<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[166135] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/166135">166135</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-03-22 21:34:38 -0700 (Sat, 22 Mar 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Call linking slow paths should be passed a CallLinkInfo* directly so that you can create a call IC without adding it to any CodeBlocks
https://bugs.webkit.org/show_bug.cgi?id=130644

Reviewed by Andreas Kling.
        
This is conceptually a really simple change but it involves the following:
        
- The inline part of the call IC stuffs a pointer to the CallLinkInfo into regT2.
        
- CodeBlock uses a Bag of CallLinkInfos instead of a Vector.
        
- Remove the significance of a CallLinkInfo's index. This means that DFG::JITCode no
  longer has a vector of slow path counts that shadows the CallLinkInfo vector.
        
- Make CallLinkInfo have its own slowPathCount, which counts actual slow path executions
  and not all relinking.
        
This makes planting JS-&gt;JS calls inside other inline caches or stubs a lot easier, since
the CallLinkInfo and the call IC slow paths no longer rely on the call being associated
with a op_call/op_construct instruction and a machine code return PC within such an
instruction.

* bytecode/CallLinkInfo.h:
(JSC::getCallLinkInfoCodeOrigin):
* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::computeFor):
(JSC::CallLinkStatus::computeDFGStatuses):
* bytecode/CallLinkStatus.h:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::printCallOp):
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::getCallLinkInfoMap):
(JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
(JSC::CodeBlock::addCallLinkInfo):
(JSC::CodeBlock::unlinkCalls):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::stubInfoBegin):
(JSC::CodeBlock::stubInfoEnd):
(JSC::CodeBlock::callLinkInfosBegin):
(JSC::CodeBlock::callLinkInfosEnd):
(JSC::CodeBlock::byValInfo):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
* dfg/DFGJITCode.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::link):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::addJSCall):
(JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
* dfg/DFGOSRExitCompilerCommon.cpp:
(JSC::DFG::reifyInlinedCallFrames):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
* ftl/FTLCompile.cpp:
(JSC::FTL::fixFunctionBasedOnStackMaps):
* ftl/FTLInlineCacheSize.cpp:
(JSC::FTL::sizeOfCall):
* ftl/FTLJSCall.cpp:
(JSC::FTL::JSCall::JSCall):
(JSC::FTL::JSCall::emit):
(JSC::FTL::JSCall::link):
* ftl/FTLJSCall.h:
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::privateCompile):
* jit/JIT.h:
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
(JSC::operationLinkFor):
(JSC::operationVirtualFor):
(JSC::operationLinkClosureCallFor):
* jit/Repatch.cpp:
(JSC::linkClosureCall):
* jit/ThunkGenerators.cpp:
(JSC::slowPathFor):
(JSC::virtualForThunkGenerator):
* tests/stress/eval-that-is-not-eval.js: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkInfocpp">trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkInfoh">trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkStatuscpp">trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkStatush">trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITCodeh">trunk/Source/JavaScriptCore/dfg/DFGJITCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITCompilercpp">trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITCompilerh">trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompilerCommoncpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCompilecpp">trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLInlineCacheSizecpp">trunk/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLJSCallcpp">trunk/Source/JavaScriptCore/ftl/FTLJSCall.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLJSCallh">trunk/Source/JavaScriptCore/ftl/FTLJSCall.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITCallcpp">trunk/Source/JavaScriptCore/jit/JITCall.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITCall32_64cpp">trunk/Source/JavaScriptCore/jit/JITCall32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationsh">trunk/Source/JavaScriptCore/jit/JITOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitThunkGeneratorscpp">trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressevalthatisnotevaljs">trunk/Source/JavaScriptCore/tests/stress/eval-that-is-not-eval.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,99 @@
</span><span class="cx"> 2014-03-22  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Call linking slow paths should be passed a CallLinkInfo* directly so that you can create a call IC without adding it to any CodeBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=130644
+
+        Reviewed by Andreas Kling.
