<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[151363] branches/dfgFourthTier</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/151363">151363</a></dd>
<dt>Author</dt> <dd>ggaren@apple.com</dd>
<dt>Date</dt> <dd>2013-06-09 22:45:15 -0700 (Sun, 09 Jun 2013)</dd>
</dl>

<h3>Log Message</h3>
<pre>Re-worked non-local variable resolution
https://bugs.webkit.org/show_bug.cgi?id=117375

Reviewed by Filip Pizlo.

Source/JavaScriptCore: 

This patch has two goals:

(1) Simplicity.

    * Net removes 15 opcodes.
    * Net removes 2,000 lines of code.
    * Removes setPair() from the DFG: All DFG nodes have 1 result register now.

(2) Performance.

    * 2%-3% speedup on SunSpider (20% in LLInt and Baseline JIT)
    * 2% speedup on v8-spider
    * 10% speedup on js-regress-hashmap*
    * Amusing 2X speedup on js-regress-poly-stricteq

The bytecode now separates the scope chain resolution opcode from the
scope access opcode.

    OLD:
        get_scoped_var  <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>, 1, 0
        inc             <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>
        put_scoped_var  1, 0, <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>

    NEW:
        resolve_scope   <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>, x(@id0)
        get_from_scope  <a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>, x(@id0)
        inc             <a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>
        put_to_scope    <a href="http://trac.webkit.org/projects/webkit/changeset/0">r0</a>, x(@id0), <a href="http://trac.webkit.org/projects/webkit/changeset/1">r1</a>

Also, we link non-local variable resolution opcodes at CodeBlock link
time instead of time of first opcode execution.

This means that we can represent all possible non-local variable
resolutions using just three opcodes, and any optimizations in these
opcodes naturally apply across-the-board.

* API/JSCTestRunnerUtils.cpp:
(JSC::numberOfDFGCompiles):
* GNUmakefile.list.am:
* JavaScriptCore.gypi:
* JavaScriptCore.order:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri: Build!

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode): Updated for removed things.

(JSC::CodeBlock::CodeBlock): Always provide the full scope chain when
creating a CodeBlock, so we can perform non-local variable resolution.

Added code to perform linking for these opcodes. This is where we figure
out which non-local variable resolutions are optimizable, and how.

(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::noticeIncomingCall):
(JSC::CodeBlock::optimizeAfterWarmUp):
(JSC::CodeBlock::optimizeAfterLongWarmUp):
(JSC::CodeBlock::optimizeSoon): Updated for removed things.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::needsActivation):
(JSC::GlobalCodeBlock::GlobalCodeBlock):
(JSC::ProgramCodeBlock::ProgramCodeBlock):
(JSC::EvalCodeBlock::EvalCodeBlock):
(JSC::FunctionCodeBlock::FunctionCodeBlock):
* bytecode/EvalCodeCache.h:
(JSC::EvalCodeCache::getSlow): Updated for interface changes.

* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFor): Treat global object access as
optimizable even though the global object has a custom property access
callback. This is what we've always done since, otherwise, we can't
optimize globals. (In future, we probably want to figure out a more
targeted policy than &quot;any property access callback means no 
optimization&quot;.)

* bytecode/GlobalResolveInfo.h: Removed.
* bytecode/Instruction.h:
* bytecode/Opcode.h:
(JSC::padOpcodeName):

* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor): Like GetByIdStatus.

* bytecode/ResolveGlobalStatus.cpp: Removed.
* bytecode/ResolveGlobalStatus.h: Removed.
* bytecode/ResolveOperation.h: Removed.

* bytecode/UnlinkedCodeBlock.cpp:
(JSC::generateFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::codeBlockFor):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h: Don't provide a scope chain to unlinked
code blocks. Giving a scope to an unscoped compilation unit invites
programming errors.

* bytecode/Watchpoint.h:
(JSC::WatchpointSet::addressOfIsInvalidated):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::resolveCallee):
(JSC::BytecodeGenerator::local):
(JSC::BytecodeGenerator::constLocal):
(JSC::BytecodeGenerator::resolveType):
(JSC::BytecodeGenerator::emitResolveScope):
(JSC::BytecodeGenerator::emitGetFromScope):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitInstanceOf):
(JSC::BytecodeGenerator::emitPushWithScope):
(JSC::BytecodeGenerator::emitPopScope):
(JSC::BytecodeGenerator::pushFinallyContext):
(JSC::BytecodeGenerator::emitComplexPopScopes):
(JSC::BytecodeGenerator::popTryAndEmitCatch):
(JSC::BytecodeGenerator::emitPushNameScope):
(JSC::BytecodeGenerator::isArgumentNumber):
* bytecompiler/BytecodeGenerator.h:
(JSC::Local::Local):
(JSC::Local::operator bool):
(JSC::Local::get):
(JSC::Local::isReadOnly):
(JSC::BytecodeGenerator::scopeDepth):
(JSC::BytecodeGenerator::shouldOptimizeLocals):
(JSC::BytecodeGenerator::canOptimizeNonLocals): Refactored the bytecode
generator to resolve all variables within local scope, as if there
were no non-local scope. This helps provide a separation of concerns:
unlinked bytecode is always scope-free, and the linking stage links
in the provided scope.

* bytecompiler/NodesCodegen.cpp:
(JSC::ResolveNode::isPure):
(JSC::ResolveNode::emitBytecode):
(JSC::EvalFunctionCallNode::emitBytecode):
(JSC::FunctionCallResolveNode::emitBytecode):
(JSC::PostfixNode::emitResolve):
(JSC::DeleteResolveNode::emitBytecode):
(JSC::TypeOfResolveNode::emitBytecode):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode): A bunch of this codegen is no longer
necessary, since it's redundant with the linking stage.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::ByteCodeParser):
(JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
(JSC::DFG::ByteCodeParser::handlePutByOffset):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock): Updated for interface changes.
Notably, we can reuse existing DFG nodes -- but the mapping between
bytecode and DFG nodes has changed, and some nodes and corner cases have
been removed.

* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::scopedVarLoadElimination):
(JSC::DFG::CSEPhase::varInjectionWatchpointElimination):
(JSC::DFG::CSEPhase::globalVarStoreElimination):
(JSC::DFG::CSEPhase::scopedVarStoreElimination):
(JSC::DFG::CSEPhase::getLocalLoadElimination):
(JSC::DFG::CSEPhase::setLocalStoreElimination):
(JSC::DFG::CSEPhase::performNodeCSE): Added CSE for var injection
watchpoints. Even though watchpoints are &quot;free&quot;, they're quite common
inside code that's subject to var injection, so I figured we'd save a
little memory.

* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGCapabilities.h: Removed detection for old forms.

* dfg/DFGDriver.h:
(JSC::DFG::tryCompile):
(JSC::DFG::tryCompileFunction):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.h:
* dfg/DFGJITCode.cpp:
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToStructureTransitionWatchpoint):
(JSC::DFG::Node::hasVarNumber):
(JSC::DFG::Node::hasIdentifierNumberForCheck):
(JSC::DFG::Node::hasRegisterPointer):
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGRepatch.h:
(JSC::DFG::dfgResetGetByID):
(JSC::DFG::dfgResetPutByID):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): Removed some unneeded things,
and updated for renames.

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile): The two primary changes here are:

(1) Use a watchpoint for var injection instead of looping over the scope
chain and checking. This is more efficient and much easier to model in
code generation.

(2) I've eliminated the notion of an optimized global assignment that
needs to check for whether it should fire a watchpiont. Instead, we
fire pre-emptively at the point of optimization. This removes a bunch
of edge cases, and it seems like a more honest representation of
the fact that our new optimization contradicts our old one.

* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* heap/DFGCodeBlocks.cpp:
(JSC::DFGCodeBlocks::jettison):
* interpreter/CallFrame.h:
(JSC::ExecState::trueCallFrame): Removed stuff that's unused now, and
fixed the build.

* interpreter/Interpreter.cpp:
(JSC::eval):
(JSC::getBytecodeOffsetForCallFrame):
(JSC::getCallerInfo):
(JSC::Interpreter::throwException): Updated exception scope tracking
to match the rest of our linking strategy: The unlinked bytecode compiles
exception scope as if non-local scope did not exist, and we add in
non-local scope at link time. This means that we can restore the right
scope depth based on a simple number, without checking the contents of
the scope chain.

(JSC::Interpreter::execute): Make sure to establish the full scope chain
before linking eval code. We now require the full scope chain at link
time, in order to link non-local variable resolution opcodes.

* jit/JIT.cpp:
(JSC::JIT::JIT):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITArithmetic.cpp:
(JSC::JIT::emit_op_add):
* jit/JITCode.cpp:
* jit/JITOpcodes.cpp:
(JSC::JIT::emitSlow_op_bitxor):
(JSC::JIT::emitSlow_op_bitor):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emitSlow_op_to_primitive):
(JSC::JIT::emit_op_strcat):
(JSC::JIT::emitSlow_op_create_this):
(JSC::JIT::emitSlow_op_to_this):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emitSlow_op_resolve_scope):
(JSC::JIT::emitLoadWithStructureCheck):
(JSC::JIT::emitGetGlobalProperty):
(JSC::JIT::emitGetGlobalVar):
(JSC::JIT::emitGetClosureVar):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emitPutGlobalProperty):
(JSC::JIT::emitPutGlobalVar):
(JSC::JIT::emitPutClosureVar):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_init_global_const):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emitSlow_op_resolve_scope):
(JSC::JIT::emitLoadWithStructureCheck):
(JSC::JIT::emitGetGlobalProperty):
(JSC::JIT::emitGetGlobalVar):
(JSC::JIT::emitGetClosureVar):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emitPutGlobalProperty):
(JSC::JIT::emitPutGlobalVar):
(JSC::JIT::emitPutClosureVar):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_init_global_const):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h: Re-wrote baseline JIT codegen for our new variable
resolution model.

* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter.cpp:
(JSC::CLoop::execute):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm: Ditto for LLInt.

* offlineasm/x86.rb: Fixed a pre-existing encoding bug for a syntactic
form that we never used before.

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncToString):
(JSC::arrayProtoFuncToLocaleString):
(JSC::arrayProtoFuncJoin):
(JSC::arrayProtoFuncConcat):
(JSC::arrayProtoFuncPop):
(JSC::arrayProtoFuncPush):
(JSC::arrayProtoFuncReverse):
(JSC::arrayProtoFuncShift):
(JSC::arrayProtoFuncSlice):
(JSC::arrayProtoFuncSort):
(JSC::arrayProtoFuncSplice):
(JSC::arrayProtoFuncUnShift):
(JSC::arrayProtoFuncFilter):
(JSC::arrayProtoFuncMap):
(JSC::arrayProtoFuncEvery):
(JSC::arrayProtoFuncForEach):
(JSC::arrayProtoFuncSome):
(JSC::arrayProtoFuncReduce):
(JSC::arrayProtoFuncReduceRight):
(JSC::arrayProtoFuncIndexOf):
(JSC::arrayProtoFuncLastIndexOf): Fixed some pre-existing bugs in
'this' value conversion, which I made much more common by removing
special cases in bytecode generation.

These functions need to invoke toThis() because they observe the 'this'
value. Also, toLocaleString() is specified to accept non-array 'this'
values.

(Most other host functions don't need this fix because they perform
strict 'this' checking, which never coerces unexpected types.)

* runtime/CodeCache.cpp:
(JSC::CodeCache::getCodeBlock):
(JSC::CodeCache::getProgramCodeBlock):
(JSC::CodeCache::getEvalCodeBlock):
* runtime/CodeCache.h: Don't supply a scope to the unlinked code cache.
Unlinked code is supposed to be scope-free, so let's have the compiler
help verify that.

* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/CommonSlowPaths.h:
* runtime/Executable.cpp:
(JSC::EvalExecutable::create):
(JSC::EvalExecutable::compileInternal):
(JSC::ProgramExecutable::compileInternal):
(JSC::FunctionExecutable::produceCodeBlockFor):
(JSC::FunctionExecutable::compileForCallInternal):
(JSC::FunctionExecutable::compileForConstructInternal):
* runtime/Executable.h:
(JSC::EvalExecutable::numVariables):
(JSC::EvalExecutable::numberOfFunctionDecls):
* runtime/ExecutionHarness.h:
(JSC::prepareForExecutionImpl):
(JSC::prepareFunctionForExecutionImpl):
(JSC::installOptimizedCode): Fiddled with executable initialization so
that we can always generate a full scope chain before we go to link a
code block. We need this because code block linking now depends on the
scope chain to link non-local variable resolution opcodes.

* runtime/JSActivation.h:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::createEvalCodeBlock):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::varInjectionWatchpoint):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncEval):
* runtime/JSNameScope.h:
* runtime/JSScope.cpp:
(JSC::abstractAccess):
(JSC::JSScope::objectAtScope):
(JSC::JSScope::depth):
(JSC::JSScope::resolve):
(JSC::JSScope::abstractResolve): Updated to match changes explained above.

* runtime/JSScope.h:
(JSC::makeType):
(JSC::needsVarInjectionChecks):
(JSC::ResolveOp::ResolveOp):
(JSC::ResolveModeAndType::ResolveModeAndType):
(JSC::ResolveModeAndType::mode):
(JSC::ResolveModeAndType::type):
(JSC::ResolveModeAndType::operand): Removed the old variable resolution
state machine, since it's unused now. Added logic for performing abstract
variable resolution at link time. This is used by codeblock linking.

* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncValueOf):
(JSC::objectProtoFuncHasOwnProperty):
(JSC::objectProtoFuncIsPrototypeOf):
(JSC::objectProtoFuncDefineGetter):
(JSC::objectProtoFuncDefineSetter):
(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
(JSC::objectProtoFuncPropertyIsEnumerable):
(JSC::objectProtoFuncToLocaleString):
(JSC::objectProtoFuncToString): Fixed some pre-existing bugs in
'this' value conversion, which I made much more common by removing
special cases in bytecode generation.

These functions need to invoke toThis() because they observe the 'this'
value.

* runtime/StringPrototype.cpp:
(JSC::checkObjectCoercible):
(JSC::stringProtoFuncReplace):
(JSC::stringProtoFuncCharAt):
(JSC::stringProtoFuncCharCodeAt):
(JSC::stringProtoFuncConcat):
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncLastIndexOf):
(JSC::stringProtoFuncMatch):
(JSC::stringProtoFuncSearch):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSplit):
(JSC::stringProtoFuncSubstr):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):
(JSC::stringProtoFuncLocaleCompare):
(JSC::stringProtoFuncBig):
(JSC::stringProtoFuncSmall):
(JSC::stringProtoFuncBlink):
(JSC::stringProtoFuncBold):
(JSC::stringProtoFuncFixed):
(JSC::stringProtoFuncItalics):
(JSC::stringProtoFuncStrike):
(JSC::stringProtoFuncSub):
(JSC::stringProtoFuncSup):
(JSC::stringProtoFuncFontcolor):
(JSC::stringProtoFuncFontsize):
(JSC::stringProtoFuncAnchor):
(JSC::stringProtoFuncLink):
(JSC::trimString): Fixed some pre-existing bugs in
'this' value conversion, which I made much more common by removing
special cases in bytecode generation.

These functions need to invoke toThis() because they observe the 'this'
value.

* runtime/StructureRareData.cpp:
* runtime/VM.cpp:
(JSC::VM::~VM):

* runtime/WriteBarrier.h:
(JSC::WriteBarrierBase::slot): Modified to reduce casting in client code.

LayoutTests: 

This patch removed special-case 'this' resolution from bytecode, making
some pre-existing edge cases in 'this' value treatment much more common.

I updated the test results below, and added some tests, to match bug
fixes for these cases.

* fast/js/script-tests/array-functions-non-arrays.js:
* fast/js/array-functions-non-arrays-expected.txt: As specified, it's
not an error to pass a non-array to toLocaleString. Our new result
matches Firefox and Chrome.

* fast/js/array-prototype-properties-expected.txt: Updated for slightly
clearer error message.

* fast/js/basic-strict-mode-expected.txt: Updated for slightly more
standard error message.

* fast/js/object-prototype-toString-expected.txt: Added.
* fast/js/object-prototype-toString.html: Added. This test demonstrates
why we now fail a Sputnik test below, while Firefox and Chrome pass it.
(The test doesn't test what it thinks it tests, and this test verifies
that we get right what it does think it tests.)

* fast/js/string-prototype-function-this-expected.txt: Added.
* fast/js/string-prototype-function-this.html: Added. This test shows
that we CheckObjectCoercible in string prototype functions. (We used
to get this wrong, but Sputnik tests made it seem like we got it right
because they didn't test the dynamic scope case.)

* sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt:

Updated to show failing results. Firefox and Chrome also fail these
tests, and the ES5 spec seems to mandate failure. Because these tests
resolve a String.prototype function at global scope, the 'this' value
for the call is an environment record. Logically, an environment record
converts to 'undefined' at the call site, and should then fail the
CheckObjectCoercible test.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchesdfgFourthTierLayoutTestsChangeLog">branches/dfgFourthTier/LayoutTests/ChangeLog</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsarrayfunctionsnonarraysexpectedtxt">branches/dfgFourthTier/LayoutTests/fast/js/array-functions-non-arrays-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsarrayprototypepropertiesexpectedtxt">branches/dfgFourthTier/LayoutTests/fast/js/array-prototype-properties-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsbasicstrictmodeexpectedtxt">branches/dfgFourthTier/LayoutTests/fast/js/basic-strict-mode-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsscripttestsarrayfunctionsnonarraysjs">branches/dfgFourthTier/LayoutTests/fast/js/script-tests/array-functions-non-arrays.js</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance11_Expressions111_Primary_Expressions1111_The_this_KeywordS1111_A2expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects154_Array154415443_Array_prototype_toLocaleStringS15443_A2_T1expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155410_StringprototypematchS155410_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155411_StringprototypereplaceS155411_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155412_StringprototypesearchS155412_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155413_StringprototypesliceS155413_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155414_StringprototypesplitS155414_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155415_StringprototypesubstringS155415_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415546_StringprototypeconcatS15546_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415547_StringprototypeindexOfS15547_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415548_StringprototypelastIndexOfS15548_A1_T3expectedtxt">branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreAPIJSCTestRunnerUtilscpp">branches/dfgFourthTier/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreChangeLog">branches/dfgFourthTier/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreGNUmakefilelistam">branches/dfgFourthTier/Source/JavaScriptCore/GNUmakefile.list.am</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCoregypi">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.gypi</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCoreorder">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.order</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcprojJavaScriptCoreJavaScriptCorevcproj">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreTargetpri">branches/dfgFourthTier/Source/JavaScriptCore/Target.pri</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeCodeBlockcpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeCodeBlockh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeEvalCodeCacheh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/EvalCodeCache.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeGetByIdStatuscpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeInstructionh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Instruction.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeOpcodeh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Opcode.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodePutByIdStatuscpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeUnlinkedCodeBlockh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeWatchpointh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Watchpoint.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecompilerBytecodeGeneratorh">branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecompilerNodesCodegencpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGAbstractStatecpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGAbstractState.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGByteCodeParsercpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGCSEPhasecpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGCapabilitiescpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCapabilities.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGFixupPhasecpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGGraphh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGNodeh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGNodeTypeh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGOperationscpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGOperationsh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGRepatchh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGRepatch.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJITh">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreinterpreterInterpretercpp">branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITcpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITh">branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITArithmeticcpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITArithmetic.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITCodecpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITCode.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITOpcodescpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITOpcodes32_64cpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITPropertyAccesscpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITPropertyAccess32_64cpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITStubscpp">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorejitJITStubsh">branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLLIntDatacpp">branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLLIntSlowPathscpp">branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLLIntSlowPathsh">branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreterasm">branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpretercpp">branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreter32_64asm">branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreter64asm">branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreofflineasmx86rb">branches/dfgFourthTier/Source/JavaScriptCore/offlineasm/x86.rb</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeArrayPrototypecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeCodeCachecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeCodeCacheh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeCommonSlowPathscpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeCommonSlowPathsh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeExecutablecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeExecutableh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeExecutionHarnessh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/ExecutionHarness.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSActivationh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSActivation.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSGlobalObjectcpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSGlobalObjecth">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSNameScopeh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSNameScope.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSScopecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSScope.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeJSScopeh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSScope.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeObjectPrototypecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeStringPrototypecpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeStructureRareDatacpp">branches/dfgFourthTier/Source/JavaScriptCore/runtime/StructureRareData.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCoreruntimeWriteBarrierh">branches/dfgFourthTier/Source/JavaScriptCore/runtime/WriteBarrier.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsobjectprototypetoStringexpectedtxt">branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsobjectprototypetoStringhtml">branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString.html</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsstringprototypefunctionthisexpectedtxt">branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this-expected.txt</a></li>
<li><a href="#branchesdfgFourthTierLayoutTestsfastjsstringprototypefunctionthishtml">branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this.html</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeGlobalResolveInfoh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveGlobalStatuscpp">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveGlobalStatush">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h</a></li>
<li><a href="#branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveOperationh">branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveOperation.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchesdfgFourthTierLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/ChangeLog (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/ChangeLog        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/ChangeLog        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,3 +1,58 @@
</span><ins>+2013-06-08  Geoffrey Garen  &lt;ggaren@apple.com&gt;
+
+        Re-worked non-local variable resolution
+        https://bugs.webkit.org/show_bug.cgi?id=117375
+
+        Reviewed by Filip Pizlo.
+
+        This patch removed special-case 'this' resolution from bytecode, making
+        some pre-existing edge cases in 'this' value treatment much more common.
+
+        I updated the test results below, and added some tests, to match bug
+        fixes for these cases.
+
+        * fast/js/script-tests/array-functions-non-arrays.js:
+        * fast/js/array-functions-non-arrays-expected.txt: As specified, it's
+        not an error to pass a non-array to toLocaleString. Our new result
+        matches Firefox and Chrome.
+
+        * fast/js/array-prototype-properties-expected.txt: Updated for slightly
+        clearer error message.
+
+        * fast/js/basic-strict-mode-expected.txt: Updated for slightly more
+        standard error message.
+
+        * fast/js/object-prototype-toString-expected.txt: Added.
+        * fast/js/object-prototype-toString.html: Added. This test demonstrates
+        why we now fail a Sputnik test below, while Firefox and Chrome pass it.
+        (The test doesn't test what it thinks it tests, and this test verifies
+        that we get right what it does think it tests.)
+
+        * fast/js/string-prototype-function-this-expected.txt: Added.
+        * fast/js/string-prototype-function-this.html: Added. This test shows
+        that we CheckObjectCoercible in string prototype functions. (We used
+        to get this wrong, but Sputnik tests made it seem like we got it right
+        because they didn't test the dynamic scope case.)
+
+        * sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt:
+        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt:
+
+        Updated to show failing results. Firefox and Chrome also fail these
+        tests, and the ES5 spec seems to mandate failure. Because these tests
+        resolve a String.prototype function at global scope, the 'this' value
+        for the call is an environment record. Logically, an environment record
+        converts to 'undefined' at the call site, and should then fail the
+        CheckObjectCoercible test.
+
</ins><span class="cx"> 2013-06-09  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         fourthTier: DFG GetById patching shouldn't distinguish between self lists and proto lists
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsarrayfunctionsnonarraysexpectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/fast/js/array-functions-non-arrays-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/array-functions-non-arrays-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/fast/js/array-functions-non-arrays-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -17,7 +17,7 @@
</span><span class="cx"> PASS ({__proto__: Array.prototype, 0: 'a', 1: 'b', 2: 'c', length: 3, join: function() { return 'join' }}).toString() is &quot;join&quot;
</span><span class="cx"> PASS Array.prototype.toString.call(42) is &quot;Number.prototype.join:42&quot;
</span><span class="cx"> PASS [0, 1, 2].toString() is &quot;array-join&quot;
</span><del>-PASS Array.prototype.toLocaleString.call({}) threw exception TypeError: Type error.
</del><ins>+PASS Array.prototype.toLocaleString.call({}) is &quot;&quot;
</ins><span class="cx"> PASS Array.prototype.concat.call(x = { length:2, 0:'b', 1:'a' }) is [x]
</span><span class="cx"> PASS Array.prototype.join.call({}) is ''
</span><span class="cx"> PASS Array.prototype.join.call(['b', 'a']) is 'b,a'
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsarrayprototypepropertiesexpectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/fast/js/array-prototype-properties-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/array-prototype-properties-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/fast/js/array-prototype-properties-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -4,7 +4,7 @@
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> PASS Array.prototype.toString.call(undefined) threw exception TypeError: 'undefined' is not an object (evaluating 'Array.prototype.toString.call(undefined)').
</span><del>-PASS Array.prototype.toLocaleString.call(undefined) threw exception TypeError: Type error.
</del><ins>+PASS Array.prototype.toLocaleString.call(undefined) threw exception TypeError: 'undefined' is not an object (evaluating 'Array.prototype.toLocaleString.call(undefined)').
</ins><span class="cx"> PASS Array.prototype.concat.call(undefined, []) threw exception TypeError: 'undefined' is not an object (evaluating 'Array.prototype.concat.call(undefined, [])').
</span><span class="cx"> PASS Array.prototype.join.call(undefined, []) threw exception TypeError: 'undefined' is not an object (evaluating 'Array.prototype.join.call(undefined, [])').
</span><span class="cx"> PASS Array.prototype.pop.call(undefined) threw exception TypeError: 'undefined' is not an object (evaluating 'Array.prototype.pop.call(undefined)').
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsbasicstrictmodeexpectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/fast/js/basic-strict-mode-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/basic-strict-mode-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/fast/js/basic-strict-mode-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -105,7 +105,7 @@
</span><span class="cx"> PASS (function (){ 'use strict'; delete someDeclaredGlobal;}) threw exception SyntaxError: Cannot delete unqualified property 'someDeclaredGlobal' in strict mode.
</span><span class="cx"> PASS (function(){(function (){ 'use strict'; delete someDeclaredGlobal;})}) threw exception SyntaxError: Cannot delete unqualified property 'someDeclaredGlobal' in strict mode.
</span><span class="cx"> PASS 'use strict'; if (0) { someGlobal = 'Shouldn\'t be able to assign this.'; }; true; is true
</span><del>-PASS 'use strict'; someGlobal = 'Shouldn\'t be able to assign this.';  threw exception ReferenceError: Strict mode forbids implicit creation of global property 'someGlobal'.
</del><ins>+PASS 'use strict'; someGlobal = 'Shouldn\'t be able to assign this.';  threw exception ReferenceError: Can't find variable: someGlobal.
</ins><span class="cx"> PASS 'use strict'; (function f(){ f = 'shouldn\'t be able to assign to function expression name'; })() threw exception TypeError: Attempted to assign to readonly property..
</span><span class="cx"> PASS 'use strict'; eval('var introducedVariable = &quot;FAIL: variable introduced into containing scope&quot;;'); introducedVariable threw exception ReferenceError: Can't find variable: introducedVariable.
</span><span class="cx"> PASS 'use strict'; objectWithReadonlyProperty.prop = 'fail' threw exception TypeError: Attempted to assign to readonly property..
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsobjectprototypetoStringexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString-expected.txt (0 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString-expected.txt                                (rev 0)
+++ branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+This test verifies that Object.prototype.toString returns different results depending on how it was resolved.
+
+PASS: this.toString() should be [object Window] and is.
+PASS: toString() should be [object Undefined] and is.
+
</ins></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsobjectprototypetoStringhtml"></a>
<div class="addfile"><h4>Added: branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString.html (0 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString.html                                (rev 0)
+++ branches/dfgFourthTier/LayoutTests/fast/js/object-prototype-toString.html        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -0,0 +1,30 @@
</span><ins>+&lt;p&gt;This test verifies that Object.prototype.toString returns different results depending on how it was resolved.&lt;/p&gt;
+&lt;pre id=&quot;log&quot;&gt;&lt;/pre&gt;
+
+&lt;script&gt;
+function log(s)
+{
+        document.getElementById(&quot;log&quot;).appendChild(document.createTextNode(s + &quot;\n&quot;));
+}
+
+function shouldBe(aDescription, a, b)
+{
+        if (a === b) {
+                log(&quot;PASS: &quot; + aDescription + &quot; should be &quot; + b + &quot; and is.&quot;);
+                return;
+        }
+
+        log(&quot;FAIL: &quot; + aDescription + &quot; should be &quot; + b + &quot; but instead is &quot; + a + &quot;.&quot;);
+}
+&lt;/script&gt;
+
+&lt;script&gt;
+if (window.testRunner)
+        testRunner.dumpAsText();
+
+// Chrome and Firefox give Window.prototype a unique toString implementation -- overwrite it with Object.prototype.toString to make sure we're testing the right thing.
+this.toString = Object.prototype.toString;
+
+shouldBe(&quot;this.toString()&quot;, this.toString(), &quot;[object Window]&quot;);
+shouldBe(&quot;toString()&quot;, toString(), &quot;[object Undefined]&quot;);
+&lt;/script&gt;
</ins></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsscripttestsarrayfunctionsnonarraysjs"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/fast/js/script-tests/array-functions-non-arrays.js (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/script-tests/array-functions-non-arrays.js        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/fast/js/script-tests/array-functions-non-arrays.js        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -91,7 +91,7 @@
</span><span class="cx"> shouldBe(&quot;[0, 1, 2].toString()&quot;, '&quot;array-join&quot;');
</span><span class="cx"> Array.prototype.join = arrayJoin;
</span><span class="cx"> 
</span><del>-shouldThrow(&quot;Array.prototype.toLocaleString.call({})&quot;);
</del><ins>+shouldBe(&quot;Array.prototype.toLocaleString.call({})&quot;, '&quot;' + '&quot;');
</ins><span class="cx"> 
</span><span class="cx"> shouldBe(&quot;Array.prototype.concat.call(x = { length:2, 0:'b', 1:'a' })&quot;, &quot;[x]&quot;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsstringprototypefunctionthisexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this-expected.txt (0 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this-expected.txt                                (rev 0)
+++ branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+This test verifies that String.prototype functions CheckObjectCoercible, even if the caller is in a dynamic scope.
+
+PASS: Threw exception: TypeError: Type error
+
</ins></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestsfastjsstringprototypefunctionthishtml"></a>
<div class="addfile"><h4>Added: branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this.html (0 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this.html                                (rev 0)
+++ branches/dfgFourthTier/LayoutTests/fast/js/string-prototype-function-this.html        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -0,0 +1,33 @@
</span><ins>+&lt;p&gt;This test verifies that String.prototype functions CheckObjectCoercible, even if the caller is in a dynamic scope.&lt;/p&gt;
+&lt;pre id=&quot;log&quot;&gt;&lt;/pre&gt;
+
+&lt;script&gt;
+function log(s)
+{
+    document.getElementById(&quot;log&quot;).appendChild(document.createTextNode(s + &quot;\n&quot;));
+}
+
+function shouldBe(aDescription, a, b)
+{
+    if (a === b) {
+        log(&quot;PASS: &quot; + aDescription + &quot; should be &quot; + b + &quot; and is.&quot;);
+        return;
+    }
+
+    log(&quot;FAIL: &quot; + aDescription + &quot; should be &quot; + b + &quot; but instead is &quot; + a + &quot;.&quot;);
+}
+&lt;/script&gt;
+
+&lt;script&gt;
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+try {
+    with({}) {
+        charCodeAt = String.prototype.charCodeAt;
+        charCodeAt(&quot;6&quot;);
+    }
+} catch(e) {
+    log(&quot;PASS: Threw exception: &quot; + e);
+}
+&lt;/script&gt;
</ins></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance11_Expressions111_Primary_Expressions1111_The_this_KeywordS1111_A2expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S11.1.1_A2
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL SputnikError: #1: this.toString() === toString(). Actual: [object Window]
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects154_Array154415443_Array_prototype_toLocaleStringS15443_A2_T1expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.3_Array_prototype_toLocaleString/S15.4.4.3_A2_T1-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.4.4.3_A2_T1
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL SputnikError: #1.2: var obj = {}; obj.toLocaleString = Array.prototype.toLocaleString; obj.toLocaleString() throw TypeError. Actual: SputnikError: #1.1: var obj = {}; obj.toLocaleString = Array.prototype.toLocaleString; obj.toLocaleString() throw TypeError. Actual: 
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155410_StringprototypematchS155410_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.10_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155411_StringprototypereplaceS155411_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.11_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155412_StringprototypesearchS155412_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.12_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155413_StringprototypesliceS155413_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.13_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155414_StringprototypesplitS155414_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.14_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String1554155415_StringprototypesubstringS155415_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.15_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415546_StringprototypeconcatS15546_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.6_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415547_StringprototypeindexOfS15547_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.7_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierLayoutTestssputnikConformance15_Native_Objects155_String155415548_StringprototypelastIndexOfS15548_A1_T3expectedtxt"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> S15.5.4.8_A1_T3
</span><span class="cx"> 
</span><del>-PASS 
</del><ins>+FAIL TypeError: Type error
</ins><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreAPIJSCTestRunnerUtilscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -53,8 +53,12 @@
</span><span class="cx">         
</span><span class="cx">         if (!baselineCodeBlock)
</span><span class="cx">             return JSValueMakeNumber(context, 0);
</span><del>-        
</del><ins>+
+#if ENABLE(DFG_JIT)        
</ins><span class="cx">         return JSValueMakeNumber(context, baselineCodeBlock-&gt;numberOfDFGCompiles());
</span><ins>+#else
+        return JSValueMakeNumber(context, 1000000.0);
+#endif
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     return JSValueMakeUndefined(context);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/ChangeLog (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/ChangeLog        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/ChangeLog        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,3 +1,465 @@
</span><ins>+2013-06-08  Geoffrey Garen  &lt;ggaren@apple.com&gt;
+
+        Re-worked non-local variable resolution
+        https://bugs.webkit.org/show_bug.cgi?id=117375
+
+        Reviewed by Filip Pizlo.
+
+        This patch has two goals:
+
+        (1) Simplicity.
+
+            * Net removes 15 opcodes.
+            * Net removes 2,000 lines of code.
+            * Removes setPair() from the DFG: All DFG nodes have 1 result register now.
+
+        (2) Performance.
+
+            * 2%-3% speedup on SunSpider (20% in LLInt and Baseline JIT)
+            * 2% speedup on v8-spider
+            * 10% speedup on js-regress-hashmap*
+            * Amusing 2X speedup on js-regress-poly-stricteq
+
+        The bytecode now separates the scope chain resolution opcode from the
+        scope access opcode.
+
+            OLD:
+                get_scoped_var  r0, 1, 0
+                inc             r0
+                put_scoped_var  1, 0, r0
+
+            NEW:
+                resolve_scope   r0, x(@id0)
+                get_from_scope  r1, r0, x(@id0)
+                inc             r1
+                put_to_scope    r0, x(@id0), r1
+
+        Also, we link non-local variable resolution opcodes at CodeBlock link
+        time instead of time of first opcode execution.
+
+        This means that we can represent all possible non-local variable
+        resolutions using just three opcodes, and any optimizations in these
+        opcodes naturally apply across-the-board.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles):
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Build!
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Updated for removed things.
+
+        (JSC::CodeBlock::CodeBlock): Always provide the full scope chain when
+        creating a CodeBlock, so we can perform non-local variable resolution.
+
+        Added code to perform linking for these opcodes. This is where we figure
+        out which non-local variable resolutions are optimizable, and how.
+
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::noticeIncomingCall):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon): Updated for removed things.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::needsActivation):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow): Updated for interface changes.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor): Treat global object access as
+        optimizable even though the global object has a custom property access
+        callback. This is what we've always done since, otherwise, we can't
+        optimize globals. (In future, we probably want to figure out a more
+        targeted policy than &quot;any property access callback means no 
+        optimization&quot;.)
+
+        * bytecode/GlobalResolveInfo.h: Removed.
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor): Like GetByIdStatus.
+
+        * bytecode/ResolveGlobalStatus.cpp: Removed.
+        * bytecode/ResolveGlobalStatus.h: Removed.
+        * bytecode/ResolveOperation.h: Removed.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h: Don't provide a scope chain to unlinked
+        code blocks. Giving a scope to an unscoped compilation unit invites
+        programming errors.
+
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::addressOfIsInvalidated):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::local):
+        (JSC::BytecodeGenerator::constLocal):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::emitPushNameScope):
+        (JSC::BytecodeGenerator::isArgumentNumber):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Local::Local):
+        (JSC::Local::operator bool):
+        (JSC::Local::get):
+        (JSC::Local::isReadOnly):
+        (JSC::BytecodeGenerator::scopeDepth):
+        (JSC::BytecodeGenerator::shouldOptimizeLocals):
+        (JSC::BytecodeGenerator::canOptimizeNonLocals): Refactored the bytecode
+        generator to resolve all variables within local scope, as if there
+        were no non-local scope. This helps provide a separation of concerns:
+        unlinked bytecode is always scope-free, and the linking stage links
+        in the provided scope.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode): A bunch of this codegen is no longer
+        necessary, since it's redundant with the linking stage.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock): Updated for interface changes.
+        Notably, we can reuse existing DFG nodes -- but the mapping between
+        bytecode and DFG nodes has changed, and some nodes and corner cases have
+        been removed.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::varInjectionWatchpointElimination):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE): Added CSE for var injection
+        watchpoints. Even though watchpoints are &quot;free&quot;, they're quite common
+        inside code that's subject to var injection, so I figured we'd save a
+        little memory.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCapabilities.h: Removed detection for old forms.
+
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (JSC::DFG::Node::hasVarNumber):
+        (JSC::DFG::Node::hasIdentifierNumberForCheck):
+        (JSC::DFG::Node::hasRegisterPointer):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Removed some unneeded things,
+        and updated for renames.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): The two primary changes here are:
+
+        (1) Use a watchpoint for var injection instead of looping over the scope
+        chain and checking. This is more efficient and much easier to model in
+        code generation.
+
+        (2) I've eliminated the notion of an optimized global assignment that
+        needs to check for whether it should fire a watchpiont. Instead, we
+        fire pre-emptively at the point of optimization. This removes a bunch
+        of edge cases, and it seems like a more honest representation of
+        the fact that our new optimization contradicts our old one.
+
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::jettison):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::trueCallFrame): Removed stuff that's unused now, and
+        fixed the build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::getBytecodeOffsetForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::throwException): Updated exception scope tracking
+        to match the rest of our linking strategy: The unlinked bytecode compiles
+        exception scope as if non-local scope did not exist, and we add in
+        non-local scope at link time. This means that we can restore the right
+        scope depth based on a simple number, without checking the contents of
+        the scope chain.
+
+        (JSC::Interpreter::execute): Make sure to establish the full scope chain
+        before linking eval code. We now require the full scope chain at link
+        time, in order to link non-local variable resolution opcodes.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        * jit/JITCode.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitor):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitVarInjectionCheck):
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetGlobalVar):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitVarInjectionCheck):
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetGlobalVar):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h: Re-wrote baseline JIT codegen for our new variable
+        resolution model.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Ditto for LLInt.
+
+        * offlineasm/x86.rb: Fixed a pre-existing encoding bug for a syntactic
+        form that we never used before.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf): Fixed some pre-existing bugs in
+        'this' value conversion, which I made much more common by removing
+        special cases in bytecode generation.
+
+        These functions need to invoke toThis() because they observe the 'this'
+        value. Also, toLocaleString() is specified to accept non-array 'this'
+        values.
+
+        (Most other host functions don't need this fix because they perform
+        strict 'this' checking, which never coerces unexpected types.)
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        * runtime/CodeCache.h: Don't supply a scope to the unlinked code cache.
+        Unlinked code is supposed to be scope-free, so let's have the compiler
+        help verify that.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::numVariables):
+        (JSC::EvalExecutable::numberOfFunctionDecls):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecutionImpl):
+        (JSC::prepareFunctionForExecutionImpl):
+        (JSC::installOptimizedCode): Fiddled with executable initialization so
+        that we can always generate a full scope chain before we go to link a
+        code block. We need this because code block linking now depends on the
+        scope chain to link non-local variable resolution opcodes.
+
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::varInjectionWatchpoint):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSNameScope.h:
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::objectAtScope):
+        (JSC::JSScope::depth):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::abstractResolve): Updated to match changes explained above.
+
+        * runtime/JSScope.h:
+        (JSC::makeType):
+        (JSC::needsVarInjectionChecks):
+        (JSC::ResolveOp::ResolveOp):
+        (JSC::ResolveModeAndType::ResolveModeAndType):
+        (JSC::ResolveModeAndType::mode):
+        (JSC::ResolveModeAndType::type):
+        (JSC::ResolveModeAndType::operand): Removed the old variable resolution
+        state machine, since it's unused now. Added logic for performing abstract
+        variable resolution at link time. This is used by codeblock linking.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString): Fixed some pre-existing bugs in
+        'this' value conversion, which I made much more common by removing
+        special cases in bytecode generation.
+
+        These functions need to invoke toThis() because they observe the 'this'
+        value.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::checkObjectCoercible):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString): Fixed some pre-existing bugs in
+        'this' value conversion, which I made much more common by removing
+        special cases in bytecode generation.
+
+        These functions need to invoke toThis() because they observe the 'this'
+        value.
+
+        * runtime/StructureRareData.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::slot): Modified to reduce casting in client code.
+
</ins><span class="cx"> 2013-06-09  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolled back in http://trac.webkit.org/changeset/151342.
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreGNUmakefilelistam"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/GNUmakefile.list.am (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/GNUmakefile.list.am        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/GNUmakefile.list.am        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -144,9 +144,6 @@
</span><span class="cx">         Source/JavaScriptCore/bytecode/PutKind.h \
</span><span class="cx">         Source/JavaScriptCore/bytecode/ReduceWhitespace.cpp \
</span><span class="cx">         Source/JavaScriptCore/bytecode/ReduceWhitespace.h \
</span><del>-        Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp \
-        Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h \
-        Source/JavaScriptCore/bytecode/ResolveOperation.h \
</del><span class="cx">         Source/JavaScriptCore/bytecode/SamplingTool.cpp \
</span><span class="cx">         Source/JavaScriptCore/bytecode/SamplingTool.h \
</span><span class="cx">         Source/JavaScriptCore/bytecode/SpecialPointer.cpp \
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCoregypi"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.gypi (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.gypi        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.gypi        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -143,7 +143,6 @@
</span><span class="cx">             'bytecode/ExpressionRangeInfo.h',
</span><span class="cx">             'bytecode/GetByIdStatus.cpp',
</span><span class="cx">             'bytecode/GetByIdStatus.h',
</span><del>-            'bytecode/GlobalResolveInfo.h',
</del><span class="cx">             'bytecode/HandlerInfo.h',
</span><span class="cx">             'bytecode/Instruction.h',
</span><span class="cx">             'bytecode/JumpTable.cpp',
</span><span class="lines">@@ -167,9 +166,6 @@
</span><span class="cx">             'bytecode/PreciseJumpTargets.cpp',
</span><span class="cx">             'bytecode/ReduceWhitespace.cpp',
</span><span class="cx">             'bytecode/ReduceWhitespace.h',
</span><del>-            'bytecode/ResolveGlobalStatus.cpp',
-            'bytecode/ResolveGlobalStatus.h',
-            'bytecode/ResolveOperation.h',
</del><span class="cx">             'bytecode/SamplingTool.cpp',
</span><span class="cx">             'bytecode/SamplingTool.h',
</span><span class="cx">             'bytecode/SpecialPointer.cpp',
</span><span class="lines">@@ -300,8 +296,6 @@
</span><span class="cx">             'dfg/DFGSpeculativeJIT.cpp',
</span><span class="cx">             'dfg/DFGSpeculativeJIT.h',
</span><span class="cx">             'dfg/DFGStructureAbstractValue.h',
</span><del>-            'dfg/DFGStructureCheckHoistingPhase.cpp',
-            'dfg/DFGStructureCheckHoistingPhase.h',
</del><span class="cx">             'dfg/DFGThunks.cpp',
</span><span class="cx">             'dfg/DFGThunks.h',
</span><span class="cx">             'dfg/DFGValidate.cpp',
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCoreorder"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.order (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.order        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.order        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -532,25 +532,21 @@
</span><span class="cx"> __ZN3JSC17BytecodeGenerator11registerForERKNS_10IdentifierE
</span><span class="cx"> __ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_10IdentifierE
</span><span class="cx"> __ZN3JSC17BytecodeGenerator18findScopedPropertyERKNS_10IdentifierERiRmbRbRPNS_8JSObjectE
</span><del>-__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14expandCapacityEm
</del><span class="cx"> __ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
</span><span class="cx"> __ZN3WTF6VectorIN3JSC10IdentifierELm0EE14expandCapacityEmPKS2_
</span><span class="cx"> __ZN3WTF6VectorIN3JSC10IdentifierELm0EE15reserveCapacityEm
</span><span class="cx"> __ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
</span><span class="cx"> __ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14expandCapacityEm
</span><del>-__ZN3JSC3JIT22emit_op_resolve_globalEPNS_11InstructionEb
</del><span class="cx"> __ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEmPKS2_
</span><span class="cx"> __ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEm
</span><span class="cx"> __ZN3JSC3JIT17emit_op_get_by_idEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT21compileGetByIdHotPathEiiPNS_10IdentifierEj
</span><del>-__ZN3JSC3JIT26emitSlow_op_resolve_globalEPNS_11InstructionERPNS_13SlowCaseEntryE
</del><span class="cx"> __ZN3JSC20MacroAssemblerX86_648storePtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE13TrustedImmPtrENS3_15ImplicitAddressE
</span><span class="cx"> __ZN3JSC11JITStubCall4callEj
</span><span class="cx"> __ZN3WTF6VectorIN3JSC10CallRecordELm0EE15reserveCapacityEm
</span><span class="cx"> __ZN3JSC3JIT21emitSlow_op_get_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
</span><span class="cx"> __ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryEb
</span><span class="cx"> __ZN3JSC11JITStubCall4callEv
</span><del>-_cti_op_resolve_global
</del><span class="cx"> __ZN3JSC15ObjectPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
</span><span class="cx"> __ZN3JSC10Identifier8toUInt32ERKNS_7UStringERb
</span><span class="cx"> __ZN3WTF12AtomicString4findEPKtjj
</span><span class="lines">@@ -796,7 +792,6 @@
</span><span class="cx"> __ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierEi
</span><span class="cx"> __ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="cx"> __ZNK3JSC16JSVariableObject16isVariableObjectEv
</span><del>-__ZN3JSC17BytecodeGenerator16emitGetScopedVarEPNS_10RegisterIDEmiNS_7JSValueE
</del><span class="cx"> __ZN3JSC3JIT22emit_op_get_global_varEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC8JSParser19parseVarDeclarationINS_10ASTBuilderEEENT_9StatementERS3_
</span><span class="cx"> __ZN3WTF6VectorISt4pairIPKN3JSC10IdentifierEjELm0EE15reserveCapacityEm
</span><span class="lines">@@ -940,8 +935,6 @@
</span><span class="cx"> __ZN3WTF6VectorIN3JSC11HandlerInfoELm0EE14expandCapacityEm
</span><span class="cx"> __ZN3JSC17BytecodeGenerator16emitPushNewScopeEPNS_10RegisterIDERKNS_10IdentifierES2_
</span><span class="cx"> __ZN3WTF6VectorIN3JSC18ControlFlowContextELm0EE14expandCapacityEm
</span><del>-__ZN3JSC17BytecodeGenerator21emitResolveBaseForPutEPNS_10RegisterIDERKNS_10IdentifierE
-__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_10IdentifierE
</del><span class="cx"> __ZN3JSC17BytecodeGenerator12emitPopScopeEv
</span><span class="cx"> __ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="cx"> __ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
</span><span class="lines">@@ -951,13 +944,10 @@
</span><span class="cx"> __ZN3JSC3JIT11emit_op_neqEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC12X86Assembler6orl_irEiNS_12X86Registers10RegisterIDE
</span><span class="cx"> __ZN3JSC3JIT13emit_op_jtrueEPNS_11InstructionE
</span><del>-__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
</del><span class="cx"> __ZN3JSC3JIT17emit_op_call_evalEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT13emit_op_catchEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC20MacroAssemblerX86_647loadPtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15ImplicitAddressENS_12X86Registers10RegisterIDE
</span><span class="cx"> __ZN3JSC3JIT22emit_op_push_new_scopeEPNS_11InstructionE
</span><del>-__ZN3JSC3JIT20emit_op_resolve_baseEPNS_11InstructionE
-__ZN3JSC3JIT15emit_op_resolveEPNS_11InstructionE
</del><span class="cx"> __ZN3JSC3JIT17emit_op_pop_scopeEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT10emit_op_eqEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT27emit_op_tear_off_activationEPNS_11InstructionE
</span><span class="lines">@@ -970,7 +960,6 @@
</span><span class="cx"> _cti_op_typeof
</span><span class="cx"> __ZN3JSC20jsTypeStringForValueEPNS_9ExecStateENS_7JSValueE
</span><span class="cx"> _cti_op_eq
</span><del>-_cti_op_resolve_with_base
</del><span class="cx"> __ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
</span><span class="cx"> _cti_op_call_eval
</span><span class="cx"> __ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12JSStackEPNS_8RegisterEii
</span><span class="lines">@@ -987,7 +976,6 @@
</span><span class="cx"> __ZN3WTF7HashMapINS_6RefPtrINS_10StringImplEEEN3JSC12WriteBarrierINS4_14EvalExecutableEEENS_10StringHashENS_10HashTraitsIS3_EENS9_IS7_EEE3setEPS2_RKS7_
</span><span class="cx"> __ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEESt4pairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEENS_18PairFirstExtractorIS9_EENS_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E6expandEv
</span><span class="cx"> __ZN3JSC11Interpreter7executeEPNS_14EvalExecutableEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeE
</span><del>-_cti_op_resolve
</del><span class="cx"> _JSValueMakeBoolean
</span><span class="cx"> __ZN3JSC8JSParser20parseReturnStatementINS_10ASTBuilderEEENT_9StatementERS3_
</span><span class="cx"> __ZN3JSC10ASTBuilder11makeDivNodeEPNS_14ExpressionNodeES2_b
</span><span class="lines">@@ -1126,7 +1114,6 @@
</span><span class="cx"> __ZN3WTFL4multERNS_6BigIntERKS0_
</span><span class="cx"> __ZN3WTF6VectorIjLm16EEaSERKS1_
</span><span class="cx"> __ZN3WTF6String6numberEd
</span><del>-__ZN3JSC17BytecodeGenerator16emitPutScopedVarEmiPNS_10RegisterIDENS_7JSValueE
</del><span class="cx"> __ZN3JSC3JIT22emit_op_put_global_varEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT11emit_op_subEPNS_11InstructionE
</span><span class="cx"> __ZN3JSC3JIT15emitSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
</span><span class="lines">@@ -1190,7 +1177,6 @@
</span><span class="cx"> _cti_op_in
</span><span class="cx"> __ZN3JSC12JSActivation13visitChildrenERNS_9MarkStackE
</span><span class="cx"> __ZNK3JSC12JSActivation14isDynamicScopeERb
</span><del>-__ZN3JSC3JIT22emit_op_get_scoped_varEPNS_11InstructionE
</del><span class="cx"> __ZN3JSC8JSParser19parseBreakStatementINS_10ASTBuilderEEENT_9StatementERS3_
</span><span class="cx"> __ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="cx"> __ZN3JSC9BreakNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="lines">@@ -1208,7 +1194,6 @@
</span><span class="cx"> __ZN3JSC9CodeBlock14visitAggregateERNS_9MarkStackE
</span><span class="cx"> __ZN3JSC13EvalCodeCache14visitAggregateERNS_9MarkStackE
</span><span class="cx"> __ZN3JSC17StructureStubInfo14visitAggregateERNS_9MarkStackE
</span><del>-_cti_op_resolve_base
</del><span class="cx"> __ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="cx"> __ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
</span><span class="cx"> __ZN3JSC17BytecodeGenerator13emitNewObjectEPNS_10RegisterIDE
</span><span class="lines">@@ -1404,8 +1389,6 @@
</span><span class="cx"> __ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateE
</span><span class="cx"> __ZN3JSC12RegExpObject4testEPNS_9ExecStateE
</span><span class="cx"> __ZN3JSC12RegExpObject5matchEPNS_9ExecStateE
</span><del>-__ZN3JSC3JIT20emit_op_resolve_skipEPNS_11InstructionE
-_cti_op_resolve_skip
</del><span class="cx"> __ZN3WTFeqERKNS_12AtomicStringERKNS_6VectorItLm0EEE
</span><span class="cx"> __ZN3WTF11OSAllocator18releaseDecommittedEPvm
</span><span class="cx"> __ZN3WTF12AtomicString16fromUTF8InternalEPKcS2_
</span><span class="lines">@@ -1619,8 +1602,6 @@
</span><span class="cx"> __ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16EE14expandCapacityEm
</span><span class="cx"> __ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
</span><span class="cx"> __ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
</span><del>-__ZN3JSC3JIT30emit_op_resolve_global_dynamicEPNS_11InstructionE
-__ZN3JSC3JIT34emitSlow_op_resolve_global_dynamicEPNS_11InstructionERPNS_13SlowCaseEntryE
</del><span class="cx"> __ZN3WTF6VectorIN3JSC11StringRangeELm16EE14expandCapacityEmPKS2_
</span><span class="cx"> __ZN3WTF6VectorIN3JSC11StringRangeELm16EE15reserveCapacityEm
</span><span class="cx"> __ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEmPKS2_
</span><span class="lines">@@ -2271,7 +2252,6 @@
</span><span class="cx"> __ZN3JSC27StrictModeTypeErrorFunction18callThrowTypeErrorEPNS_9ExecStateE
</span><span class="cx"> __ZN3JSC14throwTypeErrorEPNS_9ExecStateERKNS_7UStringE
</span><span class="cx"> __ZN3JSC9Arguments33createStrictModeCallerIfNecessaryEPNS_9ExecStateE
</span><del>-_cti_op_resolve_base_strict_put
</del><span class="cx"> __ZN3JSC37createErrorForInvalidGlobalAssignmentEPNS_9ExecStateERKNS_7UStringE
</span><span class="cx"> __ZN3JSC19JSStaticScopeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
</span><span class="cx"> __ZN3JSC20StrictEvalActivationC1EPNS_9ExecStateE
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcprojJavaScriptCoreJavaScriptCorevcproj"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1842,10 +1842,6 @@
</span><span class="cx">                                 &gt;
</span><span class="cx">                         &lt;/File&gt;
</span><span class="cx">                         &lt;File
</span><del>-                                RelativePath=&quot;..\..\bytecode\GlobalResolveInfo.h&quot;
-                                &gt;
-                        &lt;/File&gt;
-                        &lt;File
</del><span class="cx">                                 RelativePath=&quot;..\..\bytecode\HandlerInfo.h&quot;
</span><span class="cx">                                 &gt;
</span><span class="cx">                         &lt;/File&gt;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -459,7 +459,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\ExitKind.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\ExpressionRangeInfo.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\GetByIdStatus.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\bytecode\GlobalResolveInfo.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\HandlerInfo.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\Instruction.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\JumpTable.h&quot; /&gt;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -929,9 +929,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\GetByIdStatus.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;bytecode&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\bytecode\GlobalResolveInfo.h&quot;&gt;
-      &lt;Filter&gt;bytecode&lt;/Filter&gt;
-    &lt;/ClInclude&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\HandlerInfo.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;bytecode&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -191,7 +191,6 @@
</span><span class="cx">                 0F620178143FCD440068B77C /* DFGAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016E143FCD2F0068B77C /* DFGAbstractState.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F620179143FCD480068B77C /* DFGAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */; };
</span><span class="cx">                 0F63943F15C75F19006A597C /* DFGTypeCheckHoistingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63943D15C75F14006A597C /* DFGTypeCheckHoistingPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                0F63944015C75F1D006A597C /* DFGTypeCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */; };
</del><span class="cx">                 0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63945115D07051006A597C /* ArrayProfile.cpp */; };
</span><span class="cx">                 0F63945515D07057006A597C /* ArrayProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63945215D07051006A597C /* ArrayProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -401,8 +400,6 @@
</span><span class="cx">                 0FF4275715914A20004CB9FF /* LinkBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4275615914A20004CB9FF /* LinkBuffer.cpp */; };
</span><span class="cx">                 0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */; };
</span><span class="cx">                 0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */; };
-                0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 0FF60AC216740F8300029779 /* ReduceWhitespace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF60AC016740F8100029779 /* ReduceWhitespace.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0FF60AC316740F8800029779 /* ReduceWhitespace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */; };
</span><span class="cx">                 0FF7168C15A3B235008F5DAA /* PropertyOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7168A15A3B231008F5DAA /* PropertyOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -569,6 +566,7 @@
</span><span class="cx">                 148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F0B3A909BB4DC00068FCE3 /* Parser.cpp */; };
</span><span class="cx">                 149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */; };
</span><span class="cx">                 1497209114EB831500FEB1B7 /* PassWeak.h in Headers */ = {isa = PBXBuildFile; fileRef = 1497209014EB831500FEB1B7 /* PassWeak.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                1497C47D176197320095DED4 /* DFGTypeCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */; };
</ins><span class="cx">                 14A1563210966365006FA260 /* DateInstanceCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A1563010966365006FA260 /* DateInstanceCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14A23D750F4E1ABB0023CDAD /* JITStubs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */; };
</span><span class="cx">                 14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14ABDF5E0A437FEF00ECCA01 /* JSCallbackObject.cpp */; };
</span><span class="lines">@@ -782,7 +780,6 @@
</span><span class="cx">                 A77F1825164192C700640A47 /* ParserModes.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F18241641925400640A47 /* ParserModes.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A784A26411D16622005776AC /* SyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                A7AFC17915F7EFE30048F57B /* ResolveOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = A7AFC17715F7EFE30048F57B /* ResolveOperation.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
</span><span class="cx">                 A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -1411,8 +1408,6 @@
</span><span class="cx">                 0FF4275615914A20004CB9FF /* LinkBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkBuffer.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDisassembler.cpp; path = dfg/DFGDisassembler.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDisassembler.h; path = dfg/DFGDisassembler.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResolveGlobalStatus.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResolveGlobalStatus.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReduceWhitespace.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FF60AC016740F8100029779 /* ReduceWhitespace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReduceWhitespace.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FF7168A15A3B231008F5DAA /* PropertyOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyOffset.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -1802,7 +1797,6 @@
</span><span class="cx">                 A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRefPrivate.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ASTBuilder.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SyntaxChecker.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                A7AFC17715F7EFE30048F57B /* ResolveOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResolveOperation.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExportMacros.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -3211,9 +3205,6 @@
</span><span class="cx">                                 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
</span><span class="cx">                                 0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */,
</span><span class="cx">                                 0FF60AC016740F8100029779 /* ReduceWhitespace.h */,
</span><del>-                                0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */,
-                                0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */,
-                                A7AFC17715F7EFE30048F57B /* ResolveOperation.h */,
</del><span class="cx">                                 1429D8830ED21C3D00B89619 /* SamplingTool.cpp */,
</span><span class="cx">                                 1429D8840ED21C3D00B89619 /* SamplingTool.h */,
</span><span class="cx">                                 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */,
</span><span class="lines">@@ -3684,8 +3675,6 @@
</span><span class="cx">                                 969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */,
</span><span class="cx">                                 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */,
</span><span class="cx">                                 86D3B3C410159D7F002865E7 /* RepatchBuffer.h in Headers */,
</span><del>-                                0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */,
-                                A7AFC17915F7EFE30048F57B /* ResolveOperation.h in Headers */,
</del><span class="cx">                                 869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */,
</span><span class="cx">                                 C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
</span><span class="cx">                                 1429D8860ED21C3D00B89619 /* SamplingTool.h in Headers */,
</span><span class="lines">@@ -4222,6 +4211,7 @@
</span><span class="cx">                                 0FC097A1146B28CA00CF2442 /* DFGThunks.cpp in Sources */,
</span><span class="cx">                                 0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources */,
</span><span class="cx">                                 0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */,
</span><ins>+                                1497C47D176197320095DED4 /* DFGTypeCheckHoistingPhase.cpp in Sources */,
</ins><span class="cx">                                 0FDDBFB51666EED800C55FEF /* DFGVariableAccessDataDump.cpp in Sources */,
</span><span class="cx">                                 0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */,
</span><span class="cx">                                 0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */,
</span><span class="lines">@@ -4417,7 +4407,6 @@
</span><span class="cx">                                 8642C512151C083D0046D4EF /* RegExpMatchesArray.cpp in Sources */,
</span><span class="cx">                                 14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */,
</span><span class="cx">                                 14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */,
</span><del>-                                0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */,
</del><span class="cx">                                 0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */,
</span><span class="cx">                                 1429D8850ED21C3D00B89619 /* SamplingTool.cpp in Sources */,
</span><span class="cx">                                 C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */,
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreTargetpri"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/Target.pri (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/Target.pri        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/Target.pri        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -74,7 +74,6 @@
</span><span class="cx">     bytecode/PreciseJumpTargets.cpp \
</span><span class="cx">     bytecode/PutByIdStatus.cpp \
</span><span class="cx">     bytecode/ReduceWhitespace.cpp \
</span><del>-    bytecode/ResolveGlobalStatus.cpp \
</del><span class="cx">     bytecode/SamplingTool.cpp \
</span><span class="cx">     bytecode/SpecialPointer.cpp \
</span><span class="cx">     bytecode/SpeculatedType.cpp \
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -166,11 +166,6 @@
</span><span class="cx">     return toCString(regexpToSourceString(regexp), &quot;(@re&quot;, re, &quot;)&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static CString pointerToSourceString(void* p)
-{
-    return toCString(RawPointer(p));
-}
-
</del><span class="cx"> NEVER_INLINE static const char* debugHookName(int debugHookID)
</span><span class="cx"> {
</span><span class="cx">     switch (static_cast&lt;DebugHookID&gt;(debugHookID)) {
</span><span class="lines">@@ -459,50 +454,6 @@
</span><span class="cx">     it += 5;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::printStructure(PrintStream&amp; out, const char* name, const Instruction* vPC, int operand)
-{
-    unsigned instructionOffset = vPC - instructions().begin();
-    out.printf(&quot;  [%4d] %s: %s\n&quot;, instructionOffset, name, pointerToSourceString(vPC[operand].u.structure).data());
-}
-
-void CodeBlock::printStructures(PrintStream&amp; out, const Instruction* vPC)
-{
-    Interpreter* interpreter = m_vm-&gt;interpreter;
-    unsigned instructionOffset = vPC - instructions().begin();
-
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id)) {
-        printStructure(out, &quot;get_by_id&quot;, vPC, 4);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_self)) {
-        printStructure(out, &quot;get_by_id_self&quot;, vPC, 4);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_proto)) {
-        out.printf(&quot;  [%4d] %s: %s, %s\n&quot;, instructionOffset, &quot;get_by_id_proto&quot;, pointerToSourceString(vPC[4].u.structure).data(), pointerToSourceString(vPC[5].u.structure).data());
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_transition)) {
-        out.printf(&quot;  [%4d] %s: %s, %s, %s\n&quot;, instructionOffset, &quot;put_by_id_transition&quot;, pointerToSourceString(vPC[4].u.structure).data(), pointerToSourceString(vPC[5].u.structure).data(), pointerToSourceString(vPC[6].u.structureChain).data());
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_chain)) {
-        out.printf(&quot;  [%4d] %s: %s, %s\n&quot;, instructionOffset, &quot;get_by_id_chain&quot;, pointerToSourceString(vPC[4].u.structure).data(), pointerToSourceString(vPC[5].u.structureChain).data());
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id)) {
-        printStructure(out, &quot;put_by_id&quot;, vPC, 4);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_replace)) {
-        printStructure(out, &quot;put_by_id_replace&quot;, vPC, 4);
-        return;
-    }
-
-    // These m_instructions doesn't ref Structures.
-    ASSERT(vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_generic) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_call) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_call_eval) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_construct));
-}
-
</del><span class="cx"> void CodeBlock::dumpBytecode(PrintStream&amp; out)
</span><span class="cx"> {
</span><span class="cx">     // We only use the ExecState* for things that don't actually lead to JS execution,
</span><span class="lines">@@ -717,7 +668,7 @@
</span><span class="cx">         }
</span><span class="cx">         case op_get_callee: {
</span><span class="cx">             int r0 = (++it)-&gt;u.operand;
</span><del>-            out.printf(&quot;[%4d] op_get_callee %s\n&quot;, location, registerName(r0).data());
</del><ins>+            out.printf(&quot;[%4d] get_callee %s\n&quot;, location, registerName(r0).data());
</ins><span class="cx">             ++it;
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="lines">@@ -940,43 +891,6 @@
</span><span class="cx">             printBinaryOp(out, exec, location, it, &quot;in&quot;);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        case op_put_to_base_variable:
-        case op_put_to_base: {
-            int base = (++it)-&gt;u.operand;
-            int id0 = (++it)-&gt;u.operand;
-            int value = (++it)-&gt;u.operand;
-            int resolveInfo = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] put_to_base\t %s, %s, %s, %d&quot;, location, registerName(base).data(), idName(id0, m_identifiers[id0]).data(), registerName(value).data(), resolveInfo);
-            break;
-        }
-        case op_resolve:
-        case op_resolve_global_property:
-        case op_resolve_global_var:
-        case op_resolve_scoped_var:
-        case op_resolve_scoped_var_on_top_scope:
-        case op_resolve_scoped_var_with_top_scope_check: {
-            int r0 = (++it)-&gt;u.operand;
-            int id0 = (++it)-&gt;u.operand;
-            int resolveInfo = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] resolve\t\t %s, %s, %d&quot;, location, registerName(r0).data(), idName(id0, m_identifiers[id0]).data(), resolveInfo);
-            dumpValueProfiling(out, it, hasPrintedProfiling);
-            break;
-        }
-        case op_get_scoped_var: {
-            int r0 = (++it)-&gt;u.operand;
-            int index = (++it)-&gt;u.operand;
-            int skipLevels = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] get_scoped_var\t %s, %d, %d&quot;, location, registerName(r0).data(), index, skipLevels);
-            dumpValueProfiling(out, it, hasPrintedProfiling);
-            break;
-        }
-        case op_put_scoped_var: {
-            int index = (++it)-&gt;u.operand;
-            int skipLevels = (++it)-&gt;u.operand;
-            int r0 = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] put_scoped_var\t %d, %d, %s&quot;, location, index, skipLevels, registerName(r0).data());
-            break;
-        }
</del><span class="cx">         case op_init_global_const_nop: {
</span><span class="cx">             out.printf(&quot;[%4d] init_global_const_nop\t&quot;, location);
</span><span class="cx">             it++;
</span><span class="lines">@@ -993,53 +907,12 @@
</span><span class="cx">             it++;
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        case op_init_global_const_check: {
-            WriteBarrier&lt;Unknown&gt;* registerPointer = (++it)-&gt;u.registerPointer;
-            int r0 = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] init_global_const_check\t g%d(%p), %s&quot;, location, m_globalObject-&gt;findRegisterIndex(registerPointer), registerPointer, registerName(r0).data());
-            it++;
-            it++;
-            break;
-        }
-        case op_resolve_base_to_global:
-        case op_resolve_base_to_global_dynamic:
-        case op_resolve_base_to_scope:
-        case op_resolve_base_to_scope_with_top_scope_check:
-        case op_resolve_base: {
-            int r0 = (++it)-&gt;u.operand;
-            int id0 = (++it)-&gt;u.operand;
-            int isStrict = (++it)-&gt;u.operand;
-            int resolveInfo = (++it)-&gt;u.operand;
-            int putToBaseInfo = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] resolve_base%s\t %s, %s, %d, %d&quot;, location, isStrict ? &quot;_strict&quot; : &quot;&quot;, registerName(r0).data(), idName(id0, m_identifiers[id0]).data(), resolveInfo, putToBaseInfo);
-            dumpValueProfiling(out, it, hasPrintedProfiling);
-            break;
-        }
</del><span class="cx">         case op_ensure_property_exists: {
</span><span class="cx">             int r0 = (++it)-&gt;u.operand;
</span><span class="cx">             int id0 = (++it)-&gt;u.operand;
</span><span class="cx">             out.printf(&quot;[%4d] ensure_property_exists\t %s, %s&quot;, location, registerName(r0).data(), idName(id0, m_identifiers[id0]).data());
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        case op_resolve_with_base: {
-            int r0 = (++it)-&gt;u.operand;
-            int r1 = (++it)-&gt;u.operand;
-            int id0 = (++it)-&gt;u.operand;
-            int resolveInfo = (++it)-&gt;u.operand;
-            int putToBaseInfo = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] resolve_with_base %s, %s, %s, %d, %d&quot;, location, registerName(r0).data(), registerName(r1).data(), idName(id0, m_identifiers[id0]).data(), resolveInfo, putToBaseInfo);
-            dumpValueProfiling(out, it, hasPrintedProfiling);
-            break;
-        }
-        case op_resolve_with_this: {
-            int r0 = (++it)-&gt;u.operand;
-            int r1 = (++it)-&gt;u.operand;
-            int id0 = (++it)-&gt;u.operand;
-            int resolveInfo = (++it)-&gt;u.operand;
-            out.printf(&quot;[%4d] resolve_with_this %s, %s, %s, %d&quot;, location, registerName(r0).data(), registerName(r1).data(), idName(id0, m_identifiers[id0]).data(), resolveInfo);
-            dumpValueProfiling(out, it, hasPrintedProfiling);
-            break;
-        }
</del><span class="cx">         case op_get_by_id:
</span><span class="cx">         case op_get_by_id_out_of_line:
</span><span class="cx">         case op_get_by_id_self:
</span><span class="lines">@@ -1421,6 +1294,35 @@
</span><span class="cx">             out.printf(&quot;[%4d] end\t\t %s&quot;, location, registerName(r0).data());
</span><span class="cx">             break;
</span><span class="cx">         }
</span><ins>+        case op_resolve_scope: {
+            int r0 = (++it)-&gt;u.operand;
+            int id0 = (++it)-&gt;u.operand;
+            ++it; // ResolveType
+            ++it; // depth
+            out.printf(&quot;[%4d] resolve_scope\t %s, %s&quot;, location, registerName(r0).data(), idName(id0, m_identifiers[id0]).data());
+            break;
+        }
+        case op_get_from_scope: {
+            int r0 = (++it)-&gt;u.operand;
+            int r1 = (++it)-&gt;u.operand;
+            int id0 = (++it)-&gt;u.operand;
+            int resolveModeAndType = (++it)-&gt;u.operand;
+            ++it; // Structure
+            ++it; // Operand
+            ++it; // Skip value profile.
+            out.printf(&quot;[%4d] get_from_scope\t %s, %s, %s, %d&quot;, location, registerName(r0).data(), registerName(r1).data(), idName(id0, m_identifiers[id0]).data(), resolveModeAndType);
+            break;
+        }
+        case op_put_to_scope: {
+            int r0 = (++it)-&gt;u.operand;
+            int id0 = (++it)-&gt;u.operand;
+            int r1 = (++it)-&gt;u.operand;
+            int resolveModeAndType = (++it)-&gt;u.operand;
+            ++it; // Structure
+            ++it; // Operand
+            out.printf(&quot;[%4d] put_to_scope\t %s, %s, %s, %d&quot;, location, registerName(r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(r1).data(), resolveModeAndType);
+            break;
+        }
</ins><span class="cx"> #if ENABLE(LLINT_C_LOOP)
</span><span class="cx">         default:
</span><span class="cx">             RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -1459,7 +1361,6 @@
</span><span class="cx"> 
</span><span class="cx"> #define FOR_EACH_MEMBER_VECTOR(macro) \
</span><span class="cx">     macro(instructions) \
</span><del>-    macro(globalResolveInfos) \
</del><span class="cx">     macro(structureStubInfos) \
</span><span class="cx">     macro(callLinkInfos) \
</span><span class="cx">     macro(linkedCallerList) \
</span><span class="lines">@@ -1603,8 +1504,6 @@
</span><span class="cx">     , m_osrExitCounter(0)
</span><span class="cx">     , m_optimizationDelayCounter(0)
</span><span class="cx">     , m_reoptimizationRetryCounter(0)
</span><del>-    , m_resolveOperations(other.m_resolveOperations)
-    , m_putToBaseOperations(other.m_putToBaseOperations)
</del><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
</span><span class="cx"> #endif
</span><span class="lines">@@ -1624,21 +1523,21 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, unsigned baseScopeDepth, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
-    : m_globalObject(globalObject-&gt;vm(), ownerExecutable, globalObject)
</del><ins>+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
+    : m_globalObject(scope-&gt;globalObject()-&gt;vm(), ownerExecutable, scope-&gt;globalObject())
</ins><span class="cx">     , m_heap(&amp;m_globalObject-&gt;vm().heap)
</span><span class="cx">     , m_numCalleeRegisters(unlinkedCodeBlock-&gt;m_numCalleeRegisters)
</span><span class="cx">     , m_numVars(unlinkedCodeBlock-&gt;m_numVars)
</span><span class="cx">     , m_isConstructor(unlinkedCodeBlock-&gt;isConstructor())
</span><span class="cx">     , m_shouldAlwaysBeInlined(true)
</span><del>-    , m_unlinkedCode(globalObject-&gt;vm(), ownerExecutable, unlinkedCodeBlock)
-    , m_ownerExecutable(globalObject-&gt;vm(), ownerExecutable, ownerExecutable)
</del><ins>+    , m_unlinkedCode(m_globalObject-&gt;vm(), ownerExecutable, unlinkedCodeBlock)
+    , m_ownerExecutable(m_globalObject-&gt;vm(), ownerExecutable, ownerExecutable)
</ins><span class="cx">     , m_vm(unlinkedCodeBlock-&gt;vm())
</span><span class="cx">     , m_thisRegister(unlinkedCodeBlock-&gt;thisRegister())
</span><span class="cx">     , m_argumentsRegister(unlinkedCodeBlock-&gt;argumentsRegister())
</span><span class="cx">     , m_activationRegister(unlinkedCodeBlock-&gt;activationRegister())
</span><span class="cx">     , m_isStrictMode(unlinkedCodeBlock-&gt;isStrictMode())
</span><del>-    , m_needsActivation(unlinkedCodeBlock-&gt;needsFullScopeChain())
</del><ins>+    , m_needsActivation(unlinkedCodeBlock-&gt;needsFullScopeChain() &amp;&amp; unlinkedCodeBlock-&gt;codeType() == FunctionCode)
</ins><span class="cx">     , m_source(sourceProvider)
</span><span class="cx">     , m_sourceOffset(sourceOffset)
</span><span class="cx">     , m_codeType(unlinkedCodeBlock-&gt;codeType())
</span><span class="lines">@@ -1657,7 +1556,7 @@
</span><span class="cx">     setIdentifiers(unlinkedCodeBlock-&gt;identifiers());
</span><span class="cx">     setConstantRegisters(unlinkedCodeBlock-&gt;constantRegisters());
</span><span class="cx">     if (unlinkedCodeBlock-&gt;usesGlobalObject())
</span><del>-        m_constantRegisters[unlinkedCodeBlock-&gt;globalObjectRegister()].set(*m_vm, ownerExecutable, globalObject);
</del><ins>+        m_constantRegisters[unlinkedCodeBlock-&gt;globalObjectRegister()].set(*m_vm, ownerExecutable, m_globalObject.get());
</ins><span class="cx">     m_functionDecls.grow(unlinkedCodeBlock-&gt;numberOfFunctionDecls());
</span><span class="cx">     for (size_t count = unlinkedCodeBlock-&gt;numberOfFunctionDecls(), i = 0; i &lt; count; ++i) {
</span><span class="cx">         UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock-&gt;functionDecl(i);
</span><span class="lines">@@ -1693,12 +1592,13 @@
</span><span class="cx">         }
</span><span class="cx">         if (size_t count = unlinkedCodeBlock-&gt;numberOfExceptionHandlers()) {
</span><span class="cx">             m_rareData-&gt;m_exceptionHandlers.grow(count);
</span><ins>+            size_t nonLocalScopeDepth = scope-&gt;depth();
</ins><span class="cx">             for (size_t i = 0; i &lt; count; i++) {
</span><span class="cx">                 const UnlinkedHandlerInfo&amp; handler = unlinkedCodeBlock-&gt;exceptionHandler(i);
</span><span class="cx">                 m_rareData-&gt;m_exceptionHandlers[i].start = handler.start;
</span><span class="cx">                 m_rareData-&gt;m_exceptionHandlers[i].end = handler.end;
</span><span class="cx">                 m_rareData-&gt;m_exceptionHandlers[i].target = handler.target;
</span><del>-                m_rareData-&gt;m_exceptionHandlers[i].scopeDepth = handler.scopeDepth + baseScopeDepth;
</del><ins>+                m_rareData-&gt;m_exceptionHandlers[i].scopeDepth = nonLocalScopeDepth + handler.scopeDepth;
</ins><span class="cx"> #if ENABLE(JIT) &amp;&amp; ENABLE(LLINT)
</span><span class="cx">                 m_rareData-&gt;m_exceptionHandlers[i].nativeCode = CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(llint_op_catch)));
</span><span class="cx"> #endif
</span><span class="lines">@@ -1754,13 +1654,6 @@
</span><span class="cx"> #endif
</span><span class="cx">     if (size_t size = unlinkedCodeBlock-&gt;numberOfObjectAllocationProfiles())
</span><span class="cx">         m_objectAllocationProfiles.grow(size);
</span><del>-    if (size_t size = unlinkedCodeBlock-&gt;numberOfResolveOperations())
-        m_resolveOperations.grow(size);
-    if (size_t putToBaseCount = unlinkedCodeBlock-&gt;numberOfPutToBaseOperations()) {
-        m_putToBaseOperations.reserveInitialCapacity(putToBaseCount);
-        for (size_t i = 0; i &lt; putToBaseCount; ++i)
-            m_putToBaseOperations.uncheckedAppend(PutToBaseOperation(isStrictMode()));
-    }
</del><span class="cx"> 
</span><span class="cx">     // Copy and translate the UnlinkedInstructions
</span><span class="cx">     size_t instructionCount = unlinkedCodeBlock-&gt;instructions().size();
</span><span class="lines">@@ -1809,59 +1702,6 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> #endif
</span><del>-        case op_resolve_base:
-        case op_resolve_base_to_global:
-        case op_resolve_base_to_global_dynamic:
-        case op_resolve_base_to_scope:
-        case op_resolve_base_to_scope_with_top_scope_check: {
-            instructions[i + 4].u.resolveOperations = &amp;m_resolveOperations[pc[i + 4].u.operand];
-            instructions[i + 5].u.putToBaseOperation = &amp;m_putToBaseOperations[pc[i + 5].u.operand];
-#if ENABLE(DFG_JIT)
-            ValueProfile* profile = &amp;m_valueProfiles[pc[i + opLength - 1].u.operand];
-            ASSERT(profile-&gt;m_bytecodeOffset == -1);
-            profile-&gt;m_bytecodeOffset = i;
-            ASSERT((opLength - 1) &gt; 5);
-            instructions[i + opLength - 1] = profile;
-#endif
-            break;
-        }
-        case op_resolve_global_property:
-        case op_resolve_global_var:
-        case op_resolve_scoped_var:
-        case op_resolve_scoped_var_on_top_scope:
-        case op_resolve_scoped_var_with_top_scope_check: {
-            instructions[i + 3].u.resolveOperations = &amp;m_resolveOperations[pc[i + 3].u.operand];
-            break;
-        }
-        case op_put_to_base:
-        case op_put_to_base_variable: {
-            instructions[i + 4].u.putToBaseOperation = &amp;m_putToBaseOperations[pc[i + 4].u.operand];
-            break;
-        }
-        case op_resolve: {
-#if ENABLE(DFG_JIT)
-            ValueProfile* profile = &amp;m_valueProfiles[pc[i + opLength - 1].u.operand];
-            ASSERT(profile-&gt;m_bytecodeOffset == -1);
-            profile-&gt;m_bytecodeOffset = i;
-            ASSERT((opLength - 1) &gt; 3);
-            instructions[i + opLength - 1] = profile;
-#endif
-            instructions[i + 3].u.resolveOperations = &amp;m_resolveOperations[pc[i + 3].u.operand];
-            break;
-        }
-        case op_resolve_with_base:
-        case op_resolve_with_this: {
-            instructions[i + 4].u.resolveOperations = &amp;m_resolveOperations[pc[i + 4].u.operand];
-            if (pc[i].u.opcode != op_resolve_with_this)
-                instructions[i + 5].u.putToBaseOperation = &amp;m_putToBaseOperations[pc[i + 5].u.operand];
-#if ENABLE(DFG_JIT)
-            ValueProfile* profile = &amp;m_valueProfiles[pc[i + opLength - 1].u.operand];
-            ASSERT(profile-&gt;m_bytecodeOffset == -1);
-            profile-&gt;m_bytecodeOffset = i;
-            instructions[i + opLength - 1] = profile;
-#endif
-            break;
-        }
</del><span class="cx">         case op_new_object: {
</span><span class="cx">             int objectAllocationProfileIndex = pc[i + opLength - 1].u.operand;
</span><span class="cx">             ObjectAllocationProfile* objectAllocationProfile = &amp;m_objectAllocationProfiles[objectAllocationProfileIndex];
</span><span class="lines">@@ -1873,16 +1713,6 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_get_scoped_var: {
-#if ENABLE(DFG_JIT)
-            ValueProfile* profile = &amp;m_valueProfiles[pc[i + opLength - 1].u.operand];
-            ASSERT(profile-&gt;m_bytecodeOffset == -1);
-            profile-&gt;m_bytecodeOffset = i;
-            instructions[i + opLength - 1] = profile;
-#endif
-            break;
-        }
-
</del><span class="cx">         case op_call:
</span><span class="cx">         case op_call_eval: {
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="lines">@@ -1929,22 +1759,61 @@
</span><span class="cx">         case op_init_global_const_nop: {
</span><span class="cx">             ASSERT(codeType() == GlobalCode);
</span><span class="cx">             Identifier ident = identifier(pc[i + 4].u.operand);
</span><del>-            SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(ident.impl());
</del><ins>+            SymbolTableEntry entry = m_globalObject-&gt;symbolTable()-&gt;get(ident.impl());
</ins><span class="cx">             if (entry.isNull())
</span><span class="cx">                 break;
</span><span class="cx"> 
</span><del>-            if (entry.couldBeWatched()) {
-                instructions[i + 0] = vm()-&gt;interpreter-&gt;getOpcode(op_init_global_const_check);
-                instructions[i + 1] = &amp;globalObject-&gt;registerAt(entry.getIndex());
-                instructions[i + 3] = entry.addressOfIsWatched();
-                break;
-            }
</del><ins>+            // It's likely that we'll write to this var, so notify now and avoid the overhead of doing so at runtime.
+            entry.notifyWrite();
</ins><span class="cx"> 
</span><span class="cx">             instructions[i + 0] = vm()-&gt;interpreter-&gt;getOpcode(op_init_global_const);
</span><del>-            instructions[i + 1] = &amp;globalObject-&gt;registerAt(entry.getIndex());
</del><ins>+            instructions[i + 1] = &amp;m_globalObject-&gt;registerAt(entry.getIndex());
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        case op_resolve_scope: {
+            Identifier&amp; ident = identifier(pc[i + 2].u.operand);
+            ResolveType type = static_cast&lt;ResolveType&gt;(pc[i + 3].u.operand);
+
+            ResolveOp op = JSScope::abstractResolve(m_globalObject-&gt;globalExec(), scope, ident, Get, type);
+            instructions[i + 3].u.operand = op.type;
+            instructions[i + 4].u.operand = op.depth;
+            break;
+        }
+
+        case op_get_from_scope: {
+#if ENABLE(VALUE_PROFILER)
+            ValueProfile* profile = &amp;m_valueProfiles[pc[i + opLength - 1].u.operand];
+            ASSERT(profile-&gt;m_bytecodeOffset == -1);
+            profile-&gt;m_bytecodeOffset = i;
+            instructions[i + opLength - 1] = profile;
+#endif
+
+            // get_from_scope dst, scope, id, ResolveModeAndType, Structure, Operand
+            Identifier&amp; ident = identifier(pc[i + 3].u.operand);
+            ResolveModeAndType modeAndType = ResolveModeAndType(pc[i + 4].u.operand);
+            ResolveOp op = JSScope::abstractResolve(m_globalObject-&gt;globalExec(), scope, ident, Get, modeAndType.type());
+
+            instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
+            if (op.structure)
+                instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
+            instructions[i + 6].u.pointer = reinterpret_cast&lt;void*&gt;(op.operand);
+            break;
+        }
+
+        case op_put_to_scope: {
+            // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
+            Identifier&amp; ident = identifier(pc[i + 2].u.operand);
+            ResolveModeAndType modeAndType = ResolveModeAndType(pc[i + 4].u.operand);
+            ResolveOp op = JSScope::abstractResolve(m_globalObject-&gt;globalExec(), scope, ident, Put, modeAndType.type());
+
+            instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
+            if (op.structure)
+                instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
+            instructions[i + 6].u.pointer = reinterpret_cast&lt;void*&gt;(op.operand);
+            break;
+        }
+
</ins><span class="cx">         case op_debug: {
</span><span class="cx">             size_t charPosition = pc[i + 4].u.operand;
</span><span class="cx">             size_t actualCharPosition = charPosition + m_sourceOffset;
</span><span class="lines">@@ -2022,50 +1891,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::visitStructures(SlotVisitor&amp; visitor, Instruction* vPC)
-{
-    Interpreter* interpreter = m_vm-&gt;interpreter;
-
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id) &amp;&amp; vPC[4].u.structure) {
-        visitor.append(&amp;vPC[4].u.structure);
-        return;
-    }
-
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_custom_self)) {
-        visitor.append(&amp;vPC[4].u.structure);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_custom_proto)) {
-        visitor.append(&amp;vPC[4].u.structure);
-        visitor.append(&amp;vPC[5].u.structure);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_custom_chain)) {
-        visitor.append(&amp;vPC[4].u.structure);
-        if (vPC[5].u.structureChain)
-            visitor.append(&amp;vPC[5].u.structureChain);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_transition)) {
-        visitor.append(&amp;vPC[4].u.structure);
-        visitor.append(&amp;vPC[5].u.structure);
-        if (vPC[6].u.structureChain)
-            visitor.append(&amp;vPC[6].u.structureChain);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id) &amp;&amp; vPC[4].u.structure) {
-        visitor.append(&amp;vPC[4].u.structure);
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_replace)) {
-        visitor.append(&amp;vPC[4].u.structure);
-        return;
-    }
-
-    // These instructions don't ref their Structures.
-    ASSERT(vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_put_by_id_generic) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_array_length) || vPC[0].u.opcode == interpreter-&gt;getOpcode(op_get_string_length));
-}
-
</del><span class="cx"> void EvalCodeCache::visitAggregate(SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><span class="cx">     EvalCacheMap::iterator end = m_cacheMap.end();
</span><span class="lines">@@ -2334,6 +2159,16 @@
</span><span class="cx">                 break;
</span><span class="cx">             case op_get_array_length:
</span><span class="cx">                 break;
</span><ins>+            case op_get_from_scope:
+            case op_put_to_scope: {
+                WriteBarrierBase&lt;Structure&gt;&amp; structure = curInstruction[5].u.structure;
+                if (!structure || Heap::isMarked(structure.get()))
+                    break;
+                if (Options::verboseOSR())
+                    dataLogF(&quot;Clearing LLInt scope access with structure %p.\n&quot;, structure.get());
+                structure.clear();
+                break;
+            }
</ins><span class="cx">             default:
</span><span class="cx">                 RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">             }
</span><span class="lines">@@ -2382,28 +2217,6 @@
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><del>-    for (size_t size = m_putToBaseOperations.size(), i = 0; i &lt; size; ++i) {
-        if (m_putToBaseOperations[i].m_structure &amp;&amp; !Heap::isMarked(m_putToBaseOperations[i].m_structure.get())) {
-            if (Options::verboseOSR())
-                dataLog(&quot;Clearing putToBase info in &quot;, *this, &quot;\n&quot;);
-            m_putToBaseOperations[i].m_structure.clear();
-        }
-    }
-    for (size_t size = m_resolveOperations.size(), i = 0; i &lt; size; ++i) {
-        if (m_resolveOperations[i].isEmpty())
-            continue;
-#ifndef NDEBUG
-        for (size_t insnSize = m_resolveOperations[i].size() - 1, k = 0; k &lt; insnSize; ++k)
-            ASSERT(!m_resolveOperations[i][k].m_structure);
-#endif
-        m_resolveOperations[i].last().m_structure.clear();
-        if (m_resolveOperations[i].last().m_structure &amp;&amp; !Heap::isMarked(m_resolveOperations[i].last().m_structure.get())) {
-            if (Options::verboseOSR())
-                dataLog(&quot;Clearing resolve info in &quot;, *this, &quot;\n&quot;);
-            m_resolveOperations[i].last().m_structure.clear();
-        }
-    }
-
</del><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     // Handle inline caches.
</span><span class="cx">     if (!!jitCode()) {
</span><span class="lines">@@ -2996,16 +2809,17 @@
</span><span class="cx">     
</span><span class="cx">     if (!m_shouldAlwaysBeInlined)
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
+#if ENABLE(DFG_JIT)
</ins><span class="cx">     if (!hasBaselineJITProfiling())
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
</ins><span class="cx">     if (!DFG::mightInlineFunction(this))
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
</ins><span class="cx">     if (!canInline(m_capabilityLevelState))
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
</ins><span class="cx">     if (callerCodeBlock-&gt;jitType() == JITCode::InterpreterThunk) {
</span><span class="cx">         // If the caller is still in the interpreter, then we can't expect inlining to
</span><span class="cx">         // happen anytime soon. Assume it's profitable to optimize it separately. This
</span><span class="lines">@@ -3049,8 +2863,10 @@
</span><span class="cx">         dataLog(&quot;    Marking SABI because the caller is not a DFG candidate.\n&quot;);
</span><span class="cx">     
</span><span class="cx">     m_shouldAlwaysBeInlined = false;
</span><ins>+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#if ENABLE(DFG_JIT)
</ins><span class="cx"> unsigned CodeBlock::reoptimizationRetryCounter() const
</span><span class="cx"> {
</span><span class="cx">     ASSERT(m_reoptimizationRetryCounter &lt;= Options::reoptimizationRetryCounterMax());
</span><span class="lines">@@ -3190,6 +3006,7 @@
</span><span class="cx">         optimizationThresholdScalingFactor() *
</span><span class="cx">         (1 &lt;&lt; reoptimizationRetryCounter()));
</span><span class="cx"> }
</span><ins>+#endif
</ins><span class="cx"> 
</span><span class="cx"> bool CodeBlock::checkIfOptimizationThresholdReached()
</span><span class="cx"> {
</span><span class="lines">@@ -3222,21 +3039,27 @@
</span><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR())
</span><span class="cx">         dataLog(*this, &quot;: Optimizing after warm-up.\n&quot;);
</span><ins>+#if ENABLE(DFG_JIT)
</ins><span class="cx">     m_jitExecuteCounter.setNewThreshold(counterValueForOptimizeAfterWarmUp(), this);
</span><ins>+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlock::optimizeAfterLongWarmUp()
</span><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR())
</span><span class="cx">         dataLog(*this, &quot;: Optimizing after long warm-up.\n&quot;);
</span><ins>+#if ENABLE(DFG_JIT)
</ins><span class="cx">     m_jitExecuteCounter.setNewThreshold(counterValueForOptimizeAfterLongWarmUp(), this);
</span><ins>+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlock::optimizeSoon()
</span><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR())
</span><span class="cx">         dataLog(*this, &quot;: Optimizing soon.\n&quot;);
</span><ins>+#if ENABLE(DFG_JIT)
</ins><span class="cx">     m_jitExecuteCounter.setNewThreshold(counterValueForOptimizeSoon(), this);
</span><ins>+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlock::forceOptimizationSlowPathConcurrently()
</span><span class="lines">@@ -3246,6 +3069,7 @@
</span><span class="cx">     m_jitExecuteCounter.forceSlowPathConcurrently();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#if ENABLE(DFG_JIT)
</ins><span class="cx"> void CodeBlock::setOptimizationThresholdBasedOnCompilationResult(CompilationResult result)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(jitType() == JITCode::BaselineJIT);
</span><span class="lines">@@ -3277,7 +3101,6 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-#if ENABLE(JIT)
</del><span class="cx"> uint32_t CodeBlock::adjustedExitCountThreshold(uint32_t desiredThreshold)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(JITCode::isOptimizingJIT(jitType()));
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -65,7 +65,6 @@
</span><span class="cx"> #include &quot;LineInfo.h&quot;
</span><span class="cx"> #include &quot;ProfilerCompilation.h&quot;
</span><span class="cx"> #include &quot;RegExpObject.h&quot;
</span><del>-#include &quot;ResolveOperation.h&quot;
</del><span class="cx"> #include &quot;StructureStubInfo.h&quot;
</span><span class="cx"> #include &quot;UnconditionalFinalizer.h&quot;
</span><span class="cx"> #include &quot;ValueProfile.h&quot;
</span><span class="lines">@@ -99,7 +98,7 @@
</span><span class="cx"> protected:
</span><span class="cx">     CodeBlock(CopyParsedBlockTag, CodeBlock&amp; other);
</span><span class="cx">         
</span><del>-    CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSGlobalObject*, unsigned baseScopeDepth, PassRefPtr&lt;SourceProvider&gt;, unsigned sourceOffset);
</del><ins>+    CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr&lt;SourceProvider&gt;, unsigned sourceOffset);
</ins><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;JSGlobalObject&gt; m_globalObject;
</span><span class="cx">     Heap* m_heap;
</span><span class="lines">@@ -358,7 +357,7 @@
</span><span class="cx">         
</span><span class="cx">     bool needsActivation() const
</span><span class="cx">     {
</span><del>-        return needsFullScopeChain() &amp;&amp; codeType() != GlobalCode;
</del><ins>+        return m_needsActivation;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     bool isCaptured(int operand, InlineCallFrame* inlineCallFrame = 0) const
</span><span class="lines">@@ -973,8 +972,6 @@
</span><span class="cx"> #if ENABLE(VALUE_PROFILER)
</span><span class="cx">     void dumpRareCaseProfile(PrintStream&amp;, const char* name, RareCaseProfile*, bool&amp; hasPrintedProfiling);
</span><span class="cx"> #endif
</span><del>-
-    void visitStructures(SlotVisitor&amp;, Instruction* vPC);
</del><span class="cx">         
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">     bool shouldImmediatelyAssumeLivenessDuringScan()
</span><span class="lines">@@ -1084,9 +1081,6 @@
</span><span class="cx">     uint16_t m_optimizationDelayCounter;
</span><span class="cx">     uint16_t m_reoptimizationRetryCounter;
</span><span class="cx"> 
</span><del>-    Vector&lt;ResolveOperations&gt; m_resolveOperations;
-    Vector&lt;PutToBaseOperation, 1&gt; m_putToBaseOperations;
-
</del><span class="cx">     struct RareData {
</span><span class="cx">         WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx">     public:
</span><span class="lines">@@ -1129,8 +1123,8 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    GlobalCodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, unsigned baseScopeDepth, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
-        : CodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, baseScopeDepth, sourceProvider, sourceOffset)
</del><ins>+    GlobalCodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
+        : CodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> };
</span><span class="lines">@@ -1142,8 +1136,8 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ProgramCodeBlock(ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
-        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, 0, sourceProvider, 0)
</del><ins>+    ProgramCodeBlock(ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
+        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1168,8 +1162,8 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    EvalCodeBlock(EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr&lt;SourceProvider&gt; sourceProvider, int baseScopeDepth)
-        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, baseScopeDepth, sourceProvider, 0)
</del><ins>+    EvalCodeBlock(EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
+        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1200,8 +1194,8 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    FunctionCodeBlock(FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSGlobalObject* globalObject, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
-        : CodeBlock(ownerExecutable, unlinkedCodeBlock, globalObject, 0, sourceProvider, sourceOffset)
</del><ins>+    FunctionCodeBlock(FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset)
+        : CodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">         
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeEvalCodeCacheh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/EvalCodeCache.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -49,29 +49,18 @@
</span><span class="cx">             return 0;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const String&amp; evalSource, JSScope* scope, JSValue&amp; exceptionValue)
</del><ins>+        EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const String&amp; evalSource, JSScope* scope)
</ins><span class="cx">         {
</span><span class="cx">             EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext);
</span><del>-            exceptionValue = evalExecutable-&gt;compile(exec, scope);
-            if (exceptionValue)
</del><ins>+            if (!evalExecutable)
</ins><span class="cx">                 return 0;
</span><del>-            
</del><ins>+
</ins><span class="cx">             if (!inStrictContext &amp;&amp; evalSource.length() &lt; maxCacheableSourceLength &amp;&amp; scope-&gt;begin()-&gt;isVariableObject() &amp;&amp; m_cacheMap.size() &lt; maxCacheEntries)
</span><span class="cx">                 m_cacheMap.set(evalSource.impl(), WriteBarrier&lt;EvalExecutable&gt;(exec-&gt;vm(), owner, evalExecutable));
</span><span class="cx">             
</span><span class="cx">             return evalExecutable;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        EvalExecutable* get(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const String&amp; evalSource, JSScope* scope, JSValue&amp; exceptionValue)
-        {
-            EvalExecutable* evalExecutable = tryGet(inStrictContext, evalSource, scope);
-
-            if (!evalExecutable)
-                evalExecutable = getSlow(exec, owner, inStrictContext, evalSource, scope, exceptionValue);
-
-            return evalExecutable;
-        }
-
</del><span class="cx">         bool isEmpty() const { return m_cacheMap.isEmpty(); }
</span><span class="cx"> 
</span><span class="cx">         void visitAggregate(SlotVisitor&amp;);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -260,10 +260,13 @@
</span><span class="cx">     // For now we only handle the super simple self access case. We could handle the
</span><span class="cx">     // prototype case in the future.
</span><span class="cx">     
</span><ins>+    if (!structure)
+        return GetByIdStatus(TakesSlowPath);
+
</ins><span class="cx">     if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx">         return GetByIdStatus(TakesSlowPath);
</span><span class="cx">     
</span><del>-    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot())
</del><ins>+    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
</ins><span class="cx">         return GetByIdStatus(TakesSlowPath);
</span><span class="cx">     
</span><span class="cx">     if (!structure-&gt;propertyAccessesAreCacheable())
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeGlobalResolveInfoh"></a>
<div class="delfile"><h4>Deleted: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,55 +0,0 @@
</span><del>-/*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef GlobalResolveInfo_h
-#define GlobalResolveInfo_h
-
-#include &quot;WriteBarrier.h&quot;
-
-namespace JSC {
-
-struct GlobalResolveInfo {
-    GlobalResolveInfo() { }
-    
-    GlobalResolveInfo(unsigned bytecodeOffset)
-        : offset(0)
-        , bytecodeOffset(bytecodeOffset)
-    {
-    }
-    
-    WriteBarrier&lt;Structure&gt; structure;
-    PropertyOffset offset;
-    unsigned bytecodeOffset; // Only valid in old JIT code. This means nothing in the DFG.
-};
-
-inline unsigned getGlobalResolveInfoBytecodeOffset(GlobalResolveInfo* globalResolveInfo)
-{
-    return globalResolveInfo-&gt;bytecodeOffset;
-}
-
-} // namespace JSC
-
-#endif // GlobalResolveInfo_h
-
</del></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeInstructionh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Instruction.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Instruction.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Instruction.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -32,7 +32,6 @@
</span><span class="cx"> #include &quot;MacroAssembler.h&quot;
</span><span class="cx"> #include &quot;Opcode.h&quot;
</span><span class="cx"> #include &quot;PropertySlot.h&quot;
</span><del>-#include &quot;ResolveOperation.h&quot;
</del><span class="cx"> #include &quot;SpecialPointer.h&quot;
</span><span class="cx"> #include &quot;Structure.h&quot;
</span><span class="cx"> #include &quot;StructureChain.h&quot;
</span><span class="lines">@@ -117,8 +116,6 @@
</span><span class="cx">         ObjectAllocationProfile* objectAllocationProfile;
</span><span class="cx">         void* pointer;
</span><span class="cx">         bool* predicatePointer;
</span><del>-        ResolveOperations* resolveOperations;
-        PutToBaseOperation* putToBaseOperation;
</del><span class="cx">     } u;
</span><span class="cx">         
</span><span class="cx"> private:
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeOpcodeh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Opcode.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Opcode.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Opcode.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -95,34 +95,10 @@
</span><span class="cx">     macro(op_is_function, 3) \
</span><span class="cx">     macro(op_in, 4) \
</span><span class="cx">     \
</span><del>-    macro(op_get_scoped_var, 5) /* has value profiling */ \
-    macro(op_put_scoped_var, 4) \
-    \
-    macro(op_resolve, 5) /* has value profiling */  \
-    macro(op_resolve_global_property, 5) /* has value profiling */  \
-    macro(op_resolve_global_var, 5) /* has value profiling */  \
-    macro(op_resolve_scoped_var, 5) /* has value profiling */  \
-    macro(op_resolve_scoped_var_on_top_scope, 5) /* has value profiling */  \
-    macro(op_resolve_scoped_var_with_top_scope_check, 5) /* has value profiling */  \
-    \
-    macro(op_resolve_base_to_global, 7) /* has value profiling */ \
-    macro(op_resolve_base_to_global_dynamic, 7) /* has value profiling */ \
-    macro(op_resolve_base_to_scope, 7) /* has value profiling */ \
-    macro(op_resolve_base_to_scope_with_top_scope_check, 7) /* has value profiling */ \
-    macro(op_resolve_base, 7) /* has value profiling */ \
-    \
</del><span class="cx">     macro(op_ensure_property_exists, 3) \
</span><span class="cx">     \
</span><del>-    macro(op_resolve_with_base, 7) /* has value profiling */ \
-    \
-    macro(op_resolve_with_this, 6) /* has value profiling */ \
-    \
-    macro(op_put_to_base, 5) \
-    macro(op_put_to_base_variable, 5) \
-    \
</del><span class="cx">     macro(op_init_global_const_nop, 5) \
</span><span class="cx">     macro(op_init_global_const, 5) \
</span><del>-    macro(op_init_global_const_check, 5) \
</del><span class="cx">     macro(op_get_by_id, 9) /* has value profiling */ \
</span><span class="cx">     macro(op_get_by_id_out_of_line, 9) /* has value profiling */ \
</span><span class="cx">     macro(op_get_by_id_self, 9) /* has value profiling */ \
</span><span class="lines">@@ -194,6 +170,10 @@
</span><span class="cx">     macro(op_get_pnames, 6) \
</span><span class="cx">     macro(op_next_pname, 7) \
</span><span class="cx">     \
</span><ins>+    macro(op_resolve_scope, 5) \
+    macro(op_get_from_scope, 8) /* has value profiling */ \
+    macro(op_put_to_scope, 7) \
+    \
</ins><span class="cx">     macro(op_push_with_scope, 2) \
</span><span class="cx">     macro(op_pop_scope, 1) \
</span><span class="cx">     macro(op_push_name_scope, 4) \
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodePutByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -152,8 +152,11 @@
</span><span class="cx"> {
</span><span class="cx">     if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx">         return PutByIdStatus(TakesSlowPath);
</span><ins>+
+    if (!structure)
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">     
</span><del>-    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot())
</del><ins>+    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
</ins><span class="cx">         return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> 
</span><span class="cx">     if (!structure-&gt;propertyAccessesAreCacheable())
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveGlobalStatuscpp"></a>
<div class="delfile"><h4>Deleted: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,61 +0,0 @@
</span><del>-/*
- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;ResolveGlobalStatus.h&quot;
-
-#include &quot;CodeBlock.h&quot;
-#include &quot;JSCJSValue.h&quot;
-#include &quot;Operations.h&quot;
-#include &quot;Structure.h&quot;
-
-namespace JSC {
-
-static ResolveGlobalStatus computeForStructure(CodeBlock* codeBlock, Structure* structure, StringImpl* uid)
-{
-    unsigned attributesIgnored;
-    JSCell* specificValue;
-    PropertyOffset offset = structure-&gt;getConcurrently(*codeBlock-&gt;vm(), uid, attributesIgnored, specificValue);
-    if (structure-&gt;isDictionary())
-        specificValue = 0;
-    if (!isValidOffset(offset))
-        return ResolveGlobalStatus();
-    
-    return ResolveGlobalStatus(ResolveGlobalStatus::Simple, structure, offset, specificValue);
-}
-
-ResolveGlobalStatus ResolveGlobalStatus::computeFor(CodeBlock* codeBlock, int, ResolveOperation* operation, StringImpl* uid)
-{
-    ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
-    
-    ASSERT(operation-&gt;m_operation == ResolveOperation::GetAndReturnGlobalProperty);
-    if (!operation-&gt;m_structure)
-        return ResolveGlobalStatus();
-    
-    return computeForStructure(codeBlock, operation-&gt;m_structure.get(), uid);
-}
-
-} // namespace JSC
-
</del></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveGlobalStatush"></a>
<div class="delfile"><h4>Deleted: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,88 +0,0 @@
</span><del>-/*
- * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef ResolveGlobalStatus_h
-#define ResolveGlobalStatus_h
-
-#include &quot;JSCJSValue.h&quot;
-#include &quot;PropertyOffset.h&quot;
-#include &lt;wtf/NotFound.h&gt;
-#include &lt;wtf/text/StringImpl.h&gt;
-
-namespace JSC {
-
-class CodeBlock;
-struct ResolveOperation;
-class Structure;
-
-class ResolveGlobalStatus {
-public:
-    enum State {
-        NoInformation,
-        Simple,
-        TakesSlowPath
-    };
-    
-    ResolveGlobalStatus()
-        : m_state(NoInformation)
-        , m_structure(0)
-        , m_offset(invalidOffset)
-    {
-    }
-    
-    ResolveGlobalStatus(
-        State state, Structure* structure = 0, PropertyOffset offset = invalidOffset,
-        JSValue specificValue = JSValue())
-        : m_state(state)
-        , m_structure(structure)
-        , m_offset(offset)
-        , m_specificValue(specificValue)
-    {
-    }
-    
-    static ResolveGlobalStatus computeFor(CodeBlock*, int bytecodeIndex, ResolveOperation*, StringImpl* uid);
-    
-    State state() const { return m_state; }
-    
-    bool isSet() const { return m_state != NoInformation; }
-    bool operator!() const { return !isSet(); }
-    bool isSimple() const { return m_state == Simple; }
-    bool takesSlowPath() const { return m_state == TakesSlowPath; }
-    
-    Structure* structure() const { return m_structure; }
-    PropertyOffset offset() const { return m_offset; }
-    JSValue specificValue() const { return m_specificValue; }
-
-private:
-    State m_state;
-    Structure* m_structure;
-    PropertyOffset m_offset;
-    JSValue m_specificValue;
-}; // class ResolveGlobalStatus
-
-} // namespace JSC
-
-#endif // ResolveGlobalStatus_h
-
</del></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeResolveOperationh"></a>
<div class="delfile"><h4>Deleted: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveOperation.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveOperation.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/ResolveOperation.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1,184 +0,0 @@
</span><del>-/*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ResolveOperation_h
-#define ResolveOperation_h
-
-#include &quot;PropertyOffset.h&quot;
-#include &quot;WriteBarrier.h&quot;
-
-#include &lt;wtf/Vector.h&gt;
-
-namespace JSC {
-
-class Structure;
-
-struct ResolveOperation {
-    typedef enum {
-        Fail,
-        SetBaseToUndefined,
-        ReturnScopeAsBase,
-        SetBaseToScope,
-        SetBaseToGlobal,
-        GetAndReturnScopedVar,
-        GetAndReturnGlobalVar,
-        GetAndReturnGlobalVarWatchable,
-        SkipTopScopeNode,
-        SkipScopes,
-        ReturnGlobalObjectAsBase,
-        GetAndReturnGlobalProperty,
-        CheckForDynamicEntriesBeforeGlobalScope
-    } ResolveOperationType;
-
-    ResolveOperationType m_operation;
-    WriteBarrier&lt;Structure&gt; m_structure;
-    union {
-        PropertyOffset m_offset;
-        WriteBarrier&lt;Unknown&gt;* m_registerAddress;
-        int m_scopesToSkip;
-        int m_activationRegister;
-    };
-    static ResolveOperation getAndReturnScopedVar(PropertyOffset offset)
-    {
-        ResolveOperation op;
-        op.m_operation = GetAndReturnScopedVar;
-        op.m_offset = offset;
-        return op;
-    }
-    static ResolveOperation checkForDynamicEntriesBeforeGlobalScope()
-    {
-        ResolveOperation op;
-        op.m_operation = CheckForDynamicEntriesBeforeGlobalScope;
-        return op;
-    }
-
-    static ResolveOperation getAndReturnGlobalVar(WriteBarrier&lt;Unknown&gt;* registerAddress, bool couldBeWatched)
-    {
-        ResolveOperation op;
-        op.m_operation = couldBeWatched ? GetAndReturnGlobalVarWatchable : GetAndReturnGlobalVar;
-        op.m_registerAddress = registerAddress;
-        return op;
-    }
-    static ResolveOperation getAndReturnGlobalProperty()
-    {
-        ResolveOperation op;
-        op.m_operation = GetAndReturnGlobalProperty;
-        return op;
-    }
-    static ResolveOperation resolveFail()
-    {
-        ResolveOperation op;
-        op.m_operation = Fail;
-        return op;
-    }
-    static ResolveOperation skipTopScopeNode(int activationRegister)
-    {
-        ResolveOperation op;
-        op.m_operation = SkipTopScopeNode;
-        op.m_activationRegister = activationRegister;
-        return op;
-    }
-    static ResolveOperation skipScopes(int scopesToSkip)
-    {
-        ResolveOperation op;
-        op.m_operation = SkipScopes;
-        op.m_scopesToSkip = scopesToSkip;
-        return op;
-    }
-    static ResolveOperation returnGlobalObjectAsBase()
-    {
-        ResolveOperation op;
-        op.m_operation = ReturnGlobalObjectAsBase;
-        return op;
-    }
-    static ResolveOperation setBaseToGlobal()
-    {
-        ResolveOperation op;
-        op.m_operation = SetBaseToGlobal;
-        return op;
-    }
-    static ResolveOperation setBaseToUndefined()
-    {
-        ResolveOperation op;
-        op.m_operation = SetBaseToUndefined;
-        return op;
-    }
-    static ResolveOperation setBaseToScope()
-    {
-        ResolveOperation op;
-        op.m_operation = SetBaseToScope;
-        return op;
-    }
-    static ResolveOperation returnScopeAsBase()
-    {
-        ResolveOperation op;
-        op.m_operation = ReturnScopeAsBase;
-        return op;
-    }
-};
-
-struct ResolveOperations : Vector&lt;ResolveOperation&gt; {
-    ResolveOperations() : m_ready(false) { }
-    
-    bool m_ready;
-};
-
-struct PutToBaseOperation {
-    PutToBaseOperation(bool isStrict)
-        : m_kind(Uninitialised)
-        , m_isDynamic(false)
-        , m_isStrict(isStrict)
-        , m_predicatePointer(0)
-        , m_ready(false)
-    {
-
-    }
-    enum Kind { Uninitialised, Generic, Readonly, GlobalVariablePut, GlobalVariablePutChecked, GlobalPropertyPut, VariablePut };
-    union {
-        Kind m_kind : 8;
-        uint8_t m_kindAsUint8;
-    };
-    bool m_isDynamic : 8;
-    bool m_isStrict : 8;
-    union {
-        bool* m_predicatePointer;
-        unsigned m_scopeDepth;
-    };
-    WriteBarrier&lt;Structure&gt; m_structure;
-    union {
-        // Used for GlobalVariablePut
-        WriteBarrier&lt;Unknown&gt;* m_registerAddress;
-
-        // Used for GlobalPropertyPut and VariablePut
-        struct {
-            PropertyOffset m_offset;
-            int32_t m_offsetInButterfly;
-        };
-    };
-    bool m_ready;
-};
-}
-
-#endif // ResolveOperation_h
</del></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> const ClassInfo UnlinkedEvalCodeBlock::s_info = { &quot;UnlinkedEvalCodeBlock&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedEvalCodeBlock) };
</span><span class="cx"> const ClassInfo UnlinkedFunctionCodeBlock::s_info = { &quot;UnlinkedFunctionCodeBlock&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionCodeBlock) };
</span><span class="cx"> 
</span><del>-static UnlinkedFunctionCodeBlock* generateFunctionCodeBlock(VM&amp; vm, JSScope* scope, UnlinkedFunctionExecutable* executable, const SourceCode&amp; source, CodeSpecializationKind kind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</del><ins>+static UnlinkedFunctionCodeBlock* generateFunctionCodeBlock(VM&amp; vm, UnlinkedFunctionExecutable* executable, const SourceCode&amp; source, CodeSpecializationKind kind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;FunctionBodyNode&gt; body = parse&lt;FunctionBodyNode&gt;(&amp;vm, source, executable-&gt;parameters(), executable-&gt;name(), executable-&gt;isInStrictContext() ? JSParseStrict : JSParseNormal, JSParseFunctionCode, error);
</span><span class="cx"> 
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx">     executable-&gt;recordParse(body-&gt;features(), body-&gt;hasCapturedVariables(), body-&gt;lineNo(), body-&gt;lastLine());
</span><span class="cx">     
</span><span class="cx">     UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&amp;vm, FunctionCode, ExecutableInfo(body-&gt;needsActivation(), body-&gt;usesEval(), body-&gt;isStrictMode(), kind == CodeForConstruct));
</span><del>-    OwnPtr&lt;BytecodeGenerator&gt; generator(adoptPtr(new BytecodeGenerator(vm, scope, body.get(), result, debuggerMode, profilerMode)));
</del><ins>+    OwnPtr&lt;BytecodeGenerator&gt; generator(adoptPtr(new BytecodeGenerator(vm, body.get(), result, debuggerMode, profilerMode)));
</ins><span class="cx">     error = generator-&gt;generate();
</span><span class="cx">     body-&gt;destroyData();
</span><span class="cx">     if (error.m_type != ParserError::ErrorNone)
</span><span class="lines">@@ -139,7 +139,7 @@
</span><span class="cx">     return executable;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedFunctionCodeBlock* UnlinkedFunctionExecutable::codeBlockFor(VM&amp; vm, JSScope* scope, const SourceCode&amp; source, CodeSpecializationKind specializationKind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</del><ins>+UnlinkedFunctionCodeBlock* UnlinkedFunctionExecutable::codeBlockFor(VM&amp; vm, const SourceCode&amp; source, CodeSpecializationKind specializationKind, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</ins><span class="cx"> {
</span><span class="cx">     switch (specializationKind) {
</span><span class="cx">     case CodeForCall:
</span><span class="lines">@@ -152,7 +152,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    UnlinkedFunctionCodeBlock* result = generateFunctionCodeBlock(vm, scope, this, source, specializationKind, debuggerMode, profilerMode, error);
</del><ins>+    UnlinkedFunctionCodeBlock* result = generateFunctionCodeBlock(vm, this, source, specializationKind, debuggerMode, profilerMode, error);
</ins><span class="cx">     
</span><span class="cx">     if (error.m_type != ParserError::ErrorNone)
</span><span class="cx">         return 0;
</span><span class="lines">@@ -200,8 +200,6 @@
</span><span class="cx">     , m_lineCount(0)
</span><span class="cx">     , m_features(0)
</span><span class="cx">     , m_codeType(codeType)
</span><del>-    , m_resolveOperationCount(0)
-    , m_putToBaseOperationCount(1)
</del><span class="cx">     , m_arrayProfileCount(0)
</span><span class="cx">     , m_arrayAllocationProfileCount(0)
</span><span class="cx">     , m_objectAllocationProfileCount(0)
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeUnlinkedCodeBlockh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx"> 
</span><span class="cx">     String paramString() const;
</span><span class="cx"> 
</span><del>-    UnlinkedFunctionCodeBlock* codeBlockFor(VM&amp;, JSScope*, const SourceCode&amp;, CodeSpecializationKind, DebuggerMode, ProfilerMode, ParserError&amp;);
</del><ins>+    UnlinkedFunctionCodeBlock* codeBlockFor(VM&amp;, const SourceCode&amp;, CodeSpecializationKind, DebuggerMode, ProfilerMode, ParserError&amp;);
</ins><span class="cx"> 
</span><span class="cx">     static UnlinkedFunctionExecutable* fromGlobalCode(const Identifier&amp;, ExecState*, Debugger*, const SourceCode&amp;, JSObject** exception);
</span><span class="cx"> 
</span><span class="lines">@@ -398,11 +398,6 @@
</span><span class="cx"> 
</span><span class="cx">     VM* vm() const { return m_vm; }
</span><span class="cx"> 
</span><del>-    unsigned addResolve() { return m_resolveOperationCount++; }
-    unsigned numberOfResolveOperations() const { return m_resolveOperationCount; }
-    unsigned addPutToBase() { return m_putToBaseOperationCount++; }
-    unsigned numberOfPutToBaseOperations() const { return m_putToBaseOperationCount; }
-
</del><span class="cx">     UnlinkedArrayProfile addArrayProfile() { return m_arrayProfileCount++; }
</span><span class="cx">     unsigned numberOfArrayProfiles() { return m_arrayProfileCount; }
</span><span class="cx">     UnlinkedArrayAllocationProfile addArrayAllocationProfile() { return m_arrayAllocationProfileCount++; }
</span><span class="lines">@@ -533,8 +528,6 @@
</span><span class="cx">     size_t m_bytecodeCommentIterator;
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    unsigned m_resolveOperationCount;
-    unsigned m_putToBaseOperationCount;
</del><span class="cx">     unsigned m_arrayProfileCount;
</span><span class="cx">     unsigned m_arrayAllocationProfileCount;
</span><span class="cx">     unsigned m_objectAllocationProfileCount;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecodeWatchpointh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Watchpoint.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Watchpoint.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Watchpoint.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -50,6 +50,7 @@
</span><span class="cx"> class InlineWatchpointSet;
</span><span class="cx"> 
</span><span class="cx"> class WatchpointSet : public ThreadSafeRefCounted&lt;WatchpointSet&gt; {
</span><ins>+    friend class LLIntOffsetsExtractor;
</ins><span class="cx"> public:
</span><span class="cx">     WatchpointSet(InitialWatchpointSetMode);
</span><span class="cx">     ~WatchpointSet();
</span><span class="lines">@@ -88,6 +89,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     bool* addressOfIsWatched() { return &amp;m_isWatched; }
</span><ins>+    bool* addressOfIsInvalidated() { return &amp;m_isInvalidated; }
</ins><span class="cx">     
</span><span class="cx">     JS_EXPORT_PRIVATE void notifyWriteSlow(); // Call only if you've checked isWatched.
</span><span class="cx">     
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -31,7 +31,6 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;BytecodeGenerator.h&quot;
</span><span class="cx"> 
</span><del>-#include &quot;BatchedTransitionOptimizer.h&quot;
</del><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JSActivation.h&quot;
</span><span class="cx"> #include &quot;JSFunction.h&quot;
</span><span class="lines">@@ -56,27 +55,6 @@
</span><span class="cx">         m_generator-&gt;m_instructions[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-#ifndef NDEBUG
-void ResolveResult::checkValidity()
-{
-    switch (m_type) {
-    case Register:
-    case ReadOnlyRegister:
-        ASSERT(m_local);
-        return;
-    case Dynamic:
-        ASSERT(!m_local);
-        return;
-    case Lexical:
-    case ReadOnlyLexical:
-        ASSERT(!m_local);
-        return;
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-    }
-}
-#endif
-
</del><span class="cx"> ParserError BytecodeGenerator::generate()
</span><span class="cx"> {
</span><span class="cx">     SamplingRegion samplingRegion(&quot;Bytecode Generation&quot;);
</span><span class="lines">@@ -157,7 +135,7 @@
</span><span class="cx">         m_lastVar = &amp;m_calleeRegisters.last();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-BytecodeGenerator::BytecodeGenerator(VM&amp; vm, JSScope*, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</del><ins>+BytecodeGenerator::BytecodeGenerator(VM&amp; vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</ins><span class="cx">     : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
</span><span class="cx">     , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
</span><span class="cx">     , m_symbolTable(0)
</span><span class="lines">@@ -167,7 +145,7 @@
</span><span class="cx">     , m_emptyValueRegister(0)
</span><span class="cx">     , m_globalObjectRegister(0)
</span><span class="cx">     , m_finallyDepth(0)
</span><del>-    , m_dynamicScopeDepth(0)
</del><ins>+    , m_localScopeDepth(0)
</ins><span class="cx">     , m_codeType(GlobalCode)
</span><span class="cx">     , m_nextConstantOffset(0)
</span><span class="cx">     , m_globalConstantIndex(0)
</span><span class="lines">@@ -205,18 +183,17 @@
</span><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-BytecodeGenerator::BytecodeGenerator(VM&amp; vm, JSScope* scope, FunctionBodyNode* functionBody, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</del><ins>+BytecodeGenerator::BytecodeGenerator(VM&amp; vm, FunctionBodyNode* functionBody, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</ins><span class="cx">     : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
</span><span class="cx">     , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
</span><span class="cx">     , m_symbolTable(codeBlock-&gt;symbolTable())
</span><span class="cx">     , m_scopeNode(functionBody)
</span><del>-    , m_scope(vm, scope)
</del><span class="cx">     , m_codeBlock(vm, codeBlock)
</span><span class="cx">     , m_activationRegister(0)
</span><span class="cx">     , m_emptyValueRegister(0)
</span><span class="cx">     , m_globalObjectRegister(0)
</span><span class="cx">     , m_finallyDepth(0)
</span><del>-    , m_dynamicScopeDepth(0)
</del><ins>+    , m_localScopeDepth(0)
</ins><span class="cx">     , m_codeType(FunctionCode)
</span><span class="cx">     , m_nextConstantOffset(0)
</span><span class="cx">     , m_globalConstantIndex(0)
</span><span class="lines">@@ -402,18 +379,17 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-BytecodeGenerator::BytecodeGenerator(VM&amp; vm, JSScope* scope, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</del><ins>+BytecodeGenerator::BytecodeGenerator(VM&amp; vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
</ins><span class="cx">     : m_shouldEmitDebugHooks(debuggerMode == DebuggerOn)
</span><span class="cx">     , m_shouldEmitProfileHooks(profilerMode == ProfilerOn)
</span><span class="cx">     , m_symbolTable(codeBlock-&gt;symbolTable())
</span><span class="cx">     , m_scopeNode(evalNode)
</span><del>-    , m_scope(vm, scope)
</del><span class="cx">     , m_codeBlock(vm, codeBlock)
</span><span class="cx">     , m_thisRegister(CallFrame::thisArgumentOffset())
</span><span class="cx">     , m_emptyValueRegister(0)
</span><span class="cx">     , m_globalObjectRegister(0)
</span><span class="cx">     , m_finallyDepth(0)
</span><del>-    , m_dynamicScopeDepth(0)
</del><ins>+    , m_localScopeDepth(0)
</ins><span class="cx">     , m_codeType(EvalCode)
</span><span class="cx">     , m_nextConstantOffset(0)
</span><span class="cx">     , m_globalConstantIndex(0)
</span><span class="lines">@@ -470,13 +446,8 @@
</span><span class="cx">     m_calleeRegister.setIndex(JSStack::Callee);
</span><span class="cx"> 
</span><span class="cx">     // If non-strict eval is in play, we use a separate object in the scope chain for the callee's name.
</span><del>-    if ((m_codeBlock-&gt;usesEval() &amp;&amp; !m_codeBlock-&gt;isStrictMode()) || m_shouldEmitDebugHooks) {
-        emitOpcode(op_push_name_scope);
-        instructions().append(addConstant(functionBodyNode-&gt;ident()));
-        instructions().append(m_calleeRegister.index());
-        instructions().append(ReadOnly | DontDelete);
-        return 0;
-    }
</del><ins>+    if ((m_codeBlock-&gt;usesEval() &amp;&amp; !m_codeBlock-&gt;isStrictMode()) || m_shouldEmitDebugHooks)
+        emitPushNameScope(functionBodyNode-&gt;ident(), &amp;m_calleeRegister, ReadOnly | DontDelete);
</ins><span class="cx"> 
</span><span class="cx">     if (!functionBodyNode-&gt;captures(functionBodyNode-&gt;ident()))
</span><span class="cx">         return &amp;m_calleeRegister;
</span><span class="lines">@@ -1160,76 +1131,36 @@
</span><span class="cx">     return m_globalObjectRegister;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-ResolveResult BytecodeGenerator::resolve(const Identifier&amp; property)
</del><ins>+Local BytecodeGenerator::local(const Identifier&amp; property)
</ins><span class="cx"> {
</span><span class="cx">     if (property == propertyNames().thisIdentifier)
</span><del>-        return ResolveResult::registerResolve(thisRegister(), ResolveResult::ReadOnlyFlag);
</del><ins>+        return Local(thisRegister(), ReadOnly);
</ins><span class="cx"> 
</span><del>-    // Check if the property should be allocated in a register.
-    if (m_codeType != GlobalCode &amp;&amp; shouldOptimizeLocals() &amp;&amp; m_symbolTable) {
-        SymbolTableEntry entry = symbolTable().get(property.impl());
-        if (!entry.isNull()) {
-            if (property == propertyNames().arguments)
-                createArgumentsIfNecessary();
-            unsigned flags = entry.isReadOnly() ? ResolveResult::ReadOnlyFlag : 0;
-            RegisterID* local = createLazyRegisterIfNecessary(&amp;registerFor(entry.getIndex()));
-            return ResolveResult::registerResolve(local, flags);
-        }
-    }
-    // Cases where we cannot statically optimize the lookup.
-    if (property == propertyNames().arguments || !canOptimizeNonLocals())
-        return ResolveResult::dynamicResolve();
</del><ins>+    if (property == propertyNames().arguments)
+        createArgumentsIfNecessary();
</ins><span class="cx"> 
</span><del>-    if (!m_scope || m_codeType != FunctionCode || m_shouldEmitDebugHooks)
-        return ResolveResult::dynamicResolve();
</del><ins>+    if (!shouldOptimizeLocals())
+        return Local();
</ins><span class="cx"> 
</span><del>-    ScopeChainIterator iter = m_scope-&gt;begin();
-    ScopeChainIterator end = m_scope-&gt;end();
-    size_t depth = m_codeBlock-&gt;needsFullScopeChain();
-    unsigned flags = 0;
-    for (; iter != end; ++iter, ++depth) {
-        JSObject* currentScope = iter.get();
-        if (!currentScope-&gt;isVariableObject())
-            return ResolveResult::dynamicResolve();
</del><ins>+    SymbolTableEntry entry = symbolTable().get(property.impl());
+    if (entry.isNull())
+        return Local();
</ins><span class="cx"> 
</span><del>-        JSSymbolTableObject* currentVariableObject = jsCast&lt;JSSymbolTableObject*&gt;(currentScope);
-        SymbolTableEntry entry = currentVariableObject-&gt;symbolTable()-&gt;get(property.impl());
-
-        // Found the property
-        if (!entry.isNull()) {
-            if (entry.isReadOnly())
-                flags |= ResolveResult::ReadOnlyFlag;
-            if (++iter == end)
-                return ResolveResult::dynamicResolve();
-#if !ASSERT_DISABLED
-            if (JSActivation* activation = jsDynamicCast&lt;JSActivation*&gt;(currentVariableObject))
-                ASSERT(activation-&gt;isValid(entry));
-#endif
-            return ResolveResult::lexicalResolve(entry.getIndex(), depth, flags);
-        }
-        bool scopeRequiresDynamicChecks = false;
-        if (currentVariableObject-&gt;isDynamicScope(scopeRequiresDynamicChecks))
-            break;
-        if (scopeRequiresDynamicChecks)
-            flags |= ResolveResult::DynamicFlag;
-    }
-
-    return ResolveResult::dynamicResolve();
</del><ins>+    RegisterID* local = createLazyRegisterIfNecessary(&amp;registerFor(entry.getIndex()));
+    return Local(local, entry.getAttributes());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-ResolveResult BytecodeGenerator::resolveConstDecl(const Identifier&amp; property)
</del><ins>+Local BytecodeGenerator::constLocal(const Identifier&amp; property)
</ins><span class="cx"> {
</span><del>-    // Register-allocated const declarations.
-    if (m_codeType == FunctionCode &amp;&amp; m_symbolTable) {
-        SymbolTableEntry entry = symbolTable().get(property.impl());
-        if (!entry.isNull()) {
-            unsigned flags = entry.isReadOnly() ? ResolveResult::ReadOnlyFlag : 0;
-            RegisterID* local = createLazyRegisterIfNecessary(&amp;registerFor(entry.getIndex()));
-            return ResolveResult::registerResolve(local, flags);
-        }
-    }
</del><ins>+    if (m_codeType != FunctionCode)
+        return Local();
</ins><span class="cx"> 
</span><del>-    return ResolveResult::dynamicResolve();
</del><ins>+    SymbolTableEntry entry = symbolTable().get(property.impl());
+    if (entry.isNull())
+        return Local();
+
+    RegisterID* local = createLazyRegisterIfNecessary(&amp;registerFor(entry.getIndex()));
+    return Local(local, entry.getAttributes());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void BytecodeGenerator::emitCheckHasInstance(RegisterID* dst, RegisterID* value, RegisterID* base, Label* target)
</span><span class="lines">@@ -1242,125 +1173,70 @@
</span><span class="cx">     instructions().append(target-&gt;bind(begin, instructions().size()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitInstanceOf(RegisterID* dst, RegisterID* value, RegisterID* basePrototype)
-{ 
-    emitOpcode(op_instanceof);
-    instructions().append(dst-&gt;index());
-    instructions().append(value-&gt;index());
-    instructions().append(basePrototype-&gt;index());
-    return dst;
-}
-
-bool BytecodeGenerator::shouldAvoidResolveGlobal()
</del><ins>+// Indicates the least upper bound of resolve type based on local scope. The bytecode linker
+// will start with this ResolveType and compute the least upper bound including intercepting scopes.
+ResolveType BytecodeGenerator::resolveType()
</ins><span class="cx"> {
</span><del>-    return !m_labelScopes.size();
</del><ins>+    if (m_localScopeDepth)
+        return Dynamic;
+    if (m_symbolTable &amp;&amp; m_symbolTable-&gt;usesNonStrictEval())
+        return GlobalPropertyWithVarInjectionChecks;
+    return GlobalProperty;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const ResolveResult&amp; resolveResult, const Identifier&amp; property)
</del><ins>+RegisterID* BytecodeGenerator::emitResolveScope(RegisterID* dst, const Identifier&amp; identifier)
</ins><span class="cx"> {
</span><ins>+    ASSERT(!m_symbolTable || !m_symbolTable-&gt;contains(identifier.impl()) || resolveType() == Dynamic);
</ins><span class="cx"> 
</span><del>-    if (resolveResult.isStatic())
-        return emitGetStaticVar(dst, resolveResult, property);
-
-    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve);
</del><ins>+    // resolve_scope dst, id, ResolveType, depth
+    emitOpcode(op_resolve_scope);
</ins><span class="cx">     instructions().append(kill(dst));
</span><del>-    instructions().append(addConstant(property));
-    instructions().append(getResolveOperations(property));
-    instructions().append(profile);
</del><ins>+    instructions().append(addConstant(identifier));
+    instructions().append(resolveType());
+    instructions().append(0);
</ins><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const ResolveResult&amp; resolveResult, const Identifier&amp; property)
</del><ins>+RegisterID* BytecodeGenerator::emitGetFromScope(RegisterID* dst, RegisterID* scope, const Identifier&amp; identifier, ResolveMode resolveMode)
</ins><span class="cx"> {
</span><del>-    if (!resolveResult.isDynamic()) {
-        // Global object is the base
-        return emitLoadGlobalObject(dst);
-    }
</del><ins>+    m_codeBlock-&gt;addPropertyAccessInstruction(instructions().size());
</ins><span class="cx"> 
</span><del>-    // We can't optimise at all :-(
-    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_base);
</del><ins>+    // get_from_scope dst, scope, id, ResolveModeAndType, Structure, Operand
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_from_scope);
</ins><span class="cx">     instructions().append(kill(dst));
</span><del>-    instructions().append(addConstant(property));
-    instructions().append(false);
-    instructions().append(getResolveBaseOperations(property));
</del><ins>+    instructions().append(scope-&gt;index());
+    instructions().append(addConstant(identifier));
+    instructions().append(ResolveModeAndType(resolveMode, resolveType()).operand());
</ins><span class="cx">     instructions().append(0);
</span><ins>+    instructions().append(0);
</ins><span class="cx">     instructions().append(profile);
</span><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitResolveBaseForPut(RegisterID* dst, const ResolveResult&amp;, const Identifier&amp; property, NonlocalResolveInfo&amp; verifier)
</del><ins>+RegisterID* BytecodeGenerator::emitPutToScope(RegisterID* scope, const Identifier&amp; identifier, RegisterID* value, ResolveMode resolveMode)
</ins><span class="cx"> {
</span><del>-    // We can't optimise at all :-(
-    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_base);
-    instructions().append(kill(dst));
-    instructions().append(addConstant(property));
-    instructions().append(m_codeBlock-&gt;isStrictMode());
-    uint32_t putToBaseIndex = 0;
-    instructions().append(getResolveBaseForPutOperations(property, putToBaseIndex));
-    verifier.resolved(putToBaseIndex);
-    instructions().append(putToBaseIndex);
-    instructions().append(profile);
-    return dst;
-}
</del><ins>+    m_codeBlock-&gt;addPropertyAccessInstruction(instructions().size());
</ins><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitResolveWithBaseForPut(RegisterID* baseDst, RegisterID* propDst, const ResolveResult&amp; resolveResult, const Identifier&amp; property, NonlocalResolveInfo&amp; verifier)
-{
-    ASSERT_UNUSED(resolveResult, !resolveResult.isStatic());
-    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_with_base);
-    instructions().append(kill(baseDst));
-    instructions().append(propDst-&gt;index());
-    instructions().append(addConstant(property));
-    uint32_t putToBaseIndex = 0;
-    instructions().append(getResolveWithBaseForPutOperations(property, putToBaseIndex));
-    verifier.resolved(putToBaseIndex);
-    instructions().append(putToBaseIndex);
-    instructions().append(profile);
-    return baseDst;
</del><ins>+    // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
+    emitOpcode(op_put_to_scope);
+    instructions().append(scope-&gt;index());
+    instructions().append(addConstant(identifier));
+    instructions().append(value-&gt;index());
+    instructions().append(ResolveModeAndType(resolveMode, resolveType()).operand());
+    instructions().append(0);
+    instructions().append(0);
+    return value;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitResolveWithThis(RegisterID* baseDst, RegisterID* propDst, const ResolveResult&amp; resolveResult, const Identifier&amp; property)
-{
-    if (resolveResult.isStatic()) {
-        emitLoad(baseDst, jsUndefined());
-        emitGetStaticVar(propDst, resolveResult, property);
-        return baseDst;
-    }
-
-    UnlinkedValueProfile profile = emitProfiledOpcode(op_resolve_with_this);
-    instructions().append(kill(baseDst));
-    instructions().append(propDst-&gt;index());
-    instructions().append(addConstant(property));
-    instructions().append(getResolveWithThisOperations(property));
-    instructions().append(profile);
-    return baseDst;
</del><ins>+RegisterID* BytecodeGenerator::emitInstanceOf(RegisterID* dst, RegisterID* value, RegisterID* basePrototype)
+{ 
+    emitOpcode(op_instanceof);
+    instructions().append(dst-&gt;index());
+    instructions().append(value-&gt;index());
+    instructions().append(basePrototype-&gt;index());
+    return dst;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitGetStaticVar(RegisterID* dst, const ResolveResult&amp; resolveResult, const Identifier&amp;)
-{
-    ASSERT(m_codeType == FunctionCode);
-    switch (resolveResult.type()) {
-    case ResolveResult::Register:
-    case ResolveResult::ReadOnlyRegister:
-        if (dst == ignoredResult())
-            return 0;
-        return moveToDestinationIfNeeded(dst, resolveResult.local());
-
-    case ResolveResult::Lexical:
-    case ResolveResult::ReadOnlyLexical: {
-        UnlinkedValueProfile profile = emitProfiledOpcode(op_get_scoped_var);
-        instructions().append(dst-&gt;index());
-        instructions().append(resolveResult.index());
-        instructions().append(resolveResult.depth());
-        instructions().append(profile);
-        return dst;
-    }
-
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        return 0;
-    }
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitInitGlobalConst(const Identifier&amp; identifier, RegisterID* value)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(m_codeType == GlobalCode);
</span><span class="lines">@@ -1372,28 +1248,6 @@
</span><span class="cx">     return value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitPutStaticVar(const ResolveResult&amp; resolveResult, const Identifier&amp;, RegisterID* value)
-{
-    ASSERT(m_codeType == FunctionCode);
-    switch (resolveResult.type()) {
-    case ResolveResult::Register:
-    case ResolveResult::ReadOnlyRegister:
-        return moveToDestinationIfNeeded(resolveResult.local(), value);
-
-    case ResolveResult::Lexical:
-    case ResolveResult::ReadOnlyLexical:
-        emitOpcode(op_put_scoped_var);
-        instructions().append(resolveResult.index());
-        instructions().append(resolveResult.depth());
-        instructions().append(value-&gt;index());
-        return value;
-
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        return 0;
-    }
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property)
</span><span class="cx"> {
</span><span class="cx">     m_codeBlock-&gt;addPropertyAccessInstruction(instructions().size());
</span><span class="lines">@@ -1440,16 +1294,6 @@
</span><span class="cx">     return value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitPutToBase(RegisterID* base, const Identifier&amp; property, RegisterID* value, NonlocalResolveInfo&amp; resolveInfo)
-{
-    emitOpcode(op_put_to_base);
-    instructions().append(base-&gt;index());
-    instructions().append(addConstant(property));
-    instructions().append(value-&gt;index());
-    instructions().append(resolveInfo.put());
-    return value;
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitDirectPutById(RegisterID* base, const Identifier&amp; property, RegisterID* value)
</span><span class="cx"> {
</span><span class="cx">     unsigned propertyIndex = addConstant(property);
</span><span class="lines">@@ -2006,7 +1850,7 @@
</span><span class="cx">     ControlFlowContext context;
</span><span class="cx">     context.isFinallyBlock = false;
</span><span class="cx">     m_scopeContextStack.append(context);
</span><del>-    m_dynamicScopeDepth++;
</del><ins>+    m_localScopeDepth++;
</ins><span class="cx"> 
</span><span class="cx">     return emitUnaryNoDstOp(op_push_with_scope, scope);
</span><span class="cx"> }
</span><span class="lines">@@ -2019,7 +1863,7 @@
</span><span class="cx">     emitOpcode(op_pop_scope);
</span><span class="cx"> 
</span><span class="cx">     m_scopeContextStack.removeLast();
</span><del>-    m_dynamicScopeDepth--;
</del><ins>+    m_localScopeDepth--;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void BytecodeGenerator::emitDebugHook(DebugHookID debugHookID, int firstLine, int lastLine, int charPosition)
</span><span class="lines">@@ -2051,7 +1895,7 @@
</span><span class="cx">         static_cast&lt;unsigned&gt;(m_tryContextStack.size()),
</span><span class="cx">         static_cast&lt;unsigned&gt;(m_labelScopes.size()),
</span><span class="cx">         m_finallyDepth,
</span><del>-        m_dynamicScopeDepth
</del><ins>+        m_localScopeDepth
</ins><span class="cx">     };
</span><span class="cx">     scope.finallyContext = context;
</span><span class="cx">     m_scopeContextStack.append(scope);
</span><span class="lines">@@ -2220,8 +2064,8 @@
</span><span class="cx">             }
</span><span class="cx">             int savedFinallyDepth = m_finallyDepth;
</span><span class="cx">             m_finallyDepth = finallyContext.finallyDepth;
</span><del>-            int savedDynamicScopeDepth = m_dynamicScopeDepth;
-            m_dynamicScopeDepth = finallyContext.dynamicScopeDepth;
</del><ins>+            int savedDynamicScopeDepth = m_localScopeDepth;
+            m_localScopeDepth = finallyContext.dynamicScopeDepth;
</ins><span class="cx">             
</span><span class="cx">             // Emit the finally block.
</span><span class="cx">             emitNode(finallyContext.finallyBlock);
</span><span class="lines">@@ -2250,7 +2094,7 @@
</span><span class="cx">             if (flipLabelScopes)
</span><span class="cx">                 m_labelScopes = savedLabelScopes;
</span><span class="cx">             m_finallyDepth = savedFinallyDepth;
</span><del>-            m_dynamicScopeDepth = savedDynamicScopeDepth;
</del><ins>+            m_localScopeDepth = savedDynamicScopeDepth;
</ins><span class="cx">             
</span><span class="cx">             --topScope;
</span><span class="cx">         }
</span><span class="lines">@@ -2333,7 +2177,7 @@
</span><span class="cx">     m_tryContextStack.removeLast();
</span><span class="cx">     
</span><span class="cx">     emitLabel(tryRange.tryData-&gt;target.get());
</span><del>-    tryRange.tryData-&gt;targetScopeDepth = m_dynamicScopeDepth;
</del><ins>+    tryRange.tryData-&gt;targetScopeDepth = m_localScopeDepth;
</ins><span class="cx"> 
</span><span class="cx">     emitOpcode(op_catch);
</span><span class="cx">     instructions().append(targetRegister-&gt;index());
</span><span class="lines">@@ -2352,7 +2196,7 @@
</span><span class="cx">     ControlFlowContext context;
</span><span class="cx">     context.isFinallyBlock = false;
</span><span class="cx">     m_scopeContextStack.append(context);
</span><del>-    m_dynamicScopeDepth++;
</del><ins>+    m_localScopeDepth++;
</ins><span class="cx"> 
</span><span class="cx">     emitOpcode(op_push_name_scope);
</span><span class="cx">     instructions().append(addConstant(property));
</span><span class="lines">@@ -2490,7 +2334,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool BytecodeGenerator::isArgumentNumber(const Identifier&amp; ident, int argumentNumber)
</span><span class="cx"> {
</span><del>-    RegisterID* registerID = resolve(ident).local();
</del><ins>+    RegisterID* registerID = local(ident).get();
</ins><span class="cx">     if (!registerID || registerID-&gt;index() &gt;= 0)
</span><span class="cx">          return 0;
</span><span class="cx">     return registerID-&gt;index() == CallFrame::argumentOffset(argumentNumber);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -52,7 +52,6 @@
</span><span class="cx"> 
</span><span class="cx">     class Identifier;
</span><span class="cx">     class Label;
</span><del>-    class JSScope;
</del><span class="cx"> 
</span><span class="cx">     enum ExpectedFunction {
</span><span class="cx">         NoExpectedFunction,
</span><span class="lines">@@ -112,130 +111,35 @@
</span><span class="cx">         TryData* tryData;
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    struct TryRange {
-        RefPtr&lt;Label&gt; start;
-        RefPtr&lt;Label&gt; end;
-        TryData* tryData;
-    };
-
-    class ResolveResult {
</del><ins>+    class Local {
</ins><span class="cx">     public:
</span><del>-        enum Flags {
-            // The property is locally bound, in a register.
-            RegisterFlag = 0x1,
-            // We need to traverse the scope chain at runtime, checking for
-            // non-strict eval and/or `with' nodes.
-            DynamicFlag = 0x2,
-            // The resolved binding is immutable.
-            ReadOnlyFlag = 0x4,
-            // The property has a static location
-            StaticFlag = 0x8,
-            // Entry at scope distance &quot;m_depth&quot; and located at &quot;m_index&quot;
-            ScopedFlag = 0x10
-        };
-
-        enum Type {
-            // The property is local, and stored in a register.
-            Register = RegisterFlag | StaticFlag,
-            // A read-only local, created by &quot;const&quot;.
-            ReadOnlyRegister = RegisterFlag | ReadOnlyFlag | StaticFlag,
-            // Lexically fixed location in the scope chain
-            Lexical = ScopedFlag | StaticFlag,
-            // A read-only Lexical, created by &quot;const&quot;.
-            ReadOnlyLexical = ScopedFlag | ReadOnlyFlag | StaticFlag,
-            // Any other form of lookup
-            Dynamic = DynamicFlag,
-        };
-
-        static ResolveResult registerResolve(RegisterID *local, unsigned flags)
</del><ins>+        Local()
+            : m_local(0)
+            , m_attributes(0)
</ins><span class="cx">         {
</span><del>-            return ResolveResult(Register | flags, local);
</del><span class="cx">         }
</span><del>-        static ResolveResult dynamicResolve()
</del><ins>+
+        Local(RegisterID* local, unsigned attributes)
+            : m_local(local)
+            , m_attributes(attributes)
</ins><span class="cx">         {
</span><del>-            return ResolveResult(Dynamic, 0);
</del><span class="cx">         }
</span><del>-        static ResolveResult lexicalResolve(int index, size_t depth, unsigned flags)
-        {
-            if (flags &amp; DynamicFlag)
-                return dynamicResolve();
-            return ResolveResult(Lexical | flags, index, depth);
-        }
-        unsigned type() const { return m_type; }
</del><span class="cx"> 
</span><del>-        // Returns the register corresponding to a local variable, or 0 if no
-        // such register exists. Registers returned by ResolveResult::local() do
-        // not require explicit reference counting.
-        RegisterID* local() const { return m_local; }
</del><ins>+        operator bool() { return m_local; }
</ins><span class="cx"> 
</span><del>-        bool isRegister() const { return m_type &amp; RegisterFlag; }
-        bool isStatic() const { return (m_type &amp; StaticFlag) &amp;&amp; !isDynamic(); }
-        bool isDynamic() const { return m_type &amp; DynamicFlag; }
-        bool isReadOnly() const { return (m_type &amp; ReadOnlyFlag) &amp;&amp; !isDynamic(); }
</del><ins>+        RegisterID* get() { return m_local; }
</ins><span class="cx"> 
</span><del>-        unsigned depth() const { ASSERT(isStatic()); return m_depth; }
-        int32_t index() const { ASSERT(isStatic()); return m_index; }
</del><ins>+        bool isReadOnly() { return m_attributes &amp; ReadOnly; }
</ins><span class="cx"> 
</span><span class="cx">     private:
</span><del>-        ResolveResult(unsigned type, RegisterID* local)
-            : m_type(type)
-            , m_local(local)
-            , m_index(0)
-            , m_depth(0)
-        {
-#ifndef NDEBUG
-            checkValidity();
-#endif
-        }
-
-        ResolveResult(unsigned type, int index, unsigned depth)
-            : m_type(type)
-            , m_local(0)
-            , m_index(index)
-            , m_depth(depth)
-        {
-#ifndef NDEBUG
-            checkValidity();
-#endif
-        }
-
-#ifndef NDEBUG
-        void checkValidity();
-#endif
-
-        unsigned m_type;
-        RegisterID* m_local; // Local register, if RegisterFlag is set
-        int m_index;
-        unsigned m_depth;
</del><ins>+        RegisterID* m_local;
+        unsigned m_attributes;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><del>-    struct NonlocalResolveInfo {
-        friend class BytecodeGenerator;
-        NonlocalResolveInfo()
-            : m_state(Unused)
-        {
-        }
-        ~NonlocalResolveInfo()
-        {
-            ASSERT(m_state == Put);
-        }
-    private:
-        void resolved(uint32_t putToBaseIndex)
-        {
-            ASSERT(putToBaseIndex);
-            ASSERT(m_state == Unused);
-            m_state = Resolved;
-            m_putToBaseIndex = putToBaseIndex;
-        }
-        uint32_t put()
-        {
-            ASSERT(m_state == Resolved);
-            m_state = Put;
-            return m_putToBaseIndex;
-        }
-        enum State { Unused, Resolved, Put };
-        State m_state;
-        uint32_t m_putToBaseIndex;
</del><ins>+    struct TryRange {
+        RefPtr&lt;Label&gt; start;
+        RefPtr&lt;Label&gt; end;
+        TryData* tryData;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     class BytecodeGenerator {
</span><span class="lines">@@ -244,9 +148,9 @@
</span><span class="cx">         typedef DeclarationStacks::VarStack VarStack;
</span><span class="cx">         typedef DeclarationStacks::FunctionStack FunctionStack;
</span><span class="cx"> 
</span><del>-        BytecodeGenerator(VM&amp;, JSScope*, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode);
-        BytecodeGenerator(VM&amp;, JSScope*, FunctionBodyNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode);
-        BytecodeGenerator(VM&amp;, JSScope*, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode);
</del><ins>+        BytecodeGenerator(VM&amp;, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode);
+        BytecodeGenerator(VM&amp;, FunctionBodyNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode);
+        BytecodeGenerator(VM&amp;, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode);
</ins><span class="cx"> 
</span><span class="cx">         ~BytecodeGenerator();
</span><span class="cx">         
</span><span class="lines">@@ -264,11 +168,8 @@
</span><span class="cx">         bool willResolveToArguments(const Identifier&amp;);
</span><span class="cx">         RegisterID* uncheckedRegisterForArguments();
</span><span class="cx"> 
</span><del>-        // Resolve an identifier, given the current compile-time scope chain.
-        ResolveResult resolve(const Identifier&amp;);
-        // Behaves as resolve does, but ignores dynamic scope as
-        // dynamic scope should not interfere with const initialisation
-        ResolveResult resolveConstDecl(const Identifier&amp;);
</del><ins>+        Local local(const Identifier&amp;);
+        Local constLocal(const Identifier&amp;);
</ins><span class="cx"> 
</span><span class="cx">         // Returns the register storing &quot;this&quot;
</span><span class="cx">         RegisterID* thisRegister() { return &amp;m_thisRegister; }
</span><span class="lines">@@ -443,18 +344,8 @@
</span><span class="cx">         RegisterID* emitTypeOf(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_typeof, dst, src); }
</span><span class="cx">         RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
</span><span class="cx"> 
</span><del>-        RegisterID* emitGetStaticVar(RegisterID* dst, const ResolveResult&amp;, const Identifier&amp;);
-        RegisterID* emitPutStaticVar(const ResolveResult&amp;, const Identifier&amp;, RegisterID* value);
</del><span class="cx">         RegisterID* emitInitGlobalConst(const Identifier&amp;, RegisterID* value);
</span><span class="cx"> 
</span><del>-        RegisterID* emitResolve(RegisterID* dst, const ResolveResult&amp;, const Identifier&amp; property);
-        RegisterID* emitResolveBase(RegisterID* dst, const ResolveResult&amp;, const Identifier&amp; property);
-        RegisterID* emitResolveBaseForPut(RegisterID* dst, const ResolveResult&amp;, const Identifier&amp; property, NonlocalResolveInfo&amp;);
-        RegisterID* emitResolveWithBaseForPut(RegisterID* baseDst, RegisterID* propDst, const ResolveResult&amp;, const Identifier&amp; property, NonlocalResolveInfo&amp;);
-        RegisterID* emitResolveWithThis(RegisterID* baseDst, RegisterID* propDst, const ResolveResult&amp;, const Identifier&amp; property);
-
-        RegisterID* emitPutToBase(RegisterID* base, const Identifier&amp;, RegisterID* value, NonlocalResolveInfo&amp;);
-
</del><span class="cx">         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property);
</span><span class="cx">         RegisterID* emitGetArgumentsLength(RegisterID* dst, RegisterID* base);
</span><span class="cx">         RegisterID* emitPutById(RegisterID* base, const Identifier&amp; property, RegisterID* value);
</span><span class="lines">@@ -480,6 +371,11 @@
</span><span class="cx">         RegisterID* emitStrcat(RegisterID* dst, RegisterID* src, int count);
</span><span class="cx">         void emitToPrimitive(RegisterID* dst, RegisterID* src);
</span><span class="cx"> 
</span><ins>+        ResolveType resolveType();
+        RegisterID* emitResolveScope(RegisterID* dst, const Identifier&amp;);
+        RegisterID* emitGetFromScope(RegisterID* dst, RegisterID* scope, const Identifier&amp;, ResolveMode);
+        RegisterID* emitPutToScope(RegisterID* scope, const Identifier&amp;, RegisterID* value, ResolveMode);
+
</ins><span class="cx">         PassRefPtr&lt;Label&gt; emitLabel(Label*);
</span><span class="cx">         void emitLoopHint();
</span><span class="cx">         PassRefPtr&lt;Label&gt; emitJump(Label* target);
</span><span class="lines">@@ -514,7 +410,7 @@
</span><span class="cx"> 
</span><span class="cx">         void emitDebugHook(DebugHookID, int firstLine, int lastLine, int charPosition);
</span><span class="cx"> 
</span><del>-        int scopeDepth() { return m_dynamicScopeDepth + m_finallyDepth; }
</del><ins>+        int scopeDepth() { return m_localScopeDepth + m_finallyDepth; }
</ins><span class="cx">         bool hasFinaliser() { return m_finallyDepth != 0; }
</span><span class="cx"> 
</span><span class="cx">         void pushFinallyContext(StatementNode* finallyBlock);
</span><span class="lines">@@ -568,12 +464,6 @@
</span><span class="cx"> 
</span><span class="cx">         typedef HashMap&lt;double, JSValue&gt; NumberMap;
</span><span class="cx">         typedef HashMap&lt;StringImpl*, JSString*, IdentifierRepHash&gt; IdentifierStringMap;
</span><del>-        typedef struct {
-            int resolveOperations;
-            int putOperations;
-        } ResolveCacheEntry;
-        typedef HashMap&lt;StringImpl*, ResolveCacheEntry, IdentifierRepHash&gt; IdentifierResolvePutMap;
-        typedef HashMap&lt;StringImpl*, uint32_t, IdentifierRepHash&gt; IdentifierResolveMap;
</del><span class="cx">         
</span><span class="cx">         // Helper for emitCall() and emitConstruct(). This works because the set of
</span><span class="cx">         // expected functions have identical behavior for both call and construct
</span><span class="lines">@@ -608,7 +498,6 @@
</span><span class="cx">         void addCallee(FunctionBodyNode*, RegisterID*);
</span><span class="cx"> 
</span><span class="cx">         void preserveLastVar();
</span><del>-        bool shouldAvoidResolveGlobal();
</del><span class="cx"> 
</span><span class="cx">         RegisterID&amp; registerFor(int index)
</span><span class="cx">         {
</span><span class="lines">@@ -650,10 +539,10 @@
</span><span class="cx"> 
</span><span class="cx">         bool shouldOptimizeLocals()
</span><span class="cx">         {
</span><del>-            if (m_dynamicScopeDepth)
</del><ins>+            if (m_codeType != FunctionCode)
</ins><span class="cx">                 return false;
</span><span class="cx"> 
</span><del>-            if (m_codeType != FunctionCode)
</del><ins>+            if (m_localScopeDepth)
</ins><span class="cx">                 return false;
</span><span class="cx"> 
</span><span class="cx">             return true;
</span><span class="lines">@@ -661,7 +550,7 @@
</span><span class="cx"> 
</span><span class="cx">         bool canOptimizeNonLocals()
</span><span class="cx">         {
</span><del>-            if (m_dynamicScopeDepth)
</del><ins>+            if (m_localScopeDepth)
</ins><span class="cx">                 return false;
</span><span class="cx"> 
</span><span class="cx">             if (m_codeType == EvalCode)
</span><span class="lines">@@ -687,7 +576,6 @@
</span><span class="cx">         SharedSymbolTable* m_symbolTable;
</span><span class="cx"> 
</span><span class="cx">         ScopeNode* m_scopeNode;
</span><del>-        Strong&lt;JSScope&gt; m_scope;
</del><span class="cx">         Strong&lt;UnlinkedCodeBlock&gt; m_codeBlock;
</span><span class="cx"> 
</span><span class="cx">         // Some of these objects keep pointers to one another. They are arranged
</span><span class="lines">@@ -706,7 +594,7 @@
</span><span class="cx">         LabelScopeStore m_labelScopes;
</span><span class="cx">         RefPtr&lt;RegisterID&gt; m_lastVar;
</span><span class="cx">         int m_finallyDepth;
</span><del>-        int m_dynamicScopeDepth;
</del><ins>+        int m_localScopeDepth;
</ins><span class="cx">         CodeType m_codeType;
</span><span class="cx"> 
</span><span class="cx">         Vector&lt;ControlFlowContext, 0, UnsafeVectorOverflow&gt; m_scopeContextStack;
</span><span class="lines">@@ -736,75 +624,6 @@
</span><span class="cx">         NumberMap m_numberMap;
</span><span class="cx">         IdentifierStringMap m_stringMap;
</span><span class="cx"> 
</span><del>-        uint32_t getResolveOperations(const Identifier&amp; property)
-        {
-            if (m_dynamicScopeDepth)
-                return m_codeBlock-&gt;addResolve();
-            IdentifierResolveMap::AddResult result = m_resolveCacheMap.add(property.impl(), 0);
-            if (result.isNewEntry)
-                result.iterator-&gt;value = m_codeBlock-&gt;addResolve();
-            return result.iterator-&gt;value;
-        }
-
-        uint32_t getResolveWithThisOperations(const Identifier&amp; property)
-        {
-            if (m_dynamicScopeDepth)
-                return m_codeBlock-&gt;addResolve();
-            IdentifierResolveMap::AddResult result = m_resolveWithThisCacheMap.add(property.impl(), 0);
-            if (result.isNewEntry)
-                result.iterator-&gt;value = m_codeBlock-&gt;addResolve();
-            return result.iterator-&gt;value;
-        }
-
-        uint32_t getResolveBaseOperations(IdentifierResolvePutMap&amp; map, const Identifier&amp; property, uint32_t&amp; putToBaseOperation)
-        {
-            if (m_dynamicScopeDepth) {
-                putToBaseOperation = m_codeBlock-&gt;addPutToBase();
-                return m_codeBlock-&gt;addResolve();
-            }
-            ResolveCacheEntry entry = {-1, -1};
-            IdentifierResolvePutMap::AddResult result = map.add(property.impl(), entry);
-            if (result.isNewEntry)
-                result.iterator-&gt;value.resolveOperations = m_codeBlock-&gt;addResolve();
-            if (result.iterator-&gt;value.putOperations == -1)
-                result.iterator-&gt;value.putOperations = getPutToBaseOperation(property);
-            putToBaseOperation = result.iterator-&gt;value.putOperations;
-            return result.iterator-&gt;value.resolveOperations;
-        }
-
-        uint32_t getResolveBaseOperations(const Identifier&amp; property)
-        {
-            uint32_t scratch;
-            return getResolveBaseOperations(m_resolveBaseMap, property, scratch);
-        }
-
-        uint32_t getResolveBaseForPutOperations(const Identifier&amp; property, uint32_t&amp; putToBaseOperation)
-        {
-            return getResolveBaseOperations(m_resolveBaseForPutMap, property, putToBaseOperation);
-        }
-
-        uint32_t getResolveWithBaseForPutOperations(const Identifier&amp; property, uint32_t&amp; putToBaseOperation)
-        {
-            return getResolveBaseOperations(m_resolveWithBaseForPutMap, property, putToBaseOperation);
-        }
-
-        uint32_t getPutToBaseOperation(const Identifier&amp; property)
-        {
-            if (m_dynamicScopeDepth)
-                return m_codeBlock-&gt;addPutToBase();
-            IdentifierResolveMap::AddResult result = m_putToBaseMap.add(property.impl(), 0);
-            if (result.isNewEntry)
-                result.iterator-&gt;value = m_codeBlock-&gt;addPutToBase();
-            return result.iterator-&gt;value;
-        }
-
-        IdentifierResolveMap m_putToBaseMap;
-        IdentifierResolveMap m_resolveCacheMap;
-        IdentifierResolveMap m_resolveWithThisCacheMap;
-        IdentifierResolvePutMap m_resolveBaseMap;
-        IdentifierResolvePutMap m_resolveBaseForPutMap;
-        IdentifierResolvePutMap m_resolveWithBaseForPutMap;
-
</del><span class="cx">         StaticPropertyAnalyzer m_staticPropertyAnalyzer;
</span><span class="cx"> 
</span><span class="cx">         VM* m_vm;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -141,20 +141,20 @@
</span><span class="cx"> 
</span><span class="cx"> bool ResolveNode::isPure(BytecodeGenerator&amp; generator) const
</span><span class="cx"> {
</span><del>-    return generator.resolve(m_ident).isStatic();
</del><ins>+    return generator.local(m_ident).get();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
-    if (RegisterID* local = resolveResult.local()) {
</del><ins>+    if (Local local = generator.local(m_ident)) {
</ins><span class="cx">         if (dst == generator.ignoredResult())
</span><span class="cx">             return 0;
</span><del>-        return generator.moveToDestinationIfNeeded(dst, local);
</del><ins>+        return generator.moveToDestinationIfNeeded(dst, local.get());
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     generator.emitExpressionInfo(m_startOffset + m_ident.length(), m_ident.length(), 0);
</span><del>-    return generator.emitResolve(generator.finalDestination(dst), resolveResult, m_ident);
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.tempDestination(dst), m_ident);
+    return generator.emitGetFromScope(generator.finalDestination(dst), scope.get(), m_ident, ThrowIfNotFound);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ ArrayNode ------------------------------------
</span><span class="lines">@@ -407,10 +407,18 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;RegisterID&gt; func = generator.tempDestination(dst);
</del><ins>+    if (Local local = generator.local(generator.propertyNames().eval)) {
+        RefPtr&lt;RegisterID&gt; func = generator.emitMove(generator.tempDestination(dst), local.get());
+        CallArguments callArguments(generator, m_args);
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+        return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());
+    }
+
+    RefPtr&lt;RegisterID&gt; func = generator.newTemporary();
</ins><span class="cx">     CallArguments callArguments(generator, m_args);
</span><span class="cx">     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
</span><del>-    generator.emitResolveWithThis(callArguments.thisRegister(), func.get(), generator.resolve(generator.propertyNames().eval), generator.propertyNames().eval);
</del><ins>+    generator.emitResolveScope(callArguments.thisRegister(), generator.propertyNames().eval);
+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), generator.propertyNames().eval, ThrowIfNotFound);
</ins><span class="cx">     return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -430,10 +438,9 @@
</span><span class="cx"> RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><span class="cx">     ExpectedFunction expectedFunction = generator.expectedFunctionForIdentifier(m_ident);
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
</del><span class="cx"> 
</span><del>-    if (RegisterID* local = resolveResult.local()) {
-        RefPtr&lt;RegisterID&gt; func = generator.emitMove(generator.tempDestination(dst), local);
</del><ins>+    if (Local local = generator.local(m_ident)) {
+        RefPtr&lt;RegisterID&gt; func = generator.emitMove(generator.tempDestination(dst), local.get());
</ins><span class="cx">         RefPtr&lt;RegisterID&gt; returnValue = generator.finalDestination(dst, func.get());
</span><span class="cx">         CallArguments callArguments(generator, m_args);
</span><span class="cx">         generator.emitLoad(callArguments.thisRegister(), jsUndefined());
</span><span class="lines">@@ -442,22 +449,12 @@
</span><span class="cx">         return generator.emitCall(returnValue.get(), func.get(), NoExpectedFunction, callArguments, divot(), startOffset(), endOffset());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic()) {
-        RefPtr&lt;RegisterID&gt; func = generator.newTemporary();
-        RefPtr&lt;RegisterID&gt; returnValue = generator.finalDestination(dst, func.get());
-        CallArguments callArguments(generator, m_args);
-        generator.emitGetStaticVar(func.get(), resolveResult, m_ident);
-        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
-        return generator.emitCall(returnValue.get(), func.get(), expectedFunction, callArguments, divot(), startOffset(), endOffset());
-    }
-
</del><span class="cx">     RefPtr&lt;RegisterID&gt; func = generator.newTemporary();
</span><span class="cx">     RefPtr&lt;RegisterID&gt; returnValue = generator.finalDestination(dst, func.get());
</span><span class="cx">     CallArguments callArguments(generator, m_args);
</span><del>-    int identifierStart = divot() - startOffset();
-
-    generator.emitExpressionInfo(identifierStart + m_ident.length(), m_ident.length(), 0);
-    generator.emitResolveWithThis(callArguments.thisRegister(), func.get(), resolveResult, m_ident);
</del><ins>+    generator.emitExpressionInfo(divot() - startOffset() + m_ident.length(), m_ident.length(), 0);
+    generator.emitResolveScope(callArguments.thisRegister(), m_ident);
+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), m_ident, ThrowIfNotFound);
</ins><span class="cx">     return generator.emitCall(returnValue.get(), func.get(), expectedFunction, callArguments, divot(), startOffset(), endOffset());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -631,29 +628,19 @@
</span><span class="cx">     ResolveNode* resolve = static_cast&lt;ResolveNode*&gt;(m_expr);
</span><span class="cx">     const Identifier&amp; ident = resolve-&gt;identifier();
</span><span class="cx"> 
</span><del>-    ResolveResult resolveResult = generator.resolve(ident);
-
-    if (RefPtr&lt;RegisterID&gt; local = resolveResult.local()) {
-        if (resolveResult.isReadOnly()) {
</del><ins>+    if (Local local = generator.local(ident)) {
+        if (local.isReadOnly()) {
</ins><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><del>-            local = generator.emitMove(generator.tempDestination(dst), local.get());
</del><ins>+            local = Local(generator.emitMove(generator.tempDestination(dst), local.get()), 0);
</ins><span class="cx">         }
</span><span class="cx">         return emitPostIncOrDec(generator, generator.finalDestination(dst), local.get(), m_operator);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic() &amp;&amp; !resolveResult.isReadOnly()) {
-        RefPtr&lt;RegisterID&gt; value = generator.emitGetStaticVar(generator.newTemporary(), resolveResult, ident);
-        RefPtr&lt;RegisterID&gt; oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        generator.emitPutStaticVar(resolveResult, ident, value.get());
-        return oldValue.get();
-    }
-
</del><span class="cx">     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
</span><del>-    RefPtr&lt;RegisterID&gt; value = generator.newTemporary();
-    NonlocalResolveInfo resolveInfo;
-    RefPtr&lt;RegisterID&gt; base = generator.emitResolveWithBaseForPut(generator.newTemporary(), value.get(), resolveResult, ident, resolveInfo);
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.newTemporary(), ident);
+    RefPtr&lt;RegisterID&gt; value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), ident, ThrowIfNotFound);
</ins><span class="cx">     RefPtr&lt;RegisterID&gt; oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
</span><del>-    generator.emitPutToBase(base.get(), ident, value.get(), resolveInfo);
</del><ins>+    generator.emitPutToScope(scope.get(), ident, value.get(), ThrowIfNotFound);
</ins><span class="cx">     return oldValue.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -718,13 +705,12 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
-    if (resolveResult.isRegister())
</del><ins>+    if (generator.local(m_ident).get())
</ins><span class="cx">         return generator.emitLoad(generator.finalDestination(dst), false);
</span><span class="cx"> 
</span><span class="cx">     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
</span><del>-    RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), resolveResult, m_ident);
-    return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
</del><ins>+    RefPtr&lt;RegisterID&gt; base = generator.emitResolveScope(generator.tempDestination(dst), m_ident);
+    return generator.emitDeleteById(generator.finalDestination(dst, base.get()), base.get(), m_ident);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ DeleteBracketNode -----------------------------------
</span><span class="lines">@@ -774,23 +760,17 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
-    if (RegisterID* local = resolveResult.local()) {
</del><ins>+    if (Local local = generator.local(m_ident)) {
</ins><span class="cx">         if (dst == generator.ignoredResult())
</span><span class="cx">             return 0;
</span><del>-        return generator.emitTypeOf(generator.finalDestination(dst), local);
</del><ins>+        return generator.emitTypeOf(generator.finalDestination(dst), local.get());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic()) {
-        RefPtr&lt;RegisterID&gt; scratch = generator.emitGetStaticVar(generator.tempDestination(dst), resolveResult, m_ident);
-        return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
-    }
-
-    RefPtr&lt;RegisterID&gt; scratch = generator.emitResolveBase(generator.tempDestination(dst), resolveResult, m_ident);
-    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.tempDestination(dst), m_ident);
+    RefPtr&lt;RegisterID&gt; value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), m_ident, DoNotThrowIfNotFound);
</ins><span class="cx">     if (dst == generator.ignoredResult())
</span><span class="cx">         return 0;
</span><del>-    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
</del><ins>+    return generator.emitTypeOf(generator.finalDestination(dst, scope.get()), value.get());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ TypeOfValueNode -----------------------------------
</span><span class="lines">@@ -813,30 +793,21 @@
</span><span class="cx">     ResolveNode* resolve = static_cast&lt;ResolveNode*&gt;(m_expr);
</span><span class="cx">     const Identifier&amp; ident = resolve-&gt;identifier();
</span><span class="cx"> 
</span><del>-    ResolveResult resolveResult = generator.resolve(ident);
-    if (RefPtr&lt;RegisterID&gt; local = resolveResult.local()) {
-        if (resolveResult.isReadOnly()) {
</del><ins>+    if (Local local = generator.local(ident)) {
+        if (local.isReadOnly()) {
</ins><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><del>-            local = generator.emitMove(generator.tempDestination(dst), local.get());
</del><ins>+            local = Local(generator.emitMove(generator.tempDestination(dst), local.get()), 0);
</ins><span class="cx">         }
</span><span class="cx">         emitIncOrDec(generator, local.get(), m_operator);
</span><span class="cx">         return generator.moveToDestinationIfNeeded(dst, local.get());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic() &amp;&amp; !resolveResult.isReadOnly()) {
-        RefPtr&lt;RegisterID&gt; propDst = generator.emitGetStaticVar(generator.tempDestination(dst), resolveResult, ident);
-        emitIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutStaticVar(resolveResult, ident, propDst.get());
-        return generator.moveToDestinationIfNeeded(dst, propDst.get());
-    }
-
</del><span class="cx">     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
</span><del>-    RefPtr&lt;RegisterID&gt; propDst = generator.tempDestination(dst);
-    NonlocalResolveInfo resolveVerifier;
-    RefPtr&lt;RegisterID&gt; base = generator.emitResolveWithBaseForPut(generator.newTemporary(), propDst.get(), resolveResult, ident, resolveVerifier);
-    emitIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutToBase(base.get(), ident, propDst.get(), resolveVerifier);
-    return generator.moveToDestinationIfNeeded(dst, propDst.get());
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.tempDestination(dst), ident);
+    RefPtr&lt;RegisterID&gt; value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), ident, ThrowIfNotFound);
+    emitIncOrDec(generator, value.get(), m_operator);
+    generator.emitPutToScope(scope.get(), ident, value.get(), ThrowIfNotFound);
+    return generator.moveToDestinationIfNeeded(dst, value.get());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RegisterID* PrefixNode::emitBracket(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="lines">@@ -1304,71 +1275,50 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
-
-    if (RegisterID *local = resolveResult.local()) {
-        if (resolveResult.isReadOnly()) {
</del><ins>+    if (Local local = generator.local(m_ident)) {
+        if (local.isReadOnly()) {
</ins><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><del>-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</del><ins>+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right-&gt;isPure(generator))) {
</span><span class="cx">             RefPtr&lt;RegisterID&gt; result = generator.newTemporary();
</span><del>-            generator.emitMove(result.get(), local);
</del><ins>+            generator.emitMove(result.get(), local.get());
</ins><span class="cx">             emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</span><del>-            generator.emitMove(local, result.get());
</del><ins>+            generator.emitMove(local.get(), result.get());
</ins><span class="cx">             return generator.moveToDestinationIfNeeded(dst, result.get());
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</del><ins>+        RegisterID* result = emitReadModifyAssignment(generator, local.get(), local.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</ins><span class="cx">         return generator.moveToDestinationIfNeeded(dst, result);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic() &amp;&amp; !resolveResult.isReadOnly()) {
-        RefPtr&lt;RegisterID&gt; src1 = generator.emitGetStaticVar(generator.tempDestination(dst), resolveResult, m_ident);
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
-        generator.emitPutStaticVar(resolveResult, m_ident, result);
-        return result;
-    }
-
-    RefPtr&lt;RegisterID&gt; src1 = generator.tempDestination(dst);
</del><span class="cx">     generator.emitExpressionInfo(divot() - startOffset() + m_ident.length(), m_ident.length(), 0);
</span><del>-    NonlocalResolveInfo resolveVerifier;
-    RefPtr&lt;RegisterID&gt; base = generator.emitResolveWithBaseForPut(generator.newTemporary(), src1.get(), resolveResult, m_ident, resolveVerifier);
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()), this);
-    return generator.emitPutToBase(base.get(), m_ident, result, resolveVerifier);
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
+    RefPtr&lt;RegisterID&gt; value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), m_ident, ThrowIfNotFound);
+    RefPtr&lt;RegisterID&gt; result = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()), this);
+    return generator.emitPutToScope(scope.get(), m_ident, result.get(), ThrowIfNotFound);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ AssignResolveNode -----------------------------------
</span><span class="cx"> 
</span><span class="cx"> RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolve(m_ident);
-
-    if (RegisterID* local = resolveResult.local()) {
-        if (resolveResult.isReadOnly()) {
</del><ins>+    if (Local local = generator.local(m_ident)) {
+        if (local.isReadOnly()) {
</ins><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx">             return generator.emitNode(dst, m_right);
</span><span class="cx">         }
</span><del>-        RegisterID* result = generator.emitNode(local, m_right);
</del><ins>+        RegisterID* result = generator.emitNode(local.get(), m_right);
</ins><span class="cx">         return generator.moveToDestinationIfNeeded(dst, result);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (resolveResult.isStatic() &amp;&amp; !resolveResult.isReadOnly()) {
-        if (dst == generator.ignoredResult())
-            dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right);
-        generator.emitPutStaticVar(resolveResult, m_ident, value);
-        return value;
-    }
-
-    NonlocalResolveInfo resolveVerifier;
-    RefPtr&lt;RegisterID&gt; base = generator.emitResolveBaseForPut(generator.newTemporary(), resolveResult, m_ident, resolveVerifier);
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
</ins><span class="cx">     if (dst == generator.ignoredResult())
</span><span class="cx">         dst = 0;
</span><del>-    RegisterID* value = generator.emitNode(dst, m_right);
</del><ins>+    RefPtr&lt;RegisterID&gt; result = generator.emitNode(dst, m_right);
</ins><span class="cx">     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
</span><del>-    return generator.emitPutToBase(base.get(), m_ident, value, resolveVerifier);
</del><ins>+    return generator.emitPutToScope(scope.get(), m_ident, result.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ AssignDotNode -----------------------------------
</span><span class="lines">@@ -1451,10 +1401,8 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator&amp; generator)
</span><span class="cx"> {
</span><del>-    ResolveResult resolveResult = generator.resolveConstDecl(m_ident);
-
</del><span class="cx">     // FIXME: This code does not match the behavior of const in Firefox.
</span><del>-    if (RegisterID* local = resolveResult.local()) {
</del><ins>+    if (RegisterID* local = generator.constLocal(m_ident).get()) {
</ins><span class="cx">         if (!m_init)
</span><span class="cx">             return local;
</span><span class="cx"> 
</span><span class="lines">@@ -1470,8 +1418,8 @@
</span><span class="cx">         return value.get();
</span><span class="cx"> 
</span><span class="cx">     // FIXME: This will result in incorrect assignment if m_ident exists in an intervening with scope.
</span><del>-    RefPtr&lt;RegisterID&gt; base = generator.emitResolveBase(generator.newTemporary(), resolveResult, m_ident);
-    return generator.emitPutById(base.get(), m_ident, value.get());
</del><ins>+    RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
+    return generator.emitPutToScope(scope.get(), m_ident, value.get(), DoNotThrowIfNotFound);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID*)
</span><span class="lines">@@ -1735,16 +1683,14 @@
</span><span class="cx">     bool optimizedForinAccess = false;
</span><span class="cx">     if (m_lexpr-&gt;isResolveNode()) {
</span><span class="cx">         const Identifier&amp; ident = static_cast&lt;ResolveNode*&gt;(m_lexpr)-&gt;identifier();
</span><del>-        ResolveResult resolveResult = generator.resolve(ident);
-        propertyName = resolveResult.local();
</del><ins>+        Local local = generator.local(ident);
+        propertyName = local.get();
</ins><span class="cx">         if (!propertyName) {
</span><span class="cx">             propertyName = generator.newTemporary();
</span><span class="cx">             RefPtr&lt;RegisterID&gt; protect = propertyName;
</span><del>-            NonlocalResolveInfo resolveVerifier;
-            RegisterID* base = generator.emitResolveBaseForPut(generator.newTemporary(), resolveResult, ident, resolveVerifier);
-
</del><ins>+            RegisterID* scope = generator.emitResolveScope(generator.newTemporary(), ident);
</ins><span class="cx">             generator.emitExpressionInfo(divot(), startOffset(), endOffset());
</span><del>-            generator.emitPutToBase(base, ident, propertyName, resolveVerifier);
</del><ins>+            generator.emitPutToScope(scope, ident, propertyName, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
</ins><span class="cx">         } else {
</span><span class="cx">             expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
</span><span class="cx">             generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGAbstractStatecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGAbstractState.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGAbstractState.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGAbstractState.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1263,15 +1263,15 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case GetScopeRegisters:
</del><ins>+    case GetClosureRegisters:
</ins><span class="cx">         forNode(node).clear(); // The result is not a JS value.
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case GetScopedVar:
</del><ins>+    case GetClosureVar:
</ins><span class="cx">         forNode(node).makeTop();
</span><span class="cx">         break;
</span><span class="cx">             
</span><del>-    case PutScopedVar:
</del><ins>+    case PutClosureVar:
</ins><span class="cx">         clobberCapturedVars(node-&gt;codeOrigin);
</span><span class="cx">         break;
</span><span class="cx">             
</span><span class="lines">@@ -1522,11 +1522,11 @@
</span><span class="cx">         break;
</span><span class="cx">         
</span><span class="cx">     case GlobalVarWatchpoint:
</span><ins>+    case VarInjectionWatchpoint:
</ins><span class="cx">         node-&gt;setCanExit(true);
</span><span class="cx">         break;
</span><span class="cx">             
</span><span class="cx">     case PutGlobalVar:
</span><del>-    case PutGlobalVarCheck:
</del><span class="cx">         break;
</span><span class="cx">             
</span><span class="cx">     case CheckHasInstance:
</span><span class="lines">@@ -1548,20 +1548,11 @@
</span><span class="cx">             
</span><span class="cx">     case Call:
</span><span class="cx">     case Construct:
</span><del>-    case Resolve:
-    case ResolveBase:
-    case ResolveBaseStrictPut:
-    case ResolveGlobal:
</del><span class="cx">         node-&gt;setCanExit(true);
</span><span class="cx">         clobberWorld(node-&gt;codeOrigin, indexInBlock);
</span><span class="cx">         forNode(node).makeTop();
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case GarbageValue:
-        clobberWorld(node-&gt;codeOrigin, indexInBlock);
-        forNode(node).makeTop();
-        break;
-
</del><span class="cx">     case ForceOSRExit:
</span><span class="cx">     case ForwardForceOSRExit:
</span><span class="cx">         node-&gt;setCanExit(true);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -38,7 +38,6 @@
</span><span class="cx"> #include &quot;Operations.h&quot;
</span><span class="cx"> #include &quot;PreciseJumpTargets.h&quot;
</span><span class="cx"> #include &quot;PutByIdStatus.h&quot;
</span><del>-#include &quot;ResolveGlobalStatus.h&quot;
</del><span class="cx"> #include &quot;StringConstructor.h&quot;
</span><span class="cx"> #include &lt;wtf/CommaPrinter.h&gt;
</span><span class="cx"> #include &lt;wtf/HashMap.h&gt;
</span><span class="lines">@@ -138,7 +137,6 @@
</span><span class="cx">         , m_preservedVars(m_codeBlock-&gt;m_numVars)
</span><span class="cx">         , m_parameterSlots(0)
</span><span class="cx">         , m_numPassedVarArgs(0)
</span><del>-        , m_globalResolveNumber(0)
</del><span class="cx">         , m_inlineStackTop(0)
</span><span class="cx">         , m_haveBuiltOperandMaps(false)
</span><span class="cx">         , m_emptyJSValueIndex(UINT_MAX)
</span><span class="lines">@@ -169,6 +167,7 @@
</span><span class="cx">     // Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.
</span><span class="cx">     bool handleIntrinsic(int resultOperand, Intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction);
</span><span class="cx">     bool handleConstantInternalFunction(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, CodeSpecializationKind);
</span><ins>+    Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, Node* value);
</ins><span class="cx">     Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset);
</span><span class="cx">     void handleGetByOffset(
</span><span class="cx">         int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber,
</span><span class="lines">@@ -179,9 +178,6 @@
</span><span class="cx"> 
</span><span class="cx">     Node* getScope(bool skipTop, unsigned skipCount);
</span><span class="cx">     
</span><del>-    // Convert a set of ResolveOperations into graph nodes
-    bool parseResolveOperations(SpeculatedType, unsigned identifierNumber, ResolveOperations*, PutToBaseOperation*, Node** base, Node** value);
-
</del><span class="cx">     // Prepare to parse a block.
</span><span class="cx">     void prepareToParseBlock();
</span><span class="cx">     // Parse a single basic block of bytecode instructions.
</span><span class="lines">@@ -252,17 +248,6 @@
</span><span class="cx">         setDirect(m_inlineStackTop-&gt;remapOperand(operand), value, setMode);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    void setPair(int operand1, Node* value1, int operand2, Node* value2)
-    {
-        // First emit dead SetLocals for the benefit of OSR.
-        set(operand1, value1);
-        set(operand2, value2);
-        
-        // Now emit the real SetLocals.
-        set(operand1, value1);
-        set(operand2, value2);
-    }
-    
</del><span class="cx">     Node* injectLazyOperandSpeculation(Node* node)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(node-&gt;op() == GetLocal);
</span><span class="lines">@@ -780,7 +765,7 @@
</span><span class="cx">         return call;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    Node* addStructureTransitionCheck(JSCell* object, Structure* structure)
</del><ins>+    Node* cellConstantWithStructureCheck(JSCell* object, Structure* structure)
</ins><span class="cx">     {
</span><span class="cx">         // Add a weak JS constant for the object regardless, since the code should
</span><span class="cx">         // be jettisoned if the object ever dies.
</span><span class="lines">@@ -793,15 +778,14 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structure)), objectNode);
</span><del>-        
</del><span class="cx">         return objectNode;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    Node* addStructureTransitionCheck(JSCell* object)
</del><ins>+    Node* cellConstantWithStructureCheck(JSCell* object)
</ins><span class="cx">     {
</span><del>-        return addStructureTransitionCheck(object, object-&gt;structure());
</del><ins>+        return cellConstantWithStructureCheck(object, object-&gt;structure());
</ins><span class="cx">     }
</span><del>-    
</del><ins>+
</ins><span class="cx">     SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
</span><span class="cx">     {
</span><span class="cx">         ConcurrentJITLocker locker(m_inlineStackTop-&gt;m_profiledBlock-&gt;m_lock);
</span><span class="lines">@@ -1016,8 +1000,6 @@
</span><span class="cx">     unsigned m_parameterSlots;
</span><span class="cx">     // The number of var args passed to the next var arg node.
</span><span class="cx">     unsigned m_numPassedVarArgs;
</span><del>-    // The index in the global resolve info.
-    unsigned m_globalResolveNumber;
</del><span class="cx"> 
</span><span class="cx">     struct PhiStackEntry {
</span><span class="cx">         PhiStackEntry(BasicBlock* block, Node* phi, unsigned varNo)
</span><span class="lines">@@ -1664,6 +1646,23 @@
</span><span class="cx">     set(destinationOperand, handleGetByOffset(prediction, base, identifierNumber, offset));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+Node* ByteCodeParser::handlePutByOffset(Node* base, unsigned identifier, PropertyOffset offset, Node* value)
+{
+    Node* propertyStorage;
+    if (isInlineOffset(offset))
+        propertyStorage = base;
+    else
+        propertyStorage = addToGraph(GetButterfly, base);
+    Node* result = addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, base, value);
+    
+    StorageAccessData storageAccessData;
+    storageAccessData.offset = indexRelativeToBase(offset);
+    storageAccessData.identifierNumber = identifier;
+    m_graph.m_storageAccessData.append(storageAccessData);
+
+    return result;
+}
+
</ins><span class="cx"> void ByteCodeParser::handleGetById(
</span><span class="cx">     int destinationOperand, SpeculatedType prediction, Node* base, unsigned identifierNumber,
</span><span class="cx">     const GetByIdStatus&amp; getByIdStatus)
</span><span class="lines">@@ -1696,7 +1695,7 @@
</span><span class="cx">         for (unsigned i = 0; i &lt; getByIdStatus.chain()-&gt;size(); ++i) {
</span><span class="cx">             currentObject = asObject(currentStructure-&gt;prototypeForLookup(m_inlineStackTop-&gt;m_codeBlock));
</span><span class="cx">             currentStructure = getByIdStatus.chain()-&gt;at(i);
</span><del>-            base = addStructureTransitionCheck(currentObject, currentStructure);
</del><ins>+            base = cellConstantWithStructureCheck(currentObject, currentStructure);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1744,175 +1743,6 @@
</span><span class="cx">     return localBase;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ByteCodeParser::parseResolveOperations(SpeculatedType prediction, unsigned identifier, ResolveOperations* resolveOperations, PutToBaseOperation* putToBaseOperation, Node** base, Node** value)
-{
-    {
-        ConcurrentJITLocker locker(m_inlineStackTop-&gt;m_profiledBlock-&gt;m_lock);
-     
-        if (!resolveOperations-&gt;m_ready) {
-            addToGraph(ForceOSRExit);
-            return false;
-        }
-    }
-
-    ASSERT(!resolveOperations-&gt;isEmpty());
-
-    JSGlobalObject* globalObject = m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject();
-    int skipCount = 0;
-    bool skipTop = false;
-    bool skippedScopes = false;
-    bool setBase = false;
-    ResolveOperation* pc = resolveOperations-&gt;data();
-    Node* localBase = 0;
-    bool resolvingBase = true;
-    while (resolvingBase) {
-        switch (pc-&gt;m_operation) {
-        case ResolveOperation::ReturnGlobalObjectAsBase:
-            *base = cellConstant(globalObject);
-            ASSERT(!value);
-            return true;
-
-        case ResolveOperation::SetBaseToGlobal:
-            *base = cellConstant(globalObject);
-            setBase = true;
-            resolvingBase = false;
-            ++pc;
-            break;
-
-        case ResolveOperation::SetBaseToUndefined:
-            *base = constantUndefined();
-            setBase = true;
-            resolvingBase = false;
-            ++pc;
-            break;
-
-        case ResolveOperation::SetBaseToScope:
-            localBase = getScope(skipTop, skipCount);
-            *base = localBase;
-            setBase = true;
-
-            resolvingBase = false;
-
-            // Reset the scope skipping as we've already loaded it
-            skippedScopes = false;
-            ++pc;
-            break;
-        case ResolveOperation::ReturnScopeAsBase:
-            *base = getScope(skipTop, skipCount);
-            ASSERT(!value);
-            return true;
-
-        case ResolveOperation::SkipTopScopeNode:
-            ASSERT(!inlineCallFrame());
-            skipTop = true;
-            skippedScopes = true;
-            ++pc;
-            break;
-
-        case ResolveOperation::SkipScopes:
-            skipCount += pc-&gt;m_scopesToSkip;
-            skippedScopes = true;
-            ++pc;
-            break;
-
-        case ResolveOperation::CheckForDynamicEntriesBeforeGlobalScope:
-            return false;
-
-        case ResolveOperation::Fail:
-            return false;
-
-        default:
-            resolvingBase = false;
-        }
-    }
-    if (skippedScopes)
-        localBase = getScope(skipTop, skipCount);
-
-    if (base &amp;&amp; !setBase)
-        *base = localBase;
-
-    ASSERT(value);
-    ResolveOperation* resolveValueOperation = pc;
-    switch (resolveValueOperation-&gt;m_operation) {
-    case ResolveOperation::GetAndReturnGlobalProperty: {
-        ResolveGlobalStatus status = ResolveGlobalStatus::computeFor(m_inlineStackTop-&gt;m_profiledBlock, m_currentIndex, resolveValueOperation, m_graph.identifiers()[identifier]);
-        if (status.isSimple()) {
-            ASSERT(status.structure());
-
-            Node* globalObjectNode = addStructureTransitionCheck(globalObject, status.structure());
-
-            if (status.specificValue()) {
-                ASSERT(status.specificValue().isCell());
-                *value = cellConstant(status.specificValue().asCell());
-            } else
-                *value = handleGetByOffset(prediction, globalObjectNode, identifier, status.offset());
-            return true;
-        }
-
-        Node* resolve = addToGraph(ResolveGlobal, OpInfo(m_graph.m_resolveGlobalData.size()), OpInfo(prediction));
-        m_graph.m_resolveGlobalData.append(ResolveGlobalData());
-        ResolveGlobalData&amp; data = m_graph.m_resolveGlobalData.last();
-        data.identifierNumber = identifier;
-        data.resolveOperations = resolveOperations;
-        data.putToBaseOperation = putToBaseOperation;
-        data.resolvePropertyIndex = resolveValueOperation - resolveOperations-&gt;data();
-        *value = resolve;
-        return true;
-    }
-    case ResolveOperation::GetAndReturnGlobalVar: {
-        *value = addToGraph(
-            GetGlobalVar,
-            OpInfo(globalObject-&gt;assertRegisterIsInThisObject(pc-&gt;m_registerAddress)),
-            OpInfo(prediction));
-        return true;
-    }
-    case ResolveOperation::GetAndReturnGlobalVarWatchable: {
-        SpeculatedType prediction = getPrediction();
-
-        JSGlobalObject* globalObject = m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject();
-
-        StringImpl* uid = m_graph.identifiers()[identifier];
-        SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(uid);
-        if (!m_graph.watchpoints().isStillValid(entry.watchpointSet())) {
-            *value = addToGraph(GetGlobalVar, OpInfo(globalObject-&gt;assertRegisterIsInThisObject(pc-&gt;m_registerAddress)), OpInfo(prediction));
-            return true;
-        }
-
-        // The watchpoint is still intact! This means that we will get notified if the
-        // current value in the global variable changes. So, we can inline that value.
-        // Moreover, currently we can assume that this value is a JSFunction*, which
-        // implies that it's a cell. This simplifies things, since in general we'd have
-        // to use a JSConstant for non-cells and a WeakJSConstant for cells. So instead
-        // of having both cases we just assert that the value is a cell.
-
-        // NB. If it wasn't for CSE, GlobalVarWatchpoint would have no need for the
-        // register pointer. But CSE tracks effects on global variables by comparing
-        // register pointers. Because CSE executes multiple times while the backend
-        // executes once, we use the following performance trade-off:
-        // - The node refers directly to the register pointer to make CSE super cheap.
-        // - To perform backend code generation, the node only contains the identifier
-        //   number, from which it is possible to get (via a few average-time O(1)
-        //   lookups) to the WatchpointSet.
-
-        addToGraph(GlobalVarWatchpoint, OpInfo(globalObject-&gt;assertRegisterIsInThisObject(pc-&gt;m_registerAddress)), OpInfo(identifier));
-
-        JSValue specificValue = globalObject-&gt;registerAt(entry.getIndex()).get();
-        ASSERT(specificValue.isCell());
-        *value = cellConstant(specificValue.asCell());
-        return true;
-    }
-    case ResolveOperation::GetAndReturnScopedVar: {
-        Node* getScopeRegisters = addToGraph(GetScopeRegisters, localBase);
-        *value = addToGraph(GetScopedVar, OpInfo(resolveValueOperation-&gt;m_offset), OpInfo(prediction), getScopeRegisters);
-        return true;
-    }
-    default:
-        CRASH();
-        return false;
-    }
-
-}
-
</del><span class="cx"> bool ByteCodeParser::parseBlock(unsigned limit)
</span><span class="cx"> {
</span><span class="cx">     bool shouldContinueParsing = true;
</span><span class="lines">@@ -2565,17 +2395,7 @@
</span><span class="cx">             
</span><span class="cx">             if (!hasExitSite &amp;&amp; putByIdStatus.isSimpleReplace()) {
</span><span class="cx">                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putByIdStatus.oldStructure())), base);
</span><del>-                Node* propertyStorage;
-                if (isInlineOffset(putByIdStatus.offset()))
-                    propertyStorage = base;
-                else
-                    propertyStorage = addToGraph(GetButterfly, base);
-                addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, base, value);
-                
-                StorageAccessData storageAccessData;
-                storageAccessData.offset = indexRelativeToBase(putByIdStatus.offset());
-                storageAccessData.identifierNumber = identifierNumber;
-                m_graph.m_storageAccessData.append(storageAccessData);
</del><ins>+                handlePutByOffset(base, identifierNumber, putByIdStatus.offset(), value);
</ins><span class="cx">             } else if (
</span><span class="cx">                 !hasExitSite
</span><span class="cx">                 &amp;&amp; putByIdStatus.isSimpleTransition()
</span><span class="lines">@@ -2587,7 +2407,7 @@
</span><span class="cx">                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putByIdStatus.oldStructure())), base);
</span><span class="cx">                 if (!direct) {
</span><span class="cx">                     if (!putByIdStatus.oldStructure()-&gt;storedPrototype().isNull()) {
</span><del>-                        addStructureTransitionCheck(
</del><ins>+                        cellConstantWithStructureCheck(
</ins><span class="cx">                             putByIdStatus.oldStructure()-&gt;storedPrototype().asCell());
</span><span class="cx">                     }
</span><span class="cx">                     
</span><span class="lines">@@ -2595,8 +2415,7 @@
</span><span class="cx">                         JSValue prototype = putByIdStatus.structureChain()-&gt;at(i)-&gt;storedPrototype();
</span><span class="cx">                         if (prototype.isNull())
</span><span class="cx">                             continue;
</span><del>-                        ASSERT(prototype.isCell());
-                        addStructureTransitionCheck(prototype.asCell());
</del><ins>+                        cellConstantWithStructureCheck(prototype.asCell());
</ins><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx">                 ASSERT(putByIdStatus.oldStructure()-&gt;transitionWatchpointSetHasBeenInvalidated());
</span><span class="lines">@@ -2666,29 +2485,6 @@
</span><span class="cx">             NEXT_OPCODE(op_init_global_const);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_init_global_const_check: {
-            Node* value = get(currentInstruction[2].u.operand);
-            CodeBlock* codeBlock = m_inlineStackTop-&gt;m_codeBlock;
-            JSGlobalObject* globalObject = codeBlock-&gt;globalObject();
-            unsigned identifierNumber = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[4].u.operand];
-            StringImpl* uid = m_graph.identifiers()[identifierNumber];
-            SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(uid);
-            if (!entry.couldBeWatched()) {
-                addToGraph(
-                    PutGlobalVar,
-                    OpInfo(globalObject-&gt;assertRegisterIsInThisObject(currentInstruction[1].u.registerPointer)),
-                    value);
-                NEXT_OPCODE(op_init_global_const_check);
-            }
-            addToGraph(
-                PutGlobalVarCheck,
-                OpInfo(codeBlock-&gt;globalObject()-&gt;assertRegisterIsInThisObject(currentInstruction[1].u.registerPointer)),
-                OpInfo(identifierNumber),
-                value);
-            NEXT_OPCODE(op_init_global_const_check);
-        }
-
-
</del><span class="cx">         // === Block terminators. ===
</span><span class="cx"> 
</span><span class="cx">         case op_jmp: {
</span><span class="lines">@@ -3051,207 +2847,142 @@
</span><span class="cx">             addToGraph(Jump, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jneq_ptr)));
</span><span class="cx">             LAST_OPCODE(op_jneq_ptr);
</span><span class="cx"> 
</span><del>-        case op_get_scoped_var: {
-            SpeculatedType prediction = getPrediction();
-            int dst = currentInstruction[1].u.operand;
-            int slot = currentInstruction[2].u.operand;
-            int depth = currentInstruction[3].u.operand;
-            bool hasTopScope = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_inlineStackTop-&gt;m_codeBlock-&gt;needsFullScopeChain();
-            ASSERT(!hasTopScope || depth &gt;= 1);
-            Node* scope = getScope(hasTopScope, depth - hasTopScope);
-            Node* getScopeRegisters = addToGraph(GetScopeRegisters, scope);
-            Node* getScopedVar = addToGraph(GetScopedVar, OpInfo(slot), OpInfo(prediction), getScopeRegisters);
-            set(dst, getScopedVar);
-            NEXT_OPCODE(op_get_scoped_var);
-        }
</del><ins>+        case op_resolve_scope: {
+            unsigned dst = currentInstruction[1].u.operand;
+            ResolveType resolveType = static_cast&lt;ResolveType&gt;(currentInstruction[3].u.operand);
+            unsigned depth = currentInstruction[4].u.operand;
</ins><span class="cx"> 
</span><del>-        case op_put_scoped_var: {
-            int slot = currentInstruction[1].u.operand;
-            int depth = currentInstruction[2].u.operand;
-            int source = currentInstruction[3].u.operand;
-            bool hasTopScope = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_inlineStackTop-&gt;m_codeBlock-&gt;needsFullScopeChain();
-            ASSERT(!hasTopScope || depth &gt;= 1);
-            Node* scope = getScope(hasTopScope, depth - hasTopScope);
-            Node* scopeRegisters = addToGraph(GetScopeRegisters, scope);
-            addToGraph(PutScopedVar, OpInfo(slot), scope, scopeRegisters, get(source));
-            NEXT_OPCODE(op_put_scoped_var);
-        }
</del><ins>+            // get_from_scope and put_to_scope depend on this watchpoint forcing OSR exit, so they don't add their own watchpoints.
+            if (needsVarInjectionChecks(resolveType))
+                addToGraph(VarInjectionWatchpoint);
</ins><span class="cx"> 
</span><del>-        case op_resolve:
-        case op_resolve_global_property:
-        case op_resolve_global_var:
-        case op_resolve_scoped_var:
-        case op_resolve_scoped_var_on_top_scope:
-        case op_resolve_scoped_var_with_top_scope_check: {
-            SpeculatedType prediction = getPrediction();
-            
-            unsigned identifier = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[2].u.operand];
-            ResolveOperations* operations = currentInstruction[3].u.resolveOperations;
-            Node* value = 0;
-            if (parseResolveOperations(prediction, identifier, operations, 0, 0, &amp;value)) {
-                set(currentInstruction[1].u.operand, value);
-                NEXT_OPCODE(op_resolve);
</del><ins>+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalVar:
+            case GlobalPropertyWithVarInjectionChecks:
+            case GlobalVarWithVarInjectionChecks:
+                set(dst, cellConstant(m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject()));
+                break;
+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks:
+                set(dst, getScope(m_inlineStackTop-&gt;m_codeBlock-&gt;needsActivation(), depth));
+                break;
+            case Dynamic:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
</ins><span class="cx">             }
</span><del>-
-            Node* resolve = addToGraph(Resolve, OpInfo(m_graph.m_resolveOperationsData.size()), OpInfo(prediction));
-            m_graph.m_resolveOperationsData.append(ResolveOperationData());
-            ResolveOperationData&amp; data = m_graph.m_resolveOperationsData.last();
-            data.identifierNumber = identifier;
-            data.resolveOperations = operations;
-
-            set(currentInstruction[1].u.operand, resolve);
-
-            NEXT_OPCODE(op_resolve);
</del><ins>+            NEXT_OPCODE(op_resolve_scope);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_put_to_base_variable:
-        case op_put_to_base: {
-            unsigned base = currentInstruction[1].u.operand;
-            unsigned identifier = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[2].u.operand];
-            unsigned value = currentInstruction[3].u.operand;
-            PutToBaseOperation* putToBase = currentInstruction[4].u.putToBaseOperation;
-            
</del><ins>+        case op_get_from_scope: {
+            unsigned dst = currentInstruction[1].u.operand;
+            unsigned scope = currentInstruction[2].u.operand;
+            unsigned identifierNumber = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[3].u.operand];
+            StringImpl* uid = m_graph.identifiers()[identifierNumber];
+            ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+
+            Structure* structure;
+            uintptr_t operand;
</ins><span class="cx">             {
</span><span class="cx">                 ConcurrentJITLocker locker(m_inlineStackTop-&gt;m_profiledBlock-&gt;m_lock);
</span><del>-                
-                if (!putToBase-&gt;m_ready) {
-                    locker.unlockEarly();
-                    addToGraph(ForceOSRExit);
-                    addToGraph(Phantom, get(base));
-                    addToGraph(Phantom, get(value));
-                    NEXT_OPCODE(op_put_to_base);
-                }
</del><ins>+                structure = currentInstruction[5].u.structure.get();
+                operand = reinterpret_cast&lt;uintptr_t&gt;(currentInstruction[6].u.pointer);
</ins><span class="cx">             }
</span><span class="cx"> 
</span><del>-            if (putToBase-&gt;m_isDynamic) {
-                addToGraph(PutById, OpInfo(identifier), get(base), get(value));
-                NEXT_OPCODE(op_put_to_base);
-            }
</del><ins>+            SpeculatedType prediction = getPrediction();
+            JSGlobalObject* globalObject = m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject();
</ins><span class="cx"> 
</span><del>-            switch (putToBase-&gt;m_kind) {
-            case PutToBaseOperation::Uninitialised:
-                addToGraph(ForceOSRExit);
-                addToGraph(Phantom, get(base));
-                addToGraph(Phantom, get(value));
-                break;
-
-            case PutToBaseOperation::GlobalVariablePutChecked: {
-                CodeBlock* codeBlock = m_inlineStackTop-&gt;m_codeBlock;
-                JSGlobalObject* globalObject = codeBlock-&gt;globalObject();
-                SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(m_graph.identifiers()[identifier]);
-                if (entry.couldBeWatched()) {
-                    addToGraph(PutGlobalVarCheck,
-                               OpInfo(codeBlock-&gt;globalObject()-&gt;assertRegisterIsInThisObject(putToBase-&gt;m_registerAddress)),
-                               OpInfo(identifier),
-                               get(value));
</del><ins>+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalPropertyWithVarInjectionChecks: {
+                GetByIdStatus status = GetByIdStatus::computeFor(*m_vm, structure, uid);
+                if (status.takesSlowPath()) {
+                    set(dst, addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(scope)));
</ins><span class="cx">                     break;
</span><span class="cx">                 }
</span><del>-            }
-            case PutToBaseOperation::GlobalVariablePut:
-                addToGraph(PutGlobalVar,
-                           OpInfo(m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject()-&gt;assertRegisterIsInThisObject(putToBase-&gt;m_registerAddress)),
-                           get(value));
</del><ins>+                Node* base = cellConstantWithStructureCheck(globalObject, status.structureSet().singletonStructure());
+                if (JSValue specificValue = status.specificValue())
+                    set(dst, cellConstant(specificValue.asCell()));
+                else
+                    set(dst, handleGetByOffset(prediction, base, identifierNumber, operand));
</ins><span class="cx">                 break;
</span><del>-            case PutToBaseOperation::VariablePut: {
-                Node* scope = get(base);
-                Node* scopeRegisters = addToGraph(GetScopeRegisters, scope);
-                addToGraph(PutScopedVar, OpInfo(putToBase-&gt;m_offset), scope, scopeRegisters, get(value));
-                break;
</del><span class="cx">             }
</span><del>-            case PutToBaseOperation::GlobalPropertyPut: {
-                if (!putToBase-&gt;m_structure) {
-                    addToGraph(ForceOSRExit);
-                    addToGraph(Phantom, get(base));
-                    addToGraph(Phantom, get(value));
-                    NEXT_OPCODE(op_put_to_base);
</del><ins>+            case GlobalVar:
+            case GlobalVarWithVarInjectionChecks: {
+                SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(uid);
+                if (!entry.couldBeWatched() || !m_graph.watchpoints().isStillValid(entry.watchpointSet())) {
+                    set(dst, addToGraph(GetGlobalVar, OpInfo(operand), OpInfo(prediction)));
+                    break;
</ins><span class="cx">                 }
</span><del>-                Node* baseNode = get(base);
-                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putToBase-&gt;m_structure.get())), baseNode);
-                Node* propertyStorage;
-                if (isInlineOffset(putToBase-&gt;m_offset))
-                    propertyStorage = baseNode;
-                else
-                    propertyStorage = addToGraph(GetButterfly, baseNode);
-                addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, baseNode, get(value));
</del><span class="cx"> 
</span><del>-                StorageAccessData storageAccessData;
-                storageAccessData.offset = indexRelativeToBase(putToBase-&gt;m_offset);
-                storageAccessData.identifierNumber = identifier;
-                m_graph.m_storageAccessData.append(storageAccessData);
</del><ins>+                addToGraph(GlobalVarWatchpoint, OpInfo(operand), OpInfo(identifierNumber));
+                JSValue specificValue = globalObject-&gt;registerAt(entry.getIndex()).get();
+                set(dst, cellConstant(specificValue.asCell()));
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><del>-            case PutToBaseOperation::Readonly:
-            case PutToBaseOperation::Generic:
-                addToGraph(PutById, OpInfo(identifier), get(base), get(value));
</del><ins>+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks:
+                set(dst, 
+                    addToGraph(GetClosureVar, OpInfo(operand), OpInfo(prediction), 
+                        addToGraph(GetClosureRegisters, get(scope))));
+                break;
+            case Dynamic:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
</ins><span class="cx">             }
</span><del>-            NEXT_OPCODE(op_put_to_base);
</del><ins>+            NEXT_OPCODE(op_get_from_scope);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_resolve_base_to_global:
-        case op_resolve_base_to_global_dynamic:
-        case op_resolve_base_to_scope:
-        case op_resolve_base_to_scope_with_top_scope_check:
-        case op_resolve_base: {
-            SpeculatedType prediction = getPrediction();
-            
-            unsigned identifier = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[2].u.operand];
-            ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-            PutToBaseOperation* putToBaseOperation = currentInstruction[5].u.putToBaseOperation;
</del><ins>+        case op_put_to_scope: {
+            unsigned scope = currentInstruction[1].u.operand;
+            unsigned identifierNumber = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[2].u.operand];
+            unsigned value = currentInstruction[3].u.operand;
+            ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+            StringImpl* uid = m_graph.identifiers()[identifierNumber];
</ins><span class="cx"> 
</span><del>-            Node* base = 0;
-            if (parseResolveOperations(prediction, identifier, operations, 0, &amp;base, 0)) {
-                set(currentInstruction[1].u.operand, base);
-                NEXT_OPCODE(op_resolve_base);
</del><ins>+            Structure* structure;
+            uintptr_t operand;
+            {
+                ConcurrentJITLocker locker(m_inlineStackTop-&gt;m_profiledBlock-&gt;m_lock);
+                structure = currentInstruction[5].u.structure.get();
+                operand = reinterpret_cast&lt;uintptr_t&gt;(currentInstruction[6].u.pointer);
</ins><span class="cx">             }
</span><span class="cx"> 
</span><del>-            Node* resolve = addToGraph(currentInstruction[3].u.operand ? ResolveBaseStrictPut : ResolveBase, OpInfo(m_graph.m_resolveOperationsData.size()), OpInfo(prediction));
-            m_graph.m_resolveOperationsData.append(ResolveOperationData());
-            ResolveOperationData&amp; data = m_graph.m_resolveOperationsData.last();
-            data.identifierNumber = identifier;
-            data.resolveOperations = operations;
-            data.putToBaseOperation = putToBaseOperation;
-        
-            set(currentInstruction[1].u.operand, resolve);
</del><ins>+            JSGlobalObject* globalObject = m_inlineStackTop-&gt;m_codeBlock-&gt;globalObject();
</ins><span class="cx"> 
</span><del>-            NEXT_OPCODE(op_resolve_base);
-        }
-        case op_resolve_with_base: {
-            SpeculatedType prediction = getPrediction();
-            unsigned baseDst = currentInstruction[1].u.operand;
-            unsigned valueDst = currentInstruction[2].u.operand;
-            unsigned identifier = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[3].u.operand];
-            ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-            PutToBaseOperation* putToBaseOperation = currentInstruction[5].u.putToBaseOperation;
-
-            Node* base = 0;
-            Node* value = 0;
-            if (parseResolveOperations(prediction, identifier, operations, putToBaseOperation, &amp;base, &amp;value))
-                setPair(baseDst, base, valueDst, value);
-            else {
-                addToGraph(ForceOSRExit);
-                setPair(baseDst, addToGraph(GarbageValue), valueDst, addToGraph(GarbageValue));
</del><ins>+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalPropertyWithVarInjectionChecks: {
+                PutByIdStatus status = PutByIdStatus::computeFor(*m_vm, globalObject, structure, uid, false);
+                if (!status.isSimpleReplace()) {
+                    addToGraph(PutById, OpInfo(identifierNumber), get(scope), get(value));
+                    break;
+                }
+                Node* base = cellConstantWithStructureCheck(globalObject, status.oldStructure());
+                handlePutByOffset(base, identifierNumber, static_cast&lt;PropertyOffset&gt;(operand), get(value));
+                break;
</ins><span class="cx">             }
</span><del>-
-            NEXT_OPCODE(op_resolve_with_base);
-        }
-        case op_resolve_with_this: {
-            SpeculatedType prediction = getPrediction();
-            unsigned baseDst = currentInstruction[1].u.operand;
-            unsigned valueDst = currentInstruction[2].u.operand;
-            unsigned identifier = m_inlineStackTop-&gt;m_identifierRemap[currentInstruction[3].u.operand];
-            ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-
-            Node* base = 0;
-            Node* value = 0;
-            if (parseResolveOperations(prediction, identifier, operations, 0, &amp;base, &amp;value))
-                setPair(baseDst, base, valueDst, value);
-            else {
-                addToGraph(ForceOSRExit);
-                setPair(baseDst, addToGraph(GarbageValue), valueDst, addToGraph(GarbageValue));
</del><ins>+            case GlobalVar:
+            case GlobalVarWithVarInjectionChecks: {
+                SymbolTableEntry entry = globalObject-&gt;symbolTable()-&gt;get(uid);
+                ASSERT(!entry.couldBeWatched() || !m_graph.watchpoints().isStillValid(entry.watchpointSet()));
+                addToGraph(PutGlobalVar, OpInfo(operand), get(value));
+                break;
</ins><span class="cx">             }
</span><del>-
-            NEXT_OPCODE(op_resolve_with_this);
</del><ins>+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks: {
+                Node* scopeNode = get(scope);
+                Node* scopeRegisters = addToGraph(GetClosureRegisters, scopeNode);
+                addToGraph(PutClosureVar, OpInfo(operand), scopeNode, scopeRegisters, get(value));
+                break;
+            }
+            case Dynamic:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            NEXT_OPCODE(op_put_to_scope);
</ins><span class="cx">         }
</span><ins>+
</ins><span class="cx">         case op_loop_hint: {
</span><span class="cx">             // Baseline-&gt;DFG OSR jumps between loop hints. The DFG assumes that Baseline-&gt;DFG
</span><span class="cx">             // OSR can only happen at basic block boundaries. Assert that these two statements
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGCSEPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -248,12 +248,12 @@
</span><span class="cx">         for (unsigned i = m_indexInBlock; i--;) {
</span><span class="cx">             Node* node = m_currentBlock-&gt;at(i);
</span><span class="cx">             switch (node-&gt;op()) {
</span><del>-            case GetScopedVar: {
</del><ins>+            case GetClosureVar: {
</ins><span class="cx">                 if (node-&gt;child1() == registers &amp;&amp; node-&gt;varNumber() == varNumber)
</span><span class="cx">                     return node;
</span><span class="cx">                 break;
</span><span class="cx">             } 
</span><del>-            case PutScopedVar: {
</del><ins>+            case PutClosureVar: {
</ins><span class="cx">                 if (node-&gt;child2() == registers &amp;&amp; node-&gt;varNumber() == varNumber)
</span><span class="cx">                     return node-&gt;child3().node();
</span><span class="cx">                 break;
</span><span class="lines">@@ -295,6 +295,18 @@
</span><span class="cx">         }
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><ins>+
+    bool varInjectionWatchpointElimination()
+    {
+        for (unsigned i = m_indexInBlock; i--;) {
+            Node* node = m_currentBlock-&gt;at(i);
+            if (node-&gt;op() == VarInjectionWatchpoint)
+                return true;
+            if (m_graph.clobbersWorld(node))
+                break;
+        }
+        return false;
+    }
</ins><span class="cx">     
</span><span class="cx">     Node* globalVarStoreElimination(WriteBarrier&lt;Unknown&gt;* registerPointer)
</span><span class="cx">     {
</span><span class="lines">@@ -302,7 +314,6 @@
</span><span class="cx">             Node* node = m_currentBlock-&gt;at(i);
</span><span class="cx">             switch (node-&gt;op()) {
</span><span class="cx">             case PutGlobalVar:
</span><del>-            case PutGlobalVarCheck:
</del><span class="cx">                 if (node-&gt;registerPointer() == registerPointer)
</span><span class="cx">                     return node;
</span><span class="cx">                 break;
</span><span class="lines">@@ -326,13 +337,13 @@
</span><span class="cx">         for (unsigned i = m_indexInBlock; i--;) {
</span><span class="cx">             Node* node = m_currentBlock-&gt;at(i);
</span><span class="cx">             switch (node-&gt;op()) {
</span><del>-            case PutScopedVar: {
</del><ins>+            case PutClosureVar: {
</ins><span class="cx">                 if (node-&gt;child1() == scope &amp;&amp; node-&gt;child2() == registers &amp;&amp; node-&gt;varNumber() == varNumber)
</span><span class="cx">                     return node;
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">                 
</span><del>-            case GetScopedVar: {
</del><ins>+            case GetClosureVar: {
</ins><span class="cx">                 // Let's be conservative.
</span><span class="cx">                 if (node-&gt;varNumber() == varNumber)
</span><span class="cx">                     return 0;
</span><span class="lines">@@ -850,7 +861,7 @@
</span><span class="cx">                 }
</span><span class="cx">                 break;
</span><span class="cx">                 
</span><del>-            case PutScopedVar:
</del><ins>+            case PutClosureVar:
</ins><span class="cx">                 if (static_cast&lt;VirtualRegister&gt;(node-&gt;varNumber()) == local)
</span><span class="cx">                     return 0;
</span><span class="cx">                 break;
</span><span class="lines">@@ -902,7 +913,7 @@
</span><span class="cx">                 return result;
</span><span class="cx">             }
</span><span class="cx">                 
</span><del>-            case GetScopedVar:
</del><ins>+            case GetClosureVar:
</ins><span class="cx">                 if (static_cast&lt;VirtualRegister&gt;(node-&gt;varNumber()) == local)
</span><span class="cx">                     result.mayBeAccessed = true;
</span><span class="cx">                 break;
</span><span class="lines">@@ -1076,7 +1087,7 @@
</span><span class="cx">         case LogicalNot:
</span><span class="cx">         case SkipTopScope:
</span><span class="cx">         case SkipScope:
</span><del>-        case GetScopeRegisters:
</del><ins>+        case GetClosureRegisters:
</ins><span class="cx">         case GetScope:
</span><span class="cx">         case TypeOf:
</span><span class="cx">         case CompareEqConstant:
</span><span class="lines">@@ -1233,7 +1244,7 @@
</span><span class="cx">             setReplacement(globalVarLoadElimination(node-&gt;registerPointer()));
</span><span class="cx">             break;
</span><span class="cx"> 
</span><del>-        case GetScopedVar: {
</del><ins>+        case GetClosureVar: {
</ins><span class="cx">             if (cseMode == StoreElimination)
</span><span class="cx">                 break;
</span><span class="cx">             setReplacement(scopedVarLoadElimination(node-&gt;child1().node(), node-&gt;varNumber()));
</span><span class="lines">@@ -1247,14 +1258,20 @@
</span><span class="cx">                 eliminate();
</span><span class="cx">             break;
</span><span class="cx">             
</span><ins>+        case VarInjectionWatchpoint:
+            if (cseMode == StoreElimination)
+                break;
+            if (varInjectionWatchpointElimination())
+                eliminate();
+            break;
+            
</ins><span class="cx">         case PutGlobalVar:
</span><del>-        case PutGlobalVarCheck:
</del><span class="cx">             if (cseMode == NormalCSE)
</span><span class="cx">                 break;
</span><span class="cx">             eliminate(globalVarStoreElimination(node-&gt;registerPointer()));
</span><span class="cx">             break;
</span><span class="cx">             
</span><del>-        case PutScopedVar: {
</del><ins>+        case PutClosureVar: {
</ins><span class="cx">             if (cseMode == NormalCSE)
</span><span class="cx">                 break;
</span><span class="cx">             eliminate(scopedVarStoreElimination(node-&gt;child1().node(), node-&gt;child2().node(), node-&gt;varNumber()));
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCapabilities.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCapabilities.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCapabilities.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -75,41 +75,6 @@
</span><span class="cx">         dataLog(&quot;Cannot compile code block &quot;, *codeBlock, &quot; because of opcode &quot;, opcodeNames[opcodeID], &quot;\n&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// Opcode checking.
-inline bool canInlineResolveOperations(ResolveOperations* operations)
-{
-    for (unsigned i = 0; i &lt; operations-&gt;size(); i++) {
-        switch (operations-&gt;data()[i].m_operation) {
-        case ResolveOperation::ReturnGlobalObjectAsBase:
-        case ResolveOperation::SetBaseToGlobal:
-        case ResolveOperation::SetBaseToUndefined:
-        case ResolveOperation::GetAndReturnGlobalProperty:
-        case ResolveOperation::GetAndReturnGlobalVar:
-        case ResolveOperation::GetAndReturnGlobalVarWatchable:
-        case ResolveOperation::SkipScopes:
-        case ResolveOperation::SetBaseToScope:
-        case ResolveOperation::ReturnScopeAsBase:
-        case ResolveOperation::GetAndReturnScopedVar:
-            continue;
-
-        case ResolveOperation::Fail:
-            // Fall-back resolves don't know how to deal with the ExecState* having a different
-            // global object (and scope) than the inlined code that is invoking that resolve.
-            return false;
-
-        case ResolveOperation::SkipTopScopeNode:
-            // We don't inline code blocks that create activations. Creation of
-            // activations is the only thing that leads to SkipTopScopeNode.
-            return false;
-
-        case ResolveOperation::CheckForDynamicEntriesBeforeGlobalScope:
-            // This would be easy to support in all cases.
-            return false;
-        }
-    }
-    return true;
-}
-
</del><span class="cx"> CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, Instruction* pc)
</span><span class="cx"> {
</span><span class="cx">     switch (opcodeID) {
</span><span class="lines">@@ -167,7 +132,6 @@
</span><span class="cx">     case op_put_by_id_transition_normal_out_of_line:
</span><span class="cx">     case op_init_global_const_nop:
</span><span class="cx">     case op_init_global_const:
</span><del>-    case op_init_global_const_check:
</del><span class="cx">     case op_jmp:
</span><span class="cx">     case op_jtrue:
</span><span class="cx">     case op_jfalse:
</span><span class="lines">@@ -200,44 +164,25 @@
</span><span class="cx">     case op_get_argument_by_val:
</span><span class="cx">     case op_get_arguments_length:
</span><span class="cx">     case op_jneq_ptr:
</span><del>-    case op_put_to_base_variable:
-    case op_put_to_base:
</del><span class="cx">     case op_typeof:
</span><span class="cx">     case op_to_number:
</span><ins>+    case op_get_from_scope:
+    case op_put_to_scope:
</ins><span class="cx">         return CanCompileAndInline;
</span><del>-        
</del><ins>+
+    case op_resolve_scope: {
+        // We don't compile 'catch' or 'with', so there's no point in compiling variable resolution within them.
+        ResolveType resolveType = static_cast&lt;ResolveType&gt;(pc[3].u.operand);
+        if (resolveType == Dynamic)
+            return CannotCompile;
+        return CanCompileAndInline;
+    }
+
</ins><span class="cx">     case op_call_varargs:
</span><span class="cx">         if (codeBlock-&gt;usesArguments() &amp;&amp; pc[4].u.operand == codeBlock-&gt;argumentsRegister())
</span><span class="cx">             return CanInline;
</span><span class="cx">         return CannotCompile;
</span><span class="cx"> 
</span><del>-    case op_resolve:
-    case op_resolve_global_property:
-    case op_resolve_global_var:
-    case op_resolve_scoped_var:
-    case op_resolve_scoped_var_on_top_scope:
-    case op_resolve_scoped_var_with_top_scope_check:
-        if (canInlineResolveOperations(pc[3].u.resolveOperations))
-            return CanCompileAndInline;
-        return CanCompile;
-
-    case op_get_scoped_var:
-    case op_put_scoped_var:
-        if (!codeBlock-&gt;needsFullScopeChain())
-            return CanCompileAndInline;
-        return CanCompile;
-
-    case op_resolve_base_to_global:
-    case op_resolve_base_to_global_dynamic:
-    case op_resolve_base_to_scope:
-    case op_resolve_base_to_scope_with_top_scope_check:
-    case op_resolve_base:
-    case op_resolve_with_base:
-    case op_resolve_with_this:
-        if (canInlineResolveOperations(pc[4].u.resolveOperations))
-            return CanCompileAndInline;
-        return CanCompile;
-
</del><span class="cx">     case op_new_regexp: 
</span><span class="cx">     case op_create_activation:
</span><span class="cx">     case op_tear_off_activation:
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -698,8 +698,8 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">             
</span><del>-        case GetScopeRegisters:
-        case PutScopedVar:
</del><ins>+        case GetClosureRegisters:
+        case PutClosureVar:
</ins><span class="cx">         case SkipTopScope:
</span><span class="cx">         case SkipScope:
</span><span class="cx">         case SetCallee:
</span><span class="lines">@@ -866,21 +866,17 @@
</span><span class="cx">         case GetLocalUnlinked:
</span><span class="cx">         case InlineStart:
</span><span class="cx">         case GetMyScope:
</span><del>-        case GetScopedVar:
</del><ins>+        case GetClosureVar:
</ins><span class="cx">         case GetGlobalVar:
</span><span class="cx">         case PutGlobalVar:
</span><span class="cx">         case GlobalVarWatchpoint:
</span><del>-        case PutGlobalVarCheck:
</del><ins>+        case VarInjectionWatchpoint:
</ins><span class="cx">         case AllocationProfileWatchpoint:
</span><span class="cx">         case Call:
</span><span class="cx">         case Construct:
</span><span class="cx">         case NewObject:
</span><span class="cx">         case NewArrayBuffer:
</span><span class="cx">         case NewRegexp:
</span><del>-        case Resolve:
-        case ResolveBase:
-        case ResolveBaseStrictPut:
-        case ResolveGlobal:
</del><span class="cx">         case Breakpoint:
</span><span class="cx">         case IsUndefined:
</span><span class="cx">         case IsBoolean:
</span><span class="lines">@@ -903,7 +899,6 @@
</span><span class="cx">         case Return:
</span><span class="cx">         case Throw:
</span><span class="cx">         case ThrowReferenceError:
</span><del>-        case GarbageValue:
</del><span class="cx">         case CountExecution:
</span><span class="cx">         case ForceOSRExit:
</span><span class="cx">         case ForwardForceOSRExit:
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGGraph.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGGraph.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGGraph.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -59,23 +59,6 @@
</span><span class="cx">     unsigned identifierNumber;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-struct ResolveGlobalData {
-    unsigned identifierNumber;
-    ResolveOperations* resolveOperations;
-    PutToBaseOperation* putToBaseOperation;
-    unsigned resolvePropertyIndex;
-};
-
-struct ResolveOperationData {
-    unsigned identifierNumber;
-    ResolveOperations* resolveOperations;
-    PutToBaseOperation* putToBaseOperation;
-};
-
-struct PutToBaseOperationData {
-    PutToBaseOperation* putToBaseOperation;
-};
-
</del><span class="cx"> enum AddSpeculationMode {
</span><span class="cx">     DontSpeculateInteger,
</span><span class="cx">     SpeculateIntegerAndTruncateConstants,
</span><span class="lines">@@ -710,9 +693,6 @@
</span><span class="cx">     Vector&lt; OwnPtr&lt;BasicBlock&gt; , 8&gt; m_blocks;
</span><span class="cx">     Vector&lt;Edge, 16&gt; m_varArgChildren;
</span><span class="cx">     Vector&lt;StorageAccessData&gt; m_storageAccessData;
</span><del>-    Vector&lt;ResolveGlobalData&gt; m_resolveGlobalData;
-    Vector&lt;ResolveOperationData&gt; m_resolveOperationsData;
-    Vector&lt;PutToBaseOperationData&gt; m_putToBaseOperationData;
</del><span class="cx">     Vector&lt;Node*, 8&gt; m_arguments;
</span><span class="cx">     SegmentedVector&lt;VariableAccessData, 16&gt; m_variableAccessData;
</span><span class="cx">     SegmentedVector&lt;ArgumentPosition, 8&gt; m_argumentPositions;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNode.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNode.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNode.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -312,6 +312,8 @@
</span><span class="cx">     void convertToStructureTransitionWatchpoint(Structure* structure)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(m_op == CheckStructure || m_op == ForwardCheckStructure || m_op == ArrayifyToStructure);
</span><ins>+        ASSERT(!child2());
+        ASSERT(!child3());
</ins><span class="cx">         m_opInfo = bitwise_cast&lt;uintptr_t&gt;(structure);
</span><span class="cx">         if (m_op == CheckStructure || m_op == ArrayifyToStructure)
</span><span class="cx">             m_op = StructureTransitionWatchpoint;
</span><span class="lines">@@ -484,18 +486,6 @@
</span><span class="cx">         return m_opInfo;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    unsigned resolveGlobalDataIndex()
-    {
-        ASSERT(op() == ResolveGlobal);
-        return m_opInfo;
-    }
-
-    unsigned resolveOperationsDataIndex()
-    {
-        ASSERT(op() == Resolve || op() == ResolveBase || op() == ResolveBaseStrictPut);
-        return m_opInfo;
-    }
-
</del><span class="cx">     bool hasArithNodeFlags()
</span><span class="cx">     {
</span><span class="cx">         switch (op()) {
</span><span class="lines">@@ -598,7 +588,7 @@
</span><span class="cx">     
</span><span class="cx">     bool hasVarNumber()
</span><span class="cx">     {
</span><del>-        return op() == GetScopedVar || op() == PutScopedVar;
</del><ins>+        return op() == GetClosureVar || op() == PutClosureVar;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     unsigned varNumber()
</span><span class="lines">@@ -609,7 +599,7 @@
</span><span class="cx">     
</span><span class="cx">     bool hasIdentifierNumberForCheck()
</span><span class="cx">     {
</span><del>-        return op() == GlobalVarWatchpoint || op() == PutGlobalVarCheck;
</del><ins>+        return op() == GlobalVarWatchpoint;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     unsigned identifierNumberForCheck()
</span><span class="lines">@@ -620,7 +610,7 @@
</span><span class="cx">     
</span><span class="cx">     bool hasRegisterPointer()
</span><span class="cx">     {
</span><del>-        return op() == GetGlobalVar || op() == PutGlobalVar || op() == GlobalVarWatchpoint || op() == PutGlobalVarCheck;
</del><ins>+        return op() == GetGlobalVar || op() == PutGlobalVar || op() == GlobalVarWatchpoint;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     WriteBarrier&lt;Unknown&gt;* registerPointer()
</span><span class="lines">@@ -760,11 +750,7 @@
</span><span class="cx">         case Call:
</span><span class="cx">         case Construct:
</span><span class="cx">         case GetByOffset:
</span><del>-        case GetScopedVar:
-        case Resolve:
-        case ResolveBase:
-        case ResolveBaseStrictPut:
-        case ResolveGlobal:
</del><ins>+        case GetClosureVar:
</ins><span class="cx">         case ArrayPop:
</span><span class="cx">         case ArrayPush:
</span><span class="cx">         case RegExpExec:
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNodeType.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNodeType.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNodeType.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -161,13 +161,13 @@
</span><span class="cx">     macro(SetMyScope, NodeMustGenerate) \
</span><span class="cx">     macro(SkipTopScope, NodeResultJS) \
</span><span class="cx">     macro(SkipScope, NodeResultJS) \
</span><del>-    macro(GetScopeRegisters, NodeResultStorage) \
-    macro(GetScopedVar, NodeResultJS) \
-    macro(PutScopedVar, NodeMustGenerate) \
</del><ins>+    macro(GetClosureRegisters, NodeResultStorage) \
+    macro(GetClosureVar, NodeResultJS) \
+    macro(PutClosureVar, NodeMustGenerate) \
</ins><span class="cx">     macro(GetGlobalVar, NodeResultJS) \
</span><span class="cx">     macro(PutGlobalVar, NodeMustGenerate) \
</span><span class="cx">     macro(GlobalVarWatchpoint, NodeMustGenerate) \
</span><del>-    macro(PutGlobalVarCheck, NodeMustGenerate) \
</del><ins>+    macro(VarInjectionWatchpoint, NodeMustGenerate) \
</ins><span class="cx">     macro(CheckFunction, NodeMustGenerate) \
</span><span class="cx">     macro(AllocationProfileWatchpoint, NodeMustGenerate) \
</span><span class="cx">     \
</span><span class="lines">@@ -204,12 +204,6 @@
</span><span class="cx">     macro(NewArrayBuffer, NodeResultJS) \
</span><span class="cx">     macro(NewRegexp, NodeResultJS) \
</span><span class="cx">     \
</span><del>-    /* Resolve nodes. */\
-    macro(Resolve, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
-    macro(ResolveBase, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
-    macro(ResolveBaseStrictPut, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
-    macro(ResolveGlobal, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
-    \
</del><span class="cx">     /* Nodes for misc operations. */\
</span><span class="cx">     macro(Breakpoint, NodeMustGenerate | NodeClobbersWorld) \
</span><span class="cx">     macro(CheckHasInstance, NodeMustGenerate) \
</span><span class="lines">@@ -256,8 +250,6 @@
</span><span class="cx">     macro(Throw, NodeMustGenerate) \
</span><span class="cx">     macro(ThrowReferenceError, NodeMustGenerate) \
</span><span class="cx">     \
</span><del>-    macro(GarbageValue, NodeResultJS | NodeClobbersWorld) \
-    \
</del><span class="cx">     /* Count execution. */\
</span><span class="cx">     macro(CountExecution, NodeMustGenerate) \
</span><span class="cx">     \
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1198,47 +1198,6 @@
</span><span class="cx">     return virtualFor(execCallee, CodeForConstruct);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void DFG_OPERATION operationNotifyGlobalVarWrite(WatchpointSet* watchpointSet)
-{
-    watchpointSet-&gt;notifyWrite();
-}
-
-EncodedJSValue DFG_OPERATION operationResolve(ExecState* exec, StringImpl* uid, ResolveOperations* operations)
-{
-    VM* vm = &amp;exec-&gt;vm();
-    NativeCallFrameTracer tracer(vm, exec);
-    Identifier ident(vm, uid);
-    return JSValue::encode(JSScope::resolve(exec, ident, operations));
-}
-
-EncodedJSValue DFG_OPERATION operationResolveBase(ExecState* exec, StringImpl* uid, ResolveOperations* operations, PutToBaseOperation* putToBaseOperations)
-{
-    VM* vm = &amp;exec-&gt;vm();
-    NativeCallFrameTracer tracer(vm, exec);
-    Identifier ident(vm, uid);
-    return JSValue::encode(JSScope::resolveBase(exec, ident, false, operations, putToBaseOperations));
-}
-
-EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState* exec, StringImpl* uid, ResolveOperations* operations, PutToBaseOperation* putToBaseOperations)
-{
-    VM* vm = &amp;exec-&gt;vm();
-    NativeCallFrameTracer tracer(vm, exec);
-    Identifier ident(vm, uid);
-    return JSValue::encode(JSScope::resolveBase(exec, ident, true, operations, putToBaseOperations));
-}
-
-EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState* exec, ResolveOperation* resolveOperation, JSGlobalObject* globalObject, StringImpl* uid)
-{
-    VM* vm = &amp;exec-&gt;vm();
-    NativeCallFrameTracer tracer(vm, exec);
-    ASSERT(globalObject);
-    UNUSED_PARAM(resolveOperation);
-    UNUSED_PARAM(globalObject);
-    ASSERT(resolveOperation-&gt;m_operation == ResolveOperation::GetAndReturnGlobalProperty);
-    Identifier ident(vm, uid);
-    return JSValue::encode(JSScope::resolveGlobal(exec, ident, globalObject, resolveOperation));
-}
-
</del><span class="cx"> EncodedJSValue DFG_OPERATION operationToPrimitive(ExecState* exec, EncodedJSValue value)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx">     Z: int32_t
</span><span class="cx">     D: double
</span><span class="cx">     I: StringImpl*
</span><del>-    G: GlobalResolveInfo*
</del><span class="cx"> */
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_E)(ExecState*);
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EA)(ExecState*, JSArray*);
</span><span class="lines">@@ -65,10 +64,7 @@
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECI)(ExecState*, JSCell*, StringImpl*);
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EDA)(ExecState*, double, JSArray*);
</span><del>-typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EGriJsgI)(ExecState*, ResolveOperation*, JSGlobalObject*, StringImpl*);
</del><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EI)(ExecState*, StringImpl*);
</span><del>-typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EIRo)(ExecState*, StringImpl*, ResolveOperations*);
-typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EIRoPtbo)(ExecState*, StringImpl*, ResolveOperations*, PutToBaseOperation*);
</del><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EJ)(ExecState*, EncodedJSValue);
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EJA)(ExecState*, EncodedJSValue, JSArray*);
</span><span class="cx"> typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EJI)(ExecState*, EncodedJSValue, StringImpl*);
</span><span class="lines">@@ -139,11 +135,6 @@
</span><span class="cx"> EncodedJSValue DFG_OPERATION operationGetByIdOptimize(ExecState*, EncodedJSValue, StringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue DFG_OPERATION operationCallCustomGetter(ExecState*, JSCell*, PropertySlot::GetValueFunc, StringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue DFG_OPERATION operationCallGetter(ExecState*, JSCell*, JSCell*) WTF_INTERNAL;
</span><del>-void DFG_OPERATION operationNotifyGlobalVarWrite(WatchpointSet* watchpointSet) WTF_INTERNAL;
-EncodedJSValue DFG_OPERATION operationResolve(ExecState*, StringImpl*, ResolveOperations*) WTF_INTERNAL;
-EncodedJSValue DFG_OPERATION operationResolveBase(ExecState*, StringImpl*, ResolveOperations*, PutToBaseOperation*) WTF_INTERNAL;
-EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState*, StringImpl*, ResolveOperations*, PutToBaseOperation*) WTF_INTERNAL;
-EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState*, ResolveOperation*, JSGlobalObject*, StringImpl*) WTF_INTERNAL;
</del><span class="cx"> EncodedJSValue DFG_OPERATION operationToPrimitive(ExecState*, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> char* DFG_OPERATION operationNewArray(ExecState*, Structure*, void*, size_t) WTF_INTERNAL;
</span><span class="cx"> char* DFG_OPERATION operationNewArrayBuffer(ExecState*, Structure*, size_t, size_t) WTF_INTERNAL;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -174,11 +174,7 @@
</span><span class="cx">         case Call:
</span><span class="cx">         case Construct:
</span><span class="cx">         case GetGlobalVar:
</span><del>-        case GetScopedVar:
-        case Resolve:
-        case ResolveBase:
-        case ResolveBaseStrictPut:
-        case ResolveGlobal: {
</del><ins>+        case GetClosureVar: {
</ins><span class="cx">             changed |= setPrediction(node-&gt;getHeapPrediction());
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="lines">@@ -360,7 +356,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case GetScopeRegisters:            
</del><ins>+        case GetClosureRegisters:            
</ins><span class="cx">         case GetButterfly: 
</span><span class="cx">         case GetIndexedPropertyStorage:
</span><span class="cx">         case AllocatePropertyStorage:
</span><span class="lines">@@ -497,7 +493,7 @@
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx">         // These get ignored because they don't return anything.
</span><span class="cx">         case PutByVal:
</span><del>-        case PutScopedVar:
</del><ins>+        case PutClosureVar:
</ins><span class="cx">         case Return:
</span><span class="cx">         case Throw:
</span><span class="cx">         case PutById:
</span><span class="lines">@@ -524,11 +520,10 @@
</span><span class="cx">         case TearOffArguments:
</span><span class="cx">         case CheckArgumentsNotCreated:
</span><span class="cx">         case GlobalVarWatchpoint:
</span><del>-        case GarbageValue:
</del><ins>+        case VarInjectionWatchpoint:
</ins><span class="cx">         case AllocationProfileWatchpoint:
</span><span class="cx">         case Phantom:
</span><span class="cx">         case PutGlobalVar:
</span><del>-        case PutGlobalVarCheck:
</del><span class="cx">         case CheckWatchdogTimer:
</span><span class="cx">             break;
</span><span class="cx">             
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGRepatchh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGRepatch.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGRepatch.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGRepatch.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -59,8 +59,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace DFG {
</span><span class="cx"> 
</span><del>-inline NO_RETURN void dfgResetGetByID(RepatchBuffer&amp;, StructureStubInfo&amp;) { RELEASE_ASSERT_NOT_REACHED(); }
-inline NO_RETURN void dfgResetPutByID(RepatchBuffer&amp;, StructureStubInfo&amp;) { RELEASE_ASSERT_NOT_REACHED(); }
</del><ins>+inline NO_RETURN_DUE_TO_CRASH void dfgResetGetByID(RepatchBuffer&amp;, StructureStubInfo&amp;) { RELEASE_ASSERT_NOT_REACHED(); }
+inline NO_RETURN_DUE_TO_CRASH void dfgResetPutByID(RepatchBuffer&amp;, StructureStubInfo&amp;) { RELEASE_ASSERT_NOT_REACHED(); }
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -971,7 +971,6 @@
</span><span class="cx">         m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImmPtr(index), TrustedImmPtr(size));
</span><span class="cx">         return appendCallWithExceptionCheckSetResult(operation, result);
</span><span class="cx">     }
</span><del>-
</del><span class="cx">     JITCompiler::Call callOperation(C_DFGOperation_E operation, GPRReg result)
</span><span class="cx">     {
</span><span class="cx">         m_jit.setupArgumentsExecState();
</span><span class="lines">@@ -1125,26 +1124,11 @@
</span><span class="cx">         m_jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, result);
</span><span class="cx">         return call;
</span><span class="cx">     }
</span><del>-    JITCompiler::Call callOperation(J_DFGOperation_EGriJsgI operation, GPRReg result, GPRReg arg1, GPRReg arg2, StringImpl* uid)
-    {
-        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(uid));
-        return appendCallWithExceptionCheckSetResult(operation, result);
-    }
</del><span class="cx">     JITCompiler::Call callOperation(J_DFGOperation_EI operation, GPRReg result, StringImpl* uid)
</span><span class="cx">     {
</span><span class="cx">         m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid));
</span><span class="cx">         return appendCallWithExceptionCheckSetResult(operation, result);
</span><span class="cx">     }
</span><del>-    JITCompiler::Call callOperation(J_DFGOperation_EIRo operation, GPRReg result, StringImpl* uid, ResolveOperations* operations)
-    {
-        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid), TrustedImmPtr(operations));
-        return appendCallWithExceptionCheckSetResult(operation, result);
-    }
-    JITCompiler::Call callOperation(J_DFGOperation_EIRoPtbo operation, GPRReg result, StringImpl* uid, ResolveOperations* operations, PutToBaseOperation* putToBaseOperations)
-    {
-        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid), TrustedImmPtr(operations), TrustedImmPtr(putToBaseOperations));
-        return appendCallWithExceptionCheckSetResult(operation, result);
-    }
</del><span class="cx">     JITCompiler::Call callOperation(J_DFGOperation_EA operation, GPRReg result, GPRReg arg1)
</span><span class="cx">     {
</span><span class="cx">         m_jit.setupArgumentsWithExecState(arg1);
</span><span class="lines">@@ -1344,11 +1328,6 @@
</span><span class="cx">         m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(pointer));
</span><span class="cx">         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
</span><span class="cx">     }
</span><del>-    JITCompiler::Call callOperation(J_DFGOperation_EGriJsgI operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2, StringImpl* uid)
-    {
-        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(uid));
-        return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
-    }
</del><span class="cx">     JITCompiler::Call callOperation(J_DFGOperation_EP operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1)
</span><span class="cx">     {
</span><span class="cx">         m_jit.setupArgumentsWithExecState(arg1);
</span><span class="lines">@@ -1482,18 +1461,6 @@
</span><span class="cx">         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    JITCompiler::Call callOperation(J_DFGOperation_EIRo operation, GPRReg resultTag, GPRReg resultPayload, StringImpl* uid, ResolveOperations* operations)
-    {
-        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid), TrustedImmPtr(operations));
-        return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
-    }
-
-    JITCompiler::Call callOperation(J_DFGOperation_EIRoPtbo operation, GPRReg resultTag, GPRReg resultPayload, StringImpl* uid, ResolveOperations* operations, PutToBaseOperation* putToBaseOperations)
-    {
-        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid), TrustedImmPtr(operations), TrustedImmPtr(putToBaseOperations));
-        return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
-    }
-
</del><span class="cx">     JITCompiler::Call callOperation(J_DFGOperation_ECJ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2Tag, GPRReg arg2Payload)
</span><span class="cx">     {
</span><span class="cx">         m_jit.setupArgumentsWithExecState(arg1, arg2Payload, arg2Tag);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -3802,7 +3802,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case GetScopeRegisters: {
</del><ins>+    case GetClosureRegisters: {
</ins><span class="cx">         SpeculateCellOperand scope(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this);
</span><span class="cx">         GPRReg scopeGPR = scope.gpr();
</span><span class="lines">@@ -3812,7 +3812,7 @@
</span><span class="cx">         storageResult(resultGPR, node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    case GetScopedVar: {
</del><ins>+    case GetClosureVar: {
</ins><span class="cx">         StorageOperand registers(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary resultTag(this);
</span><span class="cx">         GPRTemporary resultPayload(this);
</span><span class="lines">@@ -3824,7 +3824,7 @@
</span><span class="cx">         jsValueResult(resultTagGPR, resultPayloadGPR, node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    case PutScopedVar: {
</del><ins>+    case PutClosureVar: {
</ins><span class="cx">         SpeculateCellOperand scope(this, node-&gt;child1());
</span><span class="cx">         StorageOperand registers(this, node-&gt;child2());
</span><span class="cx">         JSValueOperand value(this, node-&gt;child3());
</span><span class="lines">@@ -4183,37 +4183,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case PutGlobalVarCheck: {
-        JSValueOperand value(this, node-&gt;child1());
-        
-        WatchpointSet* watchpointSet =
-            m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;symbolTable()-&gt;get(
-                identifierUID(node-&gt;identifierNumberForCheck())).watchpointSet();
-        addSlowPathGenerator(
-            slowPathCall(
-                m_jit.branchTest8(
-                    JITCompiler::NonZero,
-                    JITCompiler::AbsoluteAddress(watchpointSet-&gt;addressOfIsWatched())),
-                this, operationNotifyGlobalVarWrite, NoResult, watchpointSet));
-        
-        if (Heap::isWriteBarrierEnabled()) {
-            GPRTemporary scratch(this);
-            GPRReg scratchReg = scratch.gpr();
-            
-            writeBarrier(m_jit.globalObjectFor(node-&gt;codeOrigin), value.tagGPR(), node-&gt;child1(), WriteBarrierForVariableAccess, scratchReg);
-        }
-
-        // FIXME: if we happen to have a spare register - and _ONLY_ if we happen to have
-        // a spare register - a good optimization would be to put the register pointer into
-        // a register and then do a zero offset store followed by a four-offset store (or
-        // vice-versa depending on endianness).
-        m_jit.store32(value.tagGPR(), node-&gt;registerPointer()-&gt;tagPointer());
-        m_jit.store32(value.payloadGPR(), node-&gt;registerPointer()-&gt;payloadPointer());
-
-        noResult(node);
-        break;
-    }
-        
</del><span class="cx">     case GlobalVarWatchpoint: {
</span><span class="cx">         WatchpointSet* set = m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;symbolTable()-&gt;get(
</span><span class="cx">             identifierUID(node-&gt;identifierNumberForCheck())).watchpointSet();
</span><span class="lines">@@ -4239,6 +4208,14 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    case VarInjectionWatchpoint: {
+        WatchpointSet* set = m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;varInjectionWatchpoint();
+        m_jit.addLazily(speculationWatchpoint(), set);
+        
+        noResult(node);
+        break;
+    }
+
</ins><span class="cx">     case CheckHasInstance: {
</span><span class="cx">         SpeculateCellOperand base(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary structure(this);
</span><span class="lines">@@ -4432,80 +4409,6 @@
</span><span class="cx">         emitCall(node);
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case Resolve: {
-        flushRegisters();
-        GPRResult resultPayload(this);
-        GPRResult2 resultTag(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolve, resultTag.gpr(), resultPayload.gpr(), identifierUID(data.identifierNumber), data.resolveOperations);
-        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-        break;
-    }
-
-    case ResolveBase: {
-        flushRegisters();
-        GPRResult resultPayload(this);
-        GPRResult2 resultTag(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolveBase, resultTag.gpr(), resultPayload.gpr(), identifierUID(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
-        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-        break;
-    }
-
-    case ResolveBaseStrictPut: {
-        flushRegisters();
-        GPRResult resultPayload(this);
-        GPRResult2 resultTag(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolveBaseStrictPut, resultTag.gpr(), resultPayload.gpr(), identifierUID(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
-        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
-        break;
-    }
-
-    case ResolveGlobal: {
-        GPRTemporary globalObject(this);
-        GPRTemporary resolveInfo(this);
-        GPRTemporary resultTag(this);
-        GPRTemporary resultPayload(this);
-
-        GPRReg globalObjectGPR = globalObject.gpr();
-        GPRReg resolveInfoGPR = resolveInfo.gpr();
-        GPRReg resultTagGPR = resultTag.gpr();
-        GPRReg resultPayloadGPR = resultPayload.gpr();
-
-        ResolveGlobalData&amp; data = m_jit.graph().m_resolveGlobalData[node-&gt;resolveGlobalDataIndex()];
-        ResolveOperation* resolveOperationAddress = &amp;(data.resolveOperations-&gt;data()[data.resolvePropertyIndex]);
-
-        // Check Structure of global object
-        m_jit.move(JITCompiler::TrustedImmPtr(m_jit.globalObjectFor(node-&gt;codeOrigin)), globalObjectGPR);
-        m_jit.move(JITCompiler::TrustedImmPtr(resolveOperationAddress), resolveInfoGPR);
-        m_jit.loadPtr(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_structure)), resultPayloadGPR);
-
-        JITCompiler::Jump structuresNotMatch = m_jit.branchPtr(JITCompiler::NotEqual, resultPayloadGPR, JITCompiler::Address(globalObjectGPR, JSCell::structureOffset()));
-
-        // Fast case
-        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::butterflyOffset()), resultPayloadGPR);
-        m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_offset)), resolveInfoGPR);
-#if DFG_ENABLE(JIT_ASSERT)
-        JITCompiler::Jump isOutOfLine = m_jit.branch32(JITCompiler::GreaterThanOrEqual, resolveInfoGPR, TrustedImm32(firstOutOfLineOffset));
-        m_jit.breakpoint();
-        isOutOfLine.link(&amp;m_jit);
-#endif
-        m_jit.neg32(resolveInfoGPR);
-        m_jit.signExtend32ToPtr(resolveInfoGPR, resolveInfoGPR);
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) + (firstOutOfLineOffset - 2) * static_cast&lt;ptrdiff_t&gt;(sizeof(JSValue))), resultTagGPR);
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) + (firstOutOfLineOffset - 2) * static_cast&lt;ptrdiff_t&gt;(sizeof(JSValue))), resultPayloadGPR);
-
-        addSlowPathGenerator(
-            slowPathCall(
-                structuresNotMatch, this, operationResolveGlobal,
-                JSValueRegs(resultTagGPR, resultPayloadGPR), resolveInfoGPR, globalObjectGPR,
-                identifierUID(data.identifierNumber)));
-
-        jsValueResult(resultTagGPR, resultPayloadGPR, node);
-        break;
-    }
-
</del><span class="cx">     case CreateActivation: {
</span><span class="cx">         JSValueOperand value(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this, value, false);
</span><span class="lines">@@ -4890,11 +4793,6 @@
</span><span class="cx">         compileNewFunctionExpression(node);
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case GarbageValue:
-        // We should never get to the point of code emission for a GarbageValue
-        CRASH();
-        break;
-
</del><span class="cx">     case ForceOSRExit:
</span><span class="cx">     case ForwardForceOSRExit: {
</span><span class="cx">         terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -3717,7 +3717,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case GetScopeRegisters: {
</del><ins>+    case GetClosureRegisters: {
</ins><span class="cx">         SpeculateCellOperand scope(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this);
</span><span class="cx">         GPRReg scopeGPR = scope.gpr();
</span><span class="lines">@@ -3727,7 +3727,7 @@
</span><span class="cx">         storageResult(resultGPR, node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    case GetScopedVar: {
</del><ins>+    case GetClosureVar: {
</ins><span class="cx">         StorageOperand registers(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this);
</span><span class="cx">         GPRReg registersGPR = registers.gpr();
</span><span class="lines">@@ -3737,7 +3737,7 @@
</span><span class="cx">         jsValueResult(resultGPR, node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    case PutScopedVar: {
</del><ins>+    case PutClosureVar: {
</ins><span class="cx">         SpeculateCellOperand scope(this, node-&gt;child1());
</span><span class="cx">         StorageOperand registers(this, node-&gt;child2());
</span><span class="cx">         JSValueOperand value(this, node-&gt;child3());
</span><span class="lines">@@ -4085,32 +4085,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case PutGlobalVarCheck: {
-        JSValueOperand value(this, node-&gt;child1());
-        
-        WatchpointSet* watchpointSet =
-            m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;symbolTable()-&gt;get(
-                identifierUID(node-&gt;identifierNumberForCheck())).watchpointSet();
-        addSlowPathGenerator(
-            slowPathCall(
-                m_jit.branchTest8(
-                    JITCompiler::NonZero,
-                    JITCompiler::AbsoluteAddress(watchpointSet-&gt;addressOfIsWatched())),
-                this, operationNotifyGlobalVarWrite, NoResult, watchpointSet));
-        
-        if (Heap::isWriteBarrierEnabled()) {
-            GPRTemporary scratch(this);
-            GPRReg scratchReg = scratch.gpr();
-            
-            writeBarrier(m_jit.globalObjectFor(node-&gt;codeOrigin), value.gpr(), node-&gt;child1(), WriteBarrierForVariableAccess, scratchReg);
-        }
-        
-        m_jit.store64(value.gpr(), node-&gt;registerPointer());
-
-        noResult(node);
-        break;
-    }
-        
</del><span class="cx">     case GlobalVarWatchpoint: {
</span><span class="cx">         WatchpointSet* set = m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;symbolTable()-&gt;get(
</span><span class="cx">             identifierUID(node-&gt;identifierNumberForCheck())).watchpointSet();
</span><span class="lines">@@ -4131,6 +4105,14 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    case VarInjectionWatchpoint: {
+        WatchpointSet* set = m_jit.globalObjectFor(node-&gt;codeOrigin)-&gt;varInjectionWatchpoint();
+        m_jit.addLazily(speculationWatchpoint(), set);
+        
+        noResult(node);
+        break;
+    }
+
</ins><span class="cx">     case CheckHasInstance: {
</span><span class="cx">         SpeculateCellOperand base(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary structure(this);
</span><span class="lines">@@ -4327,73 +4309,6 @@
</span><span class="cx">         emitCall(node);
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case Resolve: {
-        flushRegisters();
-        GPRResult result(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolve, result.gpr(), identifierUID(data.identifierNumber), data.resolveOperations);
-        jsValueResult(result.gpr(), node);
-        break;
-    }
-
-    case ResolveBase: {
-        flushRegisters();
-        GPRResult result(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolveBase, result.gpr(), identifierUID(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
-        jsValueResult(result.gpr(), node);
-        break;
-    }
-
-    case ResolveBaseStrictPut: {
-        flushRegisters();
-        GPRResult result(this);
-        ResolveOperationData&amp; data = m_jit.graph().m_resolveOperationsData[node-&gt;resolveOperationsDataIndex()];
-        callOperation(operationResolveBaseStrictPut, result.gpr(), identifierUID(data.identifierNumber), data.resolveOperations, data.putToBaseOperation);
-        jsValueResult(result.gpr(), node);
-        break;
-    }
-
-    case ResolveGlobal: {
-        GPRTemporary globalObject(this);
-        GPRTemporary resolveInfo(this);
-        GPRTemporary result(this);
-
-        GPRReg globalObjectGPR = globalObject.gpr();
-        GPRReg resolveInfoGPR = resolveInfo.gpr();
-        GPRReg resultGPR = result.gpr();
-
-        ResolveGlobalData&amp; data = m_jit.graph().m_resolveGlobalData[node-&gt;resolveGlobalDataIndex()];
-        ResolveOperation* resolveOperationAddress = &amp;(data.resolveOperations-&gt;data()[data.resolvePropertyIndex]);
-
-        // Check Structure of global object
-        m_jit.move(JITCompiler::TrustedImmPtr(m_jit.globalObjectFor(node-&gt;codeOrigin)), globalObjectGPR);
-        m_jit.move(JITCompiler::TrustedImmPtr(resolveOperationAddress), resolveInfoGPR);
-        m_jit.loadPtr(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_structure)), resultGPR);
-        JITCompiler::Jump structuresDontMatch = m_jit.branchPtr(JITCompiler::NotEqual, resultGPR, JITCompiler::Address(globalObjectGPR, JSCell::structureOffset()));
-
-        // Fast case
-        m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(ResolveOperation, m_offset)), resolveInfoGPR);
-#if DFG_ENABLE(JIT_ASSERT)
-        JITCompiler::Jump isOutOfLine = m_jit.branch32(JITCompiler::GreaterThanOrEqual, resolveInfoGPR, TrustedImm32(firstOutOfLineOffset));
-        m_jit.breakpoint();
-        isOutOfLine.link(&amp;m_jit);
-#endif
-        m_jit.neg32(resolveInfoGPR);
-        m_jit.signExtend32ToPtr(resolveInfoGPR, resolveInfoGPR);
-        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::butterflyOffset()), resultGPR);
-        m_jit.load64(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::TimesEight, (firstOutOfLineOffset - 2) * static_cast&lt;ptrdiff_t&gt;(sizeof(JSValue))), resultGPR);
-        
-        addSlowPathGenerator(
-            slowPathCall(
-                structuresDontMatch, this, operationResolveGlobal,
-                resultGPR, resolveInfoGPR, globalObjectGPR,
-                identifierUID(data.identifierNumber)));
-
-        jsValueResult(resultGPR, node);
-        break;
-    }
-        
</del><span class="cx">     case CreateActivation: {
</span><span class="cx">         RELEASE_ASSERT(!node-&gt;codeOrigin.inlineCallFrame);
</span><span class="cx">         
</span><span class="lines">@@ -4743,11 +4658,6 @@
</span><span class="cx">         m_jit.add64(TrustedImm32(1), MacroAssembler::AbsoluteAddress(node-&gt;executionCounter()-&gt;address()));
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case GarbageValue:
-        // We should never get to the point of code emission for a GarbageValue
-        CRASH();
-        break;
-
</del><span class="cx">     case ForceOSRExit:
</span><span class="cx">     case ForwardForceOSRExit: {
</span><span class="cx">         terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -310,8 +310,6 @@
</span><span class="cx">                     m_graph.voteChildren(node, VoteOther);
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><del>-                case GarbageValue:
-                    break;
</del><span class="cx">                     
</span><span class="cx">                 default:
</span><span class="cx">                     m_graph.voteChildren(node, VoteOther);
</span><span class="lines">@@ -420,8 +418,6 @@
</span><span class="cx">                     m_graph.voteChildren(node, VoteOther);
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><del>-                case GarbageValue:
-                    break;
</del><span class="cx">                     
</span><span class="cx">                 default:
</span><span class="cx">                     m_graph.voteChildren(node, VoteOther);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -202,14 +202,6 @@
</span><span class="cx"> 
</span><span class="cx"> static CallFrame* getCallerInfo(VM*, CallFrame*, unsigned&amp; bytecodeOffset, CodeBlock*&amp; callerOut);
</span><span class="cx"> 
</span><del>-// Returns the depth of the scope chain within a given call frame.
-static int depth(CodeBlock* codeBlock, JSScope* sc)
-{
-    if (!codeBlock-&gt;needsFullScopeChain())
-        return 0;
-    return sc-&gt;localDepth();
-}
-
</del><span class="cx"> JSValue eval(CallFrame* callFrame)
</span><span class="cx"> {
</span><span class="cx">     if (!callFrame-&gt;argumentCount())
</span><span class="lines">@@ -247,12 +239,9 @@
</span><span class="cx">         // If the literal parser bailed, it should not have thrown exceptions.
</span><span class="cx">         ASSERT(!callFrame-&gt;vm().exception);
</span><span class="cx"> 
</span><del>-        JSValue exceptionValue;
-        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock-&gt;ownerExecutable(), callerCodeBlock-&gt;isStrictMode(), programSource, callerScopeChain, exceptionValue);
-        
-        ASSERT(!eval == exceptionValue);
-        if (UNLIKELY(!eval))
-            return throwError(callFrame, exceptionValue);
</del><ins>+        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock-&gt;ownerExecutable(), callerCodeBlock-&gt;isStrictMode(), programSource, callerScopeChain);
+        if (!eval)
+            return jsUndefined();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue thisValue = callerFrame-&gt;thisValue();
</span><span class="lines">@@ -571,13 +560,11 @@
</span><span class="cx">     CodeBlock* codeBlock = callFrame-&gt;codeBlock();
</span><span class="cx">     if (!codeBlock)
</span><span class="cx">         return 0;
</span><del>-#if ENABLE(JIT)
</del><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">     if (JITCode::isOptimizingJIT(codeBlock-&gt;jitType()))
</span><span class="cx">         return codeBlock-&gt;codeOrigin(callFrame-&gt;locationAsCodeOriginIndex()).bytecodeIndex;
</span><span class="cx"> #endif
</span><span class="cx">     return callFrame-&gt;locationAsBytecodeOffset();
</span><del>-#endif
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static CallFrame* getCallerInfo(VM* vm, CallFrame* callFrame, unsigned&amp; bytecodeOffset, CodeBlock*&amp; caller)
</span><span class="lines">@@ -787,15 +774,14 @@
</span><span class="cx">         profiler-&gt;exceptionUnwind(callFrame);
</span><span class="cx"> 
</span><span class="cx">     // Unwind the scope chain within the exception handler's call frame.
</span><ins>+    int targetScopeDepth = handler-&gt;scopeDepth;
+    if (codeBlock-&gt;needsActivation() &amp;&amp; callFrame-&gt;uncheckedR(codeBlock-&gt;activationRegister()).jsValue())
+        ++targetScopeDepth;
+
</ins><span class="cx">     JSScope* scope = callFrame-&gt;scope();
</span><del>-    int scopeDelta = 0;
-    if (!codeBlock-&gt;needsFullScopeChain() || codeBlock-&gt;codeType() != FunctionCode 
-        || callFrame-&gt;uncheckedR(codeBlock-&gt;activationRegister()).jsValue()) {
-        int currentDepth = depth(codeBlock, scope);
-        int targetDepth = handler-&gt;scopeDepth;
-        scopeDelta = currentDepth - targetDepth;
-        RELEASE_ASSERT(scopeDelta &gt;= 0);
-    }
</del><ins>+    int scopeDelta = scope-&gt;depth() - targetScopeDepth;
+    RELEASE_ASSERT(scopeDelta &gt;= 0);
+
</ins><span class="cx">     while (scopeDelta--)
</span><span class="cx">         scope = scope-&gt;next();
</span><span class="cx">     callFrame-&gt;setScope(scope);
</span><span class="lines">@@ -1277,30 +1263,32 @@
</span><span class="cx">     if (!nativeStack.isSafeToRecurse(policy.requiredCapacity()))
</span><span class="cx">         return checkedReturn(throwStackOverflowError(callFrame));
</span><span class="cx"> 
</span><del>-    // Compile the callee:
</del><ins>+    unsigned numVariables = eval-&gt;numVariables();
+    int numFunctions = eval-&gt;numberOfFunctionDecls();
+
+    JSScope* variableObject;
+    if ((numVariables || numFunctions) &amp;&amp; eval-&gt;isStrictMode()) {
+        scope = StrictEvalActivation::create(callFrame);
+        variableObject = scope;
+    } else {
+        for (JSScope* node = scope; ; node = node-&gt;next()) {
+            RELEASE_ASSERT(node);
+            if (node-&gt;isVariableObject() &amp;&amp; !node-&gt;isNameScopeObject()) {
+                variableObject = node;
+                break;
+            }
+        }
+    }
+
</ins><span class="cx">     JSObject* compileError = eval-&gt;compile(callFrame, scope);
</span><span class="cx">     if (UNLIKELY(!!compileError))
</span><span class="cx">         return checkedReturn(throwError(callFrame, compileError));
</span><span class="cx">     EvalCodeBlock* codeBlock = &amp;eval-&gt;generatedBytecode();
</span><span class="cx"> 
</span><del>-    JSObject* variableObject;
-    for (JSScope* node = scope; ; node = node-&gt;next()) {
-        RELEASE_ASSERT(node);
-        if (node-&gt;isVariableObject() &amp;&amp; !node-&gt;isNameScopeObject()) {
-            variableObject = node;
-            break;
-        }
-    }
-
-    unsigned numVariables = codeBlock-&gt;numVariables();
-    int numFunctions = codeBlock-&gt;numberOfFunctionDecls();
</del><span class="cx">     if (numVariables || numFunctions) {
</span><del>-        if (codeBlock-&gt;isStrictMode()) {
-            scope = StrictEvalActivation::create(callFrame);
-            variableObject = scope;
-        }
-        // Scope for BatchedTransitionOptimizer
</del><span class="cx">         BatchedTransitionOptimizer optimizer(vm, variableObject);
</span><ins>+        if (variableObject-&gt;next())
+            variableObject-&gt;globalObject()-&gt;varInjectionWatchpoint()-&gt;notifyWrite();
</ins><span class="cx"> 
</span><span class="cx">         for (unsigned i = 0; i &lt; numVariables; ++i) {
</span><span class="cx">             const Identifier&amp; ident = codeBlock-&gt;variable(i);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -79,7 +79,6 @@
</span><span class="cx">     , m_bytecodeOffset((unsigned)-1)
</span><span class="cx">     , m_propertyAccessInstructionIndex(UINT_MAX)
</span><span class="cx">     , m_byValInstructionIndex(UINT_MAX)
</span><del>-    , m_globalResolveInfoIndex(UINT_MAX)
</del><span class="cx">     , m_callLinkInfoIndex(UINT_MAX)
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     , m_jumpTargetIndex(0)
</span><span class="lines">@@ -171,7 +170,6 @@
</span><span class="cx">     Instruction* instructionsBegin = m_codeBlock-&gt;instructions().begin();
</span><span class="cx">     unsigned instructionCount = m_codeBlock-&gt;instructions().size();
</span><span class="cx"> 
</span><del>-    m_globalResolveInfoIndex = 0;
</del><span class="cx">     m_callLinkInfoIndex = 0;
</span><span class="cx"> 
</span><span class="cx">     for (m_bytecodeOffset = 0; m_bytecodeOffset &lt; instructionCount; ) {
</span><span class="lines">@@ -303,27 +301,8 @@
</span><span class="cx">         case op_init_global_const_nop:
</span><span class="cx">             NEXT_OPCODE(op_init_global_const_nop);
</span><span class="cx">         DEFINE_OP(op_init_global_const)
</span><del>-        DEFINE_OP(op_init_global_const_check)
</del><span class="cx"> 
</span><del>-        case op_resolve_global_property:
-        case op_resolve_global_var:
-        case op_resolve_scoped_var:
-        case op_resolve_scoped_var_on_top_scope:
-        case op_resolve_scoped_var_with_top_scope_check:
-        DEFINE_OP(op_resolve)
-
-        case op_resolve_base_to_global:
-        case op_resolve_base_to_global_dynamic:
-        case op_resolve_base_to_scope:
-        case op_resolve_base_to_scope_with_top_scope_check:
-        DEFINE_OP(op_resolve_base)
-
-        case op_put_to_base_variable:
-        DEFINE_OP(op_put_to_base)
-
</del><span class="cx">         DEFINE_OP(op_ensure_property_exists)
</span><del>-        DEFINE_OP(op_resolve_with_base)
-        DEFINE_OP(op_resolve_with_this)
</del><span class="cx">         DEFINE_OP(op_ret)
</span><span class="cx">         DEFINE_OP(op_ret_object_or_this)
</span><span class="cx">         DEFINE_OP(op_rshift)
</span><span class="lines">@@ -341,8 +320,9 @@
</span><span class="cx">         DEFINE_OP(op_to_number)
</span><span class="cx">         DEFINE_OP(op_to_primitive)
</span><span class="cx"> 
</span><del>-        DEFINE_OP(op_get_scoped_var)
-        DEFINE_OP(op_put_scoped_var)
</del><ins>+        DEFINE_OP(op_resolve_scope)
+        DEFINE_OP(op_get_from_scope)
+        DEFINE_OP(op_put_to_scope)
</ins><span class="cx"> 
</span><span class="cx">         case op_get_by_id_chain:
</span><span class="cx">         case op_get_by_id_generic:
</span><span class="lines">@@ -384,7 +364,6 @@
</span><span class="cx"> 
</span><span class="cx">     m_propertyAccessInstructionIndex = 0;
</span><span class="cx">     m_byValInstructionIndex = 0;
</span><del>-    m_globalResolveInfoIndex = 0;
</del><span class="cx">     m_callLinkInfoIndex = 0;
</span><span class="cx">     
</span><span class="cx"> #if ENABLE(VALUE_PROFILER)
</span><span class="lines">@@ -471,32 +450,16 @@
</span><span class="cx">         case op_put_by_id_transition_normal_out_of_line:
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_put_by_id)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_put_by_val)
</span><del>-        DEFINE_SLOWCASE_OP(op_init_global_const_check);
</del><span class="cx">         DEFINE_SLOWCASE_OP(op_rshift)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_urshift)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_stricteq)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_sub)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_to_number)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_to_primitive)
</span><ins>+        DEFINE_SLOWCASE_OP(op_resolve_scope)
+        DEFINE_SLOWCASE_OP(op_get_from_scope)
+        DEFINE_SLOWCASE_OP(op_put_to_scope)
</ins><span class="cx"> 
</span><del>-        case op_resolve_global_property:
-        case op_resolve_global_var:
-        case op_resolve_scoped_var:
-        case op_resolve_scoped_var_on_top_scope:
-        case op_resolve_scoped_var_with_top_scope_check:
-        DEFINE_SLOWCASE_OP(op_resolve)
-
-        case op_resolve_base_to_global:
-        case op_resolve_base_to_global_dynamic:
-        case op_resolve_base_to_scope:
-        case op_resolve_base_to_scope_with_top_scope_check:
-        DEFINE_SLOWCASE_OP(op_resolve_base)
-        DEFINE_SLOWCASE_OP(op_resolve_with_base)
-        DEFINE_SLOWCASE_OP(op_resolve_with_this)
-
-        case op_put_to_base_variable:
-        DEFINE_SLOWCASE_OP(op_put_to_base)
-
</del><span class="cx">         default:
</span><span class="cx">             RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">         }
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -716,15 +716,7 @@
</span><span class="cx">         void emit_op_put_by_val(Instruction*);
</span><span class="cx">         void emit_op_put_getter_setter(Instruction*);
</span><span class="cx">         void emit_op_init_global_const(Instruction*);
</span><del>-        void emit_op_init_global_const_check(Instruction*);
-        void emit_resolve_operations(ResolveOperations*, const int* base, const int* value);
-        void emitSlow_link_resolve_operations(ResolveOperations*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-        void emit_op_resolve(Instruction*);
-        void emit_op_resolve_base(Instruction*);
</del><span class="cx">         void emit_op_ensure_property_exists(Instruction*);
</span><del>-        void emit_op_resolve_with_base(Instruction*);
-        void emit_op_resolve_with_this(Instruction*);
-        void emit_op_put_to_base(Instruction*);
</del><span class="cx">         void emit_op_ret(Instruction*);
</span><span class="cx">         void emit_op_ret_object_or_this(Instruction*);
</span><span class="cx">         void emit_op_rshift(Instruction*);
</span><span class="lines">@@ -742,8 +734,6 @@
</span><span class="cx">         void emit_op_to_primitive(Instruction*);
</span><span class="cx">         void emit_op_unexpected_load(Instruction*);
</span><span class="cx">         void emit_op_urshift(Instruction*);
</span><del>-        void emit_op_get_scoped_var(Instruction*);
-        void emit_op_put_scoped_var(Instruction*);
</del><span class="cx"> 
</span><span class="cx">         void emitSlow_op_add(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_bitand(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="lines">@@ -787,7 +777,6 @@
</span><span class="cx">         void emitSlow_op_inc(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_put_by_id(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_put_by_val(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><del>-        void emitSlow_op_init_global_const_check(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</del><span class="cx">         void emitSlow_op_rshift(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_stricteq(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_sub(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="lines">@@ -795,15 +784,17 @@
</span><span class="cx">         void emitSlow_op_to_primitive(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_urshift(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx"> 
</span><del>-        void emitSlow_op_resolve(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-        void emitSlow_op_resolve_base(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-        void emitSlow_op_resolve_with_base(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-        void emitSlow_op_resolve_with_this(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-        void emitSlow_op_put_to_base(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
-
</del><span class="cx">         void emitRightShift(Instruction*, bool isUnsigned);
</span><span class="cx">         void emitRightShiftSlowCase(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;, bool isUnsigned);
</span><span class="cx"> 
</span><ins>+        void emit_op_resolve_scope(Instruction*);
+        void emit_op_get_from_scope(Instruction*);
+        void emit_op_put_to_scope(Instruction*);
+
+        void emitSlow_op_resolve_scope(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
+        void emitSlow_op_get_from_scope(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
+        void emitSlow_op_put_to_scope(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
+
</ins><span class="cx">         void emitInitRegister(unsigned dst);
</span><span class="cx"> 
</span><span class="cx">         void emitPutIntToCallFrameHeader(RegisterID from, JSStack::CallFrameHeaderEntry);
</span><span class="lines">@@ -813,6 +804,16 @@
</span><span class="cx">         void emitGetFromCallFrameHeader64(JSStack::CallFrameHeaderEntry, RegisterID to, RegisterID from = callFrameRegister);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+        void emitResolveClosure(unsigned dst, bool needsVarInjectionChecks, unsigned depth);
+        void emitVarInjectionCheck(bool needsVarInjectionChecks);
+        void emitLoadWithStructureCheck(unsigned scope, Structure**);
+        void emitGetGlobalProperty(uintptr_t* operandSlot);
+        void emitPutGlobalProperty(uintptr_t* operandSlot, unsigned value);
+        void emitGetGlobalVar(uintptr_t operand);
+        void emitPutGlobalVar(uintptr_t operand, unsigned value);
+        void emitGetClosureVar(unsigned scope, uintptr_t operand);
+        void emitPutClosureVar(unsigned scope, uintptr_t operand, unsigned value);
+
</ins><span class="cx">         JSValue getConstantOperand(unsigned src);
</span><span class="cx">         bool isOperandConstantImmediateInt(unsigned src);
</span><span class="cx">         bool isOperandConstantImmediateChar(unsigned src);
</span><span class="lines">@@ -903,7 +904,6 @@
</span><span class="cx"> 
</span><span class="cx">         unsigned m_propertyAccessInstructionIndex;
</span><span class="cx">         unsigned m_byValInstructionIndex;
</span><del>-        unsigned m_globalResolveInfoIndex;
</del><span class="cx">         unsigned m_callLinkInfoIndex;
</span><span class="cx"> 
</span><span class="cx"> #if USE(JSVALUE32_64)
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITArithmeticcpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITArithmetic.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITArithmetic.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITArithmetic.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -863,6 +863,7 @@
</span><span class="cx">         addSlowCase();
</span><span class="cx">         JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_add);
</span><span class="cx">         slowPathCall.call();
</span><ins>+        emitGetVirtualRegister(result, regT0);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITCodecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITCode.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITCode.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITCode.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -40,12 +40,16 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#if ENABLE(JIT)
+
</ins><span class="cx"> JSValue JITCode::execute(JSStack* stack, CallFrame* callFrame, VM* vm)
</span><span class="cx"> {
</span><span class="cx">     JSValue result = JSValue::decode(ctiTrampoline(executableAddress(), stack, callFrame, 0, 0, vm));
</span><span class="cx">     return vm-&gt;exception ? jsNull() : result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#endif
+
</ins><span class="cx"> DFG::CommonData* JITCode::dfgCommon()
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -161,4 +165,3 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WTF
</span><del>-
</del></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1152,65 +1152,6 @@
</span><span class="cx">     stubCall.callWithValueProfiling(dst);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_put_to_base(Instruction* currentInstruction)
-{
-    int base = currentInstruction[1].u.operand;
-    int id = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    PutToBaseOperation* operation = currentInstruction[4].u.putToBaseOperation;
-    switch (operation-&gt;m_kind) {
-    case PutToBaseOperation::GlobalVariablePutChecked:
-        addSlowCase(branchTest8(NonZero, AbsoluteAddress(operation-&gt;m_predicatePointer)));
-    case PutToBaseOperation::GlobalVariablePut: {
-        JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
-        if (operation-&gt;m_isDynamic) {
-            emitGetVirtualRegister(base, regT0);
-            addSlowCase(branchPtr(NotEqual, regT0, TrustedImmPtr(globalObject)));
-        }
-        emitGetVirtualRegister(value, regT0);
-        store64(regT0, operation-&gt;m_registerAddress);
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(globalObject, regT0, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        return;
-    }
-    case PutToBaseOperation::VariablePut: {
-        emitGetVirtualRegisters(base, regT0, value, regT1);
-        loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT2);
-        store64(regT1, Address(regT2, operation-&gt;m_offset * sizeof(Register)));
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(regT0, regT1, regT2, regT3, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        return;
-    }
-
-    case PutToBaseOperation::GlobalPropertyPut: {
-        emitGetVirtualRegisters(base, regT0, value, regT1);
-        loadPtr(&amp;operation-&gt;m_structure, regT2);
-        addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), regT2));
-        ASSERT(!operation-&gt;m_structure || !operation-&gt;m_structure-&gt;inlineCapacity());
-        loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
-        load32(&amp;operation-&gt;m_offsetInButterfly, regT3);
-        signExtend32ToPtr(regT3, regT3);
-        store64(regT1, BaseIndex(regT2, regT3, TimesEight));
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(regT0, regT1, regT2, regT3, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        return;
-    }
-
-    case PutToBaseOperation::Uninitialised:
-    case PutToBaseOperation::Readonly:
-    case PutToBaseOperation::Generic:
-        JITStubCall stubCall(this, cti_op_put_to_base);
-
-        stubCall.addArgument(TrustedImm32(base));
-        stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(id)));
-        stubCall.addArgument(TrustedImm32(value));
-        stubCall.addArgument(TrustedImmPtr(operation));
-        stubCall.call();
-        return;
-    }
-}
-
</del><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_loop_hint(Instruction*)
</span><span class="lines">@@ -1252,353 +1193,6 @@
</span><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_resolve_operations(ResolveOperations* resolveOperations, const int* baseVR, const int* valueVR)
-{
-
-#if USE(JSVALUE32_64)
-    unmap();
-#else
-    killLastResultRegister();
-#endif
-
-    if (resolveOperations-&gt;isEmpty()) {
-        addSlowCase(jump());
-        return;
-    }
-
-    const RegisterID value = regT0;
-#if USE(JSVALUE32_64)
-    const RegisterID valueTag = regT1;
-#endif
-    const RegisterID scope = regT2;
-    const RegisterID scratch = regT3;
-
-    JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
-    ResolveOperation* pc = resolveOperations-&gt;data();
-    emitGetFromCallFrameHeaderPtr(JSStack::ScopeChain, scope);
-    bool setBase = false;
-    bool resolvingBase = true;
-    while (resolvingBase) {
-        switch (pc-&gt;m_operation) {
-        case ResolveOperation::ReturnGlobalObjectAsBase:
-            move(TrustedImmPtr(globalObject), value);
-#if USE(JSVALUE32_64)
-            move(TrustedImm32(JSValue::CellTag), valueTag);
-#endif
-            emitValueProfilingSite();
-            emitStoreCell(*baseVR, value);
-            return;
-        case ResolveOperation::SetBaseToGlobal:
-            RELEASE_ASSERT(baseVR);
-            setBase = true;
-            move(TrustedImmPtr(globalObject), scratch);
-            emitStoreCell(*baseVR, scratch);
-            resolvingBase = false;
-            ++pc;
-            break;
-        case ResolveOperation::SetBaseToUndefined: {
-            RELEASE_ASSERT(baseVR);
-            setBase = true;
-#if USE(JSVALUE64)
-            move(TrustedImm64(JSValue::encode(jsUndefined())), scratch);
-            emitPutVirtualRegister(*baseVR, scratch);
-#else
-            emitStore(*baseVR, jsUndefined());
-#endif
-            resolvingBase = false;
-            ++pc;
-            break;
-        }
-        case ResolveOperation::SetBaseToScope:
-            RELEASE_ASSERT(baseVR);
-            setBase = true;
-            emitStoreCell(*baseVR, scope);
-            resolvingBase = false;
-            ++pc;
-            break;
-        case ResolveOperation::ReturnScopeAsBase:
-            emitStoreCell(*baseVR, scope);
-            RELEASE_ASSERT(value == regT0);
-            move(scope, value);
-#if USE(JSVALUE32_64)
-            move(TrustedImm32(JSValue::CellTag), valueTag);
-#endif
-            emitValueProfilingSite();
-            return;
-        case ResolveOperation::SkipTopScopeNode: {
-#if USE(JSVALUE32_64)
-            Jump activationNotCreated = branch32(Equal, tagFor(m_codeBlock-&gt;activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
-#else
-            Jump activationNotCreated = branchTest64(Zero, addressFor(m_codeBlock-&gt;activationRegister()));
-#endif
-            loadPtr(Address(scope, JSScope::offsetOfNext()), scope);
-            activationNotCreated.link(this);
-            ++pc;
-            break;
-        }
-        case ResolveOperation::CheckForDynamicEntriesBeforeGlobalScope: {
-            move(scope, regT3);
-            loadPtr(Address(regT3, JSScope::offsetOfNext()), regT1);
-            Jump atTopOfScope = branchTestPtr(Zero, regT1);
-            Label loopStart = label();
-            loadPtr(Address(regT3, JSCell::structureOffset()), regT2);
-            Jump isActivation = branchPtr(Equal, regT2, TrustedImmPtr(globalObject-&gt;activationStructure()));
-            addSlowCase(branchPtr(NotEqual, regT2, TrustedImmPtr(globalObject-&gt;nameScopeStructure())));
-            isActivation.link(this);
-            move(regT1, regT3);
-            loadPtr(Address(regT3, JSScope::offsetOfNext()), regT1);
-            branchTestPtr(NonZero, regT1, loopStart);
-            atTopOfScope.link(this);
-            ++pc;
-            break;
-        }
-        case ResolveOperation::SkipScopes: {
-            for (int i = 0; i &lt; pc-&gt;m_scopesToSkip; i++)
-                loadPtr(Address(scope, JSScope::offsetOfNext()), scope);
-            ++pc;
-            break;
-        }
-        case ResolveOperation::Fail:
-            addSlowCase(jump());
-            return;
-        default:
-            resolvingBase = false;
-        }
-    }
-    if (baseVR &amp;&amp; !setBase)
-        emitStoreCell(*baseVR, scope);
-
-    RELEASE_ASSERT(valueVR);
-    ResolveOperation* resolveValueOperation = pc;
-    switch (resolveValueOperation-&gt;m_operation) {
-    case ResolveOperation::GetAndReturnGlobalProperty: {
-        // Verify structure.
-        move(TrustedImmPtr(globalObject), regT2);
-        move(TrustedImmPtr(resolveValueOperation), regT3);
-        loadPtr(Address(regT3, OBJECT_OFFSETOF(ResolveOperation, m_structure)), regT1);
-        addSlowCase(branchPtr(NotEqual, regT1, Address(regT2, JSCell::structureOffset())));
-
-        // Load property.
-        load32(Address(regT3, OBJECT_OFFSETOF(ResolveOperation, m_offset)), regT3);
-
-        // regT2: GlobalObject
-        // regT3: offset
-#if USE(JSVALUE32_64)
-        compileGetDirectOffset(regT2, valueTag, value, regT3, KnownNotFinal);
-#else
-        compileGetDirectOffset(regT2, value, regT3, regT1, KnownNotFinal);
-#endif
-        break;
-    }
-    case ResolveOperation::GetAndReturnGlobalVarWatchable:
-    case ResolveOperation::GetAndReturnGlobalVar: {
-#if USE(JSVALUE32_64)
-        load32(reinterpret_cast&lt;char*&gt;(pc-&gt;m_registerAddress) + OBJECT_OFFSETOF(JSValue, u.asBits.tag), valueTag);
-        load32(reinterpret_cast&lt;char*&gt;(pc-&gt;m_registerAddress) + OBJECT_OFFSETOF(JSValue, u.asBits.payload), value);
-#else
-        load64(reinterpret_cast&lt;char*&gt;(pc-&gt;m_registerAddress), value);
-#endif
-        break;
-    }
-    case ResolveOperation::GetAndReturnScopedVar: {
-        loadPtr(Address(scope, JSVariableObject::offsetOfRegisters()), scope);
-#if USE(JSVALUE32_64)
-        load32(Address(scope, pc-&gt;m_offset * sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), valueTag);
-        load32(Address(scope, pc-&gt;m_offset * sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), value);
-#else
-        load64(Address(scope, pc-&gt;m_offset * sizeof(Register)), value);
-#endif
-        break;
-    }
-    default:
-        CRASH();
-        return;
-    }
-
-#if USE(JSVALUE32_64)
-    emitStore(*valueVR, valueTag, value);
-#else
-    emitPutVirtualRegister(*valueVR, value);
-#endif
-    emitValueProfilingSite();
-}
-
-void JIT::emitSlow_link_resolve_operations(ResolveOperations* resolveOperations, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    if (resolveOperations-&gt;isEmpty()) {
-        linkSlowCase(iter);
-        return;
-    }
-
-    ResolveOperation* pc = resolveOperations-&gt;data();
-    bool resolvingBase = true;
-    while (resolvingBase) {
-        switch (pc-&gt;m_operation) {
-        case ResolveOperation::ReturnGlobalObjectAsBase:
-            return;
-        case ResolveOperation::SetBaseToGlobal:
-            resolvingBase = false;
-            ++pc;
-            break;
-        case ResolveOperation::SetBaseToUndefined: {
-            resolvingBase = false;
-            ++pc;
-            break;
-        }
-        case ResolveOperation::SetBaseToScope:
-            resolvingBase = false;
-            ++pc;
-            break;
-        case ResolveOperation::ReturnScopeAsBase:
-            return;
-        case ResolveOperation::SkipTopScopeNode: {
-            ++pc;
-            break;
-        }
-        case ResolveOperation::SkipScopes:
-            ++pc;
-            break;
-        case ResolveOperation::Fail:
-            linkSlowCase(iter);
-            return;
-        case ResolveOperation::CheckForDynamicEntriesBeforeGlobalScope: {
-            linkSlowCase(iter);
-            ++pc;
-            break;
-        }
-        default:
-            resolvingBase = false;
-        }
-    }
-    ResolveOperation* resolveValueOperation = pc;
-    switch (resolveValueOperation-&gt;m_operation) {
-    case ResolveOperation::GetAndReturnGlobalProperty: {
-        linkSlowCase(iter);
-        break;
-    }
-    case ResolveOperation::GetAndReturnGlobalVarWatchable:
-    case ResolveOperation::GetAndReturnGlobalVar:
-        break;
-    case ResolveOperation::GetAndReturnScopedVar:
-        break;
-    default:
-        CRASH();
-        return;
-    }
-}
-
-void JIT::emit_op_resolve(Instruction* currentInstruction)
-{
-    ResolveOperations* operations = currentInstruction[3].u.resolveOperations;
-    int dst = currentInstruction[1].u.operand;
-    emit_resolve_operations(operations, 0, &amp;dst);
-}
-
-void JIT::emitSlow_op_resolve(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    ResolveOperations* operations = currentInstruction[3].u.resolveOperations;
-    emitSlow_link_resolve_operations(operations, iter);
-    JITStubCall stubCall(this, cti_op_resolve);
-    stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[3].u.resolveOperations));
-    stubCall.callWithValueProfiling(currentInstruction[1].u.operand);
-}
-
-void JIT::emit_op_resolve_base(Instruction* currentInstruction)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    int dst = currentInstruction[1].u.operand;
-    emit_resolve_operations(operations, &amp;dst, 0);
-}
-
-void JIT::emitSlow_op_resolve_base(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    emitSlow_link_resolve_operations(operations, iter);
-    JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
-    stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[4].u.resolveOperations));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[5].u.putToBaseOperation));
-    stubCall.callWithValueProfiling(currentInstruction[1].u.operand);
-}
-
-void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    int base = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    emit_resolve_operations(operations, &amp;base, &amp;value);
-}
-
-void JIT::emitSlow_op_resolve_with_base(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    emitSlow_link_resolve_operations(operations, iter);
-    JITStubCall stubCall(this, cti_op_resolve_with_base);
-    stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[4].u.resolveOperations));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[5].u.putToBaseOperation));
-    stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
-}
-
-void JIT::emit_op_resolve_with_this(Instruction* currentInstruction)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    int base = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    emit_resolve_operations(operations, &amp;base, &amp;value);
-}
-
-void JIT::emitSlow_op_resolve_with_this(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    ResolveOperations* operations = currentInstruction[4].u.resolveOperations;
-    emitSlow_link_resolve_operations(operations, iter);
-    JITStubCall stubCall(this, cti_op_resolve_with_this);
-    stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(currentInstruction[3].u.operand)));
-    stubCall.addArgument(TrustedImm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(TrustedImmPtr(currentInstruction[4].u.resolveOperations));
-    stubCall.callWithValueProfiling(currentInstruction[2].u.operand);
-}
-
-void JIT::emitSlow_op_put_to_base(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    int base = currentInstruction[1].u.operand;
-    int id = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    PutToBaseOperation* putToBaseOperation = currentInstruction[4].u.putToBaseOperation;
-    switch (putToBaseOperation-&gt;m_kind) {
-    case PutToBaseOperation::VariablePut:
-        return;
-
-    case PutToBaseOperation::GlobalVariablePut:
-        if (!putToBaseOperation-&gt;m_isDynamic)
-            return;
-        linkSlowCase(iter);
-        break;
-
-    case PutToBaseOperation::Uninitialised:
-    case PutToBaseOperation::Readonly:
-    case PutToBaseOperation::Generic:
-        return;
-
-    case PutToBaseOperation::GlobalVariablePutChecked:
-    case PutToBaseOperation::GlobalPropertyPut:
-        linkSlowCase(iter);
-        break;
-
-    }
-
-    JITStubCall stubCall(this, cti_op_put_to_base);
-
-    stubCall.addArgument(TrustedImm32(base));
-    stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(id)));
-    stubCall.addArgument(TrustedImm32(value));
-    stubCall.addArgument(TrustedImmPtr(putToBaseOperation));
-    stubCall.call();
-}
-
</del><span class="cx"> void JIT::emit_op_new_regexp(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     JITStubCall stubCall(this, cti_op_new_regexp);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -426,19 +426,20 @@
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="cx"> {
</span><del>-    int dst = currentInstruction[1].u.operand;
-
</del><span class="cx">     linkSlowCase(iter);
</span><span class="cx"> 
</span><span class="cx">     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_primitive);
</span><span class="cx">     slowPathCall.call();
</span><del>-    emitLoad(dst, regT1, regT0, callFrameRegister);
</del><ins>+    emitLoad(currentInstruction[1].u.operand, regT1, regT0);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_strcat(Instruction* currentInstruction)
</span><span class="cx"> {
</span><ins>+    int dst = currentInstruction[1].u.operand;
+
</ins><span class="cx">     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_strcat);
</span><span class="cx">     slowPathCall.call();
</span><ins>+    emitLoad(dst, regT1, regT0);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
</span><span class="lines">@@ -1280,71 +1281,6 @@
</span><span class="cx">     stubCall.callWithValueProfiling(dst);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_put_to_base(Instruction* currentInstruction)
-{
-    int base = currentInstruction[1].u.operand;
-    int id = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
-
-    PutToBaseOperation* operation = currentInstruction[4].u.putToBaseOperation;
-
-
-    switch (operation-&gt;m_kind) {
-    case PutToBaseOperation::GlobalVariablePutChecked:
-        addSlowCase(branchTest8(NonZero, AbsoluteAddress(operation-&gt;m_predicatePointer)));
-    case PutToBaseOperation::GlobalVariablePut: {
-        JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
-        if (operation-&gt;m_isDynamic)
-            addSlowCase(branchPtr(NotEqual, payloadFor(base), TrustedImmPtr(globalObject)));
-
-        emitLoad(value, regT1, regT0);
-        storePtr(regT0, reinterpret_cast&lt;char*&gt;(operation-&gt;m_registerAddress) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
-        storePtr(regT1, reinterpret_cast&lt;char*&gt;(operation-&gt;m_registerAddress) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(globalObject, regT0, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        break;
-    }
-    case PutToBaseOperation::VariablePut: {
-        loadPtr(payloadFor(base), regT3);
-        emitLoad(value, regT1, regT0);
-        loadPtr(Address(regT3, JSVariableObject::offsetOfRegisters()), regT2);
-        store32(regT0, Address(regT2, operation-&gt;m_offset * sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-        store32(regT1, Address(regT2, operation-&gt;m_offset * sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(regT3, regT1, regT0, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        break;
-    }
-
-    case PutToBaseOperation::GlobalPropertyPut: {
-        JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
-        loadPtr(payloadFor(base), regT3);
-        emitLoad(value, regT1, regT0);
-        loadPtr(&amp;operation-&gt;m_structure, regT2);
-        addSlowCase(branchPtr(NotEqual, Address(regT3, JSCell::structureOffset()), regT2));
-        ASSERT(!operation-&gt;m_structure || !operation-&gt;m_structure-&gt;inlineCapacity());
-        loadPtr(Address(regT3, JSObject::butterflyOffset()), regT2);
-        load32(&amp;operation-&gt;m_offsetInButterfly, regT3);
-        storePtr(regT0, BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-        storePtr(regT1, BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-        if (Heap::isWriteBarrierEnabled())
-            emitWriteBarrier(globalObject, regT1, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-        break;
-    }
-
-    case PutToBaseOperation::Uninitialised:
-    case PutToBaseOperation::Readonly:
-    case PutToBaseOperation::Generic:
-        JITStubCall stubCall(this, cti_op_put_to_base);
-
-        stubCall.addArgument(TrustedImm32(base));
-        stubCall.addArgument(TrustedImmPtr(&amp;m_codeBlock-&gt;identifier(id)));
-        stubCall.addArgument(TrustedImm32(value));
-        stubCall.addArgument(TrustedImmPtr(operation));
-        stubCall.call();
-        break;
-    }
-}
-
</del><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // USE(JSVALUE32_64)
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include &quot;RepatchBuffer.h&quot;
</span><span class="cx"> #include &quot;ResultType.h&quot;
</span><span class="cx"> #include &quot;SamplingTool.h&quot;
</span><ins>+#include &quot;SlowPathCall.h&quot;
</ins><span class="cx"> #include &lt;wtf/StringPrintStream.h&gt;
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -1204,88 +1205,220 @@
</span><span class="cx">     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
</del><ins>+void JIT::emitVarInjectionCheck(bool needsVarInjectionChecks)
</ins><span class="cx"> {
</span><del>-    int skip = currentInstruction[3].u.operand;
</del><ins>+    if (!needsVarInjectionChecks)
+        return;
+    addSlowCase(branchTest8(NonZero, AbsoluteAddress(m_codeBlock-&gt;globalObject()-&gt;varInjectionWatchpoint()-&gt;addressOfIsInvalidated())));
+}
</ins><span class="cx"> 
</span><del>-    emitGetFromCallFrameHeaderPtr(JSStack::ScopeChain, regT0);
-    bool checkTopLevel = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_codeBlock-&gt;needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel &amp;&amp; skip--) {
-        Jump activationNotCreated;
-        if (checkTopLevel)
-            activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock-&gt;activationRegister()));
</del><ins>+void JIT::emitResolveClosure(unsigned dst, bool needsVarInjectionChecks, unsigned depth)
+{
+    emitVarInjectionCheck(needsVarInjectionChecks);
+    emitGetVirtualRegister(JSStack::ScopeChain, regT0);
+    if (m_codeBlock-&gt;needsActivation()) {
+        emitGetVirtualRegister(m_codeBlock-&gt;activationRegister(), regT1);
+        Jump noActivation = branchTestPtr(Zero, regT1);
</ins><span class="cx">         loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
</span><del>-        activationNotCreated.link(this);
</del><ins>+        noActivation.link(this);
</ins><span class="cx">     }
</span><del>-    while (skip--)
</del><ins>+    for (unsigned i = 0; i &lt; depth; ++i)
</ins><span class="cx">         loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
</span><ins>+    emitPutVirtualRegister(dst);
+}
</ins><span class="cx"> 
</span><ins>+void JIT::emit_op_resolve_scope(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = static_cast&lt;ResolveType&gt;(currentInstruction[3].u.operand);
+    unsigned depth = currentInstruction[4].u.operand;
+
+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalVar:
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        move(TrustedImmPtr(m_codeBlock-&gt;globalObject()), regT0);
+        emitPutVirtualRegister(dst);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitResolveClosure(dst, needsVarInjectionChecks(resolveType), depth);
+        break;
+    case Dynamic:
+        killLastResultRegister();
+        addSlowCase(jump());
+        break;
+    }
+}
+
+void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = static_cast&lt;ResolveType&gt;(currentInstruction[3].u.operand);
+
+    if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
+    slowPathCall.call();
+    emitGetVirtualRegister(dst, regT0);
+}
+
+void JIT::emitLoadWithStructureCheck(unsigned scope, Structure** structureSlot)
+{
+    emitGetVirtualRegister(scope, regT0);
+    loadPtr(structureSlot, regT1);
+    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), regT1));
+}
+
+void JIT::emitGetGlobalProperty(uintptr_t* operandSlot)
+{
+    load32(operandSlot, regT1);
+    compileGetDirectOffset(regT0, regT0, regT1, regT2, KnownNotFinal);
+}
+
+void JIT::emitGetGlobalVar(uintptr_t operand)
+{
+    loadPtr(reinterpret_cast&lt;void*&gt;(operand), regT0);
+}
+
+void JIT::emitGetClosureVar(unsigned scope, uintptr_t operand)
+{
+    emitGetVirtualRegister(scope, regT0);
</ins><span class="cx">     loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT0);
</span><del>-    loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
</del><ins>+    loadPtr(Address(regT0, operand * sizeof(Register)), regT0);
+}
+
+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast&lt;uintptr_t*&gt;(&amp;currentInstruction[6].u.pointer);
+
+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalPropertyWithVarInjectionChecks:
+        emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+        emitGetGlobalProperty(operandSlot);
+        break;
+    case GlobalVar:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitGetGlobalVar(*operandSlot);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitGetClosureVar(scope, *operandSlot);
+        break;
+    case Dynamic:
+        killLastResultRegister();
+        addSlowCase(jump());
+        break;
+    }
+    emitPutVirtualRegister(dst);
</ins><span class="cx">     emitValueProfilingSite();
</span><del>-    emitPutVirtualRegister(currentInstruction[1].u.operand);
</del><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
</del><ins>+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</ins><span class="cx"> {
</span><del>-    int skip = currentInstruction[2].u.operand;
</del><ins>+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
</ins><span class="cx"> 
</span><del>-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
</del><ins>+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
</ins><span class="cx"> 
</span><del>-    emitGetFromCallFrameHeaderPtr(JSStack::ScopeChain, regT1);
-    bool checkTopLevel = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_codeBlock-&gt;needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel &amp;&amp; skip--) {
-        Jump activationNotCreated;
-        if (checkTopLevel)
-            activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock-&gt;activationRegister()));
-        loadPtr(Address(regT1, JSScope::offsetOfNext()), regT1);
-        activationNotCreated.link(this);
-    }
-    while (skip--)
-        loadPtr(Address(regT1, JSScope::offsetOfNext()), regT1);
</del><ins>+    linkSlowCase(iter);
</ins><span class="cx"> 
</span><del>-    emitWriteBarrier(regT1, regT0, regT2, regT3, ShouldFilterImmediates, WriteBarrierForVariableAccess);
</del><ins>+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_from_scope);
+    slowPathCall.call();
+    emitGetVirtualRegister(dst, regT0);
+    emitValueProfilingSite();
+}
</ins><span class="cx"> 
</span><del>-    loadPtr(Address(regT1, JSVariableObject::offsetOfRegisters()), regT1);
-    storePtr(regT0, Address(regT1, currentInstruction[1].u.operand * sizeof(Register)));
</del><ins>+void JIT::emitPutGlobalProperty(uintptr_t* operandSlot, unsigned value)
+{
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+    loadPtr(operandSlot, regT1);
+    negPtr(regT1);
+    emitGetVirtualRegister(value, regT2);
+    storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_init_global_const(Instruction* currentInstruction)
</del><ins>+void JIT::emitPutGlobalVar(uintptr_t operand, unsigned value)
</ins><span class="cx"> {
</span><del>-    JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
</del><ins>+    emitGetVirtualRegister(value, regT0);
+    storePtr(regT0, reinterpret_cast&lt;void*&gt;(operand));
+}
</ins><span class="cx"> 
</span><del>-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
</del><ins>+void JIT::emitPutClosureVar(unsigned scope, uintptr_t operand, unsigned value)
+{
+    emitGetVirtualRegister(value, regT1);
+    emitGetVirtualRegister(scope, regT0);
+    loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT0);
+    storePtr(regT1, Address(regT0, operand * sizeof(Register)));
+}
</ins><span class="cx"> 
</span><del>-    store64(regT0, currentInstruction[1].u.registerPointer);
-    if (Heap::isWriteBarrierEnabled())
-        emitWriteBarrier(globalObject, regT0, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
</del><ins>+void JIT::emit_op_put_to_scope(Instruction* currentInstruction)
+{
+    unsigned scope = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast&lt;uintptr_t*&gt;(&amp;currentInstruction[6].u.pointer);
+
+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalPropertyWithVarInjectionChecks:
+        emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+        emitPutGlobalProperty(operandSlot, value);
+        break;
+    case GlobalVar:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitPutGlobalVar(*operandSlot, value);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitPutClosureVar(scope, *operandSlot, value);
+        break;
+    case Dynamic:
+        killLastResultRegister();
+        addSlowCase(jump());
+        break;
+    }
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_init_global_const_check(Instruction* currentInstruction)
</del><ins>+void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</ins><span class="cx"> {
</span><del>-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
</del><ins>+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
</ins><span class="cx"> 
</span><del>-    addSlowCase(branchTest8(NonZero, AbsoluteAddress(currentInstruction[3].u.predicatePointer)));
</del><ins>+    linkSlowCase(iter);
</ins><span class="cx"> 
</span><ins>+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_to_scope);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_init_global_const(Instruction* currentInstruction)
+{
</ins><span class="cx">     JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
</span><span class="cx"> 
</span><ins>+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+
</ins><span class="cx">     store64(regT0, currentInstruction[1].u.registerPointer);
</span><span class="cx">     if (Heap::isWriteBarrierEnabled())
</span><span class="cx">         emitWriteBarrier(globalObject, regT0, regT2, ShouldFilterImmediates, WriteBarrierForVariableAccess);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emitSlow_op_init_global_const_check(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    linkSlowCase(iter);
-
-    JITStubCall stubCall(this, cti_op_init_global_const_check);
-    stubCall.addArgument(regT0);
-    stubCall.addArgument(TrustedImm32(currentInstruction[4].u.operand));
-    stubCall.call();
-}
-
</del><span class="cx"> void JIT::resetPatchGetById(RepatchBuffer&amp; repatchBuffer, StructureStubInfo* stubInfo)
</span><span class="cx"> {
</span><span class="cx">     repatchBuffer.relink(stubInfo-&gt;callReturnLocation, cti_op_get_by_id);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include &quot;RepatchBuffer.h&quot;
</span><span class="cx"> #include &quot;ResultType.h&quot;
</span><span class="cx"> #include &quot;SamplingTool.h&quot;
</span><ins>+#include &quot;SlowPathCall.h&quot;
</ins><span class="cx"> #include &lt;wtf/StringPrintStream.h&gt;
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -1244,57 +1245,216 @@
</span><span class="cx">     stubCall.call(dst);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
</del><ins>+void JIT::emitVarInjectionCheck(bool needsVarInjectionChecks)
</ins><span class="cx"> {
</span><del>-    int dst = currentInstruction[1].u.operand;
-    int index = currentInstruction[2].u.operand;
-    int skip = currentInstruction[3].u.operand;
</del><ins>+    if (!needsVarInjectionChecks)
+        return;
+    addSlowCase(branchTest8(NonZero, AbsoluteAddress(m_codeBlock-&gt;globalObject()-&gt;varInjectionWatchpoint()-&gt;addressOfIsInvalidated())));
+}
</ins><span class="cx"> 
</span><del>-    emitGetFromCallFrameHeaderPtr(JSStack::ScopeChain, regT2);
-    bool checkTopLevel = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_codeBlock-&gt;needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel &amp;&amp; skip--) {
-        Jump activationNotCreated;
-        if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock-&gt;activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
-        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
-        activationNotCreated.link(this);
</del><ins>+void JIT::emitResolveClosure(unsigned dst, bool needsVarInjectionChecks, unsigned depth)
+{
+    emitVarInjectionCheck(needsVarInjectionChecks);
+    move(TrustedImm32(JSValue::CellTag), regT1);
+    emitLoadPayload(JSStack::ScopeChain, regT0);
+    if (m_codeBlock-&gt;needsActivation()) {
+        emitLoadPayload(m_codeBlock-&gt;activationRegister(), regT2);
+        Jump noActivation = branchTestPtr(Zero, regT2);
+        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT0);
+        noActivation.link(this);
</ins><span class="cx">     }
</span><del>-    while (skip--)
-        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
</del><ins>+    for (unsigned i = 0; i &lt; depth; ++i)
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeOffset + OPCODE_LENGTH(op_resolve_scope), dst, regT1, regT0);
+}
</ins><span class="cx"> 
</span><del>-    loadPtr(Address(regT2, JSVariableObject::offsetOfRegisters()), regT2);
</del><ins>+void JIT::emit_op_resolve_scope(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = static_cast&lt;ResolveType&gt;(currentInstruction[3].u.operand);
+    unsigned depth = currentInstruction[4].u.operand;
</ins><span class="cx"> 
</span><del>-    emitLoad(index, regT1, regT0, regT2);
</del><ins>+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalVar:
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        move(TrustedImm32(JSValue::CellTag), regT1);
+        move(TrustedImmPtr(m_codeBlock-&gt;globalObject()), regT0);
+        emitStore(dst, regT1, regT0);
+        map(m_bytecodeOffset + OPCODE_LENGTH(op_resolve_scope), dst, regT1, regT0);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitResolveClosure(dst, needsVarInjectionChecks(resolveType), depth);
+        break;
+    case Dynamic:
+        addSlowCase(jump());
+        break;
+    }
+}
+
+void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = static_cast&lt;ResolveType&gt;(currentInstruction[3].u.operand);
+
+    if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
+    slowPathCall.call();
+    emitLoad(dst, regT1, regT0, callFrameRegister);
+}
+
+void JIT::emitLoadWithStructureCheck(unsigned scope, Structure** structureSlot)
+{
+    emitLoad(scope, regT1, regT0);
+    loadPtr(structureSlot, regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), regT2));
+}
+
+void JIT::emitGetGlobalProperty(uintptr_t* operandSlot)
+{
+    move(regT0, regT2);
+    load32(operandSlot, regT3);
+    compileGetDirectOffset(regT2, regT1, regT0, regT3, KnownNotFinal);
+}
+
+void JIT::emitGetGlobalVar(uintptr_t operand)
+{
+    load32(reinterpret_cast&lt;char*&gt;(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag), regT1);
+    load32(reinterpret_cast&lt;char*&gt;(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), regT0);
+}
+
+void JIT::emitGetClosureVar(unsigned scope, uintptr_t operand)
+{
+    emitLoad(scope, regT1, regT0);
+    loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT0);
+    load32(Address(regT0, operand * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), regT1);
+    load32(Address(regT0, operand * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), regT0);
+}
+
+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast&lt;uintptr_t*&gt;(&amp;currentInstruction[6].u.pointer);
+
+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalPropertyWithVarInjectionChecks:
+        emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+        emitGetGlobalProperty(operandSlot);
+        break;
+    case GlobalVar:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitGetGlobalVar(*operandSlot);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitGetClosureVar(scope, *operandSlot);
+        break;
+    case Dynamic:
+        addSlowCase(jump());
+        break;
+    }
</ins><span class="cx">     emitValueProfilingSite();
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_scoped_var), dst, regT1, regT0);
</del><ins>+    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_from_scope), dst, regT1, regT0);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
</del><ins>+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</ins><span class="cx"> {
</span><del>-    int index = currentInstruction[1].u.operand;
-    int skip = currentInstruction[2].u.operand;
-    int value = currentInstruction[3].u.operand;
</del><ins>+    unsigned dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
</ins><span class="cx"> 
</span><ins>+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_from_scope);
+    slowPathCall.call();
+    emitLoad(dst, regT1, regT0, callFrameRegister);
+    emitValueProfilingSite();
+}
+
+void JIT::emitPutGlobalProperty(uintptr_t* operandSlot, unsigned value)
+{
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+    loadPtr(operandSlot, regT1);
+    negPtr(regT1);
+    emitLoad(value, regT3, regT2);
+    store32(regT3, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    store32(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+}
+
+void JIT::emitPutGlobalVar(uintptr_t operand, unsigned value)
+{
</ins><span class="cx">     emitLoad(value, regT1, regT0);
</span><ins>+    store32(regT1, reinterpret_cast&lt;char*&gt;(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+    store32(regT0, reinterpret_cast&lt;char*&gt;(operand) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+}
</ins><span class="cx"> 
</span><del>-    emitGetFromCallFrameHeaderPtr(JSStack::ScopeChain, regT2);
-    bool checkTopLevel = m_codeBlock-&gt;codeType() == FunctionCode &amp;&amp; m_codeBlock-&gt;needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel &amp;&amp; skip--) {
-        Jump activationNotCreated;
-        if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock-&gt;activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
-        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
-        activationNotCreated.link(this);
</del><ins>+void JIT::emitPutClosureVar(unsigned scope, uintptr_t operand, unsigned value)
+{
+    emitLoad(value, regT3, regT2);
+    emitLoad(scope, regT1, regT0);
+    loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT0);
+    store32(regT3, Address(regT0, operand * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    store32(regT2, Address(regT0, operand * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+}
+
+void JIT::emit_op_put_to_scope(Instruction* currentInstruction)
+{
+    unsigned scope = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[3].u.operand;
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast&lt;uintptr_t*&gt;(&amp;currentInstruction[6].u.pointer);
+
+    switch (resolveType) {
+    case GlobalProperty:
+    case GlobalPropertyWithVarInjectionChecks:
+        emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+        emitPutGlobalProperty(operandSlot, value);
+        break;
+    case GlobalVar:
+    case GlobalVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitPutGlobalVar(*operandSlot, value);
+        break;
+    case ClosureVar:
+    case ClosureVarWithVarInjectionChecks:
+        emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+        emitPutClosureVar(scope, *operandSlot, value);
+        break;
+    case Dynamic:
+        addSlowCase(jump());
+        break;
</ins><span class="cx">     }
</span><del>-    while (skip--)
-        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
</del><ins>+}
</ins><span class="cx"> 
</span><del>-    loadPtr(Address(regT2, JSVariableObject::offsetOfRegisters()), regT3);
-    emitStore(index, regT1, regT0, regT3);
-    emitWriteBarrier(regT2, regT1, regT0, regT1, ShouldFilterImmediates, WriteBarrierForVariableAccess);
</del><ins>+void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
+
+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_to_scope);
+    slowPathCall.call();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_init_global_const(Instruction* currentInstruction)
</span><span class="lines">@@ -1317,37 +1477,6 @@
</span><span class="cx">     map(m_bytecodeOffset + OPCODE_LENGTH(op_init_global_const), value, regT1, regT0);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JIT::emit_op_init_global_const_check(Instruction* currentInstruction)
-{
-    WriteBarrier&lt;Unknown&gt;* registerPointer = currentInstruction[1].u.registerPointer;
-    int value = currentInstruction[2].u.operand;
-    
-    JSGlobalObject* globalObject = m_codeBlock-&gt;globalObject();
-    
-    emitLoad(value, regT1, regT0);
-    
-    addSlowCase(branchTest8(NonZero, AbsoluteAddress(currentInstruction[3].u.predicatePointer)));
-    
-    if (Heap::isWriteBarrierEnabled()) {
-        move(TrustedImmPtr(globalObject), regT2);
-        emitWriteBarrier(globalObject, regT1, regT3, ShouldFilterImmediates, WriteBarrierForVariableAccess);
-    }
-    
-    store32(regT1, registerPointer-&gt;tagPointer());
-    store32(regT0, registerPointer-&gt;payloadPointer());
-    unmap();
-}
-
-void JIT::emitSlow_op_init_global_const_check(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
-{
-    linkSlowCase(iter);
-    
-    JITStubCall stubCall(this, cti_op_init_global_const_check);
-    stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(TrustedImm32(currentInstruction[4].u.operand));
-    stubCall.call();
-}
-
</del><span class="cx"> void JIT::resetPatchGetById(RepatchBuffer&amp; repatchBuffer, StructureStubInfo* stubInfo)
</span><span class="cx"> {
</span><span class="cx">     repatchBuffer.relink(stubInfo-&gt;callReturnLocation, cti_op_get_by_id);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITStubscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -1427,54 +1427,6 @@
</span><span class="cx">     return constructArray(stackFrame.callFrame, stackFrame.args[2].arrayAllocationProfile(), stackFrame.callFrame-&gt;codeBlock()-&gt;constantBuffer(stackFrame.args[0].int32()), stackFrame.args[1].int32());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-DEFINE_STUB_FUNCTION(void, op_init_global_const_check)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-    
-    CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* codeBlock = callFrame-&gt;codeBlock();
-    symbolTablePut(codeBlock-&gt;globalObject(), callFrame, codeBlock-&gt;identifier(stackFrame.args[1].int32()), stackFrame.args[0].jsValue(), true);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    
-    ResolveOperations* operations = stackFrame.args[1].resolveOperations();
-    bool willReify = operations-&gt;isEmpty();
-    
-    JSValue result = JSScope::resolve(callFrame, stackFrame.args[0].identifier(), operations);
-    
-    if (willReify) {
-        ConcurrentJITLocker locker(callFrame-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
-DEFINE_STUB_FUNCTION(void, op_put_to_base)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    JSValue base = callFrame-&gt;r(stackFrame.args[0].int32()).jsValue();
-    JSValue value = callFrame-&gt;r(stackFrame.args[2].int32()).jsValue();
-    PutToBaseOperation* operation = stackFrame.args[3].putToBaseOperation();
-    bool firstTime = !operation-&gt;m_ready;
-    JSScope::resolvePut(callFrame, base, stackFrame.args[1].identifier(), value, operation);
-    
-    if (firstTime) {
-        ConcurrentJITLocker locker(callFrame-&gt;codeBlock()-&gt;m_lock);
-        operation-&gt;m_ready = true;
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
</del><span class="cx"> DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
</span><span class="cx"> {
</span><span class="cx">     STUB_INIT_STACK_FRAME(stackFrame);
</span><span class="lines">@@ -1724,42 +1676,6 @@
</span><span class="cx">     return newCallFrame;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-    
-    ResolveOperations* operations = stackFrame.args[1].resolveOperations();
-    bool willReify = operations-&gt;isEmpty();
-    
-    JSValue result = JSScope::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), false, operations, stackFrame.args[2].putToBaseOperation());
-    
-    if (willReify) {
-        ConcurrentJITLocker locker(stackFrame.callFrame-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    
-    return JSValue::encode(result);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base_strict_put)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    ResolveOperations* operations = stackFrame.args[1].resolveOperations();
-    bool willReify = operations-&gt;isEmpty();
-    
-    if (JSValue result = JSScope::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), true, operations, stackFrame.args[2].putToBaseOperation())) {
-        
-        if (willReify) {
-            ConcurrentJITLocker locker(stackFrame.callFrame-&gt;codeBlock()-&gt;m_lock);
-            operations-&gt;m_ready = true;
-        }
-        
-        return JSValue::encode(result);
-    }
-    VM_THROW_EXCEPTION();
-}
-
</del><span class="cx"> DEFINE_STUB_FUNCTION(EncodedJSValue, op_ensure_property_exists)
</span><span class="cx"> {
</span><span class="cx">     STUB_INIT_STACK_FRAME(stackFrame);
</span><span class="lines">@@ -1954,38 +1870,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    ResolveOperations* operations = stackFrame.args[2].resolveOperations();
-    bool willReify = operations-&gt;isEmpty();
-    JSValue result = JSScope::resolveWithBase(callFrame, stackFrame.args[0].identifier(), &amp;callFrame-&gt;registers()[stackFrame.args[1].int32()], operations, stackFrame.args[3].putToBaseOperation());
-    if (willReify) {
-        ConcurrentJITLocker locker(stackFrame.callFrame-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_this)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    CallFrame* callFrame = stackFrame.callFrame;
-    ResolveOperations* operations = stackFrame.args[2].resolveOperations();
-    bool willReify = operations-&gt;isEmpty();
-    JSValue result = JSScope::resolveWithThis(callFrame, stackFrame.args[0].identifier(), &amp;callFrame-&gt;registers()[stackFrame.args[1].int32()], operations);
-    if (willReify) {
-        ConcurrentJITLocker locker(stackFrame.callFrame-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
-}
-
</del><span class="cx"> DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
</span><span class="cx"> {
</span><span class="cx">     STUB_INIT_STACK_FRAME(stackFrame);
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorejitJITStubsh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -36,7 +36,6 @@
</span><span class="cx"> #include &quot;LowLevelInterpreter.h&quot;
</span><span class="cx"> #include &quot;MacroAssemblerCodeRef.h&quot;
</span><span class="cx"> #include &quot;Register.h&quot;
</span><del>-#include &quot;ResolveOperation.h&quot;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -83,8 +82,6 @@
</span><span class="cx">     JSString* jsString() { return static_cast&lt;JSString*&gt;(asPointer); }
</span><span class="cx">     Structure* structure() { return static_cast&lt;Structure*&gt;(asPointer); }
</span><span class="cx">     ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
</span><del>-    ResolveOperations* resolveOperations() { return static_cast&lt;ResolveOperations*&gt;(asPointer); }
-    PutToBaseOperation* putToBaseOperation() { return static_cast&lt;PutToBaseOperation*&gt;(asPointer); }
</del><span class="cx">     ArrayAllocationProfile* arrayAllocationProfile() { return static_cast&lt;ArrayAllocationProfile*&gt;(asPointer); }
</span><span class="cx"> };
</span><span class="cx">     
</span><span class="lines">@@ -351,13 +348,7 @@
</span><span class="cx"> EncodedJSValue JIT_STUB cti_op_is_number(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_STUB cti_op_is_string(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_STUB cti_op_is_undefined(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><del>-EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-EncodedJSValue JIT_STUB cti_op_resolve_base_strict_put(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</del><span class="cx"> EncodedJSValue JIT_STUB cti_op_ensure_property_exists(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><del>-EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-EncodedJSValue JIT_STUB cti_op_resolve_with_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-void JIT_STUB cti_op_put_to_base(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</del><span class="cx"> EncodedJSValue JIT_STUB cti_to_object(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> JSObject* JIT_STUB cti_op_new_array_with_size(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="lines">@@ -396,7 +387,6 @@
</span><span class="cx"> void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> void JIT_STUB cti_op_put_by_val_generic(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> void JIT_STUB cti_op_put_getter_setter(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><del>-void JIT_STUB cti_op_init_global_const_check(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</del><span class="cx"> void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span><span class="cx"> void JIT_STUB cti_op_throw_static_error(STUB_ARGS_DECLARATION) WTF_INTERNAL;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntData.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntData.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntData.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -31,8 +31,10 @@
</span><span class="cx"> #include &quot;BytecodeConventions.h&quot;
</span><span class="cx"> #include &quot;CodeType.h&quot;
</span><span class="cx"> #include &quot;Instruction.h&quot;
</span><ins>+#include &quot;JSScope.h&quot;
</ins><span class="cx"> #include &quot;LLIntCLoop.h&quot;
</span><span class="cx"> #include &quot;Opcode.h&quot;
</span><ins>+#include &quot;PropertyOffset.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace LLInt {
</span><span class="cx"> 
</span><span class="lines">@@ -112,7 +114,17 @@
</span><span class="cx">     ASSERT(GlobalCode == 0);
</span><span class="cx">     ASSERT(EvalCode == 1);
</span><span class="cx">     ASSERT(FunctionCode == 2);
</span><ins>+
+    ASSERT(GlobalProperty == 0);
+    ASSERT(GlobalVar == 1);
+    ASSERT(ClosureVar == 2);
+    ASSERT(GlobalPropertyWithVarInjectionChecks == 3);
+    ASSERT(GlobalVarWithVarInjectionChecks == 4);
+    ASSERT(ClosureVarWithVarInjectionChecks == 5);
+    ASSERT(Dynamic == 6);
</ins><span class="cx">     
</span><ins>+    ASSERT(ResolveModeAndType::mask == 0xffff);
+
</ins><span class="cx">     // FIXME: make these assertions less horrible.
</span><span class="cx"> #if !ASSERT_DISABLED
</span><span class="cx">     Vector&lt;int&gt; testVector;
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -498,106 +498,6 @@
</span><span class="cx">     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_resolve)
-{
-    LLINT_BEGIN();
-    Identifier ident = exec-&gt;codeBlock()-&gt;identifier(pc[2].u.operand);
-    ResolveOperations* operations = pc[3].u.resolveOperations;
-    JSValue result = JSScope::resolve(exec, ident, operations);
-    ASSERT(operations-&gt;size());
-    switch (operations-&gt;data()[0].m_operation) {
-    case ResolveOperation::GetAndReturnGlobalProperty:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_global_property);
-        break;
-
-    case ResolveOperation::GetAndReturnGlobalVar:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_global_var);
-        break;
-
-    case ResolveOperation::SkipTopScopeNode:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_scoped_var_with_top_scope_check);
-        break;
-
-    case ResolveOperation::SkipScopes:
-        if (operations-&gt;data()[0].m_scopesToSkip)
-            pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_scoped_var);
-        else
-            pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_scoped_var_on_top_scope);
-        break;
-
-    default:
-        break;
-    }
-    
-    {
-        ConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    
-    LLINT_RETURN_PROFILED(op_resolve, result);
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_put_to_base)
-{
-    LLINT_BEGIN();
-    PutToBaseOperation* operation = pc[4].u.putToBaseOperation;
-    JSScope::resolvePut(exec, LLINT_OP_C(1).jsValue(), exec-&gt;codeBlock()-&gt;identifier(pc[2].u.operand), LLINT_OP_C(3).jsValue(), operation);
-    switch (operation-&gt;m_kind) {
-    case PutToBaseOperation::VariablePut:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_put_to_base_variable);
-        break;
-
-    default:
-        break;
-    }
-
-    {
-        ConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock);
-        operation-&gt;m_ready = true;
-    }
-    
-    LLINT_END();
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_resolve_base)
-{
-    LLINT_BEGIN();
-    Identifier&amp; ident = exec-&gt;codeBlock()-&gt;identifier(pc[2].u.operand);
-    ResolveOperations* operations = pc[4].u.resolveOperations;
-    JSValue result;
-    if (pc[3].u.operand) {
-        result = JSScope::resolveBase(exec, ident, true, operations, pc[5].u.putToBaseOperation);
-        if (!result)
-            LLINT_THROW(vm.exception);
-    } else
-        result = JSScope::resolveBase(exec, ident, false, operations, pc[5].u.putToBaseOperation);
-    ASSERT(operations-&gt;size());
-    switch (operations-&gt;data()[0].m_operation) {
-    case ResolveOperation::ReturnGlobalObjectAsBase:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_base_to_global);
-        break;
-
-    case ResolveOperation::SkipTopScopeNode:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_base_to_scope_with_top_scope_check);
-        break;
-
-    case ResolveOperation::SkipScopes:
-        pc[0].u.opcode = LLInt::getOpcode(llint_op_resolve_base_to_scope);
-        break;
-
-    default:
-        break;
-    }
-    
-    {
-        ConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    
-    LLINT_PROFILE_VALUE(op_resolve_base, result);
-    LLINT_RETURN(result);
-}
-
</del><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_ensure_property_exists)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><span class="lines">@@ -609,46 +509,6 @@
</span><span class="cx">     LLINT_END();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_resolve_with_base)
-{
-    LLINT_BEGIN();
-    ResolveOperations* operations = pc[4].u.resolveOperations;
-    bool willReify = operations-&gt;isEmpty();
-    JSValue result = JSScope::resolveWithBase(exec, exec-&gt;codeBlock()-&gt;identifier(pc[3].u.operand), &amp;LLINT_OP(1), operations, pc[5].u.putToBaseOperation);
-    if (willReify) {
-        ConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    LLINT_CHECK_EXCEPTION();
-    LLINT_OP(2) = result;
-    LLINT_PROFILE_VALUE(op_resolve_with_base, result);
-    LLINT_END();
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_resolve_with_this)
-{
-    LLINT_BEGIN();
-    ResolveOperations* operations = pc[4].u.resolveOperations;
-    bool willReify = operations-&gt;isEmpty();
-    JSValue result = JSScope::resolveWithThis(exec, exec-&gt;codeBlock()-&gt;identifier(pc[3].u.operand), &amp;LLINT_OP(1), operations);
-    if (willReify) {
-        ConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock);
-        operations-&gt;m_ready = true;
-    }
-    LLINT_CHECK_EXCEPTION();
-    LLINT_OP(2) = result;
-    LLINT_PROFILE_VALUE(op_resolve_with_this, result);
-    LLINT_END();
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_init_global_const_check)
-{
-    LLINT_BEGIN();
-    CodeBlock* codeBlock = exec-&gt;codeBlock();
-    symbolTablePut(codeBlock-&gt;globalObject(), exec, codeBlock-&gt;identifier(pc[4].u.operand), LLINT_OP_C(2).jsValue(), true);
-    LLINT_END();
-}
-
</del><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLLIntSlowPathsh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -77,7 +77,6 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_ensure_property_exists);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_with_base);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_with_this);
</span><del>-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_init_global_const_check);
</del><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_arguments_length);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id);
</span><span class="lines">@@ -123,6 +122,9 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_debug);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_will_call);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_did_call);
</span><ins>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
</ins><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(throw_from_native_call);
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::LLInt
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -124,28 +124,16 @@
</span><span class="cx"> # Copied from PropertyOffset.h
</span><span class="cx"> const firstOutOfLineOffset = 100
</span><span class="cx"> 
</span><del>-# From ResolveOperations.h
-const ResolveOperationFail = 0
-const ResolveOperationSetBaseToUndefined = 1
-const ResolveOperationReturnScopeAsBase = 2
-const ResolveOperationSetBaseToScope = 3
-const ResolveOperationSetBaseToGlobal = 4
-const ResolveOperationGetAndReturnScopedVar = 5
-const ResolveOperationGetAndReturnGlobalVar = 6
-const ResolveOperationGetAndReturnGlobalVarWatchable = 7
-const ResolveOperationSkipTopScopeNode = 8
-const ResolveOperationSkipScopes = 9
-const ResolveOperationReturnGlobalObjectAsBase = 10
-const ResolveOperationGetAndReturnGlobalProperty = 11
-const ResolveOperationCheckForDynamicEntriesBeforeGlobalScope = 12
</del><ins>+# ResolveType
+const GlobalProperty = 0
+const GlobalVar = 1
+const ClosureVar = 2
+const GlobalPropertyWithVarInjectionChecks = 3
+const GlobalVarWithVarInjectionChecks = 4
+const ClosureVarWithVarInjectionChecks = 5
+const Dynamic = 6
</ins><span class="cx"> 
</span><del>-const PutToBaseOperationKindUninitialised = 0
-const PutToBaseOperationKindGeneric = 1
-const PutToBaseOperationKindReadonly = 2
-const PutToBaseOperationKindGlobalVariablePut = 3
-const PutToBaseOperationKindGlobalVariablePutChecked = 4
-const PutToBaseOperationKindGlobalPropertyPut = 5
-const PutToBaseOperationKindVariablePut = 6
</del><ins>+const ResolveModeMask = 0xffff
</ins><span class="cx"> 
</span><span class="cx"> # Allocation constants
</span><span class="cx"> if JSVALUE64
</span><span class="lines">@@ -162,7 +150,6 @@
</span><span class="cx">     const VectorBufferOffset = 4
</span><span class="cx"> end
</span><span class="cx"> 
</span><del>-
</del><span class="cx"> # Some common utilities.
</span><span class="cx"> macro crash()
</span><span class="cx">     if C_LOOP
</span><span class="lines">@@ -524,416 +511,11 @@
</span><span class="cx">     callSlowPath(_slow_path_in)
</span><span class="cx">     dispatch(4)
</span><span class="cx"> 
</span><del>-macro getPutToBaseOperationField(scratch, scratch1, fieldOffset, fieldGetter)
-    loadpFromInstruction(4, scratch)
-    fieldGetter(fieldOffset[scratch])
-end
-
-macro moveJSValueFromRegisterWithoutProfiling(value, destBuffer, destOffsetReg)
-    storeq value, [destBuffer, destOffsetReg, 8]
-end
-
-
-macro moveJSValueFromRegistersWithoutProfiling(tag, payload, destBuffer, destOffsetReg)
-    storei tag, TagOffset[destBuffer, destOffsetReg, 8]
-    storei payload, PayloadOffset[destBuffer, destOffsetReg, 8]
-end
-
-macro putToBaseVariableBody(variableOffset, scratch1, scratch2, scratch3)
-    loadisFromInstruction(1, scratch1)
-    loadp PayloadOffset[cfr, scratch1, 8], scratch1
-    loadp JSVariableObject::m_registers[scratch1], scratch1
-    loadisFromInstruction(3, scratch2)
-    if JSVALUE64
-        loadConstantOrVariable(scratch2, scratch3)
-        moveJSValueFromRegisterWithoutProfiling(scratch3, scratch1, variableOffset)
-    else
-        loadConstantOrVariable2Reg(scratch2, scratch3, scratch2) # scratch3=tag, scratch2=payload
-        moveJSValueFromRegistersWithoutProfiling(scratch3, scratch2, scratch1, variableOffset)
-    end
-end
-
-_llint_op_put_to_base_variable:
-    traceExecution()
-    getPutToBaseOperationField(t0, t1, PutToBaseOperation::m_offset, macro(addr)
-                                              loadis  addr, t0
-                                          end)
-    putToBaseVariableBody(t0, t1, t2, t3)
-    dispatch(5)
-
-_llint_op_put_to_base:
-    traceExecution()
-    getPutToBaseOperationField(t0, t1, 0, macro(addr)
-                                              leap addr, t0
-                                              bbneq PutToBaseOperation::m_kindAsUint8[t0], PutToBaseOperationKindVariablePut, .notPutToBaseVariable
-                                              loadis PutToBaseOperation::m_offset[t0], t0
-                                              putToBaseVariableBody(t0, t1, t2, t3)
-                                              dispatch(5)
-                                              .notPutToBaseVariable:
-                                          end)
-    callSlowPath(_llint_slow_path_put_to_base)
-    dispatch(5)
-
-macro getResolveOperation(resolveOperationIndex, dest)
-    loadpFromInstruction(resolveOperationIndex, dest)
-    loadp VectorBufferOffset[dest], dest
-end
-
-macro getScope(loadInitialScope, scopeCount, dest, scratch)
-    loadInitialScope(dest)
-    loadi scopeCount, scratch
-
-    btiz scratch, .done
-.loop:
-    loadp JSScope::m_next[dest], dest
-    subi 1, scratch
-    btinz scratch, .loop
-
-.done:
-end
-
-macro moveJSValue(sourceBuffer, sourceOffsetReg, destBuffer, destOffsetReg, profileOffset, scratchRegister)
-    if JSVALUE64
-        loadq [sourceBuffer, sourceOffsetReg, 8], scratchRegister
-        storeq scratchRegister, [destBuffer, destOffsetReg, 8]
-        loadpFromInstruction(profileOffset, destOffsetReg)
-        valueProfile(scratchRegister, destOffsetReg)
-    else
-        loadi PayloadOffset[sourceBuffer, sourceOffsetReg, 8], scratchRegister
-        storei scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
-        loadi TagOffset[sourceBuffer, sourceOffsetReg, 8], sourceOffsetReg
-        storei sourceOffsetReg, TagOffset[destBuffer, destOffsetReg, 8]
-        loadpFromInstruction(profileOffset, destOffsetReg)
-        valueProfile(sourceOffsetReg, scratchRegister, destOffsetReg)
-    end
-end
-
-macro moveJSValueFromSlot(slot, destBuffer, destOffsetReg, profileOffset, scratchRegister)
-    if JSVALUE64
-        loadq [slot], scratchRegister
-        storeq scratchRegister, [destBuffer, destOffsetReg, 8]
-        loadpFromInstruction(profileOffset, destOffsetReg)
-        valueProfile(scratchRegister, destOffsetReg)
-    else
-        loadi PayloadOffset[slot], scratchRegister
-        storei scratchRegister, PayloadOffset[destBuffer, destOffsetReg, 8]
-        loadi TagOffset[slot], slot
-        storei slot, TagOffset[destBuffer, destOffsetReg, 8]
-        loadpFromInstruction(profileOffset, destOffsetReg)
-        valueProfile(slot, scratchRegister, destOffsetReg)
-    end
-end
-
-macro moveJSValueFromRegister(value, destBuffer, destOffsetReg, profileOffset)
-    storeq value, [destBuffer, destOffsetReg, 8]
-    loadpFromInstruction(profileOffset, destOffsetReg)
-    valueProfile(value, destOffsetReg)
-end
-
-macro moveJSValueFromRegisters(tag, payload, destBuffer, destOffsetReg, profileOffset)
-    storei tag, TagOffset[destBuffer, destOffsetReg, 8]
-    storei payload, PayloadOffset[destBuffer, destOffsetReg, 8]
-    loadpFromInstruction(profileOffset, destOffsetReg)
-    valueProfile(tag, payload, destOffsetReg)
-end
-
-_llint_op_resolve_global_property:
-    traceExecution()
-    getResolveOperation(3, t0)
-    loadp CodeBlock[cfr], t1
-    loadp CodeBlock::m_globalObject[t1], t1
-    loadp ResolveOperation::m_structure[t0], t2
-    bpneq JSCell::m_structure[t1], t2, .llint_op_resolve_local
-    loadis ResolveOperation::m_offset[t0], t0
-    if JSVALUE64
-        loadPropertyAtVariableOffsetKnownNotInline(t0, t1, t2)
-        loadisFromInstruction(1, t0)
-        moveJSValueFromRegister(t2, cfr, t0, 4)
-    else
-        loadPropertyAtVariableOffsetKnownNotInline(t0, t1, t2, t3)
-        loadisFromInstruction(1, t0)
-        moveJSValueFromRegisters(t2, t3, cfr, t0, 4)
-    end
-    dispatch(5)
-
-_llint_op_resolve_global_var:
-    traceExecution()
-    getResolveOperation(3, t0)
-    loadp ResolveOperation::m_registerAddress[t0], t0
-    loadisFromInstruction(1, t1)
-    moveJSValueFromSlot(t0, cfr, t1, 4, t3)
-    dispatch(5)
-
-macro resolveScopedVarBody(resolveOperations)
-    # First ResolveOperation is to skip scope chain nodes
-    getScope(macro(dest)
-                 loadp ScopeChain + PayloadOffset[cfr], dest
-             end,
-             ResolveOperation::m_scopesToSkip[resolveOperations], t1, t2)
-    loadp JSVariableObject::m_registers[t1], t1 # t1 now contains the activation registers
-    
-    # Second ResolveOperation tells us what offset to use
-    loadis ResolveOperation::m_offset + sizeof ResolveOperation[resolveOperations], t2
-    loadisFromInstruction(1, t3)
-    moveJSValue(t1, t2, cfr, t3, 4, t0)
-end
-
-_llint_op_resolve_scoped_var:
-    traceExecution()
-    getResolveOperation(3, t0)
-    resolveScopedVarBody(t0)
-    dispatch(5)
-    
-_llint_op_resolve_scoped_var_on_top_scope:
-    traceExecution()
-    getResolveOperation(3, t0)
-
-    # Load destination index
-    loadisFromInstruction(1, t3)
-
-    # We know we want the top scope chain entry
-    loadp ScopeChain + PayloadOffset[cfr], t1
-    loadp JSVariableObject::m_registers[t1], t1 # t1 now contains the activation registers
-    
-    # Second ResolveOperation tells us what offset to use
-    loadis ResolveOperation::m_offset + sizeof ResolveOperation[t0], t2
-
-    moveJSValue(t1, t2, cfr, t3, 4, t0)
-    dispatch(5)
-
-_llint_op_resolve_scoped_var_with_top_scope_check:
-    traceExecution()
-    getResolveOperation(3, t0)
-    # First ResolveOperation tells us what register to check
-    loadis ResolveOperation::m_activationRegister[t0], t1
-
-    loadp PayloadOffset[cfr, t1, 8], t1
-
-    getScope(macro(dest)
-                 btpz t1, .scopeChainNotCreated
-                     loadp JSScope::m_next[t1], dest
-                 jmp .done
-                 .scopeChainNotCreated:
-                     loadp ScopeChain + PayloadOffset[cfr], dest
-                 .done:
-             end, 
-             # Second ResolveOperation tells us how many more nodes to skip
-             ResolveOperation::m_scopesToSkip + sizeof ResolveOperation[t0], t1, t2)
-    loadp JSVariableObject::m_registers[t1], t1 # t1 now contains the activation registers
-    
-    # Third operation tells us what offset to use
-    loadis ResolveOperation::m_offset + 2 * sizeof ResolveOperation[t0], t2
-    loadisFromInstruction(1, t3)
-    moveJSValue(t1, t2, cfr, t3, 4, t0)
-    dispatch(5)
-
-_llint_op_resolve:
-.llint_op_resolve_local:
-    traceExecution()
-    getResolveOperation(3, t0)
-    btpz t0, .noInstructions
-    loadis ResolveOperation::m_operation[t0], t1
-    bineq t1, ResolveOperationSkipScopes, .notSkipScopes
-        resolveScopedVarBody(t0)
-        dispatch(5)
-.notSkipScopes:
-    bineq t1, ResolveOperationGetAndReturnGlobalVar, .notGetAndReturnGlobalVar
-        loadp ResolveOperation::m_registerAddress[t0], t0
-        loadisFromInstruction(1, t1)
-        moveJSValueFromSlot(t0, cfr, t1, 4, t3)
-        dispatch(5)
-.notGetAndReturnGlobalVar:
-
-.noInstructions:
-    callSlowPath(_llint_slow_path_resolve)
-    dispatch(5)
-
-_llint_op_resolve_base_to_global:
-    traceExecution()
-    loadp CodeBlock[cfr], t1
-    loadp CodeBlock::m_globalObject[t1], t1
-    loadisFromInstruction(1, t3)
-    if JSVALUE64
-        moveJSValueFromRegister(t1, cfr, t3, 6)
-    else
-        move CellTag, t2
-        moveJSValueFromRegisters(t2, t1, cfr, t3, 6)
-    end
-    dispatch(7)
-
-_llint_op_resolve_base_to_global_dynamic:
-    jmp _llint_op_resolve_base
-
-_llint_op_resolve_base_to_scope:
-    traceExecution()
-    getResolveOperation(4, t0)
-    # First ResolveOperation is to skip scope chain nodes
-    getScope(macro(dest)
-                 loadp ScopeChain + PayloadOffset[cfr], dest
-             end,
-             ResolveOperation::m_scopesToSkip[t0], t1, t2)
-    loadisFromInstruction(1, t3)
-    if JSVALUE64
-        moveJSValueFromRegister(t1, cfr, t3, 6)
-    else
-        move CellTag, t2
-        moveJSValueFromRegisters(t2, t1, cfr, t3, 6)
-    end
-    dispatch(7)
-
-_llint_op_resolve_base_to_scope_with_top_scope_check:
-    traceExecution()
-    getResolveOperation(4, t0)
-    # First ResolveOperation tells us what register to check
-    loadis ResolveOperation::m_activationRegister[t0], t1
-
-    loadp PayloadOffset[cfr, t1, 8], t1
-
-    getScope(macro(dest)
-                 btpz t1, .scopeChainNotCreated
-                     loadp JSScope::m_next[t1], dest
-                 jmp .done
-                 .scopeChainNotCreated:
-                     loadp ScopeChain + PayloadOffset[cfr], dest
-                 .done:
-             end, 
-             # Second ResolveOperation tells us how many more nodes to skip
-             ResolveOperation::m_scopesToSkip + sizeof ResolveOperation[t0], t1, t2)
-
-    loadisFromInstruction(1, t3)
-    if JSVALUE64
-        moveJSValueFromRegister(t1, cfr, t3, 6)
-    else
-        move CellTag, t2
-        moveJSValueFromRegisters(t2, t1, cfr, t3, 6)
-    end
-    dispatch(7)
-
-_llint_op_resolve_base:
-    traceExecution()
-    callSlowPath(_llint_slow_path_resolve_base)
-    dispatch(7)
-
</del><span class="cx"> _llint_op_ensure_property_exists:
</span><span class="cx">     traceExecution()
</span><span class="cx">     callSlowPath(_llint_slow_path_ensure_property_exists)
</span><span class="cx">     dispatch(3)
</span><span class="cx"> 
</span><del>-macro interpretResolveWithBase(opcodeLength, slowPath)
-    traceExecution()
-    getResolveOperation(4, t0)
-    btpz t0, .slowPath
-
-    loadp ScopeChain[cfr], t3
-    # Get the base
-    loadis ResolveOperation::m_operation[t0], t2
-
-    bineq t2, ResolveOperationSkipScopes, .notSkipScopes
-        getScope(macro(dest) move t3, dest end,
-                 ResolveOperation::m_scopesToSkip[t0], t1, t2)
-        move t1, t3
-        addp sizeof ResolveOperation, t0, t0
-        jmp .haveCorrectScope
-
-    .notSkipScopes:
-
-    bineq t2, ResolveOperationSkipTopScopeNode, .notSkipTopScopeNode
-        loadis ResolveOperation::m_activationRegister[t0], t1
-        loadp PayloadOffset[cfr, t1, 8], t1
-
-        getScope(macro(dest)
-                     btpz t1, .scopeChainNotCreated
-                         loadp JSScope::m_next[t1], dest
-                     jmp .done
-                     .scopeChainNotCreated:
-                         loadp ScopeChain + PayloadOffset[cfr], dest
-                     .done:
-                 end,
-                 sizeof ResolveOperation + ResolveOperation::m_scopesToSkip[t0], t1, t2)
-        move t1, t3
-        # We've handled two opcodes here
-        addp 2 * sizeof ResolveOperation, t0, t0
-
-    .notSkipTopScopeNode:
-
-    .haveCorrectScope:
-
-    # t3 now contains the correct Scope
-    # t0 contains a pointer to the current ResolveOperation
-
-    loadis ResolveOperation::m_operation[t0], t2
-    # t2 contains the next instruction
-
-    loadisFromInstruction(1, t1)
-    # t1 now contains the index for the base register
-
-    bineq t2, ResolveOperationSetBaseToScope, .notSetBaseToScope
-        if JSVALUE64
-            storeq t3, [cfr, t1, 8]
-        else
-            storei t3, PayloadOffset[cfr, t1, 8]
-            storei CellTag, TagOffset[cfr, t1, 8]
-        end
-        jmp .haveSetBase
-
-    .notSetBaseToScope:
-
-    bineq t2, ResolveOperationSetBaseToUndefined, .notSetBaseToUndefined
-        if JSVALUE64
-            storeq ValueUndefined, [cfr, t1, 8]
-        else
-            storei 0, PayloadOffset[cfr, t1, 8]
-            storei UndefinedTag, TagOffset[cfr, t1, 8]
-        end
-        jmp .haveSetBase
-
-    .notSetBaseToUndefined:
-    bineq t2, ResolveOperationSetBaseToGlobal, .slowPath
-        loadp JSCell::m_structure[t3], t2
-        loadp Structure::m_globalObject[t2], t2
-        if JSVALUE64
-            storeq t2, [cfr, t1, 8]
-        else
-            storei t2, PayloadOffset[cfr, t1, 8]
-            storei CellTag, TagOffset[cfr, t1, 8]
-        end
-
-    .haveSetBase:
-
-    # Get the value
-
-    # Load the operation into t2
-    loadis ResolveOperation::m_operation + sizeof ResolveOperation[t0], t2
-
-    # Load the index for the value register into t1
-    loadisFromInstruction(2, t1)
-
-    bineq t2, ResolveOperationGetAndReturnScopedVar, .notGetAndReturnScopedVar
-        loadp JSVariableObject::m_registers[t3], t3 # t3 now contains the activation registers
-
-        # Second ResolveOperation tells us what offset to use
-        loadis ResolveOperation::m_offset + sizeof ResolveOperation[t0], t2
-        moveJSValue(t3, t2, cfr, t1, opcodeLength - 1, t0)
-        dispatch(opcodeLength)
-
-    .notGetAndReturnScopedVar:
-    bineq t2, ResolveOperationGetAndReturnGlobalProperty, .slowPath
-        callSlowPath(slowPath)
-        dispatch(opcodeLength)
-
-.slowPath:
-    callSlowPath(slowPath)
-    dispatch(opcodeLength)
-end
-
-_llint_op_resolve_with_base:
-    interpretResolveWithBase(7, _llint_slow_path_resolve_with_base)
-
-
-_llint_op_resolve_with_this:
-    interpretResolveWithBase(6, _llint_slow_path_resolve_with_this)
-
-
</del><span class="cx"> macro withInlineStorage(object, propertyStorage, continuation)
</span><span class="cx">     # Indicate that the object is the property storage, and that the
</span><span class="cx">     # property storage register is unused.
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpretercpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -464,7 +464,7 @@
</span><span class="cx">         // from ArgumentCount.tag() (see the dispatchAfterCall() macro used in
</span><span class="cx">         // the callTargetFunction() macro in the llint asm files).
</span><span class="cx">         //
</span><del>-        // For the C loop, we don't have the JIT stub to this work for us. So,
</del><ins>+        // For the C loop, we don't have the JIT stub to do this work for us. So,
</ins><span class="cx">         // we jump to llint_generic_return_point.
</span><span class="cx"> 
</span><span class="cx">         vPC = callFrame-&gt;currentVPC();
</span><span class="lines">@@ -490,11 +490,12 @@
</span><span class="cx">         rBasePC.vp = codeBlock-&gt;instructions().begin();
</span><span class="cx"> #endif // USE(JSVALUE64)
</span><span class="cx"> 
</span><del>-        goto op_generic_return_point;
</del><ins>+        goto llint_generic_return_point;
</ins><span class="cx"> 
</span><span class="cx">     } // END doReturnHelper.
</span><span class="cx"> 
</span><span class="cx"> 
</span><ins>+#if ENABLE(COMPUTED_GOTO_OPCODES)
</ins><span class="cx">     // Keep the compiler happy so that it doesn't complain about unused
</span><span class="cx">     // labels for the LLInt trampoline glue. The labels are automatically
</span><span class="cx">     // emitted by label macros above, and some of them are referenced by
</span><span class="lines">@@ -505,8 +506,8 @@
</span><span class="cx">         UNUSED_LABEL(__opcode);
</span><span class="cx">         FOR_EACH_OPCODE_ID(LLINT_OPCODE_ENTRY);
</span><span class="cx">     #undef LLINT_OPCODE_ENTRY
</span><ins>+#endif
</ins><span class="cx"> 
</span><del>-
</del><span class="cx">     #undef NEXT_INSTRUCTION
</span><span class="cx">     #undef DEFINE_OPCODE
</span><span class="cx">     #undef CHECK_FOR_TIMEOUT
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -102,10 +102,9 @@
</span><span class="cx"> macro dispatchAfterCall()
</span><span class="cx">     loadi ArgumentCount + TagOffset[cfr], PC
</span><span class="cx">     loadi 4[PC], t2
</span><del>-    loadi 28[PC], t3
</del><span class="cx">     storei t1, TagOffset[cfr, t2, 8]
</span><span class="cx">     storei t0, PayloadOffset[cfr, t2, 8]
</span><del>-    valueProfile(t1, t0, t3)
</del><ins>+    valueProfile(t1, t0, 28, t3)
</ins><span class="cx">     dispatch(8)
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="lines">@@ -211,6 +210,12 @@
</span><span class="cx">         end)
</span><span class="cx"> end
</span><span class="cx"> 
</span><ins>+macro loadVariable(operand, index, tag, payload)
+    loadisFromInstruction(operand, index)
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+end
+
</ins><span class="cx"> # Index, tag, and payload must be different registers. Index is not
</span><span class="cx"> # changed.
</span><span class="cx"> macro loadConstantOrVariable(index, tag, payload)
</span><span class="lines">@@ -297,10 +302,11 @@
</span><span class="cx">     # Nothing to do, since we don't have a generational or incremental collector.
</span><span class="cx"> end
</span><span class="cx"> 
</span><del>-macro valueProfile(tag, payload, profile)
</del><ins>+macro valueProfile(tag, payload, operand, scratch)
</ins><span class="cx">     if VALUE_PROFILER
</span><del>-        storei tag, ValueProfile::m_buckets + TagOffset[profile]
-        storei payload, ValueProfile::m_buckets + PayloadOffset[profile]
</del><ins>+        loadp operand[PC], scratch
+        storei tag, ValueProfile::m_buckets + TagOffset[scratch]
+        storei payload, ValueProfile::m_buckets + PayloadOffset[scratch]
</ins><span class="cx">     end
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="lines">@@ -391,8 +397,7 @@
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadi 4[PC], t0
</span><span class="cx">     loadp PayloadOffset + Callee[cfr], t1
</span><del>-    loadp 8[PC], t2
-    valueProfile(CellTag, t1, t2)
</del><ins>+    valueProfile(CellTag, t1, 8, t2)
</ins><span class="cx">     storei CellTag, TagOffset[cfr, t0, 8]
</span><span class="cx">     storei t1, PayloadOffset[cfr, t0, 8]
</span><span class="cx">     dispatch(3)
</span><span class="lines">@@ -405,8 +410,7 @@
</span><span class="cx">     loadi PayloadOffset[cfr, t0, 8], t0
</span><span class="cx">     loadp JSCell::m_structure[t0], t0
</span><span class="cx">     bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
</span><del>-    loadi 8[PC], t1
-    valueProfile(CellTag, t0, t1)
</del><ins>+    valueProfile(CellTag, t0, 8, t1)
</ins><span class="cx">     dispatch(3)
</span><span class="cx"> 
</span><span class="cx"> .opToThisSlow:
</span><span class="lines">@@ -952,25 +956,19 @@
</span><span class="cx">     loadi PayloadOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffset, 8], payload
</span><span class="cx"> end
</span><span class="cx"> 
</span><del>-macro resolveGlobal(size, slow)
-    # Operands are as follows:
-    # 4[PC]   Destination for the load.
-    # 8[PC]   Property identifier index in the code block.
-    # 12[PC]  Structure pointer, initialized to 0 by bytecode generator.
-    # 16[PC]  Offset in global object, initialized to 0 by bytecode generator.
-    loadp CodeBlock[cfr], t0
-    loadp CodeBlock::m_globalObject[t0], t0
-    loadp JSCell::m_structure[t0], t1
-    bpneq t1, 12[PC], slow
-    loadi 16[PC], t1
-    loadPropertyAtVariableOffsetKnownNotInline(t1, t0, t2, t3)
-    loadi 4[PC], t0
-    storei t2, TagOffset[cfr, t0, 8]
-    storei t3, PayloadOffset[cfr, t0, 8]
-    loadi (size - 1) * 4[PC], t0
-    valueProfile(t2, t3, t0)
</del><ins>+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, tag, payload)
+    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    storei tag, TagOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
+    storei payload, PayloadOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
</ins><span class="cx"> end
</span><span class="cx"> 
</span><ins>+
</ins><span class="cx"> _llint_op_init_global_const:
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadi 8[PC], t1
</span><span class="lines">@@ -982,21 +980,6 @@
</span><span class="cx">     dispatch(5)
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-_llint_op_init_global_const_check:
-    traceExecution()
-    loadp 12[PC], t2
-    loadi 8[PC], t1
-    loadi 4[PC], t0
-    btbnz [t2], .opInitGlobalConstCheckSlow
-    loadConstantOrVariable(t1, t2, t3)
-    writeBarrier(t2, t3)
-    storei t2, TagOffset[t0]
-    storei t3, PayloadOffset[t0]
-    dispatch(5)
-.opInitGlobalConstCheckSlow:
-    callSlowPath(_llint_slow_path_init_global_const_check)
-    dispatch(5)
-
</del><span class="cx"> # We only do monomorphic get_by_id caching for now, and we do not modify the
</span><span class="cx"> # opcode. We do, however, allow for the cache to change anytime if fails, since
</span><span class="cx"> # ping-ponging is free. At best we get lucky and the get_by_id will continue
</span><span class="lines">@@ -1019,8 +1002,7 @@
</span><span class="cx">             loadi PayloadOffset[propertyStorage, t2], t2
</span><span class="cx">             storei scratch, TagOffset[cfr, t1, 8]
</span><span class="cx">             storei t2, PayloadOffset[cfr, t1, 8]
</span><del>-            loadi 32[PC], t1
-            valueProfile(scratch, t2, t1)
</del><ins>+            valueProfile(scratch, t2, 32, t1)
</ins><span class="cx">             dispatch(9)
</span><span class="cx">         end)
</span><span class="cx"> 
</span><span class="lines">@@ -1047,11 +1029,10 @@
</span><span class="cx">     btiz t2, IsArray, .opGetArrayLengthSlow
</span><span class="cx">     btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
</span><span class="cx">     loadi 4[PC], t1
</span><del>-    loadp 32[PC], t2
</del><span class="cx">     loadp JSObject::m_butterfly[t3], t0
</span><span class="cx">     loadi -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], t0
</span><span class="cx">     bilt t0, 0, .opGetArrayLengthSlow
</span><del>-    valueProfile(Int32Tag, t0, t2)
</del><ins>+    valueProfile(Int32Tag, t0, 32, t2)
</ins><span class="cx">     storep t0, PayloadOffset[cfr, t1, 8]
</span><span class="cx">     storep Int32Tag, TagOffset[cfr, t1, 8]
</span><span class="cx">     dispatch(9)
</span><span class="lines">@@ -1212,8 +1193,7 @@
</span><span class="cx"> .opGetByValNotEmpty:
</span><span class="cx">     storei t2, TagOffset[cfr, t0, 8]
</span><span class="cx">     storei t1, PayloadOffset[cfr, t0, 8]
</span><del>-    loadi 20[PC], t0
-    valueProfile(t2, t1, t0)
</del><ins>+    valueProfile(t2, t1, 20, t0)
</ins><span class="cx">     dispatch(6)
</span><span class="cx"> 
</span><span class="cx"> .opGetByValOutOfBounds:
</span><span class="lines">@@ -1241,10 +1221,9 @@
</span><span class="cx">     loadi 4[PC], t3
</span><span class="cx">     loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
</span><span class="cx">     loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t1
</span><del>-    loadi 20[PC], t2
</del><span class="cx">     storei t0, TagOffset[cfr, t3, 8]
</span><span class="cx">     storei t1, PayloadOffset[cfr, t3, 8]
</span><del>-    valueProfile(t0, t1, t2)
</del><ins>+    valueProfile(t0, t1, 20, t2)
</ins><span class="cx">     dispatch(6)
</span><span class="cx"> 
</span><span class="cx"> .opGetArgumentByValSlow:
</span><span class="lines">@@ -1771,37 +1750,6 @@
</span><span class="cx"> 
</span><span class="cx"> end
</span><span class="cx"> 
</span><del>-_llint_op_get_scoped_var:
-    traceExecution()
-    # Operands are as follows:
-    # 4[PC]   Destination for the load.
-    # 8[PC]   Index of register in the scope.
-    # 12[PC]  De Bruijin index.
-    getDeBruijnScope(12[PC], macro (scope, scratch) end)
-    loadi 4[PC], t1
-    loadi 8[PC], t2
-    loadp JSVariableObject::m_registers[t0], t0
-    loadi TagOffset[t0, t2, 8], t3
-    loadi PayloadOffset[t0, t2, 8], t0
-    storei t3, TagOffset[cfr, t1, 8]
-    storei t0, PayloadOffset[cfr, t1, 8]
-    loadi 16[PC], t1
-    valueProfile(t3, t0, t1)
-    dispatch(5)
-
-
-_llint_op_put_scoped_var:
-    traceExecution()
-    getDeBruijnScope(8[PC], macro (scope, scratch) end)
-    loadi 12[PC], t1
-    loadConstantOrVariable(t1, t3, t2)
-    loadi 4[PC], t1
-    writeBarrier(t3, t2)
-    loadp JSVariableObject::m_registers[t0], t0
-    storei t3, TagOffset[t0, t1, 8]
-    storei t2, PayloadOffset[t0, t1, 8]
-    dispatch(4)
-
</del><span class="cx"> _llint_op_end:
</span><span class="cx">     traceExecution()
</span><span class="cx">     checkSwitchToJITForEpilogue()
</span><span class="lines">@@ -1899,3 +1847,238 @@
</span><span class="cx">     jmp _llint_throw_from_slow_path_trampoline
</span><span class="cx"> end
</span><span class="cx"> 
</span><ins>+
+macro getGlobalObject(dst)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadisFromInstruction(dst, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+end
+
+macro varInjectionCheck(slowPath)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_varInjectionWatchpoint[t0], t0
+    btbnz WatchpointSet::m_isInvalidated[t0], slowPath
+end
+
+macro resolveScope()
+    loadp CodeBlock[cfr], t0
+    loadisFromInstruction(4, t2)
+    btbz CodeBlock::m_needsActivation[t0], .resolveScopeAfterActivationCheck
+    loadis CodeBlock::m_activationRegister[t0], t1
+    btpz PayloadOffset[cfr, t1, 8], .resolveScopeAfterActivationCheck
+    addi 1, t2
+
+.resolveScopeAfterActivationCheck:
+    loadp ScopeChain[cfr], t0
+    btiz t2, .resolveScopeLoopEnd
+
+.resolveScopeLoop:
+    loadp JSScope::m_next[t0], t0
+    subi 1, t2
+    btinz t2, .resolveScopeLoop
+
+.resolveScopeLoopEnd:
+    loadisFromInstruction(1, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+end
+
+
+_llint_op_resolve_scope:
+    traceExecution()
+    loadisFromInstruction(3, t0)
+
+#rGlobalProperty:
+    bineq t0, GlobalProperty, .rGlobalVar
+    getGlobalObject(1)
+    dispatch(5)
+
+.rGlobalVar:
+    bineq t0, GlobalVar, .rClosureVar
+    getGlobalObject(1)
+    dispatch(5)
+
+.rClosureVar:
+    bineq t0, ClosureVar, .rGlobalPropertyWithVarInjectionChecks
+    resolveScope()
+    dispatch(5)
+
+.rGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .rGlobalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getGlobalObject(1)
+    dispatch(5)
+
+.rGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .rClosureVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getGlobalObject(1)
+    dispatch(5)
+
+.rClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .rDynamic
+    varInjectionCheck(.rDynamic)
+    resolveScope()
+    dispatch(5)
+
+.rDynamic:
+    callSlowPath(_slow_path_resolve_scope)
+    dispatch(5)
+
+
+macro loadWithStructureCheck(operand, slowPath)
+    loadisFromInstruction(operand, t0)
+    loadp [cfr, t0, 8], t0
+    loadpFromInstruction(5, t1)
+    bpneq JSCell::m_structure[t0], t1, slowPath
+end
+
+macro getProperty()
+    loadisFromInstruction(6, t3)
+    loadPropertyAtVariableOffset(t3, t0, t1, t2)
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+macro getGlobalVar()
+    loadpFromInstruction(6, t0)
+    loadp TagOffset[t0], t1
+    loadp PayloadOffset[t0], t2
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+macro getClosureVar()
+    loadp JSVariableObject::m_registers[t0], t0
+    loadisFromInstruction(6, t3)
+    loadp TagOffset[t0, t3, 8], t1
+    loadp PayloadOffset[t0, t3, 8], t2
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+_llint_op_get_from_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveModeMask, t0
+
+#gGlobalProperty:
+    bineq t0, GlobalProperty, .gGlobalVar
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVar:
+    bineq t0, GlobalVar, .gClosureVar
+    getGlobalVar()
+    dispatch(8)
+
+.gClosureVar:
+    bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
+    loadVariable(2, t2, t1, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t2, t1, t0)
+    getGlobalVar()
+    dispatch(8)
+
+.gClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .gDynamic
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t2, t1, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gDynamic:
+    callSlowPath(_slow_path_get_from_scope)
+    dispatch(8)
+
+
+macro putProperty()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadisFromInstruction(6, t1)
+    storePropertyAtVariableOffset(t1, t0, t2, t3)
+end
+
+macro putGlobalVar()
+    loadisFromInstruction(3, t0)
+    loadConstantOrVariable(t0, t1, t2)
+    loadpFromInstruction(6, t0)
+    storei t1, TagOffset[t0]
+    storei t2, PayloadOffset[t0]
+end
+
+macro putClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadp JSVariableObject::m_registers[t0], t0
+    loadisFromInstruction(6, t1)
+    storei t2, TagOffset[t0, t1, 8]
+    storei t3, PayloadOffset[t0, t1, 8]
+end
+
+
+_llint_op_put_to_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveModeMask, t0
+
+#pGlobalProperty:
+    bineq t0, GlobalProperty, .pGlobalVar
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVar:
+    bineq t0, GlobalVar, .pClosureVar
+    putGlobalVar()
+    dispatch(7)
+
+.pClosureVar:
+    bineq t0, ClosureVar, .pGlobalPropertyWithVarInjectionChecks
+    loadVariable(1, t2, t1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .pClosureVarWithVarInjectionChecks
+    varInjectionCheck(.pDynamic)
+    putGlobalVar()
+    dispatch(7)
+
+.pClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .pDynamic
+    varInjectionCheck(.pDynamic)
+    loadVariable(1, t2, t1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pDynamic:
+    callSlowPath(_slow_path_put_to_scope)
+    dispatch(7)
</ins></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -56,9 +56,8 @@
</span><span class="cx">     loadp CodeBlock[cfr], PB
</span><span class="cx">     loadp CodeBlock::m_instructions[PB], PB
</span><span class="cx">     loadisFromInstruction(1, t1)
</span><del>-    loadpFromInstruction(7, t2)
</del><span class="cx">     storeq t0, [cfr, t1, 8]
</span><del>-    valueProfile(t0, t2)
</del><ins>+    valueProfile(t0, 7, t2)
</ins><span class="cx">     dispatch(8)
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="lines">@@ -155,6 +154,11 @@
</span><span class="cx">         end)
</span><span class="cx"> end
</span><span class="cx"> 
</span><ins>+macro loadVariable(operand, value)
+    loadisFromInstruction(operand, value)
+    loadq [cfr, value, 8], value
+end
+
</ins><span class="cx"> # Index and value must be different registers. Index may be clobbered.
</span><span class="cx"> macro loadConstantOrVariable(index, value)
</span><span class="cx">     bpgteq index, FirstConstantRegisterIndex, .constant
</span><span class="lines">@@ -182,9 +186,10 @@
</span><span class="cx">     # Nothing to do, since we don't have a generational or incremental collector.
</span><span class="cx"> end
</span><span class="cx"> 
</span><del>-macro valueProfile(value, profile)
</del><ins>+macro valueProfile(value, operand, scratch)
</ins><span class="cx">     if VALUE_PROFILER
</span><del>-        storeq value, ValueProfile::m_buckets[profile]
</del><ins>+        loadpFromInstruction(operand, scratch)
+        storeq value, ValueProfile::m_buckets[scratch]
</ins><span class="cx">     end
</span><span class="cx"> end
</span><span class="cx"> 
</span><span class="lines">@@ -272,9 +277,8 @@
</span><span class="cx"> _llint_op_get_callee:
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadisFromInstruction(1, t0)
</span><del>-    loadpFromInstruction(2, t2)
</del><span class="cx">     loadp Callee[cfr], t1
</span><del>-    valueProfile(t1, t2)
</del><ins>+    valueProfile(t1, 2, t2)
</ins><span class="cx">     storep t1, [cfr, t0, 8]
</span><span class="cx">     dispatch(3)
</span><span class="cx"> 
</span><span class="lines">@@ -286,8 +290,7 @@
</span><span class="cx">     btqnz t0, tagMask, .opToThisSlow
</span><span class="cx">     loadp JSCell::m_structure[t0], t0
</span><span class="cx">     bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
</span><del>-    loadpFromInstruction(2, t1)
-    valueProfile(t0, t1)
</del><ins>+    valueProfile(t0, 2, t1)
</ins><span class="cx">     dispatch(3)
</span><span class="cx"> 
</span><span class="cx"> .opToThisSlow:
</span><span class="lines">@@ -797,14 +800,20 @@
</span><span class="cx">     dispatch(3)
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffsetAsPointer, objectAndStorage, value)
-    assert(macro (ok) bigteq propertyOffsetAsPointer, firstOutOfLineOffset, ok end)
-    negp propertyOffsetAsPointer
</del><ins>+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
+    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</ins><span class="cx">     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><del>-    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsPointer, 8], value
</del><ins>+    negi propertyOffsetAsInt
+    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
</ins><span class="cx"> end
</span><span class="cx"> 
</span><del>-macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</del><ins>+
+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</ins><span class="cx">     bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</span><span class="cx">     loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><span class="cx">     negi propertyOffsetAsInt
</span><span class="lines">@@ -813,7 +822,7 @@
</span><span class="cx"> .isInline:
</span><span class="cx">     addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
</span><span class="cx"> .ready:
</span><del>-    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
</del><ins>+    storeq value, (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
</ins><span class="cx"> end
</span><span class="cx"> 
</span><span class="cx"> _llint_op_init_global_const:
</span><span class="lines">@@ -826,20 +835,6 @@
</span><span class="cx">     dispatch(5)
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-_llint_op_init_global_const_check:
-    traceExecution()
-    loadpFromInstruction(3, t2)
-    loadisFromInstruction(2, t1)
-    loadpFromInstruction(1, t0)
-    btbnz [t2], .opInitGlobalConstCheckSlow
-    loadConstantOrVariable(t1, t2)
-    writeBarrier(t2)
-    storeq t2, [t0]
-    dispatch(5)
-.opInitGlobalConstCheckSlow:
-    callSlowPath(_llint_slow_path_init_global_const_check)
-    dispatch(5)
-
</del><span class="cx"> macro getById(getPropertyStorage)
</span><span class="cx">     traceExecution()
</span><span class="cx">     # We only do monomorphic get_by_id caching for now, and we do not modify the
</span><span class="lines">@@ -859,8 +854,7 @@
</span><span class="cx">             loadisFromInstruction(1, t1)
</span><span class="cx">             loadq [propertyStorage, t2], scratch
</span><span class="cx">             storeq scratch, [cfr, t1, 8]
</span><del>-            loadpFromInstruction(8, t1)
-            valueProfile(scratch, t1)
</del><ins>+            valueProfile(scratch, 8, t1)
</ins><span class="cx">             dispatch(9)
</span><span class="cx">         end)
</span><span class="cx">             
</span><span class="lines">@@ -887,12 +881,11 @@
</span><span class="cx">     btiz t2, IsArray, .opGetArrayLengthSlow
</span><span class="cx">     btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
</span><span class="cx">     loadisFromInstruction(1, t1)
</span><del>-    loadpFromInstruction(8, t2)
</del><span class="cx">     loadp JSObject::m_butterfly[t3], t0
</span><span class="cx">     loadi -sizeof IndexingHeader + IndexingHeader::m_publicLength[t0], t0
</span><span class="cx">     bilt t0, 0, .opGetArrayLengthSlow
</span><span class="cx">     orq tagTypeNumber, t0
</span><del>-    valueProfile(t0, t2)
</del><ins>+    valueProfile(t0, 8, t2)
</ins><span class="cx">     storeq t0, [cfr, t1, 8]
</span><span class="cx">     dispatch(9)
</span><span class="cx"> 
</span><span class="lines">@@ -1048,8 +1041,7 @@
</span><span class="cx"> 
</span><span class="cx"> .opGetByValDone:
</span><span class="cx">     storeq t2, [cfr, t0, 8]
</span><del>-    loadpFromInstruction(5, t0)
-    valueProfile(t2, t0)
</del><ins>+    valueProfile(t2, 5, t0)
</ins><span class="cx">     dispatch(6)
</span><span class="cx"> 
</span><span class="cx"> .opGetByValOutOfBounds:
</span><span class="lines">@@ -1076,10 +1068,9 @@
</span><span class="cx">     negi t2
</span><span class="cx">     sxi2q t2, t2
</span><span class="cx">     loadisFromInstruction(1, t3)
</span><del>-    loadpFromInstruction(4, t1)
</del><span class="cx">     loadq ThisArgumentOffset[cfr, t2, 8], t0
</span><span class="cx">     storeq t0, [cfr, t3, 8]
</span><del>-    valueProfile(t0, t1)
</del><ins>+    valueProfile(t0, 4, t1)
</ins><span class="cx">     dispatch(6)
</span><span class="cx"> 
</span><span class="cx"> .opGetArgumentByValSlow:
</span><span class="lines">@@ -1598,68 +1589,7 @@
</span><span class="cx">     loadp VM::callFrameForThrow[t1], t0
</span><span class="cx">     jmp VM::targetMachinePCForThrow[t1]
</span><span class="cx"> 
</span><del>-# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
-# scopes as they are traversed. scopeCheck() is called with two arguments: the register
-# holding the scope, and a register that can be used for scratch. Note that this does not
-# use t3, so you can hold stuff in t3 if need be.
-macro getDeBruijnScope(deBruijinIndexOperand, scopeCheck)
-    loadp ScopeChain[cfr], t0
-    loadis deBruijinIndexOperand, t2
</del><span class="cx"> 
</span><del>-    btiz t2, .done
-
-    loadp CodeBlock[cfr], t1
-    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
-    btbz CodeBlock::m_needsActivation[t1], .loop
-
-    loadis CodeBlock::m_activationRegister[t1], t1
-
-    # Need to conditionally skip over one scope.
-    btpz [cfr, t1, 8], .noActivation
-    scopeCheck(t0, t1)
-    loadp JSScope::m_next[t0], t0
-.noActivation:
-    subi 1, t2
-
-    btiz t2, .done
-.loop:
-    scopeCheck(t0, t1)
-    loadp JSScope::m_next[t0], t0
-    subi 1, t2
-    btinz t2, .loop
-
-.done:
-end
-
-_llint_op_get_scoped_var:
-    traceExecution()
-    # Operands are as follows:
-    # pc[1]: Destination for the load
-    # pc[2]: Index of register in the scope
-    # 24[PB, PC, 8]  De Bruijin index.
-    getDeBruijnScope(24[PB, PC, 8], macro (scope, scratch) end)
-    loadisFromInstruction(1, t1)
-    loadisFromInstruction(2, t2)
-
-    loadp JSVariableObject::m_registers[t0], t0
-    loadp [t0, t2, 8], t3
-    storep t3, [cfr, t1, 8]
-    loadp 32[PB, PC, 8], t1
-    valueProfile(t3, t1)
-    dispatch(5)
-
-
-_llint_op_put_scoped_var:
-    traceExecution()
-    getDeBruijnScope(16[PB, PC, 8], macro (scope, scratch) end)
-    loadis 24[PB, PC, 8], t1
-    loadConstantOrVariable(t1, t3)
-    loadis 8[PB, PC, 8], t1
-    writeBarrier(t3)
-    loadp JSVariableObject::m_registers[t0], t0
-    storep t3, [t0, t1, 8]
-    dispatch(4)
-
</del><span class="cx"> macro nativeCallTrampoline(executableOffsetToFunction)
</span><span class="cx">     storep 0, CodeBlock[cfr]
</span><span class="cx">     if X86_64
</span><span class="lines">@@ -1715,3 +1645,229 @@
</span><span class="cx">     jmp _llint_throw_from_slow_path_trampoline
</span><span class="cx"> end
</span><span class="cx"> 
</span><ins>+
+macro getGlobalObject(dst)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadisFromInstruction(dst, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+macro varInjectionCheck(slowPath)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_varInjectionWatchpoint[t0], t0
+    btbnz WatchpointSet::m_isInvalidated[t0], slowPath
+end
+
+macro resolveScope()
+    loadp CodeBlock[cfr], t0
+    loadisFromInstruction(4, t2)
+    btbz CodeBlock::m_needsActivation[t0], .resolveScopeAfterActivationCheck
+    loadis CodeBlock::m_activationRegister[t0], t1
+    btpz [cfr, t1, 8], .resolveScopeAfterActivationCheck
+    addi 1, t2
+
+.resolveScopeAfterActivationCheck:
+    loadp ScopeChain[cfr], t0
+    btiz t2, .resolveScopeLoopEnd
+
+.resolveScopeLoop:
+    loadp JSScope::m_next[t0], t0
+    subi 1, t2
+    btinz t2, .resolveScopeLoop
+
+.resolveScopeLoopEnd:
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+
+_llint_op_resolve_scope:
+    traceExecution()
+    loadisFromInstruction(3, t0)
+
+#rGlobalProperty:
+    bineq t0, GlobalProperty, .rGlobalVar
+    getGlobalObject(1)
+    dispatch(5)
+
+.rGlobalVar:
+    bineq t0, GlobalVar, .rClosureVar
+    getGlobalObject(1)
+    dispatch(5)
+
+.rClosureVar:
+    bineq t0, ClosureVar, .rGlobalPropertyWithVarInjectionChecks
+    resolveScope()
+    dispatch(5)
+
+.rGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .rGlobalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getGlobalObject(1)
+    dispatch(5)
+
+.rGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .rClosureVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getGlobalObject(1)
+    dispatch(5)
+
+.rClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .rDynamic
+    varInjectionCheck(.rDynamic)
+    resolveScope()
+    dispatch(5)
+
+.rDynamic:
+    callSlowPath(_slow_path_resolve_scope)
+    dispatch(5)
+
+
+macro loadWithStructureCheck(operand, slowPath)
+    loadisFromInstruction(operand, t0)
+    loadq [cfr, t0, 8], t0
+    loadpFromInstruction(5, t1)
+    bpneq JSCell::m_structure[t0], t1, slowPath
+end
+
+macro getProperty()
+    loadisFromInstruction(6, t1)
+    loadPropertyAtVariableOffset(t1, t0, t2)
+    valueProfile(t2, 7, t0)
+    loadisFromInstruction(1, t0)
+    storeq t2, [cfr, t0, 8]
+end
+
+macro getGlobalVar()
+    loadpFromInstruction(6, t0)
+    loadq [t0], t0
+    valueProfile(t0, 7, t1)
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+macro getClosureVar()
+    loadp JSVariableObject::m_registers[t0], t0
+    loadisFromInstruction(6, t1)
+    loadq [t0, t1, 8], t0
+    valueProfile(t0, 7, t1)
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+_llint_op_get_from_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveModeMask, t0
+
+#gGlobalProperty:
+    bineq t0, GlobalProperty, .gGlobalVar
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVar:
+    bineq t0, GlobalVar, .gClosureVar
+    getGlobalVar()
+    dispatch(8)
+
+.gClosureVar:
+    bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
+    loadVariable(2, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t0)
+    getGlobalVar()
+    dispatch(8)
+
+.gClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .gDynamic
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gDynamic:
+    callSlowPath(_slow_path_get_from_scope)
+    dispatch(8)
+
+
+macro putProperty()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadisFromInstruction(6, t1)
+    storePropertyAtVariableOffset(t1, t0, t2)
+end
+
+macro putGlobalVar()
+    loadisFromInstruction(3, t0)
+    loadConstantOrVariable(t0, t1)
+    loadpFromInstruction(6, t0)
+    storeq t1, [t0]
+end
+
+macro putClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadp JSVariableObject::m_registers[t0], t0
+    loadisFromInstruction(6, t1)
+    storeq t2, [t0, t1, 8]
+end
+
+
+_llint_op_put_to_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveModeMask, t0
+
+#pGlobalProperty:
+    bineq t0, GlobalProperty, .pGlobalVar
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVar:
+    bineq t0, GlobalVar, .pClosureVar
+    putGlobalVar()
+    dispatch(7)
+
+.pClosureVar:
+    bineq t0, ClosureVar, .pGlobalPropertyWithVarInjectionChecks
+    loadVariable(1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .pClosureVarWithVarInjectionChecks
+    varInjectionCheck(.pDynamic)
+    putGlobalVar()
+    dispatch(7)
+
+.pClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .pDynamic
+    varInjectionCheck(.pDynamic)
+    loadVariable(1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pDynamic:
+    callSlowPath(_slow_path_put_to_scope)
+    dispatch(7)
</ins></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreofflineasmx86rb"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/offlineasm/x86.rb (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/offlineasm/x86.rb        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/offlineasm/x86.rb        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -491,9 +491,9 @@
</span><span class="cx">     
</span><span class="cx">     def handleX86IntCompare(opcodeSuffix, kind)
</span><span class="cx">         if operands[0].is_a? Immediate and operands[0].value == 0 and operands[1].is_a? RegisterID and (opcodeSuffix == &quot;e&quot; or opcodeSuffix == &quot;ne&quot;)
</span><del>-            $asm.puts &quot;test#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}&quot;
</del><ins>+            $asm.puts &quot;test#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[1].x86Operand(kind)}&quot;
</ins><span class="cx">         elsif operands[1].is_a? Immediate and operands[1].value == 0 and operands[0].is_a? RegisterID and (opcodeSuffix == &quot;e&quot; or opcodeSuffix == &quot;ne&quot;)
</span><del>-            $asm.puts &quot;test#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}&quot;
</del><ins>+            $asm.puts &quot;test#{x86Suffix(kind)}  #{operands[0].x86Operand(kind)}, #{operands[0].x86Operand(kind)}&quot;
</ins><span class="cx">         else
</span><span class="cx">             $asm.puts &quot;cmp#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[0].x86Operand(kind)}&quot;
</span><span class="cx">         end
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -271,7 +271,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSValue thisValue = exec-&gt;hostThisValue();
</del><ins>+    JSValue thisValue = exec-&gt;hostThisValue().toThis(exec, StrictMode);
</ins><span class="cx"> 
</span><span class="cx">     // 1. Let array be the result of calling ToObject on the this value.
</span><span class="cx">     JSObject* thisObject = thisValue.toObject(exec);
</span><span class="lines">@@ -366,11 +366,11 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSValue thisValue = exec-&gt;hostThisValue();
</del><ins>+    JSValue thisValue = exec-&gt;hostThisValue().toThis(exec, StrictMode);
</ins><span class="cx"> 
</span><del>-    if (!thisValue.inherits(&amp;JSArray::s_info))
-        return throwVMTypeError(exec);
-    JSObject* thisObj = asArray(thisValue);
</del><ins>+    JSObject* thisObj = thisValue.toObject(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(jsUndefined());
</ins><span class="cx"> 
</span><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -409,7 +409,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -455,7 +455,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSValue thisValue = exec-&gt;hostThisValue();
</del><ins>+    JSValue thisValue = exec-&gt;hostThisValue().toThis(exec, StrictMode);
</ins><span class="cx">     JSArray* arr = constructEmptyArray(exec, 0);
</span><span class="cx">     unsigned n = 0;
</span><span class="cx">     JSValue curArg = thisValue.toObject(exec);
</span><span class="lines">@@ -490,7 +490,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSValue thisValue = exec-&gt;hostThisValue();
</del><ins>+    JSValue thisValue = exec-&gt;hostThisValue().toThis(exec, StrictMode);
</ins><span class="cx"> 
</span><span class="cx">     if (isJSArray(thisValue))
</span><span class="cx">         return JSValue::encode(asArray(thisValue)-&gt;pop(exec));
</span><span class="lines">@@ -519,7 +519,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSValue thisValue = exec-&gt;hostThisValue();
</del><ins>+    JSValue thisValue = exec-&gt;hostThisValue().toThis(exec, StrictMode);
</ins><span class="cx"> 
</span><span class="cx">     if (isJSArray(thisValue) &amp;&amp; exec-&gt;argumentCount() == 1) {
</span><span class="cx">         JSArray* array = asArray(thisValue);
</span><span class="lines">@@ -552,7 +552,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -590,7 +590,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -612,7 +612,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -722,7 +722,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (!length || exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(thisObj);
</span><span class="lines">@@ -797,7 +797,7 @@
</span><span class="cx"> {
</span><span class="cx">     // 15.4.4.12
</span><span class="cx"> 
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -855,7 +855,7 @@
</span><span class="cx"> {
</span><span class="cx">     // 15.4.4.13
</span><span class="cx"> 
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -878,7 +878,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -937,7 +937,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -999,7 +999,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1057,7 +1057,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1107,7 +1107,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1164,7 +1164,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1241,7 +1241,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
</span><span class="cx"> {
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1318,7 +1318,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     // 15.4.4.14
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1341,7 +1341,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     // 15.4.4.15
</span><del>-    JSObject* thisObj = exec-&gt;hostThisValue().toObject(exec);
</del><ins>+    JSObject* thisObj = exec-&gt;hostThisValue().toThis(exec, StrictMode).toObject(exec);
</ins><span class="cx">     unsigned length = thisObj-&gt;get(exec, exec-&gt;propertyNames().length).toUInt32(exec);
</span><span class="cx">     if (!length)
</span><span class="cx">         return JSValue::encode(jsNumber(-1));
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeCodeCachecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> template &lt;class UnlinkedCodeBlockType, class ExecutableType&gt;
</span><del>-UnlinkedCodeBlockType* CodeCache::getCodeBlock(VM&amp; vm, JSScope* scope, ExecutableType* executable, const SourceCode&amp; source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</del><ins>+UnlinkedCodeBlockType* CodeCache::getCodeBlock(VM&amp; vm, ExecutableType* executable, const SourceCode&amp; source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</ins><span class="cx"> {
</span><span class="cx">     SourceCodeKey key = SourceCodeKey(source, String(), CacheTypes&lt;UnlinkedCodeBlockType&gt;::codeType, strictness);
</span><span class="cx">     CodeCacheMap::AddResult addResult = m_sourceCode.add(key, SourceCodeValue());
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx"> 
</span><span class="cx">     UnlinkedCodeBlockType* unlinkedCode = UnlinkedCodeBlockType::create(&amp;vm, executable-&gt;executableInfo());
</span><span class="cx">     unlinkedCode-&gt;recordParse(rootNode-&gt;features(), rootNode-&gt;hasCapturedVariables(), rootNode-&gt;lineNo() - source.firstLine(), rootNode-&gt;lastLine() - rootNode-&gt;lineNo());
</span><del>-    OwnPtr&lt;BytecodeGenerator&gt; generator(adoptPtr(new BytecodeGenerator(vm, scope, rootNode.get(), unlinkedCode, debuggerMode, profilerMode)));
</del><ins>+    OwnPtr&lt;BytecodeGenerator&gt; generator(adoptPtr(new BytecodeGenerator(vm, rootNode.get(), unlinkedCode, debuggerMode, profilerMode)));
</ins><span class="cx">     error = generator-&gt;generate();
</span><span class="cx">     rootNode-&gt;destroyData();
</span><span class="cx">     if (error.m_type != ParserError::ErrorNone) {
</span><span class="lines">@@ -116,12 +116,12 @@
</span><span class="cx"> 
</span><span class="cx"> UnlinkedProgramCodeBlock* CodeCache::getProgramCodeBlock(VM&amp; vm, ProgramExecutable* executable, const SourceCode&amp; source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</span><span class="cx"> {
</span><del>-    return getCodeBlock&lt;UnlinkedProgramCodeBlock&gt;(vm, 0, executable, source, strictness, debuggerMode, profilerMode, error);
</del><ins>+    return getCodeBlock&lt;UnlinkedProgramCodeBlock&gt;(vm, executable, source, strictness, debuggerMode, profilerMode, error);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM&amp; vm, JSScope* scope, EvalExecutable* executable, const SourceCode&amp; source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</del><ins>+UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM&amp; vm, EvalExecutable* executable, const SourceCode&amp; source, JSParserStrictness strictness, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</ins><span class="cx"> {
</span><del>-    return getCodeBlock&lt;UnlinkedEvalCodeBlock&gt;(vm, scope, executable, source, strictness, debuggerMode, profilerMode, error);
</del><ins>+    return getCodeBlock&lt;UnlinkedEvalCodeBlock&gt;(vm, executable, source, strictness, debuggerMode, profilerMode, error);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> UnlinkedFunctionExecutable* CodeCache::getFunctionExecutableFromGlobalCode(VM&amp; vm, const Identifier&amp; name, const SourceCode&amp; source, ParserError&amp; error)
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeCodeCacheh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/CodeCache.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -235,7 +235,7 @@
</span><span class="cx">     static PassOwnPtr&lt;CodeCache&gt; create() { return adoptPtr(new CodeCache); }
</span><span class="cx"> 
</span><span class="cx">     UnlinkedProgramCodeBlock* getProgramCodeBlock(VM&amp;, ProgramExecutable*, const SourceCode&amp;, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&amp;);
</span><del>-    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&amp;, JSScope*, EvalExecutable*, const SourceCode&amp;, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&amp;);
</del><ins>+    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&amp;, EvalExecutable*, const SourceCode&amp;, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&amp;);
</ins><span class="cx">     UnlinkedFunctionExecutable* getFunctionExecutableFromGlobalCode(VM&amp;, const Identifier&amp;, const SourceCode&amp;, ParserError&amp;);
</span><span class="cx">     ~CodeCache();
</span><span class="cx"> 
</span><span class="lines">@@ -248,7 +248,7 @@
</span><span class="cx">     CodeCache();
</span><span class="cx"> 
</span><span class="cx">     template &lt;class UnlinkedCodeBlockType, class ExecutableType&gt; 
</span><del>-    UnlinkedCodeBlockType* getCodeBlock(VM&amp;, JSScope*, ExecutableType*, const SourceCode&amp;, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&amp;);
</del><ins>+    UnlinkedCodeBlockType* getCodeBlock(VM&amp;, ExecutableType*, const SourceCode&amp;, JSParserStrictness, DebuggerMode, ProfilerMode, ParserError&amp;);
</ins><span class="cx"> 
</span><span class="cx">     CodeCacheMap m_sourceCode;
</span><span class="cx"> };
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -468,6 +468,67 @@
</span><span class="cx">     RETURN(OP_C(2).jsValue().toPrimitive(exec));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+SLOW_PATH_DECL(slow_path_resolve_scope)
+{
+    BEGIN();
+    Identifier&amp; ident = exec-&gt;codeBlock()-&gt;identifier(pc[2].u.operand);
+    RETURN(JSScope::resolve(exec, exec-&gt;scope(), ident));
+}
+
+SLOW_PATH_DECL(slow_path_get_from_scope)
+{
+    BEGIN();
+    Identifier&amp; ident = exec-&gt;codeBlock()-&gt;identifier(pc[3].u.operand);
+    JSObject* scope = jsCast&lt;JSObject*&gt;(OP(2).jsValue());
+    ResolveModeAndType modeAndType(pc[4].u.operand);
+
+    PropertySlot slot(scope);
+    if (!scope-&gt;getPropertySlot(exec, ident, slot)) {
+        if (modeAndType.mode() == ThrowIfNotFound)
+            RETURN(throwError(exec, createUndefinedVariableError(exec, ident)));
+        RETURN(jsUndefined());
+    }
+
+    // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
+    if (slot.isCacheableValue() &amp;&amp; slot.slotBase() == scope &amp;&amp; scope-&gt;structure()-&gt;propertyAccessesAreCacheable()) {
+        if (modeAndType.type() == GlobalProperty || modeAndType.type() == GlobalPropertyWithVarInjectionChecks) {
+            CodeBlock* codeBlock = exec-&gt;codeBlock();
+            ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
+            pc[5].u.structure.set(exec-&gt;vm(), codeBlock-&gt;ownerExecutable(), scope-&gt;structure());
+            pc[6].u.operand = slot.cachedOffset();
+        }
+    }
+
+    RETURN(slot.getValue(exec, ident));
+}
+
+SLOW_PATH_DECL(slow_path_put_to_scope)
+{
+    BEGIN();
+    CodeBlock* codeBlock = exec-&gt;codeBlock();
+    Identifier&amp; ident = codeBlock-&gt;identifier(pc[2].u.operand);
+    JSObject* scope = jsCast&lt;JSObject*&gt;(OP(1).jsValue());
+    JSValue value = OP_C(3).jsValue();
+    ResolveModeAndType modeAndType = ResolveModeAndType(pc[4].u.operand);
+
+    if (modeAndType.mode() == ThrowIfNotFound &amp;&amp; !scope-&gt;hasProperty(exec, ident))
+        THROW(createUndefinedVariableError(exec, ident));
+
+    PutPropertySlot slot(codeBlock-&gt;isStrictMode());
+    scope-&gt;methodTable()-&gt;put(scope, exec, ident, value, slot);
+
+    // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
+    if (modeAndType.type() == GlobalProperty || modeAndType.type() == GlobalPropertyWithVarInjectionChecks) {
+        if (slot.isCacheable() &amp;&amp; slot.base() == scope &amp;&amp; scope-&gt;structure()-&gt;propertyAccessesAreCacheable()) {
+            ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
+            pc[5].u.structure.set(exec-&gt;vm(), codeBlock-&gt;ownerExecutable(), scope-&gt;structure());
+            pc[6].u.operand = slot.cachedOffset();
+        }
+    }
+
+    END();
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(JIT) || ENABLE(LLINT)
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeCommonSlowPathsh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -199,6 +199,9 @@
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_del_by_val);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_strcat);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_to_primitive);
</span><ins>+SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
+SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
</ins><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeExecutablecpp"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.cpp (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.cpp        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.cpp        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -116,6 +116,26 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo EvalExecutable::s_info = { &quot;EvalExecutable&quot;, &amp;ScriptExecutable::s_info, 0, 0, CREATE_METHOD_TABLE(EvalExecutable) };
</span><span class="cx"> 
</span><ins>+EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode&amp; source, bool isInStrictContext) 
+{
+    JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
+    if (!globalObject-&gt;evalEnabled()) {
+        throwError(exec, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
+        return 0;
+    }
+
+    EvalExecutable* executable = new (NotNull, allocateCell&lt;EvalExecutable&gt;(*exec-&gt;heap())) EvalExecutable(exec, source, isInStrictContext);
+    executable-&gt;finishCreation(exec-&gt;vm());
+
+    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject-&gt;createEvalCodeBlock(exec, executable);
+    if (!unlinkedEvalCode)
+        return 0;
+
+    executable-&gt;m_unlinkedEvalCodeBlock.set(exec-&gt;vm(), executable, unlinkedEvalCode);
+
+    return executable;
+}
+
</ins><span class="cx"> EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode&amp; source, bool inStrictContext)
</span><span class="cx">     : ScriptExecutable(exec-&gt;vm().evalExecutableStructure.get(), exec, source, inStrictContext)
</span><span class="cx"> {
</span><span class="lines">@@ -201,40 +221,21 @@
</span><span class="cx">     if (result)
</span><span class="cx">         *result = CompilationFailed;
</span><span class="cx">     
</span><del>-#if !ENABLE(JIT)
-    UNUSED_PARAM(jitType);
-    UNUSED_PARAM(bytecodeIndex);
-#endif
-    VM* vm = &amp;exec-&gt;vm();
-    JSGlobalObject* lexicalGlobalObject = exec-&gt;lexicalGlobalObject();
-    
</del><span class="cx">     RefPtr&lt;EvalCodeBlock&gt; newCodeBlock;
</span><span class="cx">     
</span><span class="cx">     if (!!m_evalCodeBlock) {
</span><span class="cx">         newCodeBlock = adoptRef(new EvalCodeBlock(CodeBlock::CopyParsedBlock, *m_evalCodeBlock));
</span><span class="cx">         newCodeBlock-&gt;setAlternative(static_pointer_cast&lt;CodeBlock&gt;(m_evalCodeBlock));
</span><span class="cx">     } else {
</span><del>-        UNUSED_PARAM(scope);
-        UNUSED_PARAM(vm);
-        UNUSED_PARAM(lexicalGlobalObject);
-        if (!lexicalGlobalObject-&gt;evalEnabled())
-            return throwError(exec, createEvalError(exec, lexicalGlobalObject-&gt;evalDisabledErrorMessage()));
-
-        JSObject* exception = 0;
-        UnlinkedEvalCodeBlock* unlinkedEvalCode = lexicalGlobalObject-&gt;createEvalCodeBlock(exec, scope, this, &amp;exception);
-        if (!unlinkedEvalCode)
-            return exception;
-
-        m_unlinkedEvalCodeBlock.set(*vm, this, unlinkedEvalCode);
</del><ins>+        newCodeBlock = adoptRef(new EvalCodeBlock(this, m_unlinkedEvalCodeBlock.get(), scope, source().provider()));
</ins><span class="cx">         ASSERT((jitType == JITCode::bottomTierJIT()) == !m_evalCodeBlock);
</span><del>-
-        newCodeBlock = adoptRef(new EvalCodeBlock(this, unlinkedEvalCode, lexicalGlobalObject, source().provider(), scope-&gt;localDepth()));
</del><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     CompilationResult theResult = prepareForExecution(
</span><span class="cx">         exec, m_evalCodeBlock, newCodeBlock.get(), m_jitCodeForCall, jitType, bytecodeIndex);
</span><span class="cx">     if (result)
</span><span class="cx">         *result = theResult;
</span><ins>+
</ins><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -253,7 +254,7 @@
</span><span class="cx">     m_jitCodeForCall = m_evalCodeBlock-&gt;jitCode();
</span><span class="cx">     ASSERT(!m_jitCodeForCallWithArityCheck);
</span><span class="cx"> }
</span><del>-#endif
</del><ins>+#endif // ENABLE(JIT)
</ins><span class="cx"> 
</span><span class="cx"> void EvalExecutable::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><span class="lines">@@ -325,26 +326,20 @@
</span><span class="cx">     if (result)
</span><span class="cx">         *result = CompilationFailed;
</span><span class="cx">     
</span><del>-#if !ENABLE(JIT)
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(jitType);
-    UNUSED_PARAM(bytecodeIndex);
-#endif
-    
</del><span class="cx">     RefPtr&lt;ProgramCodeBlock&gt; newCodeBlock;
</span><span class="cx">     
</span><span class="cx">     if (!!m_programCodeBlock) {
</span><span class="cx">         newCodeBlock = adoptRef(new ProgramCodeBlock(CodeBlock::CopyParsedBlock, *m_programCodeBlock));
</span><span class="cx">         newCodeBlock-&gt;setAlternative(static_pointer_cast&lt;CodeBlock&gt;(m_programCodeBlock));
</span><span class="cx">     } else {
</span><del>-        JSGlobalObject* globalObject = scope-&gt;globalObject();
-        newCodeBlock = adoptRef(new ProgramCodeBlock(this, m_unlinkedProgramCodeBlock.get(), globalObject, source().provider()));
</del><ins>+        newCodeBlock = adoptRef(new ProgramCodeBlock(this, m_unlinkedProgramCodeBlock.get(), scope, source().provider()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     CompilationResult theResult = prepareForExecution(
</span><span class="cx">         exec, m_programCodeBlock, newCodeBlock.get(), m_jitCodeForCall, jitType, bytecodeIndex);
</span><span class="cx">     if (result)
</span><span class="cx">         *result = theResult;
</span><ins>+
</ins><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -529,7 +524,7 @@
</span><span class="cx">     ParserError error;
</span><span class="cx">     DebuggerMode debuggerMode = globalObject-&gt;hasDebugger() ? DebuggerOn : DebuggerOff;
</span><span class="cx">     ProfilerMode profilerMode = globalObject-&gt;hasProfiler() ? ProfilerOn : ProfilerOff;
</span><del>-    UnlinkedFunctionCodeBlock* unlinkedCodeBlock = m_unlinkedExecutable-&gt;codeBlockFor(*vm, scope, m_source, specializationKind, debuggerMode, profilerMode, error);
</del><ins>+    UnlinkedFunctionCodeBlock* unlinkedCodeBlock = m_unlinkedExecutable-&gt;codeBlockFor(*vm, m_source, specializationKind, debuggerMode, profilerMode, error);
</ins><span class="cx">     recordParse(m_unlinkedExecutable-&gt;features(), m_unlinkedExecutable-&gt;hasCapturedVariables(), lineNo(), lastLine());
</span><span class="cx"> 
</span><span class="cx">     if (!unlinkedCodeBlock) {
</span><span class="lines">@@ -537,7 +532,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return adoptRef(new FunctionCodeBlock(this, unlinkedCodeBlock, globalObject, source().provider(), source().startOffset()));
</del><ins>+    return adoptRef(new FunctionCodeBlock(this, unlinkedCodeBlock, scope, source().provider(), source().startOffset()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="lines">@@ -548,12 +543,6 @@
</span><span class="cx">     if (result)
</span><span class="cx">         *result = CompilationFailed;
</span><span class="cx">     
</span><del>-#if !ENABLE(JIT)
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(jitType);
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(bytecodeIndex);
-#endif
</del><span class="cx">     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForCall);
</span><span class="cx">     JSObject* exception;
</span><span class="cx">     
</span><span class="lines">@@ -586,12 +575,6 @@
</span><span class="cx">     if (result)
</span><span class="cx">         *result = CompilationFailed;
</span><span class="cx">     
</span><del>-#if !ENABLE(JIT)
-    UNUSED_PARAM(jitType);
-    UNUSED_PARAM(exec);
-    UNUSED_PARAM(bytecodeIndex);
-#endif
-    
</del><span class="cx">     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForConstruct);
</span><span class="cx">     JSObject* exception;
</span><span class="cx">     RefPtr&lt;FunctionCodeBlock&gt; newCodeBlock = produceCodeBlockFor(scope, CodeForConstruct, exception);
</span><span class="lines">@@ -604,6 +587,7 @@
</span><span class="cx">         bytecodeIndex, CodeForConstruct);
</span><span class="cx">     if (result)
</span><span class="cx">         *result = theResult;
</span><ins>+
</ins><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesdfgFourthTierSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.h (151362 => 151363)</h4>
<pre class="diff"><span>
<span class="info">--- branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.h        2013-06-10 05:15:45 UTC (rev 151362)
+++ branches/dfgFourthTier/Source/JavaScriptCore/runtime/Executable.h        2013-06-10 05:45:15 UTC (rev 151363)
</span><span class="lines">@@ -250,12 +250,10 @@
</span><span class="cx">