<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[159091] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/159091">159091</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2013-11-11 19:28:41 -0800 (Mon, 11 Nov 2013)</dd>
</dl>

<h3>Log Message</h3>
<pre>Get rid of the lastResultRegister optimization in the baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=124171

Rubber stamped by Mark Hahnenberg.
        
The baseline JIT no longer needs amazing throughput. And this optimization has caused
way too many OSR exit bugs. And it constrains how much we can do in the DFG/FTL. So,
I'm getting rid of it.

* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::OSRExit):
(JSC::DFG::OSRExit::convertToForward):
* dfg/DFGOSRExit.h:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::compileMovHint):
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
* dfg/DFGSpeculativeJIT.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
(JSC::FTL::LowerDFGToLLVM::compileZombieHint):
(JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
(JSC::FTL::LowerDFGToLLVM::appendOSRExit):
(JSC::FTL::LowerDFGToLLVM::observeMovHint):
* ftl/FTLOSRExit.cpp:
(JSC::FTL::OSRExit::OSRExit):
(JSC::FTL::OSRExit::convertToForward):
* ftl/FTLOSRExit.h:
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* jit/JIT.cpp:
(JSC::JIT::JIT):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
(JSC::JIT::appendCall):
* jit/JITArithmetic32_64.cpp:
(JSC::JIT::emit_op_lshift):
(JSC::JIT::emitRightShift):
(JSC::JIT::emit_op_bitand):
(JSC::JIT::emit_op_bitor):
(JSC::JIT::emit_op_bitxor):
(JSC::JIT::emit_op_inc):
(JSC::JIT::emit_op_dec):
* jit/JITCall.cpp:
(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileLoadVarargs):
* jit/JITInlines.h:
(JSC::JIT::emitGetFromCallFrameHeaderPtr):
(JSC::JIT::emitGetFromCallFrameHeader32):
(JSC::JIT::emitGetFromCallFrameHeader64):
(JSC::JIT::emitLoadTag):
(JSC::JIT::emitLoadPayload):
(JSC::JIT::emitLoad2):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::emitGetVirtualRegisters):
(JSC::JIT::emitPutVirtualRegister):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_new_func):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_catch):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_get_by_pname):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emit_op_init_global_const):
* jit/SlowPathCall.h:
(JSC::JITSlowPathCall::call):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitcpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExith">trunk/Source/JavaScriptCore/dfg/DFGOSRExit.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompiler32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompiler64cpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOSRExitcpp">trunk/Source/JavaScriptCore/ftl/FTLOSRExit.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOSRExith">trunk/Source/JavaScriptCore/ftl/FTLOSRExit.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOSRExitCompilercpp">trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITArithmetic32_64cpp">trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITCallcpp">trunk/Source/JavaScriptCore/jit/JITCall.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITInlinesh">trunk/Source/JavaScriptCore/jit/JITInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccesscpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitSlowPathCallh">trunk/Source/JavaScriptCore/jit/SlowPathCall.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/ChangeLog        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -1,5 +1,92 @@
</span><span class="cx"> 2013-11-11  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Get rid of the lastResultRegister optimization in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=124171
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        The baseline JIT no longer needs amazing throughput. And this optimization has caused
+        way too many OSR exit bugs. And it constrains how much we can do in the DFG/FTL. So,
+        I'm getting rid of it.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::convertToForward):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::convertToForward):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::appendCall):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_inc):
+        (JSC::JIT::emit_op_dec):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emitPutCallResult):
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        (JSC::JIT::emitGetFromCallFrameHeader64):
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitPutVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_to_number):
+        (JSC::JIT::emit_op_catch):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+
+2013-11-11  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         Remove ConstantFoldingPhase's weirdo compile-time optimization
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=124169
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExit.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -42,7 +42,6 @@
</span><span class="cx">     , m_patchableCodeOffset(0)
</span><span class="cx">     , m_recoveryIndex(recoveryIndex)
</span><span class="cx">     , m_streamIndex(streamIndex)
</span><del>-    , m_lastSetOperand(jit-&gt;m_lastSetOperand)
</del><span class="cx"> {
</span><span class="cx">     ASSERT(m_codeOrigin.isSet());
</span><span class="cx"> }
</span><span class="lines">@@ -85,7 +84,6 @@
</span><span class="cx">     
</span><span class="cx">     ASSERT(lastMovHint);
</span><span class="cx">     ASSERT(lastMovHint-&gt;child1() == currentNode);
</span><del>-    m_lastSetOperand = lastMovHint-&gt;local();
</del><span class="cx">     m_valueRecoveryOverride = adoptRef(
</span><span class="cx">         new ValueRecoveryOverride(lastMovHint-&gt;local(), valueRecovery));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExith"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExit.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExit.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExit.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -105,7 +105,6 @@
</span><span class="cx">     void convertToForward(BasicBlock*, Node*, unsigned nodeIndex, const ValueRecovery&amp;);
</span><span class="cx"> 
</span><span class="cx">     unsigned m_streamIndex;
</span><del>-    VirtualRegister m_lastSetOperand;
</del><span class="cx">     
</span><span class="cx">     RefPtr&lt;ValueRecoveryOverride&gt; m_valueRecoveryOverride;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompiler32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -493,15 +493,8 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    // 11) Load the result of the last bytecode operation into regT0.
</del><ins>+    // 11) And finish.
</ins><span class="cx">     
</span><del>-    if (exit.m_lastSetOperand.isValid()) {
-        m_jit.load32(AssemblyHelpers::payloadFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
-        m_jit.load32(AssemblyHelpers::tagFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister2);
-    }
-    
-    // 12) And finish.
-    
</del><span class="cx">     adjustAndJumpToTarget(m_jit, exit);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompiler64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -432,13 +432,8 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    // 11) Load the result of the last bytecode operation into regT0.
</del><ins>+    // 11) And finish.
</ins><span class="cx">     
</span><del>-    if (exit.m_lastSetOperand.isValid())
-        m_jit.load64(AssemblyHelpers::addressFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
-    
-    // 12) And finish.
-    
</del><span class="cx">     adjustAndJumpToTarget(m_jit, exit);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -47,7 +47,6 @@
</span><span class="cx">     , m_currentNode(0)
</span><span class="cx">     , m_indexInBlock(0)
</span><span class="cx">     , m_generationInfo(m_jit.codeBlock()-&gt;m_numCalleeRegisters)
</span><del>-    , m_lastSetOperand(VirtualRegister())
</del><span class="cx">     , m_state(m_jit.graph())
</span><span class="cx">     , m_interpreter(m_jit.graph(), m_state)
</span><span class="cx">     , m_stream(&amp;jit.jitCode()-&gt;variableEventStream)
</span><span class="lines">@@ -1539,8 +1538,6 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(node-&gt;containsMovHint() &amp;&amp; node-&gt;op() != ZombieHint);
</span><span class="cx">     
</span><del>-    m_lastSetOperand = node-&gt;local();
-
</del><span class="cx">     Node* child = node-&gt;child1().node();
</span><span class="cx">     noticeOSRBirth(child);
</span><span class="cx">     
</span><span class="lines">@@ -1621,7 +1618,6 @@
</span><span class="cx">             VariableEvent::setLocal(virtualRegisterForLocal(i), variable-&gt;machineLocal(), format));
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    m_lastSetOperand = VirtualRegister();
</del><span class="cx">     m_codeOriginForExitTarget = CodeOrigin();
</span><span class="cx">     m_codeOriginForExitProfile = CodeOrigin();
</span><span class="cx">     
</span><span class="lines">@@ -1667,7 +1663,6 @@
</span><span class="cx">                 break;
</span><span class="cx">                 
</span><span class="cx">             case ZombieHint: {
</span><del>-                m_lastSetOperand = m_currentNode-&gt;local();
</del><span class="cx">                 recordSetLocal(DataFormatDead);
</span><span class="cx">                 break;
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -2254,7 +2254,6 @@
</span><span class="cx">     };
</span><span class="cx">     Vector&lt;BranchRecord, 8&gt; m_branches;
</span><span class="cx"> 
</span><del>-    VirtualRegister m_lastSetOperand;
</del><span class="cx">     CodeOrigin m_codeOriginForExitTarget;
</span><span class="cx">     CodeOrigin m_codeOriginForExitProfile;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -71,7 +71,6 @@
</span><span class="cx">         , m_heaps(state.context)
</span><span class="cx">         , m_out(state.context)
</span><span class="cx">         , m_valueSources(OperandsLike, state.graph.block(0)-&gt;variablesAtHead)
</span><del>-        , m_lastSetOperand(VirtualRegister())
</del><span class="cx">         , m_state(state.graph)
</span><span class="cx">         , m_interpreter(state.graph, m_state)
</span><span class="cx">         , m_stackmapIDs(0)
</span><span class="lines">@@ -676,7 +675,6 @@
</span><span class="cx">     void compileZombieHint()
</span><span class="cx">     {
</span><span class="cx">         VariableAccessData* data = m_node-&gt;variableAccessData();
</span><del>-        m_lastSetOperand = data-&gt;local();
</del><span class="cx">         m_valueSources.operand(data-&gt;local()) = ValueSource(SourceIsDead);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -2550,7 +2548,7 @@
</span><span class="cx">         
</span><span class="cx">         m_ftlState.jitCode-&gt;osrExit.append(OSRExit(
</span><span class="cx">             UncountableInvalidation, InvalidValueFormat, MethodOfGettingAValueProfile(),
</span><del>-            m_codeOriginForExitTarget, m_codeOriginForExitProfile, m_lastSetOperand.offset(),
</del><ins>+            m_codeOriginForExitTarget, m_codeOriginForExitProfile,
</ins><span class="cx">             m_valueSources.numberOfArguments(), m_valueSources.numberOfLocals()));
</span><span class="cx">         m_ftlState.finalizer-&gt;osrExit.append(OSRExitCompilationInfo());
</span><span class="cx">         
</span><span class="lines">@@ -3897,7 +3895,7 @@
</span><span class="cx">         
</span><span class="cx">         m_ftlState.jitCode-&gt;osrExit.append(OSRExit(
</span><span class="cx">             kind, lowValue.format(), m_graph.methodOfGettingAValueProfileFor(highValue),
</span><del>-            m_codeOriginForExitTarget, m_codeOriginForExitProfile, m_lastSetOperand.offset(),
</del><ins>+            m_codeOriginForExitTarget, m_codeOriginForExitProfile,
</ins><span class="cx">             m_valueSources.numberOfArguments(), m_valueSources.numberOfLocals()));
</span><span class="cx">         m_ftlState.finalizer-&gt;osrExit.append(OSRExitCompilationInfo());
</span><span class="cx">         
</span><span class="lines">@@ -4116,7 +4114,6 @@
</span><span class="cx">         
</span><span class="cx">         VirtualRegister operand = node-&gt;local();
</span><span class="cx">         
</span><del>-        m_lastSetOperand = operand;
</del><span class="cx">         m_valueSources.operand(operand) = ValueSource(node-&gt;child1().node());
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -4280,7 +4277,6 @@
</span><span class="cx">     HashMap&lt;Node*, LValue&gt; m_phis;
</span><span class="cx">     
</span><span class="cx">     Operands&lt;ValueSource&gt; m_valueSources;
</span><del>-    VirtualRegister m_lastSetOperand;
</del><span class="cx">     
</span><span class="cx">     InPlaceAbstractState m_state;
</span><span class="cx">     AbstractInterpreter&lt;InPlaceAbstractState&gt; m_interpreter;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOSRExitcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOSRExit.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOSRExit.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/ftl/FTLOSRExit.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -43,13 +43,12 @@
</span><span class="cx"> OSRExit::OSRExit(
</span><span class="cx">     ExitKind exitKind, ValueFormat profileValueFormat,
</span><span class="cx">     MethodOfGettingAValueProfile valueProfile, CodeOrigin codeOrigin,
</span><del>-    CodeOrigin originForProfile, int lastSetOperand, unsigned numberOfArguments,
</del><ins>+    CodeOrigin originForProfile, unsigned numberOfArguments,
</ins><span class="cx">     unsigned numberOfLocals)
</span><span class="cx">     : OSRExitBase(exitKind, codeOrigin, originForProfile)
</span><span class="cx">     , m_profileValueFormat(profileValueFormat)
</span><span class="cx">     , m_valueProfile(valueProfile)
</span><span class="cx">     , m_patchableCodeOffset(0)
</span><del>-    , m_lastSetOperand(lastSetOperand)
</del><span class="cx">     , m_values(numberOfArguments, numberOfLocals)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -79,7 +78,6 @@
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="cx">     VirtualRegister overriddenOperand = lastMovHint-&gt;local();
</span><del>-    m_lastSetOperand = overriddenOperand;
</del><span class="cx">     
</span><span class="cx">     // Is the value for this operand being passed as an argument to the exit, or is
</span><span class="cx">     // it something else? If it's an argument already, then replace that argument;
</span><span class="lines">@@ -94,7 +92,7 @@
</span><span class="cx">     
</span><span class="cx">     unsigned argument = arguments.size();
</span><span class="cx">     arguments.append(value.value());
</span><del>-    m_values.operand(m_lastSetOperand) = ExitValue::exitArgument(
</del><ins>+    m_values.operand(overriddenOperand) = ExitValue::exitArgument(
</ins><span class="cx">         ExitArgument(value.format(), argument));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOSRExith"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOSRExit.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOSRExit.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/ftl/FTLOSRExit.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -145,7 +145,7 @@
</span><span class="cx"> struct OSRExit : public DFG::OSRExitBase {
</span><span class="cx">     OSRExit(
</span><span class="cx">         ExitKind, ValueFormat profileValueFormat, MethodOfGettingAValueProfile,
</span><del>-        CodeOrigin, CodeOrigin originForProfile, int lastSetOperand,
</del><ins>+        CodeOrigin, CodeOrigin originForProfile,
</ins><span class="cx">         unsigned numberOfArguments, unsigned numberOfLocals);
</span><span class="cx">     
</span><span class="cx">     MacroAssemblerCodeRef m_code;
</span><span class="lines">@@ -161,8 +161,6 @@
</span><span class="cx">     // Offset within the exit stubs of the stub for this exit.
</span><span class="cx">     unsigned m_patchableCodeOffset;
</span><span class="cx">     
</span><del>-    VirtualRegister m_lastSetOperand;
-    
</del><span class="cx">     Operands&lt;ExitValue&gt; m_values;
</span><span class="cx">     
</span><span class="cx">     uint32_t m_stackmapID;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOSRExitCompilercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -164,12 +164,6 @@
</span><span class="cx">     
</span><span class="cx">     handleExitCounts(jit, exit);
</span><span class="cx">     reifyInlinedCallFrames(jit, exit);
</span><del>-    
-    if (exit.m_lastSetOperand.isValid()) {
-        jit.load64(
-            AssemblyHelpers::addressFor(exit.m_lastSetOperand), GPRInfo::cachedResultRegister);
-    }
-    
</del><span class="cx">     adjustAndJumpToTarget(jit, exit);
</span><span class="cx">     
</span><span class="cx">     LinkBuffer patchBuffer(*vm, &amp;jit, codeBlock);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -80,16 +80,6 @@
</span><span class="cx">     , m_putByIdIndex(UINT_MAX)
</span><span class="cx">     , m_byValInstructionIndex(UINT_MAX)
</span><span class="cx">     , m_callLinkInfoIndex(UINT_MAX)
</span><del>-#if USE(JSVALUE32_64)
-    , m_jumpTargetIndex(0)
-    , m_mappedBytecodeOffset((unsigned)-1)
-    , m_mappedVirtualRegisterIndex(UINT_MAX)
-    , m_mappedTag((RegisterID)-1)
-    , m_mappedPayload((RegisterID)-1)
-#else
-    , m_lastResultBytecodeRegister(std::numeric_limits&lt;int&gt;::max())
-    , m_jumpTargetsPosition(0)
-#endif
</del><span class="cx">     , m_randomGenerator(cryptographicallyRandomNumber())
</span><span class="cx"> #if ENABLE(VALUE_PROFILER)
</span><span class="cx">     , m_canBeOptimized(false)
</span><span class="lines">@@ -181,11 +171,6 @@
</span><span class="cx">             sampleInstruction(currentInstruction);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-#if USE(JSVALUE64)
-        if (atJumpTarget())
-            killLastResultRegister();
-#endif
-
</del><span class="cx">         m_labels[m_bytecodeOffset] = label();
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT_VERBOSE)
</span><span class="lines">@@ -376,10 +361,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     for (Vector&lt;SlowCaseEntry&gt;::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
</span><del>-#if USE(JSVALUE64)
-        killLastResultRegister();
-#endif
-
</del><span class="cx">         m_bytecodeOffset = iter-&gt;to;
</span><span class="cx"> 
</span><span class="cx">         unsigned firstTo = m_bytecodeOffset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JIT.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -266,11 +266,6 @@
</span><span class="cx">         {
</span><span class="cx">             Call functionCall = call();
</span><span class="cx">             m_calls.append(CallRecord(functionCall, m_bytecodeOffset, function.value()));
</span><del>-#if USE(JSVALUE32_64)
-            unmap();
-#else
-            killLastResultRegister();
-#endif
</del><span class="cx">             return functionCall;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -390,19 +385,10 @@
</span><span class="cx">         void emitStore(int index, const JSValue constant, RegisterID base = callFrameRegister);
</span><span class="cx">         void emitStoreInt32(int index, RegisterID payload, bool indexIsInt32 = false);
</span><span class="cx">         void emitStoreInt32(int index, TrustedImm32 payload, bool indexIsInt32 = false);
</span><del>-        void emitStoreAndMapInt32(int index, RegisterID tag, RegisterID payload, bool indexIsInt32, size_t opcodeLength);
</del><span class="cx">         void emitStoreCell(int index, RegisterID payload, bool indexIsCell = false);
</span><span class="cx">         void emitStoreBool(int index, RegisterID payload, bool indexIsBool = false);
</span><span class="cx">         void emitStoreDouble(int index, FPRegisterID value);
</span><span class="cx"> 
</span><del>-        bool isLabeled(unsigned bytecodeOffset);
-        void map(unsigned bytecodeOffset, int virtualRegisterIndex, RegisterID tag, RegisterID payload);
-        void unmap(RegisterID);
-        void unmap();
-        bool isMapped(int virtualRegisterIndex);
-        bool getMappedPayload(int virtualRegisterIndex, RegisterID&amp; payload);
-        bool getMappedTag(int virtualRegisterIndex, RegisterID&amp; tag);
-        
</del><span class="cx">         void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex);
</span><span class="cx">         void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex, RegisterID tag);
</span><span class="cx"> 
</span><span class="lines">@@ -435,8 +421,6 @@
</span><span class="cx"> 
</span><span class="cx">         int32_t getConstantOperandImmediateInt(int src);
</span><span class="cx"> 
</span><del>-        void killLastResultRegister();
-
</del><span class="cx">         Jump emitJumpIfJSCell(RegisterID);
</span><span class="cx">         Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
</span><span class="cx">         void emitJumpSlowCaseIfJSCell(RegisterID);
</span><span class="lines">@@ -645,8 +629,6 @@
</span><span class="cx">         bool isOperandConstantImmediateInt(int src);
</span><span class="cx">         bool isOperandConstantImmediateChar(int src);
</span><span class="cx"> 
</span><del>-        bool atJumpTarget();
-
</del><span class="cx">         Jump getSlowCase(Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="cx">         {
</span><span class="cx">             return iter++-&gt;from;
</span><span class="lines">@@ -815,17 +797,6 @@
</span><span class="cx">         unsigned m_byValInstructionIndex;
</span><span class="cx">         unsigned m_callLinkInfoIndex;
</span><span class="cx"> 
</span><del>-#if USE(JSVALUE32_64)
-        unsigned m_jumpTargetIndex;
-        unsigned m_mappedBytecodeOffset;
-        int m_mappedVirtualRegisterIndex;
-        RegisterID m_mappedTag;
-        RegisterID m_mappedPayload;
-#else
-        int m_lastResultBytecodeRegister;
-#endif
-        unsigned m_jumpTargetsPosition;
-
</del><span class="cx">         OwnPtr&lt;JITDisassembler&gt; m_disassembler;
</span><span class="cx">         RefPtr&lt;Profiler::Compilation&gt; m_compilation;
</span><span class="cx">         WeakRandom m_randomGenerator;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITArithmetic32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -175,7 +175,7 @@
</span><span class="cx">         emitLoad(op1, regT1, regT0);
</span><span class="cx">         addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">         lshift32(Imm32(getConstantOperand(op2).asInt32()), regT0);
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, dst == op1, OPCODE_LENGTH(op_lshift));
</del><ins>+        emitStoreInt32(dst, regT0, dst == op1);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx">         addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     lshift32(regT2, regT0);
</span><del>-    emitStoreAndMapInt32(dst, regT1, regT0, dst == op1 || dst == op2, OPCODE_LENGTH(op_lshift));
</del><ins>+    emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -223,7 +223,7 @@
</span><span class="cx">                 rshift32(Imm32(shift), regT0);
</span><span class="cx">         } else if (isUnsigned) // signed right shift by zero is simply toInt conversion
</span><span class="cx">             addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, dst == op1, OPCODE_LENGTH(op_rshift));
</del><ins>+        emitStoreInt32(dst, regT0, dst == op1);
</ins><span class="cx">     } else {
</span><span class="cx">         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
</span><span class="cx">         if (!isOperandConstantImmediateInt(op1))
</span><span class="lines">@@ -234,7 +234,7 @@
</span><span class="cx">             addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
</span><span class="cx">         } else
</span><span class="cx">             rshift32(regT2, regT0);
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, dst == op1, OPCODE_LENGTH(op_rshift));
</del><ins>+        emitStoreInt32(dst, regT0, dst == op1);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -337,7 +337,7 @@
</span><span class="cx">         emitLoad(op, regT1, regT0);
</span><span class="cx">         addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">         and32(Imm32(constant), regT0);
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, dst == op, OPCODE_LENGTH(op_bitand));
</del><ins>+        emitStoreInt32(dst, regT0, dst == op);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -345,7 +345,7 @@
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     and32(regT2, regT0);
</span><del>-    emitStoreAndMapInt32(dst, regT1, regT0, (op1 == dst || op2 == dst), OPCODE_LENGTH(op_bitand));
</del><ins>+    emitStoreInt32(dst, regT0, op1 == dst || op2 == dst);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -377,7 +377,7 @@
</span><span class="cx">         emitLoad(op, regT1, regT0);
</span><span class="cx">         addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">         or32(Imm32(constant), regT0);
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, op == dst, OPCODE_LENGTH(op_bitor));
</del><ins>+        emitStoreInt32(dst, regT0, op == dst);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -385,7 +385,7 @@
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     or32(regT2, regT0);
</span><del>-    emitStoreAndMapInt32(dst, regT1, regT0, (op1 == dst || op2 == dst), OPCODE_LENGTH(op_bitor));
</del><ins>+    emitStoreInt32(dst, regT0, op1 == dst || op2 == dst);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -417,7 +417,7 @@
</span><span class="cx">         emitLoad(op, regT1, regT0);
</span><span class="cx">         addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">         xor32(Imm32(constant), regT0);
</span><del>-        emitStoreAndMapInt32(dst, regT1, regT0, op == dst, OPCODE_LENGTH(op_bitxor));
</del><ins>+        emitStoreInt32(dst, regT0, op == dst);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -425,7 +425,7 @@
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     xor32(regT2, regT0);
</span><del>-    emitStoreAndMapInt32(dst, regT1, regT0, (op1 == dst || op2 == dst), OPCODE_LENGTH(op_bitxor));
</del><ins>+    emitStoreInt32(dst, regT0, op1 == dst || op2 == dst);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -451,7 +451,7 @@
</span><span class="cx"> 
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
</span><del>-    emitStoreAndMapInt32(srcDst, regT1, regT0, true, OPCODE_LENGTH(op_inc));
</del><ins>+    emitStoreInt32(srcDst, regT0, true);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_inc(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -474,7 +474,7 @@
</span><span class="cx"> 
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
</span><span class="cx">     addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
</span><del>-    emitStoreAndMapInt32(srcDst, regT1, regT0, true, OPCODE_LENGTH(op_dec));
</del><ins>+    emitStoreInt32(srcDst, regT0, true);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_dec(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITCallcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITCall.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITCall.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITCall.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -55,13 +55,6 @@
</span><span class="cx">     int dst = instruction[1].u.operand;
</span><span class="cx">     emitValueProfilingSite(regT4);
</span><span class="cx">     emitPutVirtualRegister(dst);
</span><del>-    if (canBeOptimizedOrInlined()) {
-        // Make lastResultRegister tracking simpler in the DFG. This is needed because
-        // the DFG may have the SetLocal corresponding to this Call's return value in
-        // a different basic block, if inlining happened. The DFG isn't smart enough to
-        // track the baseline JIT's last result register across basic blocks.
-        killLastResultRegister();
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::compileLoadVarargs(Instruction* instruction)
</span><span class="lines">@@ -70,8 +63,6 @@
</span><span class="cx">     int arguments = instruction[4].u.operand;
</span><span class="cx">     int firstFreeRegister = instruction[5].u.operand;
</span><span class="cx"> 
</span><del>-    killLastResultRegister();
-
</del><span class="cx">     JumpList slowCase;
</span><span class="cx">     JumpList end;
</span><span class="cx">     bool canOptimize = m_codeBlock-&gt;usesArguments()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITInlines.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITInlines.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITInlines.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -57,24 +57,17 @@
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(JSStack::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
</span><span class="cx"> {
</span><span class="cx">     loadPtr(Address(from, entry * sizeof(Register)), to);
</span><del>-#if USE(JSVALUE64)
-    killLastResultRegister();
-#endif
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(JSStack::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
</span><span class="cx"> {
</span><span class="cx">     load32(Address(from, entry * sizeof(Register)), to);
</span><del>-#if USE(JSVALUE64)
-    killLastResultRegister();
-#endif
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader64(JSStack::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
</span><span class="cx"> {
</span><span class="cx">     load64(Address(from, entry * sizeof(Register)), to);
</span><del>-    killLastResultRegister();
</del><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -106,16 +99,6 @@
</span><span class="cx">     return nakedCall;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-ALWAYS_INLINE bool JIT::atJumpTarget()
-{
-    while (m_jumpTargetsPosition &lt; m_codeBlock-&gt;numberOfJumpTargets() &amp;&amp; m_codeBlock-&gt;jumpTarget(m_jumpTargetsPosition) &lt;= m_bytecodeOffset) {
-        if (m_codeBlock-&gt;jumpTarget(m_jumpTargetsPosition) == m_bytecodeOffset)
-            return true;
-        ++m_jumpTargetsPosition;
-    }
-    return false;
-}
-
</del><span class="cx"> ALWAYS_INLINE void JIT::updateTopCallFrame()
</span><span class="cx"> {
</span><span class="cx">     ASSERT(static_cast&lt;int&gt;(m_bytecodeOffset) &gt;= 0);
</span><span class="lines">@@ -806,40 +789,22 @@
</span><span class="cx"> 
</span><span class="cx"> inline void JIT::emitLoadTag(int index, RegisterID tag)
</span><span class="cx"> {
</span><del>-    RegisterID mappedTag;
-    if (getMappedTag(index, mappedTag)) {
-        move(mappedTag, tag);
-        unmap(tag);
-        return;
-    }
-
</del><span class="cx">     if (m_codeBlock-&gt;isConstantRegisterIndex(index)) {
</span><span class="cx">         move(Imm32(getConstantOperand(index).tag()), tag);
</span><del>-        unmap(tag);
</del><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     load32(tagFor(index), tag);
</span><del>-    unmap(tag);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void JIT::emitLoadPayload(int index, RegisterID payload)
</span><span class="cx"> {
</span><del>-    RegisterID mappedPayload;
-    if (getMappedPayload(index, mappedPayload)) {
-        move(mappedPayload, payload);
-        unmap(payload);
-        return;
-    }
-
</del><span class="cx">     if (m_codeBlock-&gt;isConstantRegisterIndex(index)) {
</span><span class="cx">         move(Imm32(getConstantOperand(index).payload()), payload);
</span><del>-        unmap(payload);
</del><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     load32(payloadFor(index), payload);
</span><del>-    unmap(payload);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void JIT::emitLoad(const JSValue&amp; v, RegisterID tag, RegisterID payload)
</span><span class="lines">@@ -871,11 +836,6 @@
</span><span class="cx"> 
</span><span class="cx"> inline void JIT::emitLoad2(int index1, RegisterID tag1, RegisterID payload1, int index2, RegisterID tag2, RegisterID payload2)
</span><span class="cx"> {
</span><del>-    if (isMapped(index1)) {
-        emitLoad(index1, tag1, payload1);
-        emitLoad(index2, tag2, payload2);
-        return;
-    }
</del><span class="cx">     emitLoad(index2, tag2, payload2);
</span><span class="cx">     emitLoad(index1, tag1, payload1);
</span><span class="cx"> }
</span><span class="lines">@@ -912,12 +872,6 @@
</span><span class="cx">         store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline void JIT::emitStoreAndMapInt32(int index, RegisterID tag, RegisterID payload, bool indexIsInt32, size_t opcodeLength)
-{
-    emitStoreInt32(index, payload, indexIsInt32);
-    map(m_bytecodeOffset + opcodeLength, index, tag, payload);
-}
-
</del><span class="cx"> inline void JIT::emitStoreInt32(int index, TrustedImm32 payload, bool indexIsInt32)
</span><span class="cx"> {
</span><span class="cx">     store32(payload, payloadFor(index, callFrameRegister));
</span><span class="lines">@@ -955,81 +909,6 @@
</span><span class="cx">     emitStore(dst, jsUndefined());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline bool JIT::isLabeled(unsigned bytecodeOffset)
-{
-    for (size_t numberOfJumpTargets = m_codeBlock-&gt;numberOfJumpTargets(); m_jumpTargetIndex != numberOfJumpTargets; ++m_jumpTargetIndex) {
-        unsigned jumpTarget = m_codeBlock-&gt;jumpTarget(m_jumpTargetIndex);
-        if (jumpTarget == bytecodeOffset)
-            return true;
-        if (jumpTarget &gt; bytecodeOffset)
-            return false;
-    }
-    return false;
-}
-
-inline void JIT::map(unsigned bytecodeOffset, int virtualRegisterIndex, RegisterID tag, RegisterID payload)
-{
-    if (isLabeled(bytecodeOffset))
-        return;
-
-    m_mappedBytecodeOffset = bytecodeOffset;
-    m_mappedVirtualRegisterIndex = virtualRegisterIndex;
-    m_mappedTag = tag;
-    m_mappedPayload = payload;
-    
-    ASSERT(!canBeOptimizedOrInlined() || m_mappedPayload == regT0);
-    ASSERT(!canBeOptimizedOrInlined() || m_mappedTag == regT1);
-}
-
-inline void JIT::unmap(RegisterID registerID)
-{
-    if (m_mappedTag == registerID)
-        m_mappedTag = (RegisterID)-1;
-    else if (m_mappedPayload == registerID)
-        m_mappedPayload = (RegisterID)-1;
-}
-
-inline void JIT::unmap()
-{
-    m_mappedBytecodeOffset = (unsigned)-1;
-    m_mappedVirtualRegisterIndex = UINT_MAX;
-    m_mappedTag = (RegisterID)-1;
-    m_mappedPayload = (RegisterID)-1;
-}
-
-inline bool JIT::isMapped(int virtualRegisterIndex)
-{
-    if (m_mappedBytecodeOffset != m_bytecodeOffset)
-        return false;
-    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
-        return false;
-    return true;
-}
-
-inline bool JIT::getMappedPayload(int virtualRegisterIndex, RegisterID&amp; payload)
-{
-    if (m_mappedBytecodeOffset != m_bytecodeOffset)
-        return false;
-    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
-        return false;
-    if (m_mappedPayload == (RegisterID)-1)
-        return false;
-    payload = m_mappedPayload;
-    return true;
-}
-
-inline bool JIT::getMappedTag(int virtualRegisterIndex, RegisterID&amp; tag)
-{
-    if (m_mappedBytecodeOffset != m_bytecodeOffset)
-        return false;
-    if (m_mappedVirtualRegisterIndex != virtualRegisterIndex)
-        return false;
-    if (m_mappedTag == (RegisterID)-1)
-        return false;
-    tag = m_mappedTag;
-    return true;
-}
-
</del><span class="cx"> inline void JIT::emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex)
</span><span class="cx"> {
</span><span class="cx">     if (!m_codeBlock-&gt;isKnownNotImmediate(virtualRegisterIndex)) {
</span><span class="lines">@@ -1074,11 +953,6 @@
</span><span class="cx"> 
</span><span class="cx"> #else // USE(JSVALUE32_64)
</span><span class="cx"> 
</span><del>-ALWAYS_INLINE void JIT::killLastResultRegister()
-{
-    m_lastResultBytecodeRegister = std::numeric_limits&lt;int&gt;::max();
-}
-
</del><span class="cx"> // get arg puts an arg from the SF register array into a h/w register
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
</span><span class="cx"> {
</span><span class="lines">@@ -1091,20 +965,10 @@
</span><span class="cx">             move(TrustedImm64(JSValue::encode(value)), dst);
</span><span class="cx">         else
</span><span class="cx">             move(Imm64(JSValue::encode(value)), dst);
</span><del>-        killLastResultRegister();
</del><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (src == m_lastResultBytecodeRegister &amp;&amp; operandIsLocal(src) &amp;&amp; m_codeBlock-&gt;isTemporaryRegisterIndex(VirtualRegister(src).toLocal()) &amp;&amp; !atJumpTarget()) {
-        // The argument we want is already stored in eax
-        if (dst != cachedResultRegister)
-            move(cachedResultRegister, dst);
-        killLastResultRegister();
-        return;
-    }
-
</del><span class="cx">     load64(Address(callFrameRegister, src * sizeof(Register)), dst);
</span><del>-    killLastResultRegister();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetVirtualRegister(VirtualRegister src, RegisterID dst)
</span><span class="lines">@@ -1114,13 +978,8 @@
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2)
</span><span class="cx"> {
</span><del>-    if (src2 == m_lastResultBytecodeRegister) {
-        emitGetVirtualRegister(src2, dst2);
-        emitGetVirtualRegister(src1, dst1);
-    } else {
-        emitGetVirtualRegister(src1, dst1);
-        emitGetVirtualRegister(src2, dst2);
-    }
</del><ins>+    emitGetVirtualRegister(src1, dst1);
+    emitGetVirtualRegister(src2, dst2);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JIT::emitGetVirtualRegisters(VirtualRegister src1, RegisterID dst1, VirtualRegister src2, RegisterID dst2)
</span><span class="lines">@@ -1141,7 +1000,6 @@
</span><span class="cx"> ALWAYS_INLINE void JIT::emitPutVirtualRegister(int dst, RegisterID from)
</span><span class="cx"> {
</span><span class="cx">     store64(from, Address(callFrameRegister, dst * sizeof(Register)));
</span><del>-    m_lastResultBytecodeRegister = (from == cachedResultRegister) ? dst : std::numeric_limits&lt;int&gt;::max();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JIT::emitPutVirtualRegister(VirtualRegister dst, RegisterID from)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -55,30 +55,10 @@
</span><span class="cx">     int dst = currentInstruction[1].u.operand;
</span><span class="cx">     int src = currentInstruction[2].u.operand;
</span><span class="cx"> 
</span><del>-    if (canBeOptimizedOrInlined()) {
-        // Use simpler approach, since the DFG thinks that the last result register
-        // is always set to the destination on every operation.
-        emitGetVirtualRegister(src, regT0);
-        emitPutVirtualRegister(dst);
-    } else {
-        if (m_codeBlock-&gt;isConstantRegisterIndex(src)) {
-            if (!getConstantOperand(src).isNumber())
-                store64(TrustedImm64(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
-            else
-                store64(Imm64(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
-            if (dst == m_lastResultBytecodeRegister)
-                killLastResultRegister();
-        } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
-            // If either the src or dst is the cached register go though
-            // get/put registers to make sure we track this correctly.
-            emitGetVirtualRegister(src, regT0);
-            emitPutVirtualRegister(dst);
-        } else {
-            // Perform the copy via regT1; do not disturb any mapping in regT0.
-            load64(Address(callFrameRegister, src * sizeof(Register)), regT1);
-            store64(regT1, Address(callFrameRegister, dst * sizeof(Register)));
-        }
-    }
</del><ins>+    // Use simpler approach, since the DFG thinks that the last result register
+    // is always set to the destination on every operation.
+    emitGetVirtualRegister(src, regT0);
+    emitPutVirtualRegister(dst);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_end(Instruction* currentInstruction)
</span><span class="lines">@@ -661,7 +641,6 @@
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_catch(Instruction* currentInstruction)
</span><span class="cx"> {
</span><del>-    killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
</del><span class="cx">     move(regT0, callFrameRegister);
</span><span class="cx">     move(TrustedImmPtr(m_vm), regT3);
</span><span class="cx">     load64(Address(regT3, VM::exceptionOffset()), regT0);
</span><span class="lines">@@ -1188,14 +1167,8 @@
</span><span class="cx">     FunctionExecutable* funcExec = m_codeBlock-&gt;functionDecl(currentInstruction[2].u.operand);
</span><span class="cx">     callOperation(operationNewFunction, dst, funcExec);
</span><span class="cx"> 
</span><del>-    if (currentInstruction[3].u.operand) {
-#if USE(JSVALUE32_64)        
-        unmap();
-#else
-        killLastResultRegister();
-#endif
</del><ins>+    if (currentInstruction[3].u.operand)
</ins><span class="cx">         lazyJump.link(this);
</span><del>-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -204,7 +204,6 @@
</span><span class="cx">     else {
</span><span class="cx">         emitLoad(src, regT1, regT0);
</span><span class="cx">         emitStore(dst, regT1, regT0);
</span><del>-        map(m_bytecodeOffset + OPCODE_LENGTH(op_mov), dst, regT1, regT0);
</del><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -432,7 +431,6 @@
</span><span class="cx"> 
</span><span class="cx">     if (dst != src)
</span><span class="cx">         emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_to_primitive), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -956,7 +954,6 @@
</span><span class="cx"> 
</span><span class="cx">     if (src != dst)
</span><span class="cx">         emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_to_number), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_to_number(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -990,7 +987,6 @@
</span><span class="cx"> 
</span><span class="cx">     unsigned exception = currentInstruction[1].u.operand;
</span><span class="cx">     emitStore(exception, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_catch), exception, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -675,7 +675,6 @@
</span><span class="cx">         emitResolveClosure(dst, needsVarInjectionChecks(resolveType), depth);
</span><span class="cx">         break;
</span><span class="cx">     case Dynamic:
</span><del>-        killLastResultRegister();
</del><span class="cx">         addSlowCase(jump());
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -744,7 +743,6 @@
</span><span class="cx">         emitGetClosureVar(scope, *operandSlot);
</span><span class="cx">         break;
</span><span class="cx">     case Dynamic:
</span><del>-        killLastResultRegister();
</del><span class="cx">         addSlowCase(jump());
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -812,7 +810,6 @@
</span><span class="cx">         emitPutClosureVar(scope, *operandSlot, value);
</span><span class="cx">         break;
</span><span class="cx">     case Dynamic:
</span><del>-        killLastResultRegister();
</del><span class="cx">         addSlowCase(jump());
</span><span class="cx">         break;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -175,7 +175,6 @@
</span><span class="cx"> 
</span><span class="cx">     emitValueProfilingSite(regT4);
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
</del><span class="cx">     
</span><span class="cx">     m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</span><span class="cx"> }
</span><span class="lines">@@ -491,7 +490,6 @@
</span><span class="cx"> 
</span><span class="cx">     emitValueProfilingSite(regT4);
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -646,7 +644,6 @@
</span><span class="cx">     compileGetDirectOffset(regT2, regT1, regT0, regT3);    
</span><span class="cx">     
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -687,7 +684,6 @@
</span><span class="cx">     for (unsigned i = 0; i &lt; depth; ++i)
</span><span class="cx">         loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_resolve_scope), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_resolve_scope(Instruction* currentInstruction)
</span><span class="lines">@@ -705,7 +701,6 @@
</span><span class="cx">         move(TrustedImm32(JSValue::CellTag), regT1);
</span><span class="cx">         move(TrustedImmPtr(m_codeBlock-&gt;globalObject()), regT0);
</span><span class="cx">         emitStore(dst, regT1, regT0);
</span><del>-        map(m_bytecodeOffset + OPCODE_LENGTH(op_resolve_scope), dst, regT1, regT0);
</del><span class="cx">         break;
</span><span class="cx">     case ClosureVar:
</span><span class="cx">     case ClosureVarWithVarInjectionChecks:
</span><span class="lines">@@ -788,7 +783,6 @@
</span><span class="cx">     }
</span><span class="cx">     emitValueProfilingSite(regT4);
</span><span class="cx">     emitStore(dst, regT1, regT0);
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_get_from_scope), dst, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
</span><span class="lines">@@ -887,7 +881,6 @@
</span><span class="cx"> 
</span><span class="cx">     store32(regT1, registerPointer-&gt;tagPointer());
</span><span class="cx">     store32(regT0, registerPointer-&gt;payloadPointer());
</span><del>-    map(m_bytecodeOffset + OPCODE_LENGTH(op_init_global_const), value, regT1, regT0);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitSlowPathCallh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/SlowPathCall.h (159090 => 159091)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/SlowPathCall.h        2013-11-12 01:55:35 UTC (rev 159090)
+++ trunk/Source/JavaScriptCore/jit/SlowPathCall.h        2013-11-12 03:28:41 UTC (rev 159091)
</span><span class="lines">@@ -77,11 +77,6 @@
</span><span class="cx">             m_jit-&gt;sampleInstruction(m_jit-&gt;m_codeBlock-&gt;instructions().begin() + m_jit-&gt;m_bytecodeOffset, false);
</span><span class="cx"> #endif
</span><span class="cx">         
</span><del>-#if USE(JSVALUE32_64)
-        m_jit-&gt;unmap();
-#else
-        m_jit-&gt;killLastResultRegister();
-#endif   
</del><span class="cx">         m_jit-&gt;exceptionCheck();
</span><span class="cx">         return call;
</span><span class="cx">     }
</span></span></pre>
</div>
</div>

</body>
</html>