OSDN Git Service

disable webkit layers
[android-x86/external-webkit.git] / JavaScriptCore / ChangeLog
index ea47411..4257344 100644 (file)
-2008-11-04  Adam Roben  <aroben@apple.com>
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Windows build fix
+        Reviewed by Tor Arne Vestbø.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
-        the location of JSStaticScopeObject.{cpp,h}.
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
 
-        Reviewed by Alexey Proskuryakov.
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Move AllInOneFile.cpp to the top level of JavaScriptCore.
+        Reviewed by Simon Hausmann.
 
-        * AllInOneFile.cpp: Copied from kjs/AllInOneFile.cpp.
-        * GNUmakefile.am:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp: Removed.
+        Don't import the cmath functions from std:: for WINSCW.
 
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/MathExtras.h:
 
-        Rubber-stamped by Alexey Proskuryakov.
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
 
-        Add NodeInfo.h to the JavaScriptCore Xcode project.
+        Reviewed by Adam Barth.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
 
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
 
-        Rubber-stamped by Maciej Stachowiak.
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
 
-        Move more files into the runtime subdirectory of JavaScriptCore.
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
 
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackFunction.cpp:
-        * API/JSClassRef.cpp:
-        * API/OpaqueJSString.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/ArgList.cpp: Removed.
-        * kjs/ArgList.h: Removed.
-        * kjs/Arguments.cpp: Removed.
-        * kjs/Arguments.h: Removed.
-        * kjs/BatchedTransitionOptimizer.h: Removed.
-        * kjs/CollectorHeapIterator.h: Removed.
-        * kjs/CommonIdentifiers.cpp: Removed.
-        * kjs/CommonIdentifiers.h: Removed.
-        * kjs/ExecState.cpp: Removed.
-        * kjs/ExecState.h: Removed.
-        * kjs/GetterSetter.cpp: Removed.
-        * kjs/GetterSetter.h: Removed.
-        * kjs/InitializeThreading.cpp: Removed.
-        * kjs/InitializeThreading.h: Removed.
-        * kjs/JSActivation.cpp: Removed.
-        * kjs/JSActivation.h: Removed.
-        * kjs/JSGlobalData.cpp: Removed.
-        * kjs/JSGlobalData.h: Removed.
-        * kjs/JSLock.cpp: Removed.
-        * kjs/JSLock.h: Removed.
-        * kjs/JSStaticScopeObject.cpp: Removed.
-        * kjs/JSStaticScopeObject.h: Removed.
-        * kjs/JSType.h: Removed.
-        * kjs/PropertyNameArray.cpp: Removed.
-        * kjs/PropertyNameArray.h: Removed.
-        * kjs/ScopeChain.cpp: Removed.
-        * kjs/ScopeChain.h: Removed.
-        * kjs/ScopeChainMark.h: Removed.
-        * kjs/SymbolTable.h: Removed.
-        * kjs/Tracing.d: Removed.
-        * kjs/Tracing.h: Removed.
-        * runtime/ArgList.cpp: Copied from kjs/ArgList.cpp.
-        * runtime/ArgList.h: Copied from kjs/ArgList.h.
-        * runtime/Arguments.cpp: Copied from kjs/Arguments.cpp.
-        * runtime/Arguments.h: Copied from kjs/Arguments.h.
-        * runtime/BatchedTransitionOptimizer.h: Copied from kjs/BatchedTransitionOptimizer.h.
-        * runtime/CollectorHeapIterator.h: Copied from kjs/CollectorHeapIterator.h.
-        * runtime/CommonIdentifiers.cpp: Copied from kjs/CommonIdentifiers.cpp.
-        * runtime/CommonIdentifiers.h: Copied from kjs/CommonIdentifiers.h.
-        * runtime/ExecState.cpp: Copied from kjs/ExecState.cpp.
-        * runtime/ExecState.h: Copied from kjs/ExecState.h.
-        * runtime/GetterSetter.cpp: Copied from kjs/GetterSetter.cpp.
-        * runtime/GetterSetter.h: Copied from kjs/GetterSetter.h.
-        * runtime/InitializeThreading.cpp: Copied from kjs/InitializeThreading.cpp.
-        * runtime/InitializeThreading.h: Copied from kjs/InitializeThreading.h.
-        * runtime/JSActivation.cpp: Copied from kjs/JSActivation.cpp.
-        * runtime/JSActivation.h: Copied from kjs/JSActivation.h.
-        * runtime/JSGlobalData.cpp: Copied from kjs/JSGlobalData.cpp.
-        * runtime/JSGlobalData.h: Copied from kjs/JSGlobalData.h.
-        * runtime/JSLock.cpp: Copied from kjs/JSLock.cpp.
-        * runtime/JSLock.h: Copied from kjs/JSLock.h.
-        * runtime/JSStaticScopeObject.cpp: Copied from kjs/JSStaticScopeObject.cpp.
-        * runtime/JSStaticScopeObject.h: Copied from kjs/JSStaticScopeObject.h.
-        * runtime/JSType.h: Copied from kjs/JSType.h.
-        * runtime/PropertyNameArray.cpp: Copied from kjs/PropertyNameArray.cpp.
-        * runtime/PropertyNameArray.h: Copied from kjs/PropertyNameArray.h.
-        * runtime/ScopeChain.cpp: Copied from kjs/ScopeChain.cpp.
-        * runtime/ScopeChain.h: Copied from kjs/ScopeChain.h.
-        * runtime/ScopeChainMark.h: Copied from kjs/ScopeChainMark.h.
-        * runtime/SymbolTable.h: Copied from kjs/SymbolTable.h.
-        * runtime/Tracing.d: Copied from kjs/Tracing.d.
-        * runtime/Tracing.h: Copied from kjs/Tracing.h.
-
-2008-11-03  Sam Weinig  <sam@webkit.org>
+        Reviewed by Oliver Hunt and Darin Adler.
 
-        Reviewed by Mark Rowe.
+        The rest of the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        Don't unconditionally hang onto small strings. Instead, hang onto all
+        small strings as long as any small string is still referenced.
+        
+        SunSpider reports no change.
 
-        Move #define to turn on dumping StructureID statistics to StructureID.cpp so that
-        turning it on does not require a full rebuild. 
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots): Mark the small strings cache last, so it can
+        check if anything else has kept any strings alive.
 
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * runtime/StructureID.h:
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren): Only keep our strings alive if some
+        other reference to at least one of them exists, too.
 
-2008-11-03  Alp Toker  <alp@nuanti.com>
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Geoffrey Garen.
+        Reviewed by Gavin Barraclough.
 
-        Fix warning when building on Darwin without JSC_MULTIPLE_THREADS
-        enabled.
+        Some progress toward fixing
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        SunSpider reports no change.
+        
+        Keep weak references, rather than protected references, to cached for-in
+        property name enumerators.
+        
+        One problem with protected references is that a chain like 
+            [ gc object 1 ] => [ non-gc object ] => [ gc object 2 ]
+        takes two GC passes to break, since the first pass collects [ gc object 1 ],
+        releasing [ non-gc object ] and unprotecting [ gc object 2 ], and only
+        then can a second pass collect [ gc object 2 ].
+        
+        Another problem with protected references is that they can keep a bunch
+        of strings alive long after they're useful. In SunSpider and a few popular
+        websites, the size-speed tradeoff seems to favor weak references.
 
-        * kjs/InitializeThreading.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Moved this constructor
+        into the .cpp file, since it's not used elsewhere.
 
-2008-11-02  Matt Lilek  <webkit@mattlilek.com>
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator): Added a destructor
+        to support our weak reference.
 
-        Reviewed by Cameron Zwarich.
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::enumerationCache): Added a function for clearing a
+        Structure's enumeration cache, used by our new destructor. Also fixed
+        indentation to match the rest of the file.
 
-        Bug 22042: REGRESSION(r38066): ASSERTION FAILED: source in CodeBlock
-        <https://bugs.webkit.org/show_bug.cgi?id=22042>
+        * runtime/Structure.h: Changed from protected pointer to weak pointer.
 
-        Rename parameter name to avoid ASSERT.
+2010-02-11  Chris Rogers  <crogers@google.com>
 
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
+        Reviewed by David Levin.
 
-2008-11-02  Cameron Zwarich  <zwarich@apple.com>
+        audio engine: add Complex number class
+        https://bugs.webkit.org/show_bug.cgi?id=34538
 
-        Reviewed by Oliver Hunt.
+        * wtf/Complex.h: Added.
+        (WebCore::complexFromMagnitudePhase):
 
-        Bug 22035: Remove the '_' suffix on constructor parameter names for structs
-        <https://bugs.webkit.org/show_bug.cgi?id=22035>
+2010-02-10  Geoffrey Garen  <ggaren@apple.com>
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::JSCallbackObjectData::JSCallbackObjectData):
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
-        * wrec/WREC.h:
-        (JSC::Quantifier::Quantifier):
+        Reviewed by Oliver Hunt.
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        Added an SPI for asking about all the different live objects on the heap.
+        Useful for memory debugging.
 
-        Rubber-stamped by Geoff Garen.
+        * JavaScriptCore.exp: Export the new SPI.
 
-        Rename SourceRange.h to SourceCode.h.
+        * runtime/Collector.cpp:
+        (JSC::typeName): Use a little capitalization. Don't crash in the case of
+        a non-object cell, since it might just be an uninitialized cell.
 
-        * API/JSBase.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.h:
-        * kjs/SourceCode.h: Copied from kjs/SourceRange.h.
-        * kjs/SourceRange.h: Removed.
-        * kjs/grammar.y:
-        * kjs/lexer.h:
-        * kjs/nodes.cpp:
-        (JSC::ForInNode::ForInNode):
-        * kjs/nodes.h:
-        (JSC::ThrowableExpressionData::setExceptionSourceCode):
+        (JSC::Heap::objectTypeCounts): The new SPI.
+
+        * runtime/Collector.h:
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::operator++): Made 2 tweaks to these iterators:
+        (1) Skip the last cell in the block, since it's a dummy sentinel, and
+        we don't want it to confuse the object count; (2) Fixed a logic error
+        in LiveObjectIterator that could cause it to iterate dead objects if
+        m_block were equal to m_heap.nextBlock and m_cell were less than
+        m_heap.nextCell. No test for this since I can't think of a way that this
+        could make WebKit behave badly.
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+2010-02-11  Steve Block  <steveblock@google.com>
 
         Reviewed by Darin Adler.
 
-        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
-        <https://bugs.webkit.org/show_bug.cgi?id=22019>
+        Guard cmath using declarations in MathExtras.h on Android
+        https://bugs.webkit.org/show_bug.cgi?id=34840
 
-        The JSC::Interpreter::shouldPrintExceptions() function is not used at
-        all in JavaScriptCore, so it should be moved to WebCore::Console, its
-        only user.
+        Android does not provide these functions.
 
-        * JavaScriptCore.exp:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
+        * wtf/MathExtras.h:
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
 
-        Not reviewed.
+        Reviewed by Cameron Zwarich.
 
-        Windows build fix.
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * Configurations/FeatureDefines.xcconfig:
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
 
-        Rubber-stamped by Sam Weinig.
+        Reviewed by Kevin Ollivier.
 
-        Remove the call to Interpreter::setShouldPrintExceptions() from the
-        GlobalObject constructor in the shell. The shouldPrintExceptions()
-        information is not used anywhere in JavaScriptCore, only in WebCore.
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
 
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
+        * wscript:
 
-2008-10-31  Kevin Ollivier  <kevino@theolliviers.com>
+2010-02-10  Alexey Proskuryakov  <ap@apple.com>
 
-        wxMSW build fix.
+        Addressing issues found by style bot.
 
-        * wtf/Threading.h:
+        * wtf/ValueCheck.h: Renamed header guard to match final file name.
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/Vector.h: (WTF::::checkConsistency): Remove braces around a one-line clause.
 
-        Rubber-stamped by Sam Weinig.
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
 
-        Move more files from the kjs subdirectory of JavaScriptCore to the
-        runtime subdirectory.
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
 
         * GNUmakefile.am:
-        * JavaScriptCore.pri:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/RegExpConstructor.cpp: Removed.
-        * kjs/RegExpConstructor.h: Removed.
-        * kjs/RegExpMatchesArray.h: Removed.
-        * kjs/RegExpObject.cpp: Removed.
-        * kjs/RegExpObject.h: Removed.
-        * kjs/RegExpPrototype.cpp: Removed.
-        * kjs/RegExpPrototype.h: Removed.
-        * runtime/RegExpConstructor.cpp: Copied from kjs/RegExpConstructor.cpp.
-        * runtime/RegExpConstructor.h: Copied from kjs/RegExpConstructor.h.
-        * runtime/RegExpMatchesArray.h: Copied from kjs/RegExpMatchesArray.h.
-        * runtime/RegExpObject.cpp: Copied from kjs/RegExpObject.cpp.
-        * runtime/RegExpObject.h: Copied from kjs/RegExpObject.h.
-        * runtime/RegExpPrototype.cpp: Copied from kjs/RegExpPrototype.cpp.
-        * runtime/RegExpPrototype.h: Copied from kjs/RegExpPrototype.h.
+        Added ValueCheck.h.
 
-2008-10-31  Mark Rowe  <mrowe@apple.com>
+        * wtf/ValueCheck.h: Added. Moved code out of HashTraits, since it would be awkward to
+        include that from Vector.h.
+        (WTF::ValueCheck::checkConsistency): Allow null pointers, those are pretty consistent.
 
-        Revert an incorrect portion of r38034.
+        * wtf/HashTraits.h: Moved value checking code out of here.
 
-        * profiler/ProfilerServer.mm:
+        * wtf/HashTable.h: (WTF::::checkTableConsistencyExceptSize): Updated for the above changes.
 
-2008-10-31  Mark Rowe  <mrowe@apple.com>
+        * wtf/Vector.h:
+        (WTF::::checkConsistency): Check all vector elements.
+        (WTF::ValueCheck): Support checking a Vector as an element in other containers. Currently
+        unused.
 
-        Fix the 64-bit build.
+2010-02-10  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Disable strict aliasing in ProfilerServer.mm as it leads to the compiler being unhappy
-        with the common Obj-C idiom self = [super init];
+        Reviewed by Simon Hausmann.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Fix QScriptValue::toBool.
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        Fix ECMA compliance in the QScriptValue for values like 0, NaN and
+        empty strings.
 
-        Reviewed by Alexey Proskuryakov.
+        [Qt] QScriptValue::toBool problem
+        https://bugs.webkit.org/show_bug.cgi?id=34793
 
-        Change a header guard to match our coding style.
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toBool):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
 
-        * kjs/InitializeThreading.h:
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
-2008-10-30  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Oliver Hunt.
-        
-        Fixed a small bit of https://bugs.webkit.org/show_bug.cgi?id=21962
-        AST uses way too much memory
-        
-        Removed a word from StatementNode by nixing LabelStack and turning it
-        into a compile-time data structure managed by CodeGenerator.
-        
-        v8 tests and SunSpider, run by Gavin, report no change.
+        Use derefIfNotNull() to work around WINSCW compiler forward declaration bug
 
-        * GNUmakefile.am:
-        * JavaScriptCore.order:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp:
-        * JavaScriptCoreSources.bkl: I sure hope this builds!
-        
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::newLabelScope):
-        (JSC::CodeGenerator::breakTarget):
-        (JSC::CodeGenerator::continueTarget):
-        * VM/CodeGenerator.h: Nixed the JumpContext system because it depended
-        on a LabelStack in the AST, and it was a little cumbersome on the client
-        side. Replaced with LabelScope, which tracks all break / continue
-        information in the CodeGenerator, just like we track LabelIDs and other
-        stacks of compile-time data.
-
-        * kjs/LabelScope.h: Added.
-        (JSC::LabelScope::):
-        (JSC::LabelScope::LabelScope):
-        (JSC::LabelScope::ref):
-        (JSC::LabelScope::deref):
-        (JSC::LabelScope::refCount):
-        (JSC::LabelScope::breakTarget):
-        (JSC::LabelScope::continueTarget):
-        (JSC::LabelScope::type):
-        (JSC::LabelScope::name):
-        (JSC::LabelScope::scopeDepth): Simple abstraction for holding everything
-        you might want to know about a break-able / continue-able scope.
-
-        * kjs/LabelStack.cpp: Removed.
-        * kjs/LabelStack.h: Removed.
-
-        * kjs/grammar.y: No need to push labels at parse time -- we don't store
-        LabelStacks in the AST anymore.
-
-        * kjs/nodes.cpp:
-        (JSC::DoWhileNode::emitCode):
-        (JSC::WhileNode::emitCode):
-        (JSC::ForNode::emitCode):
-        (JSC::ForInNode::emitCode):
-        (JSC::ContinueNode::emitCode):
-        (JSC::BreakNode::emitCode):
-        (JSC::SwitchNode::emitCode):
-        (JSC::LabelNode::emitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::LabelNode::): Use LabelScope where we used to use JumpContext.
-        Simplified a bunch of code. Touched up label-related error messages a
-        bit.
-
-        * kjs/nodes2string.cpp:
-        (JSC::LabelNode::streamTo): Updated for rename.
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        The compiler bug is reported at
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
 
-        Reviewed by Darin Adler.
+        The change should be reverted when the above bug is fixed in WINSCW compiler.
 
-        Bug 22005: Move StructureIDChain into its own file
-        <https://bugs.webkit.org/show_bug.cgi?id=22005>
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * runtime/StructureID.cpp:
-        * runtime/StructureID.h:
-        * runtime/StructureIDChain.cpp: Copied from runtime/StructureID.cpp.
-        * runtime/StructureIDChain.h: Copied from runtime/StructureID.h.
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
-2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Build fix.
+        Get rid of WINSCW hack for UnSpecifiedBoolType
 
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
 
-2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=28054
 
-        Build fix.
+        * wtf/RefPtr.h:
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-2008-10-31  Darin Adler  <darin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dan Bernstein.
+        New functions nullValue() and undefinedValue().
 
-        - fix storage leak seen on buildbot
+        [Qt] QScriptEngine should contain nullValue and undefinedValue methods
+        https://bugs.webkit.org/show_bug.cgi?id=34749
 
-        Some other cleanup too. The storage leak was caused by the fact
-        that HashTraits<CallIdentifier>::needsDestruction was false, so
-        the call identifier objects didn't get deleted.
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::nullValue):
+        (QScriptEngine::undefinedValue):
+        * qt/api/qscriptengine.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
 
-        * profiler/CallIdentifier.h:
-        
-        Added a default constructor to create empty call identifiers.
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Changed the normal constructor to use const UString&
-        to avoid extra copying and reference count thrash.
-        
-        Removed the explicit copy constructor definition, since it's what
-        the compiler will automatically generate. (Rule of thumb: Either
-        you need both a custom copy constructor and a custom assignment
-        operator, or neither.)
+        Reviewed by Simon Hausmann.
 
-        Moved the CallIdentifier hash function out of the WTF namespace;
-        there's no reason to put it there.
+        Fixes for QScriptValue::toNumber().
 
-        Changed the CallIdentifier hash function to be a struct rather than
-        a specialization of the IntHash struct template. Having it be
-        a specialization made no sense, since CallIdentifier is not an integer,
-        and did no good.
+        Fix ECMA compliance in QScriptValue for values unbound
+        to a QScriptEngine.
 
-        Removed explicit definition of emptyValueIsZero in the hash traits,
-        since inheriting from GenericHashTraits already makes that false.
+        [Qt] QScriptValue::toNumber() is broken
+        https://bugs.webkit.org/show_bug.cgi?id=34592
 
-        Removed explicit definition of emptyValue, instead relying on the
-        default constructor and GenericHashTraits.
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
 
-        Removed explicit definition of needsDestruction, because we want it
-        to have its default value: true, not false. This fixes the leak!
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Changed constructDeletedValue and isDeletedValue to use a line number
-        of numeric_limits<unsigned>::max() to indicate a value is deleted.
-        Previously this used empty strings for the empty value and null strings
-        for the deleted value, but it's more efficient to use null for both.
+        Reviewed by Simon Hausmann.
 
-2008-10-31  Timothy Hatcher  <timothy@apple.com>
+        Fix QScriptValue::isNumber().
 
-        Emit the WillExecuteStatement debugger hook before the for loop body
-        when the statement node for the body isn't a block. This allows
-        breakpoints on those statements in the Web Inspector.
+        The isNumber() should return 'true' if the value is in the CNumber
+        state.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22004
+        [Qt] QScriptValue::isNumber() returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=34575
 
-        Reviewed by Darin Adler.
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
 
-        * kjs/nodes.cpp:
-        (JSC::ForNode::emitCode): Emit the WillExecuteStatement
-        debugger hook before the statement node if isn't a block.
-        Also emit the WillExecuteStatement debugger hook for the
-        loop as the first op-code.
-        (JSC::ForInNode::emitCode): Ditto.
+2010-02-09  Geoffrey Garen  <ggaren@apple.com>
 
-2008-10-31  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Fixes console warnings about not having an autorelease pool.
-        Also fixes the build for Snow Leopard, by including individual
-        Foundation headers instead of Foundation.h.
+        Small refactoring to the small strings cache to allow it to be cleared
+        dynamically.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21995
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::clear):
+        * runtime/SmallStrings.h: Moved initialization code into a shared function,
+        and changed the constructor to call it.
 
-        Reviewed by Oliver Hunt.
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
 
-        * profiler/ProfilerServer.mm:
-        (-[ProfilerServer init]): Create a NSAutoreleasePool and drain it.
+        Rubber Stamped by Geoff Garen.
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
 
-        Not reviewed.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+
+2010-02-09  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34772
+        Overzealous new assertion in URStringImpl::adopt()
+
+        Reviewed by Adam Barth.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        Only assert that vector.data() is non-zero if vector.size() is non-zero.
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix build problem on SnowLeopard slaves to bring them back.
 
-        Speculative wxWindows build fix.
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8): Mark method as 'static inline' to suppress "warning: no previous prototype for ..."
 
-        * JavaScriptCoreSources.bkl:
-        * jscore.bkl:
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Rubber-stamped by Maciej Stachowiak.
+        Three small string fixes:
+        (1) StringBuilder::release should CRASH if the buffer allocation failed.
+        (2) Remove weird, dead code from JSString::tryGetValue, replace with an ASSERT.
+        (3) Move UString::createFromUTF8 out to the API, as tryCreateStringFromUTF8.
+            This is only used from the API, and (now) unlike other UString::create
+            methods may return UString::null() to indicate failure cases.  Better
+            handle these in the API.
 
-        Move VM/JSPropertyNameIterator.cpp and VM/JSPropertyNameIterator.h to
-        the runtime directory.
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/JSString.h:
+        (JSC::Fiber::tryGetValue):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::find):
+        * runtime/UString.h:
+
+2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] use nanval() for Symbian as nonInlineNaN
+        https://bugs.webkit.org/show_bug.cgi?id=34170
+
+        numeric_limits<double>::quiet_NaN is broken in Symbian
+        causing NaN to be evaluated as a number.
+
+        * runtime/JSValue.cpp:
+        (JSC::nonInlineNaN):
+
+2010-02-09  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a soft modulo operation to ARM JIT using a trampoline function.
+        The performance progression is about ~1.8% on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        Developed in cooperation with Gabor Loki.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiSoftModulo):
+        * wtf/Platform.h:
 
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/JSPropertyNameIterator.cpp: Removed.
-        * VM/JSPropertyNameIterator.h: Removed.
-        * runtime/JSPropertyNameIterator.cpp: Copied from VM/JSPropertyNameIterator.cpp.
-        * runtime/JSPropertyNameIterator.h: Copied from VM/JSPropertyNameIterator.h.
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by NOBODY (SL/win build fixes).
 
-        Not reviewed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/StringPrototype.cpp:
 
-        Speculative wxWindows build fix.
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-        * jscore.bkl:
+        Reviewed by Oliver Hunt
 
-2008-10-30  Mark Rowe  <mrowe@apple.com>
+        Make String.replace throw an exception on out-of-memory, rather than
+        returning a null (err, empty-ish) string.  Move String::replaceRange
+        and String::spliceSubstringsWithSeparators out to StringPrototype -
+        these were fairly specific use anyway, and we can better integrate
+        throwing the JS expcetion this way.
 
-        Reviewed by Jon Homeycutt.
+        Also removes redundant assignment operator from UString.
 
-        Explicitly default to building for only the native architecture in debug and release builds.
+        * JavaScriptCore.exp:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringRange::StringRange):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::jsReplaceRange):
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
 
-        * Configurations/DebugRelease.xcconfig:
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Eric Seidel.
 
-        Rubber-stamped by Sam Weinig.
+        [BREWMP] Undefine WTF_OS_WINDOWS and WTF_PLATFORM_WIN
+        https://bugs.webkit.org/show_bug.cgi?id=34561
 
-        Create a debugger directory in JavaScriptCore and move the relevant
-        files to it.
+        As the binary for simulator is built with MSVC 2005,
+        WTF_OS_WINDOWS and WTF_PLATFORM_WIN are defined.
+        Undefine them as we don't target Windows.
 
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.cpp:
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        * debugger: Added.
-        * debugger/Debugger.cpp: Copied from kjs/debugger.cpp.
-        * debugger/Debugger.h: Copied from kjs/debugger.h.
-        * debugger/DebuggerCallFrame.cpp: Copied from kjs/DebuggerCallFrame.cpp.
-        * debugger/DebuggerCallFrame.h: Copied from kjs/DebuggerCallFrame.h.
-        * kjs/AllInOneFile.cpp:
-        * kjs/DebuggerCallFrame.cpp: Removed.
-        * kjs/DebuggerCallFrame.h: Removed.
-        * kjs/Parser.cpp:
-        * kjs/Parser.h:
-        * kjs/debugger.cpp: Removed.
-        * kjs/debugger.h: Removed.
-        * kjs/interpreter.cpp:
-        * kjs/nodes.cpp:
-        * runtime/FunctionConstructor.cpp:
-        * runtime/JSGlobalObject.cpp:
+        * wtf/Platform.h:
 
-2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
+2010-02-08  Chris Rogers  <crogers@google.com>
 
-        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
-        warnings; add some parentheses to disambiguate things. No functional
-        changes, so no tests.
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21973
-        Add parentheses to clean up some gcc warnings
+        audio engine: add Vector3 class
+        https://bugs.webkit.org/show_bug.cgi?id=34548
 
-        Reviewed by Dan Bernstein.
+        * wtf/Vector3.h: Added.
+        (WebCore::Vector3::Vector3):
+        (WebCore::Vector3::abs):
+        (WebCore::Vector3::isZero):
+        (WebCore::Vector3::normalize):
+        (WebCore::Vector3::x):
+        (WebCore::Vector3::y):
+        (WebCore::Vector3::z):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        (WebCore::dot):
+        (WebCore::cross):
+        (WebCore::distance):
 
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIAlphanumeric):
-        (WTF::isASCIIHexDigit):
+2010-02-08  Oliver Hunt  <oliver@apple.com>
 
-2008-10-30  Kevin Lindeman  <klindeman@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        Adds ProfilerServer, which is a distributed notification listener
-        that allows starting and stopping the profiler remotely for use
-        in conjunction with the profiler's DTace probes.
+        Fix warning in clang++
 
-        https://bugs.webkit.org/show_bug.cgi?id=21719
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
 
-        Reviewed by Timothy Hatcher.
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Calls startProfilerServerIfNeeded.
-        * profiler/ProfilerServer.h: Added.
-        * profiler/ProfilerServer.mm: Added.
-        (+[ProfilerServer sharedProfileServer]):
-        (-[ProfilerServer init]):
-        (-[ProfilerServer startProfiling]):
-        (-[ProfilerServer stopProfiling]):
-        (JSC::startProfilerServerIfNeeded):
+        Reviewed by Geoff Garen.
 
-2008-10-30  Kevin Ollivier  <kevino@theolliviers.com>
+        Make makeString CRASH if we fail to allocate a string.
 
-        wx build fix after PropertyMap and StructureID merge.
+        (tryMakeString or jsMakeNontrivialString can be used where we
+        expect allocation may fail and want to handle the error).
 
-        * JavaScriptCoreSources.bkl:
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+        (JSC::makeString):
 
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Mark Rowe.
+        Rubber Stamped by Oliver Hunt.
 
-        Change the JavaScriptCore Xcode project to use relative paths for the
-        PCRE source files.
+        Remove a couple of unnecesary C-style casts spotted by Darin.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
 
-2008-10-30  Sam Weinig  <sam@webkit.org>
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Cameron Zwarich and Geoffrey Garen.
+        Reviewed by Geoff Garen.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21989
-        Merge PropertyMap and StructureID
+        Switch some more StringBuilder/jsNontrivialString code to use
+        JSStringBuilder/jsMakeNontrivialString - these methods will
+        throw an exception if we hit out-of-memory, rather than just
+        CRASHing.
 
-        - Move PropertyMap code into StructureID in preparation for lazily
-          creating the map on gets.
-        - Make remove with transition explicit by adding removePropertyTransition.
-        - Make the put/remove without transition explicit.
-        - Make cache invalidation part of put/remove without transition.
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
 
-        1% speedup on SunSpider; 0.5% speedup on v8 suite.
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
 
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/identifier.h:
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::removeDirect):
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirect):
-        * runtime/PropertyMap.cpp: Removed.
-        * runtime/PropertyMap.h: Removed.
-        * runtime/PropertyMapHashTable.h: Copied from runtime/PropertyMap.h.
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::removePropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        (JSC::StructureID::addPropertyWithoutTransition):
-        (JSC::StructureID::removePropertyWithoutTransition):
-        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
-        (JSC::StructureID::checkConsistency):
-        (JSC::StructureID::copyPropertyTable):
-        (JSC::StructureID::get):
-        (JSC::StructureID::put):
-        (JSC::StructureID::remove):
-        (JSC::StructureID::insertIntoPropertyMapHashTable):
-        (JSC::StructureID::expandPropertyMapHashTable):
-        (JSC::StructureID::createPropertyMapHashTable):
-        (JSC::StructureID::rehashPropertyMapHashTable):
-        (JSC::comparePropertyMapEntryIndices):
-        (JSC::StructureID::getEnumerablePropertyNamesInternal):
-        * runtime/StructureID.h:
-        (JSC::StructureID::propertyStorageSize):
-        (JSC::StructureID::isEmpty):
-        (JSC::StructureID::get):
+        Reviewed by Sam Weinig.
 
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+        Use an empty identifier instead of a null identifier for parse
+        tokens without an identifier.
 
-        Reviewed by Oliver Hunt.
+        This helps encapsulate the null UStringImpl within UString.
 
-        Bug 21987: CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result register
-        <https://bugs.webkit.org/show_bug.cgi?id=21987>
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
 
-        CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result
-        register as ecx, but it should be tempReg1, which is ecx at all of its
-        callsites.
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        Build fix for make distcheck.
 
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+        * GNUmakefile.am:
 
-        Reviewed by Sam Weinig.
+2010-02-08  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Bug 21985: Opcodes should use eax as their destination register whenever possible
-        <https://bugs.webkit.org/show_bug.cgi?id=21985>
+        Unreviewed RVCT build fix.
 
-        Change more opcodes to use eax as the register for their final result,
-        and change calls to emitPutResult() that pass eax to rely on the default
-        value of eax.
+        Similar to r54391, don't import the cmath functions from std:: for RVCT.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
+        * wtf/MathExtras.h:
 
-2008-10-30  Alp Toker  <alp@nuanti.com>
+2010-02-05  Gavin Barraclough  <barraclough@apple.com>
 
-        Build fix attempt for older gcc on the trunk-mac-intel build bot
-        (error: initializer for scalar variable requires one element).
+        Reviewed by Geoff Garen.
 
-        Modify the initializer syntax slightly with an additional comma.
+        Change UStringImpl::create to CRASH if the string cannot be allocated,
+        rather than returning a null string (which will behave like a zero-length
+        string if used).
+
+        Also move createRep function from UString to become new overloaded
+        UStringImpl::create methods.  In doing so, bring their behaviour closer to
+        being in line with WebCore::StringImpl, in removing the behaviour that they
+        can be used to produce null UStrings (ASSERT the char* provided is non-null).
+        This behaviour of converting null C-strings to null UStrings is inefficient
+        (cmompared to just using UString::null()), incompatible with WebCore::StringImpl's
+        behaviour, and may generate unexpected behaviour, since in many cases a null
+        UString can be used like an empty string.
+
+        With these changes UStringImpl need not have a concept of null impls, we can
+        start transitioning this to become an implementation detail of UString, that
+        internally it chooses to use a null-object rather than an actually zero impl
+        pointer.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        (JSC::throwError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::rep):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-30  Alp Toker  <alp@nuanti.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Alexey Proskuryakov.
+        [BREWMP] Define SYSTEM_MALLOC 1
+        https://bugs.webkit.org/show_bug.cgi?id=34640
 
-        https://bugs.webkit.org/show_bug.cgi?id=21571
-        VoidPtrPair breaks CTI on Linux
+        Make BREWMP use system malloc because FastMalloc is not ported.
 
-        The VoidPtrPair return change made in r37457 does not work on Linux
-        since POD structs aren't passed in registers.
+        * wtf/Platform.h:
 
-        This patch uses a union to vectorize VoidPtrPair to a uint64_t and
-        matches Darwin/MSVC fixing CTI/WREC on Linux.
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
 
-        Alexey reports no measurable change in Mac performance with this fix.
+        Reviewed by Alexey Proskuryakov.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
-        * VM/Machine.h:
-        (JSC::):
+        Don't call CRASH() in fastMalloc and fastCalloc when the requested memory size is 0
+        https://bugs.webkit.org/show_bug.cgi?id=34569
 
-2008-10-29  Oliver Hunt  <oliver@apple.com>
+        With USE_SYSTEM_MALLOC=1, fastMalloc and fastCalloc call CRASH()
+        if the return value of malloc and calloc is 0.
+        
+        However, these functions can return 0 when the request size is 0.
+        Libc manual says, "If size is 0, then malloc() returns either NULL,
+        or a unique pointer value that can later be successfully passed to free()."
+        Though malloc returns a unique pointer in most systems,
+        0 can be returned in some systems. For instance, BREW's MALLOC returns 0
+        when size is 0.
 
-        Reviewed by Geoff Garen.
+        If malloc or calloc returns 0 due to allocation size, increase the size
+        to 1 and try again.
 
-        Initial work to reduce cost of JSNumberCell allocation
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
 
-        This does the initial work needed to bring more of number
-        allocation into CTI code directly, rather than just falling
-        back onto the slow paths if we can't guarantee that a number
-        cell can be reused.
+2010-02-04  Mark Rowe  <mrowe@apple.com>
 
-        Initial implementation only used by op_negate to make sure
-        it all works.  In a negate heavy (though not dominated) test
-        it results in a 10% win in the non-reusable cell case.
+        Reviewed by Timothy Hatcher.
 
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitAllocateNumber):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitArithIntToImmWithJump):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitUnaryOp):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::emitToJSNumber):
-        (JSC::CodeGenerator::emitTypeOf):
-        (JSC::CodeGenerator::emitGetPropertyNames):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Machine.h:
-        * kjs/ResultType.h:
-        (JSC::ResultType::isReusableNumber):
-        (JSC::ResultType::toInt):
-        * kjs/nodes.cpp:
-        (JSC::UnaryOpNode::emitCode):
-        (JSC::BinaryOpNode::emitCode):
-        (JSC::EqualNode::emitCode):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::negl_r):
-        (JSC::X86Assembler::xorpd_mr):
-        * runtime/JSNumberCell.h:
-        (JSC::JSNumberCell::JSNumberCell):
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
 
-2008-10-29  Steve Falkenburg  <sfalken@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj: Accommodate rename of script.
 
-        <rdar://problem/6326563> Crash on launch
+2010-02-04  Daniel Bates  <dbates@webkit.org>
 
-        For Windows, export explicit functions rather than exporting data for atomicallyInitializedStaticMutex.
-        
-        Exporting data from a DLL on Windows requires specifying __declspec(dllimport) in the header used by
-        callers, but __declspec(dllexport) when defined in the DLL implementation. By instead exporting
-        the explicit lock/unlock functions, we can avoid this.
-        
-        Fixes a crash on launch, since we were previously erroneously exporting atomicallyInitializedStaticMutex as a function.
-        
-        Reviewed by Darin Adler.
+        [Qt] Unreviewed, build fix for Qt bot.
 
-        * wtf/Threading.h:
-        (WTF::lockAtomicallyInitializedStaticMutex):
-        (WTF::unlockAtomicallyInitializedStaticMutex):
-        * wtf/ThreadingWin.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex):
-        (WTF::unlockAtomicallyInitializedStaticMutex):
+        * runtime/JSStringBuilder.h: Changed #include <X.h> notation #include "X.h".
 
-2008-10-29  Sam Weinig  <sam@webkit.org>
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Remove direct use of PropertyMap.
+        Clearing a WeakGCPtr is weird
+        https://bugs.webkit.org/show_bug.cgi?id=34627
 
-        * JavaScriptCore.exp:
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::mark):
-        (JSC::JSObject::put):
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        (JSC::JSObject::removeDirect):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::hasCustomProperties):
-        (JSC::JSObject::JSObject):
-        (JSC::JSObject::putDirect):
-        * runtime/PropertyMap.cpp:
-        (JSC::PropertyMap::get):
-        * runtime/PropertyMap.h:
-        (JSC::PropertyMap::isEmpty):
-        (JSC::PropertyMap::get):
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * runtime/StructureID.h:
-        (JSC::StructureID::propertyStorageSize):
-        (JSC::StructureID::get):
-        (JSC::StructureID::put):
-        (JSC::StructureID::remove):
-        (JSC::StructureID::isEmpty):
-
-2008-10-29  Sam Weinig  <sam@webkit.org>
+        Added a WeakGCPtr::clear interface.
+        
+        As discussed in https://bugs.webkit.org/show_bug.cgi?id=33383, the old
+        interface made it pretty weird for a client to conditionally clear a
+        WeakGCPtr, which is exactly what clients want to do when objects are
+        finalized.
 
-        Reviewed by Geoffrey Garen.
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype): Use the new WeakGCPtr::clear() interface. 
 
-        Rename and move the StructureID transition table to its own file.
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Added an interface for clearing a WeakGCPtr,
+        iff its current value is the value passed in. It's cumbersome for the
+        client to do this test, since WeakGCPtr sometimes pretends to be null.
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a header.
 
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition):
-        * runtime/StructureID.h:
-        (JSC::StructureID::):
-        * runtime/StructureIDTransitionTable.h: Copied from runtime/StructureID.h.
-        (JSC::StructureIDTransitionTableHash::hash):
-        (JSC::StructureIDTransitionTableHash::equal):
 
-2008-10-29  Sam Weinig  <sam@webkit.org>
+2010-02-04  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Oliver Hunt.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21958
-        Pack bits in StructureID to reduce the size of each StructureID by 2 words.
+        Add a JSStringBuilder class (similar-to, and derived-from StringBuilder) to
+        construct JSStrings, throwing a JS exception should we run out of memory whilst
+        allocating storage for the string.
 
-        * runtime/PropertyMap.h:
-        (JSC::PropertyMap::propertyMapSize):
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics): Add additional size statistics when dumping.
-        (JSC::StructureID::StructureID):
-        * runtime/StructureID.h:
+        Similarly, add jsMakeNontrivialString methods to use in cases where previously
+        we were calling makeString & passing the result to jsNontrivialString.  Again,
+        these new methods throw if we hit an out of memory condition.
 
-2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
+        Move throwOutOfMemoryError into ExceptionHelpers, to make it more widely available.
 
-        wx build fixes after addition of runtime and ImageBuffer changes.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSStringBuilder.h: Added.
+        (JSC::JSStringBuilder::releaseJSString):
+        (JSC::jsMakeNontrivialString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2010-02-04  Steve Falkenburg  <sfalken@apple.com>
 
-        * JavaScriptCoreSources.bkl:
-        * jscore.bkl:
+        Windows build fix.
 
-2008-10-29  Timothy Hatcher  <timothy@apple.com>
+        * wtf/MathExtras.h:
 
-        Emit the WillExecuteStatement debugger hook before the "else" body
-        when there is no block for the "else" body. This allows breakpoints
-        on those statements in the Web Inspector.
+2010-02-04  Darin Adler  <darin@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21944
+        Reviewed by David Levin.
 
-        Reviewed by Maciej Stachowiak.
+        Make MathExtras.h compatible with <cmath>
+        https://bugs.webkit.org/show_bug.cgi?id=34618
 
-        * kjs/nodes.cpp:
-        (JSC::IfElseNode::emitCode): Emit the WillExecuteStatement
-        debugger hook before the else node if isn't a block.
+        * wtf/MathExtras.h: Include <cmath> instead of <math.h>.
+        Use "using" as we do elsewhere in WTF for the four functions from <cmath>
+        we want to use without the prefix. Later we could consider making the std
+        explicit at call sites instead.
 
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+2010-02-04  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
 
-        Build fix.
+        Reviewed by Gavin Barraclough.
 
-        * JavaScriptCore.exp: Export HashTable::deleteTable().
+        Use an easily appendable structure for trampolines instead of pointer parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=34424
 
-2008-10-28  Alp Toker  <alp@nuanti.com>
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
 
-        Fix builddir != srcdir builds after kjs -> runtime breakage. Sources
-        may now be generated in both kjs/ and runtime/.
+2010-02-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Also sort the sources list for readability.
+        Reviewed by Simon Hausmann.
 
-        * GNUmakefile.am:
+        Increase test coverage for the QScriptValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34533
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::dataHelper):
+        (tst_QScriptValue::newRow):
+        (tst_QScriptValue::testHelper):
+        (tst_QScriptValue::ctor):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-28  Alp Toker  <alp@nuanti.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Cameron Zwarich.
+        [BREWMP] Define WTF_PLATFORM_BREWMP_SIMULATOR when AEE_SIMULATOR is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34514
 
-        Build fix attempt after kjs -> runtime rename.
+        PLATFORM(BREWMP_SIMULATOR) guard is needed to make distinction between BREWMP
+        and BREWMP simulator.
 
-        * GNUmakefile.am:
+        * wtf/Platform.h:
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
-        Not reviewed.
+        Reviewed by Eric Seidel.
 
-        Remove a duplicate includes directory.
+        [BREWMP] Remove COMPILE_ASSERT conflict with the underlying PLATFORM
+        https://bugs.webkit.org/show_bug.cgi?id=34190
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        COMPILE_ASSERT conflicts with the underlying PLATFORM because it is defined
+        both in WTF's Assertions.h and BREWMP's AEEClassIDs.h. Include AEEClassIDs.h
+        in Assertions.h and undef COMPILE_ASSERT to avoid redefining COMPILE_ASSERT.
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/Assertions.h:
 
-        Not reviewed.
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
-        Attempt to fix the Windows build.
+        Reviewed by Eric Seidel.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        [BREWMP] Implement OwnPtrBrew to make sure BREW instances are freed.
+        https://bugs.webkit.org/show_bug.cgi?id=34518
+
+        Add OwnPtrBrew to release IFile, IFileMgr and IBitmap instances.
+
+        * wtf/brew/OwnPtrBrew.cpp: Added.
+        (WTF::IFileMgr):
+        (WTF::IFile):
+        (WTF::IBitmap):
+        (WTF::freeOwnedPtrBrew):
+        * wtf/brew/OwnPtrBrew.h: Added.
+        (WTF::OwnPtrBrew::OwnPtrBrew):
+        (WTF::OwnPtrBrew::~OwnPtrBrew):
+        (WTF::OwnPtrBrew::get):
+        (WTF::OwnPtrBrew::release):
+        (WTF::OwnPtrBrew::outPtr):
+        (WTF::OwnPtrBrew::set):
+        (WTF::OwnPtrBrew::clear):
+        (WTF::OwnPtrBrew::operator*):
+        (WTF::OwnPtrBrew::operator->):
+        (WTF::OwnPtrBrew::operator!):
+        (WTF::OwnPtrBrew::operator UnspecifiedBoolType):
+        (WTF::OwnPtrBrew::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
 
-2008-10-28  Dan Bernstein  <mitz@apple.com>
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Darin Adler.
 
-        - export WTF::atomicallyInitializedStaticMutex
+        Export WTF::fastStrDup symbol
+        https://bugs.webkit.org/show_bug.cgi?id=34526
 
         * JavaScriptCore.exp:
 
-2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+2010-02-03  Kevin Watters  <kevinwatters@gmail.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Kevin Ollivier.
+
+        [wx] Enable JIT compilation for wx.
         
-        Fixed CodeBlock dumping to accurately report constant register indices.
+        https://bugs.webkit.org/show_bug.cgi?id=34536
 
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
+        * wtf/Platform.h:
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+2010-02-02  Oliver Hunt  <oliver@apple.com>
 
-        Not reviewed.
+        Reviewed by Geoffrey Garen.
 
-        More Qt build fixes.
+        Crash in CollectorBitmap::get at nbcolympics.com
+        https://bugs.webkit.org/show_bug.cgi?id=34504
+
+        This was caused by the use of m_offset to determine the offset of
+        a new property into the property storage.  This patch corrects
+        the effected cases by incorporating the anonymous slot count. It
+        also removes the duplicate copy of anonymous slot count from the
+        property table as keeping this up to date merely increased the
+        chance of a mismatch.  Finally I've added a large number of
+        assertions in an attempt to prevent such a bug from happening
+        again.
+
+        With the new assertions in place the existing anonymous slot tests
+        all fail without the m_offset fixes.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
 
-        * JavaScriptCore.pri:
+        Reviewed by Darin Adler.
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
 
-        Not reviewed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
 
-        Fix the Qt build, hopefully for real this time.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        * JavaScriptCore.pri:
+        Reviewed by Eric Seidel.
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+        [BREWMP] Add dummy main thread functions
+        https://bugs.webkit.org/show_bug.cgi?id=33569
 
-        Not reviewed.
+        Add dummy initializeMainThreadPlatform and
+        scheduleDispatchFunctionsOnMainThread.
 
-        Fix the Qt build.
+        * wtf/brew/MainThreadBrew.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
 
-        * JavaScriptCore.pri:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Darin Adler.
 
-        Not reviewed.
+        Add using WTF::getLocalTime to CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=34493
 
-        Fix the Windows build.
+        * wtf/CurrentTime.h:
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Eric Seidel.
 
-        Rubber-stamped by Sam Weinig.
+        [BREWMP] Add HAVE_XXX definitions
+        https://bugs.webkit.org/show_bug.cgi?id=34414
 
-        Create a runtime directory in JavaScriptCore and begin moving files to
-        it. This is the first step towards removing the kjs directory and
-        placing files in more meaningful subdirectories of JavaScriptCore.
+        Add HAVE_ERRNO_H=1
 
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSClassRef.cpp:
-        * API/JSClassRef.h:
-        * API/JSStringRefCF.cpp:
-        * API/JSValueRef.cpp:
-        * API/OpaqueJSString.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp:
-        * kjs/ArrayConstructor.cpp: Removed.
-        * kjs/ArrayConstructor.h: Removed.
-        * kjs/ArrayPrototype.cpp: Removed.
-        * kjs/ArrayPrototype.h: Removed.
-        * kjs/BooleanConstructor.cpp: Removed.
-        * kjs/BooleanConstructor.h: Removed.
-        * kjs/BooleanObject.cpp: Removed.
-        * kjs/BooleanObject.h: Removed.
-        * kjs/BooleanPrototype.cpp: Removed.
-        * kjs/BooleanPrototype.h: Removed.
-        * kjs/CallData.cpp: Removed.
-        * kjs/CallData.h: Removed.
-        * kjs/ClassInfo.h: Removed.
-        * kjs/ConstructData.cpp: Removed.
-        * kjs/ConstructData.h: Removed.
-        * kjs/DateConstructor.cpp: Removed.
-        * kjs/DateConstructor.h: Removed.
-        * kjs/DateInstance.cpp: Removed.
-        * kjs/DateInstance.h: Removed.
-        * kjs/DateMath.cpp: Removed.
-        * kjs/DateMath.h: Removed.
-        * kjs/DatePrototype.cpp: Removed.
-        * kjs/DatePrototype.h: Removed.
-        * kjs/Error.cpp: Removed.
-        * kjs/Error.h: Removed.
-        * kjs/ErrorConstructor.cpp: Removed.
-        * kjs/ErrorConstructor.h: Removed.
-        * kjs/ErrorInstance.cpp: Removed.
-        * kjs/ErrorInstance.h: Removed.
-        * kjs/ErrorPrototype.cpp: Removed.
-        * kjs/ErrorPrototype.h: Removed.
-        * kjs/FunctionConstructor.cpp: Removed.
-        * kjs/FunctionConstructor.h: Removed.
-        * kjs/FunctionPrototype.cpp: Removed.
-        * kjs/FunctionPrototype.h: Removed.
-        * kjs/GlobalEvalFunction.cpp: Removed.
-        * kjs/GlobalEvalFunction.h: Removed.
-        * kjs/InternalFunction.cpp: Removed.
-        * kjs/InternalFunction.h: Removed.
-        * kjs/JSArray.cpp: Removed.
-        * kjs/JSArray.h: Removed.
-        * kjs/JSCell.cpp: Removed.
-        * kjs/JSCell.h: Removed.
-        * kjs/JSFunction.cpp: Removed.
-        * kjs/JSFunction.h: Removed.
-        * kjs/JSGlobalObject.cpp: Removed.
-        * kjs/JSGlobalObject.h: Removed.
-        * kjs/JSGlobalObjectFunctions.cpp: Removed.
-        * kjs/JSGlobalObjectFunctions.h: Removed.
-        * kjs/JSImmediate.cpp: Removed.
-        * kjs/JSImmediate.h: Removed.
-        * kjs/JSNotAnObject.cpp: Removed.
-        * kjs/JSNotAnObject.h: Removed.
-        * kjs/JSNumberCell.cpp: Removed.
-        * kjs/JSNumberCell.h: Removed.
-        * kjs/JSObject.cpp: Removed.
-        * kjs/JSObject.h: Removed.
-        * kjs/JSString.cpp: Removed.
-        * kjs/JSString.h: Removed.
-        * kjs/JSValue.cpp: Removed.
-        * kjs/JSValue.h: Removed.
-        * kjs/JSVariableObject.cpp: Removed.
-        * kjs/JSVariableObject.h: Removed.
-        * kjs/JSWrapperObject.cpp: Removed.
-        * kjs/JSWrapperObject.h: Removed.
-        * kjs/MathObject.cpp: Removed.
-        * kjs/MathObject.h: Removed.
-        * kjs/NativeErrorConstructor.cpp: Removed.
-        * kjs/NativeErrorConstructor.h: Removed.
-        * kjs/NativeErrorPrototype.cpp: Removed.
-        * kjs/NativeErrorPrototype.h: Removed.
-        * kjs/NumberConstructor.cpp: Removed.
-        * kjs/NumberConstructor.h: Removed.
-        * kjs/NumberObject.cpp: Removed.
-        * kjs/NumberObject.h: Removed.
-        * kjs/NumberPrototype.cpp: Removed.
-        * kjs/NumberPrototype.h: Removed.
-        * kjs/ObjectConstructor.cpp: Removed.
-        * kjs/ObjectConstructor.h: Removed.
-        * kjs/ObjectPrototype.cpp: Removed.
-        * kjs/ObjectPrototype.h: Removed.
-        * kjs/PropertyMap.cpp: Removed.
-        * kjs/PropertyMap.h: Removed.
-        * kjs/PropertySlot.cpp: Removed.
-        * kjs/PropertySlot.h: Removed.
-        * kjs/PrototypeFunction.cpp: Removed.
-        * kjs/PrototypeFunction.h: Removed.
-        * kjs/PutPropertySlot.h: Removed.
-        * kjs/SmallStrings.cpp: Removed.
-        * kjs/SmallStrings.h: Removed.
-        * kjs/StringConstructor.cpp: Removed.
-        * kjs/StringConstructor.h: Removed.
-        * kjs/StringObject.cpp: Removed.
-        * kjs/StringObject.h: Removed.
-        * kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
-        * kjs/StringPrototype.cpp: Removed.
-        * kjs/StringPrototype.h: Removed.
-        * kjs/StructureID.cpp: Removed.
-        * kjs/StructureID.h: Removed.
-        * kjs/completion.h:
-        * kjs/interpreter.h:
-        * runtime: Added.
-        * runtime/ArrayConstructor.cpp: Copied from kjs/ArrayConstructor.cpp.
-        * runtime/ArrayConstructor.h: Copied from kjs/ArrayConstructor.h.
-        * runtime/ArrayPrototype.cpp: Copied from kjs/ArrayPrototype.cpp.
-        * runtime/ArrayPrototype.h: Copied from kjs/ArrayPrototype.h.
-        * runtime/BooleanConstructor.cpp: Copied from kjs/BooleanConstructor.cpp.
-        * runtime/BooleanConstructor.h: Copied from kjs/BooleanConstructor.h.
-        * runtime/BooleanObject.cpp: Copied from kjs/BooleanObject.cpp.
-        * runtime/BooleanObject.h: Copied from kjs/BooleanObject.h.
-        * runtime/BooleanPrototype.cpp: Copied from kjs/BooleanPrototype.cpp.
-        * runtime/BooleanPrototype.h: Copied from kjs/BooleanPrototype.h.
-        * runtime/CallData.cpp: Copied from kjs/CallData.cpp.
-        * runtime/CallData.h: Copied from kjs/CallData.h.
-        * runtime/ClassInfo.h: Copied from kjs/ClassInfo.h.
-        * runtime/ConstructData.cpp: Copied from kjs/ConstructData.cpp.
-        * runtime/ConstructData.h: Copied from kjs/ConstructData.h.
-        * runtime/DateConstructor.cpp: Copied from kjs/DateConstructor.cpp.
-        * runtime/DateConstructor.h: Copied from kjs/DateConstructor.h.
-        * runtime/DateInstance.cpp: Copied from kjs/DateInstance.cpp.
-        * runtime/DateInstance.h: Copied from kjs/DateInstance.h.
-        * runtime/DateMath.cpp: Copied from kjs/DateMath.cpp.
-        * runtime/DateMath.h: Copied from kjs/DateMath.h.
-        * runtime/DatePrototype.cpp: Copied from kjs/DatePrototype.cpp.
-        * runtime/DatePrototype.h: Copied from kjs/DatePrototype.h.
-        * runtime/Error.cpp: Copied from kjs/Error.cpp.
-        * runtime/Error.h: Copied from kjs/Error.h.
-        * runtime/ErrorConstructor.cpp: Copied from kjs/ErrorConstructor.cpp.
-        * runtime/ErrorConstructor.h: Copied from kjs/ErrorConstructor.h.
-        * runtime/ErrorInstance.cpp: Copied from kjs/ErrorInstance.cpp.
-        * runtime/ErrorInstance.h: Copied from kjs/ErrorInstance.h.
-        * runtime/ErrorPrototype.cpp: Copied from kjs/ErrorPrototype.cpp.
-        * runtime/ErrorPrototype.h: Copied from kjs/ErrorPrototype.h.
-        * runtime/FunctionConstructor.cpp: Copied from kjs/FunctionConstructor.cpp.
-        * runtime/FunctionConstructor.h: Copied from kjs/FunctionConstructor.h.
-        * runtime/FunctionPrototype.cpp: Copied from kjs/FunctionPrototype.cpp.
-        * runtime/FunctionPrototype.h: Copied from kjs/FunctionPrototype.h.
-        * runtime/GlobalEvalFunction.cpp: Copied from kjs/GlobalEvalFunction.cpp.
-        * runtime/GlobalEvalFunction.h: Copied from kjs/GlobalEvalFunction.h.
-        * runtime/InternalFunction.cpp: Copied from kjs/InternalFunction.cpp.
-        * runtime/InternalFunction.h: Copied from kjs/InternalFunction.h.
-        * runtime/JSArray.cpp: Copied from kjs/JSArray.cpp.
-        * runtime/JSArray.h: Copied from kjs/JSArray.h.
-        * runtime/JSCell.cpp: Copied from kjs/JSCell.cpp.
-        * runtime/JSCell.h: Copied from kjs/JSCell.h.
-        * runtime/JSFunction.cpp: Copied from kjs/JSFunction.cpp.
-        * runtime/JSFunction.h: Copied from kjs/JSFunction.h.
-        * runtime/JSGlobalObject.cpp: Copied from kjs/JSGlobalObject.cpp.
-        * runtime/JSGlobalObject.h: Copied from kjs/JSGlobalObject.h.
-        * runtime/JSGlobalObjectFunctions.cpp: Copied from kjs/JSGlobalObjectFunctions.cpp.
-        * runtime/JSGlobalObjectFunctions.h: Copied from kjs/JSGlobalObjectFunctions.h.
-        * runtime/JSImmediate.cpp: Copied from kjs/JSImmediate.cpp.
-        * runtime/JSImmediate.h: Copied from kjs/JSImmediate.h.
-        * runtime/JSNotAnObject.cpp: Copied from kjs/JSNotAnObject.cpp.
-        * runtime/JSNotAnObject.h: Copied from kjs/JSNotAnObject.h.
-        * runtime/JSNumberCell.cpp: Copied from kjs/JSNumberCell.cpp.
-        * runtime/JSNumberCell.h: Copied from kjs/JSNumberCell.h.
-        * runtime/JSObject.cpp: Copied from kjs/JSObject.cpp.
-        * runtime/JSObject.h: Copied from kjs/JSObject.h.
-        * runtime/JSString.cpp: Copied from kjs/JSString.cpp.
-        * runtime/JSString.h: Copied from kjs/JSString.h.
-        * runtime/JSValue.cpp: Copied from kjs/JSValue.cpp.
-        * runtime/JSValue.h: Copied from kjs/JSValue.h.
-        * runtime/JSVariableObject.cpp: Copied from kjs/JSVariableObject.cpp.
-        * runtime/JSVariableObject.h: Copied from kjs/JSVariableObject.h.
-        * runtime/JSWrapperObject.cpp: Copied from kjs/JSWrapperObject.cpp.
-        * runtime/JSWrapperObject.h: Copied from kjs/JSWrapperObject.h.
-        * runtime/MathObject.cpp: Copied from kjs/MathObject.cpp.
-        * runtime/MathObject.h: Copied from kjs/MathObject.h.
-        * runtime/NativeErrorConstructor.cpp: Copied from kjs/NativeErrorConstructor.cpp.
-        * runtime/NativeErrorConstructor.h: Copied from kjs/NativeErrorConstructor.h.
-        * runtime/NativeErrorPrototype.cpp: Copied from kjs/NativeErrorPrototype.cpp.
-        * runtime/NativeErrorPrototype.h: Copied from kjs/NativeErrorPrototype.h.
-        * runtime/NumberConstructor.cpp: Copied from kjs/NumberConstructor.cpp.
-        * runtime/NumberConstructor.h: Copied from kjs/NumberConstructor.h.
-        * runtime/NumberObject.cpp: Copied from kjs/NumberObject.cpp.
-        * runtime/NumberObject.h: Copied from kjs/NumberObject.h.
-        * runtime/NumberPrototype.cpp: Copied from kjs/NumberPrototype.cpp.
-        * runtime/NumberPrototype.h: Copied from kjs/NumberPrototype.h.
-        * runtime/ObjectConstructor.cpp: Copied from kjs/ObjectConstructor.cpp.
-        * runtime/ObjectConstructor.h: Copied from kjs/ObjectConstructor.h.
-        * runtime/ObjectPrototype.cpp: Copied from kjs/ObjectPrototype.cpp.
-        * runtime/ObjectPrototype.h: Copied from kjs/ObjectPrototype.h.
-        * runtime/PropertyMap.cpp: Copied from kjs/PropertyMap.cpp.
-        * runtime/PropertyMap.h: Copied from kjs/PropertyMap.h.
-        * runtime/PropertySlot.cpp: Copied from kjs/PropertySlot.cpp.
-        * runtime/PropertySlot.h: Copied from kjs/PropertySlot.h.
-        * runtime/PrototypeFunction.cpp: Copied from kjs/PrototypeFunction.cpp.
-        * runtime/PrototypeFunction.h: Copied from kjs/PrototypeFunction.h.
-        * runtime/PutPropertySlot.h: Copied from kjs/PutPropertySlot.h.
-        * runtime/SmallStrings.cpp: Copied from kjs/SmallStrings.cpp.
-        * runtime/SmallStrings.h: Copied from kjs/SmallStrings.h.
-        * runtime/StringConstructor.cpp: Copied from kjs/StringConstructor.cpp.
-        * runtime/StringConstructor.h: Copied from kjs/StringConstructor.h.
-        * runtime/StringObject.cpp: Copied from kjs/StringObject.cpp.
-        * runtime/StringObject.h: Copied from kjs/StringObject.h.
-        * runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from kjs/StringObjectThatMasqueradesAsUndefined.h.
-        * runtime/StringPrototype.cpp: Copied from kjs/StringPrototype.cpp.
-        * runtime/StringPrototype.h: Copied from kjs/StringPrototype.h.
-        * runtime/StructureID.cpp: Copied from kjs/StructureID.cpp.
-        * runtime/StructureID.h: Copied from kjs/StructureID.h.
-
-2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+        * wtf/Platform.h:
 
-        Reviewed by Sam Weinig.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21919
-        Sampler reports bogus time in op_enter during 3d-raytrace.js
-        
-        Fixed a bug where we would pass the incorrect Instruction* during some
-        parts of CTI codegen.
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::run):
-        * wtf/Platform.h:
+        Reviewed by Eric Seidel.
 
-2008-10-28  Kevin McCullough  <kmccullough@apple.com>
+        [BREWMP] Don't define HAVE_TM_GMTOFF, HAVE_TM_ZONE and HAVE_TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=34388
 
-        Reviewed by Dan Bernstein.
+        BREWMP does not have these features.
 
-        -Removed unused includes.
-        Apparent .4% speedup in Sunspider
+        * wtf/Platform.h:
 
-        * kjs/JSObject.cpp:
-        * kjs/interpreter.cpp:
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
 
-2008-10-28  Alp Toker  <alp@nuanti.com>
+        Reviewed by Eric Seidel.
 
-        Include copyright license files in the autotools dist target.
+        [BREWMP] Define WTF_PLATFORM_BREWMP=1 when BUILDING_BREWMP is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34386
 
-        Change suggested by Mike Hommey.
+        Define WTF_PLATFORM_BREWMP=1 so that PLATFORM(BREWMP) guard can be used.
 
-        * GNUmakefile.am:
+        * wtf/Platform.h:
 
-2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+2010-02-01  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Maciej Stachowiak.
-        
-        Stop discarding CodeBlock samples that can't be charged to a specific
-        opcode. Instead, charge the relevant CodeBlock, and provide a footnote
-        explaining the situation.
-        
-        This will help us tell which CodeBlocks are hot, even if we can't
-        identify specific lines of code within the CodeBlocks.
+        Reviewed by Darin Adler.
 
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample):
-        (JSC::compareScopeSampleRecords):
-        (JSC::SamplingTool::dump):
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
 
-        * VM/SamplingTool.h:
-        (JSC::ScopeSampleRecord::ScopeSampleRecord):
-        (JSC::ScopeSampleRecord::~ScopeSampleRecord):
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
 
-2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
 
-        Reviewed by Sam Weinig.
-        
-        Added a mutex around the SamplingTool's ScopeNode* map, to solve a crash
-        when sampling the v8 tests.
+2010-02-01  Kent Tamura  <tkent@chromium.org>
 
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::run):
-        (JSC::SamplingTool::notifyOfScope):
-        * VM/SamplingTool.h: Since new ScopeNodes can be created after
-        the SamplingTools has begun sampling, reads and writes to / from the
-        map need to be synchronized. Shark says this doesn't measurably increase
-        sampling overhead.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Provide a dummy value to the
-        HostCallRecord in CTI non-sampling builds, to silence compiler warning.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::encodeSample): Explicitly cast bool to int, to
-        silence compiler warning.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig, with Gavin Barraclough's help.
-        
-        Fixed Sampling Tool:
-            - Made CodeBlock sampling work with CTI
-            - Improved accuracy by unifying most sampling data into a single
-              32bit word, which can be written / read atomically.
-            - Split out three different #ifdefs for modularity: OPCODE_SAMPLING;
-              CODEBLOCK_SAMPLING; OPCODE_STATS.
-            - Improved reporting clarity
-            - Refactored for code clarity
-
-        * JavaScriptCore.exp: Exported another symbol.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h: Updated CTI codegen to use the unified SamplingTool interface
-        for encoding samples. (This required passing the current vPC to a lot
-        more functions, since the unified interface samples the current vPC.)
-        Added hooks for writing the current CodeBlock* on function entry and
-        after a function call, for the sake of the CodeBlock sampler. Removed
-        obsolete hook for clearing the current sample inside op_end. Also removed
-        the custom enum used to differentiate flavors of op_call, since the
-        OpcodeID enum works just as well. (This was important in an earlier
-        version of the patch, but now it's just cleanup.)
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::lineNumberForVPC):
-        * VM/CodeBlock.h: Upated for refactored #ifdefs. Changed lineNumberForVPC
-        to be robust against vPCs not recorded for exception handling, since
-        the Sampler may ask for an arbitrary vPC.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        * VM/Machine.h:
-        (JSC::Machine::setSampler):
-        (JSC::Machine::sampler):
-        (JSC::Machine::jitCodeBuffer): Upated for refactored #ifdefs. Changed
-        Machine to use SamplingTool helper objects to record movement in and
-        out of host code. This makes samples a bit more precise.
-        
-        * VM/Opcode.cpp:
-        (JSC::OpcodeStats::~OpcodeStats):
-        * VM/Opcode.h: Upated for refactored #ifdefs. Added a little more padding,
-        to accomodate our more verbose opcode names.
-
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample): Only count a sample toward our total
-        if we actually record it. This solves cases where a CodeBlock will
-        claim to have been sampled many times, with reported samples that don't
-        match.
-
-        (JSC::SamplingTool::run): Read the current sample into a Sample helper
-        object, to ensure that the data doesn't change while we're analyzing it,
-        and to help decode the data. Only access the CodeBlock sampling hash
-        table if CodeBlock sampling has been enabled, so non-CodeBlock sampling
-        runs can operate with even less overhead.
-
-        (JSC::SamplingTool::dump): I reorganized this code a lot to print the
-        most important info at the top, print as a table, annotate and document
-        the stuff I didn't understand when I started, etc.
-
-        * VM/SamplingTool.h: New helper classes, described above.
-
-        * kjs/Parser.h:
-        * kjs/Shell.cpp:
-        (runWithScripts):
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode): Updated for new sampling APIs.
+        Reviewed by Darin Adler.
 
-        * wtf/Platform.h: Moved sampling #defines here, since our custom is to
-        put ENABLE #defines into Platform.h. Made explicit the fact that
-        CODEBLOCK_SAMPLING depends on OPCODE_SAMPLING.
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
 
-2008-10-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
 
-        JSC Build fix, not reviewed.
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
 
-        * VM/CTI.cpp: add missing include stdio.h for debug builds
+        Reviewed by Eric Seidel.
 
-2008-10-24  Eric Seidel  <eric@webkit.org>
+        [BREWMP] Port WTF's currentTime
+        https://bugs.webkit.org/show_bug.cgi?id=33567
 
-        Reviewed by Darin Adler.
-        
-        Get rid of a bonus ASSERT when using a null string as a regexp.
-        Specifically calling: RegularExpression::match() with String::empty()
-        will hit this ASSERT.
-        Chromium hits this, but I don't know of any way to make a layout test.
+        Combine GETUTCSECONDS and GETTIMEMS to calculate the number
+        of milliseconds since 1970/01/01 00:00:00 UTC.
 
-        * pcre/pcre_exec.cpp:
-        (jsRegExpExecute):
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
 
-2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
 
-        Suggested and rubber-stamped by Geoff Garen.
+        Reviewed by Darin Adler.
 
-        Fix a crash when opening Font Picker.
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
 
-        The change also hopefully fixes this bug, which I could never reproduce:
-        https://bugs.webkit.org/show_bug.cgi?id=20241
-        <rdar://problem/6290576> Safari crashes at JSValueUnprotect() when fontpicker view close
+        * wtf/Platform.h:
 
-        * API/JSContextRef.cpp: (JSContextGetGlobalObject): Use lexical global object instead of
-        dynamic one.
+2010-02-01  Oliver Hunt  <oliver@apple.com>
 
-2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Geoff Garen.
+        Structure not accounting for anonymous slots when computing property storage size
+        https://bugs.webkit.org/show_bug.cgi?id=34441
 
-        Remove ScopeChainNode::bottom() and inline it into its only caller,
-        ScopeChainnode::globalObject().
+        Previously any Structure with anonymous storage would have a property map, so we
+        were only including anonymous slot size if there was a property map.  Given this
+        is no longer the case we should always include the anonymous slot count in the
+        property storage size.
 
-        * kjs/JSGlobalObject.h:
-        (JSC::ScopeChainNode::globalObject):
-        * kjs/ScopeChain.h:
-        (JSC::ScopeChain::bottom):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
 
-2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+2010-02-01  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Windows build fix, update exports file (again)
 
-        Bug 21862: Create JSFunction prototype property lazily
-        <https://bugs.webkit.org/show_bug.cgi?id=21862>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        This is a 1.5% speedup on SunSpider and a 1.4% speedup on the V8
-        benchmark suite, including a 3.8% speedup on Earley-Boyer.
+2010-02-01  Oliver Hunt  <oliver@apple.com>
 
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::getOwnPropertySlot):
-        * kjs/nodes.cpp:
-        (JSC::FuncDeclNode::makeFunction):
-        (JSC::FuncExprNode::makeFunction):
+        Windows build fix, update exports file
 
-2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Reviewed by Sam Weinig.
+2010-01-31  Oliver Hunt  <oliver@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
+        Reviewed by Maciej Stachowiak.
 
-        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+        JSC is failing to propagate anonymous slot count on some transitions
+        https://bugs.webkit.org/show_bug.cgi?id=34321
 
-2008-10-24  Darin Adler  <darin@apple.com>
+        Remove secondary Structure constructor, and make Structure store a copy
+        of the number of anonymous slots directly so saving an immediate allocation
+        of a property map for all structures with anonymous storage, which also
+        avoids the leaked property map on new property transition in the original
+        version of this patch.
 
-        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
+        We need to propagate the the anonymous slot count otherwise we can end up
+        with a structure recording incorrect information about the available and
+        needed space for property storage, or alternatively incorrectly reusing
+        some slots.
 
-        * API/APICast.h:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSValueRef.cpp:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Register.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DatePrototype.h:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/FunctionPrototype.h:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/InternalFunction.h:
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/PropertyMap.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpMatchesArray.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/Shell.cpp:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/grammar.y:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.h:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * profiler/ProfileGenerator.cpp:
-        * profiler/Profiler.cpp:
-        * profiler/Profiler.h:
-        Use JSValue* instead of JSValuePtr.
+        * JavaScriptCore.exp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::hasAnonymousSlots):
+        (JSC::Structure::anonymousSlotCount):
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
 
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
+        Reviewed by Darin Adler.
 
-        Rolled out r37840.
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
 
-        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h:
 
-2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
+2010-01-31  Kent Tamura  <tkent@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
 
-        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
 
-2008-10-23  David Kilzer  <ddkilzer@apple.com>
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
 
-        Bug 21832: Fix scripts using 'new File::Temp' for Perl 5.10
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
 
-        <https://bugs.webkit.org/show_bug.cgi?id=21832>
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Sam Weinig.
+        Sort Xcode projects.
 
-        * pcre/dftables: Use imported tempfile() from File::Temp instead of
-        'new File::Temp' to make the script work with Perl 5.10.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-2008-10-23  Gavin Barraclough  <barraclough@apple.com>
+2010-01-29  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Fix the Mac build.
 
-        Fix hideous pathological case performance when looking up repatch info, bug #21727.
-
-        When repatching JIT code to optimize we look up records providing information about
-        the generated code (also used to track recsources used in linking to be later released). 
-        The lookup was being performed using a linear scan of all such records.
-
-        (1) Split up the different types of reptach information.  This means we can search them
-            separately, and in some cases should reduce their size.
-        (2) In the case of property accesses, search with a binary chop over the data.
-        (3) In the case of calls, pass a pointer to the repatch info into the relink function.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::unlinkCall):
-        (JSC::CTI::linkCall):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::unlinkCallers):
-        (JSC::CodeBlock::derefStructureIDs):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CallLinkInfo::CallLinkInfo):
-        (JSC::CallLinkInfo::setUnlinked):
-        (JSC::CallLinkInfo::isLinked):
-        (JSC::getStructureStubInfoReturnLocation):
-        (JSC::binaryChop):
-        (JSC::CodeBlock::addCaller):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitResolve):
-        (JSC::CodeGenerator::emitGetById):
-        (JSC::CodeGenerator::emitPutById):
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_vm_lazyLinkCall):
-
-2008-10-23  Peter Kasting  <pkasting@google.com>
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
 
-        Reviewed by Adam Roben.
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21833
-        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
+        * Configurations/FeatureDefines.xcconfig:
 
-        * wtf/Platform.h:
+2010-01-29  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2008-10-23  David Kilzer  <ddkilzer@apple.com>
+        Rubber-stamped by Maciej Stachowiak.
 
-        Bug 21831: Fix create_hash_table for Perl 5.10
+        Fix the ARM build.
 
-        <https://bugs.webkit.org/show_bug.cgi?id=21831>
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure): Call the right Structure::create overload.
 
-        Reviewed by Sam Weinig.
+2010-01-28  Kevin Ollivier  <kevino@theolliviers.com>
 
-        * kjs/create_hash_table: Escaped square brackets so that Perl 5.10
-        doesn't try to use @nameEntries.
+        [wx] Build fix for MSW, use ThreadingWin.cpp as the Windows pthreads implementation
+        implements pthread_t in a way that makes it impossible to check its validity,
+        which is needed by ThreadingPthreads.cpp.
 
-2008-10-23  Darin Adler  <darin@apple.com>
+        * wscript:
 
-        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
-          to remove the JSValuePtr class, to fix two problems
+2010-01-28  Oliver Hunt  <oliver@apple.com>
 
-            1) slowness under MSVC, since it doesn't handle a
-               class with a single pointer in it as efficiently
-               as a pointer
+        Reviewed by Gavin Barraclough.
 
-            2) uninitialized pointers in Vector
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
 
-        * JavaScriptCore.exp: Updated.
+        Make getAnonymousValue const-friendly
 
-        * API/APICast.h:
-        (toRef):
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::addConstant):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::JSValueHashTraits::constructDeletedValue):
-        (JSC::CodeGenerator::JSValueHashTraits::isDeletedValue):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_vm_throw):
-        Removed calls to payload functions.
-
-        * VM/Register.h:
-        (JSC::Register::Register): Removed overload for JSCell and call
-        to payload function.
-
-        * kjs/JSCell.h: Changed JSCell to derive from JSValue again.
-        Removed JSValuePtr constructor.
-        (JSC::asCell): Changed cast from reinterpret_cast to static_cast.
-
-        * kjs/JSImmediate.h: Removed JSValuePtr class. Added typedef back.
-
-        * kjs/JSValue.h:
-        (JSC::JSValue::JSValue): Added empty protected inline constructor back.
-        (JSC::JSValue::~JSValue): Same for destructor.
-        Removed == and != operator for JSValuePtr.
-
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::PropertySlot): Chnaged argument to const JSValue*
-        and added a const_cast.
-
-        * kjs/protect.h: Removed overloads and specialization for JSValuePtr.
-
-2008-10-22  Oliver Hunt  <oliver@apple.com>
+        * runtime/JSObject.h:
+        (JSC::JSObject::getAnonymousValue):
 
-        Reviewed by Maciej Stachowiak.
+2010-01-28  Oliver Hunt  <oliver@apple.com>
 
-        Really "fix" CTI mode on windows 2k3.
+        Reviewed by Gavin Barraclough.
 
-        This adds new methods fastMallocExecutable and fastFreeExecutable
-        to wrap allocation for cti code.  This still just makes fastMalloc
-        return executable memory all the time, which will be fixed in a
-        later patch.
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
 
-        However in windows debug builds all executable allocations will be
-        allocated on separate executable pages, which should resolve any
-        remaining 2k3 issues.  Conveniently the 2k3 bot will now also fail
-        if there are any fastFree vs. fastFreeExecutable errors.
+        A class must now specify the number of slots it needs at construction time
+        rather than later on with a transition.  This makes many things simpler,
+        we no longer need to need an additional transition on object creation to
+        add the anonymous slots, and we remove the need for a number of transition
+        type checks. 
 
-        * ChangeLog:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        * kjs/regexp.cpp:
-        (JSC::RegExp::~RegExp):
-        * masm/X86Assembler.h:
-        (JSC::JITCodeBuffer::copy):
-        * wtf/FastMalloc.cpp:
-        (WTF::fastMallocExecutable):
-        (WTF::fastFreeExecutable):
-        (WTF::TCMallocStats::fastMallocExecutable):
-        (WTF::TCMallocStats::fastFreeExecutable):
-        * wtf/FastMalloc.h:
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::Fiber::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::anonymousSlotCount):
+        * runtime/StructureTransitionTable.h:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
 
-2008-10-22  Darin Adler  <darin@apple.com>
+        Windows build fix.
 
-        Reviewed by Sam Weinig.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
-          Bug 21294: Devirtualize getOwnPropertySlot()
+2010-01-27  Oliver Hunt  <oliver@apple.com>
 
-        A bit over 3% faster on V8 tests.
+        Reviewed by Maciej Stachowiak.
 
-        * JavascriptCore.exp: Export leak-related functions..
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
 
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructureID): Set HasStandardGetOwnPropertySlot
-        since this class doesn't override getPropertySlot.
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructureID): Ditto.
-
-        * VM/ExceptionHelpers.cpp:
-        (JSC::InterruptedExecutionError::InterruptedExecutionError): Use a structure
-        that's created just for this class instead of trying to share a single "null
-        prototype" structure.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_create_arguments_no_params): Rename
-        Arguments::ArgumentsNoParameters to Arguments::NoParameters.
-        
-        * kjs/Arguments.h: Rename the enum from Arguments::ArgumentsParameters to
-        Arguments::NoParametersType and the value from Arguments::ArgumentsNoParameters
-        to Arguments::NoParameters.
-        (JSC::Arguments::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        (JSC::Arguments::Arguments): Added an assertion that there are no parameters.
-
-        * kjs/DatePrototype.h:
-        (JSC::DatePrototype::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructureID): Set HasStandardGetOwnPropertySlot
-        since this class doesn't override getPropertySlot.
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::createStructureID): Ditto.
-
-        * kjs/JSArray.h:
-        (JSC::JSArray::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSCell.h: Added declaration of fastGetOwnPropertySlot; a non-virtual
-        version that uses the structure bit to decide whether to call the virtual
-        version.
-
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Initialize new structures; removed
-        nullProtoStructureID.
-        * kjs/JSGlobalData.h: Added new structures. Removed nullProtoStructureID.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSNotAnObject.h:
-        (JSC::JSNotAnObjectErrorStub::JSNotAnObjectErrorStub): Use a structure
-        that's created just for this class instead of trying to share a single "null
-        prototype" structure.
-        (JSC::JSNotAnObjectErrorStub::isNotAnObjectErrorStub): Marked this function
-        virtual for clarity and made it private since no one should call it if they
-        already have a pointer to this specific type.
-        (JSC::JSNotAnObject::JSNotAnObject): Use a structure that's created just
-        for this class instead of trying to share a single "null prototype" structure.
-        (JSC::JSNotAnObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSObject.h:
-        (JSC::JSObject::createStructureID): Added HasStandardGetOwnPropertySlot.
-        (JSC::JSObject::inlineGetOwnPropertySlot): Added. Used so we can share code
-        between getOwnPropertySlot and fastGetOwnPropertySlot.
-        (JSC::JSObject::getOwnPropertySlot): Moved so that functions are above the
-        functions that call them. Moved the guts of this function into
-        inlineGetOwnPropertySlot.
-        (JSC::JSCell::fastGetOwnPropertySlot): Added. Checks the
-        HasStandardGetOwnPropertySlot bit and if it's set, calls
-        inlineGetOwnPropertySlot, otherwise calls getOwnPropertySlot.
-        (JSC::JSObject::getPropertySlot): Changed to call fastGetOwnPropertySlot.
-        (JSC::JSValue::get): Changed to call fastGetOwnPropertySlot.
-
-        * kjs/JSWrapperObject.h: Made constructor protected to emphasize that
-        this class is only a base class and never instantiated.
-
-        * kjs/MathObject.h:
-        (JSC::MathObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        * kjs/NumberConstructor.h:
-        (JSC::NumberConstructor::createStructureID): Ditto.
-        * kjs/RegExpConstructor.h:
-        (JSC::RegExpConstructor::createStructureID): Ditto.
-        * kjs/RegExpObject.h:
-        (JSC::RegExpObject::createStructureID): Ditto.
-        * kjs/StringObject.h:
-        (JSC::StringObject::createStructureID): Ditto.
-
-        * kjs/TypeInfo.h: Added HasStandardGetOwnPropertySlot flag and
-        hasStandardGetOwnPropertySlot accessor function.
-
-2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+        Add logic to allow us to create an Object, Array, or Date instance
+        so we can create them in the context of a specific global object,
+        rather than just using the current lexical global object.
 
-        Reviewed by Geoff Garen.
+        * JavaScriptCore.exp:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructEmptyArray):
 
-        Bug 21803: Fuse op_jfalse with op_eq_null and op_neq_null
-        <https://bugs.webkit.org/show_bug.cgi?id=21803>
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
 
-        Fuse op_jfalse with op_eq_null and op_neq_null to make the new opcodes
-        op_jeq_null and op_jneq_null.
+        Reviewed by Darin Adler.
 
-        This is a 2.6% speedup on the V8 Raytrace benchmark, and strangely also
-        a 4.7% speedup on the V8 Arguments benchmark, even though it uses
-        neither of the two new opcodes.
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfTrue):
-        (JSC::CodeGenerator::emitJumpIfFalse):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
 
-2008-10-22  Darin Fisher  <darin@chromium.org>
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
 
-        Reviewed by Eric Seidel.
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
 
-        Should not define PLATFORM(WIN,MAC,GTK) when PLATFORM(CHROMIUM) is defined
-        https://bugs.webkit.org/show_bug.cgi?id=21757
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
 
-        PLATFORM(CHROMIUM) implies HAVE_ACCESSIBILITY
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
 
-        * wtf/Platform.h:
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
 
-2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
 
-        Reviewed by Alexey Proskuryakov.
+2010-01-27  Anton Muhin  <antonm@chromium.org>
 
-        Correct opcode names in documentation.
+        Reviewed by Darin Adler.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
 
-2008-10-21  Oliver Hunt <oliver@apple.com>
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
 
-        RS=Maciej Stachowiak.
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
 
-        Force FastMalloc to make all allocated pages executable in
-        a vague hope this will allow the Win2k3 bot to be able to
-        run tests.
+        Reviewed by Eric Seidel.
 
-        Filed Bug 21783: Need more granular control over allocation of executable memory
-        to cover a more granular version of this patch.
+        [BREWMP] Port WTF's randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=33566
 
-        * wtf/TCSystemAlloc.cpp:
-        (TryVirtualAlloc):
+        Use GETRAND to generate 4 byte random byte sequence to implement
+        weakRandomNumber. Create a secure random number generator with
+        AEECLSID_RANDOM to implement randomNumber.
 
-2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
 
-        Reviewed by Darin Adler.
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21769
-        MessagePort should be GC protected if there are messages to be delivered
+        Reviewed by Eric Seidel.
 
-        * wtf/MessageQueue.h:
-        (WTF::::isEmpty): Added. Also added a warning for methods that return a snapshot of queue
-        state, thus likely to cause race conditions.
+        [BREWMP] Port getCPUTime
+        https://bugs.webkit.org/show_bug.cgi?id=33572
 
-2008-10-21  Darin Adler  <darin@apple.com>
+        Use GETUPTIMEMS which returns a continuously and
+        linearly increasing millisecond timer from the time the device
+        was powered on. This function is enough to implement getCPUTime.
 
-        Reviewed by Maciej Stachowiak.
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
 
-        - convert post-increment to pre-increment in a couple more places for speed
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
 
-        Speeds up V8 benchmarks a little on most computers. (But, strangely, slows
-        them down a little on my computer.)
+        Reviewed by Oliver Hunt.
 
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode): Removed default argument, since we always want
-        to specify this explicitly.
-        (JSC::ForNode::emitCode): Tolerate ignoredResult() as the dst -- means the
-        same thing as 0.
-        (JSC::ReturnNode::emitCode): Ditto.
-        (JSC::ThrowNode::emitCode): Ditto.
-        (JSC::FunctionBodyNode::emitCode): Pass ignoredResult() so that we know we
-        don't have to compute the result of function statements.
+        [BREWMP] Add MarkStack fastMalloc implementation for platforms without VirtualAlloc or mmap.
+        https://bugs.webkit.org/show_bug.cgi?id=33582
 
-2008-10-21  Peter Kasting  <pkasting@google.com>
+        Use fastMalloc and fastFree to implement MarkStack::allocateStack and
+        MarkStack::releaseStack for platforms without page level allocation.
 
-        Reviewed by Maciej Stachowiak.
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackNone.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
 
-        Fix an include of a non-public header to use "" instead of <>.
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
 
-        * API/JSProfilerPrivate.cpp:
+        Reviewed by Eric Seidel.
 