+        
+        This is conceptually a really simple change but it involves the following:
+        
+        - The inline part of the call IC stuffs a pointer to the CallLinkInfo into regT2.
+        
+        - CodeBlock uses a Bag of CallLinkInfos instead of a Vector.
+        
+        - Remove the significance of a CallLinkInfo's index. This means that DFG::JITCode no
+          longer has a vector of slow path counts that shadows the CallLinkInfo vector.
+        
+        - Make CallLinkInfo have its own slowPathCount, which counts actual slow path executions
+          and not all relinking.
+        
+        This makes planting JS-&gt;JS calls inside other inline caches or stubs a lot easier, since
+        the CallLinkInfo and the call IC slow paths no longer rely on the call being associated
+        with a op_call/op_construct instruction and a machine code return PC within such an
+        instruction.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::getCallLinkInfoCodeOrigin):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::getCallLinkInfoMap):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        (JSC::CodeBlock::callLinkInfosBegin):
+        (JSC::CodeBlock::callLinkInfosEnd):
+        (JSC::CodeBlock::byValInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCall):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        (JSC::FTL::JSCall::emit):
+        (JSC::FTL::JSCall::link):
+        * ftl/FTLJSCall.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationLinkFor):
+        (JSC::operationVirtualFor):
+        (JSC::operationLinkClosureCallFor):
+        * jit/Repatch.cpp:
+        (JSC::linkClosureCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::slowPathFor):
+        (JSC::virtualForThunkGenerator):
+        * tests/stress/eval-that-is-not-eval.js: Added.
+
+2014-03-22  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         Unreviewed, fix mispelled test name.
</span><span class="cx"> 
</span><span class="cx">         * tests/stress/constand-folding-osr-exit.js: Removed.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkInfocpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx"> #include &quot;DFGThunks.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;RepatchBuffer.h&quot;
</span><ins>+#include &lt;wtf/NeverDestroyed.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -56,6 +57,12 @@
</span><span class="cx">         remove();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+CallLinkInfo&amp; CallLinkInfo::dummy()
+{
+    static NeverDestroyed&lt;CallLinkInfo&gt; dummy;
+    return dummy;
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -58,6 +58,7 @@
</span><span class="cx">         , hasSeenShouldRepatch(false)
</span><span class="cx">         , hasSeenClosure(false)
</span><span class="cx">         , callType(None)
</span><ins>+        , slowPathCount(0)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="lines">@@ -83,6 +84,7 @@
</span><span class="cx">     bool hasSeenClosure : 1;
</span><span class="cx">     unsigned callType : 5; // CallType
</span><span class="cx">     unsigned calleeGPR : 8;
</span><ins>+    unsigned slowPathCount;
</ins><span class="cx">     CodeOrigin codeOrigin;
</span><span class="cx"> 
</span><span class="cx">     bool isLinked() { return stub || callee; }
</span><span class="lines">@@ -97,17 +99,21 @@
</span><span class="cx">     {
</span><span class="cx">         hasSeenShouldRepatch = true;
</span><span class="cx">     }
</span><ins>+    
+    static CallLinkInfo&amp; dummy();
</ins><span class="cx"> };
</span><span class="cx"> 
</span><del>-inline void* getCallLinkInfoReturnLocation(CallLinkInfo* callLinkInfo)
</del><ins>+inline CodeOrigin getCallLinkInfoCodeOrigin(CallLinkInfo&amp; callLinkInfo)
</ins><span class="cx"> {
</span><del>-    return callLinkInfo-&gt;callReturnLocation.executableAddress();
</del><ins>+    return callLinkInfo.codeOrigin;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline unsigned getCallLinkInfoBytecodeIndex(CallLinkInfo* callLinkInfo)
-{
