<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[164459] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/164459">164459</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-02-20 17:20:48 -0800 (Thu, 20 Feb 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>DFG should do its own static estimates of execution frequency before it starts creating OSR entrypoints
https://bugs.webkit.org/show_bug.cgi?id=129129

Reviewed by Geoffrey Garen.
        
We estimate execution counts based on loop depth, and then use those to estimate branch
weights. These weights then get carried all the way down to LLVM prof branch_weights
meta-data.
        
This is better than letting LLVM do its own static estimates, since by the time we
generate LLVM IR, we may have messed up the CFG due to OSR entrypoint creation. Of
course, it would be even better if we just slurped in some kind of execution counts
from profiling, but we don't do that, yet.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGBasicBlock.cpp:
(JSC::DFG::BasicBlock::BasicBlock):
* dfg/DFGBasicBlock.h:
* dfg/DFGBlockInsertionSet.cpp:
(JSC::DFG::BlockInsertionSet::insert):
(JSC::DFG::BlockInsertionSet::insertBefore):
* dfg/DFGBlockInsertionSet.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseCodeBlock):
* dfg/DFGCriticalEdgeBreakingPhase.cpp:
(JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
* dfg/DFGLoopPreHeaderCreationPhase.cpp:
(JSC::DFG::createPreHeader):
* dfg/DFGNaturalLoops.h:
(JSC::DFG::NaturalLoops::loopDepth):
* dfg/DFGOSREntrypointCreationPhase.cpp:
(JSC::DFG::OSREntrypointCreationPhase::run):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGStaticExecutionCountEstimationPhase.cpp: Added.
(JSC::DFG::StaticExecutionCountEstimationPhase::StaticExecutionCountEstimationPhase):
(JSC::DFG::StaticExecutionCountEstimationPhase::run):
(JSC::DFG::StaticExecutionCountEstimationPhase::applyCounts):
(JSC::DFG::performStaticExecutionCountEstimation):
* dfg/DFGStaticExecutionCountEstimationPhase.h: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreGNUmakefilelistam">trunk/Source/JavaScriptCore/GNUmakefile.list.am</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockcpp">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockh">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBlockInsertionSetcpp">trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBlockInsertionSeth">trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCriticalEdgeBreakingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLoopPreHeaderCreationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGLoopPreHeaderCreationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNaturalLoopsh">trunk/Source/JavaScriptCore/dfg/DFGNaturalLoops.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSREntrypointCreationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStaticExecutionCountEstimationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStaticExecutionCountEstimationPhaseh">trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -184,6 +184,7 @@
</span><span class="cx">     dfg/DFGSpeculativeJIT32_64.cpp
</span><span class="cx">     dfg/DFGSpeculativeJIT64.cpp
</span><span class="cx">     dfg/DFGStackLayoutPhase.cpp
</span><ins>+    dfg/DFGStaticExecutionCountEstimationPhase.cpp
</ins><span class="cx">     dfg/DFGStoreBarrierElisionPhase.cpp
</span><span class="cx">     dfg/DFGStrengthReductionPhase.cpp
</span><span class="cx">     dfg/DFGThreadData.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1,5 +1,52 @@
</span><span class="cx"> 2014-02-20  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        DFG should do its own static estimates of execution frequency before it starts creating OSR entrypoints
+        https://bugs.webkit.org/show_bug.cgi?id=129129
+
+        Reviewed by Geoffrey Garen.
+        
+        We estimate execution counts based on loop depth, and then use those to estimate branch
+        weights. These weights then get carried all the way down to LLVM prof branch_weights
+        meta-data.
+        
+        This is better than letting LLVM do its own static estimates, since by the time we
+        generate LLVM IR, we may have messed up the CFG due to OSR entrypoint creation. Of
+        course, it would be even better if we just slurped in some kind of execution counts
+        from profiling, but we don't do that, yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::insert):
+        (JSC::DFG::BlockInsertionSet::insertBefore):
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        * dfg/DFGNaturalLoops.h:
+        (JSC::DFG::NaturalLoops::loopDepth):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStaticExecutionCountEstimationPhase.cpp: Added.