-2008-10-20  Sam Weinig  <sam@webkit.org>
+        [BREWMP] Don't use time function
+        https://bugs.webkit.org/show_bug.cgi?id=33577
 
-        Reviewed by Cameron Zwarich.
+        Calling time(0) in BREW devices causes a crash because time
+        is not properly ported in most devices. Cast currentTime() to
+        time_t to get the same result as time(0).
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21766
-        REGRESSION: 12 JSC tests fail
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
 
-        The JSGlobalObject was mutating the shared nullProtoStructureID when
-        used in jsc.  Instead of using nullProtoStructureID, use a new StructureID.
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
 
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::JSCallbackObject):
-        * API/JSContextRef.cpp:
-        (JSGlobalContextCreateInGroup):
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject):
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
-        (jscmain):
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
 
-2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/HashMap.h:
+        (WTF::::remove):
+        * wtf/HashSet.h:
+        (WTF::::remove):
+        * wtf/HashTable.h:
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::removeAndInvalidate):
+        (WTF::::remove):
+        (WTF::::rehash):
+        (WTF::::checkTableConsistency):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::emptyValue):
+        (WTF::):
+        * wtf/RefPtrHashMap.h:
+        (WTF::::remove):
 
-        Reviewed by Maciej Stachowiak.
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
 
-        Remove an untaken branch in CodeGenerator::emitJumpIfFalse(). This
-        function is never called with a backwards target LabelID, and there is
-        even an assertion to this effect at the top of the function body.
+        More Windows build fixing.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfFalse):
+        * wtf/HashTraits.h: _msize takes void*, remove const qualifier from type.
 
-2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
 
-        Rubber-stamped by Sam Weinig.
+        Windows build fix.
 
-        Add opcode documentation for undocumented opcodes.
+        * wtf/HashTraits.h: Include malloc.h for _msize().
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
 
-2008-10-16  Sam Weinig  <sam@webkit.org>
+        Build fix.
 
-        Reviewed by Cameron Zwarich.
+        * wtf/HashTable.h: (WTF::HashTable::checkTableConsistencyExceptSize): Remove const from a
+        static (empty) version of this function.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
-        Don't create intermediate StructureIDs for builtin objects
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
 
-        Second stage in reduce number of StructureIDs created when initializing the
-        JSGlobalObject.
+        Reviewed by Darin Adler.
 
-        - Use putDirectWithoutTransition for the remaining singleton objects to reduce
-          the number of StructureIDs create for about:blank from 132 to 73.
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
 
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * kjs/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * kjs/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        (JSC::FunctionPrototype::addFunctionProperties):
-        * kjs/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructureID):
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSObject.h:
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        * kjs/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * kjs/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * kjs/StructureID.h:
-        (JSC::StructureID::setPrototypeWithoutTransition):
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
 
-2008-10-20  Alp Toker  <alp@nuanti.com>
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
 
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
 
-        * GNUmakefile.am:
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
 
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
 
-        Reviewed by Anders Carlsson.
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCacheGetByID): Removed a redundant and sometimes
-        incorrect cast, which started ASSERTing after Darin's last checkin.
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
 
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+2010-01-26  Lyon Chen  <liachen@rim.com>
 
-        Not reviewed.
-        
-        Re-enable CTI, which I accidentally disabled while checking in fixes
-        to bytecode.
+        Reviewed by Maciej Stachowiak.
 
-        * wtf/Platform.h:
+        Opcode.h use const void* for Opcode cause error #1211 for RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=33902
 
-2008-10-20  Alp Toker  <alp@nuanti.com>
+        * bytecode/Opcode.h:
 
-        Rubber-stamped by Mark Rowe.
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
 
-        Typo fix in function name: mimimum -> minimum.
+        Reviewed by Oliver Hunt.
 
-        * kjs/DateMath.cpp:
-        (JSC::minimumYearForDST):
-        (JSC::equivalentYearForDST):
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
 
-2008-10-20  Alp Toker  <alp@nuanti.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 
-        Reviewed by Mark Rowe.
+2010-01-26  Oliver Hunt  <oliver@apple.com>
 
-        Use pthread instead of GThread where possible in the GTK+ port. This
-        fixes issues with global initialisation, particularly on GTK+/Win32
-        where a late g_thread_init() will cause hangs.
+        Reviewed by Geoffrey Garen.
 
-        * GNUmakefile.am:
-        * wtf/Platform.h:
-        * wtf/Threading.h:
-        * wtf/ThreadingGtk.cpp:
-        * wtf/ThreadingPthreads.cpp:
+        Using JavaScriptCore API with a webkit vended context can result in slow script dialog
+        https://bugs.webkit.org/show_bug.cgi?id=34172
 
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+        Make the APIShim correctly increment and decrement the timeout
+        entry counter.
 
-        Reviewed by Darin Adler.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
-        Emit profiling instrumentation only if the Web Inspector's profiling
-        feature is enabled
-
-        22.2% speedup on empty function call benchmark.
-        2.9% speedup on v8 benchmark.
-        0.7% speedup on SunSpider.
-        
-        Lesser but similar speedups in bytecode.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases): Nixed JITed profiler hooks. Profiler
-        hooks now have their own opcodes. Added support for compiling profiler
-        hook opcodes.
-        
-        (JSC::CodeBlock::dump): Dump support for the new profiling opcodes.
-
-        * VM/CodeGenerator.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct): Conditionally emit profiling hooks
-        around call and construct, at the call site. (It's easier to get things
-        right this way, if you have profiled code calling non-profiled code.
-        Also, you get a slightly more accurate profile, since you charge the full
-        cost of the call / construct operation to the callee.)
-        
-        Also, fixed a bug where construct would fetch the ".prototype" property
-        from the constructor before evaluating the arguments to the constructor,
-        incorrectly allowing an "invalid constructor" exception to short-circuit
-        argument evaluation. I encountered this bug when trying to make
-        constructor exceptions work with profiling.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval): Removed obsolete profiler hooks.
-
-        (JSC::Machine::throwException): Added a check for an exception thrown
-        within a call instruction. We didn't need this before because the call
-        instruction would check for a valid call before involing the profiler.
-        (JSC::Machine::execute): Added a didExecute hook at the end of top-level
-        function invocation, since op_ret no longer does this for us.
-
-        (JSC::Machine::privateExecute): Removed obsolete profiler hooks. Added
-        profiler opcodes. Changed some ++vPC to vPC[x] notation, since the
-        latter is better for performance, and it makes reasoning about the
-        current opcode in exception handling much simpler.
-
-        (JSC::Machine::cti_op_call_NotJSFunction): Removed obsolete profiler
-        hooks.
-
-        (JSC::Machine::cti_op_create_arguments_no_params): Added missing
-        CTI_STACK_HACK that I noticed when adding CTI_STACK_HACK to the new
-        profiler opcode functions.
-
-        (JSC::Machine::cti_op_profile_will_call):
-        (JSC::Machine::cti_op_profile_did_call): The new profiler opcode
-        functions.
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
 
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Removed obsolete profiler
-        hooks.
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * VM/Machine.h:
-        (JSC::Machine::isCallOpcode): Helper for exception handling.
+        [Qt] Fix compilation of QtScript with non-gcc compilers
 
-        * VM/Opcode.h: Declare new opcodes.
+        Variable length stack arrays are a gcc extension. Use QVarLengthArray
+        as a more portable solution that still tries to allocate on the stack
+        first.
 
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::supportsProfiling): Added virtual interface that
-        allows WebCore to specify whether the target global object has the Web
-        Inspector's profiling feature enabled.
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::call):
 
-        * profiler/Profiler.cpp:
-        (JSC::Profiler::willExecute):
-        (JSC::Profiler::didExecute):
-        (JSC::Profiler::createCallIdentifier):
-        * profiler/Profiler.h: Added support for invoking the profiler with
-        an arbitrary JSValue*, and not a known object. We didn't need this
-        before because the call instruction would check for a valid call before
-        involing the profiler.
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2008-10-20  Darin Adler  <darin@apple.com>
+        Reviewed by Tor Arne Vestbø.
 
-        Reviewed by Geoff Garen.
+        [Qt] Fix the build on platforms without JIT support.
 
-        - get CTI working on Windows again
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall): Add an overload for functions that
-        return JSObject*.
-        * VM/CTI.h: Use JSValue* and JSObject* as return types for
-        cti_op functions. Apparently, MSVC doesn't handle returning
-        the JSValuePtr struct in a register. We'll have to look into
-        this more.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_vm_throw):
-        Change these functions to return pointer types, and never
-        JSValuePtr.
-        * VM/Machine.h: Ditto.
-
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+        The JIT support should be determined at compile-time via wtf/Platform.h
 
-        Reviewed by Darin Adler.
-        
-        Fixed some recent break-age in bytecode mode.
+        * qt/api/QtScript.pro:
 
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructureIDs): Fixed up an ASSERT caused by
-        Gavin's last checkin. This is a temporary fix so I can keep on moving.
-        I'll send email about what I think is an underlying problem soon.
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Removed a redundant and sometimes
-        incorrect cast, which started ASSERTing after Darin's last checkin.
+        Reviewed by Simon Hausmann.
 
-2008-10-20  Darin Adler  <darin@apple.com>
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * qt/api/QtScript.pro: Added.
+        * qt/api/qscriptconverter_p.h: Added.
+        (QScriptConverter::toString):
+        * qt/api/qscriptengine.cpp: Added.
+        (QScriptEngine::QScriptEngine):
+        (QScriptEngine::~QScriptEngine):
+        (QScriptEngine::evaluate):
+        (QScriptEngine::collectGarbage):
+        * qt/api/qscriptengine.h: Added.
+        * qt/api/qscriptengine_p.cpp: Added.
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h: Added.
+        (QScriptEnginePrivate::get):
+        (QScriptEnginePrivate::collectGarbage):
+        (QScriptEnginePrivate::makeJSValue):
+        (QScriptEnginePrivate::context):
+        * qt/api/qscriptvalue.cpp: Added.
+        (QScriptValue::QScriptValue):
+        (QScriptValue::~QScriptValue):
+        (QScriptValue::isValid):
+        (QScriptValue::isBool):
+        (QScriptValue::isBoolean):
+        (QScriptValue::isNumber):
+        (QScriptValue::isNull):
+        (QScriptValue::isString):
+        (QScriptValue::isUndefined):
+        (QScriptValue::isError):
+        (QScriptValue::isObject):
+        (QScriptValue::isFunction):
+        (QScriptValue::toString):
+        (QScriptValue::toNumber):
+        (QScriptValue::toBool):
+        (QScriptValue::toBoolean):
+        (QScriptValue::toInteger):
+        (QScriptValue::toInt32):
+        (QScriptValue::toUInt32):
+        (QScriptValue::toUInt16):
+        (QScriptValue::call):
+        (QScriptValue::engine):
+        (QScriptValue::operator=):
+        (QScriptValue::equals):
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue.h: Added.
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h: Added.
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::get):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isValid):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::engine):
+        (QScriptValuePrivate::context):
+        (QScriptValuePrivate::value):
+        (QScriptValuePrivate::object):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::isJSBased):
+        (QScriptValuePrivate::isNumberBased):
+        (QScriptValuePrivate::isStringBased):
+        * qt/api/qtscriptglobal.h: Added.
+        * qt/tests/qscriptengine/qscriptengine.pro: Added.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::tst_QScriptEngine):
+        (tst_QScriptEngine::~tst_QScriptEngine):
+        (tst_QScriptEngine::init):
+        (tst_QScriptEngine::cleanup):
+        (tst_QScriptEngine::collectGarbage):
+        (tst_QScriptEngine::evaluate):
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::init):
+        (tst_QScriptValue::cleanup):
+        (tst_QScriptValue::ctor):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::copyConstructor_data):
+        (tst_QScriptValue::copyConstructor):
+        (tst_QScriptValue::assignOperator_data):
+        (tst_QScriptValue::assignOperator):
+        (tst_QScriptValue::dataSharing):
+        (tst_QScriptValue::constructors_data):
+        (tst_QScriptValue::constructors):
+        (tst_QScriptValue::call):
+        * qt/tests/tests.pri: Added.
+        * qt/tests/tests.pro: Added.
+
+2010-01-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Linux tests: the pthread functions on Linux produce segfault if they receive 0 thread handle.
+        After r53714, we can have 0 thread handles passed to pthread_join and pthread_detach if corresponding threads
+        were already terminated and their threadMap entries cleared.
+        Add a 0 check.
 
-        - another similar Windows build fix
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
 
-        * VM/CTI.cpp: Changed return type to JSObject* instead of JSValuePtr.
+2010-01-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2008-10-20  Darin Adler  <darin@apple.com>
+        Reviewed by Maciej Stachowiak.
 
-        - try to fix Windows build
+        Refactor JITStubs.cpp so that DEFINE_STUB_FUNCTION is only used once for each function
+        https://bugs.webkit.org/show_bug.cgi?id=33866
 
-        * VM/CTI.cpp: Use JSValue* instead of JSValuePtr for ctiTrampoline.
-        * VM/CTI.h: Ditto.
+        Place the guard USE(JSVALUE32_64) inside the body of the DEFINE_STUB_FUNCTION
+        macro for those functions that are always present.
 
-2008-10-19  Darin Adler  <darin@apple.com>
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
 
-        Reviewed by Cameron Zwarich.
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
 
-        - finish https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        Reviewed by Kevin Ollivier.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_profiler): Use asFunction.
-        (JSC::Machine::cti_vm_lazyLinkCall): Ditto.
-        (JSC::Machine::cti_op_construct_JSConstructFast): Use asObject.
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
 
-        * kjs/JSCell.h: Re-sort friend classes. Eliminate inheritance from
-        JSValue. Changed cast in asCell from static_cast to reinterpret_cast.
-        Removed JSValue::getNumber(double&) and one of JSValue::getObject
-        overloads.
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
 
-        * kjs/JSValue.h: Made the private constructor and destructor both
-        non-virtual and also remove the definitions. This class can never
-        be instantiated or derived.
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
 
-2008-10-19  Darin Adler  <darin@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Cameron Zwarich.
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
 
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        * Configurations/FeatureDefines.xcconfig:
 
-        Change JSValuePtr from a typedef into a class. This allows us to support
-        conversion from JSCell* to JSValuePtr even if JSCell isn't derived from
-        JSValue.
+2010-01-22  Dmitry Titov  <dimich@chromium.org>
 
-        * JavaScriptCore.exp: Updated symbols that involve JSValuePtr, since
-        it's now a distinct type.
+        Not reviewed, attempted Snow Leopard build fix.
 
-        * API/APICast.h:
-        (toRef): Extract the JSValuePtr payload explicitly since we can't just
-        cast any more.
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger): Ditto.
+        * wtf/ThreadingPthreads.cpp: Add a forward declaration of a function which is not 'static'.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::addConstant): Get at the payload directly.
-        (JSC::CodeGenerator::emitLoad): Added an overload of JSCell* because
-        otherwise classes derived from JSValue end up calling the bool
-        overload instead of JSValuePtr.
-        * VM/CodeGenerator.h: Ditto. Also update traits to use JSValue*
-        and the payload functions.
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
 
-        * VM/Register.h: Added a JSCell* overload and use of payload functions.
+        Reviewed by Maciej Stachowiak.
 
-        * kjs/JSCell.h:
-        (JSC::asCell): Use payload function.
-        (JSC::JSValue::asCell): Use JSValue* instead of JSValuePtr.
-        (JSC::JSValuePtr::JSValuePtr): Added. Constructor that takes JSCell*
-        and creates a JSValuePtr.
+        Fix the leak of ThreadIdentifiers in threadMap across threads.
+        https://bugs.webkit.org/show_bug.cgi?id=32689
 
-        * kjs/JSImmediate.h: Added JSValuePtr class. Also updated makeValue
-        and makeInt to work with JSValue* and the payload function.
+        Test is added to DumpRenderTree.mm.
 
-        * kjs/JSValue.h: Added == and != operators for JSValuePtr. Put them
-        here because eventually all the JSValue functions should go here
-        except what's needed by JSImmediate. Also fix asValue to use
-        JSValue* instead of JSValuePtr.
+        * Android.mk: Added file ThreadIdentifierDataPthreads.(h|cpp) to build.
+        * Android.v8.wtf.mk: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
 
-        * kjs/PropertySlot.h: Change constructor to take JSValuePtr.
+        * wtf/ThreadIdentifierDataPthreads.cpp: Added. Contains custom implementation of thread-specific data that uses custom destructor.
+        (WTF::ThreadIdentifierData::~ThreadIdentifierData): Removes the ThreadIdentifier from the threadMap.
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::destruct): Custom thread-specific destructor. Resets the value for the key again to cause second invoke.
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Need to use pthread_once since initialization may come on any thread(s).
+        * wtf/ThreadIdentifierDataPthreads.h: Added.
+        (WTF::ThreadIdentifierData::ThreadIdentifierData):
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Move initializeCurrentThreadInternal to after the lock to make
+                                 sure it is invoked when ThreadIdentifier is already established.
+
+        * wtf/Threading.h: Rename setThreadNameInternal -> initializeCurrentThreadInternal since it does more then only set the name now.
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
 
-        * kjs/protect.h: Update gcProtect functions to work with JSCell*
-        as well as JSValuePtr. Also updated the ProtectedPtr<JSValuePtr>
-        specialization to work more directly. Also changed all the call
-        sites to use gcProtectNullTolerant.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::clearPthreadHandleForIdentifier): Make it not 'static' so the ~ThreadIdentifierData() in another file can call it.
+        (WTF::initializeCurrentThreadInternal): Set the thread-specific data. The ThreadIdentifier is already established by creating thread.
+        (WTF::waitForThreadCompletion): Remove call to clearPthreadHandleForIdentifier(threadID) since it is now done in ~ThreadIdentifierData().
+        (WTF::detachThread): Ditto.
+        (WTF::currentThread): Use the thread-specific data to get the ThreadIdentifier. It's many times faster then Mutex-protected iteration through the map.
+                              Also, set the thread-specific data if called first time on the thread.
 
-2008-10-19  Darin Adler  <darin@apple.com>
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Alexey Proskuryakov.
 
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        Add ThreadSpecific for ENABLE(SINGLE_THREADED)
+        https://bugs.webkit.org/show_bug.cgi?id=33878
 
-        Remove most uses of JSValue, which will be removed in a future patch.
+        Implement ThreadSpecific with a simple getter/setter
+        when ENABLE(SINGLE_THREADED) is true.
 
-        * VM/Machine.cpp:
-        (JSC::fastToUInt32): Call toUInt32SlowCase function; no longer a member
-        of JSValue.
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::toInt32): Ditto.
-        (JSC::JSNumberCell::toUInt32): Ditto.
+        Due to the change in https://bugs.webkit.org/show_bug.cgi?id=33236,
+        an implementation of ThreadSpecific must be available to build WebKit.
+        This causes a build failure for platforms without a proper
+        ThreadSpecific implementation.
 
-        * kjs/JSValue.cpp:
-        (JSC::toInt32SlowCase): Made a non-member function.
-        (JSC::JSValue::toInt32SlowCase): Changed to call non-member function.
-        (JSC::toUInt32SlowCase): More of the same.
-        (JSC::JSValue::toUInt32SlowCase): Ditto.
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
 
-        * kjs/JSValue.h: Moved static member function so they are no longer
-        member functions at all.
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
 
-        * VM/CTI.h: Removed forward declaration of JSValue.
-        * VM/ExceptionHelpers.h: Ditto.
-        * kjs/CallData.h: Ditto.
-        * kjs/ConstructData.h: Ditto.
-        * kjs/JSGlobalObjectFunctions.h: Ditto.
-        * kjs/PropertyMap.h: Ditto.
-        * kjs/StructureID.h: Ditto.
-        * kjs/collector.h: Ditto.
-        * kjs/completion.h: Ditto.
+        Reviewed by Maciej Stachowiak.
 
-        * kjs/grammar.y:
-        (JSC::makeBitwiseNotNode): Call new non-member toInt32 function.
-        (JSC::makeLeftShiftNode): More of the same.
-        (JSC::makeRightShiftNode): Ditto.
+        Add fastStrDup to FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=33937
 
-        * kjs/protect.h: Added a specialization for ProtectedPtr<JSValuePtr>
-        so this can be used with JSValuePtr.
+        The new string returned by fastStrDup is obtained with fastMalloc,
+        and can be freed with fastFree. This makes the memory management 
+        more consistent because we don't need to keep strdup allocated pointers
+        and free them with free(). Instead we can use fastFree everywhere.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup):
+        * wtf/FastMalloc.h:
 
-        Reviewed by Oliver Hunt.
+2010-01-21  Brady Eidson  <beidson@apple.com>
 
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        Reviewed by Maciej Stachowiak.
 
-        Tweak a little more to get closer to where we can make JSValuePtr a class.
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
 
-        * API/APICast.h:
-        (toJS): Change back to JSValue* here, since we're converting the
-        pointer type.
-        * VM/CTI.cpp:
-        (JSC::CTI::unlinkCall): Call asPointer.
-        * VM/CTI.h: Cast to JSValue* here, since it's a pointer cast.
-        * kjs/DebuggerCallFrame.h:
-        (JSC::DebuggerCallFrame::DebuggerCallFrame): Call noValue.
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Call noValue.
-        * kjs/JSImmediate.cpp:
-        (JSC::JSImmediate::toObject): Remove unneeded const_cast.
-        * kjs/JSWrapperObject.h:
-        (JSC::JSWrapperObject::JSWrapperObject): Call noValue.
+        * wtf/Platform.h: Add a "HISTORY_ALWAYS_ASYNC" enable and turn it on for Chromium.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
 
-        - fix non-all-in-one build
+        Reviewed by Oliver Hunt.
 
-        * kjs/completion.h:
-        (JSC::Completion::Completion): Add include of JSValue.h.
+        Always create a prototype for automatically managed classes.
+        
+        This fixes some errors where prototype chains were not correctly hooked
+        up, and also ensures that API classes work correctly with features like
+        instanceof.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create): Cleaned up some of this code. Also changed it
+        to always create a prototype class.
 
-        Reviewed by Oliver Hunt.
+        * API/tests/testapi.c:
+        (Derived2_class):
+        (main): Fixed a null value crash in the exception checking code.
+        * API/tests/testapi.js: Added some tests for the case where a prototype
+        chain would not be hooked up correctly.
 
-        - fix assertions I introduced with my casting changes
+2010-01-21  Oliver Hunt  <oliver@apple.com>
 
-        These were showing up as failures in the JavaScriptCore tests.
+        Reviewed by Geoff Garen.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof): Remove the bogus asCell casting that
-        was at the top of the function, and instead cast at the point of use.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Moved the cast to
-        object after checking the construct type.
+        Force JSC to create a prototype chain for API classes with a
+        parent class but no static functions.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
 
-        - fix non-all-in-one build
+2010-01-21  Kent Hansen  <kent.hansen@nokia.com>
 
-        * kjs/JSGlobalObjectFunctions.h: Add include of JSImmedate.h (for now).
+        Reviewed by Geoffrey Garen.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        Object.getOwnPropertyDescriptor always returns undefined for JS API objects
+        https://bugs.webkit.org/show_bug.cgi?id=33946
 
-        - fix build
+        Ideally the getOwnPropertyDescriptor() reimplementation should return an
+        access descriptor that wraps the property getter and setter callbacks, but
+        that approach is much more involved than returning a value descriptor.
+        Keep it simple for now.
 
-        * kjs/interpreter.h: Include JSValue.h instead of JSImmediate.h.
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.js:
 
-2008-10-18  Darin Adler  <darin@apple.com>
+2010-01-20  Mark Rowe  <mrowe@apple.com>
 
-        * kjs/interpreter.h: Fix include of JSImmediate.h.
+        Build fix.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Remove unnecessary function call.
 
-        - fix non-all-in-one build
+2010-01-20  Mark Rowe  <mrowe@apple.com>
 
-        * kjs/interpreter.h: Add include of JSImmediate.h.
+        Reviewed by Oliver Hunt.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.
 
-        - fix non-all-in-one build
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
 
-        * kjs/ConstructData.h: Add include of JSImmedate.h (for now).
+2010-01-20  Mark Rowe  <mrowe@apple.com>
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        Reviewed by Oliver Hunt.
 
-        - try to fix Windows build
+        <rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported
 
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine): Use JSCell* type since MSVC seems to only allow
-        calling ~JSCell directly if it's a JSCell*.
+        Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
+        where it is supported.
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        * wtf/Platform.h:
 
-        Reviewed by Cameron Zwarich.
+2010-01-20  Geoffrey Garen  <ggaren@apple.com>
 
-        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        Reviewed by Oliver Hunt.
 
-        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
-        changing JSValuePtr to be a class, and then eventually renaming it
-        to JSValue once that's done.
+        <rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
+        all destructors
 
-        * JavaScriptCore.exp: Update entry points, since some now take JSValue*
-        instead of const JSValue*.
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks): Instead of fully marking protected objects,
+        just set their mark bits. This prevents protected objects from keeping
+        unprotected objects alive. Destructor order is not guaranteed, so it's
+        OK to destroy objects pointed to by protected objects before destroying
+        protected objects.
 
-        * API/APICast.h:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSValueRef.cpp:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Register.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/InternalFunction.h:
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/PropertyMap.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpMatchesArray.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/Shell.cpp:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/grammar.y:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.h:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * profiler/ProfileGenerator.cpp:
-        Replace JSValue* with JSValuePtr.
+2010-01-19  David Levin  <levin@chromium.org>
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        Reviewed by Oliver Hunt.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_eval): Removed stray parentheses from my
-        last check-in.
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
 
-2008-10-18  Darin Adler  <darin@apple.com>
+        * wtf/TypeTraits.cpp: Added tests for the new type traits.
+        * wtf/TypeTraits.h:
+        (WTF::IsSubclass): Determines if a class is a derived from another class.
+        (WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
+        template class (with one parameter that is unknown).
+        (WTF::RemoveTemplate): Reveals the type for a template parameter.
 
-        Reviewed by Oliver Hunt.
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
 
-        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
+        Reviewed by Darin Adler and Adam Roben.
 
-        Remove casts from JSValue* to derived classes, replacing them with
-        calls to inline casting functions. These functions are also a bit
-        better than aidrect cast because they also do a runtime assertion.
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
 
-        Removed use of 0 as for JSValue*, changing call sites to use a
-        noValue() function instead.
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
 
-        Move things needed by classes derived from JSValue out of the class,
-        since the classes won't be deriving from JSValue any more soon.
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add FeatureDefines.vsprops inherited property sheet.
 
-        I did most of these changes by changing JSValue to not be JSValue* any
-        more, then fixing a lot of the compilation problems, then rolling out
-        the JSValue change.
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
 
-        1.011x as fast on SunSpider (presumably due to some of the Machine.cpp changes)
+        [Qt] Unreviewed buildfix for r53547.
 
-        * API/APICast.h: Removed unneeded forward declarations.
+        * DerivedSources.pro:
 
-        * API/JSCallbackObject.h: Added an asCallbackObject function for casting.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::asCallbackObject): Added.
-        (JSC::JSCallbackObject::getOwnPropertySlot): Use asObject.
-        (JSC::JSCallbackObject::call): Use noValue.
-        (JSC::JSCallbackObject::staticValueGetter): Use asCallbackObject.
-        (JSC::JSCallbackObject::staticFunctionGetter): Ditto.
-        (JSC::JSCallbackObject::callbackGetter): Ditto.
-
-        * JavaScriptCore.exp: Updated.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added RegExpMatchesArray.h.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger): Added. For use casting a JSValue to an integer.
-        (JSC::CTI::emitGetArg): Use asInteger.
-        (JSC::CTI::emitGetPutArg): Ditto.
-        (JSC::CTI::getConstantImmediateNumericArg): Ditto. Also use noValue.
-        (JSC::CTI::emitInitRegister): Use asInteger.
-        (JSC::CTI::getDeTaggedConstantImmediate): Ditto.
-        (JSC::CTI::compileOpCallInitializeCallFrame): Ditto.
-        (JSC::CTI::compileOpCall): Ditto.
-        (JSC::CTI::compileOpStrictEq): Ditto.
-        (JSC::CTI::privateCompileMainPass): Ditto.
-        (JSC::CTI::privateCompileGetByIdProto): Ditto.
-        (JSC::CTI::privateCompileGetByIdChain): Ditto.
-        (JSC::CTI::privateCompilePutByIdTransition): Ditto.
-        * VM/CTI.h: Rewrite the ARG-related macros to use C++ casts instead of
-        C casts and get rid of some extra parentheses. Addd declaration of
-        asInteger.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp): Use asString.
-        (JSC::CodeGenerator::emitLoad): Use noValue.
-        (JSC::CodeGenerator::findScopedProperty): Change globalObject argument
-        to JSObject* instead of JSValue*.
-        (JSC::CodeGenerator::emitResolve): Remove unneeded cast.
-        (JSC::CodeGenerator::emitGetScopedVar): Use asCell.
-        (JSC::CodeGenerator::emitPutScopedVar): Ditto.
-        * VM/CodeGenerator.h: Changed out argument of findScopedProperty.
-        Also change the JSValueMap to use PtrHash explicitly instead of
-        getting it from DefaultHash.
-
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::toPrimitive): Use noValue.
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::next): Ditto.
-
-        * VM/Machine.cpp:
-        (JSC::fastIsNumber): Moved isImmediate check here instead of
-        checking for 0 inside Heap::isNumber. Use asCell and asNumberCell.
-        (JSC::fastToInt32): Ditto.
-        (JSC::fastToUInt32): Ditto.
-        (JSC::jsLess): Use asString.
-        (JSC::jsLessEq): Ditto.
-        (JSC::jsAdd): Ditto.
-        (JSC::jsTypeStringForValue): Use asObject.
-        (JSC::jsIsObjectType): Ditto.
-        (JSC::jsIsFunctionType): Ditto.
-        (JSC::inlineResolveBase): Use noValue.
-        (JSC::Machine::callEval): Use asString. Initialize result to
-        undefined, not 0.
-        (JSC::Machine::Machine): Remove unneeded casts to JSCell*.
-        (JSC::Machine::throwException): Use asObject.
-        (JSC::Machine::debug): Remove explicit calls to the DebuggerCallFrame
-        constructor.
-        (JSC::Machine::checkTimeout): Use noValue.
-        (JSC::cachePrototypeChain): Use asObject.
-        (JSC::Machine::tryCachePutByID): Use asCell.
-        (JSC::Machine::tryCacheGetByID): Use aCell and asObject.
-        (JSC::Machine::privateExecute): Use noValue, asCell, asObject, asString,
-        asArray, asActivation, asFunction. Changed code that creates call frames
-        for host functions to pass 0 for the function pointer -- the call frame
-        needs a JSFunction* and a host function object is not one. This was
-        caught by the assertions in the casting functions. Also remove some
-        unneeded casts in cases where two values are compared.
-        (JSC::Machine::retrieveLastCaller): Use noValue.
-        (JSC::Machine::tryCTICachePutByID): Use asCell.
-        (JSC::Machine::tryCTICacheGetByID): Use aCell and asObject.
-        (JSC::setUpThrowTrampolineReturnAddress): Added this function to restore
-        the PIC-branch-avoidance that was recently lost.
-        (JSC::Machine::cti_op_add): Use asString.
-        (JSC::Machine::cti_op_instanceof): Use asCell and asObject.
-        (JSC::Machine::cti_op_call_JSFunction): Use asFunction.
-        (JSC::Machine::cti_op_call_NotJSFunction): Changed code to pass 0 for
-        the function pointer, since we don't have a JSFunction. Use asObject.
-        (JSC::Machine::cti_op_tear_off_activation): Use asActivation.
-        (JSC::Machine::cti_op_construct_JSConstruct): Use asFunction and asObject.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): use asObject.
-        (JSC::Machine::cti_op_get_by_val): Use asArray and asString.
-        (JSC::Machine::cti_op_resolve_func): Use asPointer; this helps prepare
-        us for a situation where JSValue is not a pointer.
-        (JSC::Machine::cti_op_put_by_val): Use asArray.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_resolve_global): Use asGlobalObject.
-        (JSC::Machine::cti_op_post_inc): Change VM_CHECK_EXCEPTION_2 to
-        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
-        that point. Also use asPointer.
-        (JSC::Machine::cti_op_resolve_with_base): Use asPointer.
-        (JSC::Machine::cti_op_post_dec): Change VM_CHECK_EXCEPTION_2 to
-        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
-        that point. Also use asPointer.
-        (JSC::Machine::cti_op_call_eval): Use asObject, noValue, and change
-        VM_CHECK_EXCEPTION_ARG to VM_THROW_EXCEPTION_AT_END.
-        (JSC::Machine::cti_op_throw): Change return value to a JSValue*.
-        (JSC::Machine::cti_op_in): Use asObject.
-        (JSC::Machine::cti_op_switch_char): Use asString.
-        (JSC::Machine::cti_op_switch_string): Ditto.
-        (JSC::Machine::cti_op_put_getter): Use asObject.
-        (JSC::Machine::cti_op_put_setter): Ditto.
-        (JSC::Machine::cti_vm_throw): Change return value to a JSValue*.
-        Use noValue.
-        * VM/Machine.h: Change return values of both cti_op_throw and
-        cti_vm_throw to JSValue*.
-
-        * VM/Register.h: Remove nullJSValue, which is the same thing
-        as noValue(). Also removed unneeded definition of JSValue.
-
-        * kjs/ArgList.h: Removed unneeded definition of JSValue.
-
-        * kjs/Arguments.h:
-        (JSC::asArguments): Added.
-
-        * kjs/ArrayPrototype.cpp:
-        (JSC::getProperty): Use noValue.
-        (JSC::arrayProtoFuncToString): Use asArray.
-        (JSC::arrayProtoFuncToLocaleString): Ditto.
-        (JSC::arrayProtoFuncConcat): Ditto.
-        (JSC::arrayProtoFuncPop): Ditto. Also removed unneeded initialization
-        of the result, which is set in both sides of the branch.
-        (JSC::arrayProtoFuncPush): Ditto.
-        (JSC::arrayProtoFuncShift): Removed unneeded initialization
-        of the result, which is set in both sides of the branch.
-        (JSC::arrayProtoFuncSort): Use asArray.
-
-        * kjs/BooleanObject.h:
-        (JSC::asBooleanObject): Added.
-
-        * kjs/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString): Use asBooleanObject.
-        (JSC::booleanProtoFuncValueOf): Ditto.
-
-        * kjs/CallData.cpp:
-        (JSC::call): Use asObject and asFunction.
-        * kjs/ConstructData.cpp:
-        (JSC::construct): Ditto.
-
-        * kjs/DateConstructor.cpp:
-        (JSC::constructDate): Use asDateInstance.
-
-        * kjs/DateInstance.h:
-        (JSC::asDateInstance): Added.
-
-        * kjs/DatePrototype.cpp:
-        (JSC::dateProtoFuncToString): Use asDateInstance.
-        (JSC::dateProtoFuncToUTCString): Ditto.
-        (JSC::dateProtoFuncToDateString): Ditto.
-        (JSC::dateProtoFuncToTimeString): Ditto.
-        (JSC::dateProtoFuncToLocaleString): Ditto.
-        (JSC::dateProtoFuncToLocaleDateString): Ditto.
-        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
-        (JSC::dateProtoFuncValueOf): Ditto.
-        (JSC::dateProtoFuncGetTime): Ditto.
-        (JSC::dateProtoFuncGetFullYear): Ditto.
-        (JSC::dateProtoFuncGetUTCFullYear): Ditto.
-        (JSC::dateProtoFuncToGMTString): Ditto.
-        (JSC::dateProtoFuncGetMonth): Ditto.
-        (JSC::dateProtoFuncGetUTCMonth): Ditto.
-        (JSC::dateProtoFuncGetDate): Ditto.
-        (JSC::dateProtoFuncGetUTCDate): Ditto.
-        (JSC::dateProtoFuncGetDay): Ditto.
-        (JSC::dateProtoFuncGetUTCDay): Ditto.
-        (JSC::dateProtoFuncGetHours): Ditto.
-        (JSC::dateProtoFuncGetUTCHours): Ditto.
-        (JSC::dateProtoFuncGetMinutes): Ditto.
-        (JSC::dateProtoFuncGetUTCMinutes): Ditto.
-        (JSC::dateProtoFuncGetSeconds): Ditto.
-        (JSC::dateProtoFuncGetUTCSeconds): Ditto.
-        (JSC::dateProtoFuncGetMilliSeconds): Ditto.
-        (JSC::dateProtoFuncGetUTCMilliseconds): Ditto.
-        (JSC::dateProtoFuncGetTimezoneOffset): Ditto.
-        (JSC::dateProtoFuncSetTime): Ditto.
-        (JSC::setNewValueFromTimeArgs): Ditto.
-        (JSC::setNewValueFromDateArgs): Ditto.
-        (JSC::dateProtoFuncSetYear): Ditto.
-        (JSC::dateProtoFuncGetYear): Ditto.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::thisObject): Use asObject.
-        (JSC::DebuggerCallFrame::evaluate): Use noValue.
-        * kjs/DebuggerCallFrame.h: Added a constructor that
-        takes only a callFrame.
-
-        * kjs/ExecState.h:
-        (JSC::ExecState::clearException): Use noValue.
-
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString): Use asFunction.
-        (JSC::functionProtoFuncApply): Use asArguments and asArray.
-
-        * kjs/GetterSetter.cpp:
-        (JSC::GetterSetter::getPrimitiveNumber): Use noValue.
-
-        * kjs/GetterSetter.h:
-        (JSC::asGetterSetter): Added.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::name): Use asString.
-
-        * kjs/InternalFunction.h:
-        (JSC::asInternalFunction): Added.
-
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter): Use asActivation.
-
-        * kjs/JSActivation.h:
-        (JSC::asActivation): Added.
-
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::putSlowCase): Use noValue.
-        (JSC::JSArray::deleteProperty): Ditto.
-        (JSC::JSArray::increaseVectorLength): Ditto.
-        (JSC::JSArray::setLength): Ditto.
-        (JSC::JSArray::pop): Ditto.
-        (JSC::JSArray::sort): Ditto.
-        (JSC::JSArray::compactForSorting): Ditto.
-        * kjs/JSArray.h:
-        (JSC::asArray): Added.
-
-        * kjs/JSCell.cpp:
-        (JSC::JSCell::getJSNumber): Use noValue.
-
-        * kjs/JSCell.h:
-        (JSC::asCell): Added.
-        (JSC::JSValue::asCell): Changed to not preserve const.
-        Given the wide use of JSValue* and JSCell*, it's not
-        really useful to use const.
-        (JSC::JSValue::isNumber): Use asValue.
-        (JSC::JSValue::isString): Ditto.
-        (JSC::JSValue::isGetterSetter): Ditto.
-        (JSC::JSValue::isObject): Ditto.
-        (JSC::JSValue::getNumber): Ditto.
-        (JSC::JSValue::getString): Ditto.
-        (JSC::JSValue::getObject): Ditto.
-        (JSC::JSValue::getCallData): Ditto.
-        (JSC::JSValue::getConstructData): Ditto.
-        (JSC::JSValue::getUInt32): Ditto.
-        (JSC::JSValue::getTruncatedInt32): Ditto.
-        (JSC::JSValue::getTruncatedUInt32): Ditto.
-        (JSC::JSValue::mark): Ditto.
-        (JSC::JSValue::marked): Ditto.
-        (JSC::JSValue::toPrimitive): Ditto.
-        (JSC::JSValue::getPrimitiveNumber): Ditto.
-        (JSC::JSValue::toBoolean): Ditto.
-        (JSC::JSValue::toNumber): Ditto.
-        (JSC::JSValue::toString): Ditto.
-        (JSC::JSValue::toObject): Ditto.
-        (JSC::JSValue::toThisObject): Ditto.
-        (JSC::JSValue::needsThisConversion): Ditto.
-        (JSC::JSValue::toThisString): Ditto.
-        (JSC::JSValue::getJSNumber): Ditto.
-
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::argumentsGetter): Use asFunction.
-        (JSC::JSFunction::callerGetter): Ditto.
-        (JSC::JSFunction::lengthGetter): Ditto.
-        (JSC::JSFunction::construct): Use asObject.
-
-        * kjs/JSFunction.h:
-        (JSC::asFunction): Added.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::lastInPrototypeChain): Use asObject.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::asGlobalObject): Added.
-        (JSC::ScopeChainNode::globalObject): Use asGlobalObject.
-
-        * kjs/JSImmediate.h: Added noValue, asPointer, and makeValue
-        functions. Use rawValue, makeValue, and noValue consistently
-        instead of doing reinterpret_cast in various functions.
-
-        * kjs/JSNumberCell.h:
-        (JSC::asNumberCell): Added.
-        (JSC::JSValue::uncheckedGetNumber): Use asValue and asNumberCell.
-        (JSC::JSValue::toJSNumber): Use asValue.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put): Use asObject and asGetterSetter.
-        (JSC::callDefaultValueFunction): Use noValue.
-        (JSC::JSObject::defineGetter): Use asGetterSetter.
-        (JSC::JSObject::defineSetter): Ditto.
-        (JSC::JSObject::lookupGetter): Ditto. Also use asObject.
-        (JSC::JSObject::lookupSetter): Ditto.
-        (JSC::JSObject::hasInstance): Use asObject.
-        (JSC::JSObject::fillGetterPropertySlot): Use asGetterSetter.
-
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect): Use noValue.
-        (JSC::asObject): Added.
-        (JSC::JSValue::isObject): Use asValue.
-        (JSC::JSObject::get): Removed unneeded const_cast.
-        (JSC::JSObject::getPropertySlot): Use asObject.
-        (JSC::JSValue::get): Removed unneeded const_cast.
-        Use asValue, asCell, and asObject.
-        (JSC::JSValue::put): Ditto.
-        (JSC::JSObject::allocatePropertyStorageInline): Fixed spelling
-        of "oldPropertStorage".
-
-        * kjs/JSString.cpp:
-        (JSC::JSString::getOwnPropertySlot): Use asObject.
-
-        * kjs/JSString.h:
-        (JSC::asString): Added.
-        (JSC::JSValue::toThisJSString): Use asValue.
-
-        * kjs/JSValue.h: Make PreferredPrimitiveType a top level enum
-        instead of a member of JSValue. Added an asValue function that
-        returns this. Removed overload of asCell for const. Use asValue
-        instead of getting right at this.
-
-        * kjs/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncIsPrototypeOf): Use asObject.
-        (JSC::objectProtoFuncDefineGetter): Ditto.
-        (JSC::objectProtoFuncDefineSetter): Ditto.
-
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::PropertySlot): Take a const JSValue* so the
-        callers don't have to worry about const.
-        (JSC::PropertySlot::clearBase): Use noValue.
-        (JSC::PropertySlot::clearValue): Ditto.
-
-        * kjs/RegExpConstructor.cpp:
-        (JSC::regExpConstructorDollar1): Use asRegExpConstructor.
-        (JSC::regExpConstructorDollar2): Ditto.
-        (JSC::regExpConstructorDollar3): Ditto.
-        (JSC::regExpConstructorDollar4): Ditto.
-        (JSC::regExpConstructorDollar5): Ditto.
-        (JSC::regExpConstructorDollar6): Ditto.
-        (JSC::regExpConstructorDollar7): Ditto.
-        (JSC::regExpConstructorDollar8): Ditto.
-        (JSC::regExpConstructorDollar9): Ditto.
-        (JSC::regExpConstructorInput): Ditto.
-        (JSC::regExpConstructorMultiline): Ditto.
-        (JSC::regExpConstructorLastMatch): Ditto.
-        (JSC::regExpConstructorLastParen): Ditto.
-        (JSC::regExpConstructorLeftContext): Ditto.
-        (JSC::regExpConstructorRightContext): Ditto.
-        (JSC::setRegExpConstructorInput): Ditto.
-        (JSC::setRegExpConstructorMultiline): Ditto.
-        (JSC::constructRegExp): Use asObject.
-
-        * kjs/RegExpConstructor.h:
-        (JSC::asRegExpConstructor): Added.
-
-        * kjs/RegExpObject.cpp:
-        (JSC::regExpObjectGlobal): Use asRegExpObject.
-        (JSC::regExpObjectIgnoreCase): Ditto.
-        (JSC::regExpObjectMultiline): Ditto.
-        (JSC::regExpObjectSource): Ditto.
-        (JSC::regExpObjectLastIndex): Ditto.
-        (JSC::setRegExpObjectLastIndex): Ditto.
-        (JSC::callRegExpObject): Ditto.
-
-        * kjs/RegExpObject.h:
-        (JSC::asRegExpObject): Added.
-
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest): Use asRegExpObject.
-        (JSC::regExpProtoFuncExec): Ditto.
-        (JSC::regExpProtoFuncCompile): Ditto.
-        (JSC::regExpProtoFuncToString): Ditto.
-
-        * kjs/StringObject.h:
-        (JSC::StringObject::internalValue): Use asString.
-        (JSC::asStringObject): Added.
-
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace): Use asRegExpObject.
-        (JSC::stringProtoFuncToString): Ue asStringObject.
-        (JSC::stringProtoFuncMatch): Use asRegExpObject.
-        (JSC::stringProtoFuncSearch): Ditto.
-        (JSC::stringProtoFuncSplit): Ditto.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames): Use asObject.
-        (JSC::StructureID::createCachedPrototypeChain): Ditto.
-        (JSC::StructureIDChain::StructureIDChain): Use asCell and asObject.
-
-        * kjs/collector.h:
-        (JSC::Heap::isNumber): Removed null handling. This can only be called
-        on valid cells.
-        (JSC::Heap::cellBlock): Removed overload for const and non-const.
-        Whether the JSCell* is const or not really should have no effect on
-        whether you can modify the collector block it's in.
-
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::evaluate): Use noValue and noObject.
-
-        * kjs/nodes.cpp:
-        (JSC::FunctionCallResolveNode::emitCode): Use JSObject for the global
-        object rather than JSValue.
-        (JSC::PostfixResolveNode::emitCode): Ditto.
-        (JSC::PrefixResolveNode::emitCode): Ditto.
-        (JSC::ReadModifyResolveNode::emitCode): Ditto.
-        (JSC::AssignResolveNode::emitCode): Ditto.
-
-        * kjs/operations.h:
-        (JSC::equalSlowCaseInline): Use asString, asCell, asNumberCell, 
-        (JSC::strictEqualSlowCaseInline): Ditto.
-
-2008-10-18  Cameron Zwarich  <zwarich@apple.com>
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Simon Hausmann.
 
-        Bug 21702: Special op_create_activation for the case where there are no named parameters
-        <https://bugs.webkit.org/show_bug.cgi?id=21702>
+        [Qt] Make extraCompilers for generated sources depend on their scripts
 
-        This is a 2.5% speedup on the V8 Raytrace benchmark and a 1.1% speedup
-        on the V8 Earley-Boyer benchmark.
+        * DerivedSources.pro:
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_create_arguments_no_params):
-        * VM/Machine.h:
-        * kjs/Arguments.h:
-        (JSC::Arguments::):
-        (JSC::Arguments::Arguments):
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Tim Hatcher.
 
-        Reviewed by Cameron Zwarich.
-        
-        - in debug builds, alter the stack to avoid blowing out MallocStackLogging
+        When JavaScriptCore calls Debugger::Exception, have it pass a
+        hasHandler variable that represents if exception is being handled
+        in the same function (not in a parent on the call stack).
         
-        (In essence, while executing a CTI function we alter the return
-        address to jscGeneratedNativeCode so that a single consistent
-        function is on the stack instead of many random functions without
-        symbols.)
+        This just adds a new parameter, no behavior is changed.
 
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::doSetReturnAddress):
-        (JSC::):
-        (JSC::StackHack::StackHack):
-        (JSC::StackHack::~StackHack):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_profiler):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-
-2008-10-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Optimize op_call by allowing call sites to be directly linked to callees.
-
-        For the hot path of op_call, CTI now generates a check (initially for an impossible
-        value), and the first time the call is executed we attempt to link the call directly
-        to the callee.  We can currently only do so if the arity of the caller and callee
-        match.  The (optimized) setup for the call on the hot path is linked directly to
-        the ctiCode for the callee, without indirection.
-        
-        Two forms of the slow case of the call are generated, the first will be executed the
-        first time the call is reached.  As well as this path attempting to link the call to
-        a callee, it also relinks the slow case to a second slow case, which will not continue
-        to attempt relinking the call.  (This policy could be changed in future, but for not
-        this is intended to prevent thrashing).
-
-        If a callee that the caller has been linked to is garbage collected, then the link
-        in the caller's JIt code will be reset back to a value that cannot match - to prevent
-        any false positive matches.
-
-        ~20% progression on deltablue & richards, >12% overall reduction in v8-tests
-        runtime, one or two percent progression on sunspider.
-
-        Reviewed by Oliver Hunt.
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
 
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitNakedCall):
-        (JSC::unreachable):
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::unlinkCall):
-        (JSC::CTI::linkCall):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::unlinkCallers):
-        (JSC::CodeBlock::derefStructureIDs):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CallLinkInfo::CallLinkInfo):
-        (JSC::CodeBlock::addCaller):
-        (JSC::CodeBlock::removeCaller):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_profiler):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        * VM/Machine.h:
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::~JSFunction):
-        * kjs/JSFunction.h:
-        * kjs/nodes.h:
-        (JSC::FunctionBodyNode::):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::getDifferenceBetweenLabels):
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Geoff Garen.
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
         
-        - remove ASSERT that makes the leaks buildbot cry
+        (3% speedup on Dromaeo DOM Core tests)
 
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
+        * runtime/WeakGCMap.h:
+        (JSC::::get): inline
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+2010-01-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Cameron Zwarich
-        
-        - don't bother to do arguments tearoff when it will have no effect
+        Unreviewed build fix for JIT with RVCT.
 
-        ~1% on v8 raytrace
-        
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitReturn):
+        Remove IMPORT statement; cti_vm_throw is already defined in JITStubs.h.
+        Remove extra ')'.
 
-2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
+        * jit/JITStubs.cpp:
+        (JSC::ctiVMThrowTrampoline):
 
-        Reviewed by Sam Weinig. Landed by Jan Alonzo.
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21603
-        [GTK] Minor fixes to GOwnPtr
+        Reviewed by Oliver Hunt.
 
-        * wtf/GOwnPtr.cpp:
-        (WTF::GError):
-        (WTF::GList):
-        (WTF::GCond):
-        (WTF::GMutex):
-        (WTF::GPatternSpec):
-        (WTF::GDir):
-        * wtf/GOwnPtr.h:
-        (WTF::freeOwnedGPtr):
-        (WTF::GOwnPtr::~GOwnPtr):
-        (WTF::GOwnPtr::outPtr):
-        (WTF::GOwnPtr::set):
-        (WTF::GOwnPtr::clear):
-        * wtf/Threading.h:
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
 
-        Reviewed by Cameron Zwarich.
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
         
-        - speed up transitions that resize the property storage a fair bit
-        
-        ~3% speedup on v8 RayTrace benchmark, ~1% on DeltaBlue
-
-        * VM/CTI.cpp:
-        (JSC::resizePropertyStorage): renamed from transitionObject, and reduced to just resize
-        the object's property storage with one inline call.
-        (JSC::CTI::privateCompilePutByIdTransition): Use a separate function for property storage
-        resize, but still do all the rest of the work in assembly in that case, and pass the known
-        compile-time constants of old and new size rather than structureIDs, saving a bunch of
-        redundant memory access.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::allocatePropertyStorage): Just call the inline version.
-        * kjs/JSObject.h:
-        (JSC::JSObject::allocatePropertyStorageInline): Inline version of allocatePropertyStorage
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::pushl_i32): Add code to assmeble push of a constant; code originally by Cameron Zwarich.
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
 
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
 
-        Reviewed by Maciej Stachowiak.
-
-        Remove some C style casts.
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
 
-        * masm/X86Assembler.h:
-        (JSC::JITCodeBuffer::putIntUnchecked):
-        (JSC::X86Assembler::link):
-        (JSC::X86Assembler::linkAbsoluteAddress):
-        (JSC::X86Assembler::getRelocatedAddress):
+        Reviewed by NOBODY (build fix).
 
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+        Reverting r53455, breaks 2 javascriptcore tests.
 
-        Rubber-stamped by Maciej Stachowiak.
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrinkBlocks):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53454, since it causes much sadness in this world.
+
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
 
-        Remove some C style casts.
+        Reviewed by Oliver Hunt.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_fail):
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
 
-        Reviewed by Cameron Zwarich.
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
         
-        - Avoid restoring the caller's 'r' value in op_ret
-        https://bugs.webkit.org/show_bug.cgi?id=21319
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
 
-        This patch stops writing the call frame at call and return points;
-        instead it does so immediately before any CTI call.
-        
-        0.5% speedup or so on the v8 benchmark
-               
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
 
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Oliver Hunt.
 
-        Make WREC require CTI because it won't actually compile otherwise.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
 
-        * wtf/Platform.h:
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
 
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
 
-        Reviewed by Geoff Garen.
+2010-01-18  Kent Tamura  <tkent@chromium.org>
 
-        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
-        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+        Reviewed by Darin Adler.
 
-        This time there is no performance regression; we can avoid having
-        to use the fastcall calling convention for CTI functions by using
-        varargs to prevent the compiler from moving things around on the
-        stack.
-        
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * VM/Machine.h:
-        * wtf/Platform.h:
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
 
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+        Expose the following functions to be used by WebCore:
+         - WTF::msToyear()
+         - WTF::dayInYear()
+         - WTF::monthFromDayInYear()
+         - WTF::dayInMonthFromDayInYear()
 
-        Reviewed by Oliver Hunt.
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::msToYear): Remove "static inline".
+        (WTF::dayInYear): Remove "static inline".
+        (WTF::monthFromDayInYear): Remove "static inline".
+        (WTF::dayInMonthFromDayInYear): Remove "static inline".
+        * wtf/DateMath.h: Declare the above functions.
 
-        - fix for REGRESSION: r37631 causing crashes on buildbot
-        https://bugs.webkit.org/show_bug.cgi?id=21682
-        
-        * kjs/collector.cpp:
-        (JSC::Heap::collect): Avoid crashing when a GC occurs while no global objects are live.
+2010-01-18  Darin Adler  <darin@apple.com>
 
-2008-10-16  Sam Weinig  <sam@webkit.org>
+        Fix build by reverting the previous change.
 
-        Reviewed by Maciej Stachowiak.
+        * runtime/UString.h: Rolled out the FastAllocBase base class.
+        It was making UString larger, and therefore JSString larger,
+        and too big for a garbage collection cell.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
-        Don't create intermediate StructureIDs for builtin objects
+        This raises the unpleasant possibility that many classes became
+        larger because we added the FastAllocBase base class. I am
+        worried about this, and it needs to be investigated.
 
-        First step in reduce number of StructureIDs created when initializing the
-        JSGlobalObject.
+2010-01-18  Zoltan Horvath  <zoltan@webkit.org>
 
-        - In order to avoid creating the intermediate StructureIDs use the new putDirectWithoutTransition
-          and putDirectFunctionWithoutTransition to add properties to JSObjects without transitioning
-          the StructureID.  This patch just implements this strategy for ObjectPrototype but alone
-          reduces the number of StructureIDs create for about:blank by 10, from 142 to 132.
+        Reviewed by Darin Adler.
 
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirectWithoutTransition):
-        * kjs/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::ObjectPrototype):
-        * kjs/ObjectPrototype.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyWithoutTransition):
-        * kjs/StructureID.h:
+        Allow custom memory allocation control for UString class
+        https://bugs.webkit.org/show_bug.cgi?id=27831
 
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new' and no need to be copyable:
 
-        Reviewed by Cameron Zwarich.
-        
-        - fix for: REGRESSION: over 100 StructureIDs leak loading about:blank (result of fix for bug 21633)
-        
-        Apparent slight progression (< 0.5%) on v8 benchmarks and SunSpider.
+        class name     - instantiated at:
+        classs UString - JavaScriptCore/runtime/UString.cpp:160
 
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::~StructureID): Don't deref this object's parent's pointer to
-        itself from the destructor; that doesn't even make sense.
-        (JSC::StructureID::addPropertyTransition): Don't refer the single transition;
-        the rule is that parent StructureIDs are ref'd but child ones are not. Refing
-        the child creates a cycle.
+        * runtime/UString.h:
 
-2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-18  Evan Cheng  <evan.cheng@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21609
-        Make MessagePorts protect their peers across heaps
+        Add some ALWAYS_INLINE for key functions not inlined by some versions of GCC.
+        rdar://problem/7553780
 
-        * JavaScriptCore.exp:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::markCrossHeapDependentObjects):
-        * kjs/JSGlobalObject.h:
-        * kjs/collector.cpp:
-        (JSC::Heap::collect):
-        Before GC sweep phase, a function supplied by global object is now called for all global
-        objects in the heap, making it possible to implement cross-heap dependencies.
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): ALWAYS_INLINE both overloads.
+        * runtime/JSString.h:
+        (JSC::JSString::JSString): ALWAYS_INLINE the version that takes a UString.
+        * runtime/UString.h:
+        (JSC::operator==): ALWAYS_INLINE the version that compares two UString objects.
 
-2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21610
-        run-webkit-threads --threaded crashes in StructureID destructor
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        Protect access to a static (debug-only) HashSet with a lock.
+        Delete dftables-xxxxxxxx.in files automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=33796
 
-2008-10-15  Sam Weinig  <sam@webkit.org>
+        * pcre/dftables: unlink unnecessary temporary file.
 
-        Reviewed by Goeffrey Garen.
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Add function to dump statistics for StructureIDs.
+        Reviewed by Simon Hausmann.
 
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        * kjs/StructureID.h:
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Rolling out r53391 and r53392 because of random crashes on buildbots.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UString.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the build with strict gcc and RVCT versions: It's not legal to cast a
+        pointer to a function to a void* without an intermediate cast to a non-pointer
+        type. A cast to a ptrdiff_t inbetween fixes it.
+
+        * runtime/JSString.h:
+        (JSC::Fiber::JSString):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-15  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Maciej Stachowiak.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
 
-        Bug 21633: Avoid using a HashMap when there is only a single transition
-        <https://bugs.webkit.org/show_bug.cgi?id=21633>
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
 
-        This is a 0.8% speedup on SunSpider and between a 0.5% and 1.0% speedup
-        on the V8 benchmark suite, depending on which harness we use. It will
-        also slightly reduce the memory footprint of a StructureID.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
 
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::):
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Geoffrey Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
 
-        1.40% speedup on SunSpider, 1.44% speedup on V8. (Linux)
-        
-        No change on Mac.
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
 
-        * VM/Machine.cpp:
-        (JSC::fastIsNumber): ALWAYS_INLINE modifier added.
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
 
-2008-10-15  Geoffrey Garen  <ggaren@apple.com>
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Oliver Hunt.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
-        Start the debugger without reloading the inspected page
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
 
-        * JavaScriptCore.exp: New symbols.
-        * JavaScriptCore.xcodeproj/project.pbxproj: New files.
+        * runtime/JSString.h:
+        (JSC::jsStringWithFinalizer): Added new mechanism for a string to have an optional
+        finalizer callback, for the benefit of weak-referencing caches.
+        (JSC::):
+        (JSC::Fiber::JSString):
+        (JSC::Fiber::~JSString):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Clear fibers so this doesn't look like a string with a finalizer.
+        * runtime/WeakGCMap.h: Include "Collector.h" to make this header includable by itself.
 
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get): Updated for tweak to parsing API.
+2010-01-15  Sam Weinig  <sam@webkit.org>
 
-        * kjs/CollectorHeapIterator.h: Added. An iterator for the object heap,
-        which we use to find all the live functions and recompile them.
+        Reviewed by Maciej Stachowiak.
 
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Updated for tweak to parsing API.
+        Fix for <rdar://problem/7548432>
+        Add ALWAYS_INLINE to jsLess for a 1% speedup on llvm-gcc.
 
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction): Updated for tweak to parsing API.
+        * runtime/Operations.h:
+        (JSC::jsLess):
 
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction): Try to validate our SourceCode in debug
-        builds by ASSERTing that it's syntactically valid. This doesn't catch
-        all SourceCode bugs, but it catches a lot of them.
+2010-01-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval): Updated for tweak to parsing API.
+        Reviewed by Oliver Hunt.
 
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/Parser.h:
-        (JSC::Parser::parse): Tweaked the parser to make it possible to parse
-        without an ExecState, and to allow the client to specify a debugger to
-        notify (or not) about the source we parse. This allows the inspector
-        to recompile even though no JavaScript is executing, then notify the
-        debugger about all source code when it's done.
+        REGRESISON: Google maps buttons not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=31871
 
-        * kjs/Shell.cpp:
-        (prettyPrintScript): Updated for tweak to parsing API.
+        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
+        getting directions for a second time
+        https://bugs.webkit.org/show_bug.cgi?id=33446
+        
+        SunSpider and v8 report no change.
 
-        * kjs/SourceRange.h:
-        (JSC::SourceCode::isNull): Added to help with ASSERTs.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
+        flattening the dictionary changed any of its offsets.
 
-        * kjs/collector.cpp:
-        (JSC::Heap::heapAllocate):
-        (JSC::Heap::sweep):
-        (JSC::Heap::primaryHeapBegin):
-        (JSC::Heap::primaryHeapEnd):
-        * kjs/collector.h:
-        (JSC::): Moved a bunch of declarations around to enable compilation of
-        CollectorHeapIterator.
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): ditto
 
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate): Updated for tweak to parsing API.
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
 
-        * kjs/lexer.h:
-        (JSC::Lexer::sourceCode): BUG FIX: Calculate SourceCode ranges relative
-        to the SourceCode range in which we're lexing, otherwise nested functions
-        that are compiled individually get SourceCode ranges that don't reflect
-        their nesting.
+        Reviewed by Oliver Hunt.
 
-        * kjs/nodes.cpp:
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::finishParsing):
-        (JSC::FunctionBodyNode::create):
-        (JSC::FunctionBodyNode::copyParameters):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::setSource):
-        (JSC::FunctionBodyNode::parameterCount): Added some helper functions for
-        copying one FunctionBodyNode's parameters to another. The recompiler uses
-        these when calling "finishParsing".
+        https://bugs.webkit.org/show_bug.cgi?id=33705
+        UStringImpl::create() should use internal storage
 
-2008-10-15  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+        When creating a UStringImpl copying of a UChar*, we can use an internal buffer,
+        by calling UStringImpl::tryCreateUninitialized().
 
-        Reviewed by Darin Adler.
+        Also, remove duplicate of copyChars from JSString, call UStringImpl's version.
 
-        - part of https://bugs.webkit.org/show_bug.cgi?id=20746
-          Fix compilation on Windows CE.
+        Small (max 0.5%) progression on Sunspidey.
 
-        str(n)icmp, strdup and vsnprintf are not available on Windows CE,
-        they are called _str(n)icmp, etc. instead
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
 
-        * wtf/StringExtras.h: Added inline function implementations.
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-15  Gabor Loki  <loki@inf.u-szeged.hu>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Cameron Zwarich.
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        UString::create() creates a copy of the UChar* passed, but UStringImpl::create() assumes
+        that it should assume ownership of the provided buffer (with UString::createNonCopying()
+        and UStringImpl::createCopying() providing the alternate behaviours).  Unify on create()
+        taking a copy of the provided buffer.  For non-copying cases, use the name 'adopt', and
+        make this method take a Vector<UChar>&.  For cases where non-copying construction was being
+        used, other than from a Vector<UChar>, change the code to allocate the storage along with
+        the UStringImpl using UStringImpl::createUninitialized().  (The adopt() method also more
+        closely matches that of WebCore::StringImpl).
+
+        Also, UString::createUninitialized() and UStringImpl::createUninitialized() have incompatible
+        behaviours, in that the UString form sets the provided UChar* to a null or non-null value to
+        indicate success or failure, but UStringImpl uses the returned PassRefPtr<UStringImpl> to
+        indicate when allocation has failed (potentially leaving the output Char* uninitialized).
+        This is also incompatible with WebCore::StringImpl's behaviour, in that
+        StringImpl::createUninitialized() will CRASH() if unable to allocate.  Some uses of
+        createUninitialized() in JSC are unsafe, since they do not test the result for null.
+        UStringImpl's indication is preferable, since we may want a successful call to set the result
+        buffer to 0 (specifically, StringImpl returns 0 for the buffer where createUninitialized()
+        returns the empty string, which seems reasonable to catch bugs early).  UString's method
+        cannot support UStringImpl's behaviour directly, since it returns an object rather than a
+        pointer.
+            - remove UString::createUninitialized(), replace with calls to UStringImpl::createUninitialized()
+            - create a UStringImpl::tryCreateUninitialized() form UStringImpl::createUninitialized(),
+              with current behaviour, make createUninitialized() crash on failure to allocate.
+            - make cases in JSC that do not check the result call createUninitialized(), and cases that do
+              check call tryCreateUninitialized().
 
-        <https://bugs.webkit.org/show_bug.cgi?id=20912>
-        Use simple uint32_t multiplication on op_mul if both operands are
-        immediate number and they are between zero and 0x7FFF.
+        Rename computedHash() to existingHash(), to bring this in line wih WebCore::StringImpl.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHash::hash):
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::IdentifierRepHash::hash):
+        (JSC::makeString):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::existingHash):
 
-2008-10-09  Darin Fisher  <darin@chromium.org>
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Oliver Hunt.
 
-        Make pan scrolling a platform configurable option.
-        https://bugs.webkit.org/show_bug.cgi?id=21515
+        JSON.stringify and JSON.parse needlessly process properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33053
 
-        * wtf/Platform.h: Add ENABLE_PAN_SCROLLING
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
 
-2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
 
-        Rubber stamped by Sam Weinig.
-        
-        - revert r37572 and r37581 for now
-        
-        Turns out GCC 4.2 is still a (small) regression, we'll have to do
-        more work to turn it on.
+        Reviewed by NOBODY (buildfix).
 
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        * wtf/Platform.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-2008-10-14  Alexey Proskuryakov  <ap@webkit.org>
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20256
-        Array.push and other standard methods disappear
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
 
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        Don't use static hash tables even on platforms that don't enable JSC_MULTIPLE_THREADS -
-        these tables reference IdentifierTable, which is always per-GlobalData.
+        Test: fast/js/end-in-string-escape.html
 
-2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
 
-        Reviewed by Cameron Zwarich.
-        
-        - always use CTI_ARGUMENTS and CTI_ARGUMENTS_FASTCALL
-        
-        This is a small regression for GCC 4.0, but simplifies the code
-        for future improvements and lets us focus on GCC 4.2+ and MSVC.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        * wtf/Platform.h:
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by NOBODY (buildfix).
 
-        Reviewed by Cameron Zwarich.
-        
-        - make Machine::getArgumentsData an Arguments method and inline it
-        
-        ~2% on v8 raytrace
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        * VM/Machine.cpp:
-        * kjs/Arguments.h:
-        (JSC::Machine::getArgumentsData):
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-13  Alp Toker  <alp@nuanti.com>
+        Rubber stamped by Sam Weinig & Darin Adler.
 
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
+        Three quick fixes to UStringImpl.
+            - The destroy() method can be switched back to a normal destructor; since we've switched
+              the way we protect static strings to be using an odd ref-count the destroy() won't abort.
+            - The cost() calculation logic was wrong.  If you have multiple JSStrings wrapping substrings
+              of a base string, they would each report the full cost of the base string to the heap.
+              Instead we should only be reporting once for the base string.
+            - Remove the overloaded new operator calling fastMalloc, replace this with a 'using' to pick
+              up the implementation from the parent class.
 
-        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
 
-2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
 
-        Rubber stamped by Mark Rowe.
-        
-        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
-        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+        Reviewed by Simon Hausmann.
 
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
 
-2008-10-13  Cameron Zwarich  <zwarich@apple.com>
+        * DerivedSources.pro: Added.
+        * JavaScriptCore.pri: Moved source generation to DerivedSources.pro
+        * pcre/pcre.pri: Moved source generation to DerivedSources.pro
 
-        Reviewed by Geoff Garen.
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
 
-        Bug 21541: Move RegisterFile growth check to callee
-        <https://bugs.webkit.org/show_bug.cgi?id=21541>
-
-        Move the RegisterFile growth check to the callee in the common case,
-        where some of the information is known statically at JIT time. There is
-        still a check in the caller in the case where the caller provides too
-        few arguments.
-
-        This is a 2.1% speedup on the V8 benchmark, including a 5.1% speedup on
-        the Richards benchmark, a 4.1% speedup on the DeltaBlue benchmark, and a
-        1.4% speedup on the Earley-Boyer benchmark. It is also a 0.5% speedup on
-        SunSpider.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        * VM/RegisterFile.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::cmpl_mr):
-        (JSC::X86Assembler::emitUnlinkedJg):
+        Reviewed by Geoffrey Garen.
 
-2008-10-13  Sam Weinig  <sam@webkit.org>
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
 
-        Reviewed by Dan Bernstein.
+        Add an extra argument to getPropertyNames() and getOwnPropertyNames()
+        (and all reimplementations thereof) that indicates whether non-enumerable
+        properties should be added.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
-        5 false positive StructureID leaks
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp: Rename getEnumerablePropertyNames() to getPropertyNames(), which takes an extra argument.
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::):
 
-        - Add leak ignore set to StructureID to selectively ignore leaking some StructureIDs.
-        - Add create method to JSGlolalData to be used when the data will be intentionally
-          leaked and ignore all leaks caused the StructureIDs stored in it.
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
 
-        * JavaScriptCore.exp:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::createLeaked):
-        * kjs/JSGlobalData.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::startIgnoringLeaks):
-        (JSC::StructureID::stopIgnoringLeaks):
-        * kjs/StructureID.h:
+        Reviewed by Darin Adler.
 
-2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
 
-        Reviewed by Darin Adler. Landed by Jan Alonzo.
+        * jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp: (JSC::Identifier::checkSameIdentifierTable):
+        * wtf/FastMalloc.cpp:
+        * wtf/HashTable.h: (WTF::HashTableConstIterator::checkValidity):
+        * yarr/RegexCompiler.cpp: (JSC::Yarr::compileRegex):
 
-        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
-        http://bugs.webkit.org/show_bug.cgi?id=20483
+2009-11-23  Yong Li  <yoli@rim.com>
 
-        Add a GOwnPtr smart pointer (similar to OwnPtr) to handle memory
-        allocated by GLib and start the conversion to use it.
+        Reviewed by Adam Treat.
 
-        * GNUmakefile.am:
-        * wtf/GOwnPtr.cpp: Added.
-        (WTF::GError):
-        (WTF::GList):
-        (WTF::GCond):
-        (WTF::GMutex):
-        (WTF::GPatternSpec):
-        (WTF::GDir):
-        * wtf/GOwnPtr.h: Added.
-        (WTF::freeOwnedPtr):
-        (WTF::GOwnPtr::GOwnPtr):
-        (WTF::GOwnPtr::~GOwnPtr):
-        (WTF::GOwnPtr::get):
-        (WTF::GOwnPtr::release):
-        (WTF::GOwnPtr::rawPtr):
-        (WTF::GOwnPtr::set):
-        (WTF::GOwnPtr::clear):
-        (WTF::GOwnPtr::operator*):
-        (WTF::GOwnPtr::operator->):
-        (WTF::GOwnPtr::operator!):
-        (WTF::GOwnPtr::operator UnspecifiedBoolType):
-        (WTF::GOwnPtr::swap):
-        (WTF::swap):
-        (WTF::operator==):
-        (WTF::operator!=):
-        (WTF::getPtr):
-        * wtf/Threading.h:
-        * wtf/ThreadingGtk.cpp:
-        (WTF::Mutex::~Mutex):
-        (WTF::Mutex::lock):
-        (WTF::Mutex::tryLock):
-        (WTF::Mutex::unlock):
-        (WTF::ThreadCondition::~ThreadCondition):
-        (WTF::ThreadCondition::wait):
-        (WTF::ThreadCondition::timedWait):
-        (WTF::ThreadCondition::signal):
-        (WTF::ThreadCondition::broadcast):
-
-2008-10-12  Gabriella Toth  <gtoth@inf.u-szeged.hu>
+        Make GIF decoder support down-sampling
+        https://bugs.webkit.org/show_bug.cgi?id=31806
 
-        Reviewed by Darin Adler.
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::upperBoundScaledY):
+        (WebCore::ImageDecoder::lowerBoundScaledY):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::scaledRect):
+        (WebCore::RGBA32Buffer::setScaledRect):
+        (WebCore::ImageDecoder::scaledSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::copyOnePixel):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
 
-        - part of https://bugs.webkit.org/show_bug.cgi?id=21055
-          Bug 21055: not invoked functions
+2010-01-12  Adam Barth  <abarth@webkit.org>
 
-        * kjs/nodes.cpp: Deleted a function that is not invoked:
-        statementListInitializeVariableAccessStack.
+        Reviewed by Eric Seidel.
 
-2008-10-12  Darin Adler  <darin@apple.com>
+        ecma/Date/15.9.5.12-1.js fails every night at midnight
+        https://bugs.webkit.org/show_bug.cgi?id=28041
 
-        Reviewed by Sam Weinig.
+        Change the test to use a concrete time instead of "now".
 
-        * wtf/unicode/icu/UnicodeIcu.h: Fixed indentation to match WebKit coding style.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js:
 
-2008-10-12  Darin Adler  <darin@apple.com>
+2010-01-11  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Ariya Hidayat.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21556
-          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
+        [Qt] Enable JIT and YARR_JIT if (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100)
 
-        * wtf/unicode/icu/UnicodeIcu.h: Removed isDigit, digitValue, and isFormatChar.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+        * wtf/Platform.h:
 
-2008-10-12  Anders Carlsson  <andersca@apple.com>
+2010-01-11  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Alexey Proskuryakov.
 
-        Make the append method that takes a Vector more strict - it now requires the elements 
-        of the vector to be appended same type as the elements of the Vector they're being appended to.
+        https://bugs.webkit.org/show_bug.cgi?id=33481
+        Uninitialized data members in ArrayStorage
         
-        This would cause problems when dealing with Vectors containing other Vectors.
-        
-        * wtf/Vector.h:
-        (WTF::::append):
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize missing data members in the two cases
+        where we don't use fastZeroedMalloc, so it doesn't happen automatically.
 
-2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Clean up RegExpMatchesArray.h to match our coding style.
+        https://bugs.webkit.org/show_bug.cgi?id=33480
+        
+        Improve debugging reliability for WTF on Windows.
+        Store WTF static library's PDB file into a better location.
 
-        * kjs/RegExpMatchesArray.h:
-        (JSC::RegExpMatchesArray::getOwnPropertySlot):
-        (JSC::RegExpMatchesArray::put):
-        (JSC::RegExpMatchesArray::deleteProperty):
-        (JSC::RegExpMatchesArray::getPropertyNames):
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
 
-2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
 
-        Reviewed by Sam Weinig.
+        Windows build fix.
+        Remove extraneous entries from def file causing build warning.
 
-        Bug 21525: 55 StructureID leaks on Wikitravel's main page
-        <https://bugs.webkit.org/show_bug.cgi?id=21525>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Bug 21533: Simple JavaScript code leaks StructureIDs
-        <https://bugs.webkit.org/show_bug.cgi?id=21533>
+2010-01-10  Kent Hansen  <kent.hansen@nokia.com>
 
-        StructureID::getEnumerablePropertyNames() ends up calling back to itself
-        via JSObject::getPropertyNames(), which causes the PropertyNameArray to
-        be cached twice. This leads to a memory leak in almost every use of
-        JSObject::getPropertyNames() on an object. The fix here is based on a
-        suggestion of Sam Weinig.
+        Reviewed by Darin Adler.
 
-        This patch also fixes every StructureID leaks that occurs while running
-        the Mozilla MemBuster test.
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
 
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::setCacheable):
-        (JSC::PropertyNameArray::cacheable):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
 
-2008-10-10  Oliver Hunt  <oliver@apple.com>
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
 
-        Reviewed by Cameron Zwarich.
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        (AddRegExpCases):
+        * tests/mozilla/js1_2/regexp/toString.js:
+        Update relevant Mozilla tests (Mozilla has had this behavior since November 2003).
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/ecma/Array/15.4.1.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.1.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.1-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.13.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.16.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.18.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.5.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.7.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/TypeConversion/9.5-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/LexicalConventions/keywords-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/RegExp/exec-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/match-004.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/replace-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/split-002.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/Date/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_3/Exceptions/regress-181654.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-209067.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-85721.js: Added property allow-tabs.
+        * tests/mozilla/importList.html: Added property allow-tabs.
+        * tests/mozilla/js1_1/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Objects/toString-001.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/charCodeAt.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/concat.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/String/match.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Function_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Number.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/String.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/nesting.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-2-n.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/jsref.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/equality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/strictEquality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_dollar_number.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastIndex.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/alphanumeric.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/asterisk.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backslash.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backspace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/beginLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/character_class.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/compile.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/control_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/digit.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/dot.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/endLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/everything.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/exec.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/flags.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/global.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/hexadecimal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/ignoreCase.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/interval.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/octal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/parentheses.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/plus.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/question_mark.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/simple_form.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/source.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/special_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_replace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_search.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_split.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/test.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/toString.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/vertical_bar.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/whitespace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/word_boundary.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/break.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/continue.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/do_while.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch2.js: Added property allow-tabs.
+        * tests/mozilla/js1_3/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_4/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-111557.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-216320.js: Added property allow-tabs.
+        * tests/mozilla/menuhead.html: Added property allow-tabs.
+        * tests/mozilla/mklistpage.pl: Added property allow-tabs.
+        * tests/mozilla/runtests.pl: Added property allow-tabs.
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+        Moreover, fixes all "Weird number of spaces at line-start. Are you using a 4-space indent?"
+        errors reported by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
 
-        Use fastcall calling convention on GCC > 4.0
+        * wtf/Platform.h:
 
-        Results in a 2-3% improvement in GCC 4.2 performance, so
-        that it is no longer a regression vs. GCC 4.0
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
 
-        * VM/CTI.cpp:
-        * VM/Machine.h:
-        * wtf/Platform.h:
+        Reviewed by Eric Seidel.
 
-2008-10-10  Sam Weinig  <sam@webkit.org>
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
 
-        Reviewed by Darin Adler.
+        It's unused; the string representation is reconstructed from flags.
 
-        - Add a workaround for a bug in ceil in Darwin libc.
-        - Remove old workarounds for JS math functions that are not needed
-          anymore.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
 
-        The math functions are heavily tested by fast/js/math.html.
+2010-01-08  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/MathObject.cpp:
-        (JSC::mathProtoFuncAbs): Remove workaround.
-        (JSC::mathProtoFuncCeil): Ditto.
-        (JSC::mathProtoFuncFloor): Ditto.
-        * wtf/MathExtras.h:
-        (wtf_ceil): Add ceil workaround for darwin.
+        Reviewed by Oliver Hunt.
 
-2008-10-10  Sam Weinig  <sam@webkit.org>
+        Memory use grows grows possibly unbounded in this JavaScript Array test case
+        https://bugs.webkit.org/show_bug.cgi?id=31675
 
-        Reviewed by Darin Adler
+        This fixes one observed bug in this test case, which is that
+        arrays don't report extra cost for the sparse value maps.
 
-        Add Assertions to JSObject constructor.
+        SunSpider reports a small speedup.
 
-        * kjs/JSObject.h:
-        (JSC::JSObject::JSObject):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Report extra memory cost for
+        the sparse value map.
+        * runtime/JSArray.h: 
 
-2008-10-10  Sam Weinig  <sam@webkit.org>
+2010-01-08  Yong Li  <yoli@rim.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Darin Adler.
 
-        Remove now unused m_getterSetterFlag variable from PropertyMap.
+        Remove unnecessary #include from FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33393
 
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::operator=):
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::PropertyMap):
+        * wtf/FastMalloc.cpp:
 
-2008-10-09  Sam Weinig  <sam@webkit.org>
+2010-01-08  Eric Seidel  <eric@webkit.org>
 
-        Reviewed by Maciej Stachowiak.
+        No review, rolling out r52983.
+        http://trac.webkit.org/changeset/52983
+        https://bugs.webkit.org/show_bug.cgi?id=33321
 
-        Add leaks checking to StructureID.
+        Broke 59 JavaScriptCore tests.  I don't think Kent knew about
+        run-javascriptcore-tests.  Sadly neither does the commit-bot,
+        yet.
 
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        (JSC::RegExp::flags):
 
-2008-10-09  Alp Toker  <alp@nuanti.com>
+2010-01-08  Eric Seidel  <eric@webkit.org>
 
-        Reviewed by Mark Rowe.
+        No review, rolling out r52981.
+        http://trac.webkit.org/changeset/52981
+        https://bugs.webkit.org/show_bug.cgi?id=33319
 
-        https://bugs.webkit.org/show_bug.cgi?id=20760
-        Implement support for x86 Linux in CTI
+        Caused two JS tests to start failing:
+        ecma_2/RegExp/properties-001.js and js1_2/regexp/toString.js
 
-        Prepare to enable CTI/WREC on supported architectures.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
 
-        Make it possible to use the CTI_ARGUMENT workaround with GCC as well
-        as MSVC by fixing some preprocessor conditionals.
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
 
-        Note that CTI/WREC no longer requires CTI_ARGUMENT on Linux so we
-        don't actually enable it except when building with MSVC. GCC on Win32
-        remains untested.
+        Reviewed by Darin Adler.
 
-        Adapt inline ASM code to use the global symbol underscore prefix only
-        on Darwin and to call the properly mangled Machine::cti_vm_throw
-        symbol name depending on CTI_ARGUMENT.
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
 
-        Also avoid global inclusion of the JIT infrastructure headers
-        throughout WebCore and WebKit causing recompilation of about ~1500
-        source files after modification to X86Assembler.h, CTI.h, WREC.h,
-        which are only used deep inside JavaScriptCore.
+        It's unused; the string representation is reconstructed from flags.
 
-        * GNUmakefile.am:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/regexp.cpp:
+        * runtime/RegExp.cpp:
         (JSC::RegExp::RegExp):
-        (JSC::RegExp::~RegExp):
-        (JSC::RegExp::match):
-        * kjs/regexp.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitConvertToFastCall):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        (JSC::X86Assembler::emitRestoreArgumentReference):
+        * runtime/RegExp.h:
 
-2008-10-09  Gavin Barraclough  <barraclough@apple.com>
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Darin Adler.
 
-        Fix for bug #21160, x=0;1/(x*-1) == -Infinity
-
-        * ChangeLog:
-        * VM/CTI.cpp:
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::emitUnlinkedJs):
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
 
-2008-10-09  Cameron Zwarich  <zwarich@apple.com>
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
 
-        Reviewed by Oliver Hunt.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
 
-        Bug 21459: REGRESSION (r37324): Safari crashes inside JavaScriptCore while browsing hulu.com
-        <https://bugs.webkit.org/show_bug.cgi?id=21459>
+2010-01-08  Norbert Leser  <norbert.leser@nokia.com>
 
-        After r37324, an Arguments object does not mark an associated activation
-        object. This change was made because Arguments no longer directly used
-        the activation object in any way. However, if an activation is torn off,
-        then the backing store of Arguments becomes the register array of the
-        activation object. Arguments directly marks all of the arguments, but
-        the activation object is being collected, which causes its register
-        array to be freed and new memory to be allocated in its place.
+        Reviewed by Darin Adler.
 
-        Unfortunately, it does not seem possible to reproduce this issue in a
-        layout test.
+        RVCT compiler with "-Otime -O3" optimization tries to optimize out 
+        inline new'ed pointers that are passed as arguments.
+        Proposed patch assigns new'ed pointer explicitly outside function call.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        (JSC::JSActivation::copyRegisters):
+        https://bugs.webkit.org/show_bug.cgi?id=33084
 
-2008-10-09  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
 
-        Reviewed by Simon.
+2010-01-08  Gabor Loki  <loki@webkit.org>
 
-        Build fix for MinGW.
+        Reviewed by Gavin Barraclough.
 
-        * wtf/AlwaysInline.h:
+        Remove an unnecessary cacheFlush from ARM_TRADITIONAL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=33203
 
-2008-10-08  Cameron Zwarich  <zwarich@apple.com>
+        * assembler/ARMAssembler.cpp: Remove obsolete linkBranch function.
+        (JSC::ARMAssembler::executableCopy): Inline a clean linkBranch code.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getLdrImmAddress): Use inline function.
+        (JSC::ARMAssembler::getLdrImmAddressOnPool): Ditto.
+        (JSC::ARMAssembler::patchPointerInternal): Remove an unnecessary cacheFlush.
+        (JSC::ARMAssembler::linkJump): Use patchPointerInternal instead of linkBranch.
+        (JSC::ARMAssembler::linkCall): Ditto.
+        (JSC::ARMAssembler::relinkCall): Ditto.
 
-        Reviewed by Maciej Stachowiak.
+2010-01-07  Gabor Loki  <loki@webkit.org>
 
-        Bug 21497: REGRESSION (r37433): Bytecode JSC tests are severely broken
-        <https://bugs.webkit.org/show_bug.cgi?id=21497>
+        Reviewed by Gavin Barraclough.
 
-        Fix a typo in r37433 that causes the failure of a large number of JSC
-        tests with the bytecode interpreter enabled.
+        Build fix for JSVALUE32 when ENABLE_JIT_OPTIMIZE* are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=33311
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        Move compileGetDirectOffset function to common part of JSVALUE32
 
-2008-10-08  Mark Rowe  <mrowe@apple.com>
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
 
-        Windows build fix.
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * VM/CTI.cpp:
-        (JSC::): Update type of argument to ctiTrampoline.
+        Reviewed by Maciej Stachowiak.
 