-    return callLinkInfo-&gt;codeOrigin.bytecodeIndex;
-}
</del><ins>+typedef HashMap&lt;CodeOrigin, CallLinkInfo*, CodeOriginApproximateHash&gt; CallLinkInfoMap;
+
+#else // ENABLE(JIT)
+
+typedef HashMap&lt;int, void*&gt; CallLinkInfoMap;
+
</ins><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -115,7 +115,8 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CallLinkStatus CallLinkStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex)
</del><ins>+CallLinkStatus CallLinkStatus::computeFor(
+    CodeBlock* profiledBlock, unsigned bytecodeIndex, const CallLinkInfoMap&amp; map)
</ins><span class="cx"> {
</span><span class="cx">     ConcurrentJITLocker locker(profiledBlock-&gt;m_lock);
</span><span class="cx">     
</span><span class="lines">@@ -127,15 +128,11 @@
</span><span class="cx">         || profiledBlock-&gt;hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadExecutable)))
</span><span class="cx">         return takesSlowPath();
</span><span class="cx">     
</span><del>-    if (!profiledBlock-&gt;hasBaselineJITProfiling())
</del><ins>+    CallLinkInfo* callLinkInfo = map.get(CodeOrigin(bytecodeIndex));
+    if (!callLinkInfo)
</ins><span class="cx">         return computeFromLLInt(locker, profiledBlock, bytecodeIndex);
</span><span class="cx">     
</span><del>-    if (profiledBlock-&gt;couldTakeSlowCase(bytecodeIndex))
-        return takesSlowPath();
-    
-    CallLinkInfo&amp; callLinkInfo = profiledBlock-&gt;getCallLinkInfo(bytecodeIndex);
-    
-    CallLinkStatus result = computeFor(locker, callLinkInfo);
</del><ins>+    CallLinkStatus result = computeFor(locker, *callLinkInfo);
</ins><span class="cx">     if (!result)
</span><span class="cx">         return computeFromLLInt(locker, profiledBlock, bytecodeIndex);
</span><span class="cx">     
</span><span class="lines">@@ -151,6 +148,9 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> CallLinkStatus CallLinkStatus::computeFor(const ConcurrentJITLocker&amp;, CallLinkInfo&amp; callLinkInfo)
</span><span class="cx"> {
</span><ins>+    if (callLinkInfo.slowPathCount &gt;= Options::couldTakeSlowCaseMinimumCount())
+        return takesSlowPath();
+    
</ins><span class="cx">     if (callLinkInfo.stub)
</span><span class="cx">         return CallLinkStatus(callLinkInfo.stub-&gt;executable(), callLinkInfo.stub-&gt;structure());
</span><span class="cx">     
</span><span class="lines">@@ -171,11 +171,8 @@
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">     RELEASE_ASSERT(dfgCodeBlock-&gt;jitType() == JITCode::DFGJIT);
</span><span class="cx">     CodeBlock* baselineCodeBlock = dfgCodeBlock-&gt;alternative();
</span><del>-    DFG::JITCode* jitCode = dfgCodeBlock-&gt;jitCode()-&gt;dfg();
-    RELEASE_ASSERT(dfgCodeBlock-&gt;numberOfCallLinkInfos() &lt;= jitCode-&gt;slowPathCalls.size());
-    
-    for (size_t i = dfgCodeBlock-&gt;numberOfCallLinkInfos(); i--;) {
-        CallLinkInfo&amp; info = dfgCodeBlock-&gt;callLinkInfo(i);
</del><ins>+    for (auto iter = dfgCodeBlock-&gt;callLinkInfosBegin(); !!iter; ++iter) {
+        CallLinkInfo&amp; info = **iter;
</ins><span class="cx">         CodeOrigin codeOrigin = info.codeOrigin;
</span><span class="cx">         
</span><span class="cx">         bool takeSlowPath;
</span><span class="lines">@@ -202,7 +199,7 @@
</span><span class="cx">         
</span><span class="cx">         {
</span><span class="cx">             ConcurrentJITLocker locker(dfgCodeBlock-&gt;m_lock);
</span><del>-            if (takeSlowPath || jitCode-&gt;slowPathCalls[i] &gt;= Options::couldTakeSlowCaseMinimumCount())
</del><ins>+            if (takeSlowPath)
</ins><span class="cx">                 map.add(info.codeOrigin, takesSlowPath());
</span><span class="cx">             else {
</span><span class="cx">                 CallLinkStatus status = computeFor(locker, info);
</span><span class="lines">@@ -230,13 +227,14 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CallLinkStatus CallLinkStatus::computeFor(
</span><del>-    CodeBlock* profiledBlock, CodeOrigin codeOrigin, const CallLinkStatus::ContextMap&amp; map)