+        (JSC::DFG::StaticExecutionCountEstimationPhase::StaticExecutionCountEstimationPhase):
+        (JSC::DFG::StaticExecutionCountEstimationPhase::run):
+        (JSC::DFG::StaticExecutionCountEstimationPhase::applyCounts):
+        (JSC::DFG::performStaticExecutionCountEstimation):
+        * dfg/DFGStaticExecutionCountEstimationPhase.h: Added.
+
+2014-02-20  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         FTL may not see a compact_unwind section if there weren't any stackmaps
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=129125
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreGNUmakefilelistam"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/GNUmakefile.list.am (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/GNUmakefile.list.am        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/GNUmakefile.list.am        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -410,6 +410,8 @@
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGSSALoweringPhase.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGStackLayoutPhase.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGStackLayoutPhase.h \
</span><ins>+        Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.cpp \
+        Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.h \
</ins><span class="cx">         Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -436,6 +436,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGSSAConversionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGSSALoweringPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStackLayoutPhase.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\dfg\DFGStaticExecutionCountEstimationPhase.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStoreBarrierElisionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStrengthReductionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGThreadData.cpp&quot; /&gt;
</span><span class="lines">@@ -997,6 +998,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGSSAConversionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGSSALoweringPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStackLayoutPhase.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\dfg\DFGStaticExecutionCountEstimationPhase.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStoreBarrierElisionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStrengthReductionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStructureAbstractValue.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -261,6 +261,8 @@
</span><span class="cx">                 0F48532A187DFDEC0083B687 /* FTLRecoveryOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F485326187DFDEC0083B687 /* FTLRecoveryOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F493AF816D0CAD10084508B /* SourceProvider.cpp */; };
</span><span class="cx">                 0F4B94DC17B9F07500DD03A4 /* TypedArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4B94DB17B9F07500DD03A4 /* TypedArrayInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */; };
+                0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */; };
</span><span class="cx">                 0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F55989817C86C5800A1E543 /* ToNativeFromValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -1735,6 +1737,8 @@
</span><span class="cx">                 0F485326187DFDEC0083B687 /* FTLRecoveryOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLRecoveryOpcode.h; path = ftl/FTLRecoveryOpcode.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F493AF816D0CAD10084508B /* SourceProvider.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceProvider.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F4B94DB17B9F07500DD03A4 /* TypedArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayInlines.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpecialPointer.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecialPointer.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ToNativeFromValue.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4174,6 +4178,8 @@
</span><span class="cx">                 86EC9DB31328DF44002B2AD7 /* dfg */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><ins>+                                0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */,
+                                0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */,
</ins><span class="cx">                                 A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */,
</span><span class="cx">                                 A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */,
</span><span class="cx">                                 A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */,
</span><span class="lines">@@ -5158,6 +5164,7 @@
</span><span class="cx">                                 0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */,
</span><span class="cx">                                 0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */,
</span><span class="cx">                                 0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
</span><ins>+                                0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */,
</ins><span class="cx">                                 0F24E54417EA9F5900ABB217 /* GPRInfo.h in Headers */,
</span><span class="cx">                                 142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