-2008-10-08  Darin Adler  <darin@apple.com>
+        Allow call sites to determine if ASSERT_* and LOG_* macros are operational
+        https://bugs.webkit.org/show_bug.cgi?id=33020
 
-        Reviewed by Cameron Zwarich.
+        * wtf/Assertions.h: Set ASSERT_MSG_DISABLED, FATAL_DISABLED,
+        ERROR_DISABLED, LOG_DISABLED to 1 if the compiler does not support
+        variadic macros. Refactor for better readibility.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21403
-          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+2010-01-07  Daniel Bates  <dbates@rim.com>
 
-        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
-        client over to the new name.
+        Reviewed by Eric Seidel.
 
-        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
-        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
-        accessor functions to get at things in the frame.
+        https://bugs.webkit.org/show_bug.cgi?id=32987
 
-        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
-        JSGlobalData* and in other cases eliminating them entirely.
+        Added ENABLE_XHTMLMP flag. Disabled by default.
 
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectDeleteProperty):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * VM/CTI.cpp:
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        (JSC::CodeGenerator::emitLoad):
-        (JSC::CodeGenerator::emitUnexpectedLoad):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::jsAddSlowCase):
-        (JSC::jsAdd):
-        (JSC::jsTypeStringForValue):
-        (JSC::Machine::resolve):
-        (JSC::Machine::resolveSkip):
-        (JSC::Machine::resolveGlobal):
-        (JSC::inlineResolveBase):
-        (JSC::Machine::resolveBase):
-        (JSC::Machine::resolveBaseAndProperty):
-        (JSC::Machine::resolveBaseAndFunc):
-        (JSC::Machine::slideRegisterWindowForCall):
-        (JSC::isNotObject):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::throwException):
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute):
-        (JSC::Machine::debug):
-        (JSC::Machine::createExceptionScope):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::findFunctionCallFrame):
-        (JSC::Machine::getArgumentsData):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::getCTIArrayLengthTrampoline):
-        (JSC::Machine::getCTIStringLengthTrampoline):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/RegisterFile.h:
-        * kjs/Arguments.h:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        (JSC::DebuggerCallFrame::thisObject):
-        (JSC::DebuggerCallFrame::evaluate):
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ExecState.cpp:
-        (JSC::CallFrame::thisValue):
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * kjs/JSVariableObject.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * kjs/Shell.cpp:
-        (prettyPrintScript):
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * kjs/identifier.cpp:
-        (JSC::Identifier::checkSameIdentifierTable):
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::RegExpNode::emitCode):
-        (JSC::ArrayNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
-        * kjs/nodes.h:
-        * kjs/regexp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * kjs/regexp.h:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
+        * Configurations/FeatureDefines.xcconfig:
 
-2008-10-08  Mark Rowe  <mrowe@apple.com>
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Typed by Maciej Stachowiak, reviewed by Mark Rowe.
+        Reviewed by Gavin Barraclough.
 
-        Fix crash in fast/js/constant-folding.html with CTI disabled.
+        [Symbian] Port ARM traditional JIT Trampolines to RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=30552
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        Take the GCC implementation and mechanically convert
+        it to RVCT syntax.
 
-2008-10-08  Timothy Hatcher  <timothy@apple.com>
+        Use 'bx rX' instead of 'mov pc, rX' when it is available.
 
-        Roll out r37427 because it causes an infinite recursion loading about:blank.
+        Developed in cooperation with Iain Campbell and Gabor Loki.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21476
+        * JavaScriptCore.pri: Extra step to generate RVCT stubs. The 
+        script generation intentionally executed all the time not just
+        for RVCT targets.
 
-2008-10-08  Darin Adler  <darin@apple.com>
+        * create_rvct_stubs: Added. Perl script to expand precompiler macros
+        for RVCT assembler - the template is defined in JITStubs.cpp.
 
-        Reviewed by Cameron Zwarich.
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21403
-          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
 
-        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
-        client over to the new name.
+        Reviewed by Sam Weinig.
 
-        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
-        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
-        accessor functions to get at things in the frame.
+        Fix a crash seen on the buildbots.
 
-        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
-        JSGlobalData* and in other cases eliminating them entirely.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Disable specific function tracking here,
+        instead of in WebCore, to ensure that the disabling happens before a
+        specific function can be registered.
 
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectDeleteProperty):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * VM/CTI.cpp:
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        (JSC::CodeGenerator::emitLoad):
-        (JSC::CodeGenerator::emitUnexpectedLoad):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::jsAddSlowCase):
-        (JSC::jsAdd):
-        (JSC::jsTypeStringForValue):
-        (JSC::Machine::resolve):
-        (JSC::Machine::resolveSkip):
-        (JSC::Machine::resolveGlobal):
-        (JSC::inlineResolveBase):
-        (JSC::Machine::resolveBase):
-        (JSC::Machine::resolveBaseAndProperty):
-        (JSC::Machine::resolveBaseAndFunc):
-        (JSC::Machine::slideRegisterWindowForCall):
-        (JSC::isNotObject):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::throwException):
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute):
-        (JSC::Machine::debug):
-        (JSC::Machine::createExceptionScope):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::findFunctionCallFrame):
-        (JSC::Machine::getArgumentsData):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::getCTIArrayLengthTrampoline):
-        (JSC::Machine::getCTIStringLengthTrampoline):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/RegisterFile.h:
-        * kjs/Arguments.h:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        (JSC::DebuggerCallFrame::thisObject):
-        (JSC::DebuggerCallFrame::evaluate):
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ExecState.cpp:
-        (JSC::CallFrame::thisValue):
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * kjs/JSVariableObject.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * kjs/Shell.cpp:
-        (prettyPrintScript):
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * kjs/identifier.cpp:
-        (JSC::Identifier::checkSameIdentifierTable):
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::RegExpNode::emitCode):
-        (JSC::ArrayNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
-        * kjs/nodes.h:
-        * kjs/regexp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * kjs/regexp.h:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
 
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+        Mac build fix.
 
-        Reviewed by Oliver Hunt.
+        * JavaScriptCore.exp: Export new JSGlobalData static data members.
 
-        Avoid endless loops when compiling without the computed goto
-        optimization.
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
 
-        NEXT_OPCODE expands to "continue", which will not work inside
-        loops.
+        Reviewed by Geoffrey Garen.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
 
-2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
 
-        Reviewed by Oliver Hunt.
+        Test: fast/js/webcore-string-comparison.html
 
-        Re-landing the following fix with the crashing bug in it fixed (r37405):
-        
-        - optimize away multiplication by constant 1.0
-        
-        2.3% speedup on v8 RayTrace benchmark
-
-        Apparently it's not uncommon for JavaScript code to multiply by
-        constant 1.0 in the mistaken belief that this converts integer to
-        floating point and that there is any operational difference.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
-        case where parameter is already number.
-        (JSC::CTI::privateCompileSlowCases): ditto
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): ditto
-        * kjs/grammar.y:
-        (makeMultNode): Transform as follows:
-        +FOO * BAR ==> FOO * BAR
-        FOO * +BAR ==> FOO * BAR
-        FOO * 1 ==> +FOO
-        1 * FOO ==> +FOO
-        (makeDivNode): Transform as follows:
-        +FOO / BAR ==> FOO / BAR
-        FOO / +BAR ==> FOO / BAR
-        (makeSubNode): Transform as follows:
-        +FOO - BAR ==> FOO - BAR
-        FOO - +BAR ==> FOO - BAR
-        * kjs/nodes.h:
-        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
-        grammar.y changes
-        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
-
-2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+        In r49365, some code was moved from JSString.cpp to JSString.h, and as a result, WebCore
+        got a way to directly instantiate JSStrings over DLL borders. Since vftable for JSString was
+        not exported, objects created from WebCore got a different vptr, and JavaScriptCore
+        optimizations that relied on vptr of all JSString objects being equal failed.
 
-        Reviewed by Oliver Hunt.
-        
-        - correctly handle appending -0 to a string, it should stringify as just 0
+        * config.h: Added a JS_EXPORTCLASS macro for exporting classes. It's currently the same as
+        JS_EXPORTDATA, but it clearly needed a new name.
 
-        * kjs/ustring.cpp:
-        (JSC::concatenate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Store vptrs just once, no need to repeatedly pick and copy them. This makes it possible to
+        assert vptr correctness in object destructors (which don't have access to JSGlobalData,
+        and even Heap::heap(this) will fail for fake objects created from storeVPtrs()).
+
+        * runtime/JSArray.cpp: (JSC::JSArray::~JSArray): Assert that vptr is what we expect it to be.
+        It's important to assert in destructor, because MSVC changes the vptr after constructor
+        is invoked.
+        * runtime/JSByteArray.cpp: (JSC::JSByteArray::~JSByteArray): Ditto.
+        * runtime/JSByteArray.h: Ditto.
+        * runtime/JSFunction.h: Ditto.
+        * runtime/JSFunction.cpp: (JSC::JSFunction::~JSFunction): Ditto.
+
+        * runtime/JSCell.h: (JSC::JSCell::setVPtr): Added a method to substitute vptr for another
+        one.
+
+        * runtime/JSString.h: Export JSString class together with its vftable, and tell other
+        libraries tp import it. This is needed on platforms that have a separate JavaScriptCore
+        dynamic library - and on Mac, we already did the export via JavaScriptCore.exp.
+        (JSC::JSString::~JSString): Assert tha vptr is what we expect it to be.
+        (JSC::fixupVPtr): Store a previously saved primary vftable pointer (do nothing if building
+        JavaScriptCore itself).
+        (JSC::jsSingleCharacterString): Call fixupVPtr in case this is call across DLL boundary.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
 
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new static
+        JSGlobalData members that are used in WebCore via inline functions.
 
-        Reviewed by Simon.
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
 
-        Fix WebKit compilation with VC2008SP1
+        Reviewed by Sam Weinig.
 
-        Apply the TR1 workaround for JavaScriptCore, too.
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        The memory use was caused by the global object creating too many structures
+        as it thrashed between different specific functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::despecifyAllFunctions):
+        * runtime/Structure.h:
+        (JSC::Structure::disableSpecificFunctionTracking): Track a thrash count
+        for specific functions. Disable specific function tracking once the
+        thrash count has been hit.
+
+2010-01-07  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * JavaScriptCore.pro:
+        Reviewed by Simon Hausmann.
 
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+        [Qt] Enable JIT in debug mode on win32 after r51141 fixed the crashes.
 
-        Reviewed by Simon.
+        * JavaScriptCore.pri:
 
-        Fix compilation errors on VS2008 64Bit
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
 
-        * kjs/collector.cpp:
-        (JSC::currentThreadStackBase):
+        Reviewed by Holger Freyther.
 
-2008-10-08  AndrĂ© Pönitz  <apoenitz@trolltech.com>
+        [Mac] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
 
-        Reviewed by Simon.
+        Using of operator += cause compile error on Mac, so it is changed to
+        "= static_cast<AllocAlignmentInteger*>(old_ptr) + 1".
 
-        Fix compilation with Qt namespaces.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
 
-        * wtf/Threading.h:
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
 
-2008-10-07  Sam Weinig  <sam@webkit.org>
+        Reviewed by Holger Freyther.
 
-        Roll out r37405.
+        [Qt] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
 
-2008-10-07  Oliver Hunt  <oliver@apple.com>
+        Remove pByte (committed in r42344 from #20422), because pByte doesn't
+        exist and it is unnecessary.
 
-        Reviewed by Cameron Zwarich.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
 
-        Switch CTI runtime calls to the fastcall calling convention
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
 
-        Basically this means that we get to store the argument for CTI
-        calls in the ECX register, which saves a register->memory write
-        and subsequent memory->register read.
-        
-        This is a 1.7% progression in SunSpider and 2.4% on commandline
-        v8 tests on Windows
+        QT build fix.
 
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        * VM/CTI.h:
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-          We need this to correctly reload ecx from inside certain property access
-          trampolines.
-        * wtf/Platform.h:
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecific):
 
-2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Mark Rowe.
-        
-        - optimize away multiplication by constant 1.0
-        
-        2.3% speedup on v8 RayTrace benchmark
-
-        Apparently it's not uncommon for JavaScript code to multiply by
-        constant 1.0 in the mistaken belief that this converts integer to
-        floating point and that there is any operational difference.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
-        case where parameter is already number.
-        (JSC::CTI::privateCompileSlowCases): ditto
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): ditto
-        * kjs/grammar.y:
-        (makeMultNode): Transform as follows:
-        +FOO * BAR ==> FOO * BAR
-        FOO * +BAR ==> FOO * BAR
-        FOO * 1 ==> +FOO
-        1 * FOO ==> +FOO
-        (makeDivNode): Transform as follows:
-        +FOO / BAR ==> FOO / BAR
-        FOO / +BAR ==> FOO / BAR
-        (makeSubNode): Transform as follows:
-        +FOO - BAR ==> FOO - BAR
-        FOO - +BAR ==> FOO - BAR
-        * kjs/nodes.h:
-        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
-        grammar.y changes
-        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
-
-2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+        Windows build fix part I.
 
-        Reviewed by Oliver Hunt.
-        
-        - make constant folding code more consistent
-        
-        Added a makeSubNode to match add, mult and div; use the makeFooNode functions always,
-        instead of allocating nodes directly in other places in the grammar.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        * kjs/grammar.y:
+2010-01-06  Dan Bernstein  <mitz@apple.com>
 
-2008-10-07  Sam Weinig  <sam@webkit.org>
+        Build fix
 
-        Reviewed by Cameron Zwarich.
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecificCallback):
 
-        Move hasGetterSetterProperties flag from PropertyMap to StructureID.
+2010-01-05  Gavin Barraclough  <barraclough@apple.com>
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put):
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        * kjs/JSObject.h:
-        (JSC::JSObject::hasGetterSetterProperties):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSObject::getOwnPropertySlot):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::hasGetterSetterProperties):
-        (JSC::StructureID::setHasGetterSetterProperties):
-
-2008-10-07  Sam Weinig  <sam@webkit.org>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Cameron Zwarich.
+        https://bugs.webkit.org/show_bug.cgi?id=33236
+        Remove m_identifierTable pointer from UString
 
-        Roll r37370 back in with bug fixes.
+        Currently every string holds a pointer so that during destruction,
+        if a string has been used as an identifier, it can remove itself
+        from the table.  By instead accessing the identifierTable via a
+        thread specific tracking the table associated with the current
+        globaldata, we can save the memory cost of this pointer.
 
-        - PropertyMap::storageSize() should reflect the number of keys + deletedOffsets
-          and has nothing to do with the internal deletedSentinel count anymore.
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
 
-2008-10-07  Gavin Barraclough  <barraclough@apple.com>
+            - change the API shims to track the identifierTable of the current JSGlobalData.
 
-        Reviewed by Oliver Hunt.
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
 
-        Move callframe initialization into JIT code, again.
-        
-        As a part of the restructuring the second result from functions is now
-        returned in edx, allowing the new value of 'r' to be returned via a
-        register, and stored to the stack from JIT code, too.
+            - update creation of JSGlobalData for API usage to use new create method.
+            - fix shim instanciation bug in JSGlobalContextCreateInGroup.
 
-        4.5% progression on v8-tests. (3% in their harness)
+        * JavaScriptCore.exp:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
 
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitCall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
-        * VM/Machine.h:
-        * kjs/JSFunction.h:
-        * kjs/ScopeChain.h:
-
-2008-10-07  Mark Rowe  <mrowe@apple.com>
-
-        Fix typo in method name.
-
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
+            - add asserts to check the identifierTable is being tracked correctly.
 
-2008-10-07  Cameron Zwarich  <zwarich@apple.com>
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkSameIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        (JSC::createDefaultDataSpecific):
 
-        Rubber-stamped by Mark Rowe.
+            - Use currentIdentifierTable() instead of UStringImpl::m_identifierTable.
+            - Define methods to access the thread specific identifier tables.
 
-        Roll out r37370.
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
 
-2008-10-06  Sam Weinig  <sam@webkit.org>
+            - Declare methods to access the thread specific identifier tables.
 
-        Reviewed by Cameron Zwarich.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21415
-        Improve the division between PropertyStorageArray and PropertyMap
+            - creation of JSGlobalData objects, other than for API usage, associate themselves with the current thread.
 
-        - Rework ProperyMap to store offsets in the value so that they don't
-          change when rehashing.  This allows us not to have to keep the 
-          PropertyStorageArray in sync and thus not have to pass it in.
-        - Rename PropertyMap::getOffset -> PropertyMap::get since put/remove
-          now also return offsets.
-        - A Vector of deleted offsets is now needed since the storage is out of
-          band.
+        * runtime/JSGlobalData.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::destroy):
 
-        1% win on SunSpider.  Wash on V8 suite.
+            - destroy() method should be using isIdentifier().
 
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::transitionWillNeedStorageRealloc):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        Transition logic can be greatly simplified by the fact that
-        the storage capacity is always known, and is correct for the
-        inline case.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put): Rename getOffset -> get.
-        (JSC::JSObject::deleteProperty): Ditto.
-        (JSC::JSObject::getPropertyAttributes): Ditto.
-        (JSC::JSObject::removeDirect): Use returned offset to
-        clear the value in the PropertyNameArray.
-        (JSC::JSObject::allocatePropertyStorage): Add assert.
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect): Rename getOffset -> get
-        (JSC::JSObject::getDirectLocation): Rename getOffset -> get
-        (JSC::JSObject::putDirect): Use propertyStorageCapacity to determine whether
-        or not to resize.  Also, since put now returns an offset (and thus 
-        addPropertyTransition does also) setting of the PropertyStorageArray is
-        now done here.
-        (JSC::JSObject::transitionTo):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::checkConsistency): PropertyStorageArray is no longer 
-        passed in.
-        (JSC::PropertyMap::operator=): Copy the delete offsets vector.
-        (JSC::PropertyMap::put): Instead of setting the PropertyNameArray
-        explicitly, return the offset where the value should go.
-        (JSC::PropertyMap::remove): Instead of removing from the PropertyNameArray
-        explicitly, return the offset where the value should be removed.
-        (JSC::PropertyMap::get): Switch to using the stored offset, instead
-        of the implicit one.
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::expand): This is never called when m_table is null,
-        so remove that branch and add it as an assertion.
-        (JSC::PropertyMap::createTable): Consistency checks no longer take
-        a PropertyNameArray.
-        (JSC::PropertyMap::rehash): No need to rehash the PropertyNameArray
-        now that it is completely out of band.
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMapEntry::PropertyMapEntry): Store offset into PropertyNameArray.
-        (JSC::PropertyMap::get): Switch to using the stored offset, instead
-        of the implicit one.
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID): Initialize the propertyStorageCapacity to 
-        JSObject::inlineStorageCapacity.
-        (JSC::StructureID::growPropertyStorageCapacity): Grow the storage capacity as
-        described below.
-        (JSC::StructureID::addPropertyTransition): Copy the storage capacity.
-        (JSC::StructureID::toDictionaryTransition): Ditto.
-        (JSC::StructureID::changePrototypeTransition): Ditto.
-        (JSC::StructureID::getterSetterTransition): Ditto.
-        * kjs/StructureID.h:
-        (JSC::StructureID::propertyStorageCapacity): Add propertyStorageCapacity
-        which is the current capacity for the JSObjects PropertyStorageArray.
-        It starts at the JSObject::inlineStorageCapacity (currently 2), then
-        when it first needs to be resized moves to the JSObject::nonInlineBaseStorageCapacity
-        (currently 16), and after that doubles each time.
-
-2008-10-06  Cameron Zwarich  <zwarich@apple.com>
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
 
-        Reviewed by Oliver Hunt.
+            - replace m_identifierTable with a single m_isIdentifier bit.
 
-        Bug 21396: Remove the OptionalCalleeActivation call frame slot
-        <https://bugs.webkit.org/show_bug.cgi?id=21396>
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
 
-        Remove the OptionalCalleeActivation call frame slot. We have to be
-        careful to store the activation object in a register, because objects
-        in the scope chain do not get marked.
+            - change string hash result from 32-bit to 31-bit, to free a bit in UStringImpl for m_isIdentifier.
 
-        This is a 0.3% speedup on both SunSpider and the V8 benchmark.
+2009-12-25 Patrick Gansterer <paroga@paroga.com>
+        Reviewed by Eric Seidel.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitReturn):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        (JSC::Machine::initializeCallFrame):
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-
-2008-10-06  Tony Chang  <tony@chromium.org>
+        Buildfix for WinCE + style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=32939
 
-        Reviewed by Alexey Proskuryakov.
+        * jsc.cpp:
+        (functionPrint):
+        (functionQuit):
+        (parseArguments):
+        (fillBufferWithContentsOfFile):
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
 
-        Chromium doesn't use pthreads on windows, so make its use conditional.
-        
-        Also convert a WORD to a DWORD to avoid a compiler warning.  This
-        matches the other methods around it.
+        Reviewed by Eric Seidel.
 
-        * wtf/ThreadingWin.cpp:
-        (WTF::wtfThreadEntryPoint):
-        (WTF::ThreadCondition::broadcast):
+        WinCE buildfix after r52791 (renamed PLATFORM(WINCE) to OS(WINCE)).
+        https://bugs.webkit.org/show_bug.cgi?id=33205
 
-2008-10-06  Mark Mentovai  <mark@moxienet.com>
+        * jit/ExecutableAllocator.h:
 
-        Reviewed by Tim Hatcher.
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added compiler error for unsupported platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=33112
+
+        * jit/JITStubs.cpp:
+
+2010-01-05  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow r52729 in ARMAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=33208
+
+        Use WTF_ARM_ARCH_AT_LEAST instead of ARM_ARCH_VERSION
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::encodeComplexImm): Move tmp declaration to ARMv7
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bkpt):
+
+2010-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix for Gtk+
+
+        Don't use // comments in Platform.h, at least some of them seem to make the version of GCC
+        used on the Gtk buildbot unhappy.
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        * wtf/Platform.h: Rename, reorganize and document OS() macros.
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * API/JSContextRef.cpp:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        * bytecode/SamplingTool.cpp:
+        * config.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        (main):
+        * parser/Grammar.y:
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * runtime/Collector.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp:
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/DateMath.cpp:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitModule):
+        (WTF::TCMallocStats::):
+        * wtf/FastMalloc.h:
+        * wtf/MathExtras.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/StringExtras.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::createThreadInternal):
+        * wtf/VMTags.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Add missing files to the build system - make distcheck build fix.
+
+        * GNUmakefile.am:
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig, additional coding by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Add string hashing functions to WTF.
+        Use WTF's string hashing functions from UStringImpl.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::computeHash):
+        * wtf/HashFunctions.h:
+        * wtf/StringHashFunctions.h: Added.
+        (WTF::stringHash):
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix ARM bulid.
+
+        * wtf/Platform.h:
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Add an 'isIdentifier' to UStringImpl, use this where appropriate
+        (where previously 'identifierTable' was being tested).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Shimmey Shimmey" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33158
+        Refactor JSC API entry/exit to use RAII instead of copy/pasting code.
+        Make it easier to change set of actions taken when passing across the API boundary.
+
+        * API/APIShims.h: Added.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-01-04  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r52741.
+        http://trac.webkit.org/changeset/52741
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Add cacheFlush support for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33110
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * runtime/JSCell.cpp:
+        (JSC::):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Document CPU() macros in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=33147
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+        ExecutableAllocatorSymbian appears to have buggy ARM version check
+        https://bugs.webkit.org/show_bug.cgi?id=33138
+        
+        * wtf/Platform.h:
+        Rename all macros related to detection of particular CPUs or
+        classes of CPUs to CPU(), reorganize and document them.
+
+        All remaining changes are adapting to the renames, plus fixing the
+        second bug cited above.
+        
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Registers::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCount):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/Threading.h:
+        * wtf/dtoa.cpp:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        * yarr/RegexJIT.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Clean up COMPILER macros and remove unused ones.
+        https://bugs.webkit.org/show_bug.cgi?id=33132
+        
+        Removed values are COMPILER(BORLAND) and COMPILER(CYGWIN) - they were
+        not used anywhere.
+
+        * wtf/Platform.h:
+
+2010-01-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Update wtf/Platform.h to document the new system for porting macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33130
+
+        * wtf/Platform.h:
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        PLATFORM(CAIRO) should be defined by WIN_CAIRO define
+        https://bugs.webkit.org/show_bug.cgi?id=22250
+
+        * wtf/Platform.h: Define WTF_PLATFORM_CAIRO for GTK port only
+        For the WinCairo port WTF_PLATFORM_CAIRO is already defined in config.h
+
+2009-12-28  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Delete ThreadPrivate instance after it is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=32614
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadMonitor::instance):
+        (WTF::ThreadMonitor::threadFinished):
+        (WTF::createThreadInternal):
+        (WTF::detachThread):
+
+2009-12-28  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleanup of #define JS_EXPORT.
+
+        * API/JSBase.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfix (HWND_MESSAGE isn't supported there)
+
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        Added a file with WinMain function to link agains in WinCE.
+
+        * os-win32/WinMain.cpp: Added.
+        (convertToUtf8):
+        (WinMain):
+
+2009-12-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed; revert of r52550.
+
+        The change regressed the following LayoutTests for QtWebKit.
+
+        fast/workers/worker-call.html -> crashed
+        fast/workers/worker-close.html -> crashed
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-24  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix memory leak by deleting instance of ThreadPrivate
+        in function waitForThreadCompletion(), synchronously, or in
+        detachThread(), asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=32614 
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Include stddef.h for ptrdiff_t
+        https://bugs.webkit.org/show_bug.cgi?id=32891
+
+        ptrdiff_t is typedef-ed in stddef.h.
+        Include stddef.h in jit/ExecutableAllocator.h.
+
+        * jit/ExecutableAllocator.h:
+
+2009-12-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r47092.
+
+        * wtf/wince/MemoryManager.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        Expose dateToDaysFrom1970().
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970):
+        * wtf/DateMath.h:
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+
+2009-12-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Updates Android's scheduleDispatchFunctionsOnMainThread() to use new
+        AndroidThreading class, rather than using JavaSharedClient directly.
+        This fixes the current layering violation.
+        https://bugs.webkit.org/show_bug.cgi?id=32651
+
+        The pattern is copied from Chromium, which uses the ChromiumThreading
+        class. This patch also fixes the style in ChromiumThreading.h.
+
+        * wtf/android/AndroidThreading.h: Added. Declares AndroidThreading.
+        * wtf/android/MainThreadAndroid.cpp: Modified
+        (WTF::scheduleDispatchFunctionsOnMainThread): Uses AndroidThreading.
+        * wtf/chromium/ChromiumThreading.h: Modified. Fixes style.
+
+2009-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a couple of problems with UntypedPtrAndBitfield.
+
+        Add a m_leaksPtr to reduce false positives from leaks in debug builds
+        (this isn't perfect because we'd like a solution for release builds,
+        but this is now at least as good as a PtrAndFlags would be).
+
+        Switch SmallStringsto use a regular string for the base, rather than
+        a static one.  UntypedPtrAndBitfield assumes all strings are at least
+        8 byte aligned; this migt not be true of static strings.  Shared buffers
+        are heap allocated, as are all UStringImpls other than static strings.
+        Static strings cannot end up being the owner string of substrings,
+        since the only static strings are length 0.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UStringImpl::UStringImpl):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT (__ARMCC_VERSION < 400000) does not provide strcasecmp and strncasecmp
+        https://bugs.webkit.org/show_bug.cgi?id=32857
+
+        Add implementation of strcasecmp and strncasecmp for RVCT < 4.0
+        because earlier versions of RVCT 4.0 does not provide these functions.
+
+        * wtf/StringExtras.cpp: Added.
+        (strcasecmp):
+        (strncasecmp):
+        * wtf/StringExtras.h:
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Define ALWAYS_INLINE and WTF_PRIVATE_INLINE to __forceinline for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=32853
+
+        Use __forceinline forces RVCT to compile a C or C++ function
+        inline. The compiler attempts to inline the function, regardless of
+        the characteristics of the function.
+
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective GTK build fix: Add UStringImpl.cpp/h to the build.
+
+        * GNUmakefile.am:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add UStringImpl.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix part 5.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Fix breakage of world introduced in build fix to r52463.
+
+        * runtime/UStringImpl.h:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
+2009-12-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move some build decisions from Qt build system into source files
+        https://bugs.webkit.org/show_bug.cgi?id=31956
+
+        * JavaScriptCore.pri: Compile files unconditionally
+        * jit/ExecutableAllocatorPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * jit/ExecutableAllocatorWin.cpp: Guard with PLATFORM(WIN_OS)
+        * runtime/MarkStackPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * runtime/MarkStackSymbian.cpp: Guard with PLATFORM(SYMBIAN)
+        * runtime/MarkStackWin.cpp: Guard with PLATFORM(WIN_OS)
+        * wtf/Platform.h: Guard ENABLE_JSC_MULTIPLE_THREADS with ENABLE_SINGLE_THREADED for the Qt port
+        * wtf/ThreadingNone.cpp: Guard with ENABLE(SINGLE_THREADED)
+        * wtf/qt/ThreadingQt.cpp: Guard with !ENABLE(SINGLE_THREADED)
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add createNonCopying method to UString to make replace constructor passed bool,
+        to make behaviour more explicit.  Add createFromUTF8 to UString (wrapping method
+        on UString::Rep), since other cases of transliteration (e.g.  from ascii) are
+        performed in UString constructors.  Add/use setHash & size() accessors on Rep,
+        rather than accessing _hash/len directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::createNonCopying):
+        (JSC::UString::createFromUTF8):
+        * runtime/UString.h:
+        (JSC::UString::Rep::setHash):
+        (JSC::UString::~UString):
+        (JSC::makeString):
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Gavin Barraclough.
+        
+        Changed Register constructors to assignment operators, to streamline
+        moving values into registers. (In theory, there's no difference between
+        the two, since the constructor should just inline away, but there seems
+        to be a big difference in the addled mind of the GCC optimizer.)
+
+        In the interpreter, this is a 3.5% SunSpider speedup and a 1K-2K
+        reduction in stack usage per privateExecute stack frame.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScopeChain):
+        (JSC::ExecState::init):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock): Added a little bit of casting so these
+        functions could use the new Register assignment operators.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::Register):
+        (JSC::Register::operator=): Swapped in assignment operators for constructors.
+
+2009-12-18  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32713
+        [Qt] make wtf/Assertions.h compile in winscw compiler.
+
+        Add string arg before ellipsis to help winscw compiler resolve variadic
+        macro definitions in wtf/Assertions.h. 
+
+        * wtf/Assertions.h:
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixed intermittent failure seen on Windows buildbot, and in other JSC
+        API clients.
+        
+        Added a WeakGCPtr class and changed OpaqueJSClass::cachedPrototype to
+        use it, to avoid vending a stale object as a prototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h: Use WeakGCPtr.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/WeakGCPtr.h: Added.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::operator*):
+        (JSC::WeakGCPtr::operator->):
+        (JSC::WeakGCPtr::operator!):
+        (JSC::WeakGCPtr::operator bool):
+        (JSC::WeakGCPtr::operator UnspecifiedBoolType):
+        (JSC::WeakGCPtr::assign):
+        (JSC::::operator):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::static_pointer_cast):
+        (JSC::const_pointer_cast):
+        (JSC::getPtr): Added WeakGCPtr to the project.
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+
+        * JavaScriptCore.exp:
+            - Remove exports for UString::append
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Make StringBuilder a private header (was project).
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GRefPtr does not take a reference when assigned a raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=32709
+
+        Ensure that when assigning a raw pointer to a GRefPtr, the reference
+        count is incremented. Also remove the GRefPtr conversion overload as
+        GRefPtr types have necessarily incompatible reference counting.
+
+        * wtf/gtk/GRefPtr.h:
+        (WTF::GRefPtr::operator=):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * pcre/pcre.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Compile warning from line 29 of GRefPtr.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32703
+
+        Fix memory leak and compiler warning in GRefPtr GHashTable template
+        specialization.
+
+        * wtf/gtk/GRefPtr.cpp:
+        (WTF::refGPtr):
+
+2009-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add BUILDING_ON_SNOW_LEOPARD and TARGETING_SNOW_LEOPARD #defines.
+
+        * wtf/Platform.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Sync JavaScriptCore.vcproj with JavaScriptCore.xcodeproj and the
+        source tree
+
+        Fixes <http://webkit.org/b/32665>.
+
+        Reviewed by Ada Chan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Moved
+        around files and filters so that the structure matches
+        JavaScriptCore.xcodeproj and the source tree. A few headers that were
+        previously omitted have been added, as well as JSZombie.{cpp,h}.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Remove HeavyProfile and TreeProfile completely
+
+        These were mostly removed in r42808, but the empty files were left in
+        place.
+
+        Fixes <http://webkit.org/b/32664>.
+
+        Reviewed by John Sullivan.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        Removed HeavyProfile/TreeProfile source files.
+
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Implement GRefPtr, a smart pointer for reference counted GObject types.
+
+        * GNUmakefile.am:
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GDir):
+        * wtf/gtk/GRefPtr.h: Added.
+        (WTF::):
+        (WTF::GRefPtr::GRefPtr):
+        (WTF::GRefPtr::~GRefPtr):
+        (WTF::GRefPtr::clear):
+        (WTF::GRefPtr::get):
+        (WTF::GRefPtr::operator*):
+        (WTF::GRefPtr::operator->):
+        (WTF::GRefPtr::operator!):
+        (WTF::GRefPtr::operator UnspecifiedBoolType):
+        (WTF::GRefPtr::hashTableDeletedValue):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+        (WTF::adoptGRef):
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7355025> Interpreter::privateExecute macro generates
+        bloated code
+        
+        This patch cuts Interpreter stack use by about a third.
+
+        * bytecode/Opcode.h: Changed Opcode to const void* to work with the
+        const static initiliazation we want to do in Interpreter::privateExecute.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter): Moved hashtable initialization here to
+        avoid polluting Interpreter::privateExecute's stack, and changed it from a
+        series of add() calls to one add() call in a loop, to cut down on code size.
+
+        (JSC::Interpreter::privateExecute): Changed a series of label computations
+        to a copy of a compile-time constant array to cut down on code size.
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "r=me" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32498
+        <rdar://problem/7471495>
+        REGRESSION(r51978-r52039): AJAX "Mark This Forum Read" function no longer
+        works
+        
+        Fixed a tyop.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd): Use the '&&' operator, not the ',' operator.
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build: don't export this inlined function.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Inlined JSCell's operator new.
+        
+        3.7% speedup on bench-allocate-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the number heap, replacing it with a one-item free list for
+        numbers, taking advantage of the fact that two number cells fit inside
+        the space for one regular cell, and number cells don't require destruction.
+        
+        SunSpider says 1.6% faster in JSVALUE32 mode (the only mode that
+        heap-allocates numbers).
+        
+        SunSpider says 1.1% faster in JSVALUE32_64 mode. v8 says 0.8% faster
+        in JSVALUE32_64 mode. 10% speedup on bench-alloc-nonretained.js. 6%
+        speedup on bench-alloc-retained.js.
+        
+        There's a lot of formulaic change in this patch, but not much substance.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        (JSC::Heap::sweep):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Collector.h:
+        (JSC::): Removed all code pertaining to the number heap, and changed all
+        heap template functions and classes to non-template functions and classes.
+
+        (JSC::Heap::allocateNumber): A new optimization to replace the number
+        heap: allocate half-sized number cells in pairs, returning the first
+        cell and caching the second cell for the next allocation.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++):
+        * runtime/JSCell.h:
+        (JSC::JSCell::isNumber): Removed all code pertaining to the number heap,
+        and changed all heap template functions and classes to non-template functions
+        and classes.
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WeakGCMap class
+        https://bugs.webkit.org/show_bug.cgi?id=32547
+
+        Inherits WeakGCMap from FastAllocBase because it is instantiated by
+        'new' at: WebCore/dom/Document.cpp:512.
+
+        * runtime/WeakGCMap.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for dtoa's P5Node struct
+        https://bugs.webkit.org/show_bug.cgi?id=32544
+
+        Inherits P5Node struct from Noncopyable because it is instantiated by
+        'new' at wtf/dtoa.cpp:588 and don't need to be copyable.
+
+        * wtf/dtoa.cpp:
+
+2009-12-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32524
+        REGRESSION(52084): fast/dom/prototypes.html failing two CSS tests
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): The original patch put the parentheses in the wrong
+        place, completely changing the calculation and making it almost always
+        wrong. Moved the parentheses around the '+' operation, like the original
+        compiler warning suggested.
+
+2009-12-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        Fix crosses initialization of usedPrimaryBlocks for JSValue32
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+
+2009-12-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        GCC 4.3.x warning fixed. Suggested parantheses added.
+        warning: ../../../JavaScriptCore/wtf/StdLibExtras.h:77: warning: suggest parentheses around + or - in operand of &
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+        
+        Added WeakGCMap to keep WebCore blissfully ignorant about objects that
+        have become garbage but haven't run their destructors yet.
+        
+        1% SunSpider speedup.
+        7.6% v8 speedup (37% splay speedup).
+        17% speedup on bench-alloc-nonretained.js.
+        18% speedup on bench-alloc-retained.js.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for renames and new
+        files.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use the Collector
+        iterator abstraction.
+
+        * jsc.cpp:
+        (functionGC): Updated for rename.
+
+        * runtime/Collector.cpp: Slightly reduced the number of allocations per
+        collection, so that small workloads only allocate on collector block,
+        rather than two.
+
+        (JSC::Heap::Heap): Updated to use the new allocateBlock function.
+
+        (JSC::Heap::destroy): Updated to use the new freeBlocks function.
+
+        (JSC::Heap::allocateBlock): New function to initialize a block when
+        allocating it.
+
+        (JSC::Heap::freeBlock): Consolidated the responsibility for running
+        destructors into this function.
+
+        (JSC::Heap::freeBlocks): Updated to use freeBlock.
+
+        (JSC::Heap::recordExtraCost): Sweep the heap in this reporting function,
+        so that allocation, which is more common, doesn't have to check extraCost.
+
+        (JSC::Heap::heapAllocate): Run destructors right before recycling a
+        garbage cell. This has better cache utilization than a separate sweep phase.
+
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks): New set of functions for managing the size of
+        the heap, now that the heap doesn't maintain any information about its
+        size.
+
+        (JSC::isPointerAligned):
+        (JSC::isHalfCellAligned):
+        (JSC::isPossibleCell):
+        (JSC::isCellAligned):
+        (JSC::Heap::markConservatively): Cleaned up this code a bit.
+
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells): Some helper functions for examining the the mark
+        bitmap.
+
+        (JSC::Heap::sweep): Simplified this function by using a DeadObjectIterator.
+
+        (JSC::Heap::markRoots): Reordered some operations for clarity.
+
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics): Rewrote these functions to calculate an object
+        count on demand, since the heap doesn't maintain this information by 
+        itself.
+
+        (JSC::Heap::reset): New function for resetting the heap once we've
+        exhausted heap space.
+
+        (JSC::Heap::collectAllGarbage): This function matches the old collect()
+        behavior, but it's now an uncommon function used only by API.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::count):
+        (JSC::CollectorBitmap::isEmpty): Added some helper functions for managing
+        the collector mark bitmap.
+
+        (JSC::Heap::reportExtraMemoryCost): Changed reporting from cell equivalents
+        to bytes, so it's easier to understand.
+        
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::CollectorHeapIterator):
+        (JSC::CollectorHeapIterator::operator!=):
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::::LiveObjectIterator):
+        (JSC::::operator):
+        (JSC::::DeadObjectIterator):
+        (JSC::::ObjectIterator): New iterators for encapsulating details about
+        heap layout, and what's live and dead on the heap.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength): Delay reporting extra cost until
+        we're fully constructed, so the heap mark phase won't visit us in an
+        invalid state.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Added a dummy cell to simplify allocation logic.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't report extra cost for substrings, since they
+        share a buffer that's already reported extra cost.
+
+        * runtime/Tracing.d:
+        * runtime/Tracing.h: Changed these dtrace hooks not to report object
+        counts, since they're no longer cheap to compute.
+
+        * runtime/UString.h: Updated for renames.
+
+        * runtime/WeakGCMap.h: Added.
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedBegin):
+        (JSC::WeakGCMap::uncheckedEnd):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove): Mentioned above.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): Added a bit population count function, so the heap can
+        count live objects to fulfill statistics questions.
+
+The very last cell in the block is not allocated -- should not be marked.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Export some new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some old exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Use unsigned instead of uint32_t to avoid dependencies.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative Windows build fix).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32496
+        Switch remaining cases of string construction to use StringBuilder.
+        Builds strings using a vector rather than using string append / addition.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::indent):
+        * runtime/JSString.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncConcat):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT and USE_ATSUI on Chrome/Mac.
+
+2009-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Unify codegen for forward and backward variants of branches
+        https://bugs.webkit.org/show_bug.cgi?id=32463
+
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop): Implemented in terms of forward variant.
+        (JSC::JIT::emit_op_loop_if_true): ditto
+        (JSC::JIT::emitSlow_op_loop_if_true): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        (JSC::JIT::emit_op_loop_if_less): ditto
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        * jit/JITOpcodes.cpp:
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Allow WTFs concept of the main thread to differ from pthreads when necessary.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32454
+        Refactor construction of simple strings to avoid string concatenation.
+
+        Building strings through concatenation has a memory and performance cost -
+        a memory cost since we must over-allocate the buffer to leave space to append
+        into, and performance in that the string may still require reallocation (and
+        thus copying during construction).  Instead move the full construction to
+        within a single function call (makeString), so that the arguments' lengths
+        can be calculated and an appropriate sized buffer allocated before copying
+        any characters.
+
+        ~No performance change (~2% progression on date tests).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        (JSC::formatTime):
+        (JSC::formatTimeUTC):
+        * runtime/DateConversion.h:
+        (JSC::):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        * runtime/UString.h:
+        (JSC::):
+        (JSC::makeString):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        Re-landing r51975 - added toPrimitiveString method,
+        performs toPrimitive then subsequent toString operations.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added
+        $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCorePresent.h to include/private
+
+        This fixes other projects that use wtf/Platform.h
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS do its thang.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Write
+        QuartzCorePresent.h to $(WebKitOutputDir)/include/private.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        Added $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Fix clean builds and everything rebuilding on every build
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Don't
+        write out QuartzCorePresent.h if it exists but is older than
+        QuartzCore.h. Also, create the directory we write QuartzCorePresent.h
+        into first.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for systems with spaces in their paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Quote some paths.
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add check for presence of QuartzCore headers
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        The script now checks for the presence of QuartzCore.h. If present
+        it will turn on ACCELERATED_COMPOSITING and 3D_RENDERING to enable
+        HW compositing on Windows. The script writes QuartzCorePresent.h to
+        the build directory which has a define telling whether QuartzCore is 
+        present.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * wtf/Platform.h:
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a problem that JSC::gregorianDateTimeToMS() returns a negative
+        value for a huge year value.
+        https://bugs.webkit.org/show_bug.cgi?id=32304
+
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970): Renamed from dateToDayInYear, and changed the return type to double.
+        (WTF::calculateDSTOffset): Follow the dateToDaysFrom1970() change.
+        (WTF::timeClip): Use maxECMAScriptTime.
+        (JSC::gregorianDateTimeToMS): Follow the dateToDaysFrom1970() change.
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r51975.
+        http://trac.webkit.org/changeset/51975
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
+2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix compilation with win32-icc
+
+        The Intel compiler does not support the __has_trivial_constructor type
+        trait.  The Intel Compiler can report itself as _MSC_VER >= 1400. The
+        reason for that is that the Intel Compiler depends on the Microsoft
+        Platform SDK, and in order to try to be "fully" MS compatible it will
+        "pretend" to be the same MS compiler as was shipped with the MS PSDK.
+        (Thus, compiling with win32-icc with VC8 SDK will make the source code
+        "think" the compiler at hand supports this type trait).
+
+        * wtf/TypeTraits.h:
+
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
+2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Apply workaround for the limitation of VirtualFree with MEM_RELEASE to all ports running on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31943
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Fix lastIndexOf() for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31773
+
+        Symbian soft floating point library has problems with operators
+        comparing NaN to numbers. Without a workaround lastIndexOf() 
+        function does not work.
+
+        Patch developed by David Leong.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):Add an extra test 
+        to check for NaN for Symbian.
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix detection of linux-g++
+
+        Never use "linux-g++*" to check for linux-g++, since this will break embedded
+        builds which use linux-arm-g++ and friends. Use 'linux*-g++*' to check for any
+        g++ on linux mkspec.
+
+        * JavaScriptCore.pri:
+
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build on Windows CE 6.
+
+        * JavaScriptCore.pri: Add missing include path.
+        * wtf/Platform.h: Include ce_time.h for Windows CE 6.
+
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
+
+2009-11-13  Ä°smail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Antti Koivisto.
+
+        Fix typo, ce_time.cpp should be ce_time.c
+
+        * JavaScriptCore.pri:
+
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Disable pthread_setname_np.
+
+        This allows Qt builds on Mac from 10.6 to run on earlier version
+        where this symbol is not present.
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        * wtf/Platform.h:
+
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect â€“ ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION (r48573): JSC may incorrectly cache chain lookups with a dictionary at the head of the chain
+        https://bugs.webkit.org/show_bug.cgi?id=31045
+
+        Add guards to prevent caching of prototype chain lookups with dictionaries at the
+        head of the chain.  Also add a few tighter assertions to cached prototype lookups
+        to catch this in future.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
+
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
+
+        * wtf/ListHashSet.h:
+
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
+
+2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add cacheFlush support for Thumb-2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=30865
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSC JIT on ARMv7 cannot link jumps >16Mb range
+        https://bugs.webkit.org/show_bug.cgi?id=30891
+
+        Start planing all relative jumps as move-32-bit-immediate-to-register-BX.
+        In the cases where the jump would fall within a relative jump range, use a relative jump.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::~ARMv7Assembler):
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::executableCopy):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::isB):
+        (JSC::ARMv7Assembler::isBX):
+        (JSC::ARMv7Assembler::isMOV_imm_T3):
+        (JSC::ARMv7Assembler::isMOVT):
+        (JSC::ARMv7Assembler::isNOP_T1):
+        (JSC::ARMv7Assembler::isNOP_T2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp5i6Imm4Reg4EncodedImm):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * jit/JIT.h:
+        * wtf/Platform.h:
+
+2009-10-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve for..in enumeration performance
+        https://bugs.webkit.org/show_bug.cgi?id=30887
+
+        Improve indexing of an object with a for..in iterator by
+        identifying cases where get_by_val is being used with a iterator
+        as the subscript and replace it with a new get_by_pname
+        bytecode.  get_by_pname then optimizes lookups that directly access
+        the base object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::pushOptimisedForIn):
+        (JSC::BytecodeGenerator::popOptimisedForIn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+          Track the existence (or not) of non-enumerable properties.
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::hasAnonymousSlots):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attemp to fix Windows build.
+
+        Touch the cpp file to cause recompile.
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this since Database removes tasks when it is stopped.
+
+        * wtf/MessageQueue.h:
+        (WTF::::removeIf):
+
+2009-10-28  Afonso R. Costa Jr.  <afonso.costa@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Enable YARR when YARR_JIT is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30730
+
+        When enabling or disabling JIT using JAVASCRIPTCORE_JIT, the ENABLE_YARR should
+        be toggled also.
+
+        * JavaScriptCore.pri:
+
+2009-10-24  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix strict aliasing warning by switching reinterpret_cast to bitwise_cast.
+
+        strict-aliasing warnings in JSFunction.h
+        https://bugs.webkit.org/show_bug.cgi?id=27869
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::setNativeFunction):
+
+2009-10-28  Jan-Arve Sæther <jan-arve.saether@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build-fix for 64-bit Windows
+
+        * wtf/Platform.h: Make sure to use WTF_USE_JSVALUE64
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix!).
+
+        * jit/JIT.h:
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Export fastMalloc, fastCalloc, fastRealloc and fastFree on GCC/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=30769
+
+        When using -fvisibility=hidden to hide all internal symbols by default
+        the malloc symbols will be hidden as well. For memory instrumentation
+        it is needed to provide an instrumented version of these symbols and
+        override the normal routines and by changing the visibility back to
+        default this becomes possible.
+
+        The only other solution would be to use system malloc instead of the
+        TCmalloc implementation but this will not allow to analyze memory
+        behavior with the default allocator.
+
+        * wtf/FastMalloc.h: Define WTF_FAST_MALLOC_EXPORT for GCC and !darwin
+
+2009-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Samuel Q. Weinig.
+
+        Make the asserts protecting the offsets in the JIT more descriptive.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little bit of refactoring in the date code.
+
+        * JavaScriptCore.exp: Don't export this unused symbol.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h: Removed some unused functions. Changed the default
+        constructor to ensure that a DateInstance is always initialized.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype): Pass an initializer to our constructor,
+        since it now requires one.
+
+        * wtf/DateMath.cpp:
+        (WTF::msToGregorianDateTime): Only compute our offset from UTC if our
+        output will require it. Otherwise, our offset is 0.
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Mark DateInstaceCache.h private, so other frameworks can see it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: re-readded this file.
+
+        * runtime/DateInstanceCache.h: Added.
+        (JSC::DateInstanceData::create):
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::add):
+        (JSC::DateInstanceCache::lookup):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30800
+        Cache recently computed date data.
+        
+        SunSpider reports a ~0.5% speedup, mostly from date-format-tofte.js.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new file.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::getGregorianDateTime): Use the shared cache.
+
+        * runtime/DateInstance.h: Renamed m_cache to m_data, to avoid the confusion
+        of a "cache cache".
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Pass an ExecState to these functions, so they
+        can access the DateInstanceCache.
+
+        * runtime/JSGlobalData.h: Keep a DateInstanceCache.
+
+2009-10-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensures that JavaScriptCore/wtf/CurrentTime.cpp is not built in PLATFORM(CHROMIUM) builds.
+
+        Chromium uses a different method to calculate the current time than is used in
+        JavaScriptCore/wtf/CurrentTime.cpp. This can lead to time skew when calls to currentTime() and Chromium's time
+        function are mixed.  In particular, timers can get scheduled in the past which leads to 100% CPU use.
+        See http://code.google.com/p/chromium/issues/detail?id=25892 for an example.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30833
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/CurrentTime.cpp:
+
+2009-10-27  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix typo in RegexInterpreter.cpp and RegexJIT.cpp alterantive to
+        alternative.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Use
+        winresrc.h because it exists even when MFC is not installed, and is
+        all that's needed here.
+
+2009-10-26  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The thunkReturnAddress is on JITStackFrame on ARM JIT as well
+        https://bugs.webkit.org/show_bug.cgi?id=30782
+
+        Move the thunkReturnAddress from top of the stack into the JITStackFrame
+        structure. This is a requirement for JSValue32_64 support on ARM.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::ret): Return with link register
+        (JSC::MacroAssemblerARM::prepareCall): Store the return address in link register
+        * jit/JIT.h: Remove unused ctiReturnRegister
+        * jit/JITInlineMethods.h: Same as ARMv7
+        (JSC::JIT::restoreArgumentReference): Ditto.
+        (JSC::JIT::restoreArgumentReferenceForTrampoline): Ditto.
+        * jit/JITOpcodes.cpp: Remove ctiReturnRegister related instruction
+        * jit/JITStubs.cpp: Store thunkReturnAddress on JITStackFrame. Use
+        small trampoline functions which handle return addresses for each
+        CTI_STUB_FUNCTION.
+        * jit/JITStubs.h: Store thunkReturnAddress on JITStackFrame
+        (JSC::JITStackFrame::returnAddressSlot): Return with the address of thunkReturnAddress
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Remove the unnecessary instruction
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ability to disable ReadWriteLock on platforms (eg Android) that use pthreads but do not support pthread_rwlock.
+        https://bugs.webkit.org/show_bug.cgi?id=30713
+
+        * wtf/Platform.h: Modified. Defines HAVE_PTHREAD_RWLOCK for all platforms currently using pthreads.
+        * wtf/Threading.h: Modified. Use pthread_rwlock_t only when HAVE_PTHREAD_RWLOCK is defined.
+        * wtf/ThreadingPthreads.cpp: Modified. Build ReadWriteLock methods only when HAVE_PTHREAD_RWLOCK is defined.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to jsc.exe.
+
+        * jsc.pro:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Fixes a leak in createThreadInternal on Android.
+        https://bugs.webkit.org/show_bug.cgi?id=30698
+
+        * wtf/ThreadingPthreads.cpp: Modified.
+        (WTF::createThreadInternal): Avoid leaking a ThreadData object on failure.
+
+2009-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixed ASSERT when opening Safari's Caches window while the Web Inspector
+        is open.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Added two new types to the type name list in the Collector.
+        These types have been around for a while, but nobody remembered to consider them here.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::isPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::isPropertyNameIterator): Give the Collector
+        a way to tell if a cell is a JSPropertyNameIterator.
+
+2009-10-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30686
+        Remove debug-specific def file.
+        Only Debug_All target uses JavaScriptCore_debug.dll naming, and since
+        that target is only used internally, maintaining two files just to
+        suppress a single link warning isn't worthwhile.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Removed.
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export WTF::deleteOwnedPtr(HDC).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Ditto.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated variable name.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Slightly tweaked this #ifdef to match the
+        size of a JSValue because m_jsStrings is an array of JSValues.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed a 64-bit regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=30570.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Use TimesEight stepping on 64-bit, since
+        64-bit pointers are eight bytes long.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Refactored DateInstance::msToGregorianDateTime so that a DateInstance's
+        caller doesn't need to supply the DateInstance's own internal value to
+        the DateInstance.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::getGregorianDateTime): Renamed from "msToGregorianDateTime".
+
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Also renamed "utc" to "outputIsUTC", for clarity.
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        The op_next_pname should use 4 bytes addressing mode in case of JSValue32
+        https://bugs.webkit.org/show_bug.cgi?id=30570
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname):
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Move OverridesMarkChildren flag from DatePrototype to its parent class
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some put_by_id_transition code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30539
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+        checks or read Structures and prototypes from objects: they're all known
+        constants at compile time.
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a private API for getting a global context from a context, for
+        clients who want to preserve a context for a later callback.
+
+        * API/APICast.h:
+        (toGlobalRef): Added an ASSERT, since this function is used more often
+        than before.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h: Added. The new API.
+
+        * API/tests/testapi.c:
+        (print_callAsFunction):
+        (main): Test the new API.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build and export the new API.
+
+2009-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Tightened up some instanceof code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30488
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): No need to do object type checks - 
+        cell type checks and ImplementsDefaultHasIntance checks implicitly
+        supersede object type checks.
+
+2009-10-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Use _stricmp and _strnicmp instead of deprecated stricmp and strnicmp.
+        https://bugs.webkit.org/show_bug.cgi?id=30474
+
+        stricmp and strnicmp are deprecated beginning in Visual
+        C++ 2005. Use _stricmp and _strnicmp instead in StringExtras.h.
+
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        (strcasecmp):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: apparently we shouldn't export those symbols?
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export some symbols.
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        structure typeinfo flags should be inherited.
+        https://bugs.webkit.org/show_bug.cgi?id=30468
+
+        Add StructureFlag constant to the various JSC classes and use
+        it for the TypeInfo construction.  This allows us to simply
+        accumulate flags by basing each classes StructureInfo on its parents.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast for-in enumeration: Cache JSPropertyNameIterator; cache JSStrings
+        in JSPropertyNameIterator; inline more code.
+
+        1.024x as fast on SunSpider (fasta: 1.43x as fast).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        * bytecompiler/BytecodeGenerator.h: Added a few extra operands to
+        op_get_pnames and op_next_pname so that we can track iteration state
+        in the register file instead of in the JSPropertyNameIterator. (To be
+        cacheable, the JSPropertyNameIterator must be stateless.)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::Interpreter::privateExecute): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames): Updated for in-RegisterFile
+        iteration state tracking.
+
+        (JSC::JIT::emit_op_next_pname): Inlined code generation for op_next_pname.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Added has_property and to_object stubs. Removed op_next_pname
+        stub, since has_property is all we need anymore.
+
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames): Don't do caching at this layer
+        anymore, since we don't create a JSPropertyNameIterator at this layer.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create): Do do caching at this layer.
+        (JSC::JSPropertyNameIterator::get):  Updated for in-RegisterFile
+        iteration state tracking.
+        (JSC::JSPropertyNameIterator::markChildren): Mark our JSStrings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::size):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::cachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::cachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::Structure::setEnumerationCache): Don't store iteration state in
+        a JSPropertyNameIterator. Do cache a JSPropertyNameIterator in a
+        Structure.
+
+        * runtime/JSValue.h:
+        (JSC::asCell):
+        * runtime/MarkStack.h: Make those mischievous #include gods happy.
+
+        * runtime/ObjectConstructor.cpp:
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Renamed countPrototypeChainEntriesAndCheckForProxies
+        to normalizePrototypeChain, since it changes dictionary prototypes to
+        non-dictionary objects.
+
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end): Simplified some code here to help with
+        current and future refactoring.
+
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition): No need to clear
+        the enumeration cache with adding / removing properties without
+        transition. It is an error to add / remove properties without transition
+        once an object has been observed, and we can ASSERT to catch that.
+
+        * runtime/Structure.h:
+        (JSC::Structure::enumerationCache): Changed the enumeration cache to
+        hold a JSPropertyNameIterator.
+
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::head): Removed StructureChain::isCacheable because
+        it was wrong-headed in two ways: (1) It gave up when a prototype was a
+        dictionary, but instead we want un-dictionary heavily accessed
+        prototypes; (2) It folded a test for hasDefaultGetPropertyNames() into
+        a generic test for "cacheable-ness", but hasDefaultGetPropertyNames()
+        is only releavant to for-in caching.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Debug build in makefile should build Debug_All.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_All configuration.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, we can't use the simple hash there because the PlatformModuleVersion 
+        structure differs.
+
+        * wtf/Platform.h:
+
+2009-10-16  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ExecutableAllocator for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29946
+
+        Tested with YARR JIT enabled for Symbian; 
+        This patch does not (yet) enable YARR JIT by default.
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::MarkStack::markChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesMarkChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2009-10-14  Darin Adler  <darin@apple.com>
+
+        Additions so fix for https://bugs.webkit.org/show_bug.cgi?id=18994
+        can build on Windows.
+
+        * wtf/MathExtras.h: Added llround and llroundf for Windows.
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Set ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for plugins while we're still building stubs.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        from the make system into common code.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand reinterpret_cast<void*>
+        https://bugs.webkit.org/show_bug.cgi?id=29034
+
+        Change reinterpret_cast<void*> to regular C style (void*) cast 
+        for the ARM RVCT compiler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): 
+        * jit/JITOpcodes.cpp: Cast to FunctionPtr first 
+           instead of directly casting to reinterpret_cast
+        * jit/JITStubCall.h: Ditto + change the type of m_stub
+          from void* to FunctionPtr.
+        (JSC::JITStubCall::JITStubCall): 
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp: Ditto.
+        (JSC::DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)):
+
+2009-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Re-enable the JIT.
+
+        * wtf/Platform.h:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Support for String.trim(), String.trimLeft() and String.trimRight() methods
+        https://bugs.webkit.org/show_bug.cgi?id=26590
+
+        Implement trim, trimLeft, and trimRight
+
+        * runtime/StringPrototype.cpp:
+        (JSC::isTrimWhitespace):
+           Our normal string whitespace function does not include U+200B which
+           is needed for compatibility with mozilla's implementation of trim.
+           U+200B does not appear to be expected according to spec, however I am
+           choosing to be lax, and match mozilla behavior so have added this
+           exception.
+        (JSC::trimString):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated some legacy bytecode weirdness.
+        
+        Use vPC[x] subscripting instead of ++vPC to access instruction operands.
+        This is simpler, and often more efficient.
+
+        To support this, and to remove use of hard-coded offsets in bytecode and
+        JIT code generation and dumping, calculate jump offsets from the beginning
+        of an instruction, rather than the middle or end.
+        
+        Also, use OPCODE_LENGTH instead of hard-coded constants for the sizes of
+        opcodes.
+        
+        SunSpider reports no change in JIT mode, and a 1.01x speedup in Interpreter
+        mode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printConditionalJump):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/Label.h:
+        (JSC::Label::setLocation):
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated some code that didn't belong out of Structure.
+        
+        SunSpider says maybe 1.03x faster.
+
+        * runtime/JSCell.h: Nixed Structure::markAggregate, and made marking of
+        a Structure's prototype the direct responsility of the object using it.
+        (Giving Structure a mark function was misleading because it implied that
+        all live structures get marked during GC, when they don't.)
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren): Added code to mark prototypes stored
+        on the global object. Maybe this wasn't necessary, but now we don't have
+        to wonder.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getEnumerableNamesFromClassInfoTable):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/PropertyNameArray.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache): Moved property name gathering code
+        from Structure to JSObject because having a Structure iterate its JSObject
+        was a layering violation. A JSObject is implemented using a Structure; not
+        the other way around.
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the GTK release build.
+
+        * GNUmakefile.am: Include Grammar.cpp in release builds now that
+        AllInOneFile.cpp is gone.
+
+2009-10-09  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Rubber-stamped by Eric Seidel.
+
+        Add ARM JIT support for Gtk port (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=30228
+
+        * GNUmakefile.am:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: added a few more variable initializations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSearch):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added missing #include.
+
+        * jsc.cpp:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: initialize variable whose initialization the compiler
+        can't otherwise figure out.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: fixed file name case.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        At long last, I pronounce the death of AllInOneFile.cpp.
+        
+        SunSpider reports a 1.01x speedup.
+
+        * AllInOneFile.cpp: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added missing project files
+        to compilation stages.
+
+        * parser/Grammar.y:
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::jscyylex):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Collector.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::operator new):
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::operator new):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new):
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::executeRegex): Inlined a few things that Shark said
+        were hot, on the presumption that AllInOneFile.cpp used to inline them
+        automatically.
+
+2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for JIT'ed op_call instructions (evals, constructs, etc.)
+        when !ENABLE(JIT_OPTIMIZE_CALL) && USE(JSVALUE32_64)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30201
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed no longer exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+        
+        Removed the optional lock from Heap::protect, Heap::unprotect, and friends,
+        since WebCore no longer uses it.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        * runtime/Collector.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=30158
+
+        Inherits IdentifierArena class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/ParserArena.cpp:36.
+
+        * parser/ParserArena.h:
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Export DateInstance::info in a way that works on Windows
+
+        Fixes <http://webkit.org/b/30171>
+        fast/dom/Window/window-postmessage-clone.html fails on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed the export of DateInstance::info from here.
+
+        * runtime/DateInstance.h: Use JS_EXPORTDATA to export
+        DateInstance::info, which is the required way of exporting data on
+        Windows.
+
+2009-10-07  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        When enabling or disabling the JIT through .qmake.cache, make sure
+        to also toggle ENABLE_YARR_JIT.
+
+        * JavaScriptCore.pri:
+
+2009-10-06  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Linking fails with "relocation R_X86_64_PC32 against symbol
+        `cti_vm_throw'"
+        https://bugs.webkit.org/show_bug.cgi?id=28422
+
+        * jit/JITStubs.cpp:
+        Mark cti_vm_throw symbol as PLT-indirect symbol, so it doesn't end up
+        in text segment causing relocation errors on amd64 architecture.
+        Introduced new define SYMBOL_STRING_RELOCATION for such symbols.
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows linking fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Windows build fix.
+
+        * runtime/DateInstance.cpp:
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Expose helpers to throw correct exceptions during object graph walk
+        used for cloning and add a helper function to create Date instances
+        without going through the JS Date constructor function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTypeError):
+        * runtime/ExceptionHelpers.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        * wtf/CrossThreadRefCounted.h:
+        Removed an unused function and assert improvement.
+        (WTF::CrossThreadRefCounted::isOwnedByCurrentThread): Moved out common code from asserts.
+        (WTF::CrossThreadRefCounted::ref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::deref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::crossThreadCopy): Since this includes a potentially
+        non-threadsafe operation, add an assert that the class is owned by the current thread.
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add Symbian files to the list of excludes.
+
+        * wscript:
+
+2009-10-05  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove precompiled header from JavaScriptCore compilation to
+        prevent qmake warning during autonomous compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=30069
+
+        * JavaScriptCore.pro:
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the concept of a "fast access cutoff" in arrays, because it
+        punished some patterns of array access too much, and made things too
+        complex for inlining in some cases.
+        
+        1.3% speedup on SunSpider.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::): Check m_vectorLength instead of m_fastAccessCutoff when
+        getting / putting from / to an array. Inline putting past the end of
+        the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::canSetIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::markChildrenDirect): Removed m_fastAccessCutoff, and
+        replaced with checks for JSValue() to detect reads and writes from / to
+        uninitialized parts of the array.
+
+2009-10-02  Jonni Rainisto  <jonni.rainisto@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Math.random() gives too low values on Win32 when _CRT_RAND_S is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29956
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Added PLATFORM(WIN_OS) to handle 15bit rand()
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Take one branch instead of two to test for JSValue().
+        
+        1.1% SunSpider speedup.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_create_arguments):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description): Added support for dumping the new empty value,
+        and deleted values, in debug builds.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue()): Construct JSValue() with the empty value tag.
+
+        (JSC::JSValue::JSValue(JSCell*)): Convert null pointer to the empty value
+        tag, to avoid having two different c++ versions of null / empty.
+
+        (JSC::JSValue::operator bool): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Fix the Qt on Mac OS X build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-10-02  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow enabling and disabling of the JIT through a qmake variable.
+
+        Qt's configure may set this variable through .qmake.cache if a
+        commandline option is given and/or the compile test for hwcap.h
+        failed/succeeded.
+
+        * JavaScriptCore.pri:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29187
+
+        Don't inline ~ListRefPtr() to work around winscw compiler forward declaration
+        bug regarding templated classes.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
+
+        The change will be reverted when the above bug is fixed in winscw compiler.
+
+        * wtf/ListRefPtr.h:
+        (WTF::::~ListRefPtr):
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow custom memory allocation control for the whole JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Since in JavaScriptCore almost every class which has been instantiated by operator new is
+        inherited from FastAllocBase (bug #20422), we disable customizing global operator new for the Qt-port
+        when USE_SYSTEM_MALLOC=0.
+
+        Add #include <unistd.h> to FastMalloc.cpp because it's used by TCMalloc_PageHeap::scavengerThread().
+        (It's needed for the functionality of TCmalloc.)
+
+        Add TCSystemAlloc.cpp to JavaScriptCore.pri if USE_SYSTEM_MALLOC is disabled.
+
+        * JavaScriptCore.pri:
+        * wtf/FastMalloc.cpp:
+        (WTF::sleep):
+        * wtf/FastMalloc.h:
+
+2009-09-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by George Staikos.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        Modified by George Wright  <gwright@rim.com> to correctly work
+        with the RVCT-defined __TARGET_ARCH_ARM and __TARGET_ARCH_THUMB
+        compiler macros, as well as adding readability changes.
+
+        * wtf/Platform.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Devirtualise array toString conversion
+
+        Tweak the implementation of Array.prototype.toString to have a fast path
+        when acting on a true JSArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Buildfix for platforms using JSVALUE32.
+        https://bugs.webkit.org/show_bug.cgi?id=29915
+
+        After http://trac.webkit.org/changeset/48905 the build broke in JSVALUE32 case.
+        Also removed unreachable code.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+         - Declaration of "OperandTypes types" moved before first use.
+         - Typos fixed: dst modified to result, regT2 added.
+         - Unreachable code removed.
+        (JSC::JIT::emitSlow_op_add):
+         - Missing declaration of "OperandTypes types" added.
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Reduce heap size on Symbian from 64MB to 8MB.
+
+        This is not a perfect fix, it requires more fine tuning.
+        But this makes it possible again to debug in the emulator,
+        which is more important in order to be able to fix other
+        run-time issues.
+
+        * runtime/Collector.h:
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Fix CRASH() macro for Symbian build.
+
+        * wtf/Assertions.h: Added missing }
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Inlined a few math operations.
+        
+        ~1% SunSpider speedup.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub): Don't take a stub call when operating on
+        a constant int and a double.
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up codeblock sampler
+        https://bugs.webkit.org/show_bug.cgi?id=29836
+
+        Some rather simple refactoring of codeblock sampler so that
+        it's easier for us to use it to find problems in non-jsc
+        environments
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.h:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::enableSampler):
+        (JSC::Interpreter::dumpSampleData):
+        (JSC::Interpreter::startSampling):
+        (JSC::Interpreter::stopSampling):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::sampler):
+        * jit/JIT.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::startSampling):
+        (JSC::JSGlobalData::stopSampling):
+        (JSC::JSGlobalData::dumpSampleData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29895
+
+        The following files are generated by JavaScriptCore's GYP file and should be ignored:
+
+        pcre.mk
+        wtf.scons
+        wtf.mk
+        SConstruct
+        wtf_config.scons
+        wtf_config.mk
+        pcre.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Standardized an optimization for adding non-numbers.
+        
+        SunSpider says maybe a tiny speedup.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+        
+        6% speedup on bench-alloc-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::destroyJSGlobalObjectData):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::JSGlobalObject):
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Assert messages prints visible in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29808
+
+        Asserts use vprintf to print the messages to stderr.
+        In Symbian Open C it is not possible to see stderr so
+        I routed the messages to stdout instead.
+
+        * wtf/Assertions.cpp:
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Symbian CRASH macro implementation
+
+        Added Symbian specific crash macro that
+        stops to crash line if JIT debugging is used.
+        Additional differentiation of access violation
+        (KERN-EXEC 3) and CRASH panic.
+
+        * wtf/Assertions.h:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the PowerPC build.
+
+        * JavaScriptCore.exp:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/7195704> JavaScriptCore fails to mark registers when built for x86_64 using LLVM GCC.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markCurrentThreadConservatively): Force jmp_buf to use the appropriate alignment for a pointer
+        to ensure that we correctly interpret the contents of registers during marking.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed exports that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+        
+        2.2% speedup on bench-allocate-nonretained.js.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::setStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        * wtf/PassRefPtr.h:
+        (WTF::NotNullPassRefPtr::NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::~NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::get):
+        (WTF::NotNullPassRefPtr::clear):
+        (WTF::NotNullPassRefPtr::releaseRef):
+        (WTF::NotNullPassRefPtr::operator*):
+        (WTF::NotNullPassRefPtr::operator->):
+        (WTF::NotNullPassRefPtr::operator!):
+        (WTF::NotNullPassRefPtr::operator UnspecifiedBoolType):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::operator==):
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Hard dependency on SSE2 instruction set with JIT
+        https://bugs.webkit.org/show_bug.cgi?id=29779
+
+        Add floating point support checks to op_jfalse and op_jtrue, and
+        fix the logic for the slow case of op_add
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * wtf/Platform.h: Add a WTF_USE_QXMLQUERY #define.
+
+2009-09-28  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Remove __clear_cache which is an internal function of GCC
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        Although __clear_cache is exported from GCC, this is an internal
+        function. GCC makes no promises about it.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix an absolute path to somewhere in Oliver's machine to a relative path
+        for derived JSONObject.lut.h.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add ARM version detection for Windows CE.
+
+        * wtf/Platform.h:
+
+2009-09-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add MarkStackSymbian.cpp to build JavascriptCore for Symbian.
+
+        Re-use Windows shrinkAllocation implementation because Symbian doesn't
+        support releasing part of memory region.
+        
+        Use fastMalloc and fastFree to implement allocateStack and releaseStack
+        for Symbian port.
+
+        * JavaScriptCore.pri:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackSymbian.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2009-09-25  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix unaligned data access in YARR_JIT on ARMv5 and below.
+        https://bugs.webkit.org/show_bug.cgi?id=29695
+
+        On ARMv5 and below all data access should be naturally aligned.
+        In the YARR_JIT there is a case when character pairs are
+        loaded from the input string, but this data access is not
+        naturally aligned. This fix introduces load32WithUnalignedHalfWords
+        and branch32WithUnalignedHalfWords functions which contain
+        naturally aligned memory loads - half word loads - on ARMv5 and below.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for JavaScriptCore.  Also there are some
+        wtf project files that get built apparently.
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Ada Chan  <adachan@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+        
+        SunSpider says 0.5% faster.
+        
+        0.8% speedup on bench-alloc-nonretained.js.
+        2.5% speedup on v8-splay.js.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChain::ScopeChain):
+        (JSC::ScopeChain::globalObject): Added a globalObject data member to ScopeChainNode.
+        Replaced accessor function for globalObject() with data member. Replaced
+        globalThisObject() accessor with direct access to globalThis, to match.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h: Inlined array and object construction.
+
+2009-09-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add ARM version detection rules for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29715
+
+        * wtf/Platform.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark "Do It!" Rowe.
+
+        Some GCC versions don't like C++-style comments in preprocessor
+        directives, change to C-style to shut them up.
+
+        * wtf/Platform.h:
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Division is needlessly slow in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=29723
+
+        Add codegen for op_div on x86-64
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateDouble):
+        (JSC::JIT::addressFor):
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateNumber):
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        JavaScriptCore/JavaScriptCore.gyp directory)
+
+        JavaScriptCore.xcodeproj
+        JavaScriptCore.sln
+        JavaScriptCore.vcproj
+        JavaScriptCore_Debug.rules
+        JavaScriptCore_Release.rules
+        JavaScriptCore_Release - no tcmalloc.rules
+        JavaScriptCore_Purify.rules
+        JavaScriptCore.mk
+        JavaScriptCore_Debug_rules.mk
+        JavaScriptCore_Release_rules.mk
+        JavaScriptCore_Release - no tcmalloc_rules.mk
+        JavaScriptCore_Purify_rules.mk
+        JavaScriptCore.scons
+        JavaScriptCore_main.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Replace platform-dependent code with WTF::currentTime()
+        https://bugs.webkit.org/show_bug.cgi?id=29148
+
+        * jsc.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7215058> FastMalloc scavenging thread should be named
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerThread): Set the thread name.
+        * wtf/Platform.h: Move the knowledge of whether pthread_setname_np exists to here as HAVE(PTHREAD_SETNAME_NP).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Use HAVE(PTHREAD_SETNAME_NP).
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed clear to removeAll, as suggested by Darin Adler.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::removeAll):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix FastMalloc to build with assertions enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::ReleaseToSpans):
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::IsHeld):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Removed some unnecessary parameter names.
+
+        * wtf/HashCountedSet.h:
+
+2009-09-24  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        On Windows JSChar is typedef'ed to wchar_t.
+
+        When building with WINSCW for Symbian we need to do the
+        same typedef.
+
+        * API/JSStringRef.h:
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        A piece of my last patch that I forgot.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::clear): Added HashCountedSet::clear.
+
+2009-09-24  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid __clear_cache built-in function if DISABLE_BUILTIN_CLEAR_CACHE define is set
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        There are some GCC packages (for example GCC-2006q3 from CodeSourcery)
+        which contain __clear_cache built-in function only for C while the C++
+        version of __clear_cache is missing on ARM architectures.
+
+        Fixed a small bug in the inline assembly of cacheFlush function on
+        ARM_TRADITIONAL.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added the ability to swap vectors with inline capacities, so you can
+        store a vector with inline capacity in a hash table.
+
+        * wtf/Vector.h:
+        (WTF::swap):
+        (WTF::VectorBuffer::swap):
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        Move definition of USE(PLUGIN_HOST_PROCESS) from WebKitPrefix.h to Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Platform.h: Define WTF_USE_PLUGIN_HOST_PROCESS to 1 when
+        building on 64-bit SnowLeopard.  Define to 0 elsewhere.
+
+2009-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Code sampling builds are broken.
+        https://bugs.webkit.org/show_bug.cgi?id=29662
+
+        Fix build.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScriptSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        (JSC::compareScriptSampleRecords):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        (JSC::ScriptSampleRecord::~ScriptSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Forward.h: Added PassOwnPtr.
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's javascriptcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added.
+
+2009-09-22  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with WINSCW: no varargs macros
+
+        Disable variadic arguments for WINSCW just like we do
+        for MSVC7.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable variadic macros on MSVC7.
+
+        This was originally added in r26589 but not extended
+        when LOG_DISABLED/ASSERT_DISABLED was introduced.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix for Windows CE < 5
+
+        Define WINCEBASIC to disable the IsDebuggerPresent() code in
+        wtf/Assertions.cpp.
+
+        * JavaScriptCore.pri:
+
+2009-09-22  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix major memory leak in JavaScriptCore RegisterFile on Windows CE
+
+        https://bugs.webkit.org/show_bug.cgi?id=29367
+
+        On Widows CE we must decommit all committed pages before we release
+        them. See VirtualFree documentation.
+        Desktop Windows behaves much smoother in this situation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+
+        * wtf/Platform.h: Also sort PLATFORM(IPHONE) #defines.
+
+2009-09-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Fix] SourceCode's uninitialized member
+        
+        Potential source of crashes and bugs was fixed. Default constructor
+        didn't initialized m_provider member.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29364
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Re-land SNES fix with corrected assertion.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-21  Adam Roben  <aroben@apple.com>
+
+        Revert r48573, as it caused many assertion failures
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/JSObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam 'Cabin Boy' Weinig.
+
+        Fix stack alignment with ARM THUMB2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=29526
+        
+        Stack is currently being decremented by 0x3c, bump this to 0x40 to make this a
+        multiple of 16 bytes.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+
+2009-09-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        SNES is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=29534
+
+        The problem was that the emulator used multiple classes with
+        more properties than our dictionary cutoff allowed, this resulted
+        in more or less all critical logic inside the emulator requiring
+        uncached property access.
+
+        Rather than simply bumping the dictionary cutoff, this patch
+        recognises that there are two ways to create a "dictionary"
+        structure.  Either by adding a large number of properties, or
+        by removing a property.  In the case of adding properties we
+        know all the existing properties will maintain their existing
+        offsets, so we could cache access to those properties, if we
+        know they won't be removed.
+
+        To make this possible, this patch adds the logic required to
+        distinguish a dictionary created by addition from one created
+        by removal.  With this logic in place we can now cache access
+        to objects with large numbers of properties.
+
+        SNES performance improved by more than 6x.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement ES5 Object.create function
+        https://bugs.webkit.org/show_bug.cgi?id=29524
+
+        Implement Object.create.  Very simple patch, effectively Object.defineProperties
+        only creating the target object itself.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorCreate):
+
+2009-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Fix clean debug builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by George Staikos.
+
+        QtWebKit Windows CE compile fix
+
+        https://bugs.webkit.org/show_bug.cgi?id=29379
+
+        There is no _aligned_alloc or _aligned_free on Windows CE.
+        We just use the Windows code that was there before and use VirtualAlloc.
+        But that also means that the BLOCK_SIZE must be 64K as this function
+        allocates on 64K boundaries.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        * runtime/Collector.h:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement ES5 Object.defineProperties function
+        https://bugs.webkit.org/show_bug.cgi?id=29522
+
+        Implement Object.defineProperties.  Fairly simple patch, simply makes use of
+        existing functionality used for defineProperty.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::defineProperties):
+        (JSC::objectConstructorDefineProperties):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix part2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Implement Object.defineProperty.  This requires adding the API to
+        ObjectConstructor, along with a helper function that implements the
+        ES5 internal [[ToPropertyDescriptor]] function.  It then adds
+        JSObject::defineOwnProperty that implements the appropriate ES5 semantics.
+        Currently defineOwnProperty uses a delete followed by a put to redefine
+        attributes of a property, clearly this is less efficient than it could be
+        but we can improve this if it needs to be possible in future.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+          Update defineGetter/Setter calls
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineGetter):
+        (JSC::JSGlobalObject::defineSetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::isDataDescriptor):
+        (JSC::PropertyDescriptor::isGenericDescriptor):
+        (JSC::PropertyDescriptor::isAccessorDescriptor):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        (JSC::PropertyDescriptor::setWritable):
+        (JSC::PropertyDescriptor::setEnumerable):
+        (JSC::PropertyDescriptor::setConfigurable):
+        (JSC::PropertyDescriptor::setSetter):
+        (JSC::PropertyDescriptor::setGetter):
+        (JSC::PropertyDescriptor::equalTo):
+        (JSC::PropertyDescriptor::attributesEqual):
+        (JSC::PropertyDescriptor::attributesWithOverride):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::value):
+        (JSC::PropertyDescriptor::setValue):
+        (JSC::PropertyDescriptor::isEmpty):
+        (JSC::PropertyDescriptor::writablePresent):
+        (JSC::PropertyDescriptor::enumerablePresent):
+        (JSC::PropertyDescriptor::configurablePresent):
+        (JSC::PropertyDescriptor::setterPresent):
+        (JSC::PropertyDescriptor::getterPresent):
+        (JSC::PropertyDescriptor::operator==):
+        (JSC::PropertyDescriptor::):
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix to enable ARM_THUMB2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt/Windows CE build.
+
+        * JavaScriptCore.pri: Build the ce_time.cpp functions from
+        within Qt externally.
+        * wtf/DateMath.cpp: Removed unnecessary Qt #ifdef, for the
+        Qt build these functions are no external, too.
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fox.
+
+        Repeat Q_OS_WIN wchar_t hack for WINSCW, similar to
+        revision 24774.
+
+        WINSCW defines wchar_t, thus UChar has to be wchar_t
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29186
+
+        WINSCW Template specialisation name in declaration must the be the same as in implementation.
+
+        * runtime/LiteralParser.h:
+
+2009-09-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27060
+
+        Symbian compiler for emulator target (WINSCW) fails with
+        "illegal operand" for m_attributesInPrevious in structure.ccp
+        (when calling make_pair functions).
+        This error is apparently due to the compiler not properly
+        resolving the unsigned type of the declared bitfield.
+
+        Initial patch explicitly casted m_attributesInPrevious
+        to unsigned, but since bitfield optimization is not critical for
+        the emulator target, this conditional change in header file
+        appears to be least intrusive.
+
+        * runtime/Structure.h:
+
+2009-09-16  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix GCC warnings on ARM_THUMB2 platform
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        The webkit stdint and stdbool headers exists because
+        the compiler MSVC doesn't include them.  The check
+        should not check for PLATFORM(WIN_OS) but for MSVC.
+
+        * os-win32/stdbool.h:
+        * os-win32/stdint.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix after flag was moved to correct place.
+
+        * wscript:
+
+2009-09-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for 64-bit Qt on Mac OS X
+
+        * wtf/Platform.h: Use JSVALUE64 on DARWIN, not only on MAC
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix wtf/ThreadSpecific.h under Qt to free thread local objects.
+        https://bugs.webkit.org/show_bug.cgi?id=29295
+
+        This is an important fix when JavaScript workers are in use, since
+        unfreed ThreadGlobalDatas leak a big amount of memory (50-100k each).
+        QThreadStorage calls the destructor of a given object, which is the
+        ThreadSpecific::Data. Unlike pthread, Qt is object oriented, and does
+        not support the calling of a static utility function when the thread
+        is about to close. In this patch we call the ThreadSpecific::destroy()
+        utility function from the destructor of ThreadSpecific::Data. Moreover,
+        since Qt resets all thread local values to 0 before the calling of the
+        appropriate destructors, we set back the pointer to its original value.
+        This is necessary because the get() method of the ThreadSpecific
+        object may be called during the exuction of the destructor.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::Data::~Data):
+        (WTF::::~ThreadSpecific):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow anonymous storage inside JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=29168
+
+        Add the concept of anonymous slots to Structures so that it is
+        possible to store references to values that need marking in the
+        standard JSObject storage buffer.  This allows us to reduce the
+        malloc overhead of some objects (by allowing them to store JS
+        values in the inline storage of the object) and reduce the 
+        dependence of custom mark functions (if all an objects children
+        are in the standard object property storage there's no need to
+        mark them manually).
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::addAnonymousSlots):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::TransitionTable::addSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::removeSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::getSlotTransition):
+        (JSC::StructureTransitionTable::getAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::addAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::removeAnonymousSlotTransition):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added the ENABLE_MATHML define to the features
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-15 Csaba Osztrogonac <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows.
+
+        After http://trac.webkit.org/changeset/47795 the MinGW build broke,
+        because MinGW has __mingw_aligned_malloc instead of _aligned_malloc.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock): MinGW case added.
+        (JSC::Heap::freeBlock): MinGW case added.
+
+2009-09-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for Windows/MinGW
+
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: JSVALUE32_64 temporarily disabled on PLATFORM(WIN_OS) with COMPILER(MINGW)
+
+2009-09-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Detect VFP at runtime in generic ARM port on Linux platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29076
+
+        * JavaScriptCore.pri:
+        * assembler/MacroAssemblerARM.cpp: Added.
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+
+2009-09-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows build.
+
+        * JavaScriptCore.pri: Correct a logic error.
+        * pcre/dftables: Add missing paranthesis for tmpdir function.
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports (again).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Correct fix for non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        This patch basically requires two separate steps, the first is to split getPropertyNames
+        into two functions -- getOwnPropertyNames and getPropertyNames, basically making them behave
+        in the same way as getOwnPropertySlot and getPropertySlot.  In essence getOwnPropertyNames
+        produces the list of properties on an object excluding its prototype chain and getPropertyNames
+        just iterates the the object and its prototype chain calling getOwnPropertyNames at each level.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::getOwnEnumerablePropertyNames):
+        (JSC::Structure::getEnumerablePropertyNames):
+        * runtime/Structure.h:
+
+2009-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=29214
+
+        Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
+        This flag is used to make sure that caching of the property name data is safe.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasDefaultGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        Added a new mainThreadOnly flag that WebCore would set.
+
+        * runtime/Collector.cpp: (JSC::Heap::registerThread): JSC API methods always call this,
+        so this is a good place to check that the API isn't used form a wrong thread.
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compiling JavaScriptCore on sparc 64 with gcc fails.
+
+        ThreadSafeShared uses the atomic __gnu_cxx::__exchange_and_add with an int,
+        however on sparc 64 the _Atomic_word argument is typedefed to long (8 bytes).
+
+        The patch disables WTF_USE_LOCKFREE_THREADSAFESHARED in ThreadSafeShared to use
+        a mutex instead when compiling for sparc 64 with gcc.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29175
+
+        * wtf/Platform.h:
+        __sparc64__ is not defined on all OS.
+        Uses instead: __sparc__ && __arch64__ || __sparcv9
+        * wtf/Threading.h:
+
+2009-09-11  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on Windows7(64Bit) with latest SDK.
+
+        Added the missing include file.
+
+        * runtime/UString.cpp:
+
+2009-09-11  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Qt/Windows CE compile fix, include the executable allocator and
+        markstack implementation in the windows build.
+
+        * JavaScriptCore.pri:
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * wtf/Platform.h:
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Update JavaScriptCore and WebKit's FeatureDefines.xcconfig so that they are in sync with WebCore as they need to be.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Make StructureTransitionTable use an enum for the PtrAndFlags member
+        used for the single transition slot optimisation.
+
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Refactor StructureTransitionTable and Structure to unify handling of the single slot optimization
+        https://bugs.webkit.org/show_bug.cgi?id=29141
+
+        Make StructureTransitionTable encapsulate the single transition slot optimization.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::StructureTransitionTable::table):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::setTransitionTable):
+        (JSC::StructureTransitionTable::):
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement fastDeleteSkippingDestructor for FastAllocBase and fastDeleteAllValues for HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        FastAllocBase has been extended with fastDeleteSkippingDestructor function which
+        releases memory without destructor call. fastDeleteAllValues has been implemented 
+        similar as deleteAllValues but it uses fastDelete function to release memory.
+
+        * wtf/FastAllocBase.h:
+        (WTF::fastDeleteSkippingDestructor):
+        * wtf/HashSet.h:
+        (WTF::fastDeleteAllValues):
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand GCC visibility attribute
+        https://bugs.webkit.org/show_bug.cgi?id=29079
+
+        * API/JSBase.h: Make the test more specific to hit only
+        the GCC compiler
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert of the previous change.  It broke the tests.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+
+2009-09-10  Ben Laurie  <benl@google.com>
+
+        Reviewed by Adam Barth.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26836>
+
+        If dtoa was given a small buffer and the number was either infinite or
+        NaN, then the buffer would be overflowed.
+
+        * wtf/dtoa.cpp:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Change reinterpret_cast to static_cast in r48212.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WTF_PLATFORM_FORCE_PACK as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=29066
+
+        * wtf/Platform.h:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Implement flushing the instruction cache for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29075
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Call IMB_Range to flush
+        the instruction cache on Symbian
+
+2009-09-09  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29024
+        Make JavaScriptCore compile on platforms with case-insensitive file systems and typeinfo.h in STL
+
+        These platforms include Microsoft Visual Studio 2003, and Symbian with Metrowerks compiler.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSTypeInfo.h: Copied from JavaScriptCore/runtime/TypeInfo.h.
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h: Removed.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON.stringify(Date) loses the milliseconds information
+        https://bugs.webkit.org/show_bug.cgi?id=29063
+
+        Make sure we include milliseconds in the output of toISOString.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix when USE(LOCKFREE_THREADSAFESHARED) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29011
+
+        * wtf/Threading.h: Use LOCKFREE_THREADSAFESHARED guard for 
+        atomicIncrement and atomicDecrement
+
+2009-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control in Yarr's RegexInterpreter
+        https://bugs.webkit.org/show_bug.cgi?id=29025
+
+        Inherits RegexInterpreter classes from FastAllocBase (bug #20422), which has
+        been instantiated by 'new':
+
+        class ByteDisjunction
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1462
+
+        struct BytecodePattern
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1279
+
+        * yarr/RegexInterpreter.h:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reverting r48121 to fix Windows build errors.
+
+        * JavaScriptCore.exp:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows export files
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [[ToString]] conversion should use the actual toString function for String objects.
+
+        Remove incorrect specialisations of toString conversions on StringObject.
+
+        * JavaScriptCore.exp:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Add new export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Add new export.
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove unneeded export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Remove unneeded export.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part two.
+
+        Make some improvements to garbage collection code:
+
+            1) Create a runtime assertion that catches any classes that
+               override markChildren but have the HasDefaultMark bit set.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Improve the efficiency of the asObject and asArray functions
+               when called on JSCell* to avoid a round trip to JSValue.
+            4) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            5) Removed the JSCell::marked function and other GC-related
+               functions because these operations are no longer things that
+               code other than the core GC code needs to do directly. Fixed
+               callers that were calling them.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively): Removed unneeded call to MarkStack::drain.
+        (JSC::Heap::markProtectedObjects): Removed unneeded check of the mark
+        bit and call to MarkStack::drain.
+        (JSC::Heap::collect): Removed unneeded checks of the mark bit and also
+        changed call to SmallStrings::mark to call markChildren instead to match
+        the rest of the objects.
+        (JSC::typeName): Removed unneeded cast to JSObject*.
+
+        * runtime/JSArray.h:
+        (JSC::asArray): Added an overload for JSCell* and changed the JSValue
+        version to call it. Removed some unneeded casts.
+        (JSC::JSArray::markChildrenDirect): Marked this function inline. It's in
+        a header, and if not marked inline this could lead to linking problems.
+        (JSC::MarkStack::markChildren): Added. This helper function is used by
+        the drain function to avoid repating code. Also added the code here to
+        check fro default mark violations in debug code. If a markChildren
+        function adds something to the mark stack, but the type info claimed
+        hasDefaultMark was true, then we will get an assertion now. Also fixed
+        the assertion about the mark bit to use the Heap function directly
+        because we don't have a JSCell::marked function any more.
+        (JSC::MarkStack::drain): Changed a local variable from "v" to "value",
+        and from "currentCell" to "cell". Changed to call markChildren in two
+        places instead of repeating a chain of if statements twice. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions.
+
+        * runtime/JSCell.h: Removed JSCell's markCellDirect and marked member
+        functions. Added a comment explaining that asCell should be deprecated
+        in favor of the JSValue asCell member function.
+        (JSC::MarkStack::append): Added the assertion that catches callers
+        that have set the HasDefaultMark bit incorrectly. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions. Moved the overload of
+        MarkStack::append for JSValue here so it can call through to the cell
+        version. The old version had a copy of all the code instead, but that
+        repeated the conversion from JSValue to JSCell* and the check for
+        whether a value is a cell multiple times.
+        (JSC::Structure::markAggregate): Moved this function here to avoid
+        dependencies for Structure.h, since this calls MarkStack::append.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren): Added code to clear
+        m_isCheckingForDefaultMarkViolation so the marking done by JSObject
+        doesn't trigger the assertion.
+
+        * runtime/JSValue.h: Moved some stray includes that were outside the
+        header guard inside it. Not sure how that happened! Removed the
+        GC-related member functions markChildren, hasChildren, marked, and
+        markDirect.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/MarkStack.h: Added m_isCheckingForDefaultMarkViolation and
+        initialized it to false. Moved the append function body from here to
+        JSCell.h. Added a declaration of a private markChildren function used
+        inside the drain function.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Changed the name and style of this
+        function to match other functions. This allows us to share the normal
+        mark stack code path.
+
+        * runtime/SmallStrings.h: Changed the name and interface of mark to
+        the more-normal markChildren style.
+
+        * runtime/Structure.h: Moved the body of markAggregate into the
+        JSCell.h to avoid a circular dependency with JSCell.h.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part one.
+
+        Make some improvements to garbage collection code:
+
+            1) Fix the two classes that had the default mark bit set but
+               should not.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            4) Removed some GC-related functions because these operations are
+               no longer things that code other than the core GC code needs
+               to do directly. Fixed callers that were calling them.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate): Removed unneeded check of the mark
+        bit before calling MarkStack::append.
+
+        * interpreter/Register.h: Removed unneeded marked and markChildren
+        functions.
+
+        * jit/JITStubs.cpp:
+        (op_eq): Removed unneeded assertions, instead using checked casting
+        functions such as asObject.
+
+        * runtime/ArgList.h: Added now-needed forward declaration of MarkStack.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren): Remmoved unneeded check of the mark bit.
+
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getObject): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSObject.h:
+        (JSC::asObject): Added an overload for JSCell* and changed the JSValue
+        version to call it.
+        (JSC::JSValue::get): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set. Later we may want to optimize this for
+        wrapper types that never have cells in their internal values, but there
+        is no measured performance regression in SunSpider or V8 doing this
+        all the time.
+
+        * runtime/MarkStack.cpp: Tweaked formatting.
+
+2009-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch USE_ defines over to the compiler so that they can be
+        checked by files not including config.h (like WebCorePrefix.h).
+
+        * wtf/Platform.h:
+
+2009-09-03  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary dependency on unistd.h
+        https://bugs.webkit.org/show_bug.cgi?id=28962
+
+        * runtime/Completion.cpp:
+
+2009-09-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add strnstr for Linux and Windows in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=28901
+
+        * wtf/StringExtras.h:
+        (strnstr):
+
+2009-09-03  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's HashEntry class
+        https://bugs.webkit.org/show_bug.cgi?id=27830
+
+        Inherits HashEntry class from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/runtime/Lookup.cpp:32.
+
+        * runtime/Lookup.h:
+
+2009-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Should crash if JIT code buffer allocation fails.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28926
+        <rdar://problem/7031922>
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for building on Windows.
+
+        * wtf/ThreadingPthreads.cpp:
+
+2009-09-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use fastMalloc when neither MMAP nor VIRTUALALLOC are enabled
+        
+        RegisterFile constructor currently throws #error when both
+        MMAP and VIRTUALALLOC conditions fail.
+        On any platform that does not provide these features
+        (for instance, Symbian),
+        the fallback should be regular malloc (or fastMalloc).
+        It is functionally equivalent in this case, even though it may
+        have certain drawbacks such as lack of dynamic pre-allocation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2009-08-31  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed typo.
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON Stringifier does not follow ES5 spec for handling of Number, String and Boolean objects
+        https://bugs.webkit.org/show_bug.cgi?id=28797
+
+        Fixed unwrapBoxedPrimitive to do the right thing, which necessitated a couple of new exception
+        checks, and corrected the logic in gap to correctly convert Number and String objects.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
 