</del><ins>+    CodeBlock* profiledBlock, CodeOrigin codeOrigin,
+    const CallLinkInfoMap&amp; baselineMap, const CallLinkStatus::ContextMap&amp; dfgMap)
</ins><span class="cx"> {
</span><del>-    ContextMap::const_iterator iter = map.find(codeOrigin);
-    if (iter != map.end())
</del><ins>+    auto iter = dfgMap.find(codeOrigin);
+    if (iter != dfgMap.end())
</ins><span class="cx">         return iter-&gt;value;
</span><span class="cx">     
</span><del>-    return computeFor(profiledBlock, codeOrigin.bytecodeIndex);
</del><ins>+    return computeFor(profiledBlock, codeOrigin.bytecodeIndex, baselineMap);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CallLinkStatus::dump(PrintStream&amp; out) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #ifndef CallLinkStatus_h
</span><span class="cx"> #define CallLinkStatus_h
</span><span class="cx"> 
</span><ins>+#include &quot;CallLinkInfo.h&quot;
</ins><span class="cx"> #include &quot;CodeOrigin.h&quot;
</span><span class="cx"> #include &quot;CodeSpecializationKind.h&quot;
</span><span class="cx"> #include &quot;ConcurrentJITLock.h&quot;
</span><span class="lines">@@ -75,7 +76,8 @@
</span><span class="cx">         return *this;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    static CallLinkStatus computeFor(CodeBlock*, unsigned bytecodeIndex);
</del><ins>+    static CallLinkStatus computeFor(
+        CodeBlock*, unsigned bytecodeIndex, const CallLinkInfoMap&amp;);
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     // Computes the status assuming that we never took slow path and never previously
</span><span class="lines">@@ -91,7 +93,8 @@
</span><span class="cx">     static void computeDFGStatuses(CodeBlock* dfgCodeBlock, ContextMap&amp;);
</span><span class="cx">     
</span><span class="cx">     // Helper that first consults the ContextMap and then does computeFor().
</span><del>-    static CallLinkStatus computeFor(CodeBlock*, CodeOrigin, const ContextMap&amp;);
</del><ins>+    static CallLinkStatus computeFor(
+        CodeBlock*, CodeOrigin, const CallLinkInfoMap&amp;, const ContextMap&amp;);
</ins><span class="cx">     
</span><span class="cx">     bool isSet() const { return m_callTarget || m_executable || m_couldTakeSlowPath; }
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -408,7 +408,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::printCallOp(PrintStream&amp; out, ExecState* exec, int location, const Instruction*&amp; it, const char* op, CacheDumpMode cacheDumpMode, bool&amp; hasPrintedProfiling)
</del><ins>+void CodeBlock::printCallOp(PrintStream&amp; out, ExecState* exec, int location, const Instruction*&amp; it, const char* op, CacheDumpMode cacheDumpMode, bool&amp; hasPrintedProfiling, const CallLinkInfoMap&amp; map)
</ins><span class="cx"> {
</span><span class="cx">     int dst = (++it)-&gt;u.operand;
</span><span class="cx">     int func = (++it)-&gt;u.operand;
</span><span class="lines">@@ -427,12 +427,12 @@
</span><span class="cx">         }
</span><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(JIT)
</span><del>-        if (numberOfCallLinkInfos()) {
-            JSFunction* target = getCallLinkInfo(location).lastSeenCallee.get();
</del><ins>+        if (CallLinkInfo* info = map.get(CodeOrigin(location))) {
+            JSFunction* target = info-&gt;lastSeenCallee.get();
</ins><span class="cx">             if (target)
</span><span class="cx">                 out.printf(&quot; jit(%p, exec %p)&quot;, target, target-&gt;executable());
</span><span class="cx">         }
</span><del>-        out.print(&quot; status(&quot;, CallLinkStatus::computeFor(this, location), &quot;)&quot;);
</del><ins>+        out.print(&quot; status(&quot;, CallLinkStatus::computeFor(this, location, map), &quot;)&quot;);
</ins><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx">     ++it;
</span><span class="lines">@@ -484,12 +484,14 @@
</span><span class="cx">     out.printf(&quot;\n&quot;);
</span><span class="cx">     
</span><span class="cx">     StubInfoMap stubInfos;
