
-        Reviewed by Filip Pizlo and Geoffrey Garen.
-
-        - Remove m_reentryDepth, ThreadStackType which are now obsolete.
-        - Replaced the reentryDepth checks with a StackBounds check.
-        - Added the Interpreter::StackPolicy class to compute a reasonable
-          stack capacity requirement given the native stack that the
-          interpreter is executing on at that time.
-        - Reserved an amount of JSStack space for the use of error handling
-          and enable its use (using Interpreter::ErrorHandlingMode) when
-          we're about to throw or report an exception.
-        - Interpreter::StackPolicy also allows more native stack space
-          to be used when in ErrorHandlingMode. This is needed in the case
-          of native stack overflows.
-        - Fixed the parser so that it throws a StackOverflowError instead of
-          a SyntaxError when it encounters a stack overflow.
-
-        * API/JSContextRef.cpp:
-        (JSContextGroupCreate):
-        (JSGlobalContextCreateInGroup):
-        * JavaScriptCore.order:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::ErrorHandlingMode::ErrorHandlingMode):
-        (JSC):
-        (JSC::Interpreter::ErrorHandlingMode::~ErrorHandlingMode):
-        (JSC::Interpreter::StackPolicy::StackPolicy):
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        * interpreter/Interpreter.h:
-        (JSC):
-        (Interpreter):
-        (ErrorHandlingMode):
-        (StackPolicy):
-        (JSC::Interpreter::StackPolicy::requiredCapacity):
-        * interpreter/JSStack.cpp:
-        (JSC):
-        (JSC::JSStack::JSStack):
-        (JSC::JSStack::growSlowCase):
-        (JSC::JSStack::enableErrorStackReserve):
-        (JSC::JSStack::disableErrorStackReserve):
-        * interpreter/JSStack.h:
-        (JSStack):
-        (JSC::JSStack::reservationEnd):
-        (JSC):
-        * jsc.cpp:
-        (jscmain):
-        * parser/Parser.cpp:
-        (JSC::::Parser):
-        * parser/Parser.h:
-        (Parser):
-        (JSC::::parse):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::throwStackOverflowError):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::createContextGroup):
-        (JSC::JSGlobalData::create):
-        (JSC::JSGlobalData::createLeaked):
-        (JSC::JSGlobalData::sharedInstance):
-        * runtime/JSGlobalData.h:
-        (JSC):
-        (JSGlobalData):
-        * runtime/StringRecursionChecker.h:
-        (JSC::StringRecursionChecker::performCheck):
-        * testRegExp.cpp:
-        (realMain):
-
-2012-10-20  Martin Robinson  <[e-mail]>
-
-        Fix 'make dist' for the GTK+ port
-
-        * GNUmakefile.list.am: Add missing files to the source list.
-
-2012-10-21  Raphael Kubo da Costa  <[e-mail]>
-
-        [CMake][JSC] Depend on risc.rb to decide when to run the LLInt scripts.
-        https://bugs.webkit.org/show_bug.cgi?id=99917
-
-        Reviewed by Geoffrey Garen.
-
-        Depend on the newly-added risc.rb to make sure we always run the
-        LLInt scripts when one of them changes.
-
-        * CMakeLists.txt:
-
-2012-10-20  Filip Pizlo  <[e-mail]>
-
-        LLInt backends of non-ARM RISC platforms should be able to share code with the existing ARMv7 backend
-        https://bugs.webkit.org/show_bug.cgi?id=99745
-
-        Reviewed by Geoffrey Garen.
-
-        This moves all of the things in armv7.rb that I thought are generally useful out
-        into risc.rb. It also separates some phases (branch ops is separated into one
-        phase that does sensible things, and another that does things that are painfully
-        ARM-specific), and removes ARM assumptions from others by using a callback to
-        drive exactly what lowering must happen. The goal here is to minimize the future
-        maintenance burden of LLInt by ensuring that the various platforms share as much
-        lowering code as possible.
-
-        * offlineasm/armv7.rb:
-        * offlineasm/risc.rb: Added.
-
-2012-10-19  Filip Pizlo  <[e-mail]>
-
-        DFG should have some facility for recognizing redundant CheckArrays and Arrayifies
-        https://bugs.webkit.org/show_bug.cgi?id=99287
-
-        Reviewed by Mark Hahnenberg.
-
-        Adds reasoning about indexing type sets (i.e. ArrayModes) to AbstractValue, which
-        then enables us to fold away CheckArray's and Arrayify's that are redundant.
-
-        * bytecode/ArrayProfile.cpp:
-        (JSC::arrayModesToString):
-        (JSC):
-        * bytecode/ArrayProfile.h:
-        (JSC):
-        (JSC::mergeArrayModes):
-        (JSC::arrayModesAlreadyChecked):
-        * bytecode/StructureSet.h:
-        (JSC::StructureSet::arrayModesFromStructures):
-        (StructureSet):
-        * dfg/DFGAbstractState.cpp:
-        (JSC::DFG::AbstractState::execute):
-        * dfg/DFGAbstractValue.h:
-        (JSC::DFG::AbstractValue::AbstractValue):
-        (JSC::DFG::AbstractValue::clear):
-        (JSC::DFG::AbstractValue::isClear):
-        (JSC::DFG::AbstractValue::makeTop):
-        (JSC::DFG::AbstractValue::clobberStructures):
-        (AbstractValue):
-        (JSC::DFG::AbstractValue::setMostSpecific):
-        (JSC::DFG::AbstractValue::set):
-        (JSC::DFG::AbstractValue::operator==):
-        (JSC::DFG::AbstractValue::merge):
-        (JSC::DFG::AbstractValue::filter):
-        (JSC::DFG::AbstractValue::filterArrayModes):
-        (JSC::DFG::AbstractValue::validate):
-        (JSC::DFG::AbstractValue::checkConsistency):
-        (JSC::DFG::AbstractValue::dump):
-        (JSC::DFG::AbstractValue::clobberArrayModes):
-        (JSC::DFG::AbstractValue::clobberArrayModesSlow):
-        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
-        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
-        * dfg/DFGArrayMode.cpp:
-        (JSC::DFG::modeAlreadyChecked):
-        * dfg/DFGArrayMode.h:
-        (JSC::DFG::arrayModesFor):
-        (DFG):
-        * dfg/DFGConstantFoldingPhase.cpp:
-        (JSC::DFG::ConstantFoldingPhase::foldConstants):
-        * dfg/DFGSpeculativeJIT.cpp:
-        (JSC::DFG::SpeculativeJIT::arrayify):
-
-2012-10-19  Filip Pizlo  <[e-mail]>
-
-        Baseline JIT should not inline array allocations, to make them easier to instrument
-        https://bugs.webkit.org/show_bug.cgi?id=99905
-
-        Reviewed by Mark Hahnenberg.
-
-        This will make it easier to instrument array allocations for the purposes of profiling.
-        It also allows us to kill off a bunch of code. And, this doesn't appear to hurt
-        performance at all. That's expected because these days any hot allocation will end up
-        in the DFG JIT, which does inline these allocations.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        (JIT):
-        * jit/JITInlineMethods.h:
-        (JSC):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_new_array):
-
-2012-10-19  Oliver Hunt  <[e-mail]>
-
-        Fix some of the regression cause by the non-local variable reworking
-        https://bugs.webkit.org/show_bug.cgi?id=99896
-
-        Reviewed by Filip Pizlo.
-
-        The non0local variable reworking led to some of the optimisations performed by
-        the bytecode generator being dropped.  This in turn put more pressure on the DFG
-        optimisations.  This exposed a short coming in our double speculation propogation.
-        Now we try to distinguish between places where we should SpecDoubleReal vs generic
-        SpecDouble.
-
-        * dfg/DFGPredictionPropagationPhase.cpp:
-        (PredictionPropagationPhase):
-        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
-        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPredictions):
-        (JSC::DFG::PredictionPropagationPhase::propagate):
-
-2012-10-19  Michael Saboff  <[e-mail]>
-
-        Lexer should create 8 bit Identifiers for RegularExpressions and ASCII identifiers
-        https://bugs.webkit.org/show_bug.cgi?id=99855
-
-        Reviewed by Filip Pizlo.
-
-        Added makeIdentifier helpers that will always make an 8 bit Identifier or make an
-        Identifier that is the same size as the template parameter.  Used the first in the fast
-        path when looking for a JS identifier and the second when scanning regular expressions.
-
-        * parser/Lexer.cpp:
-        (JSC::::scanRegExp):
-        * parser/Lexer.h:
-        (Lexer):
-        (JSC::::makeIdentifierSameType):
-        (JSC::::makeLCharIdentifier):
-        (JSC::::lexExpectIdentifier):
-
-2012-10-19  Mark Lam  <[e-mail]>
-
-        Added WTF::StackStats mechanism.
-        https://bugs.webkit.org/show_bug.cgi?id=99805.
-
-        Reviewed by Geoffrey Garen.
-
-        Added StackStats checkpoints and probes.
-
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitNode):
-        (JSC::BytecodeGenerator::emitNodeInConditionContext):
-        * heap/SlotVisitor.cpp:
-        (JSC::SlotVisitor::append):
-        (JSC::visitChildren):
-        (JSC::SlotVisitor::donateKnownParallel):
-        (JSC::SlotVisitor::drain):
-        (JSC::SlotVisitor::drainFromShared):
-        (JSC::SlotVisitor::mergeOpaqueRoots):
-        (JSC::SlotVisitor::internalAppend):
-        (JSC::SlotVisitor::harvestWeakReferences):
-        (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        * parser/Parser.h:
-        (JSC::Parser::canRecurse):
-        * runtime/StringRecursionChecker.h:
-        (StringRecursionChecker):
-
-2012-10-19  Oliver Hunt  <[e-mail]>
-
-        REGRESSION(r131822): It made 500+ tests crash on 32 bit platforms
-        https://bugs.webkit.org/show_bug.cgi?id=99814
-
-        Reviewed by Filip Pizlo.
-
-        Call the correct macro in 32bit. 
-
-        * llint/LowLevelInterpreter.asm:
-
-2012-10-19  Dongwoo Joshua Im  <[e-mail]>
-
-        Rename ENABLE_CSS3_TEXT_DECORATION to ENABLE_CSS3_TEXT
-        https://bugs.webkit.org/show_bug.cgi?id=99804
-
-        Reviewed by Julien Chaffraix.
-
-        CSS3 text related properties will be implemented under this flag,
-        including text decoration, text-align-last, and text-justify.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2012-10-18  Anders Carlsson  <[e-mail]>
-
-        Clean up RegExpKey
-        https://bugs.webkit.org/show_bug.cgi?id=99798
-
-        Reviewed by Darin Adler.
-
-        RegExpHash doesn't need to be a class template specialization when the class template is specialized
-        for JSC::RegExpKey only. Make it a nested class of RegExp instead. Also, make operator== a friend function
-        so Hash::equal can see it.
-
-        * runtime/RegExpKey.h:
-        (JSC::RegExpKey::RegExpKey):
-        (JSC::RegExpKey::operator==):