-        Allow ENABLE_DASHBOARD_SUPPORT and ENABLE_MAC_JAVA_BRIDGE to be
-        disabled on the Mac.
+        Reviewed by Adam Roben.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21333
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
 
-        * wtf/Platform.h:
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        * wtf/Threading.h: (WTF::atomicIncrement): Changed atomicIncrement to match decrement
+        and return the new value. Also added using directives for these functions, to match
+        te rest of WTF.
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Link the testapi against CFLite when building the WinCairo port.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add new Release_CFLite
+          target.  Update all targets to inherit from either the
+          JavaScriptCF.vsprops (Apple target) or the JavaScriptCFLite.vsprops
+          file (WinCairo target).
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Remove
+          input file CoreFoundation.lib. This is provided by either the
+          JavaScriptCF.vsprops or JavaScriptCFLite.vsprops file.
+
+2009-08-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Fix Windows-specific crash due to missing memory clearing call.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: JavaScriptCore_debug.def missing some exports.  Apple
+        Windows build does not use this file, so it was not noticed previously.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        Missed one, fix part II.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_8_32):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON parser accepts trailing comma in array literals
+        https://bugs.webkit.org/show_bug.cgi?id=28779
+
+        Update parser to correctly fail if there's a trailing comma.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        'this' in JSON.parse reviver is the global object
+        https://bugs.webkit.org/show_bug.cgi?id=28752
+
+        This is a technically simple change, we merely update the code for calling
+        the reviver function to pass the correct this object.  Doing so however
+        exposes the holder to arbitrary mutation by the reviver function so it is
+        necessary for us to now guard all property accesses against the possibility
+        of failure.
+
+        * runtime/JSArray.h:
+          JSON needs to delete a property from the array, so we friend its 
+          Walker class so that we can make a non-virtual call to the arrays
+          delete and getOwnPropertySlot methods.
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::callReviver):
+          We need to pass the correct this object
+        (JSC::Walker::walk):
+          Update calls to callReviver, and update property logic logic
+          to correctly handle the holder being mutated by the reviver
+          function.
+
+2009-08-26  Alice Liu  <alice.liu@apple.com>
+
+        Windows build fix: added some exported symbols
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some exported symbols that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliejver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        We rely on a slightly OS X specific behaviour, that x86-64 applications have a 4Gb zero page,
+        so pointers are never representable as a 32-bit integer, and always have to be represented by
+        a separate immediate load instruction, rather than within the immediate field of an arithmetic
+        or memory operation.
+
+        We explicitly check for a couple of cases where a value might be representable in 32-bit, but
+        these probably never kick in on Mac OS, and only kick in to hose GTK.  Deleting these does not
+        show a performance degradation on SunSpider.  Remove.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A bit of Collector refatoring.
+        
+        SunSpider says no change. v8 says 1.003x faster (1.02x faster on splay).
+
+        * JavaScriptCore.exp:
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        (JSC::JSCell::getPrimitiveNumber):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::toNumber):
+        (JSC::JSCell::toString):
+        (JSC::JSCell::toObject): Removed pure virtual functions from
+        JSCell, so the collector can construct one. This allowed
+        me to remove a bunch of ASSERT_NOT_REACHED throughout the
+        code, too.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell): ditto
+        (JSC::Heap::heap): Inlined this function because it's trivial.
+
+        * JavaScriptCore.exp:
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks): Renamed freeHeap to freeBlocks, since
+        it doesn't actually free the Heap object.
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h: Refactored block allocation and destruction
+        into helper functions.
+        
+        * runtime/GetterSetter.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSPropertyNameIterator.cpp: Removed dummy implementations
+        of pure virtual functions. (See above.)
 
-2008-10-06  Steve Falkenburg  <sfalken@apple.com>
+=== End re-roll-in of r47738:47740 with Windows crash fixed ===
 
-        https://bugs.webkit.org/show_bug.cgi?id=21416
-        Pass 0 for size to VirtualAlloc, as documented by MSDN.
-        Identified by Application Verifier.
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: start out with a 32-bit value to avoid a shortening warning.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::sweep):
+
+2009-08-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Substantially reduced VM thrash in the GC heap.
+        
+        1.08x faster on v8 (1.60x faster on v8-splay).
         
+        1.40x faster on bench-alloc-nonretained.
+        
+        1.90x faster on bench-alloc-retained.
+        
+        SunSpider says no change.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate): Fixed a long-standing bug: update a few local
+        variables unconditionally after calling collect(), since they may be used
+        even if we don't "goto scan". (In the bug I saw, usedBlocks got out of
+        sync with heap.usedBlocks).
+        (JSC::Heap::sweep): Keep enough free heap space to accomodate 
+        the number of objects we'll allocate before the next GC, plus 25%, for
+        good measure.
+        * runtime/Collector.h: Bumped the block size to 256k. This seems to give
+        the best cache performance, and it prevents us from initiating lots of
+        VM traffic to recover very small chunks of memory.
+
+=== Begin re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added OwnPtr to VectorTraits so we can store OwnPtrs in Vectors.
+
+        * wtf/VectorTraits.h:
+
+2009-08-26  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Remove duplicated files from file list.
+
+        * GNUmakefile.am:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More export fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Hopefully fix all the exports from JSC on windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fixes).
+
+        Forgot I added files to JavaScriptCore. 
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the core runtime support for getOwnPropertyDescriptor.
+        This adds a virtual getOwnPropertyDescriptor method to every class
+        that implements getOwnPropertySlot that shadows the behaviour of
+        getOwnPropertySlot.  The alternative would be to make getOwnPropertySlot
+        (or PropertySlots in general) provide property attribute information,
+        but quick testing showed this to be a regression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        (JSC::JSString::getOwnPropertyDescriptor):
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+          Add property descriptor equivalents of the lookup
+          table access functions
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp: Added.
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::hasAccessors):
+        (JSC::PropertyDescriptor::setUndefined):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        * runtime/PropertyDescriptor.h: Added.
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::attributes):
+        (JSC::PropertyDescriptor::isValid):
+        (JSC::PropertyDescriptor::value):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
         Reviewed by Darin Adler.
 
-        * kjs/collector.cpp:
-        (KJS::freeBlock):
+        How many copies of the parameters do you need?
+        https://bugs.webkit.org/show_bug.cgi?id=28701
+
+        The function parameters in JSC get copied a lot - and unnecessarily so.
+
+        Originally this happened due to duplicating FunctionBodyNodes on recompilation,
+        though the problem has been exacerbated by copying the parameters from the
+        original function body onto the executable, then back onto the real body that
+        will be generated (this happens on every function).  And this is all made worse
+        since the data structures in question are a little ugly - C style arrays of C++
+        objects containing ref counts, so they need a full copy-construct (rather than
+        a simple memcpy).
 
-2008-10-06  Kevin McCullough  <kmccullough@apple.com>
+        This can all be greatly simplified by just punting the parameters off into
+        their own ref-counted object, and forgoing all the copying.
 
-        Reviewed by Tim Hatcheri and Oliver Hunt.
+        ~no performance change, possible slight progression.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21412
-        Bug 21412: Refactor user initiated profile count to be more stable
-        - Export UString::from for use with creating the profile title.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::parameterCount):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::FunctionExecutable::compile):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::parameterCount):
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Export tryFastMalloc for Canvas3D work
+        https://bugs.webkit.org/show_bug.cgi?id=28018
 
         * JavaScriptCore.exp:
 
-2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        * wtf/Platform.h: Added a #define to catch this issue in the
+        future. The define would generate an error on gcc without the
+        space in the expansion, but Visual C++ needs the space to cause an error.
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modify
+          Cairo debug build to inherit from new debug_cairo property sheet.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops:
+          Modify to look for debug CFLite when in debug build.
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Adler & Darin Hunt.
 
-        Not reviewed. Build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+        Do not retain ScopeNodes outside of parsing
         
-        - revert toBoolean changes (r37333 and r37335); need to make WebCore work with these
+        There is now no need for these to exist outside of parsing - their use in the runtime is replaced by Executable types.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::adoptData):
+        (JSC::FunctionBodyNode::parameterCount):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC::Parser::arena):
+        (JSC::Parser::Parser):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        (JSC::arrayProtoFuncSort):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compile):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::copyParameters):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::make):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::jitCode):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put): Landed revised version I had tested but forgot
+        to land. Leave out the branch, since we don't need one.
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Array index miss case creates a string every time
+        https://bugs.webkit.org/show_bug.cgi?id=28664
+
+        SunSpider test results I saw:
+
+            0.5% faster overall
+            1% faster on crypto-aes
+            20% faster on crypto-md5
+            13% faster on crypto-sha1
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype): Initialize m_hasNoPropertiesWithUInt32Names
+        to true.
+        (JSC::ObjectPrototype::put): Clearly m_hasNoPropertiesWithUInt32Names if the new
+        property has a name that is the string form of a UInt32.
+        (JSC::ObjectPrototype::getOwnPropertySlot): Don't call JSObject::getOwnPropertySlot
+        if m_hasNoPropertiesWithUInt32Names is true, and it is highly likely to be true.
+
+        * runtime/ObjectPrototype.h: Added declarations for the above.
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fix a typo in my distcheck build fix.
+
+        * GNUmakefile.am:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for make distcheck.
+
+        * GNUmakefile.am: Added files required for the build.
+
+2009-08-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION(r47639-r47660): Webkit crashes on launch on PowerPC
+        https://bugs.webkit.org/show_bug.cgi?id=28655
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Initialize properly with a VPtrHackExecutable.
+        * wtf/Platform.h:
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Fix storage leak from syntax tree arena allocation patch.
+
+        * parser/Nodes.h: CommaNode needs to inherit from ParserArenaDeletable
+        because it has a vector.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Made non-inline again.
+        This is used outside Nodes.cpp so can't be inline unless
+        it is in the header.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Two loose ends from the last commit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made ParserArena.h
+        and create_hash_table project-internal instead of "private".
+        * runtime/Executable.h: Removed accidentally-added constructor.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Use an actual arena now. 0.6% speedup on SunSpider.
+
+        New and improved with 100% less leaking of the universe.
 
-        * API/JSValueRef.cpp:
-        (JSValueToBoolean):
-        * ChangeLog:
         * JavaScriptCore.exp:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncSome):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::constructBoolean):
-        (JSC::callBooleanConstructor):
-        * kjs/GetterSetter.h:
-        * kjs/JSCell.h:
-        (JSC::JSValue::toBoolean):
-        * kjs/JSNumberCell.cpp:
-        (JSC::JSNumberCell::toBoolean):
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::toBoolean):
-        * kjs/JSObject.h:
-        * kjs/JSString.cpp:
-        (JSC::JSString::toBoolean):
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::setRegExpConstructorMultiline):
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed all exports involving the class FunctionBodyNode, which no
+        longer needs to be used outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Nodes.h and
+        Executable.h project-internal instead of "private".
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+
+        * parser/Grammar.y: Made identifiers from the lexer be const
+        Identifier* and updated since VarStack contains const Identifier* now.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers and
+        added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Changed the throwError code to use
+        the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having to
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+        (JSC::Parser::parseFunctionFromGlobalCode): Changed to use the
+        singleStatement function, since there is no longer any children function.
+        Removed some unneeded use of RefPtr.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+        (JSC::ParserArena::derefWithArena): Make non-inline.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added a separate
+        IdentifierArena object, a segmented vector of identifiers that used
+        to be in the Lexer.
+
+        * runtime/Executable.h: Moved the definition of the
+        FunctionExecutable::make function here. It can't go in JSFunction.h
+        since that header has to be used outside JavaScriptCore and so can't
+        include this, which includes Nodes.h. The function could be moved
+        elswhere if we don't want to include JSFunction.h in this header, but
+        for now this seems to be the best place.
+
+        * runtime/JSFunction.h: Removed the include of Executable.h and
+        definition of the FunctionExecutable::make function.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-08-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-JIT build.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QuickTime build fix.
+
+        * runtime/JSArray.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QT build fix.
+
+        * runtime/StringPrototype.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restructure Executable types so that host functions do not hold a FunctionExecutable.
+        https://bugs.webkit.org/show_bug.cgi?id=28621
+
+        All JSFunction objects have a pointer to an Executable*.  This is currently always a
+        FunctionExecutable, however this has a couple of drawbacks.  Host functions do not
+        store a range of information that the FunctionExecutable provides (source, name,
+        CodeBlock & information presently held on the FunctionBodyNode). 
+
+        [ * nearly all... see below! ]
+
+        Instead, make JSFunctions hold a pointer to an ExecutableBase, move fields specific
+        to JS sourced executable types (source, node) into a new subclass (ScriptExecutable),
+        and create a new NativeExecutable type.  We now provide a new method in JSFunction
+        to access & downcast to FunctionExecutable, but in doing so we can make an early
+        check (with an ASSERT) to ensure that the Executable read from a function will only
+        be treated as a FunctionExecutable (and thus the JS sepcific fields will only be
+        accessed) if the JSFunction is not a host function.
+
+        There is one JSFunction that currently does not have an Executable, which is the
+        object created to allow us to read out the vtable pointer.  By making this change
+        we can also add a new Executable type fror this object (VPtrHackExecutable).
+        Since this means that really all JSFunctions have an Executable we no longer have
+        to null-check m_executable before us it - particularly in isHostFunction().
+
+        This patch removes CacheableEvalExecutable, since all subclasses of ExecutableBase
+        can now be ref-counted - since both JSFunction holds (and ref-counts) an ExecutableBase
+        that might be a FunctionExecutable or a NativeExecutable.  This does now mean that all
+        ProgramExecutables and EvalExecutables (unnecessarily) provide an interface to be
+        ref-counted, however this seems less-bad than host functions unnecessarily providing
+        interface to access non-host specific information.
+
+        The class hierarcy has changed from this:
+        
+        - ExecutableBase
+            - ProgramExecutable
+            - EvalExecutable
+                - CacheableEvalExecutable (also RefCounted by multiple-inheritance)
+            - FunctionExecutable (also RefCounted by multiple-inheritance, 'special' FunctionExecutable also used for host functions)
+
+        To this:
+        
+        - RefCounted
+            - ExecutableBase
+                - NativeExecutable
+                - VPtrHackExecutable
+                - ScriptExecutable
+                    - ProgramExecutable
+                    - EvalExecutable
+                    - FunctionExecutable
+
+        This patch speeds up sunspidey by a couple of ms (presumably due to the changes to isHostFunction()).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        (JSC::VPtrHackExecutable::~VPtrHackExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::isHostFunction):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::source):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::JSFunction::jsExecutable):
+        (JSC::JSFunction::isHostFunction):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Browser hangs on opening Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28438
+
+        Code generation needs to be able to walk the entire scopechain in some
+        cases, however the symbol table used by activations was a member of the
+        codeblock.  Following recompilation this may no longer exist, leading
+        to a crash or hang on lookup.
+
+        We fix this by introducing a refcounted SymbolTable subclass, SharedSymbolTable,
+        for the CodeBlocks used by function code.  This allows activations to
+        maintain ownership of a copy of the symbol table even after recompilation so
+        they can continue to work.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::sharedSymbolTable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::FunctionCodeBlock::~FunctionCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        (JSC::JSActivation::JSActivationData::~JSActivationData):
+        * runtime/SymbolTable.h:
+
+2009-08-20  Xan Lopez  <xlopez@igalia.com>
+
+        Add new file to GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added a number => string cache.
+        
+        1.07x faster on v8 (1.7x faster on v8-splay).
+        1.004x faster on SunSpider.
+
+        * runtime/JSCell.h: Moved JSValue::toString to JSString.h.
+        * runtime/JSGlobalData.h: Holds the cache.
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        (JSC::JSNumberCell::toThisString): Removed -0 special case.
+        UString handles this now, since too many clients were
+        special-casing it.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Use the cache when converting
+        an int or double to string.
+
+        * runtime/Operations.h:
+        (JSC::concatenateStrings): Call toString to take advantage
+        of the cache.
+
+        * runtime/SmallStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup): The cache.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Added -0 special case mentioned above.
+        Removed appendNumeric because it's mutually exclusive with the
+        cache.
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: fast/profiler/call.html is crashing occasionally
+        https://bugs.webkit.org/show_bug.cgi?id=28476
+
+        Using the codeblock for information about how many parameters and
+        locals a function has is unsafe in certain circumstances.  The
+        basic scenario is all function code being cleared in response to
+        the debugger or profiler being enabled, and then an activation is
+        marked before its associated function is re-executed.
+
+        To deal with this scenario we store the variable count of a function
+        directly in the FunctionExecutable, and then use that information.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::variableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Numbering of arguments to emitGetJITStubArg/emitPutJITStubArg incorrect
+        <bug lost in the great bug disasteroony of 08/20/09!>
+
+        The argumentNumber argument to emitGetJITStubArg/emitPutJITStubArg should match
+        the argument number used within the stub functions in JITStubs.cpp, but it doesn't.
+
+        Firstly, all the numbers changed when we added a void* 'reserved' as the first slot
+        (rather than leaving argument 0 unused), and secondly in 32_64 builds the index to
+        peek/poke needs to be multiplies by 2 (since the argument to peek/poke is a number
+        of machine words, and on 32_64 build the argument slots to stub functions are two
+        words wide).
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        Follow up style fixes that were missed in review.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::StructureTransitionTable::contains):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Add new exports to windows jsc build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        The method check optimisation made transitions aware of the value being
+        assigned when a transition was assigning a function.  This had the side
+        effect of making every assignment of a function expression result in a
+        new transition, and thus a new Structure.  The net result of this is that
+        the common JS idiom of
+
+            function MyObject() {
+                this.myFunction = function(...){...};
+            }
+            new MyObject();
+
+        Will produce a unique structure on every iteration, meaning that all
+        caching is defeated and there is a significant amount of structure churn.
+
+        The fix is to return the transition to its original form where it is
+        keyed off a property name + attributes tuple, but have each transition
+        support an optional transition on a specific value.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::transitionedFor):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::):
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
 
-2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Sam Weinig.
-        
-        - optimize op_jtrue, op_loop_if_true and op_not in various ways
-        https://bugs.webkit.org/show_bug.cgi?id=21404
-        
-        1) Make JSValue::toBoolean nonvirtual and completely inline by
-        making use of the StructureID type field.
+        Remove FunctionCodeBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=28502
+
+        These only exist to allow JIT code to dereference properties off the
+        CodeBlock for any callee, regardless of whether it is a host function.
+
+        Instead just use the FunctionExecutable.  Copy the m_parameters field
+        from the CodeBlock into the Executable, and use this to distinguish
+        between host functions, functions that have been bytecompiled, and
+        functions that have not.
+
+        m_parameters is moved to ExecutableBase rather than FunctionExecutable
+        so that (as a separate change) we can move make a separate class of
+        executable for host code, which is not devived from FunctionExecutable
+        (host code does not feature any of the properties that normal executable
+        do and will provide, such as source, attributes, and a parsed name).
+
+        1% win on v8 tests, 0.5% on sunspider.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
         
-        2) Make JSValue::toBoolean not take an ExecState; doesn't need it.
+            remove NativeCodeBlocks and the NativeCode code type.
         
-        3) Make op_not, op_loop_if_true and op_jtrue not read the
-        ExecState (toBoolean doesn't need it any more) and not check
-        exceptions (toBoolean can't throw).
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
 
-        * API/JSValueRef.cpp:
-        (JSValueToBoolean):
-        * JavaScriptCore.exp:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncSome):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::constructBoolean):
-        (JSC::callBooleanConstructor):
-        * kjs/GetterSetter.h:
-        * kjs/JSCell.h:
-        (JSC::JSValue::toBoolean):
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::toBoolean):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        (JSC::JSObject::toBoolean):
-        (JSC::JSCell::toBoolean):
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        (JSC::JSString::toBoolean):
-        * kjs/JSValue.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::setRegExpConstructorMultiline):
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString):
+            Revert to previous behaviour (as currently still commented!) that Hhost functions have a null codeblock.
 
-2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
 
-        Reviewed by Simon.
+            Bring the 32_64 & non-32_64 JITs into line with each other, callee in regT0.
 
-        Build fix for MinGW.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
 
-        * JavaScriptCore.pri:
-        * kjs/DateMath.cpp:
-        (JSC::highResUpTime):
+            Rewrite call trampolines to not use the CodeBlock.
 
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
 
-        Reviewed by Oliver Hunt.
+            Make call_JSFunction & call_arityCheck return the callee, don't expect to be passed the CodeBlock.
 
-        Remove ScopeNode::containsClosures() now that it is unused.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::FunctionExecutable::isHostFunction):
 
-        * kjs/nodes.h:
-        (JSC::ScopeNode::containsClosures):
+            Add m_numParameters.
 
-2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
 
-        Reviewed by Cameron Zwarich.
-        
-        - fix releas-only test failures caused by the fix to bug 21375
+            Only call generatedBytecode() on JSFunctions non-host FunctionExecutables.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame): Update ExecState while unwinding call frames;
-        it now matters more to have a still-valid ExecState, since dynamicGlobalObject
-        will make use of the ExecState's scope chain.
-        * VM/Machine.h:
+2009-08-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+       
+        Use a helper function to work around winscw compiler forward declaration bug
+        regarding templated classes.
 
-        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
-        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+        Add parenthesis around (PassRefPtr::*UnspecifiedBoolType) to make winscw compiler
+        work with the default UnSpecifiedBoolType() operator, which removes the winscw
+        specific bool cast hack.
 
-        Use information from the parser to detect whether an activation is
-        needed or 'arguments' is used, and emit explicit instructions to tear
-        them off before op_ret. This allows a branch to be removed from op_ret
-        and simplifies some other code. This does cause a small change in the
-        behaviour of 'f.arguments'; it is no longer live when 'arguments' is not
-        mentioned in the lexical scope of the function.
+        * wtf/PassRefPtr.h:
+        (WTF::derefIfNotNull):
+        (WTF::PassRefPtr::~PassRefPtr):
 
-        It should now be easy to remove the OptionaCalleeActivation slot in the
-        call frame, but this will be done in a later patch.
+2009-08-19  Yong Li  <yong.li@torchmobile.com>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitReturn):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::isTornOff):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::copyRegisters):
-        (JSC::JSActivation::copyRegisters):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
+        Reviewed by Gavin Barraclough.
 
-2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+        Change namespace ARM to ARMRegisters
+        X86 to X86Registers to avoid conflict with macros
+        https://bugs.webkit.org/show_bug.cgi?id=28428
 
-        Reviewed by Oliver Hunt.
-        
-        - fixed "REGRESSION (r37297): fast/js/deep-recursion-test takes too long and times out"
-        https://bugs.webkit.org/show_bug.cgi?id=21375
-        
-        The problem is that dynamicGlobalObject had become O(N) in number
-        of call frames, but unwinding the stack for an exception called it
-        for every call frame, resulting in O(N^2) behavior for an
-        exception thrown from inside deep recursion.
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * wrec/WRECGenerator.cpp:
+        * wrec/WRECGenerator.h:
+        * yarr/RegexJIT.cpp:
 
-        Instead of doing it that way, stash the dynamic global object in JSGlobalData.
-        
-        * JavaScriptCore.exp:
-        * VM/Machine.cpp:
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Helper class to temporarily
-        store and later restore a dynamicGlobalObject in JSGlobalData.
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute): In each version, establish a DynamicGlobalObjectScope.
-        For ProgramNode, always establish set new dynamicGlobalObject, for FunctionBody and Eval,
-        only if none is currently set.
-        * VM/Machine.h:
-        * kjs/ExecState.h:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Ininitalize new dynamicGlobalObject field to 0.
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.h:
-        (JSC::ExecState::dynamicGlobalObject): Moved here from ExecState for benefit of inlining.
-        Return lexical global object if this is a globalExec(), otherwise look in JSGlobalData
-        for the one stashed there.
-
-2008-10-05  Sam Weinig  <sam@webkit.org>
+2009-08-19  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Gavin Barraclough.
 
-        Avoid an extra lookup when transitioning to an existing StructureID
-        by caching the offset of property that caused the transition.
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
 
-        1% win on V8 suite.  Wash on SunSpider.
+        We actually need to mark the value in a number object if we're using the
+        32bit number representation.
 
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::put):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::setCachedTransistionOffset):
-        (JSC::StructureID::cachedTransistionOffset):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
 
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+2009-08-19  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Darin Adler.
 
-        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
-        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+         We probably shouldn't be keeping the AST for eval nodes around forevar.
+        https://bugs.webkit.org/show_bug.cgi?id=28469
 
-        This patch does not yet remove the branch, but it does a bit of refactoring
-        so that a CodeGenerator now knows whether the associated CodeBlock will need
-        a full scope before doing any code generation. This makes it possible to emit
-        explicit tear-off instructions before every op_ret.
+        EvalNodes don't destroyData() (delete their parser data) since they need to hold onto
+        their varStack.  Copy a list of variable onto EvalCodeBlock, and this can go away.
 
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitPushScope):
-        (JSC::CodeGenerator::emitPushNewScope):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::needsActivation):
+        * bytecode/CodeBlock.h:
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::adoptVariables):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        * runtime/Executable.h:
 
-2008-10-05  Gavin Barraclough  <barraclough@apple.com>
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Darin Adler.
 
-        Fix for bug #21387 - using SamplingTool with CTI.
+        http://bugs.webkit.org/show_bug.cgi?id=28441
 
-        (1) A repatch offset offset changes due to an additional instruction to update SamplingTool state.
-        (2) Fix an incusion order problem due to ExecState changes.
-        (3) Change to a MACHINE_SAMPLING macro, use of exec should now be accessing global data.
+        Fix a build issue with ICU 4.2 or later on Windows with Visual C++. 
+        Instead of defining all isXXX and toupper/tolower as 
+          WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h,
+        #define them to be different by prepending 'WTF_...ASCIIType_h' with
+        the originial names like 'toupper_WTF_...ASCIIType_h'. 
 
-        * VM/CTI.h:
-        (JSC::CTI::execute):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::privateExecuteReturned):
-        * kjs/Shell.cpp:
+        * wtf/DisallowCType.h:
 
-2008-10-04  Mark Rowe  <mrowe@apple.com>
+2009-08-18  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by Gavin Barraclough.
 
-        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
+        Assigning a function to an object should always use the existing transition, even if the transition is not specialized
+        https://bugs.webkit.org/show_bug.cgi?id=28442
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Check for an unspecialized transition as an alternative to always failing if specialisation does not match.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
 
-2008-10-04  Sam Weinig  <sam@webkit.org>
+2009-08-18  Dirk Schulze  <krit@webkit.org>
 
         Reviewed by Oliver Hunt.
 
-        Fix https://bugs.webkit.org/show_bug.cgi?id=21320
-        leaks of PropertyNameArrayData seen on buildbot
+        Added additional getter to ByteArray with an unsigned char as return.
+        ByteArray can take unsigned char directly now.
 
-        - Fix RefPtr cycle by making PropertyNameArrayData's pointer back
-          to the StructureID a weak pointer.
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
 
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::setCachedStructureID):
-        (JSC::PropertyNameArrayData::cachedStructureID):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::~StructureID):
+2009-08-18  Peter Kasting  <pkasting@google.com>
 
-2008-10-04  Darin Adler  <darin@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Cameron Zwarich.
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21295
-          Bug 21295: Replace ExecState with a call frame Register pointer
-
-        10% faster on Richards; other v8 benchmarks faster too.
-        A wash on SunSpider.
-
-        This does the minimum necessary to get the speedup. Next step in
-        cleaning this up is to replace ExecState with a CallFrame class,
-        and be more judicious about when to pass a call frame and when
-        to pass a global data pointer, global object pointer, or perhaps
-        something else entirely.
-
-        * VM/CTI.cpp: Remove the debug-only check of the exception in
-        ctiVMThrowTrampoline -- already checked in the code the trampoline
-        jumps to, so not all that useful. Removed the exec argument from
-        ctiTrampoline. Removed emitDebugExceptionCheck -- no longer needed.
-        (JSC::CTI::emitCall): Removed code to set ExecState::m_callFrame.
-        (JSC::CTI::privateCompileMainPass): Removed code in catch to extract
-        the exception from ExecState::m_exception; instead, the code that
-        jumps into catch will make sure the exception is already in eax.
-        * VM/CTI.h: Removed exec from the ctiTrampoline. Also removed the
-        non-helpful "volatile". Temporarily left ARG_exec in as a synonym
-        for ARG_r; I'll change that on a future cleanup pass when introducing
-        more use of the CallFrame type.
-        (JSC::CTI::execute): Removed the ExecState* argument.
-
-        * VM/ExceptionHelpers.cpp:
-        (JSC::InterruptedExecutionError::InterruptedExecutionError): Take
-        JSGlobalData* instead of ExecState*.
-        (JSC::createInterruptedExecutionException): Ditto.
-        * VM/ExceptionHelpers.h: Ditto. Also removed an unneeded include.
-
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall): Removed the exec and
-        exceptionValue arguments. Changed to return 0 when there's a stack
-        overflow rather than using a separate exception argument to cut
-        down on memory accesses in the calling convention.
-        (JSC::Machine::unwindCallFrame): Removed the exec argument when
-        constructing a DebuggerCallFrame. Also removed code to set
-        ExecState::m_callFrame.
-        (JSC::Machine::throwException): Removed the exec argument when
-        construction a DebuggerCallFrame.
-        (JSC::Machine::execute): Updated to use the register instead of
-        ExecState and also removed various uses of ExecState.
-        (JSC::Machine::debug):
-        (JSC::Machine::privateExecute): Put globalData into a local
-        variable so it can be used throughout the interpreter. Changed
-        the VM_CHECK_EXCEPTION to get the exception in globalData instead
-        of through ExecState.
-        (JSC::Machine::retrieveLastCaller): Turn exec into a registers
-        pointer by calling registers() instead of by getting m_callFrame.
-        (JSC::Machine::callFrame): Ditto.
-        Tweaked exception macros. Made new versions for when you know
-        you have an exception. Get at global exception with ARG_globalData.
-        Got rid of the need to pass in the return value type.
-        (JSC::Machine::cti_op_add): Update to use new version of exception
-        macros.
-        (JSC::Machine::cti_op_pre_inc): Ditto.
-        (JSC::Machine::cti_timeout_check): Ditto.
-        (JSC::Machine::cti_op_instanceof): Ditto.
-        (JSC::Machine::cti_op_new_func): Ditto.
-        (JSC::Machine::cti_op_call_JSFunction): Optimized by using the
-        ARG values directly instead of through local variables -- this gets
-        rid of code that just shuffles things around in the stack frame.
-        Also get rid of ExecState and update for the new way exceptions are
-        handled in slideRegisterWindowForCall.
-        (JSC::Machine::cti_vm_compile): Update to make exec out of r since
-        they are both the same thing now.
-        (JSC::Machine::cti_op_call_NotJSFunction): Ditto.
-        (JSC::Machine::cti_op_init_arguments): Ditto.
-        (JSC::Machine::cti_op_resolve): Ditto.
-        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Ditto.
-        (JSC::Machine::cti_op_resolve_func): Ditto.
-        (JSC::Machine::cti_op_put_by_val): Ditto.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_resolve_skip): Ditto.
-        (JSC::Machine::cti_op_resolve_global): Ditto.
-        (JSC::Machine::cti_op_post_inc): Ditto.
-        (JSC::Machine::cti_op_resolve_with_base): Ditto.
-        (JSC::Machine::cti_op_post_dec): Ditto.
-        (JSC::Machine::cti_op_call_eval): Ditto.
-        (JSC::Machine::cti_op_throw): Ditto. Also rearranged to return
-        the exception value as the return value so it can be used by
-        op_catch.
-        (JSC::Machine::cti_op_push_scope): Ditto.
-        (JSC::Machine::cti_op_in): Ditto.
-        (JSC::Machine::cti_op_del_by_val): Ditto.
-        (JSC::Machine::cti_vm_throw): Ditto. Also rearranged to return
-        the exception value as the return value so it can be used by
-        op_catch.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName): Pass globalData.
-        (JSC::DebuggerCallFrame::evaluate): Eliminated code to make a
-        new ExecState.
-        * kjs/DebuggerCallFrame.h: Removed ExecState argument from
-        constructor.
-
-        * kjs/ExecState.h: Eliminated all data members and made ExecState
-        inherit privately from Register instead. Also added a typedef to
-        the future name for this class, which is CallFrame. It's just a
-        Register* that knows it's a pointer at a call frame. The new class
-        can't be constructed or copied. Changed all functions to use
-        the this pointer instead of m_callFrame. Changed exception-related
-        functions to access an exception in JSGlobalData. Removed functions
-        used by CTI to pass the return address to the throw machinery --
-        this is now done directly with a global in the global data.
-
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString): Pass globalData instead of exec.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::name): Take globalData instead of exec.
-        * kjs/InternalFunction.h: Ditto.
-
-        * kjs/JSGlobalData.cpp: Initialize the new exception global to 0.
-        * kjs/JSGlobalData.h: Declare two new globals. One for the current
-        exception and another for the return address used by CTI to
-        implement the throw operation.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Removed code to set up globalExec,
-        which is now the same thing as globalCallFrame.
-        (JSC::JSGlobalObject::reset): Get globalExec from our globalExec
-        function so we don't have to repeat the logic twice.
-        (JSC::JSGlobalObject::mark): Removed code to mark the exception;
-        the exception is now stored in JSGlobalData and marked there.
-        (JSC::JSGlobalObject::globalExec): Return a pointer to the end
-        of the global call frame.
-        * kjs/JSGlobalObject.h: Removed the globalExec data member.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::putDirectFunction): Pass globalData instead of exec.
-
-        * kjs/collector.cpp:
-        (JSC::Heap::collect): Mark the global exception.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
 
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart): Pass globalData
-        instead of exec to createCallIdentifier.
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        No, silly runtime, AST nodes are not for you.
+
+        We still use AST nodes (ScopeNodes, particularly FunctionBodyNodes) within
+        the runtime, which means that these nodes must be persisted outside of the
+        arena, contain both parser & runtime data, etc.  This is all a bit of a mess.
+
+        Move functionality into a new FunctionExecutable class.
 
+        * API/JSCallbackFunction.cpp:
+        * API/JSObjectRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::discardBytecode):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::extractExceptionInfo):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::functionDecl):
+        (JSC::CodeBlock::numberOfFunctionDecls):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::CodeBlock::functionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::reparseDataIfNecessary):
+        * parser/Nodes.h:
+        (JSC::EvalNode::partialDestroyData):
+        * parser/Parser.h:
+        * profiler/ProfileGenerator.cpp:
         * profiler/Profiler.cpp:
-        (JSC::Profiler::willExecute): Pass globalData instead of exec to
-        createCallIdentifier.
-        (JSC::Profiler::didExecute): Ditto.
-        (JSC::Profiler::createCallIdentifier): Take globalData instead of
-        exec.
-        (JSC::createCallIdentifierFromFunctionImp): Ditto.
-        * profiler/Profiler.h: Change interface to take a JSGlobalData
-        instead of an ExecState.
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CallData.h:
+        (JSC::):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ConstructData.h:
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.cpp: Added.
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::ProgramExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::isHostFunction):
+        (JSC::FunctionExecutable::markAggregate):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::source):
+        (JSC::ExecutableBase::sourceID):
+        (JSC::ExecutableBase::lastLine):
+        (JSC::ExecutableBase::usesEval):
+        (JSC::ExecutableBase::usesArguments):
+        (JSC::ExecutableBase::needsActivation):
+        (JSC::ExecutableBase::astNode):
+        (JSC::ExecutableBase::generatedJITCode):
+        (JSC::ExecutableBase::getExecutablePool):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::varStack):
+        (JSC::EvalExecutable::evalNode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::programNode):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::usesEval):
+        (JSC::FunctionExecutable::usesArguments):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::paramString):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::body):
+        (JSC::FunctionExecutable::jitCode):
+        (JSC::FunctionExecutable::createNativeThunk):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::FunctionExecutable::make):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalData.h:
 
-2008-10-04  Cameron Zwarich  <zwarich@apple.com>
+2009-08-17  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Darin Adler.
 
-        Bug 21369: Add opcode documentation for all undocumented opcodes
-        <https://bugs.webkit.org/show_bug.cgi?id=21369>
+        Fix 300,000+ leaks seen during the regression tests.
 
-        This patch adds opcode documentation for all undocumented opcodes, and
-        it also renames op_init_arguments to op_create_arguments.
+        EvalCodeCache::get was heap-allocating an EvalExecutable instance without adopting the initial reference.
+        While fixing this we noticed that EvalExecutable was a RefCounted type that was sometimes stack allocated.
+        To make this cleaner and to prevent clients from attempting to ref a stack-allocated instance, we move the
+        refcounting down to a new CacheableEvalExecutable class that derives from EvalExecutable. EvalCodeCache::get
+        now uses CacheableEvalExecutable::create and avoids the leak.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_create_arguments):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/Executable.h:
+        (JSC::CacheableEvalExecutable::create):
+        (JSC::CacheableEvalExecutable::CacheableEvalExecutable):
 
-        Reviewed by Cameron Zwarich.
-        
-        - "this" object in methods called on primitives should be wrapper object
-        https://bugs.webkit.org/show_bug.cgi?id=21362
+2009-08-17  Oliver Hunt  <oliver@apple.com>
 
-        I changed things so that functions which use "this" do a fast
-        version of toThisObject conversion if needed. Currently we miss
-        the conversion entirely, at least for primitive types. Using
-        TypeInfo and the primitive check, I made the fast case bail out
-        pretty fast.
-        
-        This is inexplicably an 1.007x SunSpider speedup (and a wash on V8 benchmarks).
-     
-        Also renamed some opcodes for clarity:
-        
-        init ==> enter
-        init_activation ==> enter_with_activation
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_convert_this):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::createStructureID):
-        * kjs/JSCell.h:
-        (JSC::JSValue::needsThisConversion):
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructureID):
-        * kjs/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::createStructureID):
-        * kjs/JSString.h:
-        (JSC::JSString::createStructureID):
-        * kjs/JSValue.h:
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::needsThisConversion):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesThis):
-
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+        RS=Mark Rowe.
 
-        Reviewed by Maciej Stachowiak.
+        REGRESSION (r47292): Prototype.js is broken by ES5 Arguments changes
+        https://bugs.webkit.org/show_bug.cgi?id=28341
+        <rdar://problem/7145615>
 
-        Bug 21356: The size of the RegisterFile differs depending on 32-bit / 64-bit and Debug / Release
-        <https://bugs.webkit.org/show_bug.cgi?id=21356>
+        Reverting r47292.  Alas Prototype.js breaks with Arguments inheriting
+        from Array as ES5 attempted.  Prototype.js defines $A in terms of a 
+        function it places on (among other global objects) the Array prototype,
+        thus breaking $A for arrays.
 
-        The RegisterFile decreases in size (measured in terms of numbers of
-        Registers) as the size of a Register increases. This causes
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
 
-            js1_5/Regress/regress-159334.js
+2009-08-17  Peter Kasting  <pkasting@google.com>
 
-        to fail in 64-bit debug builds. This fix makes the RegisterFile on all
-        platforms the same size that it is in 32-bit Release builds.
+        Reviewed by Steve Falkenburg.
 
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
 
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 
-        Reviewed by Cameron Zwarich.
-        
-        - Some code cleanup to how we handle code features.
-        
-        1) Rename FeatureInfo typedef to CodeFeatures.
-        2) Rename NodeFeatureInfo template to NodeInfo.
-        3) Keep CodeFeature bitmask in ScopeNode instead of trying to break it out into individual bools.
-        4) Rename misleadingly named "needsClosure" method to "containsClosures", which better describes the meaning
-        of ClosureFeature.
-        5) Make setUsersArguments() not take an argument since it only goes one way.
+2009-08-17  Xan Lopez  <xlopez@igalia.com>
 
-        * JavaScriptCore.exp:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        * kjs/NodeInfo.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::didFinishParsing):
-        * kjs/Parser.h:
-        (JSC::Parser::parse):
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesEval):
-        (JSC::ScopeNode::containsClosures):
-        (JSC::ScopeNode::usesArguments):
-        (JSC::ScopeNode::setUsesArguments):
+        Reviewed by Mark Rowe.
 
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+        Fix build with FAST_MALLOC_MATCH_VALIDATION enabled.
 
-        Reviewed by Maciej Stachowiak.
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
 
-        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
-        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        A fix was landed for this issue in r37253, and the ChangeLog assumes
-        that it is a compiler bug, but it turns out that it is a subtle issue
-        with mixing signed and unsigned 32-bit values in a 64-bit environment.
-        In order to properly fix this bug, we should convert our signed offsets
-        into the register file to use ptrdiff_t.
+        Reviewed by Mark Rowe.
 
-        This may not be the only instance of this issue, but I will land this
-        fix first and look for more later.
+        Fix crash on ./ecma_2/RegExp/exec-002.js.
+        https://bugs.webkit.org/show_bug.cgi?id=28353
 
-        * VM/Machine.cpp:
-        (JSC::Machine::getArgumentsData):
-        * VM/Machine.h:
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        * kjs/Arguments.h:
-        (JSC::Arguments::init):
+        Change the order of freeParenthesesDisjunctionContext and
+        popParenthesesDisjunctionContext on all call sites as the pop
+        method is accessing backTrack->lastContext which is the context
+        that is about to be freed.
 
-2008-10-03  Darin Adler  <darin@apple.com>
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
 
-        * VM/CTI.cpp: Another Windows build fix. Change the args of ctiTrampoline.
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
 
-        * kjs/JSNumberCell.h: A build fix for newer versions of gcc. Added
-        declarations of JSGlobalData overloads of jsNumberCell.
+        Reviewed by Mark Rowe.
 
-2008-10-03  Darin Adler  <darin@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=28352
+
+        Fix coding style violations. Use m_ for C++ class members. Remove
+        trailing whitespace on empty lines.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2009-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build with JIT disabled.
+
+        * runtime/Arguments.h: Only compile the jitCode method when the JIT is enabled.
+        * runtime/Executable.h: Include PrototypeFunction.h so the compiler knows what
+        NativeFunctionWrapper is when the JIT is disabled.
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
 
-        - try to fix Windows build
+        Reviewed by Sam Weinig.
 
-        * kjs/ScopeChain.h: Add forward declaration of JSGlobalData.
+        Added ENABLE_EVENTSOURCE flag.
+        https://bugs.webkit.org/show_bug.cgi?id=14997
 
-2008-10-03  Darin Adler  <darin@apple.com>
+        * Configurations/FeatureDefines.xcconfig:
 
-        Reviewed by Geoff Garen.
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
 
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
-          Turn ExecState into a call frame pointer.
+        * parser/Parser.h:
+        (JSC::EvalExecutable::parse):
+        (JSC::ProgramExecutable::parse):
+        * runtime/Executable.h:
 
-        Remove m_globalObject and m_globalData from ExecState.
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
 
-        SunSpider says this is a wash (slightly faster but not statistically
-        significant); which is good enough since it's a preparation step and
-        not supposed to be a spedup.
+        Reviewed by Oliver Hunt.
 
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::JSCallbackFunction):
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * kjs/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        Pass JSGlobalData* instead of ExecState* to the InternalFunction
-        constructor.
-
-        * API/OpaqueJSString.cpp: Added now-needed include.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitSlowScriptCheck): Changed to use ARGS_globalData
-        instead of ARGS_exec.
-
-        * VM/CTI.h: Added a new argument to the CTI, the global data pointer.
-        While it's possible to get to the global data pointer using the
-        ExecState pointer, it's slow enough that it's better to just keep
-        it around in the CTI arguments.
-
-        * VM/CodeBlock.h: Moved the CodeType enum here from ExecState.h.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Pass fewer arguments when constructing
-        ExecState, and pass the global data pointer when invoking CTI.
-        (JSC::Machine::firstCallFrame): Added. Used to get the dynamic global
-        object, which is in the scope chain of the first call frame.
-        (JSC::Machine::cti_op_add): Use globalData instead of exec when
-        possible, to keep fast cases fast, since it's now more expensive to
-        get to it through the exec pointer.
-        (JSC::Machine::cti_timeout_check): Ditto.
-        (JSC::Machine::cti_op_put_by_id_second): Ditto.
-        (JSC::Machine::cti_op_get_by_id_second): Ditto.
-        (JSC::Machine::cti_op_mul): Ditto.
-        (JSC::Machine::cti_vm_compile): Ditto.
-        (JSC::Machine::cti_op_get_by_val): Ditto.
-        (JSC::Machine::cti_op_sub): Ditto.
-        (JSC::Machine::cti_op_put_by_val): Ditto.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_negate): Ditto.
-        (JSC::Machine::cti_op_div): Ditto.
-        (JSC::Machine::cti_op_pre_dec): Ditto.
-        (JSC::Machine::cti_op_post_inc): Ditto.
-        (JSC::Machine::cti_op_lshift): Ditto.
-        (JSC::Machine::cti_op_bitand): Ditto.
-        (JSC::Machine::cti_op_rshift): Ditto.
-        (JSC::Machine::cti_op_bitnot): Ditto.
-        (JSC::Machine::cti_op_mod): Ditto.
-        (JSC::Machine::cti_op_post_dec): Ditto.
-        (JSC::Machine::cti_op_urshift): Ditto.
-        (JSC::Machine::cti_op_bitxor): Ditto.
-        (JSC::Machine::cti_op_bitor): Ditto.
-        (JSC::Machine::cti_op_call_eval): Ditto.
-        (JSC::Machine::cti_op_throw): Ditto.
-        (JSC::Machine::cti_op_is_string): Ditto.
-        (JSC::Machine::cti_op_debug): Ditto.
-        (JSC::Machine::cti_vm_throw): Ditto.
-
-        * VM/Machine.h: Added firstCallFrame.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Pass fewer arguments when
-        constructing ExecState.
-
-        * kjs/ExecState.cpp: Deleted contents. Later we'll remove the
-        file altogether.
-
-        * kjs/ExecState.h: Removed m_globalObject and m_globalData.
-        Moved CodeType into another header.
-        (JSC::ExecState::ExecState): Take only a single argument, a
-        call frame pointer.
-        (JSC::ExecState::dynamicGlobalObject): Get the object from
-        the first call frame since it's no longer stored.
-        (JSC::ExecState::globalData): Get the global data from the
-        scope chain, since we no longer store a pointer to it here.
-        (JSC::ExecState::identifierTable): Ditto.
-        (JSC::ExecState::propertyNames): Ditto.
-        (JSC::ExecState::emptyList): Ditto.
-        (JSC::ExecState::lexer): Ditto.
-        (JSC::ExecState::parser): Ditto.
-        (JSC::ExecState::machine): Ditto.
-        (JSC::ExecState::arrayTable): Ditto.
-        (JSC::ExecState::dateTable): Ditto.
-        (JSC::ExecState::mathTable): Ditto.
-        (JSC::ExecState::numberTable): Ditto.
-        (JSC::ExecState::regExpTable): Ditto.
-        (JSC::ExecState::regExpConstructorTable): Ditto.
-        (JSC::ExecState::stringTable): Ditto.
-        (JSC::ExecState::heap): Ditto.
-
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor): Pass
-        JSGlobalData* instead of ExecState* to the InternalFunction
-        constructor.
-        (JSC::constructFunction): Pass the global data pointer when
-        constructing a new scope chain.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction): Take a JSGlobalData*
-        instead of an ExecState*. Later we can change more places to
-        work this way -- it's more efficient to take the type you need
-        since the caller might already have it.
-        * kjs/InternalFunction.h: Ditto.
-
-        * kjs/JSCell.h:
-        (JSC::JSCell::operator new): Added an overload that takes a
-        JSGlobalData* so you can construct without an ExecState*.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Moved creation of the global scope
-        chain in here, since it now requires a pointer to the global data.
-        Moved the initialization of the call frame in here since it requires
-        the global scope chain node. Removed the extra argument to ExecState
-        when creating the global ExecState*.
-        * kjs/JSGlobalObject.h: Removed initialization of globalScopeChain
-        and the call frame from the JSGlobalObjectData constructor. Added
-        a thisValue argument to the init function.
-
-        * kjs/JSNumberCell.cpp: Added versions of jsNumberCell that take
-        JSGlobalData* rather than ExecState*.
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::operator new): Added a version that takes
-        JSGlobalData*.
-        (JSC::JSNumberCell::JSNumberCell): Ditto.
-        (JSC::jsNumber): Ditto.
-        * kjs/JSString.cpp:
-        (JSC::jsString): Ditto.
-        (JSC::jsSubstring): Ditto.
-        (JSC::jsOwnedString): Ditto.
-        * kjs/JSString.h:
-        (JSC::JSString::JSString): Changed to take JSGlobalData*.
-        (JSC::jsEmptyString): Added a version that takes JSGlobalData*.
-        (JSC::jsSingleCharacterString): Ditto.
-        (JSC::jsSingleCharacterSubstring): Ditto.
-        (JSC::jsNontrivialString): Ditto.
-        (JSC::JSString::getIndex): Ditto.
-        (JSC::jsString): Ditto.
-        (JSC::jsSubstring): Ditto.
-        (JSC::jsOwnedString): Ditto.
+        Remove AST nodes from use within the Runtime (outside of parsing), stage 1
+        https://bugs.webkit.org/show_bug.cgi?id=28330
 
-        * kjs/ScopeChain.h: Added a globalData pointer to each node.
-        (JSC::ScopeChainNode::ScopeChainNode): Initialize the globalData
-        pointer.
-        (JSC::ScopeChainNode::push): Set the global data pointer in the
-        new node.
-        (JSC::ScopeChain::ScopeChain): Take a globalData argument.
+        Remove the EvalNode and ProgramNode from use in the runtime.  They still exist
+        after this patch, but are hidden behind EvalExecutable and FunctionExecutable,
+        and are also still reachable behind CodeBlock::m_ownerNode.
 
-        * kjs/SmallStrings.cpp:
-        (JSC::SmallStrings::createEmptyString): Take JSGlobalData* instead of
-        ExecState*.
-        (JSC::SmallStrings::createSingleCharacterString): Ditto.
-        * kjs/SmallStrings.h:
-        (JSC::SmallStrings::emptyString): Ditto.
-        (JSC::SmallStrings::singleCharacterString): Ditto.
+        The next step will be to beat back FunctionBodyNode in the same fashion.
+        Then remove the usage via CodeBlock, then only construct these nodes only on
+        demand during bytecode generation.
 
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse):
+        (JSC::Parser::parseFunctionFromGlobalCode):
+        (JSC::::parse):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/Error.h:
+        * runtime/Executable.h: Added.
+        (JSC::TemplateExecutable::TemplateExecutable):
+        (JSC::TemplateExecutable::markAggregate):
+        (JSC::TemplateExecutable::sourceURL):
+        (JSC::TemplateExecutable::lineNo):
+        (JSC::TemplateExecutable::bytecode):
+        (JSC::TemplateExecutable::jitCode):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::codeBlocks):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
 
-        Reviewed by Geoff Garen.
+2009-08-14  Darin Adler  <darin@apple.com>
 
-        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
-        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+        Reviewed by Sam Weinig.
 
-        Add a workaround for a bug in GCC, which affects GCC 4.0, GCC 4.2, and
-        llvm-gcc 4.2. I put it in an #ifdef because it was a slight regression
-        on SunSpider in 32-bit, although that might be entirely random.
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray): Removed unneeded isObject call
+        and updated remaining isObject call to new name, inherits.
+
+        * runtime/JSCell.h: Renamed isObject(<class>) to inherits(<class>)
+        but more importantly, made it non-virtual (it was already inline)
+        so it is now as fast as JSObject::inherits was.
+
+        * runtime/JSObject.h: Removed inherits function since the one
+        in the base class is fine as-is. Also made various JSCell functions
+        that should not be called on JSObject uncallable by making them
+        both private and not implemented.
+        (JSC::JSCell::inherits): Updated name.
+        (JSC::JSValue::inherits): Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncConcat):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSValue.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        Updated to new name, inherits, from old name, isObject.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
+2009-07-31  Harald Fernengel  <harald.fernengel@nokia.com>
 
-2008-10-03  Darin Adler  <darin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Rubber stamped by Alexey Proskuryakov.
+        Adding QNX as a platform. Currently only tested with Qt.
 
-        * kjs/Shell.cpp: (main): Don't delete JSGlobalData. Later, we need to change
-        this tool to use public JavaScriptCore API instead.
+        https://bugs.webkit.org/show_bug.cgi?id=27885
 
-2008-10-03  Darin Adler  <darin@apple.com>
+        * JavaScriptCore/runtime/Collector.cpp: Added retrieving of stack base
+          since QNX doesn't have the pthread _nt functions
+        * JavaScriptCore/wtf/Platform.h: Added WTF_PLATFORM_QNX and corresponding
+          defines
+        * WebCore/bridge/npapi.h: Build fix for missing typedefs on QNX
 
-        Suggested by Alexey Proskuryakov.
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::~JSGlobalData): Remove call to heap.destroy() because
-        it's too late to ref the JSGlobalData object once it's already being
-        destroyed. In practice this is not a problem because WebCore's JSGlobalData
-        is never destroyed and JSGlobalContextRelease takes care of calling
-        heap.destroy() in advance.
+        Reviewed by Simon Hausmann.
 
-2008-10-02  Oliver Hunt  <oliver@apple.com>
+        Currently generic ARM and ARMv7 platforms work only with JSVALUE32
+        https://bugs.webkit.org/show_bug.cgi?id=28300
 
-        Reviewed by Maciej Stachowiak.
+        * wtf/Platform.h:
 
-        Replace SSE3 check with an SSE2 check, and implement SSE2 check on windows.
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        5.6% win on SunSpider on windows.
+        Reviewed by Simon Hausmann.
 
-        * VM/CTI.cpp:
-        (JSC::isSSE2Present):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
+        Enable JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
 
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+        * wtf/Platform.h:
 
-        Rubber stamped by Cameron Zwarich.
-        
-        - fix mistaken change of | to || which caused a big perf regression on EarleyBoyer
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        * kjs/grammar.y:
+        Reviewed by Simon Hausmann.
 
-2008-10-02  Darin Adler  <darin@apple.com>
+        Enable YARR_JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
 
-        Reviewed by Geoff Garen.
+        * wtf/Platform.h:
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21321
-          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
+2009-08-14  Oliver Hunt  <oliver@apple.com>
 
-        1.019x as fast on SunSpider.
+        Reviewed by Gavin Barraclough.
 
-        * API/JSBase.cpp:
-        (JSEvaluateScript): Use heap. instead of heap-> to work with the heap.
-        (JSCheckScriptSyntax): Ditto.
-        (JSGarbageCollect): Ditto.
-        (JSReportExtraMemoryCost): Ditto.
-        * API/JSContextRef.cpp:
-        (JSGlobalContextRetain): Ditto.
-        (JSGlobalContextRelease): Destroy the heap with the destroy function instead
-        of the delete operator.
-        (JSContextGetGlobalObject): Use heap. instead of heap-> to work with the heap.
-        * API/JSObjectRef.cpp:
-        (JSObjectMake): Use heap. instead of heap-> to work with the heap.
-        (JSObjectMakeFunctionWithCallback): Ditto.
-        (JSObjectMakeConstructor): Ditto.
-        (JSObjectMakeFunction): Ditto.
-        (JSObjectMakeArray): Ditto.
-        (JSObjectMakeDate): Ditto.
-        (JSObjectMakeError): Ditto.
-        (JSObjectMakeRegExp): Ditto.
-        (JSObjectHasProperty): Ditto.
-        (JSObjectGetProperty): Ditto.
-        (JSObjectSetProperty): Ditto.
-        (JSObjectGetPropertyAtIndex): Ditto.
-        (JSObjectSetPropertyAtIndex): Ditto.
-        (JSObjectDeleteProperty): Ditto.
-        (JSObjectCallAsFunction): Ditto.
-        (JSObjectCallAsConstructor): Ditto.
-        (JSObjectCopyPropertyNames): Ditto.
-        (JSPropertyNameAccumulatorAddName): Ditto.
-        * API/JSValueRef.cpp:
-        (JSValueIsEqual): Ditto.
-        (JSValueIsInstanceOfConstructor): Ditto.
-        (JSValueMakeNumber): Ditto.
-        (JSValueMakeString): Ditto.
-        (JSValueToNumber): Ditto.
-        (JSValueToStringCopy): Ditto.
-        (JSValueToObject): Ditto.
-        (JSValueProtect): Ditto.
-        (JSValueUnprotect): Ditto.
-
-        * kjs/ExecState.h:
-        (JSC::ExecState::heap): Update to use the & operator.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Update to initialize a heap member
-        instead of calling new to make a heap.
-        (JSC::JSGlobalData::~JSGlobalData): Destroy the heap with the destroy
-        function instead of the delete operator.
-        * kjs/JSGlobalData.h: Change from Heap* to a Heap.
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::mark): Use the & operator here.
-        (JSC::JSGlobalObject::operator new): Use heap. instead of heap-> to work
-        with the heap.
-
-2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+        [ES5] Arguments object should inherit from Array
+        https://bugs.webkit.org/show_bug.cgi?id=28298
 
-        Reviewed by Geoff Garen.
+        Make the Arguments object conform to the behaviour specified in ES5.
+        The simple portion of this is to make Arguments use Array.prototype
+        as its prototype rather than Object.prototype.
 
-        Bug 21317: Replace RegisterFile size and capacity information with Register pointers
-        <https://bugs.webkit.org/show_bug.cgi?id=21317>
+        The spec then requires us to set instance.constructor to the pristine
+        Object constructor, and instance.toString and instance.toLocaleString
+        to the pristine versions from Object.prototype.  To do this we now 
+        make the ObjectPrototype constructor return its toString and
+        toLocaleString functions (similar to the call and apply functions
+        from FunctionPrototype).
 
-        This is a 2.3% speedup on the V8 DeltaBlue benchmark, a 3.3% speedup on
-        the V8 Raytrace benchmark, and a 1.0% speedup on SunSpider.
+        Oddly enough this reports itself as a slight win, but given the code
+        isn't hit in the tests that claim to have improved I put this down to
+        code motion.
 
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall):
-        (JSC::Machine::callEval):
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/RegisterFile.cpp:
-        (JSC::RegisterFile::~RegisterFile):
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::start):
-        (JSC::RegisterFile::end):
-        (JSC::RegisterFile::size):
-        (JSC::RegisterFile::shrink):
-        (JSC::RegisterFile::grow):
-        (JSC::RegisterFile::lastGlobal):
-        (JSC::RegisterFile::markGlobals):
-        (JSC::RegisterFile::markCallFrames):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::copyGlobalsTo):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::initializeStandardProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::objectToStringFunction):
+        (JSC::JSGlobalObject::objectToLocaleStringFunction):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+          Update test to new es5 behaviour
 
-2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+2009-08-14  Oliver Hunt  <oliver@apple.com>
 
-        Rubber-stamped by Darin Adler.
+        Remove MarkStack::drain from the JSC exports file
 
-        Change bitwise operations introduced in r37166 to boolean operations. We
-        only use bitwise operations over boolean operations for increasing
-        performance in extremely hot code, but that does not apply to anything
-        in the parser.
+        MarkStack::drain is now marked inline, the including it in the exports file
+        produces an ld warning
 
-        * kjs/grammar.y:
+        * JavaScriptCore.exp:
 
-2008-10-02  Gavin Barraclough  <barraclough@apple.com>
+2009-08-13  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Oliver Hunt.
 
-        Fix for bug #21232 - should reset m_isPendingDash on flush,
-        and should allow '\-' as beginning or end of a range (though
-        not to specifiy a range itself).
-
-        * ChangeLog:
-        * wrec/CharacterClassConstructor.cpp:
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        * wrec/CharacterClassConstructor.h:
-        (JSC::CharacterClassConstructor::flushBeforeEscapedHyphen):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateDisjunction):
-        (JSC::WRECParser::parseCharacterClass):
-        (JSC::WRECParser::parseDisjunction):
-        * wrec/WREC.h:
+        Remove accidentally left in debugging statement.
 
-2008-10-02  Darin Adler  <darin@apple.com>
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
 
-        Reviewed by Sam Weinig.
+2009-08-13  Oliver Hunt  <oliver@apple.com>
 
-        - remove the "static" from declarations in a header file, since we
-          don't want them to have internal linkage
+        Reviewed by Maciej Stachowiak.
 
-        * VM/Machine.h: Remove the static keyword from the constant and the
-        three inline functions that Geoff just moved here.
+        [ES5] Implement Array.isArray
+        https://bugs.webkit.org/show_bug.cgi?id=28296
 
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+        Add support for Array.isArray to the Array constructor
 
-        Reviewed by Sam Weinig.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21283.
-        Profiler Crashes When Started
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayConstructor.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
 
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        (JSC::makeHostCallFramePointer):
-        (JSC::isHostCallFrame):
-        (JSC::stripHostCallFrameBit): Moved some things to the header so
-        JSGlobalObject could use them.
+2009-08-13  Oliver Hunt  <oliver@apple.com>
 
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Call the
-        new makeHostCallFramePointer API, since 0 no longer indicates a host
-        call frame.
+        Reviewed by NOBODY (Buildfix).
 
-2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
+        Attempt to fix windows build
 
-        Reviewed by Darin Adler.
+        * runtime/Collector.cpp:
 
-        https://bugs.webkit.org/show_bug.cgi?id=21304
-        Stop using a static wrapper map for WebCore JS bindings
+2009-08-13  Oliver Hunt  <oliver@apple.com>
 
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        (JSC::JSGlobalData::ClientData::~ClientData):
-        * kjs/JSGlobalData.h:
-        Added a client data member to JSGlobalData. WebCore will use it to store bindings-related
-        global data.
+        Reviewed by Maciej Stachowiak.
 
-        * JavaScriptCore.exp: Export virtual ClientData destructor.
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
 
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+        Add a bit to TypeInfo to indicate that an object uses the standard
+        JSObject::markChildren method.  This allows us to devirtualise marking
+        of most objects (though a branch is still needed).  We also add a branch
+        to identify arrays thus devirtualising marking in that case as well.
 
-        Not reviewed.
-        
-        Try to fix Qt build.
+        In order to make the best use of this devirtualisation I've also reworked
+        the MarkStack::drain() logic to make the iteration more efficient.
 
-        * kjs/Error.h:
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * JavaScriptCore.exp:
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::markChildrenDirect):
+        (JSC::MarkStack::drain):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        (JSC::JSObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::MarkStackArray::last):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::hasDefaultMark):
+
+2009-08-13  Darin Adler  <darin@apple.com>
 
-2008-10-01  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Mark Rowe.
 
-        Reviewed by Darin Adler and Cameron Zwarich.
+        Some small bits of housekeeping.
 
-        Preliminary step toward dynamic recompilation: Standardized and
-        simplified the parsing interface.
-        
-        The main goal in this patch is to make it easy to ask for a duplicate
-        compilation, and get back a duplicate result -- same source URL, same
-        debugger / profiler ID, same toString behavior, etc.
-        
-        The basic unit of compilation and evaluation is now SourceCode, which
-        encompasses a SourceProvider, a range in that provider, and a starting
-        line number.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make Parser.h
+        project instead of private. Remove JSONObject.lut.h.
 
-        A SourceProvider now encompasses a source URL, and *is* a source ID,
-        since a pointer is a unique identifier.
+        * assembler/ARMAssembler.h: Remove unneeded WTF prefix.
+        * assembler/AssemblerBufferWithConstantPool.h: Ditto.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
 
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-        
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-        (JSC::CodeBlock::CodeBlock): ASSERT something that used to be ASSERTed
-        by our caller -- this is a better bottleneck.
+        * wtf/SegmentedVector.h: Add a "using" statement as we do
+        with the other WTF headers.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator): Updated for the fact that
-        FunctionBodyNode's parameters are no longer a WTF::Vector.
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): ditto
+        Fix Tiger build.
 
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Provide a SourceCode to the Parser,
-        since other APIs are no longer supported.
+        * parser/Grammar.y: Use a template function so we can compile
+        setStatementLocation even if it comes before YYLTYPE is defined.
 
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction): Provide a SourceCode to the Parser, since
-        other APIs are no longer supported. Adopt FunctionBodyNode's new
-        "finishParsing" API.
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::lengthGetter):
-        (JSC::JSFunction::getParameterName): Updated for the fact that
-        FunctionBodyNode's parameters are no longer a wtf::Vector.
+        Reviewed by George Staikos.
 
-        * kjs/JSFunction.h: Nixed some cruft.
+        Too much use of void* in Grammar.y
+        https://bugs.webkit.org/show_bug.cgi?id=28287
 
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval): Provide a SourceCode to the Parser, since
-        other APIs are no longer supported. 
+        * parser/Grammar.y: Changed all the helper functions to
+        take a JSGlobalData* instead of a void*. A couple formatting
+        tweaks that I missed when breaking this into pieces.
 
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse): Require a SourceCode argument, instead of a bunch
-        of broken out parameters. Stop tracking sourceId as an integer, since we
-        use the SourceProvider pointer for this now. Don't clamp the
-        startingLineNumber, since SourceCode does that now.
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        * kjs/Parser.h:
-        (JSC::Parser::parse): Standardized the parsing interface to require a
-        SourceCode.
+        Reviewed by George Staikos.
 
-        * kjs/Shell.cpp:
-        (functionRun):
-        (functionLoad):
-        (prettyPrintScript):
-        (runWithScripts):
-        (runInteractive): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-
-        * kjs/SourceProvider.h:
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::SourceProvider::url):
-        (JSC::SourceProvider::asId):
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::UStringSourceProvider): Added new
-        responsibilities described above.
-
-        * kjs/SourceRange.h:
-        (JSC::SourceCode::SourceCode):
-        (JSC::SourceCode::toString):
-        (JSC::SourceCode::provider):
-        (JSC::SourceCode::firstLine):
-        (JSC::SourceCode::data):
-        (JSC::SourceCode::length): Added new responsibilities described above.
-        Renamed SourceRange to SourceCode, based on review feedback. Added
-        a makeSource function for convenience.
-
-        * kjs/debugger.h: Provide a SourceCode to the client, since other APIs
-        are no longer supported.
-
-        * kjs/grammar.y: Provide startingLineNumber when creating a SourceCode.
-
-        * kjs/debugger.h: Treat sourceId as intptr_t to avoid loss of precision
-        on 64bit platforms.
-
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/interpreter.h: Require a SourceCode instead of broken out arguments.
-
-        * kjs/lexer.cpp:
-        (JSC::Lexer::setCode):
-        * kjs/lexer.h:
-        (JSC::Lexer::sourceRange): Fold together the SourceProvider and line number
-        into a SourceCode. Fixed a bug where the Lexer would accidentally keep
-        alive the last SourceProvider forever.
-
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::generateCode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::finishParsing):
-        (JSC::FunctionBodyNode::create):
-        (JSC::FunctionBodyNode::generateCode):
-        (JSC::ProgramNode::generateCode):
-        (JSC::FunctionBodyNode::paramString):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::):
-        (JSC::ScopeNode::sourceId):
-        (JSC::FunctionBodyNode::):
-        (JSC::FunctionBodyNode::parameterCount):
-        (JSC::FuncExprNode::):
-        (JSC::FuncDeclNode::): Store a SourceCode in all ScopeNodes, since
-        SourceCode is now responsible for tracking URL, ID, etc. Streamlined
-        some ad hoc FunctionBodyNode fixups into a "finishParsing" function, to
-        help make clear what you need to do in order to finish parsing a
-        FunctionBodyNode.
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
 
-        * wtf/Vector.h:
-        (WTF::::releaseBuffer): Don't ASSERT that releaseBuffer() is only called
-        when buffer is not 0, since FunctionBodyNode is more than happy
-        to get back a 0 buffer, and other functions like RefPtr::release() allow
-        for 0, too.
+        * parser/Grammar.y: Reduced and sorted includes. Tweaked comment
+        format. Marked a few more functions inline.
 
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by George Staikos.
 
-        Bug 21289: REGRESSION (r37160): Inspector crashes on load
-        <https://bugs.webkit.org/show_bug.cgi?id=21289>
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
 
-        The code in Arguments::mark() in r37160 was wrong. It marks indices in
-        d->registers, but that makes no sense (they are local variables, not
-        arguments). It should mark those indices in d->registerArray instead.
+        * parser/Grammar.y: Pass the number to the PropertyNode instead of
+        first turning it into an Identifier.
 
-        This patch also changes Arguments::copyRegisters() to use d->numParameters
-        instead of recomputing it.
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode): Add an overload that takes a double
+        so the code to convert to a string can be here instead of Grammar.y.
+        * parser/Nodes.h: Ditto.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::copyRegisters):
+2009-08-13  Darin Adler  <darin@apple.com>
 
-2008-09-30  Darin Adler  <darin@apple.com>
+        Reviewed by George Staikos.
 
-        Reviewed by Eric Seidel.
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
+        * parser/Grammar.y: Eliminate the DBG macro.
 
-        Eliminate some unneeded uses of dynamicGlobalObject.
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::contextData): Changed to use a map in the global data instead
-        of on the global object. Also fixed to use only a single hash table lookup.
+        Reviewed by George Staikos.
 
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor): Use lexicalGlobalObject rather than dynamicGlobalObject
-        to get the object prototype.
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
 
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString): Use arrayVisitedElements set in global data rather
-        than in the global object.
-        (JSC::arrayProtoFuncToLocaleString): Ditto.
-        (JSC::arrayProtoFuncJoin): Ditto.
+        * parser/Grammar.y: Eliminate the SET_EXCEPTION_LOCATION macro.
 
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Don't initialize opaqueJSClassData, since
-        it's no longer a pointer.
-        (JSC::JSGlobalData::~JSGlobalData): We still need to delete all the values, but
-        we don't need to delete the map since it's no longer a pointer.
+2009-08-13  Darin Adler  <darin@apple.com>
 
-        * kjs/JSGlobalData.h: Made opaqueJSClassData a map instead of a pointer to a map.
-        Also added arrayVisitedElements.
+        Reviewed by George Staikos.
 
-        * kjs/JSGlobalObject.h: Removed arrayVisitedElements.
+        George asked me to break the patch from
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+        into smaller pieces and land it in stages.
 
-        * kjs/Shell.cpp:
-        (functionRun): Use lexicalGlobalObject instead of dynamicGlobalObject.
-        (functionLoad): Ditto.
+        * parser/Grammar.y: Eliminate the LEXER macro.
 
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+2009-08-13  Mark Rowe  <mrowe@apple.com>
 
-        Not reviewed.
+        Try some more to fix the Windows build.
 
-        Speculative Windows build fix.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
 
-        * kjs/grammar.y:
+2009-08-13  Mark Rowe  <mrowe@apple.com>
 
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+        Try and fix the Windows build.
 
-        Reviewed by Darin Adler.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
 
-        Bug 21123: using "arguments" in a function should not force creation of an activation object
-        <https://bugs.webkit.org/show_bug.cgi?id=21123>
-
-        Make the 'arguments' object not require a JSActivation. We store the
-        'arguments' object in the OptionalCalleeArguments call frame slot. We
-        need to be able to get the original 'arguments' object to tear it off
-        when returning from a function, but 'arguments' may be assigned to in a
-        number of ways.
-
-        Therefore, we use the OptionalCalleeArguments slot when we want to get
-        the original activation or we know that 'arguments' was not assigned a
-        different value. When 'arguments' may have been assigned a new value,
-        we use a new local variable that is initialized with 'arguments'. Since
-        a function parameter named 'arguments' may overwrite the value of
-        'arguments', we also need to be careful to look up 'arguments' in the
-        symbol table, so we get the parameter named 'arguments' instead of the
-        local variable that we have added for holding the 'arguments' object.
-
-        This is a 19.1% win on the V8 Raytrace benchmark using the SunSpider
-        harness, and a 20.7% win using the V8 harness. This amounts to a 6.5%
-        total speedup on the V8 benchmark suite using the V8 harness.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_init_arguments):
-        (JSC::Machine::cti_op_ret_activation_arguments):
-        * VM/Machine.h:
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        (JSC::Arguments::fillArgList):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        * kjs/Arguments.h:
-        (JSC::Arguments::setRegisters):
-        (JSC::Arguments::init):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::copyRegisters):
-        (JSC::JSActivation::copyRegisters):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
-        * kjs/grammar.y:
-        * kjs/nodes.h:
-        (JSC::ScopeNode::setUsesArguments):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::orl_mr):
+2009-08-13  Darin Adler  <darin@apple.com>
 
-2008-10-01  Kevin McCullough  <kmccullough@apple.com>
+        Reviewed by David Levin.
 
-        Rubberstamped by Geoff Garen.
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
 
-        Remove BreakpointCheckStatement because it's not used anymore.
-        No effect on sunspider or the jsc tests.
+        Eliminate dependencies on Nodes.h outside JavaScriptCore,
+        and cut down on them inside JavaScriptCore.
 
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
+        Change regular expression parsing to use identifiers as
+        with other strings we parse.
 
-2008-09-30  Oliver Hunt  <oliver@apple.com>
+        Fix a couple things that are needed to use const Identifier
+        more, which will be part of the parser arena work.
 
-        Reviewed by Geoff Garen.
+        * JavaScriptCore.exp: Resorted and updated.
 
-        Improve performance of CTI on windows.
-
-        Currently on platforms where the compiler doesn't allow us to safely
-        index relative to the address of a parameter we need to actually
-        provide a pointer to CTI runtime call arguments.  This patch improves
-        performance in this case by making the CTI logic for restoring this
-        parameter much less conservative by only resetting it before we actually
-        make a call, rather than between each and every SF bytecode we generate
-        code for.
-
-        This results in a 3.6% progression on the v8 benchmark when compiled with MSVC.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        * wtf/Platform.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed
+        CollectorHeapIterator.h to be project-internal.
 
-2008-09-30  Maciej Stachowiak  <mjs@apple.com>
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope): Added const.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
 
-        Reviewed by Oliver Hunt.
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function
+        here from WebCore. Here is better since it uses so many internals.
+        Removed unimportant optimization for the no listener case.
+        * debugger/Debugger.h: Ditto. Also removed unneeded include
+        and tweaked formatting and comments.
 
-        - track uses of "this", "with" and "catch" in the parser
-        
-        Knowing this up front will be useful for future optimizations.
-        
-        Perf and correctness remain the same.
-        
-        * kjs/NodeInfo.h:
-        * kjs/grammar.y:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Call asFunction instead
+        of doing the unchecked static_cast.
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Ditto.
 
-2008-09-30  Sam Weinig  <sam@webkit.org>
+        * jit/JITStubs.cpp:
+        (JSC::op_call_JSFunction): Call isHostFunction on the body rather
+        than on the JSFunction.
+        (JSC::vm_lazyLinkCall): Ditto.
+        (JSC::op_construct_JSConstruct): Ditto.
 