</span><span class="cx">                                 C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */,
</span><span class="lines">@@ -6082,6 +6089,7 @@
</span><span class="cx">                                 0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
</span><span class="cx">                                 0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */,
</span><span class="cx">                                 0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
</span><ins>+                                0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */,
</ins><span class="cx">                                 A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
</span><span class="cx">                                 0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
</span><span class="cx">                                 FEB58C14187B8B160098EF0B /* ErrorHandlingScope.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,7 +32,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx"> 
</span><del>-BasicBlock::BasicBlock(unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals)
</del><ins>+BasicBlock::BasicBlock(
+    unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals, float executionCount)
</ins><span class="cx">     : bytecodeBegin(bytecodeBegin)
</span><span class="cx">     , index(NoBlock)
</span><span class="cx">     , isOSRTarget(false)
</span><span class="lines">@@ -49,6 +50,7 @@
</span><span class="cx">     , variablesAtTail(numArguments, numLocals)
</span><span class="cx">     , valuesAtHead(numArguments, numLocals)
</span><span class="cx">     , valuesAtTail(numArguments, numLocals)
</span><ins>+    , executionCount(executionCount)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -48,7 +48,9 @@
</span><span class="cx"> typedef Vector&lt;BasicBlock*, 2&gt; PredecessorList;
</span><span class="cx"> 
</span><span class="cx"> struct BasicBlock : RefCounted&lt;BasicBlock&gt; {
</span><del>-    BasicBlock(unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals);
</del><ins>+    BasicBlock(
+        unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals,
+        float executionCount);
</ins><span class="cx">     ~BasicBlock();
</span><span class="cx">     
</span><span class="cx">     void ensureLocals(unsigned newNumLocals);
</span><span class="lines">@@ -134,6 +136,8 @@
</span><span class="cx">     Operands&lt;AbstractValue&gt; valuesAtHead;
</span><span class="cx">     Operands&lt;AbstractValue&gt; valuesAtTail;
</span><span class="cx">     
</span><ins>+    float executionCount;
+    
</ins><span class="cx">     // These fields are reserved for NaturalLoops.
</span><span class="cx">     static const unsigned numberOfInnerMostLoopIndices = 2;
</span><span class="cx">     unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBlockInsertionSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -49,20 +49,21 @@
</span><span class="cx">     insert(BlockInsertion(index, block));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-BasicBlock* BlockInsertionSet::insert(size_t index)
</del><ins>+BasicBlock* BlockInsertionSet::insert(size_t index, float executionCount)
</ins><span class="cx"> {
</span><span class="cx">     RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(
</span><span class="cx">         UINT_MAX,
</span><span class="cx">         m_graph.block(0)-&gt;variablesAtHead.numberOfArguments(),
</span><del>-        m_graph.block(0)-&gt;variablesAtHead.numberOfLocals()));
</del><ins>+        m_graph.block(0)-&gt;variablesAtHead.numberOfLocals(),
+        executionCount));
</ins><span class="cx">     block-&gt;isReachable = true;
</span><span class="cx">     insert(index, block);
</span><span class="cx">     return block.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before)
</del><ins>+BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, float executionCount)
</ins><span class="cx"> {
</span><del>-    return insert(before-&gt;index);
</del><ins>+    return insert(before-&gt;index, executionCount);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool BlockInsertionSet::execute()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBlockInsertionSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -43,8 +43,8 @@
</span><span class="cx">     
</span><span class="cx">     void insert(const BlockInsertion&amp; insertion);
</span><span class="cx">     void insert(size_t index, PassRefPtr&lt;BasicBlock&gt; block);
</span><del>-    BasicBlock* insert(size_t index);
-    BasicBlock* insertBefore(BasicBlock* before);
</del><ins>+    BasicBlock* insert(size_t index, float executionCount);
+    BasicBlock* insertBefore(BasicBlock* before, float executionCount);
</ins><span class="cx">     
</span><span class="cx">     bool execute();
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -1455,7 +1455,7 @@
</span><span class="cx">     
</span><span class="cx"> 
</span><span class="cx">     // Need to create a new basic block for the continuation at the caller.
</span><del>-    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(nextOffset, m_numArguments, m_numLocals));
</del><ins>+    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(nextOffset, m_numArguments, m_numLocals, QNaN));
</ins><span class="cx"> 
</span><span class="cx">     // Link the early returns to the basic block we're about to create.
</span><span class="cx">     for (size_t i = 0; i &lt; inlineStackEntry.m_unlinkedBlocks.size(); ++i) {
</span><span class="lines">@@ -3710,7 +3710,7 @@
</span><span class="cx">                     m_currentBlock = m_graph.lastBlock();
</span><span class="cx">                     m_currentBlock-&gt;bytecodeBegin = m_currentIndex;
</span><span class="cx">                 } else {
</span><del>-                    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals));
</del><ins>+                    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, QNaN));
</ins><span class="cx">                     m_currentBlock = block.get();
</span><span class="cx">                     // This assertion checks two things:
</span><span class="cx">                     // 1) If the bytecodeBegin is greater than currentIndex, then something has gone
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCriticalEdgeBreakingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGCriticalEdgeBreakingPhase.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -73,7 +73,9 @@
</span><span class="cx"> private:
</span><span class="cx">     void breakCriticalEdge(BasicBlock* predecessor, BasicBlock** successor)
</span><span class="cx">     {
</span><del>-        BasicBlock* pad = m_insertionSet.insertBefore(*successor);
</del><ins>+        // Note that we pass NaN for the count of the critical edge block, because we honestly
+        // don't know its execution frequency.
+        BasicBlock* pad = m_insertionSet.insertBefore(*successor, QNaN);
</ins><span class="cx">         pad-&gt;appendNode(
</span><span class="cx">             m_graph, SpecNone, Jump, (*successor)-&gt;at(0)-&gt;origin, OpInfo(*successor));
</span><span class="cx">         pad-&gt;predecessors.append(predecessor);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLoopPreHeaderCreationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLoopPreHeaderCreationPhase.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLoopPreHeaderCreationPhase.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGLoopPreHeaderCreationPhase.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -39,7 +39,8 @@
</span><span class="cx"> 
</span><span class="cx"> BasicBlock* createPreHeader(Graph&amp; graph, BlockInsertionSet&amp; insertionSet, BasicBlock* block)
</span><span class="cx"> {
</span><del>-    BasicBlock* preHeader = insertionSet.insertBefore(block);
</del><ins>+    // Don't bother to preserve execution frequencies for now.
+    BasicBlock* preHeader = insertionSet.insertBefore(block, QNaN);
</ins><span class="cx">     preHeader-&gt;appendNode(
</span><span class="cx">         graph, SpecNone, Jump, block-&gt;at(0)-&gt;origin, OpInfo(block));
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNaturalLoopsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNaturalLoops.h (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNaturalLoops.h        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGNaturalLoops.h        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -154,6 +154,14 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><ins>+    unsigned loopDepth(BasicBlock* block) const
+    {
+        unsigned depth = 0;
+        for (const NaturalLoop* loop = innerMostLoopOf(block); loop; loop = innerMostOuterLoop(*loop))
+            depth++;
+        return depth;
+    }
+    
</ins><span class="cx">     // Return the indices of all loops this belongs to.
</span><span class="cx">     Vector&lt;const NaturalLoop*&gt; loopsOf(BasicBlock*) const;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSREntrypointCreationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSREntrypointCreationPhase.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -83,7 +83,7 @@
</span><span class="cx">         
</span><span class="cx">         BlockInsertionSet insertionSet(m_graph);
</span><span class="cx">         
</span><del>-        BasicBlock* newRoot = insertionSet.insert(0);
</del><ins>+        BasicBlock* newRoot = insertionSet.insert(0, QNaN);
</ins><span class="cx">         NodeOrigin origin = target-&gt;at(0)-&gt;origin;
</span><span class="cx">         
</span><span class="cx">         Vector&lt;Node*&gt; locals(baseline-&gt;m_numCalleeRegisters);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (164458 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-02-21 01:14:35 UTC (rev 164458)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -56,6 +56,7 @@
</span><span class="cx"> #include &quot;DFGSSAConversionPhase.h&quot;
</span><span class="cx"> #include &quot;DFGSSALoweringPhase.h&quot;
</span><span class="cx"> #include &quot;DFGStackLayoutPhase.h&quot;