</span><ins>+    CallLinkInfoMap callLinkInfos;
</ins><span class="cx">     getStubInfoMap(stubInfos);
</span><ins>+    getCallLinkInfoMap(callLinkInfos);
</ins><span class="cx">     
</span><span class="cx">     const Instruction* begin = instructions().begin();
</span><span class="cx">     const Instruction* end = instructions().end();
</span><span class="cx">     for (const Instruction* it = begin; it != end; ++it)
</span><del>-        dumpBytecode(out, exec, begin, it, stubInfos);
</del><ins>+        dumpBytecode(out, exec, begin, it, stubInfos, callLinkInfos);
</ins><span class="cx">     
</span><span class="cx">     if (numberOfIdentifiers()) {
</span><span class="cx">         out.printf(&quot;\nIdentifiers:\n&quot;);
</span><span class="lines">@@ -617,7 +619,9 @@
</span><span class="cx">     out.printf(&quot;%s&quot;, registerName(operand).data());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::dumpBytecode(PrintStream&amp; out, ExecState* exec, const Instruction* begin, const Instruction*&amp; it, const StubInfoMap&amp; map)
</del><ins>+void CodeBlock::dumpBytecode(
+    PrintStream&amp; out, ExecState* exec, const Instruction* begin, const Instruction*&amp; it,
+    const StubInfoMap&amp; stubInfos, const CallLinkInfoMap&amp; callLinkInfos)
</ins><span class="cx"> {
</span><span class="cx">     int location = it - begin;
</span><span class="cx">     bool hasPrintedProfiling = false;
</span><span class="lines">@@ -914,7 +918,7 @@
</span><span class="cx">         case op_get_by_id_out_of_line:
</span><span class="cx">         case op_get_array_length: {
</span><span class="cx">             printGetByIdOp(out, exec, location, it);
</span><del>-            printGetByIdCacheStatus(out, exec, location, map);
</del><ins>+            printGetByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx">             dumpValueProfiling(out, it, hasPrintedProfiling);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="lines">@@ -1175,11 +1179,11 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_call: {
</span><del>-            printCallOp(out, exec, location, it, &quot;call&quot;, DumpCaches, hasPrintedProfiling);
</del><ins>+            printCallOp(out, exec, location, it, &quot;call&quot;, DumpCaches, hasPrintedProfiling, callLinkInfos);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_call_eval: {
</span><del>-            printCallOp(out, exec, location, it, &quot;call_eval&quot;, DontDumpCaches, hasPrintedProfiling);
</del><ins>+            printCallOp(out, exec, location, it, &quot;call_eval&quot;, DontDumpCaches, hasPrintedProfiling, callLinkInfos);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_call_varargs: {
</span><span class="lines">@@ -1220,7 +1224,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_construct: {
</span><del>-            printCallOp(out, exec, location, it, &quot;construct&quot;, DumpCaches, hasPrintedProfiling);
</del><ins>+            printCallOp(out, exec, location, it, &quot;construct&quot;, DumpCaches, hasPrintedProfiling, callLinkInfos);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_strcat: {
</span><span class="lines">@@ -1381,11 +1385,13 @@
</span><span class="cx">     out.print(&quot;\n&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::dumpBytecode(PrintStream&amp; out, unsigned bytecodeOffset, const StubInfoMap&amp; map)
</del><ins>+void CodeBlock::dumpBytecode(
+    PrintStream&amp; out, unsigned bytecodeOffset,
+    const StubInfoMap&amp; stubInfos, const CallLinkInfoMap&amp; callLinkInfos)
</ins><span class="cx"> {
</span><span class="cx">     ExecState* exec = m_globalObject-&gt;globalExec();
</span><span class="cx">     const Instruction* it = instructions().begin() + bytecodeOffset;
</span><del>-    dumpBytecode(out, exec, instructions().begin(), it, map);
</del><ins>+    dumpBytecode(out, exec, instructions().begin(), it, stubInfos, callLinkInfos);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #define FOR_EACH_MEMBER_VECTOR(macro) \
</span><span class="lines">@@ -2233,34 +2239,34 @@
</span><span class="cx">     // Handle inline caches.
</span><span class="cx">     if (!!jitCode()) {
</span><span class="cx">         RepatchBuffer repatchBuffer(this);
</span><del>-        for (unsigned i = 0; i &lt; numberOfCallLinkInfos(); ++i) {
-            if (callLinkInfo(i).isLinked()) {
-                if (ClosureCallStubRoutine* stub = callLinkInfo(i).stub.get()) {
</del><ins>+        for (auto iter = callLinkInfosBegin(); !!iter; ++iter) {
+            CallLinkInfo&amp; info = **iter;
+            if (info.isLinked()) {
+                if (ClosureCallStubRoutine* stub = info.stub.get()) {
</ins><span class="cx">                     if (!Heap::isMarked(stub-&gt;structure())
</span><span class="cx">                         || !Heap::isMarked(stub-&gt;executable())) {
</span><span class="cx">                         if (Options::verboseOSR()) {
</span><span class="cx">                             dataLog(
</span><span class="cx">                                 &quot;Clearing closure call from &quot;, *this, &quot; to &quot;,
</span><del>-                                stub-&gt;executable()-&gt;hashFor(callLinkInfo(i).specializationKind()),
</del><ins>+                                stub-&gt;executable()-&gt;hashFor(info.specializationKind()),
</ins><span class="cx">                                 &quot;, stub routine &quot;, RawPointer(stub), &quot;.\n&quot;);
</span><span class="cx">                         }
</span><del>-                        callLinkInfo(i).unlink(*m_vm, repatchBuffer);
</del><ins>+                        info.unlink(*m_vm, repatchBuffer);
</ins><span class="cx">                     }
</span><del>-                } else if (!Heap::isMarked(callLinkInfo(i).callee.get())) {
</del><ins>+                } else if (!Heap::isMarked(info.callee.get())) {
</ins><span class="cx">                     if (Options::verboseOSR()) {
</span><span class="cx">                         dataLog(
</span><span class="cx">                             &quot;Clearing call from &quot;, *this, &quot; to &quot;,
</span><del>-                            RawPointer(callLinkInfo(i).callee.get()), &quot; (&quot;,
-                            callLinkInfo(i).callee.get()-&gt;executable()-&gt;hashFor(
-                                callLinkInfo(i).specializationKind()),
</del><ins>+                            RawPointer(info.callee.get()), &quot; (&quot;,
+                            info.callee.get()-&gt;executable()-&gt;hashFor(info.specializationKind()),
</ins><span class="cx">                             &quot;).\n&quot;);
</span><span class="cx">                     }
</span><del>-                    callLinkInfo(i).unlink(*m_vm, repatchBuffer);
</del><ins>+                    info.unlink(*m_vm, repatchBuffer);
</ins><span class="cx">                 }
</span><span class="cx">             }
</span><del>-            if (!!callLinkInfo(i).lastSeenCallee
-                &amp;&amp; !Heap::isMarked(callLinkInfo(i).lastSeenCallee.get()))
-                callLinkInfo(i).lastSeenCallee.clear();
</del><ins>+            if (!!info.lastSeenCallee
+                &amp;&amp; !Heap::isMarked(info.lastSeenCallee.get()))
+                info.lastSeenCallee.clear();
</ins><span class="cx">         }
</span><span class="cx">         for (Bag&lt;StructureStubInfo&gt;::iterator iter = m_stubInfos.begin(); !!iter; ++iter) {
</span><span class="cx">             StructureStubInfo&amp; stubInfo = **iter;
</span><span class="lines">@@ -2289,13 +2295,47 @@
</span><span class="cx">     getStubInfoMap(locker, result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void CodeBlock::getCallLinkInfoMap(const ConcurrentJITLocker&amp;, CallLinkInfoMap&amp; result)
+{
</ins><span class="cx"> #if ENABLE(JIT)
</span><ins>+    toHashMap(m_callLinkInfos, getCallLinkInfoCodeOrigin, result);
+#else
+    UNUSED_PARAM(result);
+#endif
+}
+
+void CodeBlock::getCallLinkInfoMap(CallLinkInfoMap&amp; result)
+{
+    ConcurrentJITLocker locker(m_lock);
+    getCallLinkInfoMap(locker, result);
+}
+
+CallLinkInfo* CodeBlock::getCallLinkInfoForBytecodeIndex(unsigned index)
+{
+#if ENABLE(JIT)
+    for (auto iter = m_callLinkInfos.begin(); !!iter; ++iter) {
+        if ((*iter)-&gt;codeOrigin == CodeOrigin(index))
+            return *iter;
+    }
+#else
+    UNUSED_PARAM(index);
+#endif
+    return nullptr;
+}
+
+#if ENABLE(JIT)
</ins><span class="cx"> StructureStubInfo* CodeBlock::addStubInfo()
</span><span class="cx"> {
</span><span class="cx">     ConcurrentJITLocker locker(m_lock);
</span><span class="cx">     return m_stubInfos.add();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+CallLinkInfo* CodeBlock::addCallLinkInfo()
+{
+    ConcurrentJITLocker locker(m_lock);
+    return m_callLinkInfos.add();
+}
+
</ins><span class="cx"> void CodeBlock::resetStub(StructureStubInfo&amp; stubInfo)
</span><span class="cx"> {
</span><span class="cx">     if (stubInfo.accessType == access_unset)
</span><span class="lines">@@ -2592,15 +2632,16 @@
</span><span class="cx">             m_llintCallLinkInfos[i].unlink();
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><del>-    if (!m_callLinkInfos.size())
</del><ins>+    if (m_callLinkInfos.isEmpty())
</ins><span class="cx">         return;
</span><span class="cx">     if (!m_vm-&gt;canUseJIT())
</span><span class="cx">         return;
</span><span class="cx">     RepatchBuffer repatchBuffer(this);
</span><del>-    for (size_t i = 0; i &lt; m_callLinkInfos.size(); i++) {
-        if (!m_callLinkInfos[i].isLinked())
</del><ins>+    for (auto iter = m_callLinkInfos.begin(); !!iter; ++iter) {
+        CallLinkInfo&amp; info = **iter;
+        if (!info.isLinked())
</ins><span class="cx">             continue;
</span><del>-        m_callLinkInfos[i].unlink(*m_vm, repatchBuffer);
</del><ins>+        info.unlink(*m_vm, repatchBuffer);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -147,7 +147,9 @@
</span><span class="cx">     void visitAggregate(SlotVisitor&amp;);
</span><span class="cx"> 
</span><span class="cx">     void dumpBytecode(PrintStream&amp; = WTF::dataFile());
</span><del>-    void dumpBytecode(PrintStream&amp;, unsigned bytecodeOffset, const StubInfoMap&amp; = StubInfoMap());
</del><ins>+    void dumpBytecode(
+        PrintStream&amp;, unsigned bytecodeOffset,
+        const StubInfoMap&amp; = StubInfoMap(), const CallLinkInfoMap&amp; = CallLinkInfoMap());
</ins><span class="cx">     void printStructures(PrintStream&amp;, const Instruction*);
</span><span class="cx">     void printStructure(PrintStream&amp;, const char* name, const Instruction*, int operand);
</span><span class="cx"> 
</span><span class="lines">@@ -178,11 +180,18 @@
</span><span class="cx"> 
</span><span class="cx">     void getStubInfoMap(const ConcurrentJITLocker&amp;, StubInfoMap&amp; result);
</span><span class="cx">     void getStubInfoMap(StubInfoMap&amp; result);
</span><del>-
</del><ins>+    
+    void getCallLinkInfoMap(const ConcurrentJITLocker&amp;, CallLinkInfoMap&amp; result);
+    void getCallLinkInfoMap(CallLinkInfoMap&amp; result);
+    
+    // This is a slow function call used primarily for compiling OSR exits in the case
+    // that there had been inlining. Chances are if you want to use this, you're really
+    // looking for a CallLinkInfoMap to amortize the cost of calling this.
+    CallLinkInfo* getCallLinkInfoForBytecodeIndex(unsigned bytecodeIndex);
</ins><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     StructureStubInfo* addStubInfo();
</span><del>-    Bag&lt;StructureStubInfo&gt;::iterator begin() { return m_stubInfos.begin(); }
-    Bag&lt;StructureStubInfo&gt;::iterator end() { return m_stubInfos.end(); }
</del><ins>+    Bag&lt;StructureStubInfo&gt;::iterator stubInfoBegin() { return m_stubInfos.begin(); }
+    Bag&lt;StructureStubInfo&gt;::iterator stubInfoEnd() { return m_stubInfos.end(); }
</ins><span class="cx"> 
</span><span class="cx">     void resetStub(StructureStubInfo&amp;);
</span><span class="cx">     
</span><span class="lines">@@ -191,16 +200,9 @@
</span><span class="cx">         return *(binarySearch&lt;ByValInfo, unsigned&gt;(m_byValInfos, m_byValInfos.size(), bytecodeIndex, getByValInfoBytecodeIndex));
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    CallLinkInfo&amp; getCallLinkInfo(ReturnAddressPtr returnAddress)
-    {
-        return *(binarySearch&lt;CallLinkInfo, void*&gt;(m_callLinkInfos, m_callLinkInfos.size(), returnAddress.value(), getCallLinkInfoReturnLocation));
-    }
-
-    CallLinkInfo&amp; getCallLinkInfo(unsigned bytecodeIndex)
-    {
-        ASSERT(!JITCode::isOptimizingJIT(jitType()));
-        return *(binarySearch&lt;CallLinkInfo, unsigned&gt;(m_callLinkInfos, m_callLinkInfos.size(), bytecodeIndex, getCallLinkInfoBytecodeIndex));
-    }
</del><ins>+    CallLinkInfo* addCallLinkInfo();
+    Bag&lt;CallLinkInfo&gt;::iterator callLinkInfosBegin() { return m_callLinkInfos.begin(); }
+    Bag&lt;CallLinkInfo&gt;::iterator callLinkInfosEnd() { return m_callLinkInfos.end(); }
</ins><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx"> 
</span><span class="cx">     void unlinkIncomingCalls();
</span><span class="lines">@@ -399,10 +401,6 @@
</span><span class="cx">     void setNumberOfByValInfos(size_t size) { m_byValInfos.resizeToFit(size); }
</span><span class="cx">     size_t numberOfByValInfos() const { return m_byValInfos.size(); }
</span><span class="cx">     ByValInfo&amp; byValInfo(size_t index) { return m_byValInfos[index]; }
</span><del>-
-    void setNumberOfCallