Upgrade to upstream WebKit 6b58d86abe

CMakeLists.txt

@@ -42,8 +42,43 @@ if (SWIFT_REQUIRED)
         WEBKIT_XCRUN(CMAKE_Swift_COMPILER --find swiftc)
     endif ()
     set(ORIGINAL_Swift_COMPILER "${CMAKE_Swift_COMPILER}")
+    WEBKIT_QUERY_SWIFT_TARGET_INFO(WEBKIT_SWIFT_TARGET_INFO "${ORIGINAL_Swift_COMPILER}")
 
     if (WIN32)
+        string(JSON _swift_runtime_library_path_count ERROR_VARIABLE _swift_runtime_library_paths_error
+            LENGTH "${WEBKIT_SWIFT_TARGET_INFO}" "paths" "runtimeLibraryPaths")
+        if (NOT _swift_runtime_library_paths_error STREQUAL "NOTFOUND")
+            message(FATAL_ERROR "Could not read Swift runtime library paths: ${_swift_runtime_library_paths_error}")
+        endif ()
+        set(_swift_runtime_bin_directory "")
+        if (_swift_runtime_library_path_count)
+            math(EXPR _swift_runtime_library_path_last "${_swift_runtime_library_path_count} - 1")
+            # Prefer the installed runtime over the toolchain-adjacent testing fallback.
+            foreach (_index RANGE ${_swift_runtime_library_path_last} 0 -1)
+                string(JSON _swift_runtime_library_path GET "${WEBKIT_SWIFT_TARGET_INFO}" "paths" "runtimeLibraryPaths" ${_index})
+                if (EXISTS "${_swift_runtime_library_path}/swiftCore.dll")
+                    set(_swift_runtime_bin_directory "${_swift_runtime_library_path}")
+                    break ()
+                endif ()
+            endforeach ()
+        endif ()
+        if (NOT _swift_runtime_bin_directory)
+            message(FATAL_ERROR "Could not find the Swift runtime bin directory")
+        endif ()
+        file(WRITE "${CMAKE_BINARY_DIR}/swift-runtime-bin-directory.txt.tmp" "${_swift_runtime_bin_directory}\n")
+        execute_process(COMMAND ${CMAKE_COMMAND} -E copy_if_different
+            "${CMAKE_BINARY_DIR}/swift-runtime-bin-directory.txt.tmp"
+            "${CMAKE_BINARY_DIR}/swift-runtime-bin-directory.txt"
+            COMMAND_ERROR_IS_FATAL ANY
+        )
+        file(REMOVE "${CMAKE_BINARY_DIR}/swift-runtime-bin-directory.txt.tmp")
+        unset(_swift_runtime_library_path_count)
+        unset(_swift_runtime_library_path_last)
+        unset(_swift_runtime_library_paths_error)
+        unset(_swift_runtime_library_path)
+        unset(_swift_runtime_bin_directory)
+        unset(_index)
+
         # Avoid cmd.exe due to command-line length limits.
         set(CMAKE_Swift_COMPILER "${Python_EXECUTABLE}")
         set(CMAKE_Swift_COMPILER_ARG1 "${CMAKE_SOURCE_DIR}/Tools/Scripts/swift/swiftc-wrapper.py")
@@ -63,6 +98,8 @@ if (SWIFT_REQUIRED)
     string(REPLACE "<CMAKE_Swift_COMPILER>"
         "<CMAKE_Swift_COMPILER> --original-swift-compiler=${ORIGINAL_Swift_COMPILER}"
         CMAKE_Swift_CREATE_STATIC_LIBRARY "${CMAKE_Swift_CREATE_STATIC_LIBRARY}")
+elseif (WIN32)
+    file(REMOVE "${CMAKE_BINARY_DIR}/swift-runtime-bin-directory.txt")
 endif ()
 
 # -----------------------------------------------------------------------------

JSTests/microbenchmarks/mul-negated-operand-chain.js

@@ -0,0 +1,14 @@
+function chain(n, w) {
+    let x = 1.0;
+    for (let i = 0; i < n; ++i)
+        x = -x * w;
+    return x;
+}
+noInline(chain);
+
+let result = 0;
+for (let i = 0; i < 600; ++i)
+    result += chain(100000, 1.0);
+
+if (result !== 600)
+    throw new Error(`bad result: ${result}`);

JSTests/microbenchmarks/mul-negated-operand-integrate.js

@@ -0,0 +1,33 @@
+function integrate(px, py, vx, vy, n, damping, dt) {
+    for (let i = 0; i < n; ++i) {
+        let x = px[i];
+        let y = py[i];
+        let ax = -x * damping;
+        let ay = -y * damping;
+        let nvx = vx[i] + ax * dt;
+        let nvy = vy[i] + ay * dt;
+        vx[i] = nvx;
+        vy[i] = nvy;
+        px[i] = x + nvx * dt;
+        py[i] = y + nvy * dt;
+    }
+}
+noInline(integrate);
+
+const count = 1000;
+let px = new Float64Array(count);
+let py = new Float64Array(count);
+let vx = new Float64Array(count);
+let vy = new Float64Array(count);
+for (let i = 0; i < count; ++i) {
+    px[i] = 1.0;
+    py[i] = -1.0;
+    vx[i] = 0.25;
+    vy[i] = -0.25;
+}
+
+for (let i = 0; i < 100000; ++i)
+    integrate(px, py, vx, vy, count, 0.5, 0.125);
+
+if (!isFinite(px[0]) || !isFinite(py[0]))
+    throw new Error(`bad result: ${px[0]}, ${py[0]}`);

JSTests/stress/arraybuffer-grow-resize-huge-length.js

@@ -0,0 +1,36 @@
+function shouldThrowRangeError(func)
+{
+    var threw = false;
+    try {
+        func();
+    } catch (error) {
+        threw = true;
+        if (!(error instanceof RangeError))
+            throw new Error("expected RangeError, got " + error);
+    }
+    if (!threw)
+        throw new Error("did not throw");
+}
+
+{
+    let buffer = new ArrayBuffer(8, { maxByteLength: 16 });
+    shouldThrowRangeError(() => buffer.resize(1e20));
+    shouldThrowRangeError(() => buffer.resize(Infinity));
+    shouldThrowRangeError(() => buffer.resize(-1));
+    let detached = new ArrayBuffer(8, { maxByteLength: 16 });
+    detached.transfer();
+    shouldThrowRangeError(() => detached.resize(-1));
+    buffer.resize(16);
+    if (buffer.byteLength !== 16)
+        throw new Error("resize to 16 failed");
+}
+
+{
+    let buffer = new SharedArrayBuffer(8, { maxByteLength: 16 });
+    shouldThrowRangeError(() => buffer.grow(1e20));
+    shouldThrowRangeError(() => buffer.grow(Infinity));
+    shouldThrowRangeError(() => buffer.grow(-1));
+    buffer.grow(16);
+    if (buffer.byteLength !== 16)
+        throw new Error("grow to 16 failed");
+}

JSTests/stress/multiply-negated-operand.js

@@ -0,0 +1,78 @@
+function shouldBe(actual, expected, message) {
+    // Distinguish -0 from 0 and treat NaN as equal to NaN.
+    let same = actual === expected ? (actual !== 0 || 1 / actual === 1 / expected)
+        : (actual !== actual && expected !== expected);
+    if (!same)
+        throw new Error(`${message}: expected ${expected === 0 && 1 / expected < 0 ? "-0" : expected}, got ${actual === 0 && 1 / actual < 0 ? "-0" : actual}`);
+}
+
+function negLeft(w, r) { return -w * r; }
+noInline(negLeft);
+
+function negRight(w, r) { return w * -r; }
+noInline(negRight);
+
+function negBoth(w, r) { return -w * -r; }
+noInline(negBoth);
+
+// The negation has two users, so it cannot be absorbed into the multiply.
+function sharedNeg(w, r) {
+    let n = -w;
+    return n * r + n;
+}
+noInline(sharedNeg);
+
+// Integer operands, so this stays on the Int32 path.
+function negLeftInt(w, r) { return (-w * r) | 0; }
+noInline(negLeftInt);
+
+let signedZeroCases = [
+    // w, r, -w * r, w * -r, -w * -r
+    [0, 3, -0, -0, 0],
+    [-0, 3, 0, 0, -0],
+    [0, -3, 0, 0, -0],
+    [-0, -3, -0, -0, 0],
+    [0, 0, -0, -0, 0],
+    [-0, -0, -0, -0, 0],
+    [0, -0, 0, 0, -0],
+];
+
+let specialCases = [
+    // w, r, -w * r, w * -r, -w * -r
+    [0, Infinity, NaN, NaN, NaN],
+    [2, Infinity, -Infinity, -Infinity, Infinity],
+    [-2, Infinity, Infinity, Infinity, -Infinity],
+    [NaN, 3, NaN, NaN, NaN],
+    [3, NaN, NaN, NaN, NaN],
+    [1.5, 2.5, -3.75, -3.75, 3.75],
+    [-1.5, 2.5, 3.75, 3.75, -3.75],
+    [Number.MIN_VALUE, 0.5, -Number.MIN_VALUE / 2, -Number.MIN_VALUE / 2, Number.MIN_VALUE / 2],
+    [Number.MAX_VALUE, 2, -Infinity, -Infinity, Infinity],
+];
+
+let cases = signedZeroCases.concat(specialCases);
+
+for (let i = 0; i < 1e4; ++i) {
+    for (let [w, r, expectNegLeft, expectNegRight, expectNegBoth] of cases) {
+        shouldBe(negLeft(w, r), expectNegLeft, `-${w} * ${r}`);
+        shouldBe(negRight(w, r), expectNegRight, `${w} * -${r}`);
+        shouldBe(negBoth(w, r), expectNegBoth, `-${w} * -${r}`);
+        shouldBe(sharedNeg(w, r), expectNegLeft + -w, `shared -${w} * ${r}`);
+    }
+}
+
+// Int32 path: (-w * r) | 0 wraps like the two's complement product.
+let intCases = [
+    [1, 1, -1],
+    [-1, 1, 1],
+    [3, 7, -21],
+    [-3, 7, 21],
+    [0x7fffffff, 2, 2],
+    [-0x80000000, 2, 0],
+    [0x10000, 0x10000, 0],
+];
+
+for (let i = 0; i < 1e4; ++i) {
+    for (let [w, r, expected] of intCases)
+        shouldBe(negLeftInt(w, r), expected, `(-${w} * ${r}) | 0`);
+}

JSTests/stress/regexp-cached-result-one-character-atom-delete-all-code.js

@@ -0,0 +1,39 @@
+//@ requireOptions("--useDollarVM=1")
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`);
+}
+
+let re = /x/g;
+
+let cases = [
+    ["aaxbbxcc", 2, "aaxbb", "cc"],
+    ["aaxbbx\0\0", 2, "aaxbb", "\0\0"],
+    ["aaxbbあxcc", 2, "aaxbbあ", "cc"],
+    [("_".repeat(64) + "aaxbb".repeat(10) + "xcc" + "_".repeat(64)).substring(64, 117), 11, "aaxbb".repeat(10), "cc"],
+];
+
+let index = 0;
+let expected = null;
+
+function step() {
+    if (expected) {
+        let [leftContext, rightContext] = expected;
+        shouldBe(RegExp.$1, "");
+        shouldBe(RegExp.lastParen, "");
+        shouldBe(RegExp.lastMatch, "x");
+        shouldBe(RegExp.leftContext, leftContext);
+        shouldBe(RegExp.rightContext, rightContext);
+    }
+    if (index === cases.length)
+        return;
+    let [input, count, leftContext, rightContext] = cases[index++];
+    re.test("zzx");
+    shouldBe(input.match(re).length, count);
+    expected = [leftContext, rightContext];
+    $vm.deleteAllCodeWhenIdle();
+    setTimeout(step, 0);
+}
+
+step();

JSTests/stress/warm-up-marked-blocks-state-machine.js

@@ -1,52 +1,59 @@
-//@ runDefault("--useDollarVM=1", "--warmUpMarkedBlockCount=8", "--warmUpMarkedBlockIdleTimeout=0.2")
+//@ runDefault("--useDollarVM=1", "--warmUpMarkedBlockCount=8", "--warmUpMarkedBlockIdleTimeout=0.02")
 
-// Drives the warm-up supply through its whole state machine: fill, release on idle, restart,
-// stand-down on allocation failure, and recovery once allocation works again. Every assertion is
-// "reaches this state eventually", since a helper thread drives the transitions.
+// Drives the warm-up supply: it fills while blocks are being asked for, hands the memory back once
+// nothing has asked for a while, survives an allocation failure, and comes back once allocation
+// works again. Every assertion is "reaches this state eventually", since a libpas helper thread
+// drives the transitions on its own.
 
-const pollSeconds = 0.05;
+const pollSeconds = 0.01;
 const timeoutSeconds = 20;
 
 const retained = [];
 
 function allocateBlocks() {
     // Retaining these is the point: a heap that can recycle stops asking the allocator for blocks,
-    // and sustained block demand is what the stand-down and restart paths are driven by. The count
-    // is kept small so that a run which ends up timing out still reports rather than exhausting
-    // memory first.
+    // and sustained block demand is what keeps the supply refilling. The count is kept small so
+    // that a run which ends up timing out still reports rather than exhausting memory first.
     for (let i = 0; i < 2000; ++i)
         retained.push({ a: i, b: i, c: i });
 }
 
 function waitFor(description, predicate, betweenAttempts = () => { }) {
     for (let attempt = 0; attempt < timeoutSeconds / pollSeconds; ++attempt) {
-        if (predicate($vm.warmUpMarkedBlockState()))
+        if (predicate($vm.warmUpMarkedBlockCount()))
             return;
         betweenAttempts();
         sleepSeconds(pollSeconds);
     }
-    const state = $vm.warmUpMarkedBlockState();
-    throw new Error(`Timed out waiting for ${description}; blocks=${state.blocks} phase=${state.phase}`);
+    throw new Error(`Timed out waiting for ${description}; blocks=${$vm.warmUpMarkedBlockCount()}`);
 }
 
-const isFilled = state => state.phase === "armed" && state.blocks > 0;
+function driveTheSupply() {
+    // The supply lives in libpas, so a build that does not use libpas has nothing to drive: it
+    // reports itself disabled even though a depth was configured on the command line.
+    if (!$vm.warmUpMarkedBlocksAreEnabled())
+        return;
 
-// Demand starts the helper, which arms to the configured depth and fills.
-allocateBlocks();
-waitFor("the supply to fill", isFilled, allocateBlocks);
+    // Demand makes the helper fill the supply.
+    allocateBlocks();
+    waitFor("the supply to fill", blocks => blocks > 0, allocateBlocks);
 
-// With no demand at all, the helper hands everything back and shuts down.
-waitFor("the supply to be released when idle", state => state.phase === "stopped");
+    // With no demand at all, the memory goes back rather than staying resident on the chance that
+    // somebody will want it. This is what keeps the supply from surviving a quiet period.
+    waitFor("the supply to be released when idle", blocks => !blocks);
 
-// Fresh demand brings it back.
-allocateBlocks();
-waitFor("the helper to restart", isFilled, allocateBlocks);
+    // Fresh demand fills it again.
+    allocateBlocks();
+    waitFor("the supply to refill", blocks => blocks > 0, allocateBlocks);
 
-// An allocation failure makes it stand down rather than spin against an exhausted heap.
-$vm.setWarmUpMarkedBlockAllocationShouldFail(true);
-waitFor("the helper to stand down", state => state.phase === "standingDown", allocateBlocks);
+    // An empty supply cannot tell a filler that has stood down from one refilling as fast as the
+    // demand here consumes, so draining is only the setup.
+    $vm.setWarmUpMarkedBlockAllocationShouldFail(true);
+    waitFor("the supply to drain while allocation fails", blocks => !blocks, allocateBlocks);
 
-// Standing down must not be permanent: the idle timeout still fires while demand continues, and
-// lifts it once allocation works again.
-$vm.setWarmUpMarkedBlockAllocationShouldFail(false);
-waitFor("the stand-down to lift", isFilled, allocateBlocks);
+    // The real assertion, since a filler that treated the failure as fatal never refills.
+    $vm.setWarmUpMarkedBlockAllocationShouldFail(false);
+    waitFor("the supply to recover", blocks => blocks > 0, allocateBlocks);
+}
+
+driveTheSupply();

JSTests/stress/weak-gc-map-keeps-live-values.js

@@ -0,0 +1,32 @@
+// Symbol.for observes VM::symbolImplToSymbolMap, one of the WeakGCMaps, directly: if a reachable
+// entry is dropped, the next lookup builds a fresh Symbol cell for the same key and the two are not
+// identical. Eden and full collections reconcile those maps by different paths, so exercise both.
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${String(actual)}`);
+}
+
+const symbols = [];
+for (let i = 0; i < 128; ++i)
+    symbols.push(Symbol.for(`key-${i}`));
+
+for (let i = 0; i < 32; ++i) {
+    // Churn structure transitions, prototype structures, and interned strings, so that the weak
+    // tables gain entries between collections.
+    for (let j = 0; j < 512; ++j) {
+        const object = {};
+        object[`p${j & 31}`] = j;
+        object.tail = j;
+        Object.create(object);
+        `a,b,c-${j}`.split(",");
+    }
+
+    if (i & 1)
+        edenGC();
+    else
+        gc();
+
+    for (let j = 0; j < symbols.length; ++j)
+        shouldBe(Symbol.for(`key-${j}`), symbols[j]);
+}