</span><ins>+#include &quot;DFGStaticExecutionCountEstimationPhase.h&quot;
</ins><span class="cx"> #include &quot;DFGStoreBarrierElisionPhase.h&quot;
</span><span class="cx"> #include &quot;DFGStrengthReductionPhase.h&quot;
</span><span class="cx"> #include &quot;DFGTierUpCheckInjectionPhase.h&quot;
</span><span class="lines">@@ -208,6 +209,9 @@
</span><span class="cx">     performUnification(dfg);
</span><span class="cx">     performPredictionInjection(dfg);
</span><span class="cx">     
</span><ins>+    if (isFTL(mode))
+        performStaticExecutionCountEstimation(dfg);
+    
</ins><span class="cx">     if (mode == FTLForOSREntryMode) {
</span><span class="cx">         bool result = performOSREntrypointCreation(dfg);
</span><span class="cx">         if (!result) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStaticExecutionCountEstimationPhasecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.cpp (0 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.cpp        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -0,0 +1,107 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;DFGStaticExecutionCountEstimationPhase.h&quot;
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGBasicBlockInlines.h&quot;
+#include &quot;DFGGraph.h&quot;
+#include &quot;DFGPhase.h&quot;
+#include &quot;JSCInlines.h&quot;
+
+namespace JSC { namespace DFG {
+
+class StaticExecutionCountEstimationPhase : public Phase {
+public:
+    StaticExecutionCountEstimationPhase(Graph&amp; graph)
+        : Phase(graph, &quot;static execution count estimation&quot;)
+    {
+    }
+    
+    bool run()
+    {
+        m_graph.m_naturalLoops.computeIfNecessary(m_graph);
+        
+        // Estimate basic block execution counts based on loop depth.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+
+            block-&gt;executionCount = pow(10, m_graph.m_naturalLoops.loopDepth(block));
+        }
+        
+        // Estimate branch weights based on execution counts. This isn't quite correct. It'll
+        // assume that each block's conditional successor only has that block as its
+        // predecessor.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            switch (block-&gt;last()-&gt;op()) {
+            case Branch: {
+                BranchData* data = block-&gt;last()-&gt;branchData();
+                applyCounts(data-&gt;taken);
+                applyCounts(data-&gt;notTaken);
+                break;
+            }
+                
+            case Switch: {
+                SwitchData* data = block-&gt;last()-&gt;switchData();
+                for (unsigned i = data-&gt;cases.size(); i--;)
+                    applyCounts(data-&gt;cases[i].target);
+                applyCounts(data-&gt;fallThrough);
+                break;
+            }
+                
+            default:
+                break;
+            }
+        }
+        
+        return true;
+    }
+
+private:
+    void applyCounts(BranchTarget&amp; target)
+    {
+        target.count = target.block-&gt;executionCount;
+    }
+};
+
+bool performStaticExecutionCountEstimation(Graph&amp; graph)
+{
+    SamplingRegion samplingRegion(&quot;DFG Static Execution Count Estimation&quot;);
+    return runPhase&lt;StaticExecutionCountEstimationPhase&gt;(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStaticExecutionCountEstimationPhaseh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.h (0 => 164459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGStaticExecutionCountEstimationPhase.h        2014-02-21 01:20:48 UTC (rev 164459)
</span><span class="lines">@@ -0,0 +1,53 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGStaticExecutionCountEstimationPhase_h
+#define DFGStaticExecutionCountEstimationPhase_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Estimate execution counts (branch execution counts, in particular) based on
+// presently available static information. This phase is important because
+// subsequent CFG transformations, such as OSR entrypoint creation, perturb our
+// ability to do accurate static estimations. Hence we lock in the estimates early.
+// Ideally, we would have dynamic information, but we don't right now, so this is as
+// good as it gets.
+//
+// It's worth noting that if we didn't have this phase, then the static estimation
+// would be perfomed by LLVM instead. It's worth trying to make this phase perform
+// the estimates using the same heuristics that LLVM would use.
+
+bool performStaticExecutionCountEstimation(Graph&amp;);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGStaticExecutionCountEstimationPhase_h
+
</ins></span></pre>
</div>
</div>

</body>
</html>