-        Reviewed by Mark Rowe.
+        * parser/Grammar.y: Changed callers to use new scanRegExp with
+        out arguments instead of relying on state in the Lexer. And
+        callers that just want to skip a regular expression to use
+        skipRegExp.
 
-        Add WebKitAvailability macros for JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError,
-        and JSObjectMakeRegExp
+        * parser/Lexer.cpp:
+        (JSC::Lexer::scanRegExp): Changed to use out arguments, and to
+        add a prefix argument so we can add in the "=" character as needed.
+        Also rewrote to streamline the logic a bit inspired by suggestions
+        by David Levin.
+        (JSC::Lexer::skipRegExp): Added. Version of the function above that
+        does not actually put the regular expression into a string.
+        (JSC::Lexer::clear): Removed code to clear m_pattern and m_flags.
+        * parser/Lexer.h: Changed scanRegExp to have out arguments. Added
+        skipRegExp. Eliminated pattern, flags, m_pattern, and m_flags.
 
-        * API/JSObjectRef.h:
+        * parser/NodeConstructors.h:
+        (JSC::RegExpNode::RegExpNode): Changed to take const Identifier&.
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode): Changed since m_pattern and
+        m_flags are now Identifier instead of UString.
+        (JSC::FunctionBodyNode::make): Moved this function here instead
+        of putting it in the JSFunction.h header.
+        * parser/Nodes.h: Changed RegExpNode to use Identifier.
 
-2008-09-30  Darin Adler  <darin@apple.com>
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Changed to use isHostFunction
+        on the body instead of on the JSFunction object.
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Ditto.
 
-        Reviewed by Geoff Garen.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction): Moved here from header.
+        (JSC::JSFunction::isHostFunctionNonInline): Added.
+        (JSC::JSFunction::JSFunction): Removed unneeded initialization of
+        m_body to 0.
+        (JSC::JSFunction::setBody): Moved here from header.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
-
-        Replaced the m_prev field of ExecState with a bit in the
-        call frame pointer to indicate "host" call frames.
-
-        * VM/Machine.cpp:
-        (JSC::makeHostCallFramePointer): Added. Sets low bit.
-        (JSC::isHostCallFrame): Added. Checks low bit.
-        (JSC::stripHostCallFrameBit): Added. Clears low bit.
-        (JSC::Machine::unwindCallFrame): Replaced null check that was
-        formerly used to detect host call frames with an isHostCallFrame check.
-        (JSC::Machine::execute): Pass in a host call frame pointer rather than
-        always passing 0 when starting execution from the host. This allows us
-        to follow the entire call frame pointer chain when desired, or to stop
-        at the host calls when that's desired.
-        (JSC::Machine::privateExecute): Replaced null check that was
-        formerly used to detect host call frames with an isHostCallFrame check.
-        (JSC::Machine::retrieveCaller): Ditto.
-        (JSC::Machine::retrieveLastCaller): Ditto.
-        (JSC::Machine::callFrame): Removed the code to walk up m_prev pointers
-        and replaced it with code that uses the caller pointer and uses the
-        stripHostCallFrameBit function.
-
-        * kjs/ExecState.cpp: Removed m_prev.
-        * kjs/ExecState.h: Ditto.
-
-2008-09-30  Cameron Zwarich  <zwarich@apple.com>
+        * runtime/JSFunction.h: Removed unneeded includes. Moved private
+        constructor down to the private section. Made virtual functions
+        private. Removed unneeded overload of setBody and moved the body
+        of the function into the .cpp file. Changed assertions to use
+        the non-inline version of isHostFunction.
 
-        Reviewed by Geoff Garen.
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter): Use asFunction instead
+        of doing the unchecked static_cast.
 
-        Move all detection of 'arguments' in a lexical scope to the parser, in
-        preparation for fixing
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVector::isEmpty): Added.
 
-        Bug 21123: using "arguments" in a function should not force creation of an activation object
-        <https://bugs.webkit.org/show_bug.cgi?id=21123>
+2009-08-13  Mark Rowe  <mrowe@apple.com>
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * kjs/NodeInfo.h:
-        * kjs/grammar.y:
+        Rubber-stamped by Darin Adler.
 
-2008-09-30  Geoffrey Garen  <ggaren@apple.com>
+        Use the version of operator new that takes a JSGlobalData when allocating FuncDeclNode and FuncExprNode
+        from within the grammar to prevent these nodes from being leaked.
 
-        Not reviewed.
+        * parser/Grammar.y:
 
-        * kjs/Shell.cpp:
-        (runWithScripts): Fixed indentation.
+2009-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
 
-2008-09-30  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Ariya Hidayat.
 
-        Rubber-stamped by Sam Weinig.
+        Remove the special-case for Qt wrt JSVALUE_32 introduced in
+        r46709. It must've been a dependency issue on the bot, as
+        after a manual build all the tests pass on amd64 and ia32.
 
-        Build fix.  Move InternalFunction::classInfo implementation into the .cpp
-        file to prevent the vtable for InternalFunction being generated as a weak symbol.
-        Has no effect on SunSpider.
+        * wtf/Platform.h:
 
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::classInfo):
-        * kjs/InternalFunction.h:
+2009-08-12  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimize call and property access support for ARM JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        For tightly coupled sequences the BEGIN_UNINTERRUPTED_SEQUENCE and
+        END_UNINTERRUPTED_SEQUENCE macros have been introduced which ensure
+        space for instructions and constants of the named sequence. This
+        method is vital for those architecture which are using constant pool.
+
+        The 'latePatch' method - which was linked to JmpSrc - is replaced with
+        a port specific solution (each calls are marked to place their address
+        on the constant pool).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::executableCopy): Add extra align for constant pool.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::sizeOfConstantPool):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::linkCall):
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushIfNoSpaceFor): Fix the
+        computation of the remaining space.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::ensureSpace):
+        (JSC::MacroAssemblerARM::sizeOfConstantPool):
+        (JSC::MacroAssemblerARM::prepareCall):
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Dave Kilzer.
+
+        Disable WTF_USE_JSVALUE32_64 on iPhone for now (support not yet added for ARMv7).
 
-2008-09-29  Maciej Stachowiak  <mjs@apple.com>
+        * wtf/Platform.h:
 
-        Reviewed by Darin Adler.
-        
-        - optimize appending a number to a string
-        https://bugs.webkit.org/show_bug.cgi?id=21203
-        
-        It's pretty common in real-world code (and on some of the v8
-        benchmarks) to append a number to a string, so I made this one of
-        the fast cases, and also added support to UString to do it
-        directly without allocating a temporary UString.
-        
-        ~1% speedup on v8 benchmark.
-
-        * VM/Machine.cpp:
-        (JSC::jsAddSlowCase): Make this NEVER_INLINE because somehow otherwise
-        the change is a regression.
-        (JSC::jsAdd): Handle number + string special case.
-        (JSC::Machine::cti_op_add): Integrate much of the logic of jsAdd to
-        avoid exception check in the str + str, num + num and str + num cases.
-        * kjs/ustring.cpp:
-        (JSC::expandedSize): Make this a non-member function, since it needs to be 
-        called in non-member functions but not outside this file.
-        (JSC::expandCapacity): Ditto.
-        (JSC::UString::expandCapacity): Call the non-member version. 
-        (JSC::createRep): Helper to make a rep from a char*.
-        (JSC::UString::UString): Use above helper.
-        (JSC::concatenate): Guts of concatenating constructor for cases where first
-        item is a UString::Rep, and second is a UChar* and length, or a char*.
-        (JSC::UString::append): Implement for cases where first item is a UString::Rep,
-        and second is an int or double. Sadly duplicates logic of UString::from(int)
-        and UString::from(double).
-        * kjs/ustring.h:
-
-2008-09-29  Darin Adler  <darin@apple.com>
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Maciej Stachoviak.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
+        Ooops - moved code that had been accidentally added to op_new_func instead of
+        op_new_func_exp, to where it shoulds be.
 
-        * JavaScriptCore.exp: Updated since JSGlobalObject::init
-        no longer takes a parameter.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * wtf/Platform.h:
 
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Removed m_registerFile argument
-        for ExecState constructors.
+2009-08-12  Ada Chan  <adachan@apple.com>
 
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Removed globalThisValue
-        argument for ExecState constructor.
+        Added workaround for the limitation that VirtualFree with MEM_RELEASE
+        can only accept the base address returned by VirtualAlloc when the region
+        was reserved and it can only free the entire region, and not a part of it.
 
-        * kjs/ExecState.cpp:
-        (JSC::ExecState::ExecState): Removed globalThisValue and
-        registerFile arguments to constructors.
+        Reviewed by Oliver Hunt.
 
-        * kjs/ExecState.h: Removed m_globalThisValue and
-        m_registerFile data members.
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::releaseStack):
 
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Removed globalThisValue
-        argument for ExecState constructor.
+2009-08-12  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
 
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject): Got rid of parameter
-        for the init function.
+        Reviewed by Ariya Hidayat.
 
-2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+        Build fix: use std::numeric_limits<long long>::min() instead of LLONG_MIN
+        since LLONG_MIN is not defined in standard c++.
 
-        Rubber-stamped by Cameron Zwarich.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21225
-        Machine::retrieveLastCaller should check for a NULL codeBlock
-        
-        In order to crash, you would need to call retrieveCaller in a situation
-        where you had two host call frames in a row in the register file. I
-        don't know how to make that happen, or if it's even possible, so I don't
-        have a test case -- but better safe than sorry!
+        * runtime/UString.cpp:
+        (JSC::UString::from):
 
-        * VM/Machine.cpp:
-        (JSC::Machine::retrieveLastCaller):
+2009-08-12  Benjamin Otte  <otte@gnome.org>
 
-2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Jan Alonzo.
 
-        Reviewed by Cameron Zwarich.
-        
-        Store the callee ScopeChain, not the caller ScopeChain, in the call frame
-        header. Nix the "scopeChain" local variable and ExecState::m_scopeChain, and
-        access the callee ScopeChain through the call frame header instead.
+        Buildfix for Gtk platforms debug builds.
 
-        Profit: call + return are simpler, because they don't have to update the
-        "scopeChain" local variable, or ExecState::m_scopeChain.
-        
-        Because CTI keeps "r" in a register, reading the callee ScopeChain relative
-        to "r" can be very fast, in any cases we care to optimize.
+        * GNUmakefile.am: Choose MarkStackPosix.cpp or MarkStackWin.cpp
+        depending on platform.
 
-        0% speedup on empty function call benchmark. (5.5% speedup in bytecode.)
-        0% speedup on SunSpider. (7.5% speedup on controlflow-recursive.)
-        2% speedup on SunSpider --v8.
-        2% speedup on v8 benchmark.
+2009-08-12  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        * VM/CTI.cpp: Changed scope chain access to read the scope chain from
-        the call frame header. Sped up op_ret by changing it not to fuss with
-        the "scopeChain" local variable or ExecState::m_scopeChain.
+        Prospective build fix for Mac and 32-bit Windows.
 
-        * VM/CTI.h: Updated CTI trampolines not to take a ScopeChainNode*
-        argument, since that's stored in the call frame header now.
+        * runtime/UString.cpp: Include wtf/StringExtras.h for snprintf.
+        (JSC::UString::from): Use %lld instead of %I64d for snprintf
+        on non-windows platforms.
 
-        * VM/Machine.cpp: Access "scopeChain" and "codeBlock" through new helper
-        functions that read from the call frame header. Updated functions operating
-        on ExecState::m_callFrame to account for / take advantage of the fact that
-        Exec:m_callFrame is now never NULL.
-        
-        Fixed a bug in op_construct, where it would use the caller's default
-        object prototype, rather than the callee's, when constructing a new object.
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
 
-        * VM/Machine.h: Made some helper functions available. Removed
-        ScopeChainNode* arguments to a lot of functions, since the ScopeChainNode*
-        is now stored in the call frame header.
+        Reviewed by Simon Hausmann.
 
-        * VM/RegisterFile.h: Renamed "CallerScopeChain" to "ScopeChain", since
-        that's what it is now.
+        Fix compile error on 64Bit Windows, when UString::from
+        is called with an intptr_t.
 
-        * kjs/DebuggerCallFrame.cpp: Updated for change to ExecState signature.
+        Added new UString::From overload with long long parameter.
 
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h: Nixed ExecState::m_callFrame, along with the unused
-        isGlobalObject function.
+        Thanks to Holger for the long long idea.
 
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h: Gave the global object a fake call frame in
-        which to store the global scope chain, since our code now assumes that
-        it can always read the scope chain out of the ExecState's call frame.
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * runtime/UString.h:
 
-2008-09-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-08-11  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Mark Rowe.
 
-        Remove the isActivationObject() virtual method on JSObject and use
-        StructureID information instead. This should be slightly faster, but
-        isActivationObject() is only used in assertions and unwinding the stack
-        for exceptions.
+        Minor style fixes.
 
-        * VM/Machine.cpp:
-        (JSC::depth):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_ret_activation):
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSObject.h:
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::getValue):
 
-2008-09-29  Peter Gal  <galpeter@inf.u-szeged.hu>
+2009-08-11  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed and tweaked by Darin Adler.
+        Reviewed by Gavin Barraclough.
 
-        Fix build for non-all-in-one platforms.
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
 
-        * kjs/StringPrototype.cpp: Added missing ASCIICType.h include.
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
 
-2008-09-29  Bradley T. Hughes  <bradley.hughes@nokia.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator PossiblyNull<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Added.
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::::getValue):
 
-        Reviewed by Simon Hausmann.
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Fix compilation with icpc
+        Reviewed by NOBODY (build fix part deux).
 
-        * wtf/HashSet.h:
-        (WTF::::find):
-        (WTF::::contains):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Simon Hausmann.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Changed copyright from Trolltech ASA to Nokia.
-        
-        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
-        
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
 
-        * wtf/qt/MainThreadQt.cpp:
+        Reviewed by Oliver Hunt.
 
-2008-09-29  Simon Hausmann  <hausmann@webkit.org>
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
 
-        Reviewed by Lars Knoll.
+        These objects were also being referenced from the CodeBlock.  By changing this
+        to just retain pointers to FunctionBodyNodes these classes can be restricted to
+        use during parsing.
 
-        Don't accidentially install libJavaScriptCore.a for the build inside
-        Qt.
+        No performance impact (or sub-percent progression).
 
-        * JavaScriptCore.pro:
+        * JavaScriptCore.exp:
+            Update symbols.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+            Unify m_functions & m_functionExpressions into a single Vector<RefPtr<FuncExprNode> >.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+            Update to reflect chnages in CodeBlock.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+            Update to reflect chnages in CodeBlock.
 
-2008-09-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * parser/Grammar.y:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
 
-        Reviewed by Maciej Stachowiak.
+        * parser/NodeConstructors.h:
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::ident):
+            Move m_ident & make methods from FuncDeclNode & FuncExprNode to FunctionBodyNode.
 
-        Bug 21200: Allow direct access to 'arguments' without using op_resolve
-        <https://bugs.webkit.org/show_bug.cgi?id=21200>
+        * runtime/JSFunction.h:
+        (JSC::FunctionBodyNode::make):
+            Make this method inline (was FuncDeclNode::makeFunction).
 
-        Allow fast access to the 'arguments' object by adding an extra slot to
-        the callframe to store it.
+2009-08-11  Oliver Hunt  <oliver@apple.com>
 
-        This is a 3.0% speedup on the V8 Raytrace benchmark.
+        Reviewed by Gavin Barraclough.
 
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::registerFor):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::registerFor):
-        * VM/Machine.cpp:
-        (JSC::Machine::initializeCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::mark):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
-        * kjs/NodeInfo.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::didFinishParsing):
-        * kjs/Parser.h:
-        (JSC::Parser::parse):
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesArguments):
+        Native JSON.stringify does not omit functions
+        https://bugs.webkit.org/show_bug.cgi?id=28117
 
-2008-09-28  Mark Rowe  <mrowe@apple.com>
+        Objects that are callable should be treated as undefined when
+        serialising to JSON.
 
-        Reviewed by Sam Weinig.
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
 
-        Add an ASCII fast-path to toLowerCase and toUpperCase.
+2009-08-11  Oliver Hunt  <oliver@apple.com>
 
-        The fast path speeds up the common case of an ASCII-only string by up to 60% while adding a less than 5% penalty
-        to the less common non-ASCII case.
+        Reviewed by Geoff Garen.
 
-        This also removes stringProtoFuncToLocaleLowerCase and stringProtoFuncToLocaleUpperCase, which were identical
-        to the non-locale variants of the functions.  toLocaleLowerCase and toLocaleUpperCase now use the non-locale
-        variants of the functions directly.
+        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
+        https://bugs.webkit.org/show_bug.cgi?id=28169
 
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
+        Handle the case where someone has attempted to shadow a property
+        on the global object with a constant.
 
-2008-09-28  Mark Rowe  <mrowe@apple.com>
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::constRegisterFor):
+        * parser/Nodes.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
 
-        Reviewed by Cameron Zwarich.
+2009-08-11  John Gregg  <johnnyg@google.com>
 
-        Speed up parseInt and parseFloat.
+        Reviewed by Maciej Stachowiak.
 
-        Repeatedly indexing into a UString is slow, so retrieve a pointer into the underlying buffer once up front
-        and use that instead.  This is a 7% win on a parseInt/parseFloat micro-benchmark.
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
 
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt):
-        (JSC::parseFloat):
+        Adds ENABLE_NOTIFICATION flag.
 
-2008-09-28  Simon Hausmann  <hausmann@webkit.org>
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
 
-        Reviewed by David Hyatt.
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
 
-        In Qt's initializeThreading re-use an existing thread identifier for the main
-        thread if it exists.
+        Reviewed by Eric Seidel.
 
-        currentThread() implicitly creates new identifiers and it could be that
-        it is called before initializeThreading().
+        Modifications on JavaScriptCore to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28121
 
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading):
+        * runtime/Collector.cpp: Haiku doesn't have sys/mman.h, using OS.h instead.
+        (JSC::currentThreadStackBase): Haiku uses its own threading system.
+        * wtf/Platform.h: Defining all Haiku platform values.
+        * wtf/haiku/MainThreadHaiku.cpp: Adding a missing header (NotImplemented.h).
 
-2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
+2009-08-11  Jessie Berlin  <jberlin@apple.com>
 
-        Added Machine::retrieveCaller to the export list.
+        Reviewed by Adam Roben.
 
-        Reviewed by Kevin McCullough and Tim Hatcher.
+        Fix windows build.
 
-        * JavaScriptCore.exp: Added Machine::retrieveCaller.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-09-27  Anders Carlsson  <andersca@apple.com>
+2009-08-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        Fix build.
+        Reviewed by Tor Arne Vestbø.
 
-        * VM/CTI.cpp:
-        (JSC::):
+        Buildfix for Qt-win platforms.
 
-2008-09-27  Geoffrey Garen  <ggaren@apple.com>
+        * JavaScriptCore.pri: Choose MarkStackPosix.cpp or MarkStackWin.cpp depend on platform.
 
-        Reviewed by Cameron Zwarich.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=21175
+2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Store the callee CodeBlock, not the caller CodeBlock, in the call frame
-        header. Nix the "codeBlock" local variable, and access the callee
-        CodeBlock through the call frame header instead.
-        
-        Profit: call + return are simpler, because they don't have to update the
-        "codeBlock" local variable.
-        
-        Because CTI keeps "r" in a register, reading the callee CodeBlock relative
-        to "r" can be very fast, in any cases we care to optimize. Presently,
-        no such cases seem important.
-        
-        Also, stop writing "dst" to the call frame header. CTI doesn't use it.
-        
-        21.6% speedup on empty function call benchmark.
-        3.8% speedup on SunSpider --v8.
-        2.1% speedup on v8 benchmark.
-        0.7% speedup on SunSpider (6% speedup on controlflow-recursive).
-        
-        Small regression in bytecode, because currently every op_ret reads the
-        callee CodeBlock to check needsFullScopeChain, and bytecode does not
-        keep "r" in a register. On-balance, this is probably OK, since CTI is
-        our high-performance execution model. Also, this should go away once
-        we make needsFullScopeChain statically determinable at parse time.
+        Reviewed by NOBODY (And another build fix).
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall): The speedup!
-        (JSC::CTI::privateCompileSlowCases): ditto
+        Add new exports for MSVC
 
-        * VM/CTI.h:
-        (JSC::): Fixed up magic trampoline constants to account for the nixed
-        "codeBlock" argument.
-        (JSC::CTI::execute): Changed trampoline function not to take a "codeBlock"
-        argument, since codeBlock is now stored in the call frame header.
-        
-        * VM/Machine.cpp: Read the callee CodeBlock from the register file. Use
-        a NULL CallerRegisters in the call frame header to signal a built-in
-        caller, since CodeBlock is now never NULL.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        * VM/Machine.h: Made some stand-alone functions Machine member functions
-        so they could call the private codeBlock() accessor in the Register
-        class, of which Machine is a friend. Renamed "CallerCodeBlock" to
-        "CodeBlock", since it's no longer the caller's CodeBlock.
+2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        * VM/RegisterFile.h: Marked some methods const to accommodate a 
-        const RegisterFile* being passed around in Machine.cpp.
+        Reviewed by NOBODY (yet another build fix).
 
-2008-09-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Remove obsolete entries from MSVC exports file
 
-        Gtk build fix. Not reviewed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Narrow-down the target of the JavaScriptCore .lut.h generator so
-        it won't try to create the WebCore .lut.hs.
+2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        * GNUmakefile.am:
+        Add includes needed for non-allinonefile builds
 
-2008-09-26  Matt Lilek  <webkit@mattlilek.com>
+        * runtime/GetterSetter.h:
+        * runtime/ScopeChain.h:
 
-        Reviewed by Tim Hatcher.
+2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Update FEATURE_DEFINES after ENABLE_CROSS_DOCUMENT_MESSAGING was removed.
+        Fix export file for last build fix
 
-        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.exp:
 
-2008-09-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-08-10  Oliver Hunt  <oliver@apple.com>
 
-        Rubber-stamped by Anders Carlson.
+        Hoist page size initialization into platform specific code.
 
-        Change the name 'sc' to 'scopeChainNode' in a few places.
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::pageSize):
+        * runtime/MarkStackPosix.cpp:
+        (JSC::MarkStack::initializePagesize):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::initializePagesize):
 
-        * kjs/nodes.cpp:
-        (JSC::EvalNode::generateCode):
-        (JSC::FunctionBodyNode::generateCode):
-        (JSC::ProgramNode::generateCode):
+2009-08-07  Oliver Hunt  <oliver@apple.com>
 
-2008-09-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Darin Adler.
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
-        Speedup static property get/put
+        Make the GC mark phase iterative by using an explicit mark stack.
+        To do this marking any single object is performed in multiple stages
+          * The object is appended to the MarkStack, this sets the marked
+            bit for the object using the new markDirect() function, and then
+            returns
+          * When the MarkStack is drain()ed the object is popped off the stack
+            and markChildren(MarkStack&) is called on the object to collect 
+            all of its children.  drain() then repeats until the stack is empty.
 
-        Convert getting/setting static property values to use static functions
-        instead of storing an integer and switching in getValueProperty/putValueProperty.
+        Additionally I renamed a number of methods from 'mark' to 'markAggregate'
+        in order to make it more clear that marking of those object was not
+        going to result in an actual recursive mark.
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::getOwnPropertySlot):
-        * kjs/NumberConstructor.cpp:
-        (JSC::numberConstructorNaNValue):
-        (JSC::numberConstructorNegInfinity):
-        (JSC::numberConstructorPosInfinity):
-        (JSC::numberConstructorMaxValue):
-        (JSC::numberConstructorMinValue):
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::regExpConstructorDollar1):
-        (JSC::regExpConstructorDollar2):
-        (JSC::regExpConstructorDollar3):
-        (JSC::regExpConstructorDollar4):
-        (JSC::regExpConstructorDollar5):
-        (JSC::regExpConstructorDollar6):
-        (JSC::regExpConstructorDollar7):
-        (JSC::regExpConstructorDollar8):
-        (JSC::regExpConstructorDollar9):
-        (JSC::regExpConstructorInput):
-        (JSC::regExpConstructorMultiline):
-        (JSC::regExpConstructorLastMatch):
-        (JSC::regExpConstructorLastParen):
-        (JSC::regExpConstructorLeftContext):
-        (JSC::regExpConstructorRightContext):
-        (JSC::setRegExpConstructorInput):
-        (JSC::setRegExpConstructorMultiline):
-        (JSC::RegExpConstructor::setInput):
-        (JSC::RegExpConstructor::setMultiline):
-        (JSC::RegExpConstructor::multiline):
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        (JSC::regExpObjectGlobal):
-        (JSC::regExpObjectIgnoreCase):
-        (JSC::regExpObjectMultiline):
-        (JSC::regExpObjectSource):
-        (JSC::regExpObjectLastIndex):
-        (JSC::setRegExpObjectLastIndex):
-        * kjs/RegExpObject.h:
-        (JSC::RegExpObject::setLastIndex):
-        (JSC::RegExpObject::lastIndex):
-        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/create_hash_table:
-        * kjs/lexer.cpp:
-        (JSC::Lexer::lex):
-        * kjs/lookup.cpp:
-        (JSC::HashTable::createTable):
-        (JSC::HashTable::deleteTable):
-        (JSC::setUpStaticFunctionSlot):
-        * kjs/lookup.h:
-        (JSC::HashEntry::initialize):
-        (JSC::HashEntry::setKey):
-        (JSC::HashEntry::key):
-        (JSC::HashEntry::attributes):
-        (JSC::HashEntry::function):
-        (JSC::HashEntry::functionLength):
-        (JSC::HashEntry::propertyGetter):
-        (JSC::HashEntry::propertyPutter):
-        (JSC::HashEntry::lexerValue):
-        (JSC::HashEntry::):
-        (JSC::HashTable::entry):
-        (JSC::getStaticPropertySlot):
-        (JSC::getStaticValueSlot):
-        (JSC::lookupPut):
-
-2008-09-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Maciej Stachowiak & Oliver Hunt.
-
-        Add support for reusing temporary JSNumberCells.  This change is based on the observation
-        that if the result of certain operations is a JSNumberCell and is consumed by a subsequent
-        operation that would produce a JSNumberCell, we can reuse the object rather than allocating
-        a fresh one.  E.g. given the expression ((a * b) * c), we can statically determine that
-        (a * b) will have a numeric result (or else it will have thrown an exception), so the result
-        will either be a JSNumberCell or a JSImmediate.
-
-        This patch changes three areas of JSC:
-            * The AST now tracks type information about the result of each node.
-            * This information is consumed in bytecode compilation, and certain bytecode operations
-              now carry the statically determined type information about their operands.
-            * CTI uses the information in a number of fashions:
-                * Where an operand to certain arithmetic operations is reusable, it will plant code
-                  to try to perform the operation in JIT code & reuse the cell, where appropriate.
-                * Where it can be statically determined that an operand can only be numeric (typically
-                  the result of another arithmetic operation) the code will not redundantly check that
-                  the JSCell is a JSNumberCell.
-                * Where either of the operands to an add are non-numeric do not plant an optimized
-                  arithmetic code path, just call straight out to the C function.
-
-        +6% Sunspider (10% progression on 3D, 16% progression on math, 60% progression on access-nbody),
-        +1% v8-tests (improvements in raytrace & crypto)
-
-        * VM/CTI.cpp: Add optimized code generation with reuse of temporary JSNumberCells.
-        * VM/CTI.h:
-        * kjs/JSNumberCell.h:
-        * masm/X86Assembler.h:
-
-        * VM/CodeBlock.cpp: Add type information to specific bytecodes.
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-
-        * kjs/nodes.cpp: Track static type information for nodes.
-        * kjs/nodes.h:
-        * kjs/ResultDescriptor.h: (Added)
+        * GNUmakefile.am
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::markAggregate):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::markAggregate):
+        (JSC::EvalNode::markAggregate):
+        (JSC::FunctionBodyNode::markAggregate):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::markAggregate):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/ArgList.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        * runtime/Arguments.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+        (JSC::Heap::markCurrentThreadConservatively):
+        (JSC::Heap::markOtherThreadConservatively):
+        (JSC::Heap::markStackObjectsConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::markCellDirect):
+        (JSC::JSCell::markChildren):
+        (JSC::JSValue::markDirect):
+        (JSC::JSValue::markChildren):
+        (JSC::JSValue::hasChildren):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::drain):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::markChildren):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::markAggregate):
+        (JSC::JSONObject::markStringifiers):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/MarkStack.cpp: Added.
+        (JSC::MarkStack::compact):
+        * runtime/MarkStack.h: Added.
+        (JSC::):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::~MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::pageSize):
+        
+        MarkStackArray is a non-shrinking, mmap-based vector type
+        used for storing objects to be marked.
+        (JSC::MarkStack::MarkStackArray::MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::expand):
+        (JSC::MarkStack::MarkStackArray::append):
+        (JSC::MarkStack::MarkStackArray::removeLast):
+        (JSC::MarkStack::MarkStackArray::isEmpty):
+        (JSC::MarkStack::MarkStackArray::size):
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+        * runtime/MarkStackWin.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+        * runtime/ScopeChain.h:
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::mark):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+
+2009-08-10  Mark Rowe  <mrowe@apple.com>
+        
+        Reviewed by Darin Adler.
 
-2008-09-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+        Fix hundreds of "pointer being freed was not allocated" errors seen on the build bot.
 
-        Reviewed by George Staikos, Maciej Stachowiak.
+        * wtf/FastMalloc.h: Implement nothrow variants of the delete and delete[] operators since
+        we implement the nothrow variants of new and new[].  The nothrow variant of delete is called
+        explicitly in the implementation of std::sort which was resulting in FastMalloc-allocated
+        memory being passed to the system allocator to free.
 
-        Add utility functions needed for upcoming WML code.
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
 
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIPrintable):
+        [Gtk] Unreviewed build fix. Move JSAPIValueWrapper.cpp/.h in the debug
+        section. This file is already part of AllInOneFile in Release builds.
 
-2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+        * GNUmakefile.am:
 
-        Reviewed by Darin Adler.
-        
-        Reverted the part of r36614 that used static data because static data
-        is not thread-safe.
+2009-08-10  Darin Adler  <darin@apple.com>
 
-2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+        * wtf/FastMalloc.h: Fix build.
 
-        Reviewed by Maciej Stachowiak.
-        
-        Removed dynamic check for whether the callee needs an activation object.
-        Replaced with callee code to create the activation object.
+2009-08-10  Darin Adler  <darin@apple.com>
 
-        0.5% speedup on SunSpider.
-        No change on v8 benchmark. (Might be a speedup, but it's in range of the
-        variance.)
+        Reviewed by Mark Rowe.
 
-        0.7% speedup on v8 benchmark in bytecode.
-        1.3% speedup on empty call benchmark in bytecode.
+        FastMalloc.h has cross-platform code but marked as WinCE-only
+        https://bugs.webkit.org/show_bug.cgi?id=28160
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Added support for op_init_activation,
-        the new opcode that specifies that the callee's initialization should
-        create an activation object.
-        (JSC::CTI::privateCompile): Removed previous code that did a similar
-        thing in an ad-hoc way.
+        1) The support for nothrow was inside #if PLATFORM(WINCE) even though it is
+           not platform-specific.
+        2) The code tried to override operator delete nothrow, which does not exist.
+        3) The code in the header checks the value of USE_SYSTEM_MALLOC, but the code
+           in FastMalloc.cpp checks only if the macro is defined.
 
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Added a case for dumping op_init_activation.
+        * wtf/FastMalloc.h: See above.
+        * wtf/FastMalloc.cpp: Ditto.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate): Added fixup code to change op_init to
-        op_init_activation if necessary. (With a better parser, we would know
-        which to use from the beginning.)
+2009-08-10  Sam Weinig  <sam@webkit.org>
 
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-        (WTF::): Faster traits for the instruction vector. An earlier version
-        of this patch relied on inserting at the beginning of the vector, and
-        depended on this change for speed.
+        Reviewed by Anders Carlsson.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Removed clients of setScopeChain, the old
-        abstraction for dynamically checking for whether an activation object
-        needed to be created.
-        (JSC::Machine::privateExecute): ditto
+        Fix an annoying indentation issue.
 
-        (JSC::Machine::cti_op_push_activation): Renamed this function from
-        cti_vm_updateScopeChain, and made it faster by removing the call to 
-        setScopeChain.
-        * VM/Machine.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
 
-        * VM/Opcode.h: Declared op_init_activation.
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+        Unreviewed build fix.
 
-        Reviewed by Maciej Stachowiak.
-        
-        Move most of the return code back into the callee, now that the callee
-        doesn't have to calculate anything dynamically.
-        
-        11.5% speedup on empty function call benchmark.
-        
-        SunSpider says 0.3% faster. SunSpider --v8 says no change.
+        Add new files to makefile.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
+        * GNUmakefile.am:
 
-2008-09-24  Sam Weinig  <sam@webkit.org>
+2009-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Maciej Stachowiak.
+        Fix compilation with the interpreter instead of the JIT by including
+        PrototypeFunction.h as forward-declared through NativeFunctionWrapper.h.
 
-        Remove staticFunctionGetter.  There is only one remaining user of
-        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
+        * runtime/ObjectConstructor.cpp:
 
-        * JavaScriptCore.exp:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
+2009-08-09  Oliver Hunt  <oliver@apple.com>
 
-2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by George Staikos.
 
-        Reviewed by Oliver Hunt.
-        
-        - inline JIT fast case of op_neq
-        - remove extra level of function call indirection from slow cases of eq and neq
+        JSON.stringify replacer returning undefined does not omit object properties
+        https://bugs.webkit.org/show_bug.cgi?id=28118
+
+        Correct behaviour of stringify when using a replacer function that returns
+        undefined.  This is a simple change to move the undefined value check to
+        after the replacer function is called.  This means that the replacer function
+        is now called for properties with the value undefined, however i've confirmed
+        that this behaviour is correct.
         
-        1% speedup on Richards
+        In addition I've made the cyclic object exception have a more useful error
+        message.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_neq):
-        * kjs/operations.cpp:
-        (JSC::equal):
-        (JSC::equalSlowCase):
-        * kjs/operations.h:
-        (JSC::equalSlowCaseInline):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
 
-2008-09-24  Sam Weinig  <sam@webkit.org>
+2009-08-08  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel and Sam Weinig.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21080
-        <rdar://problem/6243534>
-        Crash below Function.apply when using a runtime array as the argument list
+        [ES5] Implement Object.getPrototypeOf
+        https://bugs.webkit.org/show_bug.cgi?id=28114
 
-        Test: plugins/bindings-array-apply-crash.html
+        Implement getPrototypeOf
 
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncApply): Revert to the slow case if the object inherits from 
-        JSArray (via ClassInfo) but is not a JSArray.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConsGetPrototypeOf):
+        * runtime/ObjectConstructor.h:
 
-2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Style change.
+        Reviewed by Eric Seidel.
 
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode):
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
 
-2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+        Several classes which are inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
 
-        Reviewed by Geoff.
+        * wtf/Noncopyable.h:
 
-        Bug 21031: Breakpoints in the condition of loops only breaks the first
-        time
-        - Now when setting breakpoints in the condition of a loop (for, while,
-        for in, and do while) will successfully break each time throught the
-        loop.
-        - For 'for' loops we need a little more complicated behavior that cannot
-        be accomplished without some more significant changes:
-        https://bugs.webkit.org/show_bug.cgi?id=21073
+2009-08-07  George Staikos <george.staikos@torchmobile.com> 
 
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode): We don't want to blindly emit a debug hook
-        at the first line of loops, instead let the loop emit the debug hooks.
-        (JSC::DoWhileNode::emitCode):
-        (JSC::WhileNode::emitCode):
-        (JSC::ForNode::emitCode):
-        (JSC::ForInNode::emitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::DoWhileNode::):
-        (JSC::WhileNode::):
-        (JSC::ForInNode::):
+        Reviewed by Eric Seidel.
 
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27305
+        Implement WinCE-specific unicode layer.
+        Written by George Staikos <george.staikos@torchmobile.com>
+        with bug fixes by Yong Li <yong.li@torchmobile.com>
+        refactored by Joe Mason <joe.mason@torchmobile.com> 
 
-        Reviewed by Darin Adler.
-        
-        Fixed <rdar://problem/5605532> Need a SPI for telling JS the size of
-        the objects it retains
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wince/UnicodeWince.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWince.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2009-08-07  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
-        * API/tests/testapi.c: Test the new SPI a little.
+        Reviewed by Eric Seidel.
 
-        * API/JSSPI.cpp: Add the new SPI.
-        * API/JSSPI.h: Add the new SPI.
-        * JavaScriptCore.exp: Add the new SPI.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Add the new SPI.
+        https://bugs.webkit.org/show_bug.cgi?id=28069
 
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+        Add inline to help winscw compiler resolve specialized argument in 
+        templated functions.  
 
-        Reviewed by Darin Adler.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
 
-        * API/JSBase.h: Filled in some missing function names.
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Cameron Zwarich.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21057
-        Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html
+        Allow custom memory allocation control for RegExpObjectData struct
+        http://bugs.webkit.org/show_bug.cgi?id=26750
 
-        * VM/CodeGenerator.h: Changed declaration order to ensure the
-        m_lastConstant, which is a RefPtr that points into m_calleeRegisters,
-        has its destructor called before the destructor for m_calleeRegisters.
+        Inherits RegExpObjectData struct from FastAllocBase because
+        it has been instantiated by 'new' in JavaScriptCore/runtime/RegExpObject.cpp:62
 
-2008-09-24  Darin Adler  <darin@apple.com>
+        * runtime/RegExpObject.h:
 
-        Reviewed by Sam Weinig.
+2009-08-06  Norbert Leser  <norbert.leser@nokia.com>
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21047
-          speed up ret_activation with inlining
+        Reviewed by Darin Adler.
 
-        About 1% on v8-raytrace.
+        Updated patch for bug #27059:
+        Symbian platform always uses little endian encoding,
+        regardless of compiler.
+        We need to make sure that we correctly detect EABI architecture
+        for armv5 targets on Symbian,
+        where __EABI__ is set but not __ARM_EABI__
 
-        * JavaScriptCore.exp: Removed JSVariableObject::setRegisters.
+        * wtf/Platform.h:
 
-        * kjs/JSActivation.cpp: Moved copyRegisters to the header to make it inline.
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::copyRegisters): Moved here. Also removed the registerArraySize
-        argument to setRegisters, since the object doesn't need to store the number of
-        registers.
+2009-08-06  Adam Barth  <abarth@webkit.org>
 
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset): Removed unnecessary clearing left over from when we
-        used this on objects that weren't brand new. These days, this function is really
-        just part of the constructor.
+        Unreviewed revert.
 
-        * kjs/JSGlobalObject.h: Added registerArraySize to JSGlobalObjectData, since
-        JSVariableObjectData no longer needs it. Added a setRegisters override here
-        that handles storing the size.
+        http://bugs.webkit.org/show_bug.cgi?id=27879
 
-        * kjs/JSStaticScopeObject.h: Removed code to set registerArraySize, since it
-        no longer exists.
+        Revert 46877 because it broke GTK.
 
-        * kjs/JSVariableObject.cpp: Moved copyRegisterArray and setRegisters to the
-        header to make them inline.
-        * kjs/JSVariableObject.h: Removed registerArraySize from JSVariableObjectData,
-        since it was only used for the global object.
-        (JSC::JSVariableObject::copyRegisterArray): Moved here ot make it inline.
-        (JSC::JSVariableObject::setRegisters): Moved here to make it inline. Also
-        removed the code to set registerArraySize and changed an if statement into
-        an assert to save an unnnecessary branch.
+        * wtf/Noncopyable.h:
 
-2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+2009-08-06  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
-        
-        - inline PropertyMap::getOffset to speed up polymorphic lookups
-        
-        ~1.5% speedup on v8 benchmark
-        no effect on SunSpider
 
-        * JavaScriptCore.exp:
-        * kjs/PropertyMap.cpp:
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::getOffset):
-
-2008-09-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20992
-        Build fails on GTK+ Mac OS
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
 
-        * wtf/ThreadingGtk.cpp: Remove platform ifdef as suggested by
-          Richard Hult.
-        (WTF::initializeThreading):
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
 
-2008-09-23  Oliver Hunt  <oliver@apple.com>
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
 
-        Reviewed by Maciej Stachowiak.
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
 
-        Bug 19968: Slow Script at www.huffingtonpost.com
-        <https://bugs.webkit.org/show_bug.cgi?id=19968>
-
-        Finally found the cause of this accursed issue.  It is triggered
-        by synchronous creation of a new global object from JS.  The new
-        global object resets the timer state in this execution group's
-        Machine, taking timerCheckCount to 0.  Then when JS returns the
-        timerCheckCount is decremented making it non-zero.  The next time
-        we execute JS we will start the timeout counter, however the non-zero
-        timeoutCheckCount means we don't reset the timer information. This
-        means that the timeout check is now checking the cumulative time
-        since the creation of the global object rather than the time since
-        JS was last entered.  At this point the slow script dialog is guaranteed
-        to eventually be displayed incorrectly unless a page is loaded
-        asynchronously (which will reset everything into a sane state).
-
-        The fix for this is rather trivial -- the JSGlobalObject constructor
-        should not be resetting the machine timer state.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-          Now that we can't rely on the GlobalObject initialising the timeout
-          state, we do it in the Machine constructor.
-
-        * VM/Machine.h:
-        (JSC::Machine::stopTimeoutCheck):
-          Add assertions to guard against this happening.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-          Don't reset the timeout state.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
 
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Several classes which inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
 
-        Reviewed by Oliver Hunt.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21038 | <rdar://problem/6240812>
-        Uncaught exceptions in regex replace callbacks crash webkit
-        
-        This was a combination of two problems:
-        
-        (1) the replace function would continue execution after an exception
-        had been thrown.
-        
-        (2) In some cases, the Machine would return 0 in the case of an exception,
-        despite the fact that a few clients dereference the Machine's return
-        value without first checking for an exception.
-        
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        
-        ^ Return jsNull() instead of 0 in the case of an exception, since some
-        clients depend on using our return value.
-        
-        ^ ASSERT that execution does not continue after an exception has been
-        thrown, to help catch problems like this in the future.
+        * wtf/Noncopyable.h:
 
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        
-        ^ Stop execution if an exception has been thrown.
+2009-08-06  Mark Rowe  <mrowe@apple.com>
 
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+        Rubber-stamped by Sam Weinig.
 
-        Try to fix the windows build.
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-2008-09-23  Alp Toker  <alp@nuanti.com>
+2009-08-06  Mark Rowe  <mrowe@apple.com>
 
-        Build fix.
+        Bring a little order to our otherwise out of control lives.
 
-        * VM/CTI.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
 
-        * wtf/Platform.h: Removed duplicate #if.
+        Allow custom memory allocation control for JavaScriptCore's PolymorphicAccessStructureList struct
+        https://bugs.webkit.org/show_bug.cgi?id=27877
 
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Changed the layout of the call frame from
-        
-        { header, parameters, locals | constants, temporaries }
-        
-        to
-        
-        { parameters, header | locals, constants, temporaries }
-        
-        This simplifies function entry+exit, and enables a number of future
-        optimizations.
-        
-        13.5% speedup on empty call benchmark for bytecode; 23.6% speedup on
-        empty call benchmark for CTI.
-        
-        SunSpider says no change. SunSpider --v8 says 1% faster.
+        Inherits PolymorphicAccessStructureList struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/jit/JITStubs.cpp:1229.
 
-        * VM/CTI.cpp:
-        
-        Added a bit of abstraction for calculating whether a register is a
-        constant, since this patch changes that calculation:
-        (JSC::CTI::isConstant):
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
+        * bytecode/Instruction.h:
 
-        Updated for changes to callframe header location:
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::printOpcodeOperandTypes):
-        
-        Renamed to spite Oliver:
-        (JSC::CTI::emitInitRegister):
-        
-        Added an abstraction for emitting a call through a register, so that
-        calls through registers generate exception info, too:
-        (JSC::CTI::emitCall):
+2009-08-05  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Updated to match the new callframe header layout, and to support calls
-        through registers, which have no destination address:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
+        Reviewed by Darin Adler.
 
-        * VM/CTI.h:
+        Allow custom memory allocation control for JavaScriptCore's ScopeNodeData struct
+        https://bugs.webkit.org/show_bug.cgi?id=27875
+
+        Inherits ScopeNodeData struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/parser/Nodes.cpp:1848.
+
+        * parser/Nodes.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add floating point support for generic ARM port.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::doubleTransfer):
+        * assembler/ARMAssembler.h:
+        (JSC::ARM::):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::faddd_r):
+        (JSC::ARMAssembler::fsubd_r):
+        (JSC::ARMAssembler::fmuld_r):
+        (JSC::ARMAssembler::fcmpd_r):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::fmsr_r):
+        (JSC::ARMAssembler::fsitod_r):
+        (JSC::ARMAssembler::fmstat):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        * jit/JIT.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add JIT support for generic ARM port without optimizations.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        All JIT optimizations are disabled.
+
+        Signed off by Zoltan Herczeg <zherczeg@inf.u-szeged.hu>
+        Signed off by Gabor Loki <loki@inf.u-szeged.hu>
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::load32):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        * wtf/Platform.h:
 
-        More of the above:
-        (JSC::CallRecord::CallRecord):
+2009-08-04  Gavin Barraclough  <barraclough@apple.com>
 
-        * VM/CodeBlock.cpp:
+        Rubber Stamped by Oiver Hunt.
 
-        Updated for new register layout:
-        (JSC::registerName):
-        (JSC::CodeBlock::dump):
+        Revert r46643 since this breaks the Yarr::Interpreter running the v8 tests.
+        https://bugs.webkit.org/show_bug.cgi?id=27874
 
-        * VM/CodeBlock.h:
-        
-        Updated CodeBlock to track slightly different information about the
-        register frame, and tweaked the style of an ASSERT_NOT_REACHED.
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::getStubInfo):
-
-        * VM/CodeGenerator.cpp:
-        
-        Added some abstraction around constant register allocation, since this
-        patch changes it, changed codegen to account for the new callframe
-        layout, and added abstraction around register fetching code
-        that used to assume that all local registers lived at negative indices,
-        since vars now live at positive indices:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::addVar):
-        (JSC::CodeGenerator::addGlobalVar):
-        (JSC::CodeGenerator::allocateConstants):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::addParameter):
-        (JSC::CodeGenerator::registerFor):
-        (JSC::CodeGenerator::constRegisterFor):
-        (JSC::CodeGenerator::newRegister):
-        (JSC::CodeGenerator::newTemporary):
-        (JSC::CodeGenerator::highestUsedRegister):
-        (JSC::CodeGenerator::addConstant):
-        
-        ASSERT that our caller referenced the registers it passed to us.
-        Otherwise, we might overwrite them with parameters:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-
-        * VM/CodeGenerator.h:
-        
-        Added some abstraction for getting a RegisterID for a given index,
-        since the rules are a little weird:
-        (JSC::CodeGenerator::registerFor):
-
-        * VM/Machine.cpp:
-
-        Utility function to transform a machine return PC to a virtual machine
-        return VPC, for the sake of stack unwinding, since both PCs are stored
-        in the same location now:
-        (JSC::vPCForPC):
-
-        Tweaked to account for new call frame:
-        (JSC::Machine::initializeCallFrame):
-        
-        Tweaked to account for registerOffset supplied by caller:
-        (JSC::slideRegisterWindowForCall):
-
-        Tweaked to account for new register layout:
-        (JSC::scopeChainForCall):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::execute):
-
-        Changed op_call and op_construct to implement the new calling convention:
-        (JSC::Machine::privateExecute):
-
-        Tweaked to account for the new register layout:
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::callFrame):
-        (JSC::Machine::getArgumentsData):
-
-        Changed CTI call helpers to implement the new calling convention:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_ret_activation):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_call_eval):
-
-        * VM/Machine.h:
-
-        * VM/Opcode.h:
-        
-        Renamed op_initialise_locals to op_init, because this opcode
-        doesn't initialize all locals, and it doesn't initialize only locals.
-        Also, to spite Oliver.
-        
-        * VM/RegisterFile.h:
-        
-        New call frame enumeration values:
-        (JSC::RegisterFile::):
-
-        Simplified the calculation of whether a RegisterID is a temporary,
-        since we can no longer assume that all positive non-constant registers
-        are temporaries:
-        * VM/RegisterID.h:
-        (JSC::RegisterID::RegisterID):
-        (JSC::RegisterID::setTemporary):
-        (JSC::RegisterID::isTemporary):
-
-        Renamed firstArgumentIndex to firstParameterIndex because the assumption
-        that this variable pertained to the actual arguments supplied by the
-        caller caused me to write some buggy code:
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::fillArgList):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
 
-        Updated for new call frame layout:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        * kjs/DebuggerCallFrame.h:
-
-        Changed the activation object to account for the fact that a call frame
-        header now sits between parameters and local variables. This change
-        requires all variable objects to do their own marking, since they
-        now use their register storage differently:
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::mark):
-        (JSC::JSActivation::copyRegisters):
-        (JSC::JSActivation::createArgumentsObject):
-        * kjs/JSActivation.h:
+2009-08-04  Oliver Hunt  <oliver@apple.com>
 
-        Updated global object to use the new interfaces required by the change
-        to JSActivation above:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::mark):
-        (JSC::JSGlobalObject::copyGlobalsFrom):
-        (JSC::JSGlobalObject::copyGlobalsTo):
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::addStaticGlobals):
-
-        Updated static scope object to use the new interfaces required by the 
-        change to JSActivation above:
-        * kjs/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::mark):
-        (JSC::JSStaticScopeObject::~JSStaticScopeObject):
-        * kjs/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::d):
-
-        Updated variable object to use the new interfaces required by the 
-        change to JSActivation above:
-        * kjs/JSVariableObject.cpp:
-        (JSC::JSVariableObject::copyRegisterArray):
-        (JSC::JSVariableObject::setRegisters):
-        * kjs/JSVariableObject.h:
-
-        Changed the bit twiddling in symbol table not to assume that all indices
-        are negative, since they can be positive now:
-        * kjs/SymbolTable.h:
-        (JSC::SymbolTableEntry::SymbolTableEntry):
-        (JSC::SymbolTableEntry::isNull):
-        (JSC::SymbolTableEntry::getIndex):
-        (JSC::SymbolTableEntry::getAttributes):
-        (JSC::SymbolTableEntry::setAttributes):
-        (JSC::SymbolTableEntry::isReadOnly):
-        (JSC::SymbolTableEntry::pack):
-        (JSC::SymbolTableEntry::isValidIndex):
-
-        Changed call and construct nodes to ref their functions and/or bases,
-        so that emitCall/emitConstruct doesn't overwrite them with parameters.
-        Also, updated for rename to registerFor:
-        * kjs/nodes.cpp:
-        (JSC::ResolveNode::emitCode):
-        (JSC::NewExprNode::emitCode):
-        (JSC::EvalFunctionCallNode::emitCode):
-        (JSC::FunctionCallValueNode::emitCode):
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::FunctionCallBracketNode::emitCode):
-        (JSC::FunctionCallDotNode::emitCode):
-        (JSC::PostfixResolveNode::emitCode):
-        (JSC::DeleteResolveNode::emitCode):
-        (JSC::TypeOfResolveNode::emitCode):
-        (JSC::PrefixResolveNode::emitCode):
-        (JSC::ReadModifyResolveNode::emitCode):
-        (JSC::AssignResolveNode::emitCode):
-        (JSC::ConstDeclNode::emitCodeSingle):
-        (JSC::ForInNode::emitCode):
+        PPC64 Build fix
 
-        Added abstraction for getting exception info out of a call through a
-        register:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitCall):
-        
-        Removed duplicate #if:
         * wtf/Platform.h:
 
-2008-09-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin.
+2009-08-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
 
-        Bug 21030: The JS debugger breaks on the do of a do-while not the while
-        (where the conditional statement is)
-        https://bugs.webkit.org/show_bug.cgi?id=21030
-        Now the statementListEmitCode detects if a do-while node is being
-        emited and emits the debug hook on the last line instead of the first.
+        Reviewed by Adam Treat
 
-        This change had no effect on sunspider.
+        Explicitly include limits.h header when using INT_MAX and INT_MIN
 
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::isDoWhile):
-        (JSC::DoWhileNode::isDoWhile):
+        * interpreter/Interpreter.cpp
 
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+2009-08-03  Harald Fernengel  <harald.fernengel@nokia.com>
 
-        Reviewed by Camron Zwarich.
+        Reviewed by Darin Adler.
 
-        - inline the fast case of instanceof
-        https://bugs.webkit.org/show_bug.cgi?id=20818
+        Fix compile error for ambigous call to abs()
+        https://bugs.webkit.org/show_bug.cgi?id=27873
 
-        ~2% speedup on EarleyBoyer test.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof):
+        Fix ambiguity in abs(long int) call by calling labs() instead
 
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+        * wtf/DateMath.cpp: replace call to abs() with labs()
 
-        Reviewed by Cameron Zwarich.
-        
-        - add forgotten slow case logic for !==
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileSlowCases):
+        Reviewed by Eric Seidel.
 
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
 
-        Reviewed by Cameron Zwarich.
+        * JavaScriptCore.pro:
 
-        - inline the fast cases of !==, same as for ===
-        
-        2.9% speedup on EarleyBoyer benchmark
+2009-08-03  Ada Chan  <adachan@apple.com>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpStrictEq): Factored stricteq codegen into this function,
-        and parameterized so it can do the reverse version as well.
-        (JSC::CTI::privateCompileMainPass): Use the above for stricteq and nstricteq.
-        * VM/CTI.h:
-        (JSC::CTI::): Declare above stuff.
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_nstricteq): Removed fast cases, now handled inline.
+        Fixed the Tiger build.
 
-2008-09-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * wtf/FastMalloc.cpp:
 
-        Reviewed by Oliver Hunt.
+2009-08-03  Ada Chan  <adachan@apple.com>
 
-        Bug 20989: Aguments constructor should put 'callee' and 'length' properties in a more efficient way
-        <https://bugs.webkit.org/show_bug.cgi?id=20989>
+        Reviewed by Darin Adler.
 
-        Make special cases for the 'callee' and 'length' properties in the
-        Arguments object.
+        Don't use background thread to scavenge memory on Tiger until we figure out why it causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=27900
 
-        This is somewhere between a 7.8% speedup and a 10% speedup on the V8
-        Raytrace benchmark, depending on whether it is run alone or with the
-        other V8 benchmarks.
+        * wtf/FastMalloc.cpp:
 
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::mark):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
+2009-08-03  Fumitoshi Ukai  <ukai@chromium.org>
 
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Jan Alonzo.
 
-        Reviewed by Darin.
+        Fix build break on Gtk/x86_64.
+        https://bugs.webkit.org/show_bug.cgi?id=27936
 
-        - speed up instanceof some more
-        https://bugs.webkit.org/show_bug.cgi?id=20818
-        
-        ~2% speedup on EarleyBoyer
+        Use JSVALUE64 for X86_64 LINUX, except Qt.
 
-        The idea here is to record in the StructureID whether the class
-        needs a special hasInstance or if it can use the normal logic from
-        JSObject. 
-        
-        Based on this I inlined the real work directly into
-        cti_op_instanceof and put the fastest checks up front and the
-        error handling at the end (so it should be fairly straightforward
-        to split off the beginning to be inlined if desired).
+        * wtf/Platform.h:
 
-        I only did this for CTI, not the bytecode interpreter.
-        
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructureID):
-        * ChangeLog:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof):
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::isAnyImmediate):
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::overridesHasInstance):
-        (JSC::TypeInfo::flags):
-
-2008-09-22  Darin Adler  <darin@apple.com>
+2009-08-02  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Sam Weinig.
+        Fix the GTK+ build.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21019
-          make FunctionBodyNode::ref/deref fast
+        * wtf/Platform.h:
 
-        Speeds up v8-raytrace by 7.2%.
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/nodes.cpp:
-        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize m_refCount to 0.
-        * kjs/nodes.h:
-        (JSC::FunctionBodyNode::ref): Call base class ref once, and thereafter use
-        m_refCount.
-        (JSC::FunctionBodyNode::deref): Ditto, but the deref side.
+        Reviewed by Sam Weinig.
 
-2008-09-22  Darin Adler  <darin@apple.com>
+        Disabled JSVALUE32_64 on Qt builds, since all layout tests mysteriously
+        crash with it enabled.
 
-        Pointed out by Sam Weinig.
+        * wtf/Platform.h:
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::fillArgList): Fix bad copy and paste. Oops!
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-22  Darin Adler  <darin@apple.com>
+        Qt build fix.
 
-        Reviewed by Cameron Zwarich.
+        Added JSAPIValueWrapper.cpp to the build.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20983
-          ArgumentsData should have some room to allocate some extra arguments inline
+        * JavaScriptCore.pri:
 
-        Speeds up v8-raytrace by 5%.
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData): Use a fixed buffer if there are 4 or fewer
-        extra arguments.
-        (JSC::Arguments::Arguments): Use a fixed buffer if there are 4 or fewer
-        extra arguments.
-        (JSC::Arguments::~Arguments): Delete the buffer if necessary.
-        (JSC::Arguments::mark): Update since extraArguments are now Register.
-        (JSC::Arguments::fillArgList): Added special case for the only case that's
-        actually used in the practice, when there are no parameters. There are some
-        other special cases in there too, but that's the only one that matters.
-        (JSC::Arguments::getOwnPropertySlot): Updated to use setValueSlot since there's
-        no operation to get you at the JSValue* inside a Register as a "slot".
+        Windows build fix.
 
-2008-09-22  Sam Weinig  <sam@webkit.org>
+        Exported symbols for JSAPIValueWrapper.
 
-        Reviewed by Maciej Stachowiak.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21014
-        Speed up for..in by using StructureID to avoid calls to hasProperty
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        Speeds up fasta by 8%.
+        GTK build fix.
 
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::next):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::setCachedStructureID):
-        (JSC::PropertyNameArrayData::cachedStructureID):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::structureIDChainsAreEqual):
-        * kjs/StructureID.h:
+        * jit/JITStubs.cpp: #include <stdarg.h>, for a definition of va_start.
 
-2008-09-22  Kelvin Sherlock  <ksherlock@gmail.com>
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        Updated and tweaked by Sam Weinig.
+        Qt build fix.
+        
+        * runtime/Collector.cpp: #include <limits.h>, for a definition of ULONG_MAX.
 
-        Reviewed by Geoffrey Garen.
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        Bug 20020: Proposed enhancement to JavaScriptCore API
-        <https://bugs.webkit.org/show_bug.cgi?id=20020>
+        Windows build fix: Nixed JSImmediate::prototype, JSImmediate::toObject,
+        and JSImmediate::toThisObject, and removed their exported symbols.
 
-        Add JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError, and JSObjectMakeRegExp
-        functions to create JavaScript Array, Date, Error, and RegExp objects, respectively.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSImmediate.cpp:
+        * runtime/JSImmediate.h:
 
-        * API/JSObjectRef.cpp: The functions
-        * API/JSObjectRef.h: Function prototype and documentation
-        * JavaScriptCore.exp: Added functions to exported function list
-        * API/tests/testapi.c: Added basic functionality tests.
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/DateConstructor.cpp:
-        Replaced static JSObject* constructDate(ExecState* exec, JSObject*, const ArgList& args)
-        with JSObject* constructDate(ExecState* exec, const ArgList& args).
-        Added static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args) function
+        Reviewed by Mark Rowe.
 
-        * kjs/DateConstructor.h:
-        added prototype for JSObject* constructDate(ExecState* exec, const ArgList& args)
+        Enabled JSVALUE32_64 by default on all platforms other than x86_64 (which uses JSVALUE64).
 
-        * kjs/ErrorConstructor.cpp:
-        removed static qualifier from ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+        * wtf/Platform.h:
 
-        * kjs/ErrorConstructor.h:
-        added prototype for ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+2009-08-02  Kevin Ollivier  <kevino@theolliviers.com>
 
-        * kjs/RegExpConstructor.cpp:
-        removed static qualifier from JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+        Reviewed by Jan Alonzo.
 
-        * kjs/RegExpConstructor.h:
-        added prototype for JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+        Script for building the JavaScriptCore library for wx.
+        https://bugs.webkit.org/show_bug.cgi?id=27619
 
-2008-09-22  Matt Lilek  <webkit@mattlilek.com>
+        * wscript: Added.
 
-        Not reviewed, Windows build fix.
+2009-08-02  Yong Li  <yong.li@torchmobile.com>
 
-        * kjs/Arguments.cpp:
-        * kjs/FunctionPrototype.cpp:
+        Reviewed by George Staikos.
 
-2008-09-22  Sam Weinig  <sam@webkit.org>
+        DateMath depends on strftime and localtime, which need to be imported manually on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=26558
 
-        Reviewed by Darin Adler.
+        * wtf/DateMath.cpp:
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20982
-        Speed up the apply method of functions by special-casing array and 'arguments' objects
+2009-08-01  David Kilzer  <ddkilzer@apple.com>
 
-        1% speedup on v8-raytrace.
+        wtf/Threading.h: added include of Platform.h
 
-        Test: fast/js/function-apply.html
+        Reviewed by Mark Rowe.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::fillArgList):
-        * kjs/Arguments.h:
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncApply):
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::fillArgList):
-        * kjs/JSArray.h:
+        * wtf/Threading.h: Added #include "Platform.h" since this header
+        uses PLATFORM() and other macros.
 
-2008-09-22  Darin Adler  <darin@apple.com>
+2009-08-01  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Sam Weinig.
+        Rubber-stamped by Oliver Hunt.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20993
-          Array.push/pop need optimized cases for JSArray
+        Roll out r46668 as it was misinformed.  ScopeChain is only used with placement new.
 
-        3% or so speedup on DeltaBlue benchmark.
+        * runtime/ScopeChain.h:
 
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncPop): Call JSArray::pop when appropriate.
-        (JSC::arrayProtoFuncPush): Call JSArray::push when appropriate.
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::putSlowCase): Set m_fastAccessCutoff when appropriate, getting
-        us into the fast code path.
-        (JSC::JSArray::pop): Added.
-        (JSC::JSArray::push): Added.
-        * kjs/JSArray.h: Added push and pop.
+        Allow custom memory allocation control for JavaScriptCore's HashMap class
+        http://bugs.webkit.org/show_bug.cgi?id=27871
 
-        * kjs/operations.cpp:
-        (JSC::throwOutOfMemoryError): Don't inline this. Helps us avoid PIC branches.
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/API/JSClassRef.cpp:148.
 
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+        * wtf/RefPtrHashMap.h:
+        (WTF::):
 
-        Reviewed by Cameron Zwarich.
-        
-        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
-        
-        2.2% speedup on EarleyBoyer benchmark.
+        Allow custom memory allocation control for JavaScriptCore's ScopeChain class
+        https://bugs.webkit.org/show_bug.cgi?id=27834
 
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructureID):
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructureID):
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructureID):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::hasInstance):
-        * API/JSValueRef.cpp:
-        (JSValueIsInstanceOfConstructor):
-        * JavaScriptCore.exp:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_instanceof):
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::createStructureID):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::implementsHasInstance):
-
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        Based on initial work by Darin Adler.
-        
-        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
-        - use this to JIT inline code for eq_null and neq_null
-        https://bugs.webkit.org/show_bug.cgi?id=20823
-
-        0.5% speedup on SunSpider
-        ~4% speedup on Richards benchmark
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        (JSC::jsTypeStringForValue):
-        (JSC::jsIsObjectType):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_is_undefined):
-        * VM/Machine.h:
-        * kjs/JSCell.h:
-        * kjs/JSValue.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::create):
-        (JSC::StringObjectThatMasqueradesAsUndefined::createStructureID):
-        * kjs/StructureID.h:
-        (JSC::StructureID::mutableTypeInfo):
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::TypeInfo):
-        (JSC::TypeInfo::masqueradesAsUndefined):
-        * kjs/operations.cpp:
-        (JSC::equal):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::setne_r):
-        (JSC::X86Assembler::setnz_r):
-        (JSC::X86Assembler::testl_i32m):
+        Inherits ScopeChain class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSFunction.h:109.
 
-2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        * runtime/ScopeChain.h:
 
-        Reviewed by Simon.
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Initialize QCoreApplication in kjs binary/Shell.cpp
-        
-        This allows us to use QCoreApplication::instance() to
-        get the main thread in ThreadingQt.cpp
+        Reviewed by Darin Adler.
 
-        * kjs/Shell.cpp:
-        (main):
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading):
+        Allow custom memory allocation control for JavaScriptCore's RegExpConstructorPrivate struct 
+        https://bugs.webkit.org/show_bug.cgi?id=27833
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        Inherits RegExpConstructorPrivate class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/RegExpConstructor.cpp:152.
 
-        - blind attempt to fix non-all-in-one builds
+        * runtime/RegExpConstructor.cpp:
 
-        * kjs/JSGlobalObject.cpp: Added includes of Arguments.h and RegExpObject.h.
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        Reviewed by George Staikos.
 
-        - fix debug build
+        Resurrect the old GetTickCount implementation of currentTime, controlled by WTF_USE_QUERY_PERFORMANCE_COUNTER
+        currentSystemTime taken from older WebKit; currentTime written by Yong Li <yong.li@torchmobile.com>; cleanup by Joe Mason <joe.mason@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27848
 
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition): Use typeInfo().type() instead of m_type.
-        (JSC::StructureID::createCachedPrototypeChain): Ditto.
+        * wtf/CurrentTime.cpp:
+        (WTF::currentSystemTime): get current time with GetCurrentFT
+        (WTF::currentTime): track msec elapsed since first currentSystemTime call using GetTickCount
+        * wtf/Platform.h:
 
-2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+2009-07-31  Ada Chan  <adachan@apple.com>
 
-        Reviewed by Darin Adler.
-        
-        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
-        https://bugs.webkit.org/show_bug.cgi?id=20981
+        Fixes the Windows release-PGO build.
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/Machine.cpp:
-        (JSC::jsIsObjectType):
-        (JSC::Machine::Machine):
-        * kjs/AllInOneFile.cpp:
-        * kjs/JSCell.h:
-        (JSC::JSCell::isObject):
-        (JSC::JSCell::isString):
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSGlobalObject.h:
-        (JSC::StructureID::prototypeForLookup):
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructureID):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::createInheritorID):
-        * kjs/JSObject.h:
-        (JSC::JSObject::createStructureID):
-        * kjs/JSString.h:
-        (JSC::JSString::createStructureID):
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpMatchesArray.h: Added.
-        (JSC::RegExpMatchesArray::getOwnPropertySlot):
-        (JSC::RegExpMatchesArray::put):
-        (JSC::RegExpMatchesArray::deleteProperty):
-        (JSC::RegExpMatchesArray::getPropertyNames):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::create):
-        (JSC::StructureID::typeInfo):
-        * kjs/TypeInfo.h: Added.
-        (JSC::TypeInfo::TypeInfo):
-        (JSC::TypeInfo::type):
-
-2008-09-21  Darin Adler  <darin@apple.com>
+        Reviewed by Jon Honeycutt.
 
-        Reviewed by Cameron Zwarich.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Suppresses the warning about unreachable code that we get by adding "return 0" to WTF::TCMalloc_PageHeap::runScavengerThread().
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread): Fixes the error about the method not returning a value in the release-PGO build.
 
-        - fix crash logging into Gmail due to recent Arguments change
+2009-07-31  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): Fix window where mark() function could
-        see d->extraArguments with uninitialized contents.
-        (JSC::Arguments::mark): Check d->extraArguments for 0 to handle two
-        cases: 1) Inside the constructor before it's initialized.
-        2) numArguments <= numParameters.
+        Change malloc to fastMalloc and free to fastFree in Yarr's RegexInterpreter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27874
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        Use fastMalloc and fastFree instead of malloc and free in RegexInterpreter.cpp's methods.
 
-        - fix loose end from the "duplicate constant values" patch
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): Add a special case for values the
-        hash table can't handle.
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
 
-2008-09-21  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Jan Alonzo.
 
-        Fix the non-AllInOneFile build.
+        Fix compiler warning.
 
-        * kjs/Arguments.cpp: Add missing #include.
+        GCC does not like C++-style comments in preprocessor directives.
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        * wtf/Platform.h:
 
-        Reviewed by Cameron Zwarich and Mark Rowe.
+2009-07-30  John McCall  <rjmccall@apple.com>
 
-        - fix test failure caused by my recent IndexToNameMap patch
+        Reviewed by Gavin Barraclough.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::deleteProperty): Added the accidentally-omitted
-        check of the boolean result from toArrayIndex.
+        Optimize the X86_64 trampolines: avoid the need for filler arguments
+        and move the stub-args area closer to the stack pointer.
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        * jit/JIT.h: adjust patch offsets because of slight code-size change 
+        * jit/JITCode.h:
+        (JSC::JITCode::execute): don't pass filler args
+        * jit/JITStubs.cpp:
+        (ctiTrampoline): (X86_64): push args onto stack, use args directly
+        (ctiVMThrowTrampoline): (X86_64): adjust %rsp by correct displacement
+        (ctiOpThrowNotCaught): (X86_64): adjust %rsp by correct displacement
+        * jit/JITStubs.h:
+        (JITStackFrame): (X86_64): move args area earlier
+        (ctiTrampoline): remove filler args from prototype
 
-        Reviewed by Maciej Stachowiak.
+2009-07-30  Gavin Barraclough  <barraclough@apple.com>
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20975
-          inline immediate-number case of ==
+        Temporarily revert r46618 since this is b0rking on Linux.
 
-        * VM/CTI.h: Renamed emitJumpSlowCaseIfNotImm to
-        emitJumpSlowCaseIfNotImmNum, since the old name was incorrect.
+2009-07-23  Gavin Barraclough  <barraclough@apple.com>
 
-        * VM/CTI.cpp: Updated for new name.
-        (JSC::CTI::privateCompileMainPass): Added op_eq.
-        (JSC::CTI::privateCompileSlowCases): Added op_eq.
+        Reviewed by Oliver Hunt.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_eq): Removed fast case, since it's now
-        compiled.
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
 
-2008-09-21  Peter Gal  <galpter@inf.u-szeged.hu>
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
 
-        Reviewed by Tim Hatcher and Eric Seidel.
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
 
-        Fix the QT/Linux JavaScriptCore segmentation fault.
-        https://bugs.webkit.org/show_bug.cgi?id=20914
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
 
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading): Use currentThread() if
-        platform is not a MAC (like in pre 36541 revisions)
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
 
-        Reviewed by Sam Weinig.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
 
-        * kjs/debugger.h: Removed some unneeded includes and declarations.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
 
-2008-09-21  Darin Adler  <darin@apple.com>
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
 
-        Reviewed by Sam Weinig.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20972
-          speed up Arguments further by eliminating the IndexToNameMap
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
 
-        No change on SunSpider. 1.29x as fast on V8 Raytrace.
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
 
-        * kjs/Arguments.cpp: Moved ArgumentsData in here. Eliminated the
-        indexToNameMap and hadDeletes data members. Changed extraArguments into
-        an OwnArrayPtr and added deletedArguments, another OwnArrayPtr.
-        Replaced numExtraArguments with numParameters, since that's what's
-        used more directly in hot code paths.
-        (JSC::Arguments::Arguments): Pass in argument count instead of ArgList.
-        Initialize ArgumentsData the new way.
-        (JSC::Arguments::mark): Updated.
-        (JSC::Arguments::getOwnPropertySlot): Overload for the integer form so
-        we don't have to convert integers to identifiers just to get an argument.
-        Integrated the deleted case with the fast case.
-        (JSC::Arguments::put): Ditto.
-        (JSC::Arguments::deleteProperty): Ditto.
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
 
-        * kjs/Arguments.h: Minimized includes. Made everything private. Added
-        overloads for the integral property name case. Eliminated mappedIndexSetter.
-        Moved ArgumentsData into the .cpp file.
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/IndexToNameMap.cpp: Emptied out and prepared for deletion.
-        * kjs/IndexToNameMap.h: Ditto.
+        Reviewed by Gavin Barraclough.
 
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::createArgumentsObject): Elminated ArgList.
+        Fixed failing tests seen on Windows buildbot.
 
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        Removed IndexToNameMap.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Use "int" instead of "bool" to guarantee a 32-bit result,
+        regardless of compiler. gcc on mac uses 32-bit values for bool,
+        but gcc on linux and MSVC on Windows use 8-bit values.
 
-2008-09-21  Darin Adler  <darin@apple.com>
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): One more tweak: Wrote this in a slightly
-        clearer style.
+        Windows build fix: added missing symbols on Windows.
 
-2008-09-21  Judit Jasz  <jasy@inf.u-szeged.hu>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Reviewed and tweaked by Darin Adler.
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20645
-          Elminate duplicate constant values in CodeBlocks.
+        Windows build fix: removed stale symbols on Windows.
 
-        Seems to be a wash on SunSpider.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): Use m_numberMap and m_stringMap to guarantee
-        we emit the same JSValue* for identical numbers and strings.
-        * VM/CodeGenerator.h: Added overload of emitLoad for const Identifier&.
-        Add NumberMap and IdentifierStringMap types and m_numberMap and m_stringMap.
-        * kjs/nodes.cpp:
-        (JSC::StringNode::emitCode): Call the new emitLoad and let it do the
-        JSString creation.
+=== End merge of nitro-extreme branch 2009-07-30 ===
 
-2008-09-21  Paul Pedriana  <webkit@pedriana.com>
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed and tweaked by Darin Adler.
+        Fixed a post-review typo in r46066 that caused tons of test failures.
+        
+        SunSpider reports no change.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=16925
-          Fixed lack of Vector buffer alignment for both GCC and MSVC.
-          Since there's no portable way to do this, for now we don't support
-          other compilers.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize the full vector capacity, to avoid
+        uninitialized members at the end.
 
-        * wtf/Vector.h: Added WTF_ALIGH_ON, WTF_ALIGNED, AlignedBufferChar, and AlignedBuffer.
-        Use AlignedBuffer insteadof an array of char in VectorBuffer.
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>
+        Windows WebKit build fix: Added some missing exports.
 
-        Reviewed by Darin Adler.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        - https://bugs.webkit.org/show_bug.cgi?id=19408
-          Add lightweight constant folding to the parser for *, /, + (only for numbers), <<, >>, ~ operators.
-
-        1.008x as fast on SunSpider.
-
-        * kjs/grammar.y:
-        (makeNegateNode): Fold if expression is a number > 0.
-        (makeBitwiseNotNode): Fold if expression is a number.
-        (makeMultNode): Fold if expressions are both numbers.
-        (makeDivNode): Fold if expressions are both numbers.
-        (makeAddNode): Fold if expressions are both numbers.
-        (makeLeftShiftNode): Fold if expressions are both numbers.
-        (makeRightShiftNode): Fold if expressions are both numbers.
-
-2008-09-21  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver.
-        
-        - speed up === operator by generating inline machine code for the fast paths
-        https://bugs.webkit.org/show_bug.cgi?id=20820
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumber):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumbers):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediates):
-        (JSC::CTI::emitTagAsBoolImmediate):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_stricteq):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::sete_r):
-        (JSC::X86Assembler::setz_r):
-        (JSC::X86Assembler::movzbl_rr):
-        (JSC::X86Assembler::emitUnlinkedJnz):
+2009-07-17  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Maciej Stachowiak.
+        Get the branch working on windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27391
+        
+        SunSpider says 0.3% faster.
 
-        Free memory allocated for extra arguments in the destructor of the
-        Arguments object.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Updated
+        MSVC export lists to fix linker errors.
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::~Arguments):
-        * kjs/Arguments.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added / removed
+        new / old project files.
 
-2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Used #pragma pack to tell
+        MSVC that these structures represent actual memory layout, and should not be
+        automatically aligned. Changed the return value load to load a 64bit quantity
+        into the canonical registers.
 
-        Reviewed by Maciej Stachowiak.
+        * jit/JIT.h: Moved OBJECT_OFFSETOF definition to StdLibExtras.h because
+        it's needed by more than just the JIT, and it supplements a standard library
+        macro (offsetof).
 
-        Bug 20815: 'arguments' object creation is non-optimal
-        <https://bugs.webkit.org/show_bug.cgi?id=20815>
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame): Fixed an incorrectly signed
+        cast to resolve an MSVC warning.
 
-        Fix our inefficient way of creating the arguments object by only
-        creating named properties for each of the arguments after a use of the
-        'delete' statement. This patch also speeds up access to the 'arguments'
-        object slightly, but it still does not use the array fast path for
-        indexed access that exists for many opcodes.
+        * jit/JITStubs.h: Used #pragma pack to tell MSVC that these structures
+        represent actual memory layout, and should not be automatically aligned. 
 
-        This is about a 20% improvement on the V8 Raytrace benchmark, and a 1.5%
-        improvement on the Earley-Boyer benchmark, which gives a 4% improvement
-        overall.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Replaced memset_pattern8 with a for loop, since
+        memset_pattern8 is not portable. (I verified that this version of the loop
+        gives the best performance / generated code in GCC.)
 
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::mark):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * kjs/Arguments.h:
-        (JSC::Arguments::ArgumentsData::ArgumentsData):
-        * kjs/IndexToNameMap.h:
-        (JSC::IndexToNameMap::size):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::createArgumentsObject):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::uncheckedSymbolTableGet):
-        (JSC::JSActivation::uncheckedSymbolTableGetValue):
-        (JSC::JSActivation::uncheckedSymbolTablePut):
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::numParameters):
-
-2008-09-20  Darin Adler  <darin@apple.com>
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Removed accidental usage of FIELD_OFFSET --
+        OBJECT_OFFSETOF is our new macro name. (FIELD_OFFSET conflicts with a
+        definition in winnt.h.)
 
-        Reviewed by Mark Rowe.
+        * runtime/JSValue.cpp: Added some headers needed by non-all-in-one builds.
+        
+        * runtime/JSValue.h:
+        (JSC::JSValue::): Made the tag signed, to match MSVC's signed enum values.
+        (GCC doesn't seem to care one way or the other.)
 
-        - fix crash seen on buildbot
+        * wtf/MainThread.cpp: Moved the StdLibExtras.h #include -- I did this a
+        while ago to resolve a conflict with winnt.h. I can't remember if it's truly
+        still needed, but what the heck.
 
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::mark): Add back mark of arrayPrototype,
-        deleted by accident in my recent check-in.
+        * wtf/StdLibExtras.h: Moved OBJECT_OFFSETOF definition here.
 
-2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
 
-        Not reviewed, build fix.
+        Reviewed by Sam Weinig (?).
         
-        - speculative fix for non-AllInOne builds
+        Fixed an assertion seen during the stress test.
+        
+        Don't assume that, if op1 is constant, op2 is not, and vice versa. Sadly,
+        not all constants get folded.
 
-        * kjs/operations.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
 
-2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Sam Weinig.
         
-        - assorted optimizations to === and !== operators
-        (work towards <https://bugs.webkit.org/show_bug.cgi?id=20820>)
+        Include op_convert_this in result caching.
         
-        2.5% speedup on earley-boyer test
+        No change on SunSpider or v8.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_stricteq): Use inline version of
-        strictEqualSlowCase; remove unneeded exception check.
-        (JSC::Machine::cti_op_nstricteq): ditto
-        * kjs/operations.cpp:
-        (JSC::strictEqual): Use strictEqualSlowCaseInline
-        (JSC::strictEqualSlowCase): ditto
-        * kjs/operations.h:
-        (JSC::strictEqualSlowCaseInline): Version of strictEqualSlowCase that can be inlined,
-        since the extra function call indirection is a lose for CTI.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
 
-2008-09-20  Darin Adler  <darin@apple.com>
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Made the op_convert_this JIT stub return an EncodedJSValue, so
+        to maintain the result caching contract that { tag, payload } can be
+        found in { regT1, regT0 }.
 
-        Reviewed by Maciej Stachowiak.
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
 
-        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
+        Reviewed by Sam Weinig.
+        
+        Implemented result chaining.
+        
+        1% faster on SunSpider. 4%-5% faster on v8.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rr): Added an optimization to eliminate
+        no-op mov instructions, to simplify chaining.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h: Added data members and helper functions for recording
+        chained results. We record both a mapping from virtual to machine register
+        and the opcode for which the mapping is valid, to help ensure that the
+        mapping isn't used after the mapped register has been stomped by other
+        instructions.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase): Chain function call results.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::isLabeled):
+        (JSC::JIT::map):
+        (JSC::JIT::unmap):
+        (JSC::JIT::isMapped):
+        (JSC::JIT::getMappedPayload):
+        (JSC::JIT::getMappedTag): Use helper functions when loading virtual
+        registers into machine registers, in case the loads can be eliminated
+        by chaining.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch): Chain results from these opcodes.
+
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call): Load the profiler into regT2 to
+        avoid stomping a chained result.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id): Chain results from these opcodes.
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Always use { regT1, regT0 }, to facilitate
+        chaining.
+
+        (JSC::JITStubCall::call): Unmap all mapped registers, since our callee
+        stub might stomp them.
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Don't reload values in emitBinaryDoubleOp.
+
+        SunSpider reports a 0.6% progression. 
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
 
-        This also includes some optimizations that make the change an overall
-        small speedup. Without those it was a bit of a slowdown.
+        Reviewed by Geoffrey Garen.
 
-        * API/JSCallbackConstructor.cpp:
-        (JSC::JSCallbackConstructor::JSCallbackConstructor): Take a structure.
-        * API/JSCallbackConstructor.h: Ditto.
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::JSCallbackFunction): Pass a structure.
-        * API/JSCallbackObject.h: Take a structure.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
+        Convert op_div to load op1 and op2 up front.
 
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::prototype): Pass in a structure. Call setPrototype
-        if there's a custom prototype involved.
-        * API/JSObjectRef.cpp:
-        (JSObjectMake): Ditto.
-        (JSObjectMakeConstructor): Pass in a structure.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/Machine.cpp:
-        (JSC::jsLess): Added a special case for when both arguments are strings.
-        This avoids converting both strings to with UString::toDouble.
-        (JSC::jsLessEq): Ditto.
-        (JSC::Machine::privateExecute): Pass in a structure.
-        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
-        (JSC::Machine::cti_op_new_regexp): Ditto.
-        (JSC::Machine::cti_op_is_string): Ditto.
-        * VM/Machine.h: Made isJSString public so it can be used in the CTI.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): Pass in a structure.
-
-        * kjs/JSCell.h: Mark constructor explicit.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::markIfNeeded): Added an overload for marking structures.
-        (JSC::JSGlobalObject::reset): Eliminate code to set data members to
-        zero. We now do that in the constructor, and we no longer use this
-        anywhere except in the constructor. Added code to create structures.
-        Pass structures rather than prototypes when creating objects.
-        (JSC::JSGlobalObject::mark): Mark the structures.
-
-        * kjs/JSGlobalObject.h: Removed unneeded class declarations.
-        Added initializers for raw pointers in JSGlobalObjectData so
-        everything starts with a 0. Added structure data and accessor
-        functions.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
 
-        * kjs/JSImmediate.cpp:
-        (JSC::JSImmediate::nonInlineNaN): Added.
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::toDouble): Rewrote to avoid PIC branches.
+2009-07-01  Sam Weinig  <sam@webkit.org>
 
-        * kjs/JSNumberCell.cpp:
-        (JSC::jsNumberCell): Made non-inline to avoid PIC branches
-        in functions that call this one.
-        (JSC::jsNaN): Ditto.
-        * kjs/JSNumberCell.h: Ditto.
+        Reviewed by Geoffrey Garen.
 
-        * kjs/JSObject.h: Removed constructor that takes a prototype.
-        All callers now pass structures.
+        Don't emit code in emitBinaryDoubleOp if code is unreachable, observable
+        via an empty (unlinked) jumplist passed in.  This only effects op_jnless
+        and op_jnlesseq at present.
 
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * kjs/ArrayConstructor.h:
-        * kjs/ArrayPrototype.cpp:
-        (JSC::ArrayPrototype::ArrayPrototype):
-        * kjs/ArrayPrototype.h:
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.cpp:
-        (JSC::BooleanObject::BooleanObject):
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * kjs/BooleanPrototype.h:
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        (JSC::constructDate):
-        * kjs/DateConstructor.h:
-        * kjs/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        (JSC::DatePrototype::DatePrototype):
-        * kjs/DatePrototype.h:
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        (JSC::constructError):
-        * kjs/ErrorConstructor.h:
-        * kjs/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * kjs/ErrorInstance.h:
-        * kjs/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * kjs/ErrorPrototype.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        (JSC::FunctionPrototype::addFunctionProperties):
-        * kjs/FunctionPrototype.h:
-        * kjs/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        * kjs/GlobalEvalFunction.h:
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::constructEmptyArray):
-        (JSC::constructArray):
-        * kjs/JSArray.h:
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::construct):
-        * kjs/JSObject.cpp:
-        (JSC::constructEmptyObject):
-        * kjs/JSString.cpp:
-        (JSC::StringObject::create):
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        (JSC::NativeErrorConstructor::construct):
-        * kjs/NativeErrorConstructor.h:
-        * kjs/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * kjs/NativeErrorPrototype.h:
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        (JSC::NumberObject::NumberObject):
-        (JSC::constructNumber):
-        (JSC::constructNumberFromImmediateNumber):
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * kjs/NumberPrototype.h:
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::constructObject):
-        * kjs/ObjectConstructor.h:
-        * kjs/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::ObjectPrototype):
-        * kjs/ObjectPrototype.h:
-        * kjs/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * kjs/PrototypeFunction.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        (JSC::RegExpMatchesArray::RegExpMatchesArray):
-        (JSC::constructRegExp):
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::RegExpObject):
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * kjs/RegExpPrototype.h:
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        (JSC::constructWithStringConstructor):
-        * kjs/StringConstructor.h:
-        * kjs/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
-        * kjs/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * kjs/StringPrototype.h:
-        Take and pass structures.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
 
-2008-09-19  Alp Toker  <alp@nuanti.com>
+2009-07-01  Geoffrey Garen  <ggaren@apple.com>
 
-        Build fix for the 'gold' linker and recent binutils. New behaviour
-        requires that we link to used libraries explicitly.
+        Reviewed by Sam Weinig.
 
-        * GNUmakefile.am:
+        Converted op_mod to put { tag, payload } in { regT1, regT0 }, and
+        tidied up its constant case.
+        
+        SunSpider reports a 0.2% regression, but a micro-benchmark of op_mod
+        shows a 12% speedup, and the SunSpider test that uses op_mod most should
+        benefit a lot from result caching in the end, since it almost always
+        performs (expression) % constant.
 
-2008-09-19  Sam Weinig  <sam@webkit.org>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
 
-        Roll r36694 back in.  It did not cause the crash.
+2009-06-30  Sam Weinig  <sam@webkit.org>
 
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::create):
-        (JSC::PropertyNameArrayData::propertyNameVector):
-        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
-        (JSC::PropertyNameArrayData::cachedPrototypeChain):
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::PropertyNameArrayData):
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::setData):
-        (JSC::PropertyNameArray::data):
-        (JSC::PropertyNameArray::releaseData):
-        * kjs/StructureID.cpp:
-        (JSC::structureIDChainsAreEqual):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::createCachedPrototypeChain):
-        * kjs/StructureID.h:
+        Reviewed by Geoffrey Garen.
 
-2008-09-19  Sam Weinig  <sam@webkit.org>
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
 
-        Roll out r36694.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
 
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::releaseIdentifiers):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/StructureID.h:
-        (JSC::StructureID::clearEnumerationCache):
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-19  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Maciej Stachowiak.
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }, and added a case for subtract constant.
+        
+        SunSpider says no change. v8 says 0.3% slower.
 
-        Improve peformance of local variable initialisation.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitSlow_op_sub):
 
-        Pull local and constant initialisation out of slideRegisterWindowForCall
-        and into its own opcode.  This allows the JIT to generate the initialisation
-        code for a function directly into the instruction stream and so avoids a few
-        branches on function entry.
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
 
-        Results a 1% progression in SunSpider, particularly in a number of the bitop
-        tests where the called functions are very fast. 
+        Reviewed by Sam Weinig.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::emitInitialiseRegister):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall):
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
+        Remove more uses of addressFor(), load double constants directly from
+        the constantpool in the CodeBlock, rather than from the register file.
 
-2008-09-19  Sam Weinig  <sam@webkit.org>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
 
-        Reviewed by Darin Adler.
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20928
-        Speed up JS property enumeration by caching entire PropertyNameArray
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in postfix ops, where we would treat x = x++ and x = x--
+        as a no-op, even if x were not an int, and the ++/-- could have side-effects.
 
-        1.3% speedup on Sunspider, 30% on string-fasta.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
 
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::create):
-        (JSC::PropertyNameArrayData::propertyNameVector):
-        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
-        (JSC::PropertyNameArrayData::cachedPrototypeChain):
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::PropertyNameArrayData):
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::setData):
-        (JSC::PropertyNameArray::data):
-        (JSC::PropertyNameArray::releaseData):
-        * kjs/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * kjs/StructureID.cpp:
-        (JSC::structureIDChainsAreEqual):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::createCachedPrototypeChain):
-        * kjs/StructureID.h:
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Sam Weinig.
+        
+        Converted some arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
+        
+        SunSpider says 0.7% faster. v8 says no change.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::getOperandConstantImmediateInt):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Sam Weinig.
 
-        Fix a mismatched new[]/delete in JSObject::allocatePropertyStorage
+        Start removing cases of addressFor().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitStoreDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in my last patch with regression fixed.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out my last patch because it was a 2% SunSpider regression.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "Sam Weinig" Barraclough.
+        
+        Standardized the rest of our opcodes to put { tag, payload } in
+        { regT1, regT0 } where possible.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::allocatePropertyStorage): Spotted by valgrind.
+        Reviewed by Geoffrey Garen.
 
-2008-09-19  Darin Adler  <darin@apple.com>
+        Replace calls to store32(tagFor()) and store32(payloadFor())
+        with emitStoreInt32(), emitStoreBool(), and emitStoreCell().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitStore):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
+        
+        Standardized the rest of the property access instructions to put { tag,
+        payload } in { regT1, regT0 }.
 
-        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        * JavaScriptCore.exp: Exported constructEmptyObject for use in WebCore.
-
-        * kjs/JSGlobalObject.h: Changed the protected constructor to take a
-        structure instead of a prototype.
+        Small v8 speedup, 0.2% SunSpider slowdown.
 
-        * kjs/JSVariableObject.h: Removed constructor that takes a prototype.
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::patchPutByIdReplace):
 
-2008-09-19  Julien Chaffraix  <jchaffraix@pleyo.com>
+2009-06-29  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Alexey Proskuryakov.
+        Reviewed by Gavin Barraclough.
 
-        Use the template hoisting technique on the RefCounted class. This reduces the code bloat due to
-        non-template methods' code been copied for each instance of the template.
-        The patch splits RefCounted between a base class that holds non-template methods and attributes
-        and the template RefCounted class that keeps the same functionnality.
+        Various cleanups.
+        - Use fpRegT* instead of X86::xmm*.
+        - Use a switch statement in emitBinaryDoubleOp instead of a bunch of
+          if/elses.
 
-        On my Linux with gcc 4.3 for the Gtk port, this is:
-        - a ~600KB save on libwebkit.so in release.
-        - a ~1.6MB save on libwebkit.so in debug.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
 
-        It is a wash on Sunspider and a small win on Dromaeo (not sure it is relevant).
-        On the whole, it should be a small win as we reduce the compiled code size and the only
-        new function call should be inlined by the compiler.
+2009-06-29  Sam Weinig  <sam@webkit.org>
 
-        * wtf/RefCounted.h:
-        (WTF::RefCountedBase::ref): Copied from RefCounted.
-        (WTF::RefCountedBase::hasOneRef): Ditto.
-        (WTF::RefCountedBase::refCount): Ditto.
-        (WTF::RefCountedBase::RefCountedBase): Ditto.
-        (WTF::RefCountedBase::~RefCountedBase): Ditto.
-        (WTF::RefCountedBase::derefBase): Tweaked from the RefCounted version to remove
-        template section.
-        (WTF::RefCounted::RefCounted):
-        (WTF::RefCounted::deref): Small wrapper around RefCountedBase::derefBase().
-        (WTF::RefCounted::~RefCounted): Keep private destructor.
+        Reviewed by Geoffrey Garen.
 
-2008-09-18  Darin Adler  <darin@apple.com>
+        Add inline code dealing with doubles for op_jfalse and op_jtrue.
 
-        Reviewed by Maciej Stachowiak.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::zeroDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
 
-        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
+2009-06-28  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/lookup.h: Removed things here that were used only in WebCore:
-        cacheGlobalObject, JSC_DEFINE_PROTOTYPE, JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE,
-        and JSC_IMPLEMENT_PROTOTYPE.
+        Reviewed by Sam Weinig.
 
-2008-09-18  Darin Adler  <darin@apple.com>
+        Standardized op_get_by_id to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report maybe 0.2%-0.4% regressions, but the optimization
+        this enables will win much more than that back.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-26  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Maciej Stachowiak.
+        
+        Standardized op_call to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report no change.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20927
-          simplify/streamline the code to turn strings into identifiers while parsing
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
 
-        * kjs/grammar.y: Get rid of string from the union, and use ident for STRING as
-        well as for IDENT.
+2009-06-26  Sam Weinig  <sam@webkit.org>
 
-        * kjs/lexer.cpp:
-        (JSC::Lexer::lex): Use makeIdentifier instead of makeUString for String.
-        * kjs/lexer.h: Remove makeUString.
+        Reviewed by Geoffrey Garen.
 
-        * kjs/nodes.h: Changed StringNode to hold an Identifier instead of UString.
+        Handle multiplying by zero a little better by
+        inlining the case that both operands are non-negative
+        into the slowpath.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::keyForCharacterSwitch): Updated since StringNode now holds an Identifier.
-        (JSC::prepareJumpTableForStringSwitch): Ditto.
-        * kjs/nodes.cpp:
-        (JSC::StringNode::emitCode): Ditto. The comment from here is now in the lexer.
-        (JSC::processClauseList): Ditto.
-        * kjs/nodes2string.cpp:
-        (JSC::StringNode::streamTo): Ditto.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchOr32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
 
-2008-09-18  Sam Weinig  <sam@webkit.org>
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
 
-        Fix style.
+        Reviewed by Sam Weinig.
+        
+        Optimize x++ to ++x inside for loops.
+        
+        Sadly, no measurable speedup, but this should help with result chaining.
 
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
+        * parser/Nodes.cpp:
+        (JSC::ForNode::emitBytecode):
 
-2008-09-18  Oliver Hunt  <oliver@apple.com>
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
 
-        Bug 20911: REGRESSION(r36480?): Reproducible assertion failure below derefStructureIDs 64-bit JavaScriptCore
-        <https://bugs.webkit.org/show_bug.cgi?id=20911>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
 
-        The problem was simply caused by the int constructor for Instruction
-        failing to initialise the full struct in 64bit builds.
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
 
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
 
-2008-09-18  Darin Adler  <darin@apple.com>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
 
-        - fix release build
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
 
-        * wtf/RefCountedLeakCounter.cpp: Removed stray "static".
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
 
-2008-09-18  Darin Adler  <darin@apple.com>
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
 
-        * kjs/JSGlobalObject.h: Tiny style guideline tweak.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
 
-2008-09-18  Darin Adler  <darin@apple.com>
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Sam Weinig (sort of, maybe).
+        
+        Fixed some ASSERTs in http/tests/security.
+        
+        These ASSERTs were introduced by http://trac.webkit.org/changeset/45057,
+        but the underlying problem was actually older. http://trac.webkit.org/changeset/45057
+        just exposed the problem by enabling optimization in more cases.
+        
+        The ASSERTs fired because we tested PropertySlot::slotBase() for validity,
+        but slotBase() ASSERTs if it's invalid, so we would ASSERT before
+        the test could happen. Solution: Remove the ASSERT. Maybe it was valid
+        once, but it clearly goes against a pattern we've deployed of late.
+        
+        The underlying problem was that WebCore would re-use a PropertySlot in
+        the case of a forwarding access, and the second use would not completely
+        overwrite the first use. Solution: Make sure to overwrite m_offset when
+        setting a value on a PropertySlot. (Other values already get implicitly
+        overwritten during reuse.)
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        (JSC::PropertySlot::setUndefined):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::clearOffset):
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20925
-          LEAK messages appear every time I quit
+2009-06-24  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.exp: Updated, and also added an export
-        needed for future WebCore use of JSC::StructureID.
+        Reviewed by Geoff Garen.
 
-        * wtf/RefCountedLeakCounter.cpp:
-        (WTF::RefCountedLeakCounter::suppressMessages): Added.
-        (WTF::RefCountedLeakCounter::cancelMessageSuppression): Added.
-        (WTF::RefCountedLeakCounter::RefCountedLeakCounter): Tweaked a bit.
-        (WTF::RefCountedLeakCounter::~RefCountedLeakCounter): Added code to
-        log the reason there was no leak checking done.
-        (WTF::RefCountedLeakCounter::increment): Tweaked a bit.
-        (WTF::RefCountedLeakCounter::decrement): Ditto.
+        Enable JIT_OPTIMIZE_METHOD_CALLS on the branch, implementation matches current implemenatation in ToT.
 
-        * wtf/RefCountedLeakCounter.h: Replaced setLogLeakMessages with two
-        new functions, suppressMessages and cancelMessageSuppression. Also
-        added m_ prefixes to the data member names.
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
 
-2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20437
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
 
-        Add a proper #define to define which XML Parser implementation to use. Client
-        code can use #if USE(QXMLSTREAM) to decide if the Qt XML StreamReader
-        implementation is going to be used.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
 
-        * wtf/Platform.h:
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-18  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Maciej Stachowiak.
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching -- including removing my old enemy, op_resolve_function, because
+        it was non-standard, and removing it felt better than helping it limp along.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
 
-        Make a Unicode non-breaking space count as a whitespace character in
-        PCRE. This change was already made in WREC, and it fixes one of the
-        Mozilla JS tests. Since it is now fixed in PCRE as well, we can check
-        in a new set of expected test results.
+        Reviewed by Sam Weinig.
+        
+        Bit off a tiny bit of standardizing opcode behavior to help with result
+        caching.
+        
+        0.6% SunSpider speedup. 0.3% v8 speedup.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad): Accomodate a base register that overlaps with payload
+        by loading tag before payload, to avoid stomping base/payload.
 
-        * pcre/pcre_internal.h:
-        (isSpaceChar):
-        * tests/mozilla/expected.html:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov): Abide by the standard "tag in regT1, payload in
+        regT0" semantics.
 
-2008-09-18  Stephanie Lewis  <slewis@apple.com>
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var): Ditto. Also, removed some irrelevent
+        loads while I was at it. The global object's "d" pointer never changes
+        after construction.
 
-        Reviewed by Mark Rowe and Maciej Stachowiak.
+2009-06-23  Gavin Barraclough  <barraclough@apple.com>
 
-        add an option use arch to specify which architecture to run.
+        Reviewed by Sam Weinig.
 
-        * tests/mozilla/jsDriver.pl:
+        Remove 'arguments' field from Register union (again).
+        This time do so without breaking tests (radical, I know).
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::init):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        (JSC::Register::arguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
 
-2008-09-17  Oliver Hunt  <oliver@apple.com>
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
 
-        Correctly restore argument reference prior to SFX runtime calls.
+        Reviewed by Sam Weinig.
         
-        Reviewed by Steve Falkenburg.
+        Removed some result register tracking cruft in preparation for a new
+        result tracking mechanism.
+        
+        SunSpider reports no change.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst): No need to track jump targets in
+        machine code; we already do this in bytecode.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::emitTimeoutCheck): Make sure to save and restore the result
+        registers, so an opcode with a timeout check can still benefit from result
+        register caching.
+
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases): Removed calls to killLastResultRegister()
+        in preparation for something new.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_sret):
+        (JSC::JIT::emit_op_jmp_scopes): ditto
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument): added a mechanism for reloading an argument
+        you passed to a JIT stub, for use in emitTimeoutCheck.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
 
-2008-09-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Maciej Stachowiak.
+        Remove now-useless inplace variants of binary ops.
 
-        Bug 20876: REGRESSION (r36417, r36427): fast/js/exception-expression-offset.html fails
-        <https://bugs.webkit.org/show_bug.cgi?id=20876>
-
-        r36417 and r36427 caused an get_by_id opcode to be emitted before the
-        instanceof and construct opcodes, in order to enable inline caching of
-        the prototype property. Unfortunately, this regressed some tests dealing
-        with exceptions thrown by 'instanceof' and the 'new' operator. We fix
-        these problems by detecting whether an "is not an object" exception is
-        thrown before op_instanceof or op_construct, and emit the proper
-        exception in those cases.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAnObjectError):
-        * VM/ExceptionHelpers.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::getOpcode):
-        (JSC::Machine::privateExecute):
-        * VM/Machine.h:
-        * kjs/nodes.cpp:
-        (JSC::NewExprNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emit_op_mul):
 
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+2009-06-23  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Geoffrey Garen.
 
-        JIT generation cti_op_construct_verify.
+        Move off memory operands to aid in re-enabling result caching.
+
+        - No regression measured.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_to_jsnumber):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
         
-        Quarter to half percent progression on v8-tests.
-        Roughly not change on SunSpider (possible minor progression).
+        Fixed some missing and/or misplaced labels in bytecode generation, so
+        we don't have to work around them in JIT code generation.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        * VM/Machine.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        * parser/Nodes.cpp:
+        (JSC::TryNode::emitBytecode):
 
-2008-09-15  Steve Falkenburg  <sfalken@apple.com>
+2009-06-22  Geoffrey Garen  <ggaren@apple.com>
 
-        Improve timer accuracy for JavaScript Date object on Windows.
-        
-        Use a combination of ftime and QueryPerformanceCounter.
-        ftime returns the information we want, but doesn't have sufficient resolution.
-        QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
-        To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use
-        QueryPerformanceCounter by itself, adding the delta to the saved ftime.  We re-sync to
-        correct for drift if the low-res and high-res elapsed time between calls differs by more
-        than twice the low-resolution timer resolution.
+        Reviewed by Sam Weinig.
         
-        QueryPerformanceCounter may be inaccurate due to a problems with:
-        - some PCI bridge chipsets (http://support.microsoft.com/kb/274323)
-        - BIOS bugs (http://support.microsoft.com/kb/895980/)
-        - BIOS/HAL bugs on multiprocessor/multicore systems (http://msdn.microsoft.com/en-us/library/ms644904.aspx)
+        For member function calls, emit "this" directly into the "this" slot
+        for the function call, instead of moving it there later. This reduces
+        time spent in op_mov during certain calls, like "a.b.c()".
         
-        Reviewed by Darin Adler.
+        1%-2% speedup on v8, mostly richards and delta-blue.
 
-        * kjs/DateMath.cpp:
-        (JSC::highResUpTime):
-        (JSC::lowResUTCTime):
-        (JSC::qpcAvailable):
-        (JSC::getCurrentUTCTimeWithMicroseconds):
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
 
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+2009-06-22  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Sam Weinig.
 
-        Implement JIT generation of CallFrame initialization, for op_call.
+        Remove 'arguments' field from Register union.  Having JSCell derived types in the union is
+        dangerous since it opens the possibility for the field to be written as a raw pointer but
+        then read as a JSValue.  This will lead to statle data being read for the tag, which may
+        be dangerous.  Having removed Arguments* types form Register, all arguments objects must
+        always explicitly be stored in the register file as JSValues.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
 
-        1% sunspider 2.5% v8-tests.
+2009-06-03  Sam Weinig  <sam@webkit.org>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_call_NotJSFunction):
+        Reviewed by Geoffrey Garen.
 
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+        Add back known this value optimization by abstracting
+        slow case if not JSCell jumps.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+
+2009-06-01  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Sam Weinig.
+        
+        Fixed some of the regression in crypto-aes.js. (8.5% speedup in
+        crypto-aes.js.)
+        
+        SunSpider reports no change overall.
+        
+        Division was producing double results, which took the slow path through
+        array access code.
+        
+        Strangely, all my attempts at versions of this patch that modified array
+        access code to accept ints encoded as doubles along the fast or slow paths
+        were regressions. So I did this instead.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div): When dividing an int by an int, go ahead and try
+        to turn the result into an int. Don't just do int division, though, because
+        testing shows it to be slower than SSE double division, and the corner
+        cases are pretty complicated / lengthy on top of that. Also, don't try
+        to canonicalize division of known tiny numerators into ints, since that's a
+        waste of time.
+
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
 
-        Optimizations for op_call in CTI.  Move check for (ctiCode == 0) into JIT code,
-        move copying of scopeChain for CodeBlocks that needFullScopeChain into head of
-        functions, instead of checking prior to making the call.
+        Reviewed by Oliver Hunt.
+        
+        Fixed a regression caused by my recent fix for NaN.
 
-        3% on v8-tests (4% on richards, 6% in delta-blue)
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): Actually do the comparison in reverse
+        order, like the ChangeLog said we would, bokay?
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_vm_updateScopeChain):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        Reviewed by Sam Weinig and Oliver Hunt.
+        
+        Fixed two edge cases in %:
+        
+        - Don't do -2147483648 % x as a fast case, since you might do -2147483648 % -1,
+        which will signal a hardware exception due to overflow.
 
-        Fix the QtWebKit/Mac build
+        - In the case of a zero remainder, be sure to store negative zero if the
+        dividend was zero.
+        
+        SunSpider reports no change.
 
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading): use QCoreApplication to get the main thread
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
 
-2008-09-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Maciej Stachowiak.
+        
+        Fixed a regression when comparing to NaN.
 
-        Bug 20857: REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in RegisterID::deref()
-        <https://bugs.webkit.org/show_bug.cgi?id=20857>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): For op_jnless and op_jnless_eq, do the
+        comparison in reverse order, and jump if the result is below or 
+        below-or-equal. This ensures that we do jump in the case of NaN.
 
-        Fix a problem stemming from the slightly unsafe behaviour of the
-        CodeGenerator::finalDestination() method by putting the "func" argument
-        of the emitConstruct() method in a RefPtr in its caller. Also, add an
-        assertion guaranteeing that this is always the case.
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
 
-        CodeGenerator::finalDestination() is still incorrect and can cause
-        problems with a different allocator; see bug 20340 for more details.
+        Reviewed by Oliver Hunt.
+        
+        SunSpider says no change.
+        
+        Fixed regressions in fast/js/var-declarations-shadowing.html and
+        fast/js/equality.html, caused by recent == and != optimizations.
 
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct):
-        * kjs/nodes.cpp:
-        (JSC::NewExprNode::emitCode):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq): Don't treat "compare to string" as always
+        numeric or string comparison. If the second operand is an object, you
+        need to ToPrimitive it, and start all over again. Also, I wrote out each
+        of the possible cases explicitly, to cut down on redundant branching.
 
-2008-09-16  Alice Liu  <alice.liu@apple.com>
+2009-05-25  Sam Weinig  <sam@webkit.org>
 
-        build fix.
+        Reviewed by Mark Rowe.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
+        Fix bug in fast/js/constant-folding.html where we were not negating
+        -0 properly.
 
-2008-09-16  Gavin Barraclough  <barraclough@apple.com>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
 
-        Reviewed by Geoff Garen.
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
 
-        CTI code generation for op_ret.  The majority of the work
-        (updating variables on the stack & on exec) can be performed
-        directly in generated code.
+        Reviewed by Oliver Hunt.
+        
+        Refactored new slow case codegen for == and !=.
+        
+        SunSpider reports no change, maybe a tiny speedup.
 
-        We still need to check, & to call out to C-code to handle
-        activation records, profiling, and full scope chains.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq): Made a vptr comparison a *Ptr operation,
+        instead of *32, to make it portable to 64bit. Reorganized the string
+        and generic cases to make their control flow a little clearer.
 
-        +1.5% Sunspider, +5/6% v8 tests.
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_ret_activation):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        * VM/Machine.h:
+        Reviewed by Maciej Stachowiak.
+        
+        Optimized == and != for our new value representation -- especially for strings.
+        
+        14% speedup on date-format-tofte.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_eq_strings):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSValue.h:
 
-2008-09-16  Dimitri Glazkov  <dglazkov@chromium.org>
+2009-05-22  Sam Weinig  <sam@webkit.org>
 
-        Fix the Windows build.
+        Reviewed by Gavin Barraclough.
 
-        Add some extra parentheses to stop MSVC from complaining so much.
+        Fix non-SSE enabled builds.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        * kjs/operations.cpp:
-        (JSC::strictEqual):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add): Don't early return here, we still need to call the JIT stub.
+        (JSC::JIT::emitSlow_op_sub): Ditto.
 
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Sam Weinig.
         
-        - speed up the === and !== operators by choosing the fast cases better
+        Here's a thought: let's not take a jit stub call just to multiply by 1,
+        bokay?
         
-        No effect on SunSpider but speeds up the V8 EarlyBoyer benchmark about 4%.
+        imul doesn't set the zero flag, so to test for a zero result, we need
+        an explicit instruction. (Luckily, it does set the overflow flag, so
+        we can still use that.)
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::areBothImmediate):
-        * kjs/operations.cpp:
-        (JSC::strictEqual):
-        (JSC::strictEqualSlowCase):
-        * kjs/operations.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32InPlace):
 
-2008-09-15  Oliver Hunt  <oliver@apple.com>
+2009-05-22  Sam Weinig  <sam@webkit.org>
 
-        RS=Sam Weinig.
+        Reviewed by Geoffrey "Premature Commit" Garen.
 
-        Coding style cleanup.
+        Add back constant integer cases for op_add.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateDouble):
+        (JSC::JIT::isOperandConstantImmediateDouble):
 
-2008-09-15  Oliver Hunt  <oliver@apple.com>
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Sam Weinig.
+        
+        Added fast double cases for op_jnless and op_jnlesseq.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::jumps): New accesor, used by
+        addSlowCase.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::ucomisd_rm): New method for comparing register to
+        memory.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div): Modified emitBinaryDoubleOp to accept comparison/jump
+        operations in addition to operations with explicit result registers.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addSlowCase): Added an "addSlowCase" for JumpLists, so clients
+        can track multiple jumps to the same slow case condition together.
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Implement op_negate inline fast cases.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::neg32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::negl_m):
+        (JSC::X86Assembler::xorpd_rr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
 
-        Bug 20874: op_resolve does not do any form of caching
-        <https://bugs.webkit.org/show_bug.cgi?id=20874>
+2009-05-20  Sam Weinig  <sam@webkit.org>
 
-        This patch adds an op_resolve_global opcode to handle (and cache)
-        property lookup we can statically determine must occur on the global
-        object (if at all).
+        Reviewed by Gavin Barraclough.
 
-        3% progression on sunspider, 3.2x improvement to bitops-bitwise-and, and
-        10% in math-partial-sums
+        Update the patchOffsetGetByIdSlowCaseCall constant for the
+        case that OPCODE_SAMPLING is enabled.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::findScopedProperty):
-        (JSC::CodeGenerator::emitResolve):
-        * VM/Machine.cpp:
-        (JSC::resolveGlobal):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_resolve_global):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-
-2008-09-15  Sam Weinig  <sam@webkit.org>
-
-        Roll out r36462.  It broke document.all.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::Machine::cti_op_eq_null):
-        (JSC::Machine::cti_op_neq_null):
-        * VM/Machine.h:
-        (JSC::Machine::isJSString):
-        * kjs/JSCell.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JIT.h:
 
-        Reviewed by Maciej Stachowiak.
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
 
-        Bug 20863: ASSERTION FAILED: addressOffset < instructions.size() in CodeBlock::getHandlerForVPC
-        <https://bugs.webkit.org/show_bug.cgi?id=20863>
+        Reviewed by Sam Weinig.
 
-        r36427 changed the number of arguments to op_construct without changing
-        the argument index for the vPC in the call to initializeCallFrame() in
-        the CTI case. This caused a JSC test failure. Correcting the argument
-        index fixes the test failure.
+        Added support for inline subtraction of doubles.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_construct_JSConstruct):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
+        (JSC::JIT::emitBinaryDoubleOp):
 
-2008-09-15  Mark Rowe  <mrowe@apple.com>
+2009-05-20  Sam Weinig  <sam@webkit.org>
 
-        Fix GCC 4.2 build.
+        Reviewed by Geoffrey Garen.
 
-        * VM/CTI.h:
+        Added support for inline division.
 
-2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::divsd_rr):
+        (JSC::X86Assembler::divsd_mr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
-        
-        Fixed a typo in op_get_by_id_chain that caused it to miss every time
-        in the interpreter.
-        
-        Also, a little cleanup.
+        Reviewed by Sam Weinig.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Set up baseObject before entering the
-        loop, so we compare against the right values.
+        Added support for inline addition of doubles.
 
-2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
         
-        Removed the CalledAsConstructor flag from the call frame header. Now,
-        we use an explicit opcode at the call site to fix up constructor results.
+        Factored inline double operations into a helper function, so that we
+        can reuse this code for other math operations.
 
-        SunSpider says 0.4% faster.
-        
-        cti_op_construct_verify is an out-of-line function call for now, but we
-        can fix that once StructureID holds type information like isObject.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Codegen for the new opcode.
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
 
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
+        Reviewed by Sam Weinig.
+        
+        Added support for inline multiplication of doubles.
 
-        * VM/CodeGenerator.cpp: Codegen for the new opcode. Also...
-        (JSC::CodeGenerator::emitCall): ... don't test for known non-zero value.
-        (JSC::CodeGenerator::emitConstruct): ... ditto.
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvtsi2sd_mr): New function, useful for loading an
+        int32 into a double register.
 
-        * VM/Machine.cpp: No more CalledAsConstructor
-        (JSC::Machine::privateExecute): Implementation for the new opcode.
-        (JSC::Machine::cti_op_ret): The speedup: no need to check whether we were
-        called as a constructor.
-        (JSC::Machine::cti_op_construct_verify): Implementation for the new opcode.
-        * VM/Machine.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul): Filled out these cases for double arithmetic.
 
-        * VM/Opcode.h: Declare new opcode.
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addressFor): New function, useful for addressing a JSValue's
+        full 64bits as a double.
 
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::): No more CalledAsConstructor
+2009-05-19  Sam Weinig  <sam@webkit.org>
 
-2008-09-15  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Geoff Garen.
+        Implement and enable optimized calls.
 
-        Inline code generation of eq_null/neq_null for CTI.  Uses vptr checking for
-        StringObjectsThatAreMasqueradingAsBeingUndefined.  In the long run, the
-        masquerading may be handled differently (through the StructureIDs - see bug
-        #20823).
-
-        >1% on v8-tests.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitJumpSlowCaseIfIsJSCell):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::Machine::cti_op_eq_null):
-        (JSC::Machine::cti_op_neq_null):
-        * VM/Machine.h:
-        (JSC::Machine::doesMasqueradesAsUndefined):
-        * kjs/JSWrapperObject.h:
-        (JSC::JSWrapperObject::):
-        (JSC::JSWrapperObject::JSWrapperObject):
-        * kjs/StringObject.h:
-        (JSC::StringObject::StringObject):
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Add ENABLE(JIT_OPTIMIZE_CALL) guards
+        around the the optimize call only trampolines (virtualCallPreLink and virtualCallLink).
+        Update the trampolines to account for the new JSValue representation.
+        (JSC::JIT::unlinkCall): Use NULL instead of JSValue noValue. 
 
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Update to account for the new JSValue representation
+        (JSC::JIT::compileOpCallSlowCase): Ditto.
 
-        Rubber-stamped by Oliver Hunt.
+        * jit/JITStubs.h: Remove incorrect !ENABLE(JIT_OPTIMIZE_CALL) guard.
 
-        r36427 broke CodeBlock::dump() by changing the number of arguments to
-        op_construct without changing the code that prints it. This patch fixes
-        it by printing the additional argument.
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_CALL.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
+2009-05-19  Sam Weinig  <sam@webkit.org>
 
-2008-09-15  Adam Roben  <aroben@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Build fix
+        Implement and enable optimized property access.
+
+        * assembler/AbstractMacroAssembler.h: Fix comment.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Remove array length trampoline
+        and implement the string length trampoline.
+        * jit/JIT.h: Add new constants for patch offsets.
+        * jit/JITInlineMethods.h: Remove FIELD_OFFSET which is now in StdLibExtras.h.
+        * jit/JITPropertyAccess.cpp: 
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add version of addArgument that takes
+        two registers for the tag and payload.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs): Remove array length trampoline pointer.
+        (JSC::JITStubs::cti_op_get_by_id_self_fail): 
+        * jit/JITStubs.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Move m_inheritorID below the property storage
+        to align it to a 16 byte boundary.
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        * wtf/StdLibExtras.h: Move FIELD_OFFSET here.
 
-        * kjs/StructureID.cpp: Removed a stray semicolon.
+2009-05-17  Sam Weinig  <sam@webkit.org>
 
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Maciej Stachowiak.
+        Remove unneeded ExecState parameter from the number JSValue constructors.
 
-        Fix a crash in fast/js/exception-expression-offset.html caused by not
-        updating all mentions of the length of op_construct in r36427.
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
+2009-05-15  Sam Weinig  <sam@webkit.org>
 
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Cameron Zwarich.
-        
-        - fix layout test failure introduced by fix for 20849
-        
-        (The failing test was fast/js/delete-then-put.html)
+        Implemented fast path for op_put_by_val when putting to arrays.
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::removeDirect): Clear enumeration cache
-        in the dictionary case.
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirect): Ditto.
-        * kjs/StructureID.h:
-        (JSC::StructureID::clearEnumerationCache): Inline to handle the
-        clear.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
 
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+2009-05-15  Geoffrey Garen  <ggaren@apple.com> (Mostly by Sam)
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Sam Weinig.
         
-        - fix JSC test failures introduced by fix for 20849
+        Implemented fast path for op_get_by_val when accessing array.
 
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames): Use the correct count.
+        * jit/JIT.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
 
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Sam Weinig.
+        
+        Fixed a failure in fast/js/math-transforms.html caused by failing to
+        preserve -0 in multiplication.
 
-        Bug 20851: REGRESSION (r36410): fast/js/kde/GlobalObject.html fails
-        <https://bugs.webkit.org/show_bug.cgi?id=20851>
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jz):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace): Check both for overflow and for zero when
+        doing multiplication. Use a slow case to get these right.
 
-        r36410 introduced an optimization for parseInt() that is incorrect when
-        its argument is larger than the range of a 32-bit integer. If the
-        argument is a number that is not an immediate integer, then the correct
-        behaviour is to return the floor of its value, unless it is an infinite
-        value, in which case the correct behaviour is to return 0.
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt):
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in the varargs calling convention.
 
-2008-09-15  Sam Weinig  <sam@webkit.org>
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs): Move the argument count into regT1,
+        since that's where ctiVirtualCall expects it to be.
 
-        Reviewed by Maciej Stachowiak.
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20849
-        Cache property names for getEnumerablePropertyNames in the StructureID.
+        Reviewed by Sam Weinig.
 
-        ~0.5% speedup on Sunspider overall (9.7% speedup on string-fasta).  ~1% speedup
-        on the v8 test suite.
+        Fixed a small bug in instanceof's looping code.
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/StructureID.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): NULL means the object has no prototype,
+        so only loop when *not* equal to NULL.
 
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Cameron Zwarich.
-        
-        - speed up JS construction by extracting "prototype" lookup so PIC applies.
+        Reviewed by Sam Weinig.
         
-        ~0.5% speedup on SunSpider
-        Speeds up some of the V8 tests as well, most notably earley-boyer.
+        Fixed a small bug in instanceof's result writing code.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall): Account for extra arg for prototype.
-        (JSC::CTI::privateCompileMainPass): Account for increased size of op_construct.
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct): Emit separate lookup to get prototype property.
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Expect prototype arg in op_construct.
-        (JSC::Machine::cti_op_construct_JSConstruct): ditto
-        (JSC::Machine::cti_op_construct_NotJSConstruct): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): Make sure to fill out the payload bits
+        in all cases.
 
-2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Geoffrey Garen.
 
-        Add a protected destructor for RefCounted.
+        Removed an invalid assertion in cti_op_urshift which
+        depended on a fast path for op_urshift which has
+        never existed.
 
-        It is wrong to call its destructor directly, because (1) this should be taken care of by
-        deref(), and (2) many classes that use RefCounted have non-virtual destructors.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_urshift):
 
-        No change in behavior.
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * wtf/RefCounted.h: (WTF::RefCounted::~RefCounted):
+        Reviewed by Sam Weinig.
+        
+        Fixed loop_if_true, which had the same reversed test that jtrue had.
 
-2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
 
-        Reviewed by Sam Weinig.
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-        Accelerated property accesses.
-
-        Inline more of the array access code into the JIT code for get/put_by_val.
-        Accelerate get/put_by_id by speculatively inlining a disable direct access
-        into the hot path of the code, and repatch this with the correct StructureID
-        and property map offset once these are known.  In the case of accesses to the
-        prototype and reading the array-length a trampoline is genertaed, and the
-        branch to the slow-case is relinked to jump to this.
-
-        By repatching, we mean rewriting the x86 instruction stream.  Instructions are
-        only modified in a simple fasion - altering immediate operands, memory access
-        deisplacements, and branch offsets.
-        
-        For regular get_by_id/put_by_id accesses to an object, a StructureID in an
-        instruction's immediate operant is updateded, and a memory access operation's
-        displacement is updated to access the correct field on the object.  In the case
-        of more complex accesses (array length and get_by_id_prototype) the offset on
-        the branch to slow-case is updated, to now jump to a trampoline.
-
-        +2.8% sunspider, +13% v8-tests
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::CTI):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileArrayLengthTrampoline):
-        (JSC::CTI::privateCompileStringLengthTrampoline):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::privateCompilePatchGetStringLength):
-        * VM/CTI.h:
-        (JSC::CTI::compileGetByIdSelf):
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        (JSC::CTI::compilePutByIdReplace):
-        (JSC::CTI::compilePutByIdTransition):
-        (JSC::CTI::compileArrayLengthTrampoline):
-        (JSC::CTI::compileStringLengthTrampoline):
-        (JSC::CTI::compilePatchGetArrayLength):
-        (JSC::CTI::compilePatchGetStringLength):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_put_by_val_array):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::cmpl_i8m):
-        (JSC::X86Assembler::emitUnlinkedJa):
-        (JSC::X86Assembler::getRelocatedAddress):
-        (JSC::X86Assembler::getDifferenceBetweenLabels):
-        (JSC::X86Assembler::emitModRm_opmsib):
+        Reviewed by Geoffrey Garen.
 
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+        In op_neq, we apparently want to check that one value
+        does *not* equal another.  Go figure.
 
-        Reviewed by Cameron Zwarich.
-        
-        - split the "prototype" lookup for hasInstance into opcode stream so it can be cached
-        
-        ~5% speedup on v8 earley-boyer test
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_neq):
 
-        * API/JSCallbackObject.h: Add a parameter for the pre-looked-up prototype.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::hasInstance): Ditto.
-        * API/JSValueRef.cpp:
-        (JSValueIsInstanceOfConstructor): Look up and pass in prototype.
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Pass along prototype.
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Print third arg.
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitInstanceOf): Implement this, now that there
-        is a third argument.
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Pass along the prototype.
-        (JSC::Machine::cti_op_instanceof): ditto
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::hasInstance): Expect to get a pre-looked-up prototype.
-        * kjs/JSObject.h:
-        * kjs/nodes.cpp:
-        (JSC::InstanceOfNode::emitCode): Emit a get_by_id of the prototype
-        property and pass that register to instanceof.
-        * kjs/nodes.h:
-
-2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Geoffrey Garen.
 
-        Remove unnecessary virtual function call from cti_op_call_JSFunction -
-        ~5% on richards, ~2.5% on v8-tests, ~0.5% on sunspider.
+        The slow case of op_mod should call op_mod's jit stub,
+        not op_mul.  That would be dumb.
 
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
 
-2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Sam Weinig.
+        
+        Fixed problems when using 'arguments' due to a half-initialized register.
 
-        Bug 20827: the 'typeof' operator is slow
-        <https://bugs.webkit.org/show_bug.cgi?id=20827>
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::init): Require a full JSValue when setting up the 
+        'arguments' virtual register, since this register is accessible from JIT
+        code and bytecode, and needs to be a true JSValue.
 
-        Optimize the 'typeof' operator when its result is compared to a constant
-        string.
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame): ditto
 
-        This is a 5.5% speedup on the V8 Earley-Boyer test.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): ditto
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsIsObjectType):
-        (JSC::jsIsFunctionType):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/nodes.cpp:
-        (JSC::BinaryOpNode::emitCode):
-        (JSC::EqualNode::emitCode):
-        (JSC::StrictEqualNode::emitCode):
-        * kjs/nodes.h:
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
+        * interpreter/Register.h: Removed the constructor that allowed assignment
+        of a JSArguments* to a register. That is not safe. See above.
 
-        Reviewed by Cameron Zwarich.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params): ditto
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20844
-        Speed up parseInt for numbers
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-        Sunspider reports this as 1.029x as fast overall and 1.37x as fast on string-unpack-code.
-        No change on the v8 suite.
+        Reviewed by Geoffrey Garen.
 
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt): Don't convert numbers to strings just to
-        convert them back to numbers.
+        We really want to go to the slow case in op_jfalse and
+        op_jtrue if the value is *not* boolean. 
 
-2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
 
-        Reviewed by Oliver Hunt.
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-        Bug 20816: op_lesseq should be optimized
-        <https://bugs.webkit.org/show_bug.cgi?id=20816>
+        Reviewed by Geoffrey Garen.
 
-        Add a loop_if_lesseq opcode that is similar to the loop_if_less opcode.
+        Flipped the condition when emitting a an op_loop_if_less or op_loop_if_lesseq
+        if the first operand is a constant.
 
-        This is a 9.4% speedup on the V8 Crypto benchmark.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfTrue):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        * VM/Machine.h:
-        * VM/Opcode.h:
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-2008-09-14  Sam Weinig  <sam@webkit.org>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Cameron Zwarich.
+        Added missing return in op_jnless and op_jnlesseq. 
 
-        Cleanup Sampling code.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
 
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        (JSC::CTI::execute):
-        * VM/SamplingTool.cpp:
-        (JSC::):
-        (JSC::SamplingTool::run):
-        (JSC::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::callingHostFunction):
+2009-05-14  Sam Weinig  <sam@webkit.org>
 
-2008-09-13  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Cameron Zwarich.
+        Load constants into the the register file as a temporary measure to
+        aid bring up.  This allows us to use to treat constants like any
+        other virtual register.
 
-        Bug 20821: Cache property transitions to speed up object initialization
-        https://bugs.webkit.org/show_bug.cgi?id=20821
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
 
-        Implement a transition cache to improve the performance of new properties
-        being added to objects.  This is extremely beneficial in constructors and
-        shows up as a 34% improvement on access-binary-trees in SunSpider (0.8%
-        overall)
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::):
-        (JSC::transitionWillNeedStorageRealloc):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/CTI.h:
-        (JSC::CTI::compilePutByIdTransition):
-        * VM/CodeBlock.cpp:
-        (JSC::printPutByIdOp):
-        (JSC::CodeBlock::printStructureIDs):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructureIDs):
-        (JSC::CodeBlock::refStructureIDs):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitPutById):
-        * VM/Machine.cpp:
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::transitionTo):
-        * kjs/PutPropertySlot.h:
-        (JSC::PutPropertySlot::PutPropertySlot):
-        (JSC::PutPropertySlot::wasTransition):
-        (JSC::PutPropertySlot::setWasTransition):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::transitionTo):
-        (JSC::StructureIDChain::StructureIDChain):
-        * kjs/StructureID.h:
-        (JSC::StructureID::previousID):
-        (JSC::StructureID::setCachedPrototypeChain):
-        (JSC::StructureID::cachedPrototypeChain):
-        (JSC::StructureID::propertyMap):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::addl_i8m):
-        (JSC::X86Assembler::subl_i8m):
-
-2008-09-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Sam Weinig.
+        
+        Implemented op_strict_eq. Original patch by Snowy, by way of Sam and Gavin.
 
-        Reviewed by Maciej Stachowiak.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8): Added set8, since it's slightly
+        faster than set32, and the new value representation usually doesn't
+        need set32.
 
-        Bug 20819: JSValue::isObject() is slow
-        <https://bugs.webkit.org/show_bug.cgi?id=20819>
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload): Added helper functions for dealing with
+        constants. Eventually, we should write special cases for all constants,
+        but these are helpful in the short term.
 
-        Optimize JSCell::isObject() and JSCell::isString() by making them
-        non-virtual calls that rely on the StructureID type information.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq): teh opcodez.
 
-        This is a 0.7% speedup on SunSpider and a 1.0% speedup on the V8
-        benchmark suite.
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValue::isDouble): Added a LowestTag for clarity.
 
-        * JavaScriptCore.exp:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        (JSC::JSCell::isObject):
-        (JSC::JSCell::isString):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        (JSC::JSString::JSString):
-        * kjs/StructureID.h:
-        (JSC::StructureID::type):
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-11  Stephanie Lewis  <slewis@apple.com>
+        Reviewed by Sam Weinig.
+        
+        Fixed some bugs in host function calls.
+        
+        testapi now passes!
 
-        Reviewed by Oliver Hunt.
+        * jit/JIT.cpp: Changed some registers around to avoid overwriting edx:eax,
+        which is how JSValues are now returned. Also changed the code that
+        passes thisValue to pass the full 64bits of the value. Also added
+        an #error compiler directive to other platform builds, since the JSValue
+        return signature probably won't return in edx:eax on those platforms,
+        and we'll have to investigate a solution.
 
-        Turn off PGO Optimization on CTI.cpp -> <rdar://problem/6207709>.  Fixes
-        crash on CNN and on Dromaeo.
-        Fix Missing close tag in vcproj. 
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Reviewed by Sam Weinig.
+        
+        Removed parameters from functions that are intended never to use their
+        parameters.
 
-2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
 
-        Not reviewed.
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Correct an SVN problem with the last commit and actually add the new
-        files.
+        Reviewed by Sam Weinig.
+        
+        Ported op_instance_of from TOT. It's basically the same, but some register
+        stuff changed to memory stuff.
 
-        * wrec/CharacterClassConstructor.cpp: Added.
-        (JSC::):
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::CharacterClassConstructor::addSorted):
-        (JSC::CharacterClassConstructor::addSortedRange):
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        (JSC::CharacterClassConstructor::append):
-        * wrec/CharacterClassConstructor.h: Added.
-        (JSC::CharacterClassConstructor::CharacterClassConstructor):
-        (JSC::CharacterClassConstructor::isUpsideDown):
-        (JSC::CharacterClassConstructor::charClass):
-
-2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitStore): Changed to use helper functions.
 
-        Reviewed by Maciej Stachowiak.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): Ported from TOT.
 
-        Bug 20788: Split CharacterClassConstructor into its own file
-        <https://bugs.webkit.org/show_bug.cgi?id=20788>
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Split CharacterClassConstructor into its own file and clean up some
-        style issues.
+        Reviewed by Gavin Barraclough.
+        
+        Added a comment to explain an exception-handling subtelty that we found
+        hard to remember when reviewing my last patch.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wrec/CharacterClassConstructor.cpp: Added.
-        (JSC::):
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::CharacterClassConstructor::addSorted):
-        (JSC::CharacterClassConstructor::addSortedRange):
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        (JSC::CharacterClassConstructor::append):
-        * wrec/CharacterClassConstructor.h: Added.
-        (JSC::CharacterClassConstructor::CharacterClassConstructor):
-        (JSC::CharacterClassConstructor::isUpsideDown):
-        (JSC::CharacterClassConstructor::charClass):
-        * wrec/WREC.cpp:
-        (JSC::WRECParser::parseCharacterClass):
-
-2008-09-10  Simon Hausmann  <hausmann@webkit.org>
-
-        Not reviewed but trivial one-liner for yet unused macro.
-
-        Changed PLATFORM(WINCE) to PLATFORM(WIN_CE) as requested by Mark.
-
-        (part of https://bugs.webkit.org/show_bug.cgi?id=20746)
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
 
-        * wtf/Platform.h:
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Sam Weinig.
+        
+        Implemented try/catch.
 
-        Rubber-stamped by Oliver Hunt.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw): Updated to use JITStackFrame abstraction.
+        (JSC::JIT::emit_op_catch): Filled out.
 
-        Fix a typo by renaming the overloaded orl_rr that takes an immediate to
-        orl_i32r.
+2009-05-13  Sam Weinig  <sam@webkit.org>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::orl_i32r):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
+        Reviewed by Geoffrey Garen.
 
-2008-09-10  Sam Weinig  <sam@webkit.org>
+        Implemented op_loop_if_true, op_jfalse, op_jtrue, op_jeq_null and op_jneq_null
 
-        Reviewed by Geoff Garen.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_instanceof): Moved from below to be next to its
+        fast brother.
 
-        Add inline property storage for JSObject.
+        (JSC::JIT::emit_op_loop_if_true): Similar to the old version
+        in that it tries to do the integer case first and reduce the
+        number of jumps you might need to take.
+        (JSC::JIT::emitSlow_op_loop_if_true):
 
-        1.2% progression on Sunspider. .5% progression on the v8 test suite.
+        (JSC::JIT::emit_op_jfalse): Very similar to op_loop_if_true, only
+        the inverse and without a timeout check.
+        (JSC::JIT::emitSlow_op_jfalse):
 
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark): There is no reason to check storageSize now that
-        we start from 0.
-        (JSC::JSObject::allocatePropertyStorage): Allocates/reallocates heap storage.
-        * kjs/JSObject.h:
-        (JSC::JSObject::offsetForLocation): m_propertyStorage is not an OwnArrayPtr
-        now so there is no reason to .get()
-        (JSC::JSObject::usingInlineStorage):
-        (JSC::JSObject::JSObject): Start with m_propertyStorage pointing to the
-        inline storage.
-        (JSC::JSObject::~JSObject): Free the heap storage if not using the inline
-        storage.
-        (JSC::JSObject::putDirect): Switch to the heap storage only when we know
-        we know that we are about to add a property that will overflow the inline
-        storage.
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::createTable): Don't allocate the propertyStorage, that is
-        now handled by JSObject.
-        (JSC::PropertyMap::rehash): PropertyStorage is not a OwnArrayPtr anymore.
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::storageSize): Rename from markingCount.
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition): Don't resize the property storage
-        if we are using inline storage.
-        * kjs/StructureID.h:
-
-2008-09-10  Oliver Hunt  <oliver@apple.com>
+        (JSC::JIT::emit_op_jtrue): Very similar to op_loop_if_true except
+        without the timeout check.
+        (JSC::JIT::emitSlow_op_jtrue):
 
-        Reviewed by Geoff Garen.
+        (JSC::JIT::emit_op_jeq_null): Very similar to the implementation
+        of op_eq, except it takes jumps instead of copying the condition
+        to a dst.
+        (JSC::JIT::emit_op_jneq_null): Ditto but for op_neq.
 
-        Inline immediate number version of op_mul.
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Renamed mull_rr to imull_rr as that's what it's 
-        actually doing, and added imull_i32r for the constant
-        case immediate multiply.
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_varargs.
 
-        1.1% improvement to SunSpider.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::imull_rr):
-        (JSC::X86Assembler::imull_i32r):
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_eval.
 
-        Not reviewed.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubCall.h:
+        (JSC::CallEvalJITStub::CallEvalJITStub):
 
-        Mac build fix.
+2009-05-13  Sam Weinig  <sam@webkit.org>
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Reviewed by Gavin Barraclough.
 
-2008-09-09  Oliver Hunt  <oliver@apple.com>
+        Implemented op_not. (Gavin did most of the work!)
 
-        Reviewed by Maciej Stachowiak.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emitSlow_op_not):
 
-        Add optimised access to known properties on the global object.
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Improve cross scope access to the global object by emitting
-        code to access it directly rather than by walking the scope chain.
+        Reviewed by Sam Weinig.
+        
+        Implemented op_global_resolve.
 
-        This is a 0.8% win in SunSpider and a 1.7% win in the v8 benchmarks.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq): Added back accidentally removed
+        early returns. 
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::findScopedProperty):
-        (JSC::CodeGenerator::emitResolve):
-        (JSC::CodeGenerator::emitGetScopedVar):
-        (JSC::CodeGenerator::emitPutScopedVar):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
-        * kjs/nodes.cpp:
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::PostfixResolveNode::emitCode):
-        (JSC::PrefixResolveNode::emitCode):
-        (JSC::ReadModifyResolveNode::emitCode):
-        (JSC::AssignResolveNode::emitCode):
-
-2008-09-10  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver.
-        
-        - enable polymorphic inline caching of properties of primitives
-        
-        1.012x speedup on SunSpider.
-
-        We create special structure IDs for JSString and
-        JSNumberCell. Unlike normal structure IDs, these cannot hold the
-        true prototype. Due to JS autoboxing semantics, the prototype used
-        when looking up string or number properties depends on the lexical
-        global object of the call site, not the creation site. Thus we
-        enable StructureIDs to handle this quirk for primitives.
-        
-        Everything else should be straightforward.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        * VM/CTI.h:
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        * kjs/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        * kjs/JSCell.h:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.h:
-        (JSC::StructureID::prototypeForLookup):
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::JSNumberCell):
-        (JSC::jsNumberCell):
-        * kjs/JSObject.h:
-        (JSC::JSObject::prototype):
-        * kjs/JSString.cpp:
-        (JSC::jsString):
-        (JSC::jsSubstring):
-        (JSC::jsOwnedString):
-        * kjs/JSString.h:
-        (JSC::JSString::JSString):
-        (JSC::JSString::):
-        (JSC::jsSingleCharacterString):
-        (JSC::jsSingleCharacterSubstring):
-        (JSC::jsNontrivialString):
-        * kjs/SmallStrings.cpp:
-        (JSC::SmallStrings::createEmptyString):
-        (JSC::SmallStrings::createSingleCharacterString):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::getterSetterTransition):
-        (JSC::StructureIDChain::StructureIDChain):
-        * kjs/StructureID.h:
-        (JSC::StructureID::create):
-        (JSC::StructureID::storedPrototype):
-
-2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global): Pretty similar to the old code,
+        but we need two reads and a TimesEight step in order to account for the
+        64bit value size.
 
-        Reviewed by Sam Weinig.
+        * jit/JITStubs.h:
+        (JSC::): Slightly tweaked this code to specialize for a JSGlobalObject*,
+        to avoid having to pass an irrelevant tag pointer to the stub.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20746
+2009-05-13  Sam Weinig  <sam@webkit.org>
 
-        Added WINCE platform macro.
+        Reviewed by Geoffrey Garen.
 
-        * wtf/Platform.h:
+        Implemented op_to_jsnumber.
 
-2008-09-09  Sam Weinig  <sam@webkit.org>
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
 
-        Reviewed by Mark Rowe.
+2009-05-13  Sam Weinig  <sam@webkit.org>
 
-        Remove unnecessary override of getOffset.
+        Reviewed by Geoffrey Garen.
 
-        Sunspider reports this as a .6% progression.
+        Implemented op_convert_this.
 
-        * JavaScriptCore.exp:
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSObject::putDirect):
-        * kjs/PropertyMap.cpp:
-        * kjs/PropertyMap.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
 
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Sam Weinig.
+        
+        Got basic JS function and constructor calls working.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct):
+        (JSC::JIT::compileOpCall): Filled out these cases, with call_eval #if'd out.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitLoad): Restored some legacy "*CTIArg*" functions,
+        since I wanted to avoid the complexity of revamping the API here while
+        trying to bring it up. Eventually, we should re-remove all of these functions.
+
+        (JSC::JIT::recordJumpTarget): Removed unnecessary macro cruft. You will
+        not silence me, Sam Weinig! The world will know that you are a crufty,
+        crufty, crufty programmer!!!
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h: Changed up some offsets in the JITStackFrame class, since
+        and off-by-one error was causing stack misalignment.
 
-        Bug 20759: Remove MacroAssembler
-        <https://bugs.webkit.org/show_bug.cgi?id=20759>
+2009-05-13  Sam Weinig  <sam@webkit.org>
 
-        Remove MacroAssembler and move its functionality to X86Assembler.
+        Reviewed by Geoffrey Garen.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitJumpSlowCaseIfNotImm):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JmpTable::JmpTable):
-        (JSC::SlowCaseEntry::SlowCaseEntry):
-        (JSC::CTI::JSRInfo::JSRInfo):
-        * masm/MacroAssembler.h: Removed.
-        * masm/MacroAssemblerWin.cpp: Removed.
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitConvertToFastCall):
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        * wrec/WREC.h:
-        (JSC::WRECGenerator::WRECGenerator):
-        (JSC::WRECParser::WRECParser):
+        Implement op_eq_null and op_neq_null.
 
-2008-09-09  Sam Weinig  <sam@webkit.org>
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_stricteq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emit_op_nstricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jsc.cpp:
 
-        Reviewed by Cameron Zwarich.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        Don't waste the first item in the PropertyStorage.
+        Reviewed by Geoffrey Garen.
 
-        - Fix typo (makingCount -> markingCount)
-        - Remove undefined method declaration.
+        Implement op_new_error.
 
-        No change on Sunspider.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_error):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add a version of addArgument
+        that takes a constant JSValue.
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::put):
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getOffset):
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::rehash):
-        (JSC::PropertyMap::resizePropertyStorage):
-        (JSC::PropertyMap::checkConsistency):
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::markingCount): Fix typo.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Geoffrey Garen.
 
-        Not reviewed.
+        Remove now unused emitGetVariableObjectRegister and emitPutVariableObjectRegister.
 
-        Speculative Windows build fix.
+        * jit/JIT.cpp:
+        * jit/JIT.h:
 
-        * masm/MacroAssemblerWin.cpp:
-        (JSC::MacroAssembler::emitConvertToFastCall):
-        (JSC::MacroAssembler::emitRestoreArgumentReference):
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Maciej Stachowiak.
+        Implement op_to_primitive and op_next_pname.
 
-        Bug 20755: Create an X86 namespace for register names and other things
-        <https://bugs.webkit.org/show_bug.cgi?id=20755>
-
-        Create an X86 namespace to put X86 register names. Perhaps I will move
-        opcode names here later as well.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutArgConstant):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        (JSC::X86::):
-        (JSC::X86Assembler::emitModRm_rm):
-        (JSC::X86Assembler::emitModRm_rm_Unchecked):
-        (JSC::X86Assembler::emitModRm_rmsib):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-        * wrec/WREC.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_next_pname):
 
-2008-09-09  Sam Weinig  <sam@webkit.org>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Geoffrey Garen.
 
-        Remove unnecessary friend declaration.
+        Add op_get_global_var, op_put_global_var, emit_op_get_scoped_var, emit_op_put_scoped_var and
+        op_unexpected_load.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitLoadReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_unexpected_load):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added overflow handling to op_sub.
 
-        * kjs/PropertyMap.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
 
-2008-09-09  Sam Weinig  <sam@webkit.org>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Geoffrey Garen.
 
-        Replace uses of PropertyMap::get and PropertyMap::getLocation with
-        PropertyMap::getOffset.
+        Remove a function call by folding op_get_by_id and op_put_by_id into
+        their respective compile functions.
 
-        Sunspider reports this as a .6% improvement.
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
 
-        * JavaScriptCore.exp:
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put):
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::locationForOffset):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getOffset):
-        * kjs/PropertyMap.h:
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Geoffrey Garen.
 
-        Bug 20754: Remove emit prefix from assembler opcode methods
-        <https://bugs.webkit.org/show_bug.cgi?id=20754>
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutArgConstant):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitCall):
-        (JSC::CTI::emitJumpSlowCaseIfNotImm):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * masm/MacroAssemblerWin.cpp:
-        (JSC::MacroAssembler::emitConvertToFastCall):
-        (JSC::MacroAssembler::emitRestoreArgumentReference):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::pushl_r):
-        (JSC::X86Assembler::pushl_m):
-        (JSC::X86Assembler::popl_r):
-        (JSC::X86Assembler::popl_m):
-        (JSC::X86Assembler::movl_rr):
-        (JSC::X86Assembler::addl_rr):
-        (JSC::X86Assembler::addl_i8r):
-        (JSC::X86Assembler::addl_i32r):
-        (JSC::X86Assembler::addl_mr):
-        (JSC::X86Assembler::andl_rr):
-        (JSC::X86Assembler::andl_i32r):
-        (JSC::X86Assembler::cmpl_i8r):
-        (JSC::X86Assembler::cmpl_rr):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::cmpl_i32r):
-        (JSC::X86Assembler::cmpl_i32m):
-        (JSC::X86Assembler::cmpw_rm):
-        (JSC::X86Assembler::orl_rr):
-        (JSC::X86Assembler::subl_rr):
-        (JSC::X86Assembler::subl_i8r):
-        (JSC::X86Assembler::subl_i32r):
-        (JSC::X86Assembler::subl_mr):
-        (JSC::X86Assembler::testl_i32r):
-        (JSC::X86Assembler::testl_rr):
-        (JSC::X86Assembler::xorl_i8r):
-        (JSC::X86Assembler::xorl_rr):
-        (JSC::X86Assembler::sarl_i8r):
-        (JSC::X86Assembler::sarl_CLr):
-        (JSC::X86Assembler::shl_i8r):
-        (JSC::X86Assembler::shll_CLr):
-        (JSC::X86Assembler::mull_rr):
-        (JSC::X86Assembler::idivl_r):
-        (JSC::X86Assembler::cdq):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::movzwl_mr):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_i32r):
-        (JSC::X86Assembler::movl_i32m):
-        (JSC::X86Assembler::leal_mr):
-        (JSC::X86Assembler::ret):
-        (JSC::X86Assembler::jmp_r):
-        (JSC::X86Assembler::jmp_m):
-        (JSC::X86Assembler::call_r):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateBacktrack1):
-        (JSC::WRECGenerator::generateBacktrackBackreference):
-        (JSC::WRECGenerator::generateBackreferenceQuantifier):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECGenerator::generateCharacterClass):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
-        (JSC::WRECGenerator::generateAssertionBOL):
-        (JSC::WRECGenerator::generateAssertionEOL):
-        (JSC::WRECGenerator::generateAssertionWordBoundary):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Make JITStubCall work in 64bit by making the stack index
+        step dependent on the size of void*.
 
-        Reviewed by Maciej Stachowiak.
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
 
-        Clean up the WREC code some more.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileRegExp):
-        * wrec/WREC.cpp:
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::WRECGenerator::generateBacktrack1):
-        (JSC::WRECGenerator::generateBacktrackBackreference):
-        (JSC::WRECGenerator::generateBackreferenceQuantifier):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECGenerator::generateCharacterClass):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
-        (JSC::WRECGenerator::generateAssertionBOL):
-        (JSC::WRECGenerator::generateAssertionEOL):
-        (JSC::WRECGenerator::generateAssertionWordBoundary):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-        (JSC::WRECParser::parseCharacterClass):
-        (JSC::WRECParser::parseEscape):
-        (JSC::WRECParser::parseTerm):
-        * wrec/WREC.h:
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-2008-09-09  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Build fix, rubber-stamped by Anders Carlsson.
+        Implement simple version of property access opcodes
+        which just call a stub functions.
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jsc.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
 
-        Silence spurious build warnings about missing format attributes on functions in Assertions.cpp.
+        Reviewed by Sam Weinig.
+        
+        Added work-around for XCode debugging echo problem.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (runInteractive):
 
-2008-09-09  Mark Rowe  <mrowe@apple.com>
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
 
-        Rubber-stamped by Oliver Hunt.
+        Reviewed by Sam Weinig.
+        
+        Added overflow handling to op_add.
 
-        Fix builds using the "debug" variant.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
 
-        This reverts r36130 and tweaks Identifier to export the same symbols for Debug
-        and Release configurations.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        * Configurations/JavaScriptCore.xcconfig:
-        * DerivedSources.make:
-        * JavaScriptCore.Debug.exp: Removed.
-        * JavaScriptCore.base.exp: Removed.
-        * JavaScriptCore.exp: Added.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/identifier.cpp:
-        (JSC::Identifier::addSlowCase): #ifdef the call to checkSameIdentifierTable so that
-        there is no overhead in Release builds.
-        (JSC::Identifier::checkSameIdentifierTable): Add empty functions for Release builds.
-        * kjs/identifier.h:
-        (JSC::Identifier::add): #ifdef the calls to checkSameIdentifierTable so that there is
-        no overhead in Release builds, and remove the inline definitions of checkSameIdentifierTable.
+        Reviewed by Geoffrey Garen.
 
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Add slow cases for op_jnless or emit_op_jnlesseq.
 
-        Reviewed by Maciej Stachowiak.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
 
-        Clean up WREC a bit to bring it closer to our coding style guidelines.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        * wrec/WREC.cpp:
-        (JSC::):
-        (JSC::getCharacterClass_newline):
-        (JSC::getCharacterClass_d):
-        (JSC::getCharacterClass_s):
-        (JSC::getCharacterClass_w):
-        (JSC::getCharacterClass_D):
-        (JSC::getCharacterClass_S):
-        (JSC::getCharacterClass_W):
-        (JSC::CharacterClassConstructor::append):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECParser::parseQuantifier):
-        (JSC::WRECParser::parsePatternCharacterQualifier):
-        (JSC::WRECParser::parseCharacterClassQuantifier):
-        (JSC::WRECParser::parseBackreferenceQuantifier):
-        * wrec/WREC.h:
-        (JSC::Quantifier::):
-        (JSC::Quantifier::Quantifier):
+        Reviewed by Geoffrey Garen.
 
-2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
+        Add implementations for op_jnless, emit_op_jnlesseq, op_loop_if_less and op_loop_if_lesseq.
+        No slow cases for op_jnless or emit_op_jnlesseq yet.
 
-        Reviewed by Alexey Proskuryakov.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
 
-        Try MIME charset names before trying IANA names 
-        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        * wtf/StringExtras.h: (strcasecmp): Added.
+        Reviewed by Geoffrey Garen.
 
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Turn the RECORD_JUMP_TARGET macro into an inline function.
 
-        Reviewed by Mark Rowe.
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::recordJumpTarget):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_jmp_scopes):
 
-        Bug 20719: REGRESSION (r36135-36244): Hangs, then crashes after several seconds
-        <https://bugs.webkit.org/show_bug.cgi?id=20719>
-        <rdar://problem/6205787>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        Fix a typo in the case-insensitive matching of character patterns.
+        Add MacroAssemblerX86Common::set8 to fix the build.
 
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generatePatternCharacter):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
 
-2008-09-09  Maciej Stachowiak  <mjs@apple.com>
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
         
-        - allow polymorphic inline cache to handle Math object functions and possibly other similar things
+        Added overflow recovery for pre_inc and pre_dec.
         
-        1.012x speedup on SunSpider.
-
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::getOwnPropertySlot):
-        * kjs/lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * kjs/lookup.h:
-        (JSC::getStaticPropertySlot):
-
-2008-09-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak and Oliver Hunt.
-
-        Split storage of properties out of the PropertyMap and into the JSObject
-        to allow sharing PropertyMap on the StructureID.  In order to get this
-        function correctly, the StructureID's transition mappings were changed to
-        transition based on property name and attribute pairs, instead of just
-        property name.
-
-        - Removes the single property optimization now that the PropertyMap is shared.
-          This will be replaced by in-lining some values on the JSObject.
-
-        This is a wash on Sunspider and a 6.7% win on the v8 test suite.
-
-        * JavaScriptCore.base.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdSelf): Get the storage directly off the JSObject.
-        (JSC::CTI::privateCompileGetByIdProto): Ditto.
-        (JSC::CTI::privateCompileGetByIdChain): Ditto.
-        (JSC::CTI::privateCompilePutByIdReplace): Ditto.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark): Mark the PropertyStorage.
-        (JSC::JSObject::put): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::deleteProperty): Ditto.
-        (JSC::JSObject::defineGetter): Return early if the property is already a getter/setter.
-        (JSC::JSObject::defineSetter): Ditto.
-        (JSC::JSObject::getPropertyAttributes): Update to get the propertyMap of the StructureID
-        (JSC::JSObject::getPropertyNames): Ditto.
-        (JSC::JSObject::removeDirect): Ditto.
-        * kjs/JSObject.h: Remove PropertyMap and add PropertyStorage.
-        (JSC::JSObject::propertyStorage): return the PropertyStorage.
-        (JSC::JSObject::getDirect): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::getDirectLocation): Ditto.
-        (JSC::JSObject::offsetForLocation): Compute location directly.
-        (JSC::JSObject::hasCustomProperties): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::hasGetterSetterProperties): Ditto.
-        (JSC::JSObject::getDirectOffset): Get by indexing into PropertyStorage.
-        (JSC::JSObject::putDirectOffset): Put by indexing into PropertyStorage.
-        (JSC::JSObject::getOwnPropertySlotForWrite): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::getOwnPropertySlot): Ditto.
-        (JSC::JSObject::putDirect): Move putting into the StructureID unless the property already exists.
-        * kjs/PropertyMap.cpp: Use the propertyStorage as the storage for the JSValues.
-        (JSC::PropertyMap::checkConsistency): 
-        (JSC::PropertyMap::operator=):
-        (JSC::PropertyMap::~PropertyMap):
-        (JSC::PropertyMap::get):
-        (JSC::PropertyMap::getLocation):
-        (JSC::PropertyMap::put):
-        (JSC::PropertyMap::getOffset):
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::expand):
-        (JSC::PropertyMap::rehash):
-        (JSC::PropertyMap::createTable):
-        (JSC::PropertyMap::resizePropertyStorage): Resize the storage to match the size of the map
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h: 
-        (JSC::PropertyMapEntry::PropertyMapEntry):
-        (JSC::PropertyMap::isEmpty):
-        (JSC::PropertyMap::size):
-        (JSC::PropertyMap::makingCount):
-        (JSC::PropertyMap::PropertyMap):
-
-        * kjs/StructureID.cpp: 
-        (JSC::StructureID::addPropertyTransition): Transitions now are based off the property name
-        and attributes. 
-        (JSC::StructureID::toDictionaryTransition): Copy the map.
-        (JSC::StructureID::changePrototypeTransition): Copy the map.
-        (JSC::StructureID::getterSetterTransition): Copy the map.
-        (JSC::StructureID::~StructureID): 
-        * kjs/StructureID.h:
-        (JSC::TransitionTableHash::hash): Custom hash for transition map.
-        (JSC::TransitionTableHash::equal): Ditto.
-        (JSC::TransitionTableHashTraits::emptyValue): Custom traits for transition map
-        (JSC::TransitionTableHashTraits::constructDeletedValue): Ditto.
-        (JSC::TransitionTableHashTraits::isDeletedValue): Ditto.
-        (JSC::StructureID::propertyMap): Added.
-
-2008-09-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Mark Rowe.
+        Turned some short-circuit code into early returns, as is the WebKit style.
 
-        Bug 20694: Slow Script error pops up when running Dromaeo tests
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_dec):
 
-        Correct error in timeout logic where execution tick count would
-        be reset to incorrect value due to incorrect offset and indirection.
-        Codegen for the slow script dialog was factored out into a separate
-        method (emitSlowScriptCheck) rather than having multiple copies of
-        the same code.  Also added calls to generate slow script checks
-        for loop_if_less and loop_if_true opcodes.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        * VM/CTI.cpp:
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-
-2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Geoffrey Garen.
 
-        Remove references to the removed WRECompiler class.
+        Implement op_jmp, op_loop, op_eq and op_neq.
 
-        * VM/Machine.h:
-        * wrec/WREC.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
 
-2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        Rubber-stamped by Mark Rowe.
+        Reviewed by Geoffrey Garen.
 
-        Fix the build with CTI enabled but WREC disabled.
+        Implement the slow cases for arithmetic opcodes.
 
-        * VM/CTI.cpp:
-        * VM/CTI.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
 
-2008-09-08  Dan Bernstein  <mitz@apple.com>
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-        - build fix
+        Reviewed by Geoffrey Garen.
 
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::BlockNode::):
+        Implement op_bitnot.
 
-2008-09-08  Kevin McCullough  <kmccullough@apple.com>
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::not32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::notl_m):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
 
-        Reviewed by Geoff.
+2009-05-12  Sam Weinig  <sam@webkit.org>
 
-       <rdar://problem/6134407> Breakpoints in for loops, while loops or
-       conditions without curly braces don't break. (19306)
-       -Statement Lists already emit debug hooks but conditionals without
-       brackets are not lists.
+        Reviewed by Geoffrey Garen.
 
-        * kjs/nodes.cpp:
-        (KJS::IfNode::emitCode):
-        (KJS::IfElseNode::emitCode):
-        (KJS::DoWhileNode::emitCode):
-        (KJS::WhileNode::emitCode):
-        (KJS::ForNode::emitCode):
-        (KJS::ForInNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::StatementNode::):
-        (KJS::BlockNode::):
+        Add arithmetic opcode implementations from the old nitro-extreme branch.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed JIT_OPTIMIZE_ARITHMETIC setting, since it was all about 32bit
+        value representations.
+        
+        Added JSAPIValueWrapper to the repository.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * runtime/JSAPIValueWrapper.cpp: Added.
+        (JSC::JSAPIValueWrapper::toPrimitive):
+        (JSC::JSAPIValueWrapper::getPrimitiveNumber):
+        (JSC::JSAPIValueWrapper::toBoolean):
+        (JSC::JSAPIValueWrapper::toNumber):
+        (JSC::JSAPIValueWrapper::toString):
+        (JSC::JSAPIValueWrapper::toObject):
+        * runtime/JSAPIValueWrapper.h: Added.
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::isAPIValueWrapper):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        (JSC::jsAPIValueWrapper):
+        * wtf/Platform.h:
 
-2008-09-08  Maciej Stachowiak  <mjs@apple.com>
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Anders Carlsson.
+        Turned on the JIT and got it building and running the most trivial of
+        programs.
         
-        - Cache the code generated for eval to speed up SunSpider and web sites
-        https://bugs.webkit.org/show_bug.cgi?id=20718
+        All configurable optimizations are turned off, and a few opcodes are ad
+        hoc #if'd out.
         
-        1.052x on SunSpider
-        2.29x on date-format-tofte
+        So far, I've only merged op_mov and op_end, but some stub-reliant
+        opcodes work as-is from TOT.
         
-        Lots of real sites seem to get many hits on this cache as well,
-        including GMail, Google Spreadsheets, Slate and Digg (the last of
-        these gets over 100 hits on initial page load).
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoadReturnValue):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitStoreReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_unexpected_load):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_push_scope):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_switch_imm):
+        * jit/JITStubs.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * runtime/JSValue.h:
+        (JSC::JSValue::payload):
+        * wtf/Platform.h:
 
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get):
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_eval):
-        * VM/Machine.h:
+2009-05-07  Sam Weinig  <sam@webkit.org>
 
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Oliver Hunt.
+        Add some new MacroAssembler and assembler functions that will be needed shortly.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::neg32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::addl_rm):
+        (JSC::X86Assembler::andl_mr):
+        (JSC::X86Assembler::andl_rm):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::notl_r):
+        (JSC::X86Assembler::orl_rm):
+        (JSC::X86Assembler::orl_im):
+        (JSC::X86Assembler::subl_rm):
+        (JSC::X86Assembler::xorl_mr):
+        (JSC::X86Assembler::xorl_rm):
+        (JSC::X86Assembler::xorl_im):
+        (JSC::X86Assembler::imull_mr):
 
-        Bug 20711: Change KJS prefix on preprocessor macros to JSC
-        <https://bugs.webkit.org/show_bug.cgi?id=20711>
+2009-05-11  Sam Weinig  <sam@webkit.org>
 
-        * kjs/CommonIdentifiers.cpp:
-        (JSC::CommonIdentifiers::CommonIdentifiers):
-        * kjs/CommonIdentifiers.h:
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::getValue):
-        (JSC::PropertySlot::putValue):
-        (JSC::PropertySlot::setValueSlot):
-        (JSC::PropertySlot::setValue):
-        (JSC::PropertySlot::setRegisterSlot):
-        * kjs/lookup.h:
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-        (JSC::Node::):
-        (JSC::ExpressionNode::):
-        (JSC::StatementNode::):
-        (JSC::NullNode::):
-        (JSC::BooleanNode::):
-        (JSC::NumberNode::):
-        (JSC::ImmediateNumberNode::):
-        (JSC::StringNode::):
-        (JSC::RegExpNode::):
-        (JSC::ThisNode::):
-        (JSC::ResolveNode::):
-        (JSC::ElementNode::):
-        (JSC::ArrayNode::):
-        (JSC::PropertyNode::):
-        (JSC::PropertyListNode::):
-        (JSC::ObjectLiteralNode::):
-        (JSC::BracketAccessorNode::):
-        (JSC::DotAccessorNode::):
-        (JSC::ArgumentListNode::):
-        (JSC::ArgumentsNode::):
-        (JSC::NewExprNode::):
-        (JSC::EvalFunctionCallNode::):
-        (JSC::FunctionCallValueNode::):
-        (JSC::FunctionCallResolveNode::):
-        (JSC::FunctionCallBracketNode::):
-        (JSC::FunctionCallDotNode::):
-        (JSC::PrePostResolveNode::):
-        (JSC::PostfixResolveNode::):
-        (JSC::PostfixBracketNode::):
-        (JSC::PostfixDotNode::):
-        (JSC::PostfixErrorNode::):
-        (JSC::DeleteResolveNode::):
-        (JSC::DeleteBracketNode::):
-        (JSC::DeleteDotNode::):
-        (JSC::DeleteValueNode::):
-        (JSC::VoidNode::):
-        (JSC::TypeOfResolveNode::):
-        (JSC::TypeOfValueNode::):
-        (JSC::PrefixResolveNode::):
-        (JSC::PrefixBracketNode::):
-        (JSC::PrefixDotNode::):
-        (JSC::PrefixErrorNode::):
-        (JSC::UnaryPlusNode::):
-        (JSC::NegateNode::):
-        (JSC::BitwiseNotNode::):
-        (JSC::LogicalNotNode::):
-        (JSC::MultNode::):
-        (JSC::DivNode::):
-        (JSC::ModNode::):
-        (JSC::AddNode::):
-        (JSC::SubNode::):
-        (JSC::LeftShiftNode::):
-        (JSC::RightShiftNode::):
-        (JSC::UnsignedRightShiftNode::):
-        (JSC::LessNode::):
-        (JSC::GreaterNode::):
-        (JSC::LessEqNode::):
-        (JSC::GreaterEqNode::):
-        (JSC::ThrowableBinaryOpNode::):
-        (JSC::InstanceOfNode::):
-        (JSC::InNode::):
-        (JSC::EqualNode::):
-        (JSC::NotEqualNode::):
-        (JSC::StrictEqualNode::):
-        (JSC::NotStrictEqualNode::):
-        (JSC::BitAndNode::):
-        (JSC::BitOrNode::):
-        (JSC::BitXOrNode::):
-        (JSC::LogicalOpNode::):
-        (JSC::ConditionalNode::):
-        (JSC::ReadModifyResolveNode::):
-        (JSC::AssignResolveNode::):
-        (JSC::ReadModifyBracketNode::):
-        (JSC::AssignBracketNode::):
-        (JSC::AssignDotNode::):
-        (JSC::ReadModifyDotNode::):
-        (JSC::AssignErrorNode::):
-        (JSC::CommaNode::):
-        (JSC::VarDeclCommaNode::):
-        (JSC::ConstDeclNode::):
-        (JSC::ConstStatementNode::):
-        (JSC::EmptyStatementNode::):
-        (JSC::DebuggerStatementNode::):
-        (JSC::ExprStatementNode::):
-        (JSC::VarStatementNode::):
-        (JSC::IfNode::):
-        (JSC::IfElseNode::):
-        (JSC::DoWhileNode::):
-        (JSC::WhileNode::):
-        (JSC::ForNode::):
-        (JSC::ContinueNode::):
-        (JSC::BreakNode::):
-        (JSC::ReturnNode::):
-        (JSC::WithNode::):
-        (JSC::LabelNode::):
-        (JSC::ThrowNode::):
-        (JSC::TryNode::):
-        (JSC::ParameterNode::):
-        (JSC::ScopeNode::):
-        (JSC::ProgramNode::):
-        (JSC::EvalNode::):
-        (JSC::FunctionBodyNode::):
-        (JSC::FuncExprNode::):
-        (JSC::FuncDeclNode::):
-        (JSC::CaseClauseNode::):
-        (JSC::ClauseListNode::):
-        (JSC::CaseBlockNode::):
-        (JSC::SwitchNode::):
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Cameron Zwarich.
 
-        Reviewed by Maciej Stachowiak.
+        Remove the NumberHeap.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::sweep):
+        (JSC::Heap::collect):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::statistics):
+        (JSC::typeName):
+        (JSC::Heap::isBusy):
+        * runtime/Collector.h:
+        (JSC::Heap::globalData):
+        * runtime/JSCell.h:
 
-        Bug 20704: Replace the KJS namespace
-        <https://bugs.webkit.org/show_bug.cgi?id=20704>
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
 
-        Rename the KJS namespace to JSC. There are still some uses of KJS in
-        preprocessor macros and comments, but these will also be changed some
-        time in the near future.
+        Reviewed by Sam Weinig.
+
+        Land initial commit of new number representation for 32 bit platforms,
+        with JIT disabled.
 
         * API/APICast.h:
         (toJS):
         (toRef):
-        (toGlobalRef):
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.cpp:
-        * API/JSCallbackObject.h:
         * API/JSCallbackObjectFunctions.h:
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::staticValues):
-        (OpaqueJSClass::staticFunctions):
-        * API/JSClassRef.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSProfilerPrivate.cpp:
-        * API/JSStringRef.cpp:
-        * API/JSValueRef.cpp:
-        (JSValueGetType):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * JavaScriptCore.Debug.exp:
-        * JavaScriptCore.base.exp:
-        * VM/CTI.cpp:
-        (JSC::):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/Instruction.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/LabelID.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Opcode.cpp:
-        * VM/Opcode.h:
-        * VM/Register.h:
-        (WTF::):
-        * VM/RegisterFile.cpp:
-        * VM/RegisterFile.h:
-        * VM/RegisterID.h:
-        (WTF::):
-        * VM/SamplingTool.cpp:
-        * VM/SamplingTool.h:
-        * VM/SegmentedVector.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayConstructor.h:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/ArrayPrototype.h:
-        * kjs/BatchedTransitionOptimizer.h:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.cpp:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/BooleanPrototype.h:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ClassInfo.h:
-        * kjs/CommonIdentifiers.cpp:
-        * kjs/CommonIdentifiers.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateConstructor.h:
-        * kjs/DateInstance.cpp:
-        (JSC::DateInstance::msToGregorianDateTime):
-        * kjs/DateInstance.h:
-        * kjs/DateMath.cpp:
-        * kjs/DateMath.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DatePrototype.h:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/Error.cpp:
-        * kjs/Error.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorConstructor.h:
-        * kjs/ErrorInstance.cpp:
-        * kjs/ErrorInstance.h:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ErrorPrototype.h:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/FunctionPrototype.h:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/GlobalEvalFunction.cpp:
-        * kjs/GlobalEvalFunction.h:
-        * kjs/IndexToNameMap.cpp:
-        * kjs/IndexToNameMap.h:
-        * kjs/InitializeThreading.cpp:
-        * kjs/InitializeThreading.h:
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::JSFunction):
-        * kjs/JSGlobalData.cpp:
+        (JSC::::hasInstance):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/tests/testapi.c:
+        (EvilExceptionObject_convertToType):
+        * AllInOneFile.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::privateExecute):
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::processClauseList):
+        * runtime/ArgList.h:
+        * runtime/Collector.h:
+        (JSC::sizeof):
+        * runtime/DateMath.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isAPIValueWrapper):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        * runtime/JSGlobalData.cpp:
         (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSLock.cpp:
-        * kjs/JSLock.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSType.h:
-        * kjs/JSValue.cpp:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.cpp:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.cpp:
-        * kjs/JSWrapperObject.h:
-        * kjs/LabelStack.cpp:
-        * kjs/LabelStack.h:
-        * kjs/MathObject.cpp:
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NativeErrorConstructor.h:
-        * kjs/NativeErrorPrototype.cpp:
-        * kjs/NativeErrorPrototype.h:
-        * kjs/NodeInfo.h:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/NumberPrototype.h:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectConstructor.h:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/Parser.cpp:
-        * kjs/Parser.h:
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        * kjs/PropertyNameArray.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/PrototypeFunction.cpp:
-        * kjs/PrototypeFunction.h:
-        * kjs/PutPropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/RegExpPrototype.h:
-        * kjs/ScopeChain.cpp:
-        * kjs/ScopeChain.h:
-        * kjs/ScopeChainMark.h:
-        * kjs/Shell.cpp:
-        (jscmain):
-        * kjs/SmallStrings.cpp:
-        * kjs/SmallStrings.h:
-        * kjs/SourceProvider.h:
-        * kjs/SourceRange.h:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringConstructor.h:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StringPrototype.h:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/SymbolTable.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/create_hash_table:
-        * kjs/debugger.cpp:
-        * kjs/debugger.h:
-        * kjs/dtoa.cpp:
-        * kjs/dtoa.h:
-        * kjs/grammar.y:
-        * kjs/identifier.cpp:
-        * kjs/identifier.h:
-        (JSC::Identifier::equal):
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lexer.cpp:
-        (JSC::Lexer::Lexer):
-        (JSC::Lexer::clear):
-        (JSC::Lexer::makeIdentifier):
-        * kjs/lexer.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-        * kjs/nodes2string.cpp:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * kjs/regexp.cpp:
-        * kjs/regexp.h:
-        * kjs/ustring.cpp:
-        * kjs/ustring.h:
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+        * runtime/JSObject.h:
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        * runtime/JSString.h:
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::description):
+        (JSC::nonInlineNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::EncodedJSValueHashTraits::emptyValue):
+        (JSC::jsNaN):
+        (JSC::operator==):
         (JSC::operator!=):
-        (JSC::IdentifierRepHash::hash):
-        (WTF::):
-        * masm/MacroAssembler.h:
-        * masm/MacroAssemblerWin.cpp:
-        * masm/X86Assembler.h:
-        * pcre/pcre_exec.cpp:
-        * profiler/CallIdentifier.h:
-        (WTF::):
-        * profiler/HeavyProfile.cpp:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.cpp:
-        * profiler/Profile.h:
-        * profiler/ProfileGenerator.cpp:
-        * profiler/ProfileGenerator.h:
-        * profiler/ProfileNode.cpp:
-        * profiler/ProfileNode.h:
-        * profiler/Profiler.cpp:
-        * profiler/Profiler.h:
-        * profiler/TreeProfile.cpp:
-        * profiler/TreeProfile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-        * wtf/AVLTree.h:
-
-2008-09-07  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        - rename IA32MacroAssembler class to X86Assembler
-        
-        We otherwise call the platform X86, and also, I don't see any macros.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * masm/IA32MacroAsm.h: Removed.
-        * masm/MacroAssembler.h:
-        (KJS::MacroAssembler::MacroAssembler):
-        * masm/MacroAssemblerWin.cpp:
-        (KJS::MacroAssembler::emitRestoreArgumentReference):
-        * masm/X86Assembler.h: Copied from masm/IA32MacroAsm.h.
-        (KJS::X86Assembler::X86Assembler):
-        * wrec/WREC.cpp:
-        (KJS::WRECGenerator::generateNonGreedyQuantifier):
-        (KJS::WRECGenerator::generateGreedyQuantifier):
-        (KJS::WRECGenerator::generateParentheses):
-        (KJS::WRECGenerator::generateBackreference):
-        (KJS::WRECGenerator::gernerateDisjunction):
-        * wrec/WREC.h:
-
-2008-09-07  Cameron Zwarich  <cwzwarich@webkit.org>
+        (JSC::toInt32):
+        (JSC::toUInt32):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        * runtime/PropertySlot.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        * wtf/Platform.h:
 
-        Not reviewed.
+=== Start merge of nitro-extreme branch 2009-07-30 ===
 
-        Visual C++ seems to have some odd casting rules, so just convert the
-        offending cast back to a C-style cast for now.
+2009-07-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * kjs/collector.cpp:
-        (KJS::otherThreadStackPointer):
+        Reviewed by George Staikos.
 
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Resolve class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=27708
 
-        Reviewed by Mark Rowe.
+        * API/JSClassRef.h:
+        * bytecode/SamplingTool.h:
+        * interpreter/Interpreter.h:
+        * jit/JIT.h:
+        * profiler/ProfileGenerator.h:
+        * profiler/Profiler.h:
+        * runtime/ClassInfo.h:
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
 
-        Attempt to fix the Windows build by using a const_cast to cast regs.Esp
-        to a uintptr_t instead of a reinterpret_cast.
+2009-07-28  Ada Chan  <adachan@apple.com>        
 
-        * kjs/collector.cpp:
-        (KJS::otherThreadStackPointer):
+        Reviewed by Darin Adler.
 
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        https://bugs.webkit.org/show_bug.cgi?id=27236
+        - Implement TCMalloc_SystemRelease and TCMalloc_SystemCommit for Windows.
+        - Use a background thread to periodically scavenge memory to release back to the system.
 
-        Reviewed by Sam Weinig.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
+        (WTF::TCMalloc_PageHeap::scavenge):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::sleep):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        (TCMalloc_SystemCommit):
+        * wtf/TCSystemAlloc.h:
 
-        Remove C-style casts from kjs/collector.cpp.
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
 
-        * kjs/collector.cpp:
-        (KJS::Heap::heapAllocate):
-        (KJS::currentThreadStackBase):
-        (KJS::Heap::markConservatively):
-        (KJS::otherThreadStackPointer):
-        (KJS::Heap::markOtherThreadConservatively):
-        (KJS::Heap::sweep):
+        Add new files, fixes distcheck.
 
-2008-09-07  Mark Rowe  <mrowe@apple.com>
+        * GNUmakefile.am:
 
-        Build fix for the debug variant.
+2009-07-28  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        * DerivedSources.make: Also use the .Debug.exp exports file when building the debug variant.
+        Reviewed by Simon Hausmann.
 
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        [Qt] Determining whether to use JIT or interpreter
+        moved from JavaScriptCore.pri to Platform.h
 
-        Reviewed by Timothy Hatcher.
+        * JavaScriptCore.pri:
+        * wtf/Platform.h:
 
-        Remove C-style casts from the CTI code.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::ctiRepatchCallByReturnAddress):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-
-=== End merge of squirrelfish-extreme ===
-
-2008-09-06  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig. Adapted somewhat by Maciej Stachowiak.
-        
-        - refactor WREC to share more of the JIT infrastructure with CTI
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::emitPutCTIParam):
-        (KJS::CTI::emitGetCTIParam):
-        (KJS::CTI::emitPutToCallFrameHeader):
-        (KJS::CTI::emitGetFromCallFrameHeader):
-        (KJS::CTI::emitPutResult):
-        (KJS::CTI::emitDebugExceptionCheck):
-        (KJS::CTI::emitJumpSlowCaseIfNotImm):
-        (KJS::CTI::emitJumpSlowCaseIfNotImms):
-        (KJS::CTI::emitFastArithDeTagImmediate):
-        (KJS::CTI::emitFastArithReTagImmediate):
-        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::emitFastArithImmToInt):
-        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
-        (KJS::CTI::emitFastArithIntToImmNoCheck):
-        (KJS::CTI::CTI):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        (KJS::CTI::privateCompile):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        (KJS::CTI::compileRegExp):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::JmpTable::JmpTable):
-        (KJS::SlowCaseEntry::SlowCaseEntry):
-        (KJS::CTI::JSRInfo::JSRInfo):
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp):
-        * wrec/WREC.cpp:
-        (KJS::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
-        (KJS::GeneratePatternCharacterFunctor::generateAtom):
-        (KJS::GeneratePatternCharacterFunctor::backtrack):
-        (KJS::GenerateCharacterClassFunctor::generateAtom):
-        (KJS::GenerateCharacterClassFunctor::backtrack):
-        (KJS::GenerateBackreferenceFunctor::generateAtom):
-        (KJS::GenerateBackreferenceFunctor::backtrack):
-        (KJS::GenerateParenthesesNonGreedyFunctor::generateAtom):
-        (KJS::GenerateParenthesesNonGreedyFunctor::backtrack):
-        (KJS::WRECGenerate::generateBacktrack1):
-        (KJS::WRECGenerate::generateBacktrackBackreference):
-        (KJS::WRECGenerate::generateBackreferenceQuantifier):
-        (KJS::WRECGenerate::generateNonGreedyQuantifier):
-        (KJS::WRECGenerate::generateGreedyQuantifier):
-        (KJS::WRECGenerate::generatePatternCharacter):
-        (KJS::WRECGenerate::generateCharacterClassInvertedRange):
-        (KJS::WRECGenerate::generateCharacterClassInverted):
-        (KJS::WRECGenerate::generateCharacterClass):
-        (KJS::WRECGenerate::generateParentheses):
-        (KJS::WRECGenerate::generateParenthesesNonGreedy):
-        (KJS::WRECGenerate::gererateParenthesesResetTrampoline):
-        (KJS::WRECGenerate::generateAssertionBOL):
-        (KJS::WRECGenerate::generateAssertionEOL):
-        (KJS::WRECGenerate::generateAssertionWordBoundary):
-        (KJS::WRECGenerate::generateBackreference):
-        (KJS::WRECGenerate::gernerateDisjunction):
-        (KJS::WRECGenerate::terminateDisjunction):
-        (KJS::WRECParser::parseGreedyQuantifier):
-        (KJS::WRECParser::parseQuantifier):
-        (KJS::WRECParser::parsePatternCharacterQualifier):
-        (KJS::WRECParser::parseCharacterClassQuantifier):
-        (KJS::WRECParser::parseBackreferenceQuantifier):
-        (KJS::WRECParser::parseParentheses):
-        (KJS::WRECParser::parseCharacterClass):
-        (KJS::WRECParser::parseOctalEscape):
-        (KJS::WRECParser::parseEscape):
-        (KJS::WRECParser::parseTerm):
-        (KJS::WRECParser::parseDisjunction):
-        * wrec/WREC.h:
-        (KJS::WRECGenerate::WRECGenerate):
-        (KJS::WRECParser::):
-        (KJS::WRECParser::WRECParser):
-        (KJS::WRECParser::parseAlternative):
-        (KJS::WRECParser::isEndOfPattern):
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
 
-2008-09-06  Oliver Hunt  <oliver@apple.com>
+        Fix of misuse of sort command.
 
-        Reviewed by NOBODY (Build fix).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Fix the sampler build.
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
 
-        * VM/SamplingTool.h:
+        Build fix for Windows.
 
-2008-09-06  Oliver Hunt  <oliver@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Reviewed by Maciej Stachowiak.
+2009-07-27  Gavin Barraclough  <barraclough@apple.com>
 
-        Jump through the necessary hoops required to make MSVC cooperate with SFX
+        Rubber stamped by Oliver Hunt.
 
-        We now explicitly declare the calling convention on all cti_op_* cfunctions,
-        and return int instead of bool where appropriate (despite the cdecl calling
-        convention seems to state MSVC generates code that returns the result value
-        through ecx).  SFX behaves slightly differently under MSVC, specifically it
-        stores the base argument address for the cti_op_* functions in the first
-        argument, and then does the required stack manipulation through that pointer.
-        This is necessary as MSVC's optimisations assume they have complete control
-        of the stack, and periodically elide our stack manipulations, or move
-        values in unexpected ways.  MSVC also frequently produces tail calls which may
-        clobber the first argument, so the MSVC path is slightly less efficient due
-        to the need to restore it.
+        Fix tyop in JIT, renamed preverveReturnAddressAfterCall -> preserveReturnAddressAfterCall.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (KJS::):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * masm/MacroAssembler.h:
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * masm/MacroAssemblerIA32GCC.cpp: Removed.
-           For performance reasons we need these no-op functions to be inlined.
-
-        * masm/MacroAssemblerWin.cpp:
-        (KJS::MacroAssembler::emitRestoreArgumentReference):
-        * wtf/Platform.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
 
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak, or maybe the other way around.
-        
-        Added the ability to coalesce JITCode buffer grow operations by first
-        growing the buffer and then executing unchecked puts to it.
-        
-        About a 2% speedup on date-format-tofte.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::compileOpCall):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::ensureSpace):
-        (KJS::JITCodeBuffer::putByteUnchecked):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShortUnchecked):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putIntUnchecked):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rr_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_rm_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_opr):
-        (KJS::IA32MacroAssembler::emitModRm_opr_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_opm_Unchecked):
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
 
-        Reviewed by Sam Weinig.
+        Gtk build fix.
 
-        Disable WREC and CTI on platforms that we have not yet had a chance to test with.
+        * runtime/JSLock.cpp: (JSC::JSLock::JSLock): Fix "no threading" case.
 
-        * wtf/Platform.h:
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
 
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+        Release build fix.
 
-        Reviewed by Sam Weinig.
-        
-        Use jo instead of a mask compare when fetching array.length and
-        string.length. 4% speedup on array.length / string.length torture
-        test.
+        * runtime/JSLock.h: (JSC::JSLock::~JSLock):
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
 
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=27735
+        Give a helpful name to JSLock constructor argument
 
-        Removed a CTI compilation pass by recording labels during bytecode
-        generation. This is more to reduce complexity than it is to improve
-        performance.
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (functionGC):
+        (cleanupGlobalData):
+        (jscmain):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC::):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
 
-        SunSpider reports no change.
+2009-07-25  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        CodeBlock now keeps a "labels" set, which holds the offsets of all the
-        instructions that can be jumped to.
-
-        * VM/CTI.cpp: Nixed a pass.
-
-        * VM/CodeBlock.h: Added a "labels" set.
-
-        * VM/LabelID.h: No need for a special LableID for holding jump
-        destinations, since the CodeBlock now knows all jump destinations.
-
-        * wtf/HashTraits.h: New hash traits to accomodate putting offset 0 in
-        the set.
-
-        * kjs/nodes.cpp:
-        (KJS::TryNode::emitCode): Emit a dummy label to record sret targets.
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        Move the JITCodeBuffer onto Machine and remove the static variables.
-
-        * VM/CTI.cpp: Initialize m_jit with the Machine's code buffer.
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine): Allocate a JITCodeBuffer.
-        * VM/Machine.h:
-        * kjs/RegExpConstructor.cpp:
-        (KJS::constructRegExp): Pass the ExecState through.
-        * kjs/RegExpPrototype.cpp:
-        (KJS::regExpProtoFuncCompile): Ditto.
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncMatch): Ditto.
-        (KJS::stringProtoFuncSearch): Ditto.
-        * kjs/nodes.cpp:
-        (KJS::RegExpNode::emitCode): Compile the pattern at code generation time
-        so that we have access to an ExecState.
-        * kjs/nodes.h:
-        (KJS::RegExpNode::):
-        * kjs/nodes2string.cpp:
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp): Pass the ExecState through.
-        (KJS::RegExp::create): Ditto.
-        * kjs/regexp.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::IA32MacroAssembler): Reset the JITCodeBuffer when we are
-        constructed.
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compile): Retrieve the JITCodeBuffer from the Machine.
-        * wrec/WREC.h:
+        Reviewed by Eric Seidel.
 
-2008-09-05  Mark Rowe  <mrowe@apple.com>
+        Allow custom memory allocation control for OpaqueJSPropertyNameArray struct
+        https://bugs.webkit.org/show_bug.cgi?id=27342
 
-        Reviewed by Oliver Hunt and Gavin Barraclough.
+        Inherits OpaqueJSPropertyNameArray struct from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/API/JSObjectRef.cpp:473.
 
-        Fix the build when CTI is disabled.
+        * API/JSObjectRef.cpp:
 
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/CodeGenerator.cpp:
-        (KJS::prepareJumpTableForStringSwitch):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::~Machine):
+2009-07-24  Ada Chan  <adachan@apple.com>
 
-2008-09-05  Gavin Barraclough  <barraclough@apple.com>
+        In preparation for https://bugs.webkit.org/show_bug.cgi?id=27236:
+        Remove TCMALLOC_TRACK_DECOMMITED_SPANS.  We'll always track decommitted spans.
+        We have tested this and show it has little impact on performance.
 
         Reviewed by Mark Rowe.
 
-        Fix some windows abi issues.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::propagateDecommittedState):
+        (WTF::mergeDecommittedStates):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_post_dec):
-        * VM/Machine.h:
+2009-07-24  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-2008-09-05  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Darin Adler and Adam Barth.
 
-        Reviewed by Sam Weinig.
+        Build fix for x86 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=27602
 
-        Fix ecma/FunctionObjects/15.3.5.3.js after I broke it in r93.
+        * jit/JIT.cpp:
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_NotJSFunction): Restore m_callFrame to the correct value after making the native call.
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+2009-07-23  Kevin Ollivier  <kevino@theolliviers.com>
 
-2008-09-04  Mark Rowe  <mrowe@apple.com>
+        wx build fix, adding missing header.
 
-        Reviewed by Sam Weinig.
+        * jit/JIT.cpp:
 
-        Fix fast/dom/Window/console-functions.html.
+2009-07-22  Yong Li  <yong.li@torchmobile.com>
 
-        The call frame on the ExecState was not being updated on calls into native functions.  This meant that functions
-        such as console.log would use the line number of the last JS function on the call stack.
+        Reviewed by George Staikos.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_NotJSFunction): Update the ExecState's call frame before making a native function call,
-        and restore it when the function is done.
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+        Add wince specific memory files into wtf/wince
+        https://bugs.webkit.org/show_bug.cgi?id=27550
 
-2008-09-05  Oliver Hunt  <oliver@apple.com>
+        * wtf/wince/FastMallocWince.h: Added.
+        * wtf/wince/MemoryManager.cpp: Added.
+        * wtf/wince/MemoryManager.h: Added.
 
-        Start bringing up SFX on windows.
+2009-07-23  Norbert Leser  <norbert.leser@nokia.com>
 
-        Reviewed by Mark Rowe and Sam Weinig
+        Reviewed by Simon Hausmann.
 
-        Start doing the work to bring up SFX on windows.  Initially
-        just working on WREC, as it does not make any calls so reduces
-        the amount of code that needs to be corrected.
-        
-        Start abstracting the CTI JIT codegen engine.
+        Fix for missing mmap features in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=24540
 
-        * ChangeLog:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * masm/IA32MacroAsm.h:
-        * masm/MacroAssembler.h: Added.
-        (KJS::MacroAssembler::MacroAssembler):
-        * masm/MacroAssemblerIA32GCC.cpp: Added.
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * masm/MacroAssemblerWin.cpp: Added.
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseGreedyQuantifier):
-        (KJS::WRECompiler::parseCharacterClass):
-        (KJS::WRECompiler::parseEscape):
-        (KJS::WRECompiler::compilePattern):
-        * wrec/WREC.h:
+        Fix, conditionally for PLATFORM(SYMBIAN), as an alternative 
+        to missing support for the MAP_ANON property flag in mmap. 
+        It utilizes Symbian specific memory allocation features.
 
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+        * runtime/Collector.cpp
 
-        Reviewed by Sam Weinig.
+2009-07-22  Gavin Barraclough  <barraclough@apple.com>
 
-        Support for slow scripts (timeout checking).
+        Reviewed by Sam Weinig.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (KJS::slideRegisterWindowForCall):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_vm_throw):
+        With ENABLE(ASSEMBLER_WX_EXCLUSIVE), only change permissions once per repatch event.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27564 )
 
-2008-09-04  Sam Weinig  <sam@webkit.org>
+        Currently we change permissions forwards and backwards for each instruction modified,
+        instead we should only change permissions once per complete repatching event.
 
-        Reviewed by Mark Rowe.
+        2.5% progression running with ENABLE(ASSEMBLER_WX_EXCLUSIVE) enabled,
+        which recoups 1/3 of the penalty of running with this mode enabled.
 
-        Third round of style cleanup.
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+            - Replace usage of MakeWritable with cacheFlush.
+        
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::patchPointerInternal):
+        (JSC::ARMAssembler::repatchLoadPtrToLEA):
+            - Replace usage of MakeWritable with cacheFlush.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
+        (JSC::ARMv7Assembler::setInt32):
+            - Replace usage of MakeWritable with cacheFlush.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::performFinalization):
+            - Make explicit call to cacheFlush.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+            - Make size always available.
+
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::~RepatchBuffer):
+            - Add calls to MakeWritable & makeExecutable.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+            - Remove usage of MakeWritable.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getJITCode):
+            - Provide access to CodeBlock's JITCode.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeExecutable):
+        (JSC::ExecutableAllocator::cacheFlush):
+            - Remove MakeWritable, make cacheFlush public.
+
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+            - Add CodeBlock argument to RepatchBuffer.
+
+        * jit/JIT.h:
+            - Pass CodeBlock argument for use by RepatchBuffer.
+
+        * jit/JITCode.h:
+        (JSC::JITCode::start):
+        (JSC::JITCode::size):
+            - Provide access to code start & size.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+            - Add CodeBlock argument to RepatchBuffer.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            - Pass CodeBlock argument for use by RepatchBuffer.
+
+2009-07-21  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Cache not only the structure of the method, but the
+        structure of its prototype as well.
+        https://bugs.webkit.org/show_bug.cgi?id=27077
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
 
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/ExecState.h:
+2009-07-21  Gavin Barraclough  <barraclough@apple.com>
 
-2008-09-04  Sam Weinig  <sam@webkit.org>
+        Reviewed by Sam Weinig.
 
-        Reviewed by Jon Honeycutt.
+        Move call linking / repatching down from AbstractMacroAssembler into MacroAssemblerARCH classes.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27527 )
 
-        Second round of style cleanup.
+        This allows the implementation to be defined per architecture.  Specifically this addresses the
+        fact that x86-64 MacroAssembler implements far calls as a load to register, followed by a call
+        to register.  Patching the call actually requires the pointer load to be patched, rather than
+        the call to be patched.  This is implementation detail specific to MacroAssemblerX86_64, and as
+        such is best handled there.
 
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * wrec/WREC.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::linkCall):
+        (JSC::MacroAssemblerARM::repatchCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::linkCall):
+        (JSC::MacroAssemblerARMv7::repatchCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        (JSC::MacroAssemblerX86::repatchCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        (JSC::MacroAssemblerX86_64::repatchCall):
 
-2008-09-04  Sam Weinig  <sam@webkit.org>
+2009-07-21  Adam Treat  <adam.treat@torchmobile.com>
 
-        Reviewed by Mark Rowe.
+        Reviewed by George Staikos.
 
-        First round of style cleanup.
+        Every wtf file includes other wtf files with <> style includes
+        except this one.  Fix the exception.
 
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * masm/IA32MacroAsm.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
+        * wtf/ByteArray.h:
 
-2008-09-04  Geoffrey Garen  <ggaren@apple.com>
+2009-07-21  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Mark Rowe.
-        
-        Merged http://trac.webkit.org/changeset/36081 to work with CTI.
+        Reviewed by Oliver Hunt.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::tryCtiCacheGetByID):
+        Move LinkBuffer/RepatchBuffer out of AbstractMacroAssembler.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27485 )
 
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+        This change is the first step in a process to move code that should be in
+        the architecture-specific MacroAssembler classes up out of Assmbler and
+        AbstractMacroAssembler.
 
-        Reviewed by Sam Weinig.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - added new files
+        
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::linkPointer):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+        
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::linkCall):
+        (JSC::ARMv7Assembler::linkPointer):
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::setPointer):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::linkJump):
+        (JSC::AbstractMacroAssembler::linkCall):
+        (JSC::AbstractMacroAssembler::linkPointer):
+        (JSC::AbstractMacroAssembler::getLinkerAddress):
+        (JSC::AbstractMacroAssembler::getLinkerCallReturnOffset):
+        (JSC::AbstractMacroAssembler::repatchJump):
+        (JSC::AbstractMacroAssembler::repatchCall):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchInt32):
+        (JSC::AbstractMacroAssembler::repatchPointer):
+        (JSC::AbstractMacroAssembler::repatchLoadPtrToLEA):
+            - remove the LinkBuffer/RepatchBuffer classes, but leave a set of (private, friended) methods to interface to the Assembler
+
+        * assembler/LinkBuffer.h: Added.
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (JSC::LinkBuffer::link):
+        (JSC::LinkBuffer::patch):
+        (JSC::LinkBuffer::locationOf):
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::returnAddressOffset):
+        (JSC::LinkBuffer::finalizeCode):
+        (JSC::LinkBuffer::finalizeCodeAddendum):
+        (JSC::LinkBuffer::code):
+        (JSC::LinkBuffer::performFinalization):
+            - new file containing the LinkBuffer class, previously a member of AbstractMacroAssembler
+
+        * assembler/RepatchBuffer.h: Added.
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::relink):
+        (JSC::RepatchBuffer::repatch):
+        (JSC::RepatchBuffer::repatchLoadPtrToLEA):
+        (JSC::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::RepatchBuffer::relinkCallerToFunction):
+        (JSC::RepatchBuffer::relinkNearCallerToTrampoline):
+            - new file containing the RepatchBuffer class, previously a member of AbstractMacroAssembler
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::linkPointerForCall):
+        (JSC::X86Assembler::linkPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::setPointer):
+        (JSC::X86Assembler::setInt32):
+        (JSC::X86Assembler::setRel32):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+            - include new headers
+            - remove MacroAssembler:: specification from RepatchBuffer usage
+
+        * jit/JITPropertyAccess.cpp:
+        * yarr/RegexJIT.cpp:
+            - include new headers
+
+2009-07-21  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Fixed #undef typo.
+        https://bugs.webkit.org/show_bug.cgi?id=27506
+
+        * bytecode/Opcode.h:
+
+2009-07-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r46153, r46154, and r46155
+
+        These changes were causing build failures and assertion failures on
+        Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Removed.
 
-        Enable profiling in CTI.
+2009-07-21  Roland Steiner  <rolandsteiner@google.com>
 
-        * VM/CTI.h:
-        (KJS::):
-        (KJS::CTI::execute):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
+        Reviewed by David Levin.
 
-2008-09-04  Victor Hernandez  <vhernandez@apple.com>
+        Add ENABLE_RUBY to list of build options
+        https://bugs.webkit.org/show_bug.cgi?id=27324
 
-        Reviewed by Geoffrey Garen.
-        
-        Fixed an #if to support using WREC without CTI.
+        * Configurations/FeatureDefines.xcconfig: Added flag ENABLE_RUBY.
 
-        * kjs/regexp.cpp:
-        (KJS::RegExp::match):
+2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+        Build fix attempt #2
 
-        Reviewed by Oliver Hunt.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        The array/string length trampolines are owned by the Machine, not the codeblock that compiled them.
+2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        * VM/Machine.cpp:
-        (KJS::Machine::~Machine):
-        * VM/Machine.h:
+        Build fix attempt #1
 
-2008-09-04  Mark Rowe  <mrowe@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Reviewed by Gavin Barraclough and Sam Weinig.
+2009-07-20  Oliver Hunt  <oliver@apple.com>
 
-        Fix a crash on launch of jsc when GuardMalloc is enabled.
+        Reviewed by Gavin Barraclough.
 
-        * kjs/ScopeChain.h:
-        (KJS::ScopeChain::ScopeChain): Initialize m_node to 0 when we have no valid scope chain.
-        (KJS::ScopeChain::~ScopeChain): Null-check m_node before calling deref.
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
 
-2008-09-03  Oliver Hunt  <oliver@apple.com>
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator Maybe<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/PossiblyNull.h:
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::PossiblyNull::getValue):
+        * wtf/Platform.h:
 
-        Fix inspector and fast array access so that it bounds
-        checks correctly.
+2009-07-20  Gavin Barraclough  <barraclough@apple.com>
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitUnlinkedJb):
-        (KJS::IA32MacroAssembler::emitUnlinkedJbe):
+        RS Oliver Hunt.
 
-2008-09-03  Mark Rowe  <mrowe@apple.com>
+        Add ARM assembler files to xcodeproj, for convenience editing.
 
-        Move the assertion after the InitializeAndReturn block, as
-        that is used even when CTI is enabled.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
+2009-07-20  Jessie Berlin  <jberlin@apple.com>
 
-2008-09-03  Mark Rowe  <mrowe@apple.com>
+        Reviewed by David Levin.
 
-        Reviewed by Sam Weinig.
+        Fix an incorrect assertion in Vector::remove.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27477
 
-        Replace calls to exit with ASSERT_WITH_MESSAGE or ASSERT_NOT_REACHED.
+        * wtf/Vector.h:
+        (WTF::::remove):
+        Assert that the position at which to start removing elements + the
+        length (the number of elements to remove) is less than or equal to the
+        size of the entire Vector.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_vm_throw):
+2009-07-20  Peter Kasting  <pkasting@google.com>
 
-2008-09-03  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Mark Rowe.
 
-        Reviewed by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=27468
+        Back out r46060, which caused problems for some Apple developers.
 
-        Tweak JavaScriptCore to compile on non-x86 platforms.  This is achieved
-        by wrapping more code with ENABLE(CTI), ENABLE(WREC), and PLATFORM(X86)
-        #if's.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::printStructureIDs): Use %td as the format specifier for
-        printing a ptrdiff_t.
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp):
-        (KJS::RegExp::~RegExp):
-        (KJS::RegExp::match):
-        * kjs/regexp.h:
-        * masm/IA32MacroAsm.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-        * wtf/Platform.h: Only enable CTI and WREC on x86.  Add an extra define to
-        track whether any MASM-using features are enabled.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 
-2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Oliver Hunt.
 
-        Copy Geoff's array/string length optimization for CTI.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        * VM/CTI.h:
-        (KJS::CTI::compileArrayLengthTrampoline):
-        (KJS::CTI::compileStringLengthTrampoline):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::getCtiArrayLengthTrampoline):
-        (KJS::Machine::getCtiStringLengthTrampoline):
-        (KJS::Machine::tryCtiCacheGetByID):
-        (KJS::Machine::cti_op_get_by_id_second):
-        * VM/Machine.h:
-        * kjs/JSString.h:
-        * kjs/ustring.h:
-
-2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+        Allow custom memory allocation control in NewThreadContext
+        https://bugs.webkit.org/show_bug.cgi?id=27338
 
-        Reviewed by Oliver Hunt.
-
-        Implement fast array accesses in CTI - 2-3% progression on sunspider.
+        Inherits NewThreadContext struct from FastAllocBase because it
+        has been instantiated by 'new' JavaScriptCore/wtf/Threading.cpp:76.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::emitFastArithIntToImmNoCheck):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/CTI.h:
-        * kjs/JSArray.h:
+        * wtf/Threading.cpp:
 
-2008-09-02  Gavin Barraclough  <barraclough@apple.com>
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Oliver Hunt.
 
-        Enable fast property access support in CTI.
-
-        * VM/CTI.cpp:
-        (KJS::ctiSetReturnAddress):
-        (KJS::ctiRepatchCallByReturnAddress):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        * VM/CTI.h:
-        (KJS::CTI::compileGetByIdSelf):
-        (KJS::CTI::compileGetByIdProto):
-        (KJS::CTI::compileGetByIdChain):
-        (KJS::CTI::compilePutByIdReplace):
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        (KJS::doSetReturnAddressVmThrowTrampoline):
-        (KJS::Machine::tryCtiCachePutByID):
-        (KJS::Machine::tryCtiCacheGetByID):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_put_by_id_second):
-        (KJS::Machine::cti_op_put_by_id_generic):
-        (KJS::Machine::cti_op_put_by_id_fail):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_get_by_id_second):
-        (KJS::Machine::cti_op_get_by_id_generic):
-        (KJS::Machine::cti_op_get_by_id_fail):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * kjs/JSCell.h:
-        * kjs/JSObject.h:
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (KJS::StructureIDChain::StructureIDChain):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-
-2008-09-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        A backslash (\) at the of a RegEx should produce an error.
-        Fixes fast/regex/test1.html.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseEscape):
-
-2008-09-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Link jumps for the slow case of op_loop_if_less.  Fixes acid3.
+        Allow custom memory allocation control in JavaScriptCore's JSClassRef.h
+        https://bugs.webkit.org/show_bug.cgi?id=27340
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass4_SlowCases):
+        Inherit StaticValueEntry and StaticFunctionEntry struct from FastAllocBase because these
+        have been instantiated by 'new' in JavaScriptCore/API/JSClassRef.cpp:153
+        and in JavaScriptCore/API/JSClassRef.cpp:166.
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        * API/JSClassRef.h:
 
-        Rubber-stamped by Maciej Stachowiak.
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Switch WREC on by default.
+        Reviewed by Darin Adler.
 
-        * wtf/Platform.h:
+        Allow custom memory allocation control in JavaScriptCore's RegexPattern.h
+        https://bugs.webkit.org/show_bug.cgi?id=27343
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        Inherits RegexPattern.h's structs (which have been instantiated by operator new) from FastAllocBase:
 
-        Reviewed by Mark Rowe.
+        CharacterClass (new call: JavaScriptCore/yarr/RegexCompiler.cpp:144)
+        PatternAlternative (new call: JavaScriptCore/yarr/RegexPattern.h:221) 
+        PatternDisjunction (new call: JavaScriptCore/yarr/RegexCompiler.cpp:446)
 
-        Fix two failures in fast/regex/test1.html
-          - \- in a character class should be treated as a literal -
-          - A missing max quantifier needs to be treated differently than
-            a null max quantifier.
+        * yarr/RegexPattern.h:
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateNonGreedyQuantifier):
-        (KJS::WRECompiler::generateGreedyQuantifier):
-        (KJS::WRECompiler::parseCharacterClass):
-        * wrec/WREC.h:
-        (KJS::Quantifier::Quantifier):
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Mark Rowe.
+        Allow custom memory allocation control for JavaScriptCore's MatchFrame struct
+        https://bugs.webkit.org/show_bug.cgi?id=27344
 
-        Fix crash in fast/js/kde/evil-n.html
+        Inherits MatchFrame struct from FastAllocBase because it has
+        been instantiated by 'new' JavaScriptCore/pcre/pcre_exec.cpp:359.
 
-        * kjs/regexp.cpp: Always pass a non-null offset vector to the wrec function.
+        * pcre/pcre_exec.cpp:
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Gavin Barraclough and Mark Rowe.
+        Reviewed by Holger Freyther.
 
-        Add pattern length limit fixing one test in fast/js.
+        Remove some outdated S60 platform specific code
+        https://bugs.webkit.org/show_bug.cgi?id=27423
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compile):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::):
+        * wtf/Platform.h:
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+2009-07-20  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        Reviewed by Gavin Barraclough and Mark Rowe.
+        Reviewed by Simon Hausmann.
 
-        Make octal escape parsing/back-reference parsing more closely match 
-        prior behavior fixing one test in fast/js.
+        Qt build fix with MSVC and MinGW.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseCharacterClass): 8 and 9 should be IdentityEscaped
-        (KJS::WRECompiler::parseEscape):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::peekDigit):
+        * jsc.pro: Make sure jsc is a console application, and turn off
+        exceptions and stl support to fix the build.
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Gavin Barraclough and Mark Rowe.
+        Reviewed by Gustavo Noronha.
 
-        Fix one mozilla test.
+        Do not use C++-style comments in preprocessor directives.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateCharacterClassInverted): Fix incorrect not
-        ascii upper check.
+        GCC does not like this in some configurations, using C-style
+        comments is safer.
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        * wtf/Platform.h:
 
-        Reviewed by Gavin Barraclough and Mark Rowe.
+2009-07-17  Peter Kasting  <pkasting@google.com>
 
-        Parse octal escapes in character classes fixing one mozilla test.
+        Reviewed by Steve Falkenburg.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseCharacterClass):
-        (KJS::WRECompiler::parseOctalEscape):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::consumeOctal):
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 
-        Reviewed by Oliver Hunt.
+2009-07-17  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        Fixes two mozilla tests with WREC enabled.
+        Reviewed by Gavin Barraclough.
 
-        * wrec/WREC.cpp:
-        (KJS::CharacterClassConstructor::append): Keep the character class sorted
-        when appending another character class.
+        Add YARR support for generic ARM platforms (disabled by default).
+        https://bugs.webkit.org/show_bug.cgi?id=24986
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        Add generic ARM port for MacroAssembler. It supports the whole
+        MacroAssembler functionality except floating point.
 
-        Reviewed by Gavin Barraclough and Mark Rowe.
+        The class JmpSrc is extended with a flag which enables to patch
+        the jump destination offset during execution. This feature is
+        required for generic ARM port.
 
-        Fixes two mozilla tests with WREC enabled.
+        Signed off by Zoltan Herczeg <zherczeg@inf.u-szeged.hu>
+        Signed off by Gabor Loki <loki@inf.u-szeged.hu>
 
-        * wrec/WREC.cpp:
-        (KJS::CharacterClassConstructor::addSortedRange): Insert the range at the correct position
-        instead of appending it to the end.
+        * JavaScriptCore.pri:
+        * assembler/ARMAssembler.cpp: Added.
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::getOp2):
+        (JSC::ARMAssembler::genInt):
+        (JSC::ARMAssembler::getImm):
+        (JSC::ARMAssembler::moveImm):
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h: Added.
+        (JSC::ARM::):
+        (JSC::ARMAssembler::ARMAssembler):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::JmpSrc::enableLatePatch):
+        (JSC::ARMAssembler::JmpDst::JmpDst):
+        (JSC::ARMAssembler::JmpDst::isUsed):
+        (JSC::ARMAssembler::JmpDst::used):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::and_r):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eor_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::sub_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsb_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::add_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adc_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbc_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rsc_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::orr_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::mov_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bic_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvn_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::mul_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::mull_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::ldrh_r):
+        (JSC::ARMAssembler::ldrh_d):
+        (JSC::ARMAssembler::ldrh_u):
+        (JSC::ARMAssembler::strh_r):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::poke_r):
+        (JSC::ARMAssembler::peek_r):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bkpt):
+        (JSC::ARMAssembler::lsl):
+        (JSC::ARMAssembler::lsr):
+        (JSC::ARMAssembler::asr):
+        (JSC::ARMAssembler::lsl_r):
+        (JSC::ARMAssembler::lsr_r):
+        (JSC::ARMAssembler::asr_r):
+        (JSC::ARMAssembler::size):
+        (JSC::ARMAssembler::ensureSpace):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::align):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::patchPointerInternal):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::patchPointer):
+        (JSC::ARMAssembler::repatchInt32):
+        (JSC::ARMAssembler::repatchPointer):
+        (JSC::ARMAssembler::repatchLoadPtrToLEA):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::relinkJump):
+        (JSC::ARMAssembler::linkCall):
+        (JSC::ARMAssembler::relinkCall):
+        (JSC::ARMAssembler::getRelocatedAddress):
+        (JSC::ARMAssembler::getDifferenceBetweenLabels):
+        (JSC::ARMAssembler::getCallReturnOffset):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::placeConstantPoolBarrier):
+        (JSC::ARMAssembler::RM):
+        (JSC::ARMAssembler::RS):
+        (JSC::ARMAssembler::RD):
+        (JSC::ARMAssembler::RN):
+        (JSC::ARMAssembler::getConditionalField):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpSrc::enableLatePatch):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::enableLatePatch):
+        (JSC::AbstractMacroAssembler::Jump::enableLatePatch):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h: Added.
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::not32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::load32):
+        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerARM::load16):
+        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::pop):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::swap):
+        (JSC::MacroAssemblerARM::signExtend32ToPtr):
+        (JSC::MacroAssemblerARM::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::jump):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::mull32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::breakpoint):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::ret):
+        (JSC::MacroAssemblerARM::set32):
+        (JSC::MacroAssemblerARM::setTest32):
+        (JSC::MacroAssemblerARM::tailRecursiveCall):
+        (JSC::MacroAssemblerARM::makeTailRecursiveCall):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::storePtrWithPatch):
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::ARMCondition):
+        (JSC::MacroAssemblerARM::prepareCall):
+        (JSC::MacroAssemblerARM::call32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::enableLatePatch):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
 
-2008-09-01  Gavin Barraclough  <barraclough@apple.com>
+2009-07-17  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Gavin Barraclough.
 
-        Move cross-compilation unit call into NEVER_INLINE function.
+        Extend AssemblerBuffer with constant pool handling mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
 
-        * VM/Machine.cpp:
-        (KJS::doSetReturnAddressVmThrowTrampoline):
+        Add a platform independed constant pool framework.
+        This pool can store 32 or 64 bits values which is enough to hold
+        any integer, pointer or double constant.
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        (JSC::AssemblerBuffer::append):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/AssemblerBufferWithConstantPool.h: Added.
+        (JSC::):
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+2009-07-17  Eric Roman  <eroman@chromium.org>
 
-        Fix one test in fast/js.
+        Reviewed by Darin Adler.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Throw a createNotAConstructorError,
-        instead of a createNotAFunctionError.
+        Build fix for non-Darwin.
+        Add a guard for inclusion of RetainPtr.h which includes CoreFoundation.h
 
-2008-08-31  Gavin Barraclough  <barraclough@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27382
 
-        Reviewed by Maciej Stachowiak.
-        
-        Zero-cost exception handling.  This patch takes the exception checking
-        back of the hot path.  When an exception occurs in a Machine::cti*
-        method, the return address to JIT code is recorded, and is then
-        overwritten with a pointer to a trampoline routine.  When the method
-        returns the trampoline will cause the cti_vm_throw method to be invoked.
-
-        cti_vm_throw uses the return address preserved above, to discover the
-        vPC of the bytecode that raised the exception (using a map build during
-        translation).  From the VPC of the faulting bytecode the vPC of a catch
-        routine may be discovered (unwinding the stack where necesary), and then
-        a bytecode address for the catch routine is looked up.  Final cti_vm_throw
-        overwrites its return address to JIT code again, to trampoline directly
-        to the catch routine.
-        
-        cti_op_throw is handled in a similar fashion.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitPutCTIParam):
-        (KJS::CTI::emitPutToCallFrameHeader):
-        (KJS::CTI::emitGetFromCallFrameHeader):
-        (KJS::ctiSetReturnAddressForArgs):
-        (KJS::CTI::emitDebugExceptionCheck):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::):
-        (KJS::CTI::execute):
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_in):
-        (KJS::Machine::cti_vm_throw):
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::):
-        * kjs/ExecState.h:
-        (KJS::ExecState::setCtiReturnAddress):
-        (KJS::ExecState::ctiReturnAddress):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitPushl_m):
-        (KJS::IA32MacroAssembler::emitPopl_m):
-        (KJS::IA32MacroAssembler::getRelocatedAddress):
-
-2008-08-31  Mark Rowe  <mrowe@apple.com>
+        * wtf/unicode/icu/CollatorICU.cpp:
 
-        Reviewed by Oliver Hunt.
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
 
-        Fall back to PCRE for any regexp containing parentheses until we correctly backtrack within them.
+        Reviewed by John Sullivan.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseParentheses):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::):
+        Get user default collation order via a CFLocale API when available.
 
-2008-08-31  Mark Rowe  <mrowe@apple.com>
+        * wtf/unicode/icu/CollatorICU.cpp: (WTF::Collator::userDefault):
 
-        Reviewed by Oliver Hunt.
+2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Fix several issues within ecma_3/RegExp/perlstress-001.js with WREC enabled.
+        Reviewed by Simon Hausmann.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateNonGreedyQuantifier): Compare with the maximum quantifier count rather than the minimum.
-        (KJS::WRECompiler::generateAssertionEOL): Do a register-to-register comparison rather than immediate-to-register.
-        (KJS::WRECompiler::parseCharacterClass): Pass through the correct inversion flag.
+        [Qt] Fix the include path for the Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=27358
 
-2008-08-30  Mark Rowe  <mrowe@apple.com>
+        * JavaScriptCore.pri:
 
-        Reviewed by Oliver Hunt.
+2009-07-17  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
 
-        Re-fix the six remaining failures in the Mozilla JavaScript tests in a manner that does not kill performance.
-        This shows up as a 0.6% progression on SunSpider on my machine.
+        Reviewed by David Levin.
 
-        Grow the JITCodeBuffer's underlying buffer when we run out of space rather than just bailing out.
+        Build fix on platforms don't have MMAP.
+        https://bugs.webkit.org/show_bug.cgi?id=27365
 
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock): Switch to using fastFree now that JITCodeBuffer::copy uses fastMalloc.
-        * kjs/regexp.cpp: Ditto.
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::growBuffer):
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::~JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
+        * interpreter/RegisterFile.h: Including stdio.h irrespectively of HAVE(MMAP)
 
-2008-08-29  Oliver Hunt  <oliver@apple.com>
+2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
 
-        RS=Maciej
+        Reviewed by David Levin.
 
-        Roll out previous patch as it causes a 5% performance regression
+        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
+        https://bugs.webkit.org/show_bug.cgi?id=27206
+        
+        Add ENABLE_WEB_SOCKETS
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (KJS::getJCB):
-        (KJS::CTI::privateCompile):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_rmsib):
-        (KJS::IA32MacroAssembler::IA32MacroAssembler):
-        (KJS::IA32MacroAssembler::emitInt3):
-        (KJS::IA32MacroAssembler::emitPushl_r):
-        (KJS::IA32MacroAssembler::emitPopl_r):
-        (KJS::IA32MacroAssembler::emitMovl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_i8r):
-        (KJS::IA32MacroAssembler::emitAddl_i32r):
-        (KJS::IA32MacroAssembler::emitAddl_mr):
-        (KJS::IA32MacroAssembler::emitAndl_rr):
-        (KJS::IA32MacroAssembler::emitAndl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i8r):
-        (KJS::IA32MacroAssembler::emitCmpl_rr):
-        (KJS::IA32MacroAssembler::emitCmpl_rm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitCmpw_rm):
-        (KJS::IA32MacroAssembler::emitOrl_rr):
-        (KJS::IA32MacroAssembler::emitOrl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_rr):
-        (KJS::IA32MacroAssembler::emitSubl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_i32r):
-        (KJS::IA32MacroAssembler::emitSubl_mr):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitTestl_rr):
-        (KJS::IA32MacroAssembler::emitXorl_i8r):
-        (KJS::IA32MacroAssembler::emitXorl_rr):
-        (KJS::IA32MacroAssembler::emitSarl_i8r):
-        (KJS::IA32MacroAssembler::emitSarl_CLr):
-        (KJS::IA32MacroAssembler::emitShl_i8r):
-        (KJS::IA32MacroAssembler::emitShll_CLr):
-        (KJS::IA32MacroAssembler::emitMull_rr):
-        (KJS::IA32MacroAssembler::emitIdivl_r):
-        (KJS::IA32MacroAssembler::emitCdq):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovzwl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitLeal_mr):
-        (KJS::IA32MacroAssembler::emitRet):
-        (KJS::IA32MacroAssembler::emitJmpN_r):
-        (KJS::IA32MacroAssembler::emitJmpN_m):
-        (KJS::IA32MacroAssembler::emitCall):
-        (KJS::IA32MacroAssembler::label):
-        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
-        (KJS::IA32MacroAssembler::emitUnlinkedJne):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitUnlinkedJl):
-        (KJS::IA32MacroAssembler::emitUnlinkedJle):
-        (KJS::IA32MacroAssembler::emitUnlinkedJge):
-        (KJS::IA32MacroAssembler::emitUnlinkedJae):
-        (KJS::IA32MacroAssembler::emitUnlinkedJo):
-        (KJS::IA32MacroAssembler::link):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compilePattern):
-        (KJS::WRECompiler::compile):
-        * wrec/WREC.h:
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
 
-2008-08-29  Mark Rowe  <mrowe@apple.com>
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Eric Seidel.
 
-        Have JITCodeBuffer manage a Vector containing the generated code so that it can grow
-        as needed when generating code for a large function.  This fixes all six remaining failures
-        in Mozilla tests in both debug and release builds.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::getCode):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compilePattern):
-        * wrec/WREC.h:
+        Added Haiku-specific files for JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26620
 
-2008-08-29  Mark Rowe  <mrowe@apple.com>
+        * wtf/haiku/MainThreadHaiku.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
 
-        Reviewed by Oliver Hunt.
+2009-07-16  Gavin Barraclough  <barraclough@apple.com>
 
-        Implement parsing of octal escapes in regular expressions.  This fixes three Mozilla tests.
+        RS by Oliver Hunt.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseOctalEscape):
-        (KJS::WRECompiler::parseEscape): Parse the escape sequence as an octal escape if it has a leading zero.
-        Add a FIXME about treating invalid backreferences as octal escapes in the future.
-        * wrec/WREC.h:
-        (KJS::WRECompiler::consumeNumber): Multiply by 10 rather than 0 so that we handle numbers with more than
-        one digit.
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIOctalDigit):
+        Revert r45969, this fix does not appear to be valid.
+        https://bugs.webkit.org/show_bug.cgi?id=27077
 
-2008-08-29  Sam Weinig  <sam@webkit.org>
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
 
-        Reviewed by Mark Rowe.
+2009-07-16  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Pass vPC to instanceof method.  Fixes 2 mozilla tests in debug.
+        Reviewed by Oliver Hunt.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_instanceof):
+        Allow custom memory allocation control in ExceptionInfo and RareData struct
+        https://bugs.webkit.org/show_bug.cgi?id=27336
 
-2008-08-29  Sam Weinig  <sam@webkit.org>
+        Inherits ExceptionInfo and RareData struct from FastAllocBase because these
+        have been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.cpp:1289 and
+        in JavaScriptCore/bytecode/CodeBlock.h:453.
 
-        Reviewed by Mark Rowe.
+        Remove unnecessary WTF:: namespace from CodeBlock inheritance.
+        * bytecode/CodeBlock.h:
 
-        Pass vPCs to resolve methods for correct exception creation.  Fixes
-        17 mozilla tests in debug.
+2009-07-16  Mark Rowe  <mrowe@apple.com>
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
+        Rubber-stamped by Geoff Garen.
 
-2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+        Fix FeatureDefines.xcconfig to not be out of sync with the rest of the world.
 
-        Reviewed by Oliver Hunt.
+        * Configurations/FeatureDefines.xcconfig:
 
-        Remembering to actually throw the exception passed to op throw helps.
-        Regressions 19 -> 6.
+2009-07-16  Yong Li  <yong.li@torchmobile.com>
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
+         Reviewed by George Staikos.
 
-2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+         https://bugs.webkit.org/show_bug.cgi?id=27320
+         _countof is only included in CE6; for CE5 we need to define it ourself
 
-        Reviewed by Sam Weinig.
+         * wtf/Platform.h:
 
-        Support for exception unwinding the stack.
-        
-        Once upon a time, Sam asked me for a bettr ChangeLog entry.  The return address
-        is now preserved on entry to a JIT code function (if we preserve lazily we need
-        restore the native return address during exception stack unwind).  This takes
-        the number of regressions down from ~150 to 19.
-
-        * VM/CTI.cpp:
-        (KJS::getJCB):
-        (KJS::CTI::emitExceptionCheck):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::):
-        * VM/Machine.cpp:
-        (KJS::Machine::throwException):
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
-
-2008-08-29  Mark Rowe  <mrowe@apple.com>
+2009-07-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
         Reviewed by Oliver Hunt.
 
-        Fix js1_2/regexp/word_boundary.js and four other Mozilla tests with WREC enabled.
+        Workers + garbage collector: weird crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27077
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateCharacterClassInvertedRange): If none of the exact matches
-        succeeded, jump to failure.
-        (KJS::WRECompiler::compilePattern): Restore and increment the current position stored
-        on the stack to ensure that it will be reset to the correct position after a failed
-        match has consumed input.
+        We need to unlink cached method call sites when a function is destroyed.
 
-2008-08-29  Mark Rowe  <mrowe@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkMethodCall):
+        * jit/JIT.h:
 
-        Reviewed by Oliver Hunt.
+2009-07-15  Steve Falkenburg  <sfalken@apple.com>
 
-        Fix a hang in ecma_3/RegExp/15.10.2-1.js with WREC enabled.
-        A backreference with a quantifier would get stuck in an infinite
-        loop if the captured range was empty.
+        Windows Build fix.
 
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateBackreferenceQuantifier): If the captured range
-        was empty, do not attempt to match the backreference.
-        (KJS::WRECompiler::parseBackreferenceQuantifier):
-        * wrec/WREC.h:
-        (KJS::Quantifier::):
+        Visual Studio reset our intermediate directory on us.
+        This sets it back.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
 
-2008-08-28  Sam Weinig  <sam@webkit.org>
+2009-07-15  Kwang Yul Seo  <skyul@company100.net>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Eric Seidel.
 
-        Implement op_debug.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::debug):
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_debug):
-        * VM/Machine.h:
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_switch_string fixing 1 mozilla test and one test in fast/js.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::SwitchRecord::):
-        (KJS::SwitchRecord::SwitchRecord):
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::dump):
-        * VM/CodeBlock.h:
-        (KJS::ExpressionRangeInfo::):
-        (KJS::StringJumpTable::offsetForValue):
-        (KJS::StringJumpTable::ctiForValue):
-        (KJS::SimpleJumpTable::add):
-        (KJS::SimpleJumpTable::ctiForValue):
-        * VM/CodeGenerator.cpp:
-        (KJS::prepareJumpTableForStringSwitch):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_switch_string):
-        * VM/Machine.h:
-
-2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26794
+        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        
+        Define YYMALLOC and YYFREE to fastMalloc and fastFree
+        respectively.
 
-        Reviewed by Oliver Hunt.
+        * parser/Grammar.y:
 
-        Do not recurse on the machine stack when executing op_call.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::):
-        (KJS::CTI::compile):
-        (KJS::CTI::execute):
-        (KJS::CTI::):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::execute):
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
-        (KJS::Machine::cti_op_call_eval):
-        * VM/Machine.h:
-        * VM/Register.h:
-        (KJS::Register::Register):
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::):
-        * kjs/InternalFunction.h:
-        (KJS::InternalFunction::InternalFunction):
-        * kjs/JSFunction.h:
-        (KJS::JSFunction::JSFunction):
-        * kjs/ScopeChain.h:
-        (KJS::ScopeChain::ScopeChain):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitModRm_opm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitCallN_r):
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
+2009-07-15  Darin Adler  <darin@apple.com>
 
-        Reviewed by Mark Rowe.
+        Fix a build for a particular Apple configuration.
 
-        Exit instead of crashing in ctiUnsupported and ctiTimedOut.
+        * wtf/FastAllocBase.h: Change include to use "" style for
+        including another wtf header. This is the style we use for
+        including other public headers in the same directory.
 
-        * VM/Machine.cpp:
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
+2009-07-15  George Staikos  <george.staikos@torchmobile.com>
 
-2008-08-28  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Adam Treat.
 
-        Reviewed by Maciej Stachowiak.
+        https://bugs.webkit.org/show_bug.cgi?id=27303
+        Implement createThreadInternal for WinCE.
+        Contains changes by George Staikos <george.staikos@torchmobile.com> and Joe Mason <joe.mason@torchmobile.com>
 
-        Implement codegen for op_jsr and op_sret.
+        * wtf/ThreadingWin.cpp:
+        (WTF::createThreadInternal):
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CTI::JSRInfo::JSRInfo):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitJmpN_m):
-        (KJS::IA32MacroAssembler::linkAbsoluteAddress):
+2009-07-15  Joe Mason  <joe.mason@torchmobile.com>
 
-2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+         Reviewed by George Staikos.
 
-        Reviewed by Oliver Hunt.
+         https://bugs.webkit.org/show_bug.cgi?id=27298
+         Platform defines for WINCE.
+         Contains changes by Yong Li <yong.li@torchmobile.com>,
+         George Staikos <george.staikos@torchmobile.com> and Joe Mason <joe.mason@torchmobile.com>
 
-        Initial support for exceptions (throw / catch must occur in same CodeBlock).
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitExceptionCheck):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::nativeExceptionCodeForHandlerVPC):
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::emitCatch):
-        * VM/Machine.cpp:
-        (KJS::Machine::throwException):
-        (KJS::Machine::privateExecute):
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
-        (KJS::Machine::cti_op_add):
-        (KJS::Machine::cti_op_pre_inc):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_op_loop_if_less):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_del_by_id):
-        (KJS::Machine::cti_op_mul):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_sub):
-        (KJS::Machine::cti_op_put_by_val):
-        (KJS::Machine::cti_op_lesseq):
-        (KJS::Machine::cti_op_loop_if_true):
-        (KJS::Machine::cti_op_negate):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_div):
-        (KJS::Machine::cti_op_pre_dec):
-        (KJS::Machine::cti_op_jless):
-        (KJS::Machine::cti_op_not):
-        (KJS::Machine::cti_op_jtrue):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_eq):
-        (KJS::Machine::cti_op_lshift):
-        (KJS::Machine::cti_op_bitand):
-        (KJS::Machine::cti_op_rshift):
-        (KJS::Machine::cti_op_bitnot):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_mod):
-        (KJS::Machine::cti_op_less):
-        (KJS::Machine::cti_op_neq):
-        (KJS::Machine::cti_op_post_dec):
-        (KJS::Machine::cti_op_urshift):
-        (KJS::Machine::cti_op_bitxor):
-        (KJS::Machine::cti_op_bitor):
-        (KJS::Machine::cti_op_call_eval):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_push_scope):
-        (KJS::Machine::cti_op_stricteq):
-        (KJS::Machine::cti_op_nstricteq):
-        (KJS::Machine::cti_op_to_jsnumber):
-        (KJS::Machine::cti_op_in):
-        (KJS::Machine::cti_op_del_by_val):
-        (KJS::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * kjs/ExecState.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-
-2008-08-28  Mark Rowe  <mrowe@apple.com>
+         * wtf/Platform.h:
 
-        Rubber-stamped by Oliver Hunt.
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
 
-        Print debugging info to stderr so that run-webkit-tests can capture it.
-        This makes it easy to check whether test failures are due to unimplemented
-        op codes, missing support for exceptions, etc.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::ctiException):
-        (KJS::ctiUnsupported):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_call_eval):
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough and Maciej Stachowiak.
-
-        Fix fast/js/bitwise-and-on-undefined.html.
-
-        A temporary value in the slow path of op_bitand was being stored in edx, but was
-        being clobbered by emitGetPutArg before we used it.  To fix this, emitGetPutArg
-        now takes a third argument that specifies the scratch register to use when loading
-        from memory.  This allows us to avoid clobbering the temporary in op_bitand.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/CTI.h:
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
+         Reviewed by Adam Treat.
 
-        Rubber-stamped by Oliver Hunt.
+         https://bugs.webkit.org/show_bug.cgi?id=27306
+         Use RegisterClass instead of RegisterClassEx on WinCE.
 
-        Switch CTI on by default.
+         * wtf/win/MainThreadWin.cpp:
+         (WTF::initializeMainThreadPlatform):
 
-        * wtf/Platform.h:
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
 
-2008-08-27  Mark Rowe  <mrowe@apple.com>
+         Reviewed by George Staikos.
 
-        Reviewed by Oliver Hunt.
+         https://bugs.webkit.org/show_bug.cgi?id=27301
+         Use OutputDebugStringW on WinCE since OutputDebugStringA is not supported
+         Originally written by Yong Li <yong.li@torchmobile.com> and refactored by
+         Joe Mason <joe.mason@torchmobile.com>
 
-        Fix the build of the full WebKit stack.
+         * wtf/Assertions.cpp: vprintf_stderr_common
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Mark two new headers as private so they can be pulled in from WebCore.
-        * VM/CTI.h: Fix build issues that show up when compiled with GCC 4.2 as part of WebCore.
-        * wrec/WREC.h: Ditto.
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
 
-2008-08-27  Mark Rowe  <mrowe@apple.com>
+         Reviewed by George Staikos.
 
-        Reviewed by Sam Weinig.
+         https://bugs.webkit.org/show_bug.cgi?id=27020
+         msToGregorianDateTime should set utcOffset to 0 when outputIsUTC is false
 
-        Implement op_new_error.  Does not fix any tests as it is always followed by the unimplemented op_throw.
+         * wtf/DateMath.cpp:
+         (WTF::gregorianDateTimeToMS):
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_new_error):
-        * VM/Machine.h:
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2008-08-27  Sam Weinig  <sam@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        [Qt] Cleanup - Remove obsolete code from the make system
+        https://bugs.webkit.org/show_bug.cgi?id=27299
 
-        Implement op_put_getter and op_put_setter.
+        * JavaScriptCore.pro:
+        * jsc.pro:
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_getter):
-        (KJS::Machine::cti_op_put_setter):
-        * VM/Machine.h:
+2009-07-07  Norbert Leser  <norbert.leser@nokia.com>
 
-2008-08-27  Sam Weinig  <sam@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=27056
 
-        Implement op_del_by_val fixing 3 mozilla tests.
+        Alternate bool operator for codewarrior compiler (WINSCW).
+        Compiler (latest b482) reports error for UnspecifiedBoolType construct:
+        "illegal explicit conversion from 'WTF::OwnArrayPtr<JSC::Register>' to 'bool'"
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_val):
-        * VM/Machine.h:
+        Same fix as in r38391.
 
-2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore/wtf/OwnArrayPtr.h:
 
-        Reviewed by Oliver Hunt.
+2009-07-15  Norbert Leser  <norbert.leser@nokia.com>
 
-        Quick & dirty fix to get SamplingTool sampling op_call.
+        Reviewed by Darin Adler.
 
-        * VM/SamplingTool.h:
-        (KJS::SamplingTool::callingHostFunction):
+        Qualify include path with wtf to fix compilation
+        on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=27055
 
-2008-08-27  Sam Weinig  <sam@webkit.org>
+        * interpreter/Interpreter.h:
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Fix op_put_by_index.
+        Reviewed by Dave Kilzer.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main): Use emitPutArgConstant instead of emitGetPutArg
-        for the property value.
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_by_index): Get the property value from the correct argument.
+        Turn off non-portable date manipulations for SYMBIAN
+        https://bugs.webkit.org/show_bug.cgi?id=27064
 
-2008-08-27  Sam Weinig  <sam@webkit.org>
+        Introduce HAVE(TM_GMTOFF), HAVE(TM_ZONE) and HAVE(TIMEGM) guards 
+        and place the rules for controlling the guards in Platform.h.
+        Turn off these newly introduced guards for SYMBIAN.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+        * wtf/DateMath.h:
+        (WTF::GregorianDateTime::GregorianDateTime):
+        (WTF::GregorianDateTime::operator tm):
+        * wtf/Platform.h:
 
-        Implement op_switch_imm in the CTI fixing 13 mozilla tests.
+2009-07-15  Norbert Leser  <norbert.leser@nokia.com>
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_switch_imm):
-        * VM/Machine.h:
+        Reviewed by Simon Hausmann.
 
-2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+        Undef ASSERT on Symbian, to avoid excessive warnings
+        https://bugs.webkit.org/show_bug.cgi?id=27052
 
-        Reviewed by Oliver Hunt.
+        * wtf/Assertions.h:
 
-        Implement op_switch_char in CTI.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitCall):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::SwitchRecord::SwitchRecord):
-        * VM/CodeBlock.h:
-        (KJS::SimpleJumpTable::SimpleJumpTable::ctiForValue):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_switch_char):
-        * VM/Machine.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitJmpN_r):
-        (KJS::IA32MacroAssembler::getRelocatedAddress):
-        * wtf/Platform.h:
+2009-07-15  Oliver Hunt  <oliver@apple.com>
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Mark Rowe.
+        REGRESSION: fast/js/postfix-syntax.html fails with interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=27294
 
-        Implement op_put_by_index to fix 1 mozilla test.
+        When postfix operators operating on locals assign to the same local
+        the order of operations has to be to store the incremented value, then
+        store the unmodified number.  Rather than implementing this subtle
+        semantic in the interpreter I've just made the logic explicit in the
+        bytecode generator, so x=x++ effectively becomes x=ToNumber(x) (for a
+        local var x).
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_by_index):
-        * VM/Machine.h:
+        * parser/Nodes.cpp:
+        (JSC::emitPostIncOrDec):
 
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+2009-07-15  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Simon Hausmann.
 
-        More fixes from Geoff's review.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::getConstantImmediateNumericArg):
-        (KJS::CTI::emitGetCTIParam):
-        (KJS::CTI::emitPutResult):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::emitJumpSlowCaseIfNotImm):
-        (KJS::CTI::emitJumpSlowCaseIfNotImms):
-        (KJS::CTI::getDeTaggedConstantImmediate):
-        (KJS::CTI::emitFastArithDeTagImmediate):
-        (KJS::CTI::emitFastArithReTagImmediate):
-        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::emitFastArithImmToInt):
-        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_jmp_scopes to fix 2 Mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_new_scope): Update ExecState::m_scopeChain after calling ARG_setScopeChain.
-        (KJS::Machine::cti_op_jmp_scopes):
-        * VM/Machine.h:
-
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+        REGRESSION(43559): fast/js/kde/arguments-scope.html fails with interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=27259
 
-        Reviewed by Oliver Hunt.
+        The interpreter was incorrectly basing its need to create the arguments object
+        based on the presence of the callframe's argument reference rather than the local
+        arguments reference.  Based on this it then overrode the local variable reference.
 
-        WebKit Regular Expression Compiler. (set ENABLE_WREC = 1 in Platform.h).
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/regexp.cpp:
-        * kjs/regexp.h:
-        * wrec: Added.
-        * wrec/WREC.cpp: Added.
-        * wrec/WREC.h: Added.
-        * wtf/Platform.h:
+2009-07-14  Steve Falkenburg  <sfalken@apple.com>
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        Reorganize JavaScriptCore headers into:
+        API: include/JavaScriptCore/
+        Private: include/private/JavaScriptCore/
 
-        Rubber-stamped by Oliver Hunt.
+        Reviewed by Darin Adler.
 
-        Remove bogus assertion.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_id):
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-08-26  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Sam Weinig.
+        Change JSCell's superclass to NoncopyableCustomAllocated
+        https://bugs.webkit.org/show_bug.cgi?id=27248
 
-        Implement op_push_new_scope and stub out op_catch.  This fixes 11 Mozilla tests.
+        JSCell class customizes operator new, since Noncopyable will be 
+        inherited from FastAllocBase, NoncopyableCustomAllocated has 
+        to be used.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_new_scope):
-        (KJS::Machine::cti_op_catch):
-        * VM/Machine.h:
+        * runtime/JSCell.h:
 
-2008-08-26  Mark Rowe  <mrowe@apple.com>
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Darin Adler.
 
-        Clean up op_resolve_base so that it shares its implementation with the bytecode interpreter.
+        Change all Noncopyable inheriting visibility to public.
+        https://bugs.webkit.org/show_bug.cgi?id=27225
+
+        Change all Noncopyable inheriting visibility to public because
+        it is needed to the custom allocation framework (bug #20422).
+
+        * bytecode/SamplingTool.h:
+        * bytecompiler/RegisterID.h:
+        * interpreter/CachedCall.h:
+        * interpreter/RegisterFile.h:
+        * parser/Lexer.h:
+        * parser/Parser.h:
+        * runtime/ArgList.h:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/Collector.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSLock.h:
+        * runtime/JSONObject.cpp:
+        * runtime/SmallStrings.cpp:
+        * runtime/SmallStrings.h:
+        * wtf/CrossThreadRefCounted.h:
+        * wtf/GOwnPtr.h:
+        * wtf/Locker.h:
+        * wtf/MessageQueue.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnFastMallocPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/RefCounted.h:
+        * wtf/ThreadSpecific.h:
+        * wtf/Threading.h:
+        * wtf/Vector.h:
+        * wtf/unicode/Collator.h:
 
-        * VM/Machine.cpp:
-        (KJS::inlineResolveBase):
-        (KJS::resolveBase):
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-08-26  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Sam Weinig.
+        Change ParserArenaRefCounted's superclass to RefCountedCustomAllocated
+        https://bugs.webkit.org/show_bug.cgi?id=27249
 
-        Add codegen support for op_instanceof, fixing 15 mozilla tests.
+        ParserArenaDeletable customizes operator new, to avoid double inheritance
+        ParserArenaDeletable's superclass has been changed to RefCountedCustomAllocated.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_del_by_id):
-        * VM/Machine.h:
-        * wtf/Platform.h:
+        * parser/Nodes.h:
 
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Darin Adler.
 
-        Fixes for initial review comments.
+        Add RefCountedCustomAllocated to RefCounted.h
+        https://bugs.webkit.org/show_bug.cgi?id=27232
 
-        * VM/CTI.cpp:
-        (KJS::CTI::ctiCompileGetArg):
-        (KJS::CTI::ctiCompileGetPutArg):
-        (KJS::CTI::ctiCompilePutResult):
-        (KJS::CTI::ctiCompileCall):
-        (KJS::CTI::CTI):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        * VM/Register.h:
-        * kjs/JSValue.h:
+        Some class which are inherited from RefCounted customize
+        operator new, but RefCounted is inherited from Noncopyable
+        which will be inherited from FastAllocBase. To avoid
+        conflicts Noncopyable inheriting was moved down to RefCounted
+        and to avoid double inheritance this class has been added.
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        * wtf/RefCounted.h:
+        (WTF::RefCountedCustomAllocated::deref):
+        (WTF::RefCountedCustomAllocated::~RefCountedCustomAllocated):
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Fix up exception checking code.
+        Reviewed by Darin Adler.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_call_eval):
+        Add NoncopyableCustomAllocated to Noncopyable.h.
+        https://bugs.webkit.org/show_bug.cgi?id=27228
+        
+        Some classes which inherited from Noncopyable overrides operator new
+        since Noncopyable'll be inherited from FastAllocBase, Noncopyable.h 
+        needs to be extended with this new class to support the overriding. 
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        * wtf/Noncopyable.h:
+        (WTFNoncopyable::NoncopyableCustomAllocated::NoncopyableCustomAllocated):
+        (WTFNoncopyable::NoncopyableCustomAllocated::~NoncopyableCustomAllocated):
 
-        Reviewed by Oliver Hunt.
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Fix slowcase for op_post_inc and op_post_dec fixing 2 mozilla tests.
+        Reviewed by Darin Adler.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass4_SlowCases):
+        Allow custom memory allocation control for JavaScriptCore's IdentifierTable class
+        https://bugs.webkit.org/show_bug.cgi?id=27260
 
-2008-08-26  Mark Rowe  <mrowe@apple.com>
+        Inherits IdentifierTable class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Identifier.cpp:70.
 
-        Reviewed by Sam Weinig.
+        * runtime/Identifier.cpp:
 
-        Implement op_in, fixing 8 mozilla tests.
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_in):
-        * VM/Machine.h:
+        Reviewed by Darin Adler.
 
-2008-08-26  Mark Rowe  <mrowe@apple.com>
+        Allow custom memory allocation control for JavaScriptCore's Profiler class
+        https://bugs.webkit.org/show_bug.cgi?id=27253
 
-        Rubber-stamped by Oliver Hunt.
+        Inherits Profiler class from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/profiler/Profiler.cpp:56.
 
-        Don't hardcode the size of a Register for op_new_array.  Fixes a crash
-        seen during the Mozilla tests.
+        * profiler/Profiler.h:
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
+2009-07-06  George Staikos  <george.staikos@torchmobile.com>
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by Adam Treat.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        Authors: George Staikos <george.staikos@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>, Makoto Matsumoto <matumoto@math.keio.ac.jp>, Takuji Nishimura
 
-        Add support for op_push_scope and op_pop_scope, fixing 20 mozilla tests.
+        https://bugs.webkit.org/show_bug.cgi?id=27030
+        Implement custom RNG for WinCE using Mersenne Twister
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_scope):
-        (KJS::Machine::cti_op_pop_scope):
-        * VM/Machine.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/wince/mt19937ar.c: Added.
+        (init_genrand):
+        (init_by_array):
+        (genrand_int32):
+        (genrand_int31):
+        (genrand_real1):
+        (genrand_real2):
+        (genrand_real3):
+        (genrand_res53):
 
-2008-08-26  Oliver Hunt  <oliver@apple.com>
+2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Maciej Stachowiak.
+        Unreviewed make dist build fix.
 
-        Add codegen support for op_del_by_id, fixing 49 mozilla tests.
+        * GNUmakefile.am:
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_id):
-        * VM/Machine.h:
+2009-07-13  Drew Wilson  <atwilson@google.com>
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by David Levin.
 
-        Reviewed by Gavin Barraclough and Geoff Garen.
+        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
+        https://bugs.webkit.org/show_bug.cgi?id=26932
 
-        Don't hardcode the size of a Register for op_get_scoped_var and op_put_scoped_var 
-        fixing 513 mozilla tests in debug build.
+        Added ENABLE(SHARED_WORKERS) flag (off by default).
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
+        * Configurations/FeatureDefines.xcconfig:
 
-2008-08-26  Oliver Hunt  <oliver@apple.com>
+2009-07-07  Norbert Leser  <norbert.leser@nokia.com>
 
-        Reviewed by Maciej Stachowiak.
-        
-        Added code generator support for op_loop, fixing around 60 mozilla tests.
+        Reviewed by Maciej Stachoviak.
 
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
+        https://bugs.webkit.org/show_bug.cgi?id=27058
 
-2008-08-26  Mark Rowe  <mrowe@apple.com>
+        Removed superfluous parenthesis around single expression.
+        Compilers on Symbian platform fail to properly parse and compile.
 
-        Reviewed by Sam Weinig.
+        * JavaScriptCore/wtf/Platform.h:
 
-        Set -fomit-frame-pointer in the correct location.
+2009-07-13  Norbert Leser  <norbert.leser@nokia.com>
 
-        * Configurations/JavaScriptCore.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Reviewed by Maciej Stachoviak.
 
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27054
 
-        Reviewed by Geoff Garen.
-        
-        Inital cut of CTI, Geoff's review fixes to follow.
+        Renamed Translator to HashTranslator
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp: Added.
-        (KJS::getJCB):
-        (KJS::CTI::ctiCompileGetArg):
-        (KJS::CTI::ctiCompileGetPutArg):
-        (KJS::CTI::ctiCompilePutArg):
-        (KJS::CTI::ctiCompilePutArgImm):
-        (KJS::CTI::ctiImmediateNumericArg):
-        (KJS::CTI::ctiCompileGetCTIParam):
-        (KJS::CTI::ctiCompilePutResult):
-        (KJS::CTI::ctiCompileCall):
-        (KJS::CTI::slowCaseIfNotImm):
-        (KJS::CTI::slowCaseIfNotImms):
-        (KJS::CTI::ctiFastArithDeTagConstImmediate):
-        (KJS::CTI::ctiFastArithDeTagImmediate):
-        (KJS::CTI::ctiFastArithReTagImmediate):
-        (KJS::CTI::ctiFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::ctiFastArithImmToInt):
-        (KJS::CTI::ctiFastArithIntToImmOrSlowCase):
-        (KJS::CTI::CTI):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::ctiCompileAdd):
-        (KJS::CTI::ctiCompileAddImm):
-        (KJS::CTI::ctiCompileAddImmNotInt):
-        (KJS::CTI::TEMP_HACK_PRINT_TYPES):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass3_Link):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h: Added.
-        (KJS::CTI2Result::CTI2Result):
-        (KJS::CallRecord::CallRecord):
-        (KJS::JmpTable::JmpTable):
-        (KJS::SlowCaseEntry::SlowCaseEntry):
-        (KJS::CTI::compile):
-        (KJS::CTI::LabelInfo::LabelInfo):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::CodeBlock):
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/Machine.cpp:
-        (KJS::Machine::execute):
-        (KJS::Machine::privateExecute):
-        (KJS::ctiException):
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
-        (KJS::Machine::cti_op_end):
-        (KJS::Machine::cti_op_add):
-        (KJS::Machine::cti_op_pre_inc):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_op_loop_if_less):
-        (KJS::Machine::cti_op_new_object):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_mul):
-        (KJS::Machine::cti_op_new_func):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_new_array):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_sub):
-        (KJS::Machine::cti_op_put_by_val):
-        (KJS::Machine::cti_op_lesseq):
-        (KJS::Machine::cti_op_loop_if_true):
-        (KJS::Machine::cti_op_negate):
-        (KJS::Machine::cti_op_resolve_base):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_div):
-        (KJS::Machine::cti_op_pre_dec):
-        (KJS::Machine::cti_op_jless):
-        (KJS::Machine::cti_op_not):
-        (KJS::Machine::cti_op_jtrue):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_eq):
-        (KJS::Machine::cti_op_lshift):
-        (KJS::Machine::cti_op_bitand):
-        (KJS::Machine::cti_op_rshift):
-        (KJS::Machine::cti_op_bitnot):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_new_func_exp):
-        (KJS::Machine::cti_op_mod):
-        (KJS::Machine::cti_op_less):
-        (KJS::Machine::cti_op_neq):
-        (KJS::Machine::cti_op_post_dec):
-        (KJS::Machine::cti_op_urshift):
-        (KJS::Machine::cti_op_bitxor):
-        (KJS::Machine::cti_op_new_regexp):
-        (KJS::Machine::cti_op_bitor):
-        (KJS::Machine::cti_op_call_eval):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_get_pnames):
-        (KJS::Machine::cti_op_next_pname):
-        (KJS::Machine::cti_op_typeof):
-        (KJS::Machine::cti_op_stricteq):
-        (KJS::Machine::cti_op_nstricteq):
-        (KJS::Machine::cti_op_to_jsnumber):
-        * VM/Machine.h:
-        * VM/Register.h:
-        (KJS::Register::jsValue):
-        (KJS::Register::getJSValue):
-        (KJS::Register::codeBlock):
-        (KJS::Register::scopeChain):
-        (KJS::Register::i):
-        (KJS::Register::r):
-        (KJS::Register::vPC):
-        (KJS::Register::jsPropertyNameIterator):
-        * VM/SamplingTool.cpp:
-        (KJS::):
-        (KJS::SamplingTool::run):
-        (KJS::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        * kjs/JSImmediate.h:
-        (KJS::JSImmediate::zeroImmediate):
-        (KJS::JSImmediate::oneImmediate):
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        (KJS::JSVariableObject::JSVariableObjectData::offsetOf_registers):
-        (KJS::JSVariableObject::offsetOf_d):
-        (KJS::JSVariableObject::offsetOf_Data_registers):
-        * masm: Added.
-        * masm/IA32MacroAsm.h: Added.
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_rmsib):
-        (KJS::IA32MacroAssembler::emitModRm_opr):
-        (KJS::IA32MacroAssembler::emitModRm_opm):
-        (KJS::IA32MacroAssembler::IA32MacroAssembler):
-        (KJS::IA32MacroAssembler::emitInt3):
-        (KJS::IA32MacroAssembler::emitPushl_r):
-        (KJS::IA32MacroAssembler::emitPopl_r):
-        (KJS::IA32MacroAssembler::emitMovl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_i8r):
-        (KJS::IA32MacroAssembler::emitAddl_i32r):
-        (KJS::IA32MacroAssembler::emitAddl_mr):
-        (KJS::IA32MacroAssembler::emitAndl_rr):
-        (KJS::IA32MacroAssembler::emitAndl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i8r):
-        (KJS::IA32MacroAssembler::emitCmpl_rr):
-        (KJS::IA32MacroAssembler::emitCmpl_rm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpw_rm):
-        (KJS::IA32MacroAssembler::emitOrl_rr):
-        (KJS::IA32MacroAssembler::emitOrl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_rr):
-        (KJS::IA32MacroAssembler::emitSubl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_i32r):
-        (KJS::IA32MacroAssembler::emitSubl_mr):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitTestl_rr):
-        (KJS::IA32MacroAssembler::emitXorl_i8r):
-        (KJS::IA32MacroAssembler::emitXorl_rr):
-        (KJS::IA32MacroAssembler::emitSarl_i8r):
-        (KJS::IA32MacroAssembler::emitSarl_CLr):
-        (KJS::IA32MacroAssembler::emitShl_i8r):
-        (KJS::IA32MacroAssembler::emitShll_CLr):
-        (KJS::IA32MacroAssembler::emitMull_rr):
-        (KJS::IA32MacroAssembler::emitIdivl_r):
-        (KJS::IA32MacroAssembler::emitCdq):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovzwl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitLeal_mr):
-        (KJS::IA32MacroAssembler::emitRet):
-        (KJS::IA32MacroAssembler::JmpSrc::JmpSrc):
-        (KJS::IA32MacroAssembler::JmpDst::JmpDst):
-        (KJS::IA32MacroAssembler::emitCall):
-        (KJS::IA32MacroAssembler::label):
-        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
-        (KJS::IA32MacroAssembler::emitUnlinkedJne):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitUnlinkedJl):
-        (KJS::IA32MacroAssembler::emitUnlinkedJle):
-        (KJS::IA32MacroAssembler::emitUnlinkedJge):
-        (KJS::IA32MacroAssembler::emitUnlinkedJae):
-        (KJS::IA32MacroAssembler::emitUnlinkedJo):
-        (KJS::IA32MacroAssembler::emitPredictionNotTaken):
-        (KJS::IA32MacroAssembler::link):
-        (KJS::IA32MacroAssembler::copy):
-        * wtf/Platform.h:
+        Codewarrior compiler (WINSCW) latest b482 cannot resolve typename
+        mismatch between template declaration and definition
+        (HashTranslator / Translator)
 
-2008-08-26  Oliver Hunt  <oliver@apple.com>
+        * wtf/HashSet.h:
 
-        RS=Maciej.
+2009-07-13  Norbert Leser  <norbert.leser@nokia.com>
 
-        Enabled -fomit-frame-pointer on Release and Production builds, add additional Profiling build config for shark, etc.
+        Reviewed by Eric Seidel.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        https://bugs.webkit.org/show_bug.cgi?id=27053
 
-=== Start merge of squirrelfish-extreme ===
+        Ambiguity in LabelScope initialization
 
-2008-09-06  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Codewarrior compiler (WINSCW) latest b482 on Symbian cannot resolve
+        type of "0" unambiguously. Set expression explicitly to
+        PassRefPtr<Label>::PassRefPtr()
 
-        Reviewed by Maciej Stachowiak.
+        * bytecompiler/BytecodeGenerator.cpp
 
-        Fix the Mac Debug build by adding symbols that are exported only in a
-        Debug configuration.
+2009-07-11  Simon Fraser  <simon.fraser@apple.com>
 
-        * Configurations/JavaScriptCore.xcconfig:
-        * DerivedSources.make:
-        * JavaScriptCore.Debug.exp: Added.
-        * JavaScriptCore.base.exp: Copied from JavaScriptCore.exp.
-        * JavaScriptCore.exp: Removed.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Enable support for accelerated compositing and 3d transforms on Leopard.
+        <https://bugs.webkit.org/show_bug.cgi?id=20166>
+        <rdar://problem/6120614>
 
-2008-09-05  Darin Adler  <darin@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Cameron Zwarich.
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20681
-          JSPropertyNameIterator functions need to be inlined
+2009-07-10  Mark Rowe  <mrowe@apple.com>
 
-        1.007x as fast on SunSpider overall
-        1.081x as fast on SunSpider math-cordic
+        Second part of the "make Windows happier" dance.
 
-        * VM/JSPropertyNameIterator.cpp: Moved functions out of here.
-        * VM/JSPropertyNameIterator.h:
-        (KJS::JSPropertyNameIterator::JSPropertyNameIterator): Moved
-        this into the header and marked it inline.
-        (KJS::JSPropertyNameIterator::create): Ditto.
-        (KJS::JSPropertyNameIterator::next): Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-09-05  Darin Adler  <darin@apple.com>
+2009-07-10  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Geoffrey Garen.
+        Try and make the Windows build happy.
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20673
-          single-character strings are churning in the Identifier table
-
-        1.007x as fast on SunSpider overall
-        1.167x as fast on SunSpider string-fasta
-
-        * JavaScriptCore.exp: Updated.
-        * kjs/SmallStrings.cpp:
-        (KJS::SmallStrings::singleCharacterStringRep): Added.
-        * kjs/SmallStrings.h: Added singleCharacterStringRep for clients that
-        need just a UString, not a JSString.
-        * kjs/identifier.cpp:
-        (KJS::Identifier::add): Added special cases for single character strings
-        so that the UString::Rep that ends up in the identifier table is the one
-        from the single-character string optimization; otherwise we end up having
-        to look it up in the identifier table over and over again.
-        (KJS::Identifier::addSlowCase): Ditto.
-        (KJS::Identifier::checkSameIdentifierTable): Made this function an empty
-        inline in release builds so that callers don't have to put #ifndef NDEBUG
-        at each call site.
-        * kjs/identifier.h:
-        (KJS::Identifier::add): Removed #ifndef NDEBUG around the calls to
-        checkSameIdentifierTable.
-        (KJS::Identifier::checkSameIdentifierTable): Added. Empty inline version
-        for NDEBUG builds.
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-        Build fix.
+2009-07-10  Kevin McCullough  <kmccullough@apple.com>
 
-        * kjs/JSObject.h: Move the inline virtual destructor after a non-inline
-        virtual function so that the symbol for the vtable is not marked as a
-        weakly exported symbol.
+        Reviewed by Geoffrey Garen.
 
-2008-09-05  Darin Adler  <darin@apple.com>
+        * debugger/Debugger.h: Made this function virtual for use in WebCore's
+        WebInspector.
 
-        Reviewed by Sam Weinig.
+2009-07-10  Kwang Yul Seo  <skyul@company100.net>
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20671
-          JavaScriptCore string manipulation spends too much time in memcpy
+        Reviewed by Darin Adler.
 
-        1.011x as fast on SunSpider overall
-        1.028x as fast on SunSpider string tests
+        ParserArenaDeletable should override delete
+        https://bugs.webkit.org/show_bug.cgi?id=26790
 
-        For small strings, use a loop rather than calling memcpy. The loop can
-        be faster because there's no function call overhead, and because it can
-        assume the pointers are aligned instead of checking that. Currently the
-        threshold is set at 20 characters, based on some testing on one particular
-        computer. Later we can tune this for various platforms by setting
-        USTRING_COPY_CHARS_INLINE_CUTOFF appropriately, but it does no great harm
-        if not perfectly tuned.
+        ParserArenaDeletable overrides new, but it does not override delete.
+        ParserArenaDeletable must be freed by fastFree
+        because it is allocated by fastMalloc.
 
-        * kjs/ustring.cpp:
-        (KJS::overflowIndicator): Removed bogus const.
-        (KJS::maxUChars): Ditto.
-        (KJS::copyChars): Added.
-        (KJS::UString::Rep::createCopying): Call copyChars instead of memcpy.
-        Also eliminated need for const_cast.
-        (KJS::UString::expandPreCapacity): Ditto.
-        (KJS::concatenate): Ditto.
-        (KJS::UString::spliceSubstringsWithSeparators): Ditto.
-        (KJS::UString::append): Ditto.
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator delete):
+        * parser/Nodes.h:
 
-2008-09-05  Kevin McCullough  <kmccullough@apple.com>
+2009-07-10  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Sam and Alexey.
+        Sort all our Xcode projects
 
-        Make the profiler work with a null exec state.  This will allow other
-        applications start the profiler to get DTrace probes going without
-        needing a WebView.
+        Accomplished using sort-Xcode-project-file.
 
-        * ChangeLog:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::ProfileGenerator):
-        (KJS::ProfileGenerator::willExecute):
-        (KJS::ProfileGenerator::didExecute):
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling):
-        (KJS::dispatchFunctionToProfiles):
+        Requested by Dave Kilzer.
 
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        Reviewed by Geoffrey Garen.
-        
-        Fixed an off-by-one error that would cause the StructureIDChain to
-        be one object too short.
-        
-        Can't construct a test case because other factors make this not crash
-        (yet!).
+2009-07-09  Maciej Stachowiak  <mjs@apple.com>
 
-        * kjs/StructureID.cpp:
-        (KJS::StructureIDChain::StructureIDChain):
+        Not reviewed, build fix.
 
-2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+        Windows build fix for the last change.
 
-        wx build fixes.
+        * wtf/dtoa.cpp: Forgot to include Vector.h
 
-        * JavaScriptCoreSources.bkl:
+2009-07-09  Maciej Stachowiak  <mjs@apple.com>
 
-2008-09-04  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Eric Seidel.
+        REGRESSION: crash in edge cases of floating point parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=27110
+        <rdar://problem/7044458>
+        
+        Tests: fast/css/number-parsing-crash.html
+               fast/css/number-parsing-crash.html
+               fast/js/number-parsing-crash.html
+        
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt): Converted this to more a proper class, using a Vector
+        with inline capacity
+
+        (WTF::lshift): Rearranged logic somewhat nontrivially to deal with the new way of sizing BigInts.
+        Added an assertion to verify that invariants are maintained.
+
+        All other functions are adapted fairly mechanically to the above changes.
+        (WTF::BigInt::clear):
+        (WTF::BigInt::size):
+        (WTF::BigInt::resize):
+        (WTF::BigInt::words):
+        (WTF::BigInt::append):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::dtoa):
+
+2009-07-09  Drew Wilson  <atwilson@google.com>
 
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
-        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
+        Reviewed by Alexey Proskuryakov.
 
-        * Configurations/JavaScriptCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
-        * wtf/Platform.h: Set ENABLE_DASHBOARD_SUPPORT for PLATFORM(MAC).
+        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
+        can now be implemented for Web Workers and is reasonably stable.
 
-2008-09-04  Adele Peterson  <adele@apple.com>
+        * Configurations/FeatureDefines.xcconfig:
 
-        Build fix.
+2009-07-09  Oliver Hunt  <oliver@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
 
-2008-09-04  Mark Rowe  <mrowe@apple.com>
+2009-07-09  Oliver Hunt  <oliver@apple.com>
 
-        Mac build fix.
+        Reviewed by Darin Adler.
 
-        * kjs/config.h: Only check the value of HAVE_CONFIG_H if it is defined.
+        Bug 27016 - Interpreter crashes due to invalid array indexes
+        <https://bugs.webkit.org/show_bug.cgi?id=27016>
 
-2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
+        Unsigned vs signed conversions results in incorrect behaviour in
+        64bit interpreter builds.
 
-        Reviewed by Eric Seidel.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
 
-        http://bugs.webkit.org/show_bug.cgi?id=20380
-        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
+2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        * kjs/config.h: Include the configuration header generated by
-        autotools if available.
+        Reviewed by Darin Fisher.
 
-2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        [Chromium] Upstream JavaScriptCore.gypi, the project file for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=27135
 
-        Reviewed by Simon.
+        * JavaScriptCore.gypi: Added.
 
-        Fix the QtWebKit build to match changes in r36016
+2009-07-09  Joe Mason  <joe.mason@torchmobile.com>
 
-        * JavaScriptCore.pri:
+        Reviewed by George Staikos.
+        
+        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
 
-2008-09-04  Mark Rowe  <mrowe@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27031
+        Add an override for deleteOwnedPtr(HDC) on Windows
+        
+        * wtf/OwnPtrCommon.h:
+        * wtf/OwnPtrWin.cpp:
+        (WTF::deleteOwnedPtr):
 
-        Fix the 64-bit build.
+2009-07-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::printStructureID): Store the instruction offset into an unsigned local
-        to avoid a warning related to format specifiers.
-        (KJS::CodeBlock::printStructureIDs): Ditto.
+        Reviewed by Darin Adler.
 
-2008-09-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Guard singal.h dependency with HAVE(SIGNAL_H) to enable building jsc
+        on SYMBIAN.
 
-        Rubber-stamped by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=27026
 
-        Correct the spelling of 'entryIndices'.
+        Based on Norbert Leser's work.
 
-        * kjs/PropertyMap.cpp:
-        (KJS::PropertyMap::get):
-        (KJS::PropertyMap::getLocation):
-        (KJS::PropertyMap::put):
-        (KJS::PropertyMap::insert):
-        (KJS::PropertyMap::remove):
-        (KJS::PropertyMap::checkConsistency):
-        * kjs/PropertyMap.h:
-        (KJS::PropertyMapHashTable::entries):
-        (KJS::PropertyMap::getOffset):
-        (KJS::PropertyMap::putOffset):
-        (KJS::PropertyMap::offsetForTableLocation):
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        * wtf/Platform.h:
 
-2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+2009-07-07  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Cameron Zwarich.
-        
-        Fixed <rdar://problem/6193925> REGRESSION: Crash occurs at
-        KJS::Machine::privateExecute() when attempting to load my Mobile Gallery
-        (http://www.me.com/gallery/#home)
-        
-        also
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20633 Crash in privateExecute
-        @ cs.byu.edu
-        
-        The underlying problem was that we would cache prototype properties
-        even if the prototype was a dictionary.
-        
-        The fix is to transition a prototype back from dictionary to normal
-        status when an opcode caches access to it. (This is better than just
-        refusing to cache, since a heavily accessed prototype is almost
-        certainly not a true dictionary.)
+        Reviewed by Sam Weinig.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::tryCacheGetByID):
-        * kjs/JSObject.h:
+        Stop loading constants into the register file.
 
-2008-09-03  Eric Seidel  <eric@webkit.org>
+        Instead, use high register values (highest bit bar the sign bit set) to indicate
+        constants in the instruction stream, and when we encounter such a value load it
+        directly from the CodeBlock.
 
-        Reviewed by Sam.
+        Since constants are no longer copied into the register file, this patch renders
+        the 'unexpected constant' mechanism redundant, and removes it.
 
-        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
+        2% improvement, thanks to Sam Weinig.
 
-        * Configurations/JavaScriptCore.xcconfig: add missing ENABLE_*
-        * wtf/ASCIICType.h: include <wtf/Assertions.h> since it depends on it.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        (JSC::CodeBlock::getConstant):
+        (JSC::ExecState::r):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::preserveLastVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitNewError):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::noCaller):
+        (JSC::ExecState::hasHostCallFrameFlag):
+        (JSC::ExecState::addHostCallFrameFlag):
+        (JSC::ExecState::removeHostCallFrameFlag):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+        * parser/Nodes.cpp:
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
         * wtf/Platform.h:
 
-2008-09-03  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
+2009-07-07  Mark Rowe  <mrowe@apple.com>
 
-        Remove the rest of the "zombie" code from the profiler.
-        - There is no longer a need for the ProfilerClient callback mechanism.
+        Reviewed by Darin Adler.
 
-        * API/JSProfilerPrivate.cpp:
-        (JSStartProfiling):
-        * JavaScriptCore.exp:
-        * profiler/HeavyProfile.h:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create):
-        (KJS::ProfileGenerator::ProfileGenerator):
-        * profiler/ProfileGenerator.h:
-        (KJS::ProfileGenerator::profileGroup):
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling): Immediately return the profile when
-        stopped instead of using a callback.
-        * profiler/Profiler.h:
-        * profiler/TreeProfile.h:
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27025> / <rdar://problem/7033448>.
+        Bug 27025: Crashes and regression test failures related to regexps in 64-bit
 
-2008-09-03  Adele Peterson  <adele@apple.com>
+        For x86_64 RegexGenerator uses rbx, a callee-save register, as a scratch register but
+        neglects to save and restore it.  The change in handling of the output vector in r45545
+        altered code generation so that the RegExp::match was now storing important data in rbx,
+        which caused crashes and bogus results when it was clobbered.
 
-        Build fix.
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Save rbx.
+        (JSC::Yarr::RegexGenerator::generateReturn): Restore rbx.
 
-        * wtf/win/MainThreadWin.cpp:
+2009-07-06  Ada Chan  <adachan@apple.com>
 
-2008-09-02  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin and Tim.
-
-        Remove most of the "zombie" mode from the profiler.  Next we will need
-        to remove the client callback mechanism in profiles.
-
-        - This simplifies the code, leverages the recent changes I've made in
-        getting line numbers from SquirrelFish, and is a slight speed
-        improvement on SunSpider.
-        - Also the "zombie" mode was a constant source of odd edge cases and
-        obscure bugs so it's good to remove since all of its issues may not have
-        been found.
-
-        * API/JSProfilerPrivate.cpp: No need to call didFinishAllExecution() any
-        more.
-        (JSEndProfiling):
-        * JavaScriptCore.exp: Export the new signature of retrieveLastCaller()
-        * VM/Machine.cpp:
-        (KJS::Machine::execute): No need to call didFinishAllExecution() any
-        more.
-        (KJS::Machine::retrieveCaller): Now operates on InternalFunctions now
-        since the RegisterFile is no longer guaranteeded to store only
-        JSFunctions
-        (KJS::Machine::retrieveLastCaller): Now also retrieve the function's
-        name
-        (KJS::Machine::callFrame): A result of changing retrieveCaller()
-        * VM/Machine.h:
-        * VM/Register.h: 
-        * kjs/JSGlobalObject.cpp:
-        (KJS::JSGlobalObject::~JSGlobalObject):
-        * kjs/nodes.h:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create): Now pass the original exec and get the
-        global exec and client when necessary.  We need the original exec so we
-        can have the stack frame where profiling started.
-        (KJS::ProfileGenerator::ProfileGenerator): ditto.
-        (KJS::ProfileGenerator::addParentForConsoleStart): This is where the 
-        parent to star of the profile is added, if there is one.
-        (KJS::ProfileGenerator::willExecute): Remove uglyness!
-        (KJS::ProfileGenerator::didExecute): Ditto!
-        (KJS::ProfileGenerator::stopProfiling):
-        (KJS::ProfileGenerator::removeProfileStart): Use a better way to find
-        and remove the function we are looking for.
-        (KJS::ProfileGenerator::removeProfileEnd): Ditto.
-        * profiler/ProfileGenerator.h:
-        (KJS::ProfileGenerator::client):
-        * profiler/ProfileNode.cpp:
-        (KJS::ProfileNode::removeChild): Add a better way to remove a child from
-        a ProfileNode.
-        (KJS::ProfileNode::stopProfiling):
-        (KJS::ProfileNode::debugPrintData): Modified a debug-only diagnostic
-        function to be sane.
-        * profiler/ProfileNode.h:
-        * profiler/Profiler.cpp: Change to pass the original exec state.
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling):
-        (KJS::Profiler::willExecute):
-        (KJS::Profiler::didExecute):
-        (KJS::Profiler::createCallIdentifier):
-        * profiler/Profiler.h:
+        Reviewed by Darin Adler and Mark Rowe.
 
-2008-09-01  Alexey Proskuryakov  <ap@webkit.org>
+        Decommitted spans are added to the list of normal spans rather than 
+        the returned spans in TCMalloc_PageHeap::Delete().
+        https://bugs.webkit.org/show_bug.cgi?id=26998
+        
+        In TCMalloc_PageHeap::Delete(), the deleted span can be decommitted in 
+        the process of merging with neighboring spans that are also decommitted.  
+        The merged span needs to be placed in the list of returned spans (spans 
+        whose memory has been returned to the system).  Right now it's always added 
+        to the list of the normal spans which can theoretically cause thrashing.  
 
-        Reviewed by Darin Adler.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::Delete):
 
-        Implement callOnMainThreadAndWait().
+2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
 
-        This will be useful when a background thread needs to perform UI calls synchronously
-        (e.g. an openDatabase() call cannot return until the user answers to a confirmation dialog).
+        Reviewed by Maciej Stachowiak.
 
-        * wtf/MainThread.cpp:
-        (WTF::FunctionWithContext::FunctionWithContext): Added a ThreadCondition member. When
-        non-zero, the condition is signalled after the function is called.
-        (WTF::mainThreadFunctionQueueMutex): Renamed from functionQueueMutex, sinc this is no longer
-        static. Changed to be initialized from initializeThreading() to avoid lock contention.
-        (WTF::initializeMainThread): On non-Windows platforms, just call mainThreadFunctionQueueMutex.
-        (WTF::dispatchFunctionsFromMainThread): Signal synchronous calls when done.
-        (WTF::callOnMainThread): Updated for functionQueueMutex rename.
-        (WTF::callOnMainThreadAndWait):  Added.
+        https://bugs.webkit.org/show_bug.cgi?id=26843
 
-        * wtf/MainThread.h: Added callOnMainThreadAndWait(); initializeMainThread() now exists on
-        all platforms.
+        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
 
-        * wtf/win/MainThreadWin.cpp: (WTF::initializeMainThread): Added a callOnMainThreadAndWait()
-        call to initialize function queue mutex.
+        The Metrowerks compiler on the Symbian platform moves the globally
+        defined Hashtables into read-only memory, despite one of the members
+        being mutable. This causes crashes at run-time due to write access to
+        read-only memory.
 
-        * wtf/ThreadingGtk.cpp: (WTF::initializeThreading):
-        * wtf/ThreadingPthreads.cpp: (WTF::initializeThreading):
-        * wtf/ThreadingQt.cpp: (WTF::initializeThreading):
-        Only initialize mainThreadIdentifier on non-Darwin platforms. It was not guaranteed to be
-        accurate on Darwin.
+        Avoid the use of const with this compiler by introducing the
+        JSC_CONST_HASHTABLE macro.
 
-2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+        Based on idea by Norbert Leser.
 
-        Reviewed by Darin Adler.
-        
-        Use isUndefinedOrNull() instead of separate checks for each in op_eq_null
-        and op_neq_null.
+        * runtime/Lookup.h: Define JSC_CONST_HASHTABLE as const for !WINSCW.
+        * create_hash_table: Use JSC_CONST_HASHTABLE for hashtables.
+        * runtime/JSGlobalData.cpp: Import various global hashtables via the macro.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
+2009-07-04  Dan Bernstein  <mitz@apple.com>
 
-2008-09-02  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+        - debug build fix
 
-        Reviewed by Darin Adler.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getLastParen):
 
-        Bug 20296: OpcodeStats doesn't build on platforms which don't have mergesort().
-        <https://bugs.webkit.org/show_bug.cgi?id=20296>
+2009-07-03  Yong Li  <yong.li@torchmobile.com>
 
-        * VM/Opcode.cpp:
-        (KJS::OpcodeStats::~OpcodeStats): mergesort() replaced with qsort()
+        Reviewed by Maciej Stachowiak (and revised slightly)
 
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+        RegExp::match to be optimized
+        https://bugs.webkit.org/show_bug.cgi?id=26957
 
-        Reviewed by Oliver Hunt.
-        
-        Fast path for array.length and string.length.
+        Allow regexp matching to use Vectors with inline capacity instead of
+        allocating a new ovector buffer every time.
         
-        SunSpider says 0.5% faster.
+        ~5% speedup on SunSpider string-unpack-code test, 0.3% on SunSpider overall.
 
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
 
-        Reviewed by Anders Carlsson.
-        
-        Added optimized paths for comparing to null.
-        
-        SunSpider says 0.5% faster.
+2009-06-30  Kwang Yul Seo  <skyul@company100.net>
 
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Sam Weinig.
+        Override operator new/delete with const std::nothrow_t& as the second
+        argument.
+        https://bugs.webkit.org/show_bug.cgi?id=26792
 
-        Changed jsDriver.pl to dump the exact text you would need in order to
-        reproduce a test result. This enables a fast workflow where you copy
-        and paste a test failure in the terminal.
+        On Windows CE, operator new/delete, new[]/delete[] with const
+        std::nothrow_t& must be overrided because some standard template
+        libraries use these operators.
 
-        * tests/mozilla/jsDriver.pl:
+        The problem occurs when memory allocated by new(size_t s, const
+        std::nothrow_t&) is freed by delete(void* p). This causes the umatched
+        malloc/free problem.
 
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+        The patch overrides all new, delete, new[] and delete[] to use
+        fastMaloc and fastFree consistently.
 
-        Reviewed by Sam Weinig.
-        
-        Implemented the rest of Darin's review comments for the 09-01 inline
-        caching patch.
-        
-        SunSpider says 0.5% faster, but that seems like noise.
+        * wtf/FastMalloc.h:
+        (throw):
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Put PutPropertySlot into
-        its own file, and added BatchedTransitionOptimizer.
+2009-06-30  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock): Use array indexing instead of a pointer
-        iterator.
+        Reviewed by Sam Weinig.
 
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::CodeGenerator): Used BatchedTransitionOptimizer to
-        make batched put and remove for declared variables fast, without forever
-        pessimizing the global object. Removed the old getDirect/removeDirect hack
-        that tried to do the same in a more limited way.
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
-        * VM/CodeGenerator.h: Moved IdentifierRepHash to the KJS namespace since
-        it doesn't specialize anything in WTF.
+        Remove unnecessary references to AssemblerBuffer.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine): Nixed the DummyConstruct tag because it was
-        confusingly named.
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
 
-        (KJS::Machine::execute):  Used BatchedTransitionOptimizer, as above. Fixed
-        up some comments.
+2009-06-29  David Levin  <levin@chromium.org>
 
-        (KJS::cachePrototypeChain): Cast to JSObject*, since it's more specific.
+        Reviewed by Oliver Hunt.
 
-        (KJS::Machine::tryCachePutByID): Use isNull() instead of comparing to
-        jsNull(), since isNull() leaves more options open for the future.
-        (KJS::Machine::tryCacheGetByID): ditto
-        (KJS::Machine::privateExecute): ditto
+        Still seeing occasional leaks from UString::sharedBuffer code
+        https://bugs.webkit.org/show_bug.cgi?id=26420
 
-        * VM/SamplingTool.cpp:
-        (KJS::SamplingTool::dump): Use C++-style cast, to match our style
-        guidelines.
+        The problem is that the pointer to the memory allocation isn't visible
+        by "leaks" due to the lower bits being used as flags.  The fix is to
+        make the pointer visible in memory (in debug only). The downside of
+        this fix that the memory allocated by sharedBuffer will still look like
+        a leak in non-debug builds when any flags are set.
 
-        * kjs/BatchedTransitionOptimizer.h: Added. New class that allows host
-        code to add a batch of properties to an object in an efficient way.
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::set):
 
-        * kjs/JSActivation.cpp: Use isNull(), as above.
+2009-06-29  Sam Weinig  <sam@webkit.org>
 
-        * kjs/JSArray.cpp: Get rid of DummyConstruct tag, as above.
-        * kjs/JSArray.h:
+        Reviewed by Mark Rowe.
 
-        * kjs/JSGlobalData.cpp: Nixed two unused StructureIDs.
-        * kjs/JSGlobalData.h:
+        Remove more unused scons support.
 
-        * kjs/JSImmediate.cpp: Use isNull(), as above.
+        * SConstruct: Removed.
 
-        * kjs/JSObject.cpp:
-        (KJS::JSObject::mark): Moved mark tracing code elsewhere, to make this
-        function more readable.
+2009-06-29  Oliver Hunt  <oliver@apple.com>
 
-        (KJS::JSObject::put): Use isNull(), as above.
+        Reviewed by Gavin Barraclough.
 
-        (KJS::JSObject::createInheritorID): Return a raw pointer, since the
-        object is owned by a data member, not necessarily the caller.
-        * kjs/JSObject.h:
+        <rdar://problem/7016214> JSON.parse fails to parse valid JSON with most Unicode characters
+        <https://bugs.webkit.org/show_bug.cgi?id=26802>
 
-        * kjs/JSString.cpp: Use isNull(), as above.
+        In the original JSON.parse patch unicode was handled correctly, however in some last
+        minute "clean up" I oversimplified isSafeStringCharacter.  This patch corrects this bug.
 
-        * kjs/PropertyMap.h: Updated to use PropertySlot::invalidOffset.
+        * runtime/LiteralParser.cpp:
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
 
-        * kjs/PropertySlot.h: Changed KJS_INVALID_OFFSET to WTF::notFound
-        because C macros are so 80's.
+2009-06-26  Oliver Hunt  <oliver@apple.com>
 
-        * kjs/PutPropertySlot.h: Added. Split out of PropertySlot.h. Also renamed
-        PutPropertySlot::SlotType to PutPropertySlot::Type, and slotBase to base,
-        since "slot" was redundant.
+        Reviewed by Dan Bernstein.
 
-        * kjs/StructureID.cpp: Added a new transition *away* from dictionary
-        status, to support BatchedTransitionOptimizer.
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
 
-        (KJS::StructureIDChain::StructureIDChain): No need to store m_size as
-        a data member, so keep it in a local, which might be faster.
-        * kjs/StructureID.h:
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
 
-        * kjs/SymbolTable.h: Moved IdentifierRepHash to KJS namespace, as above.
-        * kjs/ustring.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
 
-2008-09-02  Adam Roben  <aroben@apple.com>
+2009-06-26  Eric Seidel  <eric@webkit.org>
 
-        Windows build fixes
+        No review, only rolling out r45259.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add
-        StructureID.{cpp,h} to the project. Also let VS reorder this file.
-        * VM/CodeBlock.cpp: Include StringExtras so that snprintf will be
-        defined on Windows.
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
 
-2008-09-01  Sam Weinig  <sam@webkit.org>
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
 
-        Fix release build.
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        * JavaScriptCore.exp:
+        Reviewed by Simon Hausmann.
 
-2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Add support for QDataStream operators to Vector.
 
-        Reviewed by Oliver Hunt.
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
 
-        Gtk buildfix
+2009-06-24  Sam Weinig  <sam@webkit.org>
 
-        * GNUmakefile.am:
-        * kjs/PropertyMap.cpp: rename Identifier.h to identifier.h
-        * kjs/StructureID.cpp: include JSObject.h
+        Reviewed by Gavin Barraclough.
 
-2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+        Make the opcode sampler work once again.
 
-        Reviewed by Darin Adler.
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
 
-        First cut at inline caching for access to vanilla JavaScript properties.
-        
-        SunSpider says 4% faster. Tests heavy on dictionary-like access have
-        regressed a bit -- we have a lot of room to improve in this area,
-        but this patch is over-ripe as-is.
-        
-        JSCells now have a StructureID that uniquely identifies their layout,
-        and holds their prototype.
-        
-        JSValue::put takes a PropertySlot& argument, so it can fill in details
-        about where it put a value, for the sake of caching.
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::CodeGenerator): Avoid calling removeDirect if we
-        can, since it disables inline caching in the global object. This can
-        probably improve in the future.
+        Reviewed by Maciej Stachowiak.
 
-        * kjs/JSGlobalObject.cpp: Nixed reset(), since it complicates caching, and
-        wasn't really necessary.
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
 
-        * kjs/JSObject.cpp: Tweaked getter / setter behavior not to rely on the
-        IsGetterSetter flag, since the flag was buggy. This is necessary in order
-        to avoid accidentally accessing a getter / setter as a normal property.
-        
-        Also changed getter / setter creation to honor ReadOnly, matching Mozilla.
-        
-        * kjs/PropertyMap.cpp: Nixed clear(), since it complicates caching and
-        isn't necessary.
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
 
-        * kjs/Shell.cpp: Moved SamplingTool dumping outside the loop. This allows
-        you to aggregate sampling of multiple files (or the same file repeatedly),
-        which helped me track down regressions.
+2009-06-24  David Levin  <levin@chromium.org>
 
-        * kjs/ustring.h: Moved IdentifierRepHash here to share it.
+        Fix all builds.
 
-2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Register.h:
 
-        Reviewed by Sam Weinig.
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
 
-        Eagerly allocate the Math object's numeric constants. This avoids
-        constantly reallocating them in loops, and also ensures that the Math
-        object will not use the single property optimization, which makes
-        properties ineligible for caching.
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
 
-        SunSpider reports a small speedup, in combination with inline caching.
+        * bytecode/CodeBlock.h:
 
-        * kjs/MathObject.cpp:
-        (KJS::MathObject::MathObject):
-        (KJS::MathObject::getOwnPropertySlot):
-        * kjs/MathObject.h:
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26676
 
-        Gtk build fix, not reviewed.
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
 
-        * GNUmakefile.am: Add SmallStrings.cpp in both release and debug builds
+        * bytecompiler/BytecodeGenerator.h:
 
-2008-08-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26675
 
-        Bug 20577: REGRESSION (r36006): Gmail is broken
-        <https://bugs.webkit.org/show_bug.cgi?id=20577>
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
 
-        r36006 changed stringProtoFuncSubstr() so that it is uses the more
-        efficient jsSubstring(), rather than using UString::substr() and then
-        calling jsString(). However, the change did not account for the case
-        where the start and the length of the substring extend beyond the length
-        of the original string. This patch corrects that.
+        * interpreter/Register.h:
 
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncSubstr):
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-08-31  Simon Hausmann  <hausmann@wekit.org>
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
 
-        Unreviewed build fix (with gcc 4.3)
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
 
-        * kjs/ustring.h: Properly forward declare operator== for UString and
-        the the concatenate functions inside the KJS namespace.
+        * wtf/HashMap.h:
 
-2008-08-30  Darin Adler  <darin@apple.com>
+2009-06-24  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Maciej.
+        Reviewed by Darin Adler.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=20333
-          improve JavaScript speed when handling single-character strings
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
 
-        1.035x as fast on SunSpider overall.
-        1.127x as fast on SunSpider string tests.
-        1.910x as fast on SunSpider string-base64 test.
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
 
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunction): Removed unneeded explicit construction of UString.
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        * parser/Nodes.cpp:
+        (JSC::CommaNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
 
-        * GNUmakefile.am: Added SmallStrings.h and SmallStrings.cpp.
-        * JavaScriptCore.pri: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * JavaScriptCoreSources.bkl: Ditto.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/Machine.cpp:
-        (KJS::jsAddSlowCase): Changed to use a code path that doesn't involve
-        a UString constructor. This avoids an extra jump caused by the "in charge"
-        vs. "not in charge" constructors.
-        (KJS::jsAdd): Ditto.
-        (KJS::jsTypeStringForValue): Adopted jsNontrivialString.
-
-        * kjs/ArrayPrototype.cpp:
-        (KJS::arrayProtoFuncToString): Adopted jsEmptyString.
-        (KJS::arrayProtoFuncToLocaleString): Ditto.
-        (KJS::arrayProtoFuncJoin): Ditto.
-        * kjs/BooleanPrototype.cpp:
-        (KJS::booleanProtoFuncToString): Adopted jsNontrivialString.
-        * kjs/DateConstructor.cpp:
-        (KJS::callDate): Ditto.
-        * kjs/DatePrototype.cpp:
-        (KJS::formatLocaleDate): Adopted jsEmptyString and jsNontrivialString.
-        (KJS::dateProtoFuncToString): Ditto.
-        (KJS::dateProtoFuncToUTCString): Ditto.
-        (KJS::dateProtoFuncToDateString): Ditto.
-        (KJS::dateProtoFuncToTimeString): Ditto.
-        (KJS::dateProtoFuncToLocaleString): Ditto.
-        (KJS::dateProtoFuncToLocaleDateString): Ditto.
-        (KJS::dateProtoFuncToLocaleTimeString): Ditto.
-        (KJS::dateProtoFuncToGMTString): Ditto.
-
-        * kjs/ErrorPrototype.cpp:
-        (KJS::ErrorPrototype::ErrorPrototype): Ditto.
-        (KJS::errorProtoFuncToString): Ditto.
-
-        * kjs/JSGlobalData.h: Added SmallStrings.
-
-        * kjs/JSString.cpp:
-        (KJS::jsString): Eliminated the overload that takes a const char*.
-        Added code to use SmallStrings to get strings of small sizes rather
-        than creating a new JSString every time.
-        (KJS::jsSubstring): Added. Used when creating a string from a substring
-        to avoid creating a JSString in cases where the substring will end up
-        empty or as one character.
-        (KJS::jsOwnedString): Added the same code as in jsString.
-
-        * kjs/JSString.h: Added new functions jsEmptyString, jsSingleCharacterString,
-        jsSingleCharacterSubstring, jsSubstring, and jsNontrivialString for various
-        cases where we want to create JSString, and want special handling for small
-        strings.
-        (KJS::JSString::JSString): Added an overload that takes a PassRefPtr of
-        a UString::Rep so you don't have to construct a UString; PassRefPtr can be
-        more efficient.
-        (KJS::jsEmptyString): Added.
-        (KJS::jsSingleCharacterString): Added.
-        (KJS::jsSingleCharacterSubstring): Added.
-        (KJS::jsNontrivialString): Added.
-        (KJS::JSString::getIndex): Adopted jsSingleCharacterSubstring.
-        (KJS::JSString::getStringPropertySlot): Ditto.
-
-        * kjs/NumberPrototype.cpp:
-        (KJS::numberProtoFuncToFixed): Adopted jsNontrivialString.
-        (KJS::numberProtoFuncToExponential): Ditto.
-        (KJS::numberProtoFuncToPrecision): Ditto.
-
-        * kjs/ObjectPrototype.cpp:
-        (KJS::objectProtoFuncToLocaleString): Adopted toThisJSString.
-        (KJS::objectProtoFuncToString): Adopted jsNontrivialString.
-
-        * kjs/RegExpConstructor.cpp: Separated the lastInput value that's used
-        with the lastOvector to return matches from the input value that can be
-        changed via JavaScript. They will be equal in many cases, but not all.
-        (KJS::RegExpConstructor::performMatch): Set input.
-        (KJS::RegExpMatchesArray::RegExpMatchesArray): Ditto.
-        (KJS::RegExpMatchesArray::fillArrayInstance): Adopted jsSubstring. Also,
-        use input rather than lastInput in the appropriate place.
-        (KJS::RegExpConstructor::getBackref): Adopted jsSubstring and jsEmptyString.
-        Added code to handle the case where there is no backref -- before this
-        depended on range checking in UString::substr which is not present in
-        jsSubstring.
-        (KJS::RegExpConstructor::getLastParen): Ditto.
-        (KJS::RegExpConstructor::getLeftContext): Ditto.
-        (KJS::RegExpConstructor::getRightContext): Ditto.
-        (KJS::RegExpConstructor::getValueProperty): Use input rather than lastInput.
-        Also adopt jsEmptyString.
-        (KJS::RegExpConstructor::putValueProperty): Ditto.
-        (KJS::RegExpConstructor::input): Ditto.
-
-        * kjs/RegExpPrototype.cpp:
-        (KJS::regExpProtoFuncToString): Adopt jsNonTrivialString. Also changed to
-        use UString::append to append single characters rather than using += and
-        a C-style string.
-
-        * kjs/SmallStrings.cpp: Added.
-        (KJS::SmallStringsStorage::SmallStringsStorage): Construct the
-        buffer and UString::Rep for all 256 single-character strings for
-        the U+0000 through U+00FF. This covers all the values used in
-        the base64 test as well as most values seen elsewhere on the web
-        as well. It's possible that later we might fix this to only work
-        for U+0000 through U+007F but the others are used quite a bit in
-        the current version of the base64 test.
-        (KJS::SmallStringsStorage::~SmallStringsStorage): Free memory.
-        (KJS::SmallStrings::SmallStrings): Create a set of small strings,
-        initially not created; created later when they are used.
-        (KJS::SmallStrings::~SmallStrings): Deallocate. Not left compiler
-        generated because the SmallStringsStorage class's destructor needs
-        to be visible.
-        (KJS::SmallStrings::mark): Mark all the strings.
-        (KJS::SmallStrings::createEmptyString): Create a cell for the
-        empty string. Called only the first time.
-        (KJS::SmallStrings::createSingleCharacterString): Create a cell
-        for one of the single-character strings. Called only the first time.
-        * kjs/SmallStrings.h: Added.
-
-        * kjs/StringConstructor.cpp:
-        (KJS::stringFromCharCodeSlowCase): Factored out of strinFromCharCode.
-        Only used for cases where the caller does not pass exactly one argument.
-        (KJS::stringFromCharCode): Adopted jsSingleCharacterString.
-        (KJS::callStringConstructor): Adopted jsEmptyString.
-
-        * kjs/StringObject.cpp:
-        (KJS::StringObject::StringObject): Adopted jsEmptyString.
-
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncReplace): Adopted jsSubstring.
-        (KJS::stringProtoFuncCharAt): Adopted jsEmptyString and
-        jsSingleCharacterSubstring and also added a special case when the
-        index is an immediate number to avoid conversion to and from floating
-        point, since that's the common case.
-        (KJS::stringProtoFuncCharCodeAt): Ditto.
-        (KJS::stringProtoFuncMatch): Adopted jsSubstring and jsEmptyString.
-        (KJS::stringProtoFuncSlice): Adopted jsSubstring and
-        jsSingleCharacterSubstring. Also got rid of some unneeded locals and
-        removed unneeded code to set the length property of the array, since it
-        is automatically updated as values are added to the array.
-        (KJS::stringProtoFuncSplit): Adopted jsEmptyString.
-        (KJS::stringProtoFuncSubstr): Adopted jsSubstring.
-        (KJS::stringProtoFuncSubstring): Ditto.
-
-        * kjs/collector.cpp:
-        (KJS::Heap::collect): Added a call to mark SmallStrings.
-
-        * kjs/ustring.cpp:
-        (KJS::UString::expandedSize): Made this a static member function since
-        it doesn't need to look at any data members.
-        (KJS::UString::expandCapacity): Use a non-inline function, makeNull, to
-        set the rep to null in failure cases. This avoids adding a PIC branch for
-        the normal case when there is no failure.
-        (KJS::UString::expandPreCapacity): Ditto.
-        (KJS::UString::UString): Ditto.
-        (KJS::concatenate): Refactored the concatenation constructor into this
-        separate function. Calling the concatenation constructor was leading to
-        an extra branch because of the in-charge vs. not-in-charge versions not
-        both being inlined, and this was showing up as nearly 1% on Shark. Also
-        added a special case for when the second string is a single character,
-        since it's a common idiom to build up a string that way and we can do
-        things much more quickly, without involving memcpy for example. Also
-        adopted the non-inline function, nullRep, for the same reason given for
-        makeNull above.
-        (KJS::UString::append): Adopted makeNull for failure cases.
-        (KJS::UString::operator=): Ditto.
-        (KJS::UString::toDouble): Added a special case for converting single
-        character strings to numbers. We're doing this a ton of times while
-        running the base64 test.
-        (KJS::operator==): Added special cases so we can compare single-character
-        strings without calling memcmp. Later we might want to special case other
-        short lengths similarly.
-        (KJS::UString::makeNull): Added.
-        (KJS::UString::nullRep): Added.
-        * kjs/ustring.h: Added declarations for the nullRep and makeNull. Changed
-        expandedSize to be a static member function. Added a declaration of the
-        concatenate function. Removed the concatenation constructor. Rewrote
-        operator+ to use the concatenate function.
-
-2008-08-29  Anders Carlsson  <andersca@apple.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Build fix.
+        Reviewed by Maciej Stachowiak.
 
-        * VM/Machine.cpp:
-        (KJS::getCPUTime):
+        https://bugs.webkit.org/show_bug.cgi?id=26645
 
-2008-08-29  Anders Carlsson  <andersca@apple.com>
+        Inherits ScopeChainNode class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/ScopeChain.h:95.
 
-        Reviewed by Darin Adler.
+        * wtf/RefPtr.h:
 
-        <rdar://problem/6174667> 
-        When a machine is under heavy load, the Slow Script dialog often comes up many times and just gets in the way
-        
-        Instead of using clock time, use the CPU time spent executing the current thread when
-        determining if the script has been running for too long.
-        
-        * VM/Machine.cpp:
-        (KJS::getCPUTime):
-        (KJS::Machine::checkTimeout):
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-08-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Darin Adler.
 
-        Rubber-stamped by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=26648
 
-        Change 'term' to 'expr' in variable names to standardize terminology.
-
-        * kjs/nodes.cpp:
-        (KJS::BinaryOpNode::emitCode):
-        (KJS::ReverseBinaryOpNode::emitCode):
-        (KJS::ThrowableBinaryOpNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::BinaryOpNode::BinaryOpNode):
-        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
-        (KJS::MultNode::):
-        (KJS::DivNode::):
-        (KJS::ModNode::):
-        (KJS::AddNode::):
-        (KJS::SubNode::):
-        (KJS::LeftShiftNode::):
-        (KJS::RightShiftNode::):
-        (KJS::UnsignedRightShiftNode::):
-        (KJS::LessNode::):
-        (KJS::GreaterNode::):
-        (KJS::LessEqNode::):
-        (KJS::GreaterEqNode::):
-        (KJS::ThrowableBinaryOpNode::):
-        (KJS::InstanceOfNode::):
-        (KJS::InNode::):
-        (KJS::EqualNode::):
-        (KJS::NotEqualNode::):
-        (KJS::StrictEqualNode::):
-        (KJS::NotStrictEqualNode::):
-        (KJS::BitAndNode::):
-        (KJS::BitOrNode::):
-        (KJS::BitXOrNode::):
-        * kjs/nodes2string.cpp:
-        (KJS::MultNode::streamTo):
-        (KJS::DivNode::streamTo):
-        (KJS::ModNode::streamTo):
-        (KJS::AddNode::streamTo):
-        (KJS::SubNode::streamTo):
-        (KJS::LeftShiftNode::streamTo):
-        (KJS::RightShiftNode::streamTo):
-        (KJS::UnsignedRightShiftNode::streamTo):
-        (KJS::LessNode::streamTo):
-        (KJS::GreaterNode::streamTo):
-        (KJS::LessEqNode::streamTo):
-        (KJS::GreaterEqNode::streamTo):
-        (KJS::InstanceOfNode::streamTo):
-        (KJS::InNode::streamTo):
-        (KJS::EqualNode::streamTo):
-        (KJS::NotEqualNode::streamTo):
-        (KJS::StrictEqualNode::streamTo):
-        (KJS::NotStrictEqualNode::streamTo):
-        (KJS::BitAndNode::streamTo):
-        (KJS::BitXOrNode::streamTo):
-        (KJS::BitOrNode::streamTo):
-
-2008-08-28  Alp Toker  <alp@nuanti.com>
-
-        GTK+ dist/build fix. List newly added header files.
+        Inherits Deque class from FastAllocBase because it has been
+        instantiated by 'new' with DEFINE_STATIC_LOCAL macro in 
+        JavaScriptCore/wtf/MainThread.cpp:62.
 
-        * GNUmakefile.am:
+        * wtf/Deque.h:
 
-2008-08-28  Sam Weinig  <sam@webkit.org>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Adler.
 
-        Change to throw a ReferenceError at runtime instead of a ParseError
-        at parse time, when the left hand side expression of a for-in statement
-        is not an lvalue.
+        https://bugs.webkit.org/show_bug.cgi?id=26644
 
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (KJS::ForInNode::emitCode):
+        Inherits RefPtr class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/StructureChain.cpp:41.
 
-2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
+        * wtf/RefPtr.h:
 
-        Not reviewed, build fix (at least for OpenBSD, posssibly more).
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20545
-        missing #include <unistd.h> in JavaScriptCore/VM/SamplingTool.cpp
+        Reviewed by Darin Adler.
 
-        * VM/SamplingTool.cpp: add the missing include.
+        Inherits HashSet class from FastAllocBase, because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.h:116.
 
-2008-08-26  Kevin McCullough  <kmccullough@apple.com>
+        * wtf/HashSet.h:
 
-        Reviewed by Geoff and Cameron.
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        <rdar://problem/6174603> Hitting assertion in Register::codeBlock when
-        loading facebook (20516).
+        Reviewed by Darin Adler.
 
-        - This was a result of my line numbers change.  After a host function is
-        called the stack does not get reset correctly.
-        - Oddly this also appears to be a slight speedup on SunSpider.
+        Inherits Vector class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:633.
 
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
+        * wtf/Vector.h:
 
-2008-08-26  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-24  Norbert Leser  <norbert.leser@nokia.com>
 
-        Reviewed by Geoff and Tim.
+        Reviewed by Maciej Stachoviak.
 
-        Export new API methods.
+        The BytecodeGenerator objects were instantiated on stack, which takes up ~38kB per instance
+        (each instance includes copy of JSC::CodeBlock with large SymbolTable, etc.).
+        Specifically, since there is nested invocation (e.g., GlobalCode --> FunctionCode),
+        the stack overflows immediately on Symbian hardware (max. 80 kB).
+        Proposed change allocates generator objects on heap.
+        Performance impact (if any) should be negligible and change is proposed as general fix,
+        rather than ifdef'd for SYMBIAN.
 
-        * JavaScriptCore.exp:
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateBytecode):
+        (JSC::EvalNode::generateBytecode):
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
 
-2008-08-25  Kevin McCullough  <kmccullough@apple.com>
+2009-06-23  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Geoff, Tim and Mark.
+        Reviewed by Gavin Barraclough.
 
-        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
-        in the console said what file and line number they came from
-        - Lay the foundation for getting line numbers and other data from the
-        JavaScript engine.  With the cleanup in kjs/ExecState this is actually
-        a slight performance improvement.
+        <rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
+        <https://bugs.webkit.org/show_bug.cgi?id=26593>
 
-        * JavaScriptCore.exp: Export retrieveLastCaller() for WebCore.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/Machine.cpp: Now Host and JS functions set a call frame on the
-        exec state, so this and the profiler code were pulled out of the
-        branches.
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::retrieveLastCaller): This get's the lineNumber, sourceID
-        and sourceURL for the previously called function.
-        * VM/Machine.h:
-        * kjs/ExecState.cpp: Remove references to JSFunction since it's not used
-        anywhere.
-        * kjs/ExecState.h:
-
-2008-08-25  Alexey Proskuryakov  <ap@webkit.org>
+        Do not attempt to cache structure chains if they contain a dictionary at any level.
 
-        Reviewed by Darin Adler.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+        * runtime/StructureChain.h:
 
-        Ensure that JSGlobalContextRelease() performs garbage collection, even if there are other
-        contexts in the current context's group.
+2009-06-23  Yong Li  <yong.li@torchmobile.com>
 
-        This is only really necessary when the last reference is released, but there is no way to
-        determine that, and no harm in collecting slightly more often.
+        Reviewed by George Staikos.
 
-        * API/JSContextRef.cpp: (JSGlobalContextRelease): Explicitly collect the heap if it is not
-        being destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=26654
+        Add the proper export define for the JavaScriptCore API when building for WINCE.
 
-2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * API/JSBase.h:
 
-        Reviewed by Oliver Hunt.
+2009-06-23  Joe Mason  <joe.mason@torchmobile.com>
 
-        Bug 20093: JSC shell does not clear exceptions after it executes toString on an expression
-        <https://bugs.webkit.org/show_bug.cgi?id=20093>
+        Reviewed by Adam Treat.
 
-        Clear exceptions after evaluating any code in the JSC shell. We do not
-        report exceptions that are caused by calling toString on the final
-        valued, but at least we avoid incorrect behaviour.
+        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
 
-        Also, print any exceptions that occurred while evaluating code at the
-        interactive prompt, not just while evaluating code from a file.
+        https://bugs.webkit.org/show_bug.cgi?id=26611
+        Implement currentThreadStackBase on WINCE by adding a global,
+        g_stackBase, which must be set to the address of a local variable
+        by the caller before calling any WebKit function that invokes JSC.
 
-        * kjs/Shell.cpp:
-        (runWithScripts):
-        (runInteractive):
+        * runtime/Collector.cpp:
+        (JSC::isPageWritable):
+        (JSC::getStackBase):
+          Starts at the top of the stack and returns the entire range of
+          consecutive writable pages as an estimate of the actual stack.
+          This will be much bigger than the actual stack range, so some
+          dead objects can't be collected, but it guarantees live objects
+          aren't collected prematurely.
 
-2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        (JSC::currentThreadStackBase):
+          On WinCE, returns g_stackBase if set or call getStackBase as a
+          fallback if not.
 
-        Reviewed by Oliver.
+2009-06-23  Oliver Hunt  <oliver@apple.com>
 
-        Remove an unnecessary RefPtr to a RegisterID.
+        Reviewed by Alexey Proskuryakov.
 
-        * kjs/nodes.cpp:
-        (KJS::DeleteBracketNode::emitCode):
+        Fix stupid performance problem in the LiteralParser
 
-2008-08-24  Mark Rowe  <mrowe@apple.com>
+        The LiteralParser was making a new UString in order to use
+        toDouble, however UString's toDouble allows a much wider range
+        of numberic strings than the LiteralParser accepts, and requires
+        an additional heap allocation or two for the construciton of the
+        UString.  To rectify this we just call WTF::dtoa directly using
+        a stack allocated buffer to hold the validated numeric literal.
 
-        Reviewed by Oliver Hunt.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
 
-        Use the correct version number for when JSGlobalContextCreate was introduced.
+2009-06-22  Oliver Hunt  <oliver@apple.com>
 
-        * API/JSContextRef.h:
+        Reviewed by Alexey Proskuryakov.
 
-2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Bug 26640: JSON.stringify needs to special case Boolean objects
+        <https://bugs.webkit.org/show_bug.cgi?id=26640>
 
-        Rubber-stamped by Mark Rowe.
+        Add special case handling of the Boolean object so we match current
+        ES5 errata.
 
-        Remove modelines.
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive): renamed from unwrapNumberOrString
+        (JSC::gap):
+        (JSC::Stringifier::appendStringifiedValue):
 
-        * API/APICast.h:
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.cpp:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSClassRef.cpp:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSProfilerPrivate.cpp:
-        * API/JSStringRef.cpp:
-        * API/JSStringRefBSTR.cpp:
-        * API/JSStringRefCF.cpp:
-        * API/JSValueRef.cpp:
-        * API/tests/JSNode.c:
-        * API/tests/JSNode.h:
-        * API/tests/JSNodeList.c:
-        * API/tests/JSNodeList.h:
-        * API/tests/Node.c:
-        * API/tests/Node.h:
-        * API/tests/NodeList.c:
-        * API/tests/NodeList.h:
-        * API/tests/minidom.c:
-        * API/tests/minidom.js:
-        * API/tests/testapi.c:
-        * API/tests/testapi.js:
-        * JavaScriptCore.pro:
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.h:
-        * kjs/JSArray.h:
-        * kjs/JSString.h:
-        * kjs/JSWrapperObject.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.h:
-        * kjs/lexer.h:
-        * kjs/lookup.h:
-        * wtf/Assertions.cpp:
-        * wtf/Assertions.h:
-        * wtf/HashCountedSet.h:
-        * wtf/HashFunctions.h:
-        * wtf/HashIterators.h:
-        * wtf/HashMap.h:
-        * wtf/HashSet.h:
-        * wtf/HashTable.h:
-        * wtf/HashTraits.h:
-        * wtf/ListHashSet.h:
-        * wtf/ListRefPtr.h:
-        * wtf/Noncopyable.h:
-        * wtf/OwnArrayPtr.h:
-        * wtf/OwnPtr.h:
-        * wtf/PassRefPtr.h:
-        * wtf/Platform.h:
-        * wtf/RefPtr.h:
-        * wtf/RefPtrHashMap.h:
-        * wtf/RetainPtr.h:
-        * wtf/UnusedParam.h:
-        * wtf/Vector.h:
-        * wtf/VectorTraits.h:
-        * wtf/unicode/Unicode.h:
-        * wtf/unicode/icu/UnicodeIcu.h:
+2009-06-22  Oliver Hunt  <oliver@apple.com>
 
-2008-08-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Darin Adler.
 
-        Reviewed by Oliver.
+        Bug 26591: Support revivers in JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26591>
 
-        Some cleanup to match our coding style.
+        Add reviver support to JSON.parse.  This completes the JSON object.
 
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/completion.h:
-        * kjs/identifier.cpp:
-        (KJS::Identifier::equal):
-        (KJS::CStringTranslator::hash):
-        (KJS::CStringTranslator::equal):
-        (KJS::CStringTranslator::translate):
-        (KJS::UCharBufferTranslator::equal):
-        (KJS::UCharBufferTranslator::translate):
-        (KJS::Identifier::remove):
-        * kjs/operations.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
 
-2008-08-20  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        Windows build fix.
+        Reviewed by Darin Adler.
 
-        * API/WebKitAvailability.h: Define DEPRECATED_ATTRIBUTE.
+        Bug 26592: Support standard toJSON functions
+        <https://bugs.webkit.org/show_bug.cgi?id=26592>
 
-2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
+        Add support for the standard Date.toJSON function.
 
-        Reviewed by Geoff Garen.
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
 
-        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        * kjs/JSGlobalData.cpp:
-        (KJS::JSGlobalData::~JSGlobalData):
-        (KJS::JSGlobalData::JSGlobalData): Re-add shared instance.
-        (KJS::JSGlobalData::sharedInstanceExists): Ditto.
-        (KJS::JSGlobalData::sharedInstance): Ditto.
-        (KJS::JSGlobalData::sharedInstanceInternal): Ditto.
+        Reviewed by Sam Weinig.
 
-        * API/JSContextRef.h: Deprecated JSGlobalContextCreate(). Added a very conservative
-        description of its threading model (nothing is allowed).
+        Bug 26594: JSC needs to support Date.toISOString
+        <https://bugs.webkit.org/show_bug.cgi?id=26594>
 
-        * API/JSContextRef.cpp:
-        (JSGlobalContextCreate): Use shared JSGlobalData.
-        (JSGlobalContextCreateInGroup): Support passing NULL group to request a unique one.
-        (JSGlobalContextRetain): Added back locking.
-        (JSGlobalContextRelease): Ditto.
-        (JSContextGetGlobalObject): Ditto.
+        Add support for Date.toISOString.
 
-        * API/tests/minidom.c: (main):
-        * API/tests/testapi.c: (main):
-        Switched to JSGlobalContextCreateInGroup() to avoid deprecation warnings.
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
 
-        * JavaScriptCore.exp: Re-added JSLock methods. Added JSGlobalContextCreateInGroup (d'oh!).
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax):
-        (JSGarbageCollect):
-        * API/JSCallbackConstructor.cpp:
-        (KJS::constructJSCallback):
-        * API/JSCallbackFunction.cpp:
-        (KJS::JSCallbackFunction::call):
-        * API/JSCallbackObjectFunctions.h:
-        (KJS::::init):
-        (KJS::::getOwnPropertySlot):
-        (KJS::::put):
-        (KJS::::deleteProperty):
-        (KJS::::construct):
-        (KJS::::hasInstance):
-        (KJS::::call):
-        (KJS::::getPropertyNames):
-        (KJS::::toNumber):
-        (KJS::::toString):
-        (KJS::::staticValueGetter):
-        (KJS::::callbackGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMake):
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeConstructor):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectGetPropertyAtIndex):
-        (JSObjectSetPropertyAtIndex):
-        (JSObjectDeleteProperty):
-        (JSObjectCallAsFunction):
-        (JSObjectCallAsConstructor):
-        (JSObjectCopyPropertyNames):
-        (JSPropertyNameArrayRelease):
-        (JSPropertyNameAccumulatorAddName):
-        * API/JSValueRef.cpp:
-        (JSValueIsEqual):
-        (JSValueIsInstanceOfConstructor):
-        (JSValueMakeNumber):
-        (JSValueMakeString):
-        (JSValueToNumber):
-        (JSValueToStringCopy):
-        (JSValueToObject):
-        (JSValueProtect):
-        (JSValueUnprotect):
-        * ForwardingHeaders/JavaScriptCore/JSLock.h: Added.
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        (KJS::JSGlobalObject::~JSGlobalObject):
-        (KJS::JSGlobalObject::init):
-        * kjs/JSLock.cpp: Added.
-        (KJS::createJSLockCount):
-        (KJS::JSLock::lockCount):
-        (KJS::setLockCount):
-        (KJS::JSLock::JSLock):
-        (KJS::JSLock::lock):
-        (KJS::JSLock::unlock):
-        (KJS::JSLock::currentThreadIsHoldingLock):
-        (KJS::JSLock::DropAllLocks::DropAllLocks):
-        (KJS::JSLock::DropAllLocks::~DropAllLocks):
-        * kjs/JSLock.h: Added.
-        (KJS::JSLock::JSLock):
-        (KJS::JSLock::~JSLock):
-        * kjs/Shell.cpp:
-        (functionGC):
-        (jscmain):
-        * kjs/collector.cpp:
-        (KJS::Heap::~Heap):
-        (KJS::Heap::heapAllocate):
-        (KJS::Heap::setGCProtectNeedsLocking):
-        (KJS::Heap::protect):
-        (KJS::Heap::unprotect):
-        (KJS::Heap::collect):
-        * kjs/identifier.cpp:
-        * kjs/interpreter.cpp:
-        (KJS::Interpreter::checkSyntax):
-        (KJS::Interpreter::evaluate):
-        Re-added implicit locking.
-
-2008-08-19  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim and Mark.
-
-        Implement DTrace hooks for dashcode and instruments.
-
-        * API/JSProfilerPrivate.cpp: Added. Expose SPI so that profiling can be
-        turned on from a client.  The DTrace probes were added within the
-        profiler mechanism for performance reasons so the profiler must be
-        started to enable tracing.
-        (JSStartProfiling):
-        (JSEndProfiling):
-        * API/JSProfilerPrivate.h: Added. Ditto.
-        * JavaScriptCore.exp: Exposing the start/stop methods to clients.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/Tracing.d: Define the DTrace probes.
-        * kjs/Tracing.h: Ditto.
-        * profiler/ProfileGenerator.cpp: Implement the DTrace probes in the
-        profiler.
-        (KJS::ProfileGenerator::willExecute):
-        (KJS::ProfileGenerator::didExecute):
+        Remove dead code.
 
-2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
 
-        Build fix.
-        
-        * kjs/operations.cpp:
-        (KJS::equal):
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-2008-08-18  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Darin Adler and Cameron Zwarich.
 
-        Fix an assertion when generating a heavy profile because the
-        empty value and deleted value of CallIdentifier where equal.
+        Bug 26587: Support JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26587>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20439
+        Extend the LiteralParser to support the full strict JSON
+        grammar, fix a few places where the grammar was incorrectly
+        lenient.   Doesn't yet support the JSON.parse reviver function
+        but that does not block the JSON.parse functionality itself.
 
-        Reviewed by Dan Bernstein.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative build fix for windows).
+
+        Simply removed some whitespace form this file to make windows build wtf and
+        hopefully copy the new MessageQueque.h so that WebCore picks it up.
 
-        * profiler/CallIdentifier.h: Make the emptyValue for CallIdentifier
-        use empty strings for URL and function name.
-
-2008-08-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff.
-
-        - eliminate JSValue::type()
-
-        This will make it slightly easier to change the JSImmediate design without
-        having to touch so many call sites.
-
-        SunSpider says this change is a wash (looked like a slight speedup, but not
-        statistically significant).
-
-        * API/JSStringRef.cpp: Removed include of JSType.h.
-        * API/JSValueRef.cpp: Removed include of JSType.h.
-        (JSValueGetType): Replaced use of JSValue::type() with
-        JSValue::is functions.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/JSPropertyNameIterator.cpp: Removed type() implementation.
-        (KJS::JSPropertyNameIterator::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        * VM/JSPropertyNameIterator.h: Ditto.
-
-        * VM/Machine.cpp:
-        (KJS::fastIsNumber): Updated for name change.
-        (KJS::fastToInt32): Ditto.
-        (KJS::fastToUInt32): Ditto.
-        (KJS::jsAddSlowCase): Updated toPrimitive caller for change from
-        JSType to PreferredPrimitiveType.
-        (KJS::jsAdd): Replaced calls to JSValue::type() with calls to
-        JSValue::isString().
-        (KJS::jsTypeStringForValue): Replaced calls to JSValue::type()
-        with multiple calls to JSValue::is -- we could make this a
-        virtual function instead if we want to have faster performance.
-        (KJS::Machine::privateExecute): Renamed JSImmediate::toTruncatedUInt32
-        to JSImmediate::getTruncatedUInt32 for consistency with other functions.
-        Changed two calls of JSValue::type() to JSValue::isString().
-
-        * kjs/GetterSetter.cpp:
-        (KJS::GetterSetter::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        (KJS::GetterSetter::isGetterSetter): Added.
-        * kjs/GetterSetter.h:
-
-        * kjs/JSCell.cpp:
-        (KJS::JSCell::isString): Added.
-        (KJS::JSCell::isGetterSetter): Added.
-        (KJS::JSCell::isObject): Added.
-
-        * kjs/JSCell.h: Eliminated type function. Added isGetterSetter.
-        Made isString and isObject virtual. Changed toPrimitive to take
-        PreferredPrimitiveType argument instead of JSType.
-        (KJS::JSCell::isNumber): Use Heap::isNumber for faster performance.
-        (KJS::JSValue::isGetterSetter): Added.
-        (KJS::JSValue::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-
-        * kjs/JSImmediate.h: Removed JSValue::type() and replaced
-        JSValue::toTruncatedUInt32 with JSValue::getTruncatedUInt32.
-        (KJS::JSImmediate::isEitherImmediate): Added.
-
-        * kjs/JSNotAnObject.cpp:
-        (KJS::JSNotAnObject::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        * kjs/JSNotAnObject.h: Ditto.
-        * kjs/JSNumberCell.cpp:
-        (KJS::JSNumberCell::toPrimitive): Ditto.
-        * kjs/JSNumberCell.h:
-        (KJS::JSNumberCell::toInt32): Renamed from fastToInt32. There's no
-        other "slow" version of this once you have a JSNumberCell, so there's
-        no need for "fast" in the name. It's a feature that this hides the
-        base class toInt32, which does the same job less efficiently (and has
-        an additional ExecState argument).
-        (KJS::JSNumberCell::toUInt32): Ditto.
-
-        * kjs/JSObject.cpp:
-        (KJS::callDefaultValueFunction): Use isGetterSetter instead of type.
-        (KJS::JSObject::getPrimitiveNumber): Use PreferredPrimitiveType.
-        (KJS::JSObject::defaultValue): Ditto.
-        (KJS::JSObject::defineGetter): Use isGetterSetter.
-        (KJS::JSObject::defineSetter): Ditto.
-        (KJS::JSObject::lookupGetter): Ditto.
-        (KJS::JSObject::lookupSetter): Ditto.
-        (KJS::JSObject::toNumber): Use PreferredPrimitiveType.
-        (KJS::JSObject::toString): Ditto.
-        (KJS::JSObject::isObject): Added.
-
-        * kjs/JSObject.h:
-        (KJS::JSObject::inherits): Call the isObject from JSCell; it's now
-        hidden by our override of isObject.
-        (KJS::JSObject::getOwnPropertySlotForWrite): Use isGetterSetter
-        instead of type.
-        (KJS::JSObject::getOwnPropertySlot): Ditto.
-        (KJS::JSObject::toPrimitive): Use PreferredPrimitiveType.
-
-        * kjs/JSString.cpp:
-        (KJS::JSString::toPrimitive): Use PreferredPrimitiveType.
-        (KJS::JSString::isString): Added.
-        * kjs/JSString.h: Ditto.
-
-        * kjs/JSValue.h: Removed type(), added isGetterSetter(). Added
-        PreferredPrimitiveType enum and used it as the argument for the
-        toPrimitive function.
-        (KJS::JSValue::getBoolean): Simplified a bit an removed a branch.
-
-        * kjs/collector.cpp:
-        (KJS::typeName): Changed to use JSCell::is functions instead of
-        calling JSCell::type.
-
-        * kjs/collector.h:
-        (KJS::Heap::isNumber): Renamed from fastIsNumber.
-
-        * kjs/nodes.h: Added now-needed include of JSType, since the type
-        is used here to record types of values in the tree.
-
-        * kjs/operations.cpp:
-        (KJS::equal): Rewrote to no longer depend on type().
-        (KJS::strictEqual): Ditto.
-
-2008-08-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        If there are no nodes in a profile all the time should be attributed to
-        (idle)
-
-        * profiler/Profile.cpp: If ther are no nodes make sure we still process
-        the head.
-        (KJS::Profile::forEach):
-        * profiler/ProfileGenerator.cpp: Remove some useless code.
-        (KJS::ProfileGenerator::stopProfiling):
-
-2008-08-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej.
-
-        Make JSGlobalContextRetain/Release actually work.
+        * wtf/Assertions.cpp:
 
-        * API/JSContextRef.cpp:
-        (JSGlobalContextRetain):
-        (JSGlobalContextRelease):
-        Ref/deref global data to give checking for globalData.refCount() some sense.
+2009-06-21  Drew Wilson  <atwilson@google.com>
 
-        * API/tests/testapi.c: (main): Added a test for this bug.
+        Reviewed by David Levin.
 
-        * kjs/JSGlobalData.cpp:
-        (KJS::JSGlobalData::~JSGlobalData):
-        While checking for memory leaks, found that JSGlobalData::emptyList has changed to
-        a pointer, but it was not destructed, causing a huge leak in run-webkit-tests --threaded.
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Added support for multi-threaded MessagePorts.
 
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        * wtf/MessageQueue.h:
+        (WTF::::appendAndCheckEmpty):
+            Added API to test whether the queue was empty before adding an element.
+  
+2009-06-20  David D. Kilzer  <ddkilzer@webkit.org>
 
-        Reviewed by Maciej.
+        Fix namespace comment in SegmentedVector.h
 
-        Change the counting of constants so that preincrement and predecrement of
-        const local variables are considered unexpected loads.
+        * wtf/SegmentedVector.h: Updated namespace comment to reflect
+        new namespace after r44897.
 
-        * kjs/nodes.cpp:
-        (KJS::PrefixResolveNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::ScopeNode::neededConstants):
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-2008-08-17  Oliver Hunt  <oliver@apple.com>
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Oliver Hunt.
 
-        <rdar://problem/6150322> In Gmail, a crash occurs at KJS::Machine::privateExecute() when applying list styling to text after a quote had been removed
-        <https://bugs.webkit.org/show_bug.cgi?id=20386>
+        An Iterator added for SegmentedVector. Currently
+        only the pre ++ operator is supported.
 
-        This crash was caused by "depth()" incorrectly determining the scope depth 
-        of a 0 depth function without a full scope chain.  Because such a function
-        would not have an activation the depth function would return the scope depth
-        of the parent frame, thus triggering an incorrect unwind.  Any subsequent 
-        look up that walked the scope chain would result in incorrect behaviour,
-        leading to a crash or incorrect variable resolution.  This can only actually
-        happen in try...finally statements as that's the only path that can result in
-        the need to unwind the scope chain, but not force the function to need a
-        full scope chain.
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVectorIterator::~SegmentedVectorIterator):
+        (WTF::SegmentedVectorIterator::operator*):
+        (WTF::SegmentedVectorIterator::operator->):
+        (WTF::SegmentedVectorIterator::operator++):
+        (WTF::SegmentedVectorIterator::operator==):
+        (WTF::SegmentedVectorIterator::operator!=):
+        (WTF::SegmentedVectorIterator::operator=):
+        (WTF::SegmentedVectorIterator::SegmentedVectorIterator):
+        (WTF::SegmentedVector::alloc):
+        (WTF::SegmentedVector::begin):
+        (WTF::SegmentedVector::end):
 
-        The fix is simply to check for this case before attempting to walk the scope chain.
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        * VM/Machine.cpp:
-        (KJS::depth):
-        (KJS::Machine::throwException):
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Maciej.
+        Move SegmentedVector to /wtf subdirectory
+        and change "namespace JSC" to "namespace WTF"
 
-        Bug 20419: Remove op_jless
-        <https://bugs.webkit.org/show_bug.cgi?id=20419>
+        Additional build file updates by David Kilzer.
 
-        Remove op_jless, which is rarely used now that we have op_loop_if_less.
+        * GNUmakefile.am: Updated path to SegmentedVector.h.
+        * JavaScriptCore.order: Updated SegmentedVector namespace from
+        JSC to WTF in mangled C++ method name.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Removed reference to bytecompiler\SegmentedVector.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added reference to
+        wtf\SegmentedVector.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Moved
+        SegmentedVector.h definition from bytecompiler subdirectory to
+        wtf subdirectory.
+        * bytecompiler/BytecodeGenerator.h: Updated #include path to
+        SegmentedVector.h and prepended WTF:: namespace to its use.
+        * parser/Lexer.h: Ditto.
+        * wtf/SegmentedVector.h: Renamed from JavaScriptCore/bytecompiler/SegmentedVector.h.
+        (WTF::SegmentedVector::SegmentedVector):
+        (WTF::SegmentedVector::~SegmentedVector):
+        (WTF::SegmentedVector::size):
+        (WTF::SegmentedVector::at):
+        (WTF::SegmentedVector::operator[]):
+        (WTF::SegmentedVector::last):
+        (WTF::SegmentedVector::append):
+        (WTF::SegmentedVector::removeLast):
+        (WTF::SegmentedVector::grow):
+        (WTF::SegmentedVector::clear):
+        (WTF::SegmentedVector::deleteAllSegments):
+        (WTF::SegmentedVector::segmentExistsFor):
+        (WTF::SegmentedVector::segmentFor):
+        (WTF::SegmentedVector::subscriptFor):
+        (WTF::SegmentedVector::ensureSegmentsFor):
+        (WTF::SegmentedVector::ensureSegment):
+
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix take 2 - rename FIELD_OFFSET to something that doesn't conflict with winnt.h).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::checkStructure):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+
+2009-06-19  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reorganize ARM architecture specific macros.
+        Use PLATFORM_ARM_ARCH(7) instead of PLATFORM(ARM_V7).
+
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
 
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::emitJumpIfTrue):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        * VM/Opcode.h:
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
 
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Dan Bernstein.
+        Fix armv7 JIT build issues.
 
-        Fix a typo in r35807 that is also causing build failures for
-        non-AllInOne builds.
+        Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it now contains non POD types),
+        and the FIELD_OFFSET macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT macros.
 
-        * kjs/NumberConstructor.cpp:
+        * Replace offsetofs with FIELD_OFFSETs (safe on C++ objects).
+        * Move COMPILE_ASSERTs defending layout of JITStackFrame structure on armv7 into JITThunks constructor.
 
-2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
 
-        Reviewed by Cameron Zwarich.
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
 
-        Made room for a free word in JSCell.
-        
-        SunSpider says no change.
-        
-        I changed JSCallbackObjectData, Arguments, JSArray, and RegExpObject to
-        store auxiliary data in a secondary structure.
+        Blind attempt at build fix.
 
-        I changed InternalFunction to store the function's name in the property
-        map.
-        
-        I changed JSGlobalObjectData to use a virtual destructor, so WebCore's
-        JSDOMWindowBaseData could inherit from it safely. (It's a strange design
-        for JSDOMWindowBase to allocate an object that JSGlobalObject deletes,
-        but that's really our only option, given the size constraint.)
-        
-        I also added a bunch of compile-time ASSERTs, and removed lots of comments
-        in JSObject.h because they were often out of date, and they got in the
-        way of reading what was actually going on.
-        
-        Also renamed JSArray::getLength to JSArray::length, to match our style
-        guidelines.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-08-16  Geoffrey Garen  <ggaren@apple.com>
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Oliver Hunt.
-        
-        Sped up property access for array.length and string.length by adding a
-        mechanism for returning a temporary value directly instead of returning
-        a pointer to a function that retrieves the value.
-        
-        Also removed some unused cruft from PropertySlot.
-        
-        SunSpider says 0.5% - 1.2% faster.
-
-        NOTE: This optimization is not a good idea in general, because it's
-        actually a pessimization in the case of resolve for assignment,
-        and it may get in the way of other optimizations in the future.
-        
-2008-08-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Geoffrey Garen.
 
-        Disable dead code stripping in debug builds.
+        Inherits CallIdentifier struct from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/profiler/CallIdentifier.h:86.
 
-        * Configurations/Base.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/HashCountedSet.h:
 
-2008-08-15  Mark Rowe  <mrowe@apple.com>
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
 
         Reviewed by Oliver Hunt.
 
-        <rdar://problem/6143072> FastMallocZone's enumeration code makes assumptions about handling of remote memory regions that overlap
+        https://bugs.webkit.org/show_bug.cgi?id=26540
+        Modify the test shell to add a new function 'checkSyntax' that will
+        only parse the source instead of executing it. In this way we can test
+        pure parsing performance against some of the larger scripts in the wild.
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Don't directly compare pointers mapped into the local process with
-        a pointer that has not been mapped.  Instead, calculate a local address for the pointer and compare with that.
-        (WTF::TCMallocStats::FreeObjectFinder::findFreeObjects): Pass in the remote address of the central free list so that it can
-        be used when calculating local addresses.
-        (WTF::TCMallocStats::FastMallocZone::enumerate): Ditto.
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionCheckSyntax):
 
-2008-08-15  Mark Rowe  <mrowe@apple.com>
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Rubber-stamped by Geoff Garen.
+        Reviewed by Darin Adler.
+        
+        Inherits HashCountedSet class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.cpp:1095.
 
-        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
+        * wtf/HashCountedSet.h:
 
-        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
-        between the Debug configuration and debug Production variant.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Enable the debug variant.
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
 
-2008-08-15  Mark Rowe  <mrowe@apple.com>
+        Reviewed by George Staikos.
 
-        Fix the 64-bit build.
+        https://bugs.webkit.org/show_bug.cgi?id=26558
+        Declare these symbols extern for WINCE as they are provided by libce.
 
-        Add extra cast to avoid warnings about loss of precision when casting from
-        JSValue* to an integer type.
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
 
-        * kjs/JSImmediate.h:
-        (KJS::JSImmediate::intValue):
-        (KJS::JSImmediate::uintValue):
+2009-06-19  Oliver Hunt  <oliver@apple.com>
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Maciej Stachowiak.
 
-        Still fixing Windows build.
+        <rdar://problem/6988973> ScopeChain leak in interpreter builds
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Added OpaqueJSString
-        to yet another place.
+        Move the Scopechain destruction code in JSFunction outside of the ENABLE(JIT)
+        path.
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * wtf/Platform.h:
 
-        Trying to fix non-Apple builds.
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
 
-        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Added.
+        Reviewed by George Staikos.
 
-2008-08-15  Gavin Barraclough  <barraclough@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26543
+        Windows CE uses 'GetLastError' instead of 'errno.'
 
-        Reviewed by Geoff Garen.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
 
-        Allow JSImmediate to hold 31 bit signed integer immediate values.  The low two bits of a
-        JSValue* are a tag, with the tag value 00 indicating the JSValue* is a pointer to a
-        JSCell.  Non-zero tag values used to indicate that the JSValue* is not a real pointer,
-        but instead holds an immediate value encoded within the pointer.  This patch changes the
-        encoding so both the tag values 01 and 11 indicate the value is a signed integer, allowing
-        a 31 bit value to be stored.  All other immediates are tagged with the value 10, and
-        distinguished by a secondary tag.
+2009-06-19  David Levin  <levin@chromium.org>
 
-        Roughly +2% on SunSpider.
+        Reviewed by NOBODY (Windows build fix).
 
-        * kjs/JSImmediate.h: Encoding of JSImmediates has changed - see comment at head of file for
-                             descption of new layout.
+        Add export for Windows corresponding to OSX export done in r44844.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-18  Oliver Hunt  <oliver@apple.com>
 
-        More build fixes.
+        Reviewed by Gavin "Viceroy of Venezuela" Barraclough.
 
-        * API/OpaqueJSString.h: Add a namespace to friend declaration to appease MSVC.
-        * API/JSStringRefCF.h: (JSStringCreateWithCFString) Cast UniChar* to UChar* explicitly.
-        * JavaScriptCore.exp: Added OpaqueJSString::create(const KJS::UString&) to fix WebCore build.
+        Bug 26532: Native functions do not correctly unlink from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> <rdar://problem/6625385>
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+        We need to make sure that each native function instance correctly unlinks any references to it
+        when it is collected.  Allowing this to happen required a few changes:
+            * Every native function needs a codeblock to track the link information
+            * To have this codeblock, every function now also needs its own functionbodynode
+              so we no longer get to have a single shared instance.
+            * Identifying a host function is now done by looking for CodeBlock::codeType() == NativeCode
 
-        Build fix.
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+           Constructor for NativeCode CodeBlock
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        (JSC::CodeBlock::setJITCode):
+           Add assertions to ensure we don't try and use NativeCode CodeBlocks as
+           a normal codeblock.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+          More assertions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+          Update logic to allow native function caching
+
+        * jit/JITStubs.cpp:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::isHostFunction):
+        * parser/Nodes.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Marked OpaqueJSString as private
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
-        * kjs/identifier.cpp:
-        (KJS::Identifier::checkSameIdentifierTable):
-        * kjs/identifier.h:
-        (KJS::Identifier::add):
-        Since checkSameIdentifierTable is exported for debug build's sake, gcc wants it to be
-        non-inline in release builds, too.
+        Reviewed by NOBODY (Windows build fix).
 
-        * JavaScriptCore.exp: Don't export inline OpaqueJSString destructor.
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Geoff Garen.
 
-        JSStringRef is created context-free, but can get linked to one via an identifier table,
-        breaking an implicit API contract.
+        Timezone calculation incorrect in Venezuela.
 
-        Made JSStringRef point to OpaqueJSString, which is a new string object separate from UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26531
+        <rdar://problem/6646169> Time is incorrectly reported to JavaScript in both Safari 3 and Firefox 3
 
-        * API/APICast.h: Removed toRef/toJS conversions for JSStringRef, as this is no longer a
-        simple typecast.
+        The problem is that we're calculating the timezone relative to 01/01/2000,
+        but the VET timezone changed from -4 hours to -4:30 hours on 12/09/2007.
+        According to the spec, section 15.9.1.9 states "the time since the beginning
+        of the year", presumably meaning the *current* year.  Change the calculation
+        to be based on whatever the current year is, rather than a canned date.
 
-        * kjs/identifier.cpp:
-        (KJS::Identifier::checkSameIdentifierTable):
-        * kjs/identifier.h:
-        (KJS::Identifier::add):
-        (KJS::UString::checkSameIdentifierTable):
-        Added assertions to verify that an identifier is not being added to a different JSGlobalData.
+        No performance impact.
 
-        * API/JSObjectRef.cpp:
-        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray): Changed OpaqueJSPropertyNameArray to
-        hold JSStringRefs. This is necessary to avoid having to construct (and leak) a new instance
-        in JSPropertyNameArrayGetNameAtIndex(), now that making a JSStringRef is not just a typecast.
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
 
-        * API/OpaqueJSString.cpp: Added.
-        (OpaqueJSString::create):
-        (OpaqueJSString::ustring):
-        (OpaqueJSString::identifier):
-        * API/OpaqueJSString.h: Added.
-        (OpaqueJSString::create):
-        (OpaqueJSString::characters):
-        (OpaqueJSString::length):
-        (OpaqueJSString::OpaqueJSString):
-        (OpaqueJSString::~OpaqueJSString):
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax):
-        * API/JSCallbackObjectFunctions.h:
-        (KJS::::getOwnPropertySlot):
-        (KJS::::put):
-        (KJS::::deleteProperty):
-        (KJS::::staticValueGetter):
-        (KJS::::callbackGetter):
-        * API/JSStringRef.cpp:
-        (JSStringCreateWithCharacters):
-        (JSStringCreateWithUTF8CString):
-        (JSStringRetain):
-        (JSStringRelease):
-        (JSStringGetLength):
-        (JSStringGetCharactersPtr):
-        (JSStringGetMaximumUTF8CStringSize):
-        (JSStringGetUTF8CString):
-        (JSStringIsEqual):
-        * API/JSStringRefCF.cpp:
-        (JSStringCreateWithCFString):
-        (JSStringCopyCFString):
-        * API/JSValueRef.cpp:
-        (JSValueMakeString):
-        (JSValueToStringCopy):
-        Updated to use OpaqueJSString.
+        Rubber Stamped by Mark Rowe (originally reviewed by Sam Weinig).
 
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        Added OpaqueJSString.
+        (Reintroducing patch added in r44492, and reverted in r44796.)
 
-2008-08-14  Kevin McCullough  <kmccullough@apple.com>
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
 
-        Reviewed by Tim.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
 
-        <rdar://problem/6115819> Notify of profile in console
-        - Profiles now have a unique ID so that they can be linked to the
-        console message that announces that a profile completed.
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
 
-        * profiler/HeavyProfile.cpp: 
-        (KJS::HeavyProfile::HeavyProfile):
-        * profiler/Profile.cpp:
-        (KJS::Profile::create):
-        (KJS::Profile::Profile):
-        * profiler/Profile.h:
-        (KJS::Profile::uid):
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create):
-        (KJS::ProfileGenerator::ProfileGenerator):
-        * profiler/ProfileGenerator.h:
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        * profiler/TreeProfile.cpp:
-        (KJS::TreeProfile::create):
-        (KJS::TreeProfile::TreeProfile):
-        * profiler/TreeProfile.h:
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
 
-2008-08-13  Geoffrey Garen  <ggaren@apple.com>
+        - Exposed functions now needed by WebCore.
+
+        * JavaScriptCore.exp:
+
+2009-06-17  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
-        
-        Nixed a PIC branch from JSObject::getOwnPropertySlot, by forcing
-        fillGetterProperty, which references a global function pointer,
-        out-of-line.
-        
-        .2% SunSpider speedup, 4.3% access-nbody speedup, 8.7% speedup on a
-        custom property access benchmark for objects with one property.
 
-        * kjs/JSObject.cpp:
-        (KJS::JSObject::fillGetterPropertySlot):
+        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
+        of arbitrary complexity
+        https://bugs.webkit.org/show_bug.cgi?id=26429
+
+        For marking I decided not to use gcProtect, because this is inside the engine
+        so it's easy enough to just do marking. And that darned gcProtect does locking!
+        Oliver tried to convince me to used MarkedArgumentBuffer, but the constructor
+        for that class says "FIXME: Remove all clients of this API, then remove this API."
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect): Add a call to JSONObject::markStringifiers.
+
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Added emptyIdentifier.
+        * runtime/CommonIdentifiers.h: Ditto.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Initialize firstStringifierToMark to 0.
+        * runtime/JSGlobalData.h: Added firstStringifierToMark.
+
+        * runtime/JSONObject.cpp: Cut down the includes to the needed ones only.
+        (JSC::unwrapNumberOrString): Added. Helper for unwrapping number and string
+        objects to get their number and string values.
+        (JSC::ReplacerPropertyName::ReplacerPropertyName): Added. The class is used
+        to wrap an identifier or integer so we don't have to do any work unless we
+        actually call a replacer.
+        (JSC::ReplacerPropertyName::value): Added.
+        (JSC::gap): Added. Helper function for the Stringifier constructor.
+        (JSC::PropertyNameForFunctionCall::PropertyNameForFunctionCall): Added.
+        The class is used to wrap an identifier or integer so we don't have to
+        allocate a number or string until we actually call toJSON or a replacer.
+        (JSC::PropertyNameForFunctionCall::asJSValue): Added.
+        (JSC::Stringifier::Stringifier): Updated and moved out of the class
+        definition. Added code to hook this into a singly linked list for marking.
+        (JSC::Stringifier::~Stringifier): Remove from the singly linked list.
+        (JSC::Stringifier::mark): Mark all the objects in the holder stacks.
+        (JSC::Stringifier::stringify): Updated.
+        (JSC::Stringifier::appendQuotedString): Tweaked and streamlined a bit.
+        (JSC::Stringifier::toJSON): Renamed from toJSONValue.
+        (JSC::Stringifier::appendStringifiedValue): Renamed from stringify.
+        Added code to use the m_holderStack to do non-recursive stringify of
+        objects and arrays. This code also uses the timeout checker since in
+        pathological cases it could be slow even without calling into the
+        JavaScript virtual machine.
+        (JSC::Stringifier::willIndent): Added.
+        (JSC::Stringifier::indent): Added.
+        (JSC::Stringifier::unindent): Added.
+        (JSC::Stringifier::startNewLine): Added.
+        (JSC::Stringifier::Holder::Holder): Added.
+        (JSC::Stringifier::Holder::appendNextProperty): Added. This is the
+        function that handles the format of arrays and objects.
+        (JSC::JSONObject::getOwnPropertySlot): Moved this down to the bottom
+        of the file so the JSONObject class is not interleaved with the
+        Stringifier class.
+        (JSC::JSONObject::markStringifiers): Added. Calls mark.
+        (JSC::JSONProtoFuncStringify): Streamlined the code here. The code
+        to compute the gap string is now a separate function.
+
+        * runtime/JSONObject.h: Made everything private. Added markStringifiers.
+
+2009-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com
+
+        Roll out r43849 as it appears that we cannot rely on the address of
+        an objects property storage being constant even if the structure is
+        unchanged.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe.
+
+        Fully revert r44492 & r44748 while we fix a bug they cause on internal builds <rdar://problem/6955963>.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
 
-2008-08-13  Alp Toker  <alp@nuanti.com>
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Mark Rowe.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20349
-        WTF::initializeThreading() fails if threading is already initialized
+        <rdar://problem/6947426> sunspider math-cordic.js exhibits different intermediate results running 32-bit vs. 64-bit
 
-        Fix threading initialization logic to support cases where
-        g_thread_init() has already been called elsewhere.
+        On 64-bit, NaN-encoded values must be detagged before they can be used in rshift.
 
-        Resolves database-related crashers reported in several applications.
+        No performance impact.
 
-        * wtf/ThreadingGtk.cpp:
-        (WTF::initializeThreading):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
 
-2008-08-13  Brad Hughes <bhughes@trolltech.com>
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
 
-        Reviewed by Simon.
+        Reviewed by George Staikos.
 
-        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        The latest upgrade of the intel compiler allows us to compile all of
-        Qt with optimizations enabled (yay!).
+        * jsc.cpp:
+        (main):
 
-        * JavaScriptCore.pro:
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
 
-2008-08-12  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Adam Treat.
 
-        Reviewed by Geoff Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        Add peephole optimisation to 'op_not... jfalse...' (eg. if(!...) )
+        * config.h:
+        * jsc.cpp:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/DateMath.cpp:
+        (WTF::getLocalTime):
+        * wtf/MathExtras.h:
+        * wtf/Platform.h:
+        * wtf/StringExtras.h:
+        * wtf/Threading.h:
+        * wtf/win/MainThreadWin.cpp:
 
-        This is a very slight win in sunspider, and a fairly substantial win
-        in hot code that does if(!...), etc.
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::retrieveLastUnaryOp):
-        (KJS::CodeGenerator::rewindBinaryOp):
-        (KJS::CodeGenerator::rewindUnaryOp):
-        (KJS::CodeGenerator::emitJumpIfFalse):
-        * VM/CodeGenerator.h:
+        Reviewed by Oliver Hunt.
 
-2008-08-12  Dan Bernstein  <mitz@apple.com>
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
 
-        - JavaScriptCore part of <rdar://problem/6121636>
-          Make fast*alloc() abort() on failure and add "try" variants that
-          return NULL on failure.
+        Remove PropertySlot::putValue - PropertySlots should only be used for getting,
+        not putting.  Rename JSGlobalObject::getOwnPropertySlot to hasOwnPropertyForWrite,
+        which is what it really was being used to ask, and remove some other getOwnPropertySlot
+        & getOwnPropertySlotForWrite methods, which were unused and likely to lead to confusion.
 
-        Reviewed by Darin Adler.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/PropertySlot.h:
 
-        * JavaScriptCore.exp: Exported tryFastCalloc().
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::RegisterFile): Removed an ASSERT().
-        * kjs/JSArray.cpp:
-        (KJS::JSArray::putSlowCase): Changed to use tryFastRealloc().
-        (KJS::JSArray::increaseVectorLength): Ditto.
-        * kjs/ustring.cpp:
-        (KJS::allocChars): Changed to use tryFastMalloc().
-        (KJS::reallocChars): Changed to use tryFastRealloc().
-        * wtf/FastMalloc.cpp:
-        (WTF::fastZeroedMalloc): Removed null checking of fastMalloc()'s result
-        and removed extra call to InvokeNewHook().
-        (WTF::tryFastZeroedMalloc): Added. Uses tryFastMalloc().
-        (WTF::tryFastMalloc): Renamed fastMalloc() to this.
-        (WTF::fastMalloc): Added. This version abort()s if allocation fails.
-        (WTF::tryFastCalloc): Renamed fastCalloc() to this.
-        (WTF::fastCalloc): Added. This version abort()s if allocation fails.
-        (WTF::tryFastRealloc): Renamed fastRealloc() to this.
-        (WTF::fastRealloc): Added. This version abort()s if allocation fails.
-        (WTF::do_malloc): Made this a function template. When the abortOnFailure
-        template parameter is set, the function abort()s on failure to allocate.
-        Otherwise, it sets errno to ENOMEM and returns zero.
-        (WTF::TCMallocStats::fastMalloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastMalloc): Added. Does not abort() on
-        failure.
-        (WTF::TCMallocStats::fastCalloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastCalloc): Added. Does not abort() on
-        failure.
-        (WTF::TCMallocStats::fastRealloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastRealloc): Added. Does not abort() on
-        failure.
-        * wtf/FastMalloc.h: Declared the "try" variants.
-
-2008-08-11  Adam Roben  <aroben@apple.com>
-
-        Move WTF::notFound into its own header so that it can be used
-        independently of Vector
-
-        Rubberstamped by Darin Adler.
+2009-06-16  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        Added NotFound.h to the project.
-        * wtf/NotFound.h: Added. Moved the notFound constant here...
-        * wtf/Vector.h: ...from here.
+        Reviewed by Oliver hunt.
 
-2008-08-11  Alexey Proskuryakov  <ap@webkit.org>
+        Temporarily partially disable r44492, since this is causing some problems on internal builds.
 
-        Reviewed by Mark Rowe.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+
+2009-06-16  Sam Weinig  <sam@webkit.org>
 
-        <rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit
+        Fix windows build.
 
-        * API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
 
-        * kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while
-        sweeping the heap.
+2009-06-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
 
-== Rolled over to ChangeLog-2008-08-10 ==
+        Initialize m_bytecodeIndex to -1 in JIT, and correctly initialize
+        it for each type of stub using the return address to find the correct
+        offset.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+== Rolled over to ChangeLog-2009-06-16 ==