<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[160600] branches/jsCStack</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/160600">160600</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2013-12-14 13:38:01 -0800 (Sat, 14 Dec 2013)</dd>
</dl>

<h3>Log Message</h3>
<pre>cStack: Calling into FTL-generated code should be fast
https://bugs.webkit.org/show_bug.cgi?id=125649

Not yet reviewed.

* assembler/AbstractMacroAssembler.h:
* bytecode/StructureStubInfo.h:
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedPutById):
* ftl/FTLAbbreviations.h:
(JSC::FTL::arrayType):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLCompile.cpp:
(JSC::FTL::fixFunctionBasedOnStackMaps):
* ftl/FTLExitValue.h:
(JSC::FTL::ExitValue::withVirtualRegister):
* ftl/FTLIntrinsicRepository.h:
* ftl/FTLJITCode.cpp:
(JSC::FTL::JITCode::initializeEntrypoint):
(JSC::FTL::JITCode::initializeAddressForCall):
(JSC::FTL::JITCode::addressForCall):
(JSC::FTL::JITCode::executableAddressAtOffset):
* ftl/FTLJITCode.h:
* ftl/FTLJITFinalizer.cpp:
(JSC::FTL::JITFinalizer::finalizeFunction):
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::lower):
(JSC::FTL::LowerDFGToLLVM::compileGetById):
(JSC::FTL::LowerDFGToLLVM::compilePutById):
(JSC::FTL::LowerDFGToLLVM::buildExitArguments):
(JSC::FTL::LowerDFGToLLVM::payloadFor):
(JSC::FTL::LowerDFGToLLVM::tagFor):
(JSC::FTL::LowerDFGToLLVM::addressFor):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* ftl/FTLOutput.h:
(JSC::FTL::Output::ptrToInt):
* ftl/FTLSlowPathCall.cpp:
(JSC::FTL::callOperation):
* ftl/FTLSlowPathCall.h:
* ftl/FTLState.h:
* ftl/FTLThunks.cpp:
(JSC::FTL::osrExitGenerationThunkGenerator):
* ftl/FTLThunks.h:
* heap/Heap.cpp:
(JSC::Heap::collectIfNecessaryOrDefer):
* heap/Heap.h:
(JSC::Heap::isDeferred):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::tagFor):
(JSC::AssemblyHelpers::payloadFor):
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITByIdGenerator::JITByIdGenerator):
(JSC::JITPutByIdGenerator::JITPutByIdGenerator):
* jit/JITInlineCacheGenerator.h:
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_put_by_id):
* jit/Repatch.cpp:
(JSC::tryBuildGetByIDList):
(JSC::emitPutTransitionStub):
* runtime/JSCJSValue.h:
* runtime/Options.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchesjsCStackPerformanceTestsSunSpidertestsv8v6v8cryptojs">branches/jsCStack/PerformanceTests/SunSpider/tests/v8-v6/v8-crypto.js</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreChangeLog">branches/jsCStack/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreassemblerAbstractMacroAssemblerh">branches/jsCStack/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorebytecodeStructureStubInfoh">branches/jsCStack/Source/JavaScriptCore/bytecode/StructureStubInfo.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">branches/jsCStack/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLAbbreviationsh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLAbbreviations.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLCapabilitiescpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLCompilecpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLCompile.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLExitValueh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLExitValue.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLIntrinsicRepositoryh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLJITCodecpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLJITCodeh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLJITFinalizercpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLLinkcpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLLink.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLOSRExitCompilercpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLOutputh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLOutput.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLSlowPathCallcpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLSlowPathCallh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLStateh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLState.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLThunkscpp">branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreftlFTLThunksh">branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreheapHeapcpp">branches/jsCStack/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreheapHeaph">branches/jsCStack/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorejitAssemblyHelpersh">branches/jsCStack/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorejitJITInlineCacheGeneratorcpp">branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorejitJITInlineCacheGeneratorh">branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorejitJITPropertyAccesscpp">branches/jsCStack/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCorejitRepatchcpp">branches/jsCStack/Source/JavaScriptCore/jit/Repatch.cpp</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreruntimeJSCJSValueh">branches/jsCStack/Source/JavaScriptCore/runtime/JSCJSValue.h</a></li>
<li><a href="#branchesjsCStackSourceJavaScriptCoreruntimeOptionsh">branches/jsCStack/Source/JavaScriptCore/runtime/Options.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchesjsCStackPerformanceTestsSunSpidertestsv8v6v8cryptojs"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/PerformanceTests/SunSpider/tests/v8-v6/v8-crypto.js (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/PerformanceTests/SunSpider/tests/v8-v6/v8-crypto.js        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/PerformanceTests/SunSpider/tests/v8-v6/v8-crypto.js        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -1274,6 +1274,8 @@
</span><span class="cx">   return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+print(&quot;Setting up BitInteger&quot;);
+
</ins><span class="cx"> // protected
</span><span class="cx"> BigInteger.prototype.chunkSize = bnpChunkSize;
</span><span class="cx"> BigInteger.prototype.toRadix = bnpToRadix;
</span><span class="lines">@@ -1324,6 +1326,8 @@
</span><span class="cx"> BigInteger.prototype.gcd = bnGCD;
</span><span class="cx"> BigInteger.prototype.isProbablePrime = bnIsProbablePrime;
</span><span class="cx"> 
</span><ins>+print(&quot;   OK&quot;);
+
</ins><span class="cx"> // BigInteger interfaces not implemented in jsbn:
</span><span class="cx"> 
</span><span class="cx"> // BigInteger(int signum, byte[] magnitude)
</span><span class="lines">@@ -1582,6 +1586,8 @@
</span><span class="cx">     alert(&quot;Invalid RSA private key&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+print(&quot;Here??&quot;);
+
</ins><span class="cx"> // Generate a new random private key B bits long, using public expt E
</span><span class="cx"> function RSAGenerate(B,E) {
</span><span class="cx">   var rng = new SecureRandom();
</span><span class="lines">@@ -1666,8 +1672,12 @@
</span><span class="cx"> dmq1Value=&quot;3d06982efbbe47339e1f6d36b1216b8a741d410b0c662f54f7118b27b9a4ec9d914337eb39841d8666f3034408cf94f5b62f11c402fc994fe15a05493150d9fd&quot;;
</span><span class="cx"> coeffValue=&quot;3a3e731acd8960b7ff9eb81a7ff93bd1cfa74cbd56987db58b4594fb09c09084db1734c8143f98b602b981aaa9243ca28deb69b5b280ee8dcee0fd2625e53250&quot;;
</span><span class="cx"> 
</span><ins>+print(&quot;setting up&quot;);
+
</ins><span class="cx"> setupEngine(am3, 28);
</span><span class="cx"> 
</span><ins>+print(&quot;it's set up&quot;);
+
</ins><span class="cx"> var TEXT = &quot;The quick brown fox jumped over the extremely lazy frog! &quot; +
</span><span class="cx">     &quot;Now is the time for all good men to come to the party.&quot;;
</span><span class="cx"> var encrypted;
</span><span class="lines">@@ -1689,7 +1699,10 @@
</span><span class="cx">   }
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+print(&quot;Here&quot;);
+
</ins><span class="cx"> for (var i = 0; i &lt; 8; ++i) {
</span><ins>+    print(&quot;i = &quot; + i);
</ins><span class="cx">   encrypt();
</span><span class="cx">   decrypt();
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ChangeLog (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ChangeLog        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ChangeLog        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -1,3 +1,74 @@
</span><ins>+2013-12-14  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        cStack: Calling into FTL-generated code should be fast
+        https://bugs.webkit.org/show_bug.cgi?id=125649
+
+        Not yet reviewed.
+
+        * assembler/AbstractMacroAssembler.h:
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::arrayType):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::withVirtualRegister):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::initializeEntrypoint):
+        (JSC::FTL::JITCode::initializeAddressForCall):
+        (JSC::FTL::JITCode::addressForCall):
+        (JSC::FTL::JITCode::executableAddressAtOffset):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::payloadFor):
+        (JSC::FTL::LowerDFGToLLVM::tagFor):
+        (JSC::FTL::LowerDFGToLLVM::addressFor):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::ptrToInt):
+        * ftl/FTLSlowPathCall.cpp:
+        (JSC::FTL::callOperation):
+        * ftl/FTLSlowPathCall.h:
+        * ftl/FTLState.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * ftl/FTLThunks.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        * heap/Heap.h:
+        (JSC::Heap::isDeferred):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::tagFor):
+        (JSC::AssemblyHelpers::payloadFor):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutTransitionStub):
+        * runtime/JSCJSValue.h:
+        * runtime/Options.h:
+
</ins><span class="cx"> 2013-12-13  Michael Saboff  &lt;msaboff@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         CStack Branch: Remove WTF_USE_SEPARATE_C_AND_JS_STACK
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreassemblerAbstractMacroAssemblerh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -123,7 +123,7 @@
</span><span class="cx">         {
</span><span class="cx">             return Address(base, offset + additionalOffset);
</span><span class="cx">         }
</span><del>-
</del><ins>+        
</ins><span class="cx">         RegisterID base;
</span><span class="cx">         int32_t offset;
</span><span class="cx">     };
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorebytecodeStructureStubInfoh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/bytecode/StructureStubInfo.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/bytecode/StructureStubInfo.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/bytecode/StructureStubInfo.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -225,7 +225,6 @@
</span><span class="cx"> 
</span><span class="cx">     struct {
</span><span class="cx">         int8_t registersFlushed;
</span><del>-        int8_t callFrameRegister;
</del><span class="cx">         int8_t baseGPR;
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">         int8_t valueTagGPR;
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -213,8 +213,8 @@
</span><span class="cx"> void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg resultGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
</span><span class="cx"> {
</span><span class="cx">     JITGetByIdGenerator gen(
</span><del>-        m_jit.codeBlock(), codeOrigin, usedRegisters(), GPRInfo::callFrameRegister,
-        JSValueRegs(baseGPR), JSValueRegs(resultGPR), spillMode != NeedToSpill);
</del><ins>+        m_jit.codeBlock(), codeOrigin, usedRegisters(), JSValueRegs(baseGPR),
+        JSValueRegs(resultGPR), spillMode != NeedToSpill);
</ins><span class="cx">     gen.generateFastPath(m_jit);
</span><span class="cx">     
</span><span class="cx">     JITCompiler::JumpList slowCases;
</span><span class="lines">@@ -235,9 +235,8 @@
</span><span class="cx">     writeBarrier(baseGPR, valueGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);
</span><span class="cx"> 
</span><span class="cx">     JITPutByIdGenerator gen(
</span><del>-        m_jit.codeBlock(), codeOrigin, usedRegisters(), GPRInfo::callFrameRegister,
-        JSValueRegs(baseGPR), JSValueRegs(valueGPR), scratchGPR, false,
-        m_jit.ecmaModeFor(codeOrigin), putKind);
</del><ins>+        m_jit.codeBlock(), codeOrigin, usedRegisters(), JSValueRegs(baseGPR),
+        JSValueRegs(valueGPR), scratchGPR, false, m_jit.ecmaModeFor(codeOrigin), putKind);
</ins><span class="cx">     gen.generateFastPath(m_jit);
</span><span class="cx">     
</span><span class="cx">     JITCompiler::JumpList slowCases;
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLAbbreviationsh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLAbbreviations.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -58,6 +58,7 @@
</span><span class="cx"> static inline LType doubleType(LContext context) { return llvm-&gt;DoubleTypeInContext(context); }
</span><span class="cx"> 
</span><span class="cx"> static inline LType pointerType(LType type) { return llvm-&gt;PointerType(type, 0); }
</span><ins>+static inline LType arrayType(LType type, unsigned count) { return llvm-&gt;ArrayType(type, count); }
</ins><span class="cx"> static inline LType vectorType(LType type, unsigned count) { return llvm-&gt;VectorType(type, count); }
</span><span class="cx"> 
</span><span class="cx"> enum PackingMode { NotPacked, Packed };
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -89,8 +89,6 @@
</span><span class="cx">     case Upsilon:
</span><span class="cx">     case ExtractOSREntryLocal:
</span><span class="cx">     case LoopHint:
</span><del>-    case Call:
-    case Construct:
</del><span class="cx">     case GetMyScope:
</span><span class="cx">     case SkipScope:
</span><span class="cx">     case GetClosureRegisters:
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLCompilecpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLCompile.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLCompile.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLCompile.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -151,6 +151,19 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = state.graph.m_vm;
</span><span class="cx">     StackMaps stackmaps = jitCode-&gt;stackmaps;
</span><ins>+    
+    StackMaps::RecordMap::iterator iter = recordMap.find(state.capturedStackmapID);
+    RELEASE_ASSERT(iter != recordMap.end());
+    RELEASE_ASSERT(iter-&gt;value.locations.size() == 1);
+    Location capturedLocation =
+        Location::forStackmaps(&amp;jitCode-&gt;stackmaps, iter-&gt;value.locations[0]);
+    RELEASE_ASSERT(capturedLocation.kind() == Location::Register);
+    RELEASE_ASSERT(capturedLocation.gpr() == GPRInfo::callFrameRegister);
+    RELEASE_ASSERT(!(capturedLocation.addend() % sizeof(Register)));
+    int32_t localsOffset = capturedLocation.addend() / sizeof(Register) + state.graph.m_nextMachineLocal;
+    
+    // FIXME: Need to update all machine virtual registers in runtime meta-data.
+    // https://bugs.webkit.org/show_bug.cgi?id=125725
</ins><span class="cx"> 
</span><span class="cx">     ExitThunkGenerator exitThunkGenerator(state);
</span><span class="cx">     exitThunkGenerator.emitThunks();
</span><span class="lines">@@ -167,15 +180,29 @@
</span><span class="cx">             if (Options::verboseCompilation())
</span><span class="cx">                 dataLog(&quot;Handling OSR stackmap #&quot;, exit.m_stackmapID, &quot;\n&quot;);
</span><span class="cx">             
</span><del>-            StackMaps::RecordMap::iterator iter = recordMap.find(exit.m_stackmapID);
</del><ins>+            iter = recordMap.find(exit.m_stackmapID);
</ins><span class="cx">             if (iter == recordMap.end()) {
</span><span class="cx">                 // It was optimized out.
</span><span class="cx">                 continue;
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="cx">             info.m_thunkAddress = linkBuffer-&gt;locationOf(info.m_thunkLabel);
</span><ins>+            exit.m_patchableCodeOffset = linkBuffer-&gt;offsetOf(info.m_thunkJump);
</ins><span class="cx">             
</span><del>-            exit.m_patchableCodeOffset = linkBuffer-&gt;offsetOf(info.m_thunkJump);
</del><ins>+            for (unsigned j = exit.m_values.size(); j--;) {
+                ExitValue value = exit.m_values[j];
+                if (!value.isInJSStackSomehow())
+                    continue;
+                if (!value.virtualRegister().isLocal())
+                    continue;
+                exit.m_values[j] = value.withVirtualRegister(
+                    VirtualRegister(value.virtualRegister().offset() + localsOffset));
+            }
+            
+            if (Options::verboseCompilation()) {
+                DumpContext context;
+                dataLog(&quot;    Exit values: &quot;, inContext(exit.m_values, &amp;context), &quot;\n&quot;);
+            }
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         state.finalizer-&gt;exitThunksLinkBuffer = linkBuffer.release();
</span><span class="lines">@@ -190,7 +217,7 @@
</span><span class="cx">             if (Options::verboseCompilation())
</span><span class="cx">                 dataLog(&quot;Handling GetById stackmap #&quot;, getById.stackmapID(), &quot;\n&quot;);
</span><span class="cx">             
</span><del>-            StackMaps::RecordMap::iterator iter = recordMap.find(getById.stackmapID());
</del><ins>+            iter = recordMap.find(getById.stackmapID());
</ins><span class="cx">             if (iter == recordMap.end()) {
</span><span class="cx">                 // It was optimized out.
</span><span class="cx">                 continue;
</span><span class="lines">@@ -202,18 +229,17 @@
</span><span class="cx">             RegisterSet usedRegisters = RegisterSet::allRegisters();
</span><span class="cx">             
</span><span class="cx">             GPRReg result = record.locations[0].directGPR();
</span><del>-            GPRReg callFrameRegister = record.locations[1].directGPR();
-            GPRReg base = record.locations[2].directGPR();
</del><ins>+            GPRReg base = record.locations[1].directGPR();
</ins><span class="cx">             
</span><span class="cx">             JITGetByIdGenerator gen(
</span><del>-                codeBlock, getById.codeOrigin(), usedRegisters, callFrameRegister,
-                JSValueRegs(base), JSValueRegs(result), false);
</del><ins>+                codeBlock, getById.codeOrigin(), usedRegisters, JSValueRegs(base),
+                JSValueRegs(result), false);
</ins><span class="cx">             
</span><span class="cx">             MacroAssembler::Label begin = slowPathJIT.label();
</span><span class="cx">             
</span><span class="cx">             MacroAssembler::Call call = callOperation(
</span><span class="cx">                 state, usedRegisters, slowPathJIT, operationGetByIdOptimize, result,
</span><del>-                callFrameRegister, gen.stubInfo(), base, getById.uid());
</del><ins>+                gen.stubInfo(), base, getById.uid());
</ins><span class="cx">             
</span><span class="cx">             gen.reportSlowPathCall(begin, call);
</span><span class="cx">             
</span><span class="lines">@@ -227,7 +253,7 @@
</span><span class="cx">             if (Options::verboseCompilation())
</span><span class="cx">                 dataLog(&quot;Handling PutById stackmap #&quot;, putById.stackmapID(), &quot;\n&quot;);
</span><span class="cx">             
</span><del>-            StackMaps::RecordMap::iterator iter = recordMap.find(putById.stackmapID());
</del><ins>+            iter = recordMap.find(putById.stackmapID());
</ins><span class="cx">             if (iter == recordMap.end()) {
</span><span class="cx">                 // It was optimized out.
</span><span class="cx">                 continue;
</span><span class="lines">@@ -238,20 +264,19 @@
</span><span class="cx">             // FIXME: LLVM should tell us which registers are live.
</span><span class="cx">             RegisterSet usedRegisters = RegisterSet::allRegisters();
</span><span class="cx">             
</span><del>-            GPRReg callFrameRegister = record.locations[0].directGPR();
-            GPRReg base = record.locations[1].directGPR();
-            GPRReg value = record.locations[2].directGPR();
</del><ins>+            GPRReg base = record.locations[0].directGPR();
+            GPRReg value = record.locations[1].directGPR();
</ins><span class="cx">             
</span><span class="cx">             JITPutByIdGenerator gen(
</span><del>-                codeBlock, putById.codeOrigin(), usedRegisters, callFrameRegister,
-                JSValueRegs(base), JSValueRegs(value), MacroAssembler::scratchRegister,
-                false, putById.ecmaMode(), putById.putKind());
</del><ins>+                codeBlock, putById.codeOrigin(), usedRegisters, JSValueRegs(base),
+                JSValueRegs(value), MacroAssembler::scratchRegister, false, putById.ecmaMode(),
+                putById.putKind());
</ins><span class="cx">             
</span><span class="cx">             MacroAssembler::Label begin = slowPathJIT.label();
</span><span class="cx">             
</span><span class="cx">             MacroAssembler::Call call = callOperation(
</span><del>-                state, usedRegisters, slowPathJIT, gen.slowPathFunction(), callFrameRegister,
-                gen.stubInfo(), value, base, putById.uid());
</del><ins>+                state, usedRegisters, slowPathJIT, gen.slowPathFunction(), gen.stubInfo(),
+                value, base, putById.uid());
</ins><span class="cx">             
</span><span class="cx">             gen.reportSlowPathCall(begin, call);
</span><span class="cx">             
</span><span class="lines">@@ -279,7 +304,7 @@
</span><span class="cx">     for (unsigned exitIndex = jitCode-&gt;osrExit.size(); exitIndex--;) {
</span><span class="cx">         OSRExitCompilationInfo&amp; info = state.finalizer-&gt;osrExit[exitIndex];
</span><span class="cx">         OSRExit&amp; exit = jitCode-&gt;osrExit[exitIndex];
</span><del>-        StackMaps::RecordMap::iterator iter = recordMap.find(exit.m_stackmapID);
</del><ins>+        iter = recordMap.find(exit.m_stackmapID);
</ins><span class="cx">         if (iter == recordMap.end()) {
</span><span class="cx">             // This could happen if LLVM optimizes out an OSR exit.
</span><span class="cx">             continue;
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLExitValueh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLExitValue.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLExitValue.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLExitValue.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -153,6 +153,15 @@
</span><span class="cx">         ASSERT(isInJSStackSomehow());
</span><span class="cx">         return VirtualRegister(u.virtualRegister);
</span><span class="cx">     }
</span><ins>+    
+    ExitValue withVirtualRegister(VirtualRegister virtualRegister)
+    {
+        ASSERT(isInJSStackSomehow());
+        ExitValue result;
+        result.m_kind = m_kind;
+        result.u.virtualRegister = virtualRegister.offset();
+        return result;
+    }
</ins><span class="cx"> 
</span><span class="cx">     // If it's in the JSStack somehow, this will tell you what format it's in, in a manner
</span><span class="cx">     // that is compatible with exitArgument().format(). If it's a constant or it's dead, it
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLIntrinsicRepositoryh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -40,6 +40,7 @@
</span><span class="cx">     macro(addWithOverflow32, &quot;llvm.sadd.with.overflow.i32&quot;, functionType(structType(m_context, int32, boolean), int32, int32)) \
</span><span class="cx">     macro(addWithOverflow64, &quot;llvm.sadd.with.overflow.i64&quot;, functionType(structType(m_context, int64, boolean), int64, int64)) \
</span><span class="cx">     macro(doubleAbs, &quot;llvm.fabs.f64&quot;, functionType(doubleType, doubleType)) \
</span><ins>+    macro(frameAddress, &quot;llvm.frameaddress&quot;, functionType(pointerType(int8), int32)) \
</ins><span class="cx">     macro(mulWithOverflow32, &quot;llvm.smul.with.overflow.i32&quot;, functionType(structType(m_context, int32, boolean), int32, int32)) \
</span><span class="cx">     macro(mulWithOverflow64, &quot;llvm.smul.with.overflow.i64&quot;, functionType(structType(m_context, int64, boolean), int64, int64)) \
</span><span class="cx">     macro(patchpointInt64, &quot;llvm.experimental.patchpoint.i64&quot;, functionType(int64, int32, int32, ref8, int32, Variadic)) \
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLJITCodecpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -54,21 +54,25 @@
</span><span class="cx">     m_dataSections.append(dataSection);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JITCode::initializeCode(CodeRef entrypoint)
</del><ins>+void JITCode::initializeEntrypoint(CodeRef entrypoint)
</ins><span class="cx"> {
</span><span class="cx">     m_entrypoint = entrypoint;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JITCode::initializeAddressForCall(CodePtr address)
+{
+    m_addressForCall = address;
+}
+
</ins><span class="cx"> JITCode::CodePtr JITCode::addressForCall()
</span><span class="cx"> {
</span><del>-    RELEASE_ASSERT(m_entrypoint);
-    return m_entrypoint.code();
</del><ins>+    return m_addressForCall;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void* JITCode::executableAddressAtOffset(size_t offset)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(m_entrypoint);
</span><del>-    return reinterpret_cast&lt;char*&gt;(m_entrypoint.code().executableAddress()) + offset;
</del><ins>+    return reinterpret_cast&lt;char*&gt;(m_addressForCall.executableAddress()) + offset;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void* JITCode::dataAddressAtOffset(size_t)
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLJITCodeh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITCode.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -56,7 +56,8 @@
</span><span class="cx">     void initializeExitThunks(CodeRef);
</span><span class="cx">     void addHandle(PassRefPtr&lt;ExecutableMemoryHandle&gt;);
</span><span class="cx">     void addDataSection(RefCountedArray&lt;LSectionWord&gt;);
</span><del>-    void initializeCode(CodeRef entrypoint);
</del><ins>+    void initializeEntrypoint(CodeRef);
+    void initializeAddressForCall(CodePtr);
</ins><span class="cx">     
</span><span class="cx">     const Vector&lt;RefPtr&lt;ExecutableMemoryHandle&gt;&gt;&amp; handles() const { return m_handles; }
</span><span class="cx">     const Vector&lt;RefCountedArray&lt;LSectionWord&gt;&gt;&amp; dataSections() const { return m_dataSections; }
</span><span class="lines">@@ -73,6 +74,7 @@
</span><span class="cx"> private:
</span><span class="cx">     Vector&lt;RefCountedArray&lt;LSectionWord&gt;&gt; m_dataSections;
</span><span class="cx">     Vector&lt;RefPtr&lt;ExecutableMemoryHandle&gt;&gt; m_handles;
</span><ins>+    CodePtr m_addressForCall;
</ins><span class="cx">     CodeRef m_entrypoint;
</span><span class="cx">     CodeRef m_exitThunks;
</span><span class="cx"> };
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLJITFinalizercpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -73,9 +73,7 @@
</span><span class="cx">             exitThunksLinkBuffer-&gt;link(
</span><span class="cx">                 info.m_thunkJump,
</span><span class="cx">                 CodeLocationLabel(
</span><del>-                    m_plan.vm.ftlThunks-&gt;getOSRExitGenerationThunk(
-                        m_plan.vm, Location::forStackmaps(
-                            &amp;jitCode-&gt;stackmaps, iter-&gt;value.locations[0])).code()));
</del><ins>+                    m_plan.vm.getCTIStub(osrExitGenerationThunkGenerator).code()));
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         jitCode-&gt;initializeExitThunks(
</span><span class="lines">@@ -105,7 +103,7 @@
</span><span class="cx">     MacroAssemblerCodePtr withArityCheck;
</span><span class="cx">     if (arityCheck.isSet())
</span><span class="cx">         withArityCheck = entrypointLinkBuffer-&gt;locationOf(arityCheck);
</span><del>-    jitCode-&gt;initializeCode(
</del><ins>+    jitCode-&gt;initializeEntrypoint(
</ins><span class="cx">         FINALIZE_DFG_CODE(
</span><span class="cx">             *entrypointLinkBuffer,
</span><span class="cx">             (&quot;FTL entrypoint thunk for %s with LLVM generated code at %p&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data(), function)));
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLLinkcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLLink.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLLink.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLLink.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -43,12 +43,6 @@
</span><span class="cx"> 
</span><span class="cx"> using namespace DFG;
</span><span class="cx"> 
</span><del>-static void compileEntry(CCallHelpers&amp; jit)
-{
-    jit.emitFunctionPrologue();
-    jit.emitPutImmediateToCallFrameHeader(jit.codeBlock(), JSStack::CodeBlock);
-}
-
</del><span class="cx"> void link(State&amp; state)
</span><span class="cx"> {
</span><span class="cx">     CodeBlock* codeBlock = state.graph.m_codeBlock;
</span><span class="lines">@@ -56,7 +50,10 @@
</span><span class="cx">     // LLVM will create its own jump tables as needed.
</span><span class="cx">     codeBlock-&gt;clearSwitchJumpTables();
</span><span class="cx">     
</span><del>-    state.jitCode-&gt;common.frameRegisterCount = state.graph.frameRegisterCount();
</del><ins>+    // FIXME: Need to know the real frame register count.
+    // https://bugs.webkit.org/show_bug.cgi?id=125727
+    state.jitCode-&gt;common.frameRegisterCount = 1000;
+    
</ins><span class="cx">     state.jitCode-&gt;common.requiredRegisterCountForExit = state.graph.requiredRegisterCountForExit();
</span><span class="cx">     
</span><span class="cx">     if (!state.graph.m_inlineCallFrames-&gt;isEmpty())
</span><span class="lines">@@ -64,71 +61,29 @@
</span><span class="cx">     
</span><span class="cx">     // Create the entrypoint. Note that we use this entrypoint totally differently
</span><span class="cx">     // depending on whether we're doing OSR entry or not.
</span><del>-    // FIXME: Except for OSR entry, this is a total kludge - LLVM should just use our
-    // calling convention.
-    // https://bugs.webkit.org/show_bug.cgi?id=113621
</del><span class="cx">     CCallHelpers jit(&amp;state.graph.m_vm, codeBlock);
</span><span class="cx">     
</span><span class="cx">     OwnPtr&lt;LinkBuffer&gt; linkBuffer;
</span><span class="cx">     CCallHelpers::Label arityCheck;
</span><ins>+
+    CCallHelpers::Address frame = CCallHelpers::Address(
+        CCallHelpers::stackPointerRegister, -static_cast&lt;int32_t&gt;(sizeof(void*)));
+    
</ins><span class="cx">     switch (state.graph.m_plan.mode) {
</span><span class="cx">     case FTLMode: {
</span><del>-        compileEntry(jit);
</del><ins>+        CCallHelpers::JumpList mainPathJumps;
</ins><span class="cx">     
</span><del>-        // This part is only necessary for functions. We currently only compile functions.
-        
-        CCallHelpers::Label fromArityCheck = jit.label();
-        
-        // Plant a check that sufficient space is available in the JSStack.
-        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
-        jit.addPtr(
-            CCallHelpers::TrustedImm32(virtualRegisterForLocal(state.jitCode-&gt;common.requiredRegisterCountForExit).offset() * sizeof(Register)),
-            GPRInfo::callFrameRegister, GPRInfo::regT1);
-        CCallHelpers::Jump stackCheck = jit.branchPtr(
-            CCallHelpers::Above,
-            CCallHelpers::AbsoluteAddress(state.graph.m_vm.addressOfJSStackLimit()),
-            GPRInfo::regT1);
-        CCallHelpers::Label fromStackCheck = jit.label();
-        
-        jit.setupArgumentsExecState();
-        jit.move(
-            CCallHelpers::TrustedImmPtr(reinterpret_cast&lt;void*&gt;(state.generatedFunction)),
-            GPRInfo::nonArgGPR0);
-        jit.call(GPRInfo::nonArgGPR0);
-        jit.emitFunctionEpilogue();
-        jit.ret();
-        
-        stackCheck.link(&amp;jit);
-        jit.move(CCallHelpers::TrustedImmPtr(codeBlock), GPRInfo::argumentGPR1);
-        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
-        jit.store32(
-            CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
-            CCallHelpers::tagFor(static_cast&lt;VirtualRegister&gt;(JSStack::ArgumentCount)));
-        jit.storePtr(GPRInfo::callFrameRegister, &amp;state.graph.m_vm.topCallFrame);
-        CCallHelpers::Call callStackCheck = jit.call();
-#if !ASSERT_DISABLED
-        // FIXME: need to make this call register with exception handling somehow. This is
-        // part of a bigger problem: FTL should be able to handle exceptions.
-        // https://bugs.webkit.org/show_bug.cgi?id=113622
-        // Until then, use a JIT ASSERT.
-        jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT0);
-        jit.jitAssertIsNull(GPRInfo::regT0);
-#endif
-        jit.jump(fromStackCheck);
-        
-        arityCheck = jit.label();
-        compileEntry(jit);
</del><span class="cx">         jit.load32(
</span><del>-            CCallHelpers::payloadFor(static_cast&lt;VirtualRegister&gt;(JSStack::ArgumentCount)),
</del><ins>+            frame.withOffset(sizeof(Register) * JSStack::ArgumentCount),
</ins><span class="cx">             GPRInfo::regT1);
</span><del>-        jit.branch32(
</del><ins>+        mainPathJumps.append(jit.branch32(
</ins><span class="cx">             CCallHelpers::AboveOrEqual, GPRInfo::regT1,
</span><del>-            CCallHelpers::TrustedImm32(codeBlock-&gt;numParameters()))
-            .linkTo(fromArityCheck, &amp;jit);
</del><ins>+            CCallHelpers::TrustedImm32(codeBlock-&gt;numParameters())));
+        jit.emitFunctionPrologue();
</ins><span class="cx">         jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
</span><span class="cx">         jit.store32(
</span><span class="cx">             CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
</span><del>-            CCallHelpers::tagFor(static_cast&lt;VirtualRegister&gt;(JSStack::ArgumentCount)));
</del><ins>+            CCallHelpers::tagFor(JSStack::ArgumentCount));
</ins><span class="cx">         jit.storePtr(GPRInfo::callFrameRegister, &amp;state.graph.m_vm.topCallFrame);
</span><span class="cx">         CCallHelpers::Call callArityCheck = jit.call();
</span><span class="cx"> #if !ASSERT_DISABLED
</span><span class="lines">@@ -139,16 +94,20 @@
</span><span class="cx">         jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT1);
</span><span class="cx">         jit.jitAssertIsNull(GPRInfo::regT1);
</span><span class="cx"> #endif
</span><del>-        if (GPRInfo::returnValueGPR != GPRInfo::regT0)
-            jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
-        jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0).linkTo(fromArityCheck, &amp;jit);
</del><ins>+        jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
+        jit.emitFunctionEpilogue();
+        mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));
+        jit.emitFunctionPrologue();
</ins><span class="cx">         CCallHelpers::Call callArityFixup = jit.call();
</span><del>-        jit.jump(fromArityCheck);
-        
</del><ins>+        jit.emitFunctionEpilogue();
+        mainPathJumps.append(jit.jump());
+
</ins><span class="cx">         linkBuffer = adoptPtr(new LinkBuffer(state.graph.m_vm, &amp;jit, codeBlock, JITCompilationMustSucceed));
</span><del>-        linkBuffer-&gt;link(callStackCheck, operationStackCheck);
</del><span class="cx">         linkBuffer-&gt;link(callArityCheck, codeBlock-&gt;m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
</span><span class="cx">         linkBuffer-&gt;link(callArityFixup, FunctionPtr((state.graph.m_vm.getCTIStub(arityFixup)).code().executableAddress()));
</span><ins>+        linkBuffer-&gt;link(mainPathJumps, CodeLocationLabel(bitwise_cast&lt;void*&gt;(state.generatedFunction)));
+
+        state.jitCode-&gt;initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast&lt;void*&gt;(state.generatedFunction)));
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="lines">@@ -157,16 +116,15 @@
</span><span class="cx">         // values into the scratch buffer. Everything should be good to go - at this
</span><span class="cx">         // point we've even done the stack check. Basically we just have to make the
</span><span class="cx">         // call to the LLVM-generated code.
</span><del>-        jit.setupArgumentsExecState();
-        jit.move(
-            CCallHelpers::TrustedImmPtr(reinterpret_cast&lt;void*&gt;(state.generatedFunction)),
-            GPRInfo::nonArgGPR0);
-        jit.call(GPRInfo::nonArgGPR0);
</del><ins>+        CCallHelpers::Label start = jit.label();
</ins><span class="cx">         jit.emitFunctionEpilogue();
</span><del>-        jit.ret();
</del><ins>+        CCallHelpers::Jump mainPathJump = jit.jump();
</ins><span class="cx">         
</span><span class="cx">         linkBuffer = adoptPtr(new LinkBuffer(
</span><span class="cx">             state.graph.m_vm, &amp;jit, codeBlock, JITCompilationMustSucceed));
</span><ins>+        linkBuffer-&gt;link(mainPathJump, CodeLocationLabel(bitwise_cast&lt;void*&gt;(state.generatedFunction)));
+
+        state.jitCode-&gt;initializeAddressForCall(linkBuffer-&gt;locationOf(start));
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -51,6 +51,10 @@
</span><span class="cx"> 
</span><span class="cx"> static int compileCounter;
</span><span class="cx"> 
</span><ins>+// FIXME: Get rid of this and introduce a real stack check.
+// https://bugs.webkit.org/show_bug.cgi?id=125650
+static uintptr_t stackLimit;
+
</ins><span class="cx"> // Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
</span><span class="cx"> // significantly less dead code.
</span><span class="cx"> #define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \
</span><span class="lines">@@ -92,19 +96,14 @@
</span><span class="cx">             llvm-&gt;ModuleCreateWithNameInContext(name.data(), m_ftlState.context);
</span><span class="cx">         
</span><span class="cx">         m_ftlState.function = addFunction(
</span><del>-            m_ftlState.module, name.data(), functionType(m_out.int64, m_out.intPtr));
</del><ins>+            m_ftlState.module, name.data(), functionType(m_out.int64));
</ins><span class="cx">         setFunctionCallingConv(m_ftlState.function, LLVMCCallConv);
</span><span class="cx">         
</span><span class="cx">         m_out.initialize(m_ftlState.module, m_ftlState.function, m_heaps);
</span><span class="cx">         
</span><del>-        m_prologue = appendBasicBlock(m_ftlState.context, m_ftlState.function);
-        m_out.appendTo(m_prologue);
-        createPhiVariables();
-        
-        m_callFrame = m_out.param(0);
-        m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
-        m_tagMask = m_out.constInt64(TagMask);
-        
</del><ins>+        m_prologue = FTL_NEW_BLOCK(m_out, (&quot;Prologue&quot;));
+        LBasicBlock stackOverflow = FTL_NEW_BLOCK(m_out, (&quot;Stack overflow&quot;));
+
</ins><span class="cx">         for (BlockIndex blockIndex = 0; blockIndex &lt; m_graph.numBlocks(); ++blockIndex) {
</span><span class="cx">             m_highBlock = m_graph.block(blockIndex);
</span><span class="cx">             if (!m_highBlock)
</span><span class="lines">@@ -112,9 +111,35 @@
</span><span class="cx">             m_blocks.add(m_highBlock, FTL_NEW_BLOCK(m_out, (&quot;Block &quot;, *m_highBlock)));
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        m_out.appendTo(m_prologue);
-        m_out.jump(lowBlock(m_graph.block(0)));
</del><ins>+        m_out.appendTo(m_prologue, stackOverflow);
+        createPhiVariables();
+        LValue capturedAlloca = m_out.alloca(arrayType(m_out.int64, m_graph.m_nextMachineLocal));
+        m_captured = m_out.add(
+            m_out.ptrToInt(capturedAlloca, m_out.intPtr),
+            m_out.constIntPtr(m_graph.m_nextMachineLocal * sizeof(Register)));;
</ins><span class="cx">         
</span><ins>+        // We should not create any alloca's after this point, since they will cease to
+        // be mem2reg candidates.
+        
+        m_ftlState.capturedStackmapID = m_stackmapIDs++;
+        m_out.call(
+            m_out.stackmapIntrinsic(), m_out.constInt32(m_ftlState.capturedStackmapID),
+            m_out.int32Zero, capturedAlloca);
+        
+        m_callFrame = m_out.ptrToInt(
+            m_out.call(m_out.frameAddressIntrinsic(), m_out.int32Zero), m_out.intPtr);
+        m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
+        m_tagMask = m_out.constInt64(TagMask);
+        
+        m_out.storePtr(m_out.constIntPtr(codeBlock()), addressFor(JSStack::CodeBlock));
+        m_out.branch(
+            m_out.below(m_callFrame, m_out.loadPtr(m_out.absolute(&amp;stackLimit))),
+            stackOverflow, lowBlock(m_graph.block(0)));
+        
+        m_out.appendTo(stackOverflow, lowBlock(m_graph.block(0)));
+        // FIXME: Handle exceptions. https://bugs.webkit.org/show_bug.cgi?id=113622
+        m_out.crash();
+        
</ins><span class="cx">         Vector&lt;BasicBlock*&gt; depthFirst;
</span><span class="cx">         m_graph.getBlocksInDepthFirstOrder(depthFirst);
</span><span class="cx">         for (unsigned i = 0; i &lt; depthFirst.size(); ++i)
</span><span class="lines">@@ -1270,7 +1295,7 @@
</span><span class="cx">         LValue call = m_out.call(
</span><span class="cx">             m_out.patchpointInt64Intrinsic(),
</span><span class="cx">             m_out.constInt32(stackmapID), m_out.constInt32(sizeOfGetById()),
</span><del>-            constNull(m_out.ref8), m_out.constInt32(2), m_callFrame, base);
</del><ins>+            constNull(m_out.ref8), m_out.constInt32(1), base);
</ins><span class="cx">         setInstructionCallingConvention(call, LLVMAnyRegCallConv);
</span><span class="cx">         setJSValue(call);
</span><span class="cx">         
</span><span class="lines">@@ -1295,7 +1320,7 @@
</span><span class="cx">         LValue call = m_out.call(
</span><span class="cx">             m_out.patchpointVoidIntrinsic(),
</span><span class="cx">             m_out.constInt32(stackmapID), m_out.constInt32(sizeOfPutById()),
</span><del>-            constNull(m_out.ref8), m_out.constInt32(3), m_callFrame, base, value);
</del><ins>+            constNull(m_out.ref8), m_out.constInt32(2), base, value);
</ins><span class="cx">         setInstructionCallingConvention(call, LLVMAnyRegCallConv);
</span><span class="cx">         
</span><span class="cx">         m_ftlState.putByIds.append(PutByIdDescriptor(
</span><span class="lines">@@ -4003,7 +4028,6 @@
</span><span class="cx">         OSRExit&amp; exit, ExitArgumentList&amp; arguments, FormattedValue lowValue,
</span><span class="cx">         CodeOrigin codeOrigin)
</span><span class="cx">     {
</span><del>-        arguments.append(m_callFrame);
</del><span class="cx">         if (!!lowValue)
</span><span class="cx">             arguments.append(lowValue.value());
</span><span class="cx">         
</span><span class="lines">@@ -4260,35 +4284,37 @@
</span><span class="cx">     }
</span><span class="cx">     TypedPointer payloadFor(LValue base, int operand)
</span><span class="cx">     {
</span><del>-        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
</del><ins>+        return addressFor(base, operand, PayloadOffset);
</ins><span class="cx">     }
</span><span class="cx">     TypedPointer tagFor(LValue base, int operand)
</span><span class="cx">     {
</span><del>-        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
</del><ins>+        return addressFor(base, operand, TagOffset);
</ins><span class="cx">     }
</span><del>-    TypedPointer addressFor(int operand)
</del><ins>+    TypedPointer addressFor(int operand, ptrdiff_t offset = 0)
</ins><span class="cx">     {
</span><del>-        return addressFor(m_callFrame, operand);
</del><ins>+        return addressFor(VirtualRegister(operand), offset);
</ins><span class="cx">     }
</span><del>-    TypedPointer addressFor(VirtualRegister operand)
</del><ins>+    TypedPointer addressFor(VirtualRegister operand, ptrdiff_t offset = 0)
</ins><span class="cx">     {
</span><del>-        return addressFor(m_callFrame, operand.offset());
</del><ins>+        if (operand.isLocal())
+            return addressFor(m_captured, operand.offset(), offset);
+        return addressFor(m_callFrame, operand.offset(), offset);
</ins><span class="cx">     }
</span><span class="cx">     TypedPointer payloadFor(int operand)
</span><span class="cx">     {
</span><del>-        return payloadFor(m_callFrame, operand);
</del><ins>+        return payloadFor(VirtualRegister(operand));
</ins><span class="cx">     }
</span><span class="cx">     TypedPointer payloadFor(VirtualRegister operand)
</span><span class="cx">     {
</span><del>-        return payloadFor(m_callFrame, operand.offset());
</del><ins>+        return addressFor(operand, PayloadOffset);
</ins><span class="cx">     }
</span><span class="cx">     TypedPointer tagFor(int operand)
</span><span class="cx">     {
</span><del>-        return tagFor(m_callFrame, operand);
</del><ins>+        return tagFor(VirtualRegister(operand));
</ins><span class="cx">     }
</span><span class="cx">     TypedPointer tagFor(VirtualRegister operand)
</span><span class="cx">     {
</span><del>-        return tagFor(m_callFrame, operand.offset());
</del><ins>+        return addressFor(operand, TagOffset);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     VM&amp; vm() { return m_graph.m_vm; }
</span><span class="lines">@@ -4303,6 +4329,7 @@
</span><span class="cx">     HashMap&lt;BasicBlock*, LBasicBlock&gt; m_blocks;
</span><span class="cx">     
</span><span class="cx">     LValue m_callFrame;
</span><ins>+    LValue m_captured;
</ins><span class="cx">     LValue m_tagTypeNumber;
</span><span class="cx">     LValue m_tagMask;
</span><span class="cx">     
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLOSRExitCompilercpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -79,13 +79,12 @@
</span><span class="cx">     
</span><span class="cx">     // Get the call frame and tag thingies.
</span><span class="cx">     // Restore the exiting function's callFrame value into a regT4
</span><del>-    record-&gt;locations[0].restoreInto(jit, jitCode-&gt;stackmaps, registerScratch, GPRInfo::regT4);
</del><span class="cx">     jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
</span><span class="cx">     jit.move(MacroAssembler::TrustedImm64(TagMask), GPRInfo::tagMaskRegister);
</span><span class="cx">     
</span><span class="cx">     // Do some value profiling.
</span><span class="cx">     if (exit.m_profileValueFormat != InvalidValueFormat) {
</span><del>-        record-&gt;locations[1].restoreInto(jit, jitCode-&gt;stackmaps, registerScratch, GPRInfo::regT0);
</del><ins>+        record-&gt;locations[0].restoreInto(jit, jitCode-&gt;stackmaps, registerScratch, GPRInfo::regT0);
</ins><span class="cx">         reboxAccordingToFormat(
</span><span class="cx">             exit.m_profileValueFormat, jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
</span><span class="cx">         
</span><span class="lines">@@ -129,7 +128,7 @@
</span><span class="cx">         case ExitValueInJSStackAsInt32:
</span><span class="cx">         case ExitValueInJSStackAsInt52:
</span><span class="cx">         case ExitValueInJSStackAsDouble:
</span><del>-            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister(), GPRInfo::regT4), GPRInfo::regT0);
</del><ins>+            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
</ins><span class="cx">             break;
</span><span class="cx">             
</span><span class="cx">         default:
</span><span class="lines">@@ -149,19 +148,9 @@
</span><span class="cx">         jit.load64(scratch + index, GPRInfo::regT0);
</span><span class="cx">         reboxAccordingToFormat(
</span><span class="cx">             value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
</span><del>-        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast&lt;VirtualRegister&gt;(operand), GPRInfo::regT4));
</del><ins>+        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast&lt;VirtualRegister&gt;(operand)));
</ins><span class="cx">     }
</span><span class="cx">     
</span><del>-    // Restore the old stack pointer and then put regT4 into callFrameRegister. The idea is
-    // that the FTL call frame is pushed onto the JS call frame and we can recover the old
-    // value of the stack pointer by popping the FTL call frame. We already know what the
-    // frame pointer in the JS call frame was because it would have been passed as an argument
-    // to the FTL call frame.
-    jit.move(MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
-    jit.pop(GPRInfo::nonArgGPR0);
-    jit.pop(GPRInfo::nonArgGPR0);
-    jit.move(GPRInfo::regT4, GPRInfo::callFrameRegister);
-    
</del><span class="cx">     handleExitCounts(jit, exit);
</span><span class="cx">     reifyInlinedCallFrames(jit, exit);
</span><span class="cx">     adjustAndJumpToTarget(jit, exit);
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLOutputh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLOutput.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLOutput.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLOutput.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -210,6 +210,7 @@
</span><span class="cx">     LValue castToInt32(LValue value) { return intCast(value, int32); }
</span><span class="cx">     LValue fpCast(LValue value, LType type) { return buildFPCast(m_builder, value, type); }
</span><span class="cx">     LValue intToPtr(LValue value, LType type) { return buildIntToPtr(m_builder, value, type); }
</span><ins>+    LValue ptrToInt(LValue value, LType type) { return buildPtrToInt(m_builder, value, type); }
</ins><span class="cx">     LValue bitCast(LValue value, LType type) { return buildBitCast(m_builder, value, type); }
</span><span class="cx">     
</span><span class="cx">     LValue alloca(LType type) { return buildAlloca(m_builder, type); }
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLSlowPathCallcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -158,13 +158,13 @@
</span><span class="cx"> } // anonymous namespace
</span><span class="cx"> 
</span><span class="cx"> MacroAssembler::Call callOperation(
</span><del>-    State&amp; state, const RegisterSet&amp; usedRegisters, CCallHelpers&amp; jit, 
-    J_JITOperation_ESsiJI operation, GPRReg result, GPRReg callFrameRegister,
-    StructureStubInfo* stubInfo, GPRReg object, StringImpl* uid)
</del><ins>+    State&amp; state, const RegisterSet&amp; usedRegisters, CCallHelpers&amp; jit,
+    J_JITOperation_ESsiJI operation, GPRReg result, StructureStubInfo* stubInfo, GPRReg object,
+    StringImpl* uid)
</ins><span class="cx"> {
</span><span class="cx">     CallContext context(state, usedRegisters, jit, 4, result);
</span><del>-    jit.setupArguments(
-        callFrameRegister, CCallHelpers::TrustedImmPtr(stubInfo), object,
</del><ins>+    jit.setupArgumentsWithExecState(
+        CCallHelpers::TrustedImmPtr(stubInfo), object,
</ins><span class="cx">         CCallHelpers::TrustedImmPtr(uid));
</span><span class="cx">     return context.makeCall(bitwise_cast&lt;void*&gt;(operation));
</span><span class="cx">     // FIXME: FTL should support exceptions.
</span><span class="lines">@@ -173,12 +173,12 @@
</span><span class="cx"> 
</span><span class="cx"> MacroAssembler::Call callOperation(
</span><span class="cx">     State&amp; state, const RegisterSet&amp; usedRegisters, CCallHelpers&amp; jit, 
</span><del>-    V_JITOperation_ESsiJJI operation, GPRReg callFrameRegister,
-    StructureStubInfo* stubInfo, GPRReg value, GPRReg object, StringImpl* uid)
</del><ins>+    V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, GPRReg value, GPRReg object,
+    StringImpl* uid)
</ins><span class="cx"> {
</span><span class="cx">     CallContext context(state, usedRegisters, jit, 5, InvalidGPRReg);
</span><del>-    jit.setupArguments(
-        callFrameRegister, CCallHelpers::TrustedImmPtr(stubInfo), value, object,
</del><ins>+    jit.setupArgumentsWithExecState(
+        CCallHelpers::TrustedImmPtr(stubInfo), value, object,
</ins><span class="cx">         CCallHelpers::TrustedImmPtr(uid));
</span><span class="cx">     return context.makeCall(bitwise_cast&lt;void*&gt;(operation));
</span><span class="cx">     // FIXME: FTL should support exceptions.
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLSlowPathCallh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLSlowPathCall.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -57,12 +57,10 @@
</span><span class="cx"> 
</span><span class="cx"> MacroAssembler::Call callOperation(
</span><span class="cx">     State&amp;, const RegisterSet&amp;, CCallHelpers&amp;, J_JITOperation_ESsiJI,
</span><del>-    GPRReg result, GPRReg callFrameRegister, StructureStubInfo*, GPRReg object,
-    StringImpl* uid);
</del><ins>+    GPRReg result, StructureStubInfo*, GPRReg object, StringImpl* uid);
</ins><span class="cx"> MacroAssembler::Call callOperation(
</span><span class="cx">     State&amp;, const RegisterSet&amp;, CCallHelpers&amp;, V_JITOperation_ESsiJJI,
</span><del>-    GPRReg callFrameRegister, StructureStubInfo*, GPRReg value, GPRReg object,
-    StringImpl* uid);
</del><ins>+    StructureStubInfo*, GPRReg value, GPRReg object, StringImpl* uid);
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::FTL
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLStateh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLState.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLState.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLState.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -57,6 +57,7 @@
</span><span class="cx">     RefPtr&lt;JITCode&gt; jitCode;
</span><span class="cx">     GeneratedFunction generatedFunction;
</span><span class="cx">     JITFinalizer* finalizer;
</span><ins>+    unsigned capturedStackmapID;
</ins><span class="cx">     SegmentedVector&lt;GetByIdDescriptor&gt; getByIds;
</span><span class="cx">     SegmentedVector&lt;PutByIdDescriptor&gt; putByIds;
</span><span class="cx">     Vector&lt;CString&gt; codeSectionNames;
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLThunkscpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -39,9 +39,9 @@
</span><span class="cx"> 
</span><span class="cx"> using namespace DFG;
</span><span class="cx"> 
</span><del>-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM&amp; vm, const Location&amp; location)
</del><ins>+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
</ins><span class="cx"> {
</span><del>-    AssemblyHelpers jit(&amp;vm, 0);
</del><ins>+    AssemblyHelpers jit(vm, 0);
</ins><span class="cx">     
</span><span class="cx">     // Note that the &quot;return address&quot; will be the OSR exit ID.
</span><span class="cx">     
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">     jit.push(GPRInfo::regT0);
</span><span class="cx">     jit.push(GPRInfo::regT0);
</span><span class="cx">     
</span><del>-    ScratchBuffer* scratchBuffer = vm.scratchBufferForSize(requiredScratchMemorySizeInBytes());
</del><ins>+    ScratchBuffer* scratchBuffer = vm-&gt;scratchBufferForSize(requiredScratchMemorySizeInBytes());
</ins><span class="cx">     char* buffer = static_cast&lt;char*&gt;(scratchBuffer-&gt;dataBuffer());
</span><span class="cx">     
</span><span class="cx">     saveAllRegisters(jit, buffer);
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx">     jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer-&gt;activeLengthPtr()), GPRInfo::nonArgGPR1);
</span><span class="cx">     jit.storePtr(MacroAssembler::TrustedImmPtr(requiredScratchMemorySizeInBytes()), GPRInfo::nonArgGPR1);
</span><span class="cx"> 
</span><del>-    location.restoreInto(jit, buffer, GPRInfo::argumentGPR0, 1);
</del><ins>+    jit.loadPtr(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
</ins><span class="cx">     jit.peek(GPRInfo::argumentGPR1, 3);
</span><span class="cx">     MacroAssembler::Call functionCall = jit.call();
</span><span class="cx">     
</span><span class="lines">@@ -88,9 +88,9 @@
</span><span class="cx"> 
</span><span class="cx">     jit.ret();
</span><span class="cx">     
</span><del>-    LinkBuffer patchBuffer(vm, &amp;jit, GLOBAL_THUNK_ID);
</del><ins>+    LinkBuffer patchBuffer(*vm, &amp;jit, GLOBAL_THUNK_ID);
</ins><span class="cx">     patchBuffer.link(functionCall, compileFTLOSRExit);
</span><del>-    return FINALIZE_CODE(patchBuffer, (&quot;FTL OSR exit generation thunk for callFrame at %s&quot;, toCString(location).data()));
</del><ins>+    return FINALIZE_CODE(patchBuffer, (&quot;FTL OSR exit generation thunk&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> MacroAssemblerCodeRef slowPathCallThunkGenerator(VM&amp; vm, const SlowPathCallKey&amp; key)
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreftlFTLThunksh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/ftl/FTLThunks.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace FTL {
</span><span class="cx"> 
</span><del>-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM&amp;, const Location&amp;);
</del><ins>+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM*);
</ins><span class="cx"> MacroAssemblerCodeRef slowPathCallThunkGenerator(VM&amp;, const SlowPathCallKey&amp;);
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename KeyTypeArgument&gt;
</span><span class="lines">@@ -78,12 +78,6 @@
</span><span class="cx"> 
</span><span class="cx"> class Thunks {
</span><span class="cx"> public:
</span><del>-    MacroAssemblerCodeRef getOSRExitGenerationThunk(VM&amp; vm, const Location&amp; location)
-    {
-        return generateIfNecessary(
-            vm, m_osrExitThunks, location, osrExitGenerationThunkGenerator);
-    }
-    
</del><span class="cx">     MacroAssemblerCodeRef getSlowPathCallThunk(VM&amp; vm, const SlowPathCallKey&amp; key)
</span><span class="cx">     {
</span><span class="cx">         return generateIfNecessary(
</span><span class="lines">@@ -96,7 +90,6 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx"> private:
</span><del>-    ThunkMap&lt;Location&gt; m_osrExitThunks;
</del><span class="cx">     ThunkMap&lt;SlowPathCallKey&gt; m_slowPathCallThunks;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/heap/Heap.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/heap/Heap.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/heap/Heap.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -875,10 +875,10 @@
</span><span class="cx"> 
</span><span class="cx"> bool Heap::collectIfNecessaryOrDefer()
</span><span class="cx"> {
</span><del>-    if (m_deferralDepth)
</del><ins>+    if (isDeferred())
</ins><span class="cx">         return false;
</span><span class="cx">     
</span><del>-    if (!shouldCollect())
</del><ins>+    if (Options::disableGC())
</ins><span class="cx">         return false;
</span><span class="cx">     
</span><span class="cx">     collect(DoNotSweep);
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/heap/Heap.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/heap/Heap.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/heap/Heap.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx">         
</span><span class="cx">         void addReference(JSCell*, ArrayBuffer*);
</span><span class="cx">         
</span><del>-        bool isDeferred() const { return !!m_deferralDepth; }
</del><ins>+        bool isDeferred() const { return !!m_deferralDepth || Options::disableGC(); }
</ins><span class="cx"> 
</span><span class="cx"> #if USE(CF)
</span><span class="cx">         template&lt;typename T&gt; void releaseSoon(RetainPtr&lt;T&gt;&amp;&amp;);
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/jit/AssemblyHelpers.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/jit/AssemblyHelpers.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/jit/AssemblyHelpers.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -216,7 +216,7 @@
</span><span class="cx">     static Address tagFor(VirtualRegister virtualRegister)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(virtualRegister.isValid());
</span><del>-        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
</del><ins>+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + TagOffset);
</ins><span class="cx">     }
</span><span class="cx">     static Address tagFor(int operand)
</span><span class="cx">     {
</span><span class="lines">@@ -226,7 +226,7 @@
</span><span class="cx">     static Address payloadFor(VirtualRegister virtualRegister)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(virtualRegister.isValid());
</span><del>-        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
</del><ins>+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + PayloadOffset);
</ins><span class="cx">     }
</span><span class="cx">     static Address payloadFor(int operand)
</span><span class="cx">     {
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorejitJITInlineCacheGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx"> 
</span><span class="cx"> JITByIdGenerator::JITByIdGenerator(
</span><span class="cx">     CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet&amp; usedRegisters,
</span><del>-    GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value, bool registersFlushed)
</del><ins>+    JSValueRegs base, JSValueRegs value, bool registersFlushed)
</ins><span class="cx">     : JITInlineCacheGenerator(codeBlock, codeOrigin)
</span><span class="cx">     , m_base(base)
</span><span class="cx">     , m_value(value)
</span><span class="lines">@@ -62,7 +62,6 @@
</span><span class="cx">     m_stubInfo-&gt;patch.usedRegisters.set(base);
</span><span class="cx">     m_stubInfo-&gt;patch.usedRegisters.set(value);
</span><span class="cx">     
</span><del>-    m_stubInfo-&gt;patch.callFrameRegister = static_cast&lt;int8_t&gt;(callFrameRegister);
</del><span class="cx">     m_stubInfo-&gt;patch.baseGPR = static_cast&lt;int8_t&gt;(base.payloadGPR());
</span><span class="cx">     m_stubInfo-&gt;patch.valueGPR = static_cast&lt;int8_t&gt;(value.payloadGPR());
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="lines">@@ -130,11 +129,9 @@
</span><span class="cx"> 
</span><span class="cx"> JITPutByIdGenerator::JITPutByIdGenerator(
</span><span class="cx">     CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet&amp; usedRegisters,
</span><del>-    GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value, GPRReg scratch,
-    bool registersFlushed, ECMAMode ecmaMode, PutKind putKind)
-    : JITByIdGenerator(
-        codeBlock, codeOrigin, usedRegisters, callFrameRegister, base, value,
-        registersFlushed)
</del><ins>+    JSValueRegs base, JSValueRegs value, GPRReg scratch, bool registersFlushed,
+    ECMAMode ecmaMode, PutKind putKind)
+    : JITByIdGenerator(codeBlock, codeOrigin, usedRegisters, base, value, registersFlushed)
</ins><span class="cx">     , m_scratch(scratch)
</span><span class="cx">     , m_ecmaMode(ecmaMode)
</span><span class="cx">     , m_putKind(putKind)
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorejitJITInlineCacheGeneratorh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -56,8 +56,8 @@
</span><span class="cx">     JITByIdGenerator() { }
</span><span class="cx"> 
</span><span class="cx">     JITByIdGenerator(
</span><del>-        CodeBlock*, CodeOrigin, const RegisterSet&amp;, GPRReg callFrameRegister,
-        JSValueRegs base, JSValueRegs value, bool registersFlushed);
</del><ins>+        CodeBlock*, CodeOrigin, const RegisterSet&amp;, JSValueRegs base, JSValueRegs value,
+        bool registersFlushed);
</ins><span class="cx">     
</span><span class="cx"> public:
</span><span class="cx">     void reportSlowPathCall(MacroAssembler::Label slowPathBegin, MacroAssembler::Call call)
</span><span class="lines">@@ -96,11 +96,8 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator(
</span><span class="cx">         CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet&amp; usedRegisters,
</span><del>-        GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value,
-        bool registersFlushed)
-        : JITByIdGenerator(
-            codeBlock, codeOrigin, usedRegisters, callFrameRegister, base, value,
-            registersFlushed)
</del><ins>+        JSValueRegs base, JSValueRegs value, bool registersFlushed)
+        : JITByIdGenerator(codeBlock, codeOrigin, usedRegisters, base, value, registersFlushed)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -112,9 +109,8 @@
</span><span class="cx">     JITPutByIdGenerator() { }
</span><span class="cx"> 
</span><span class="cx">     JITPutByIdGenerator(
</span><del>-        CodeBlock*, CodeOrigin, const RegisterSet&amp; usedRegisters, GPRReg callFrameRegister,
-        JSValueRegs base, JSValueRegs value, GPRReg scratch, bool registersFlushed,
-        ECMAMode, PutKind);
</del><ins>+        CodeBlock*, CodeOrigin, const RegisterSet&amp; usedRegisters, JSValueRegs base,
+        JSValueRegs value, GPRReg scratch, bool registersFlushed, ECMAMode, PutKind);
</ins><span class="cx">     
</span><span class="cx">     void generateFastPath(MacroAssembler&amp;);
</span><span class="cx">     
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -519,7 +519,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
</span><del>-        callFrameRegister, JSValueRegs(regT0), JSValueRegs(regT0), true);
</del><ins>+        JSValueRegs(regT0), JSValueRegs(regT0), true);
</ins><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx">     addSlowCase(gen.slowPathJump());
</span><span class="cx">     m_getByIds.append(gen);
</span><span class="lines">@@ -565,8 +565,8 @@
</span><span class="cx"> 
</span><span class="cx">     JITPutByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
</span><del>-        callFrameRegister, JSValueRegs(regT0), JSValueRegs(regT1), regT2, true,
-        m_codeBlock-&gt;ecmaMode(), direct ? Direct : NotDirect);
</del><ins>+        JSValueRegs(regT0), JSValueRegs(regT1), regT2, true, m_codeBlock-&gt;ecmaMode(),
+        direct ? Direct : NotDirect);
</ins><span class="cx">     
</span><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx">     addSlowCase(gen.slowPathJump());
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCorejitRepatchcpp"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/jit/Repatch.cpp (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/jit/Repatch.cpp        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/jit/Repatch.cpp        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -47,11 +47,6 @@
</span><span class="cx"> // that would ordinarily have well-known values:
</span><span class="cx"> // - tagTypeNumberRegister
</span><span class="cx"> // - tagMaskRegister
</span><del>-// - callFrameRegister **
-//
-// We currently only use the callFrameRegister for closure call patching, and we're not going to
-// give the FTL closure call patching support until we switch to the C stack - but when we do that,
-// callFrameRegister will disappear.
</del><span class="cx"> 
</span><span class="cx"> static FunctionPtr readCallTarget(RepatchBuffer&amp; repatchBuffer, CodeLocationCall call)
</span><span class="cx"> {
</span><span class="lines">@@ -495,7 +490,6 @@
</span><span class="cx">         
</span><span class="cx">         stubInfo.u.getByIdSelfList.listSize++;
</span><span class="cx">         
</span><del>-        GPRReg callFrameRegister = static_cast&lt;GPRReg&gt;(stubInfo.patch.callFrameRegister);
</del><span class="cx">         GPRReg baseGPR = static_cast&lt;GPRReg&gt;(stubInfo.patch.baseGPR);
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">         GPRReg resultTagGPR = static_cast&lt;GPRReg&gt;(stubInfo.patch.valueTagGPR);
</span><span class="lines">@@ -519,6 +513,10 @@
</span><span class="cx">         MacroAssembler::Jump success;
</span><span class="cx">         
</span><span class="cx">         if (slot.isCacheableGetter() || slot.isCacheableCustom()) {
</span><ins>+            // FIXME: This code shouldn't be assuming that the top of stack is set up for JSC
+            // JIT-style C calls, since we may be currently on top of an FTL frame.
+            // https://bugs.webkit.org/show_bug.cgi?id=125711
+            
</ins><span class="cx">             if (slot.isCacheableGetter()) {
</span><span class="cx">                 ASSERT(scratchGPR != InvalidGPRReg);
</span><span class="cx">                 ASSERT(baseGPR != scratchGPR);
</span><span class="lines">@@ -536,11 +534,11 @@
</span><span class="cx">                     stubJit.load32(MacroAssembler::Address(scratchGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
</span><span class="cx"> #endif
</span><span class="cx">                 }
</span><del>-                stubJit.setupArguments(callFrameRegister, baseGPR, scratchGPR);
</del><ins>+                stubJit.setupArgumentsWithExecState(baseGPR, scratchGPR);
</ins><span class="cx">                 operationFunction = operationCallGetter;
</span><span class="cx">             } else {
</span><del>-                stubJit.setupArguments(
-                    callFrameRegister, baseGPR,
</del><ins>+                stubJit.setupArgumentsWithExecState(
+                    baseGPR,
</ins><span class="cx">                     MacroAssembler::TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()),
</span><span class="cx">                     MacroAssembler::TrustedImmPtr(ident.impl()));
</span><span class="cx">                 operationFunction = operationCallCustomGetter;
</span><span class="lines">@@ -793,7 +791,6 @@
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx"> 
</span><del>-    GPRReg callFrameRegister = static_cast&lt;GPRReg&gt;(stubInfo.patch.callFrameRegister);
</del><span class="cx">     GPRReg baseGPR = static_cast&lt;GPRReg&gt;(stubInfo.patch.baseGPR);
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     GPRReg valueTagGPR = static_cast&lt;GPRReg&gt;(stubInfo.patch.valueTagGPR);
</span><span class="lines">@@ -950,9 +947,9 @@
</span><span class="cx">         ScratchBuffer* scratchBuffer = vm-&gt;scratchBufferForSize(allocator.desiredScratchBufferSize());
</span><span class="cx">         allocator.preserveUsedRegistersToScratchBuffer(stubJit, scratchBuffer, scratchGPR1);
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>-        stubJit.setupArguments(callFrameRegister, baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR);
</del><ins>+        stubJit.setupArgumentsWithExecState(baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR);
</ins><span class="cx"> #else
</span><del>-        stubJit.setupArguments(callFrameRegister, baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR, valueTagGPR);
</del><ins>+        stubJit.setupArgumentsWithExecState(baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR, valueTagGPR);
</ins><span class="cx"> #endif
</span><span class="cx">         operationCall = stubJit.call();
</span><span class="cx">         allocator.restoreUsedRegistersFromScratchBuffer(stubJit, scratchBuffer, scratchGPR1);
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreruntimeJSCJSValueh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/runtime/JSCJSValue.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/runtime/JSCJSValue.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/runtime/JSCJSValue.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -97,6 +97,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> };
</span><span class="cx"> 
</span><ins>+#define TagOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag))
+#define PayloadOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload))
+
</ins><span class="cx"> enum WhichValueWord {
</span><span class="cx">     TagWord,
</span><span class="cx">     PayloadWord
</span></span></pre></div>
<a id="branchesjsCStackSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: branches/jsCStack/Source/JavaScriptCore/runtime/Options.h (160599 => 160600)</h4>
<pre class="diff"><span>
<span class="info">--- branches/jsCStack/Source/JavaScriptCore/runtime/Options.h        2013-12-14 18:58:48 UTC (rev 160599)
+++ branches/jsCStack/Source/JavaScriptCore/runtime/Options.h        2013-12-14 21:38:01 UTC (rev 160600)
</span><span class="lines">@@ -208,6 +208,7 @@
</span><span class="cx">     v(bool, showObjectStatistics, false) \
</span><span class="cx">     \
</span><span class="cx">     v(bool, logGC, false) \
</span><ins>+    v(bool, disableGC, false) \
</ins><span class="cx">     v(unsigned, gcMaxHeapSize, 0) \
</span><span class="cx">     v(bool, recordGCPauseTimes, false) \
</span><span class="cx">     v(bool, logHeapStatisticsAtExit, false)
</span></span></pre>
</div>
</div>

</body>
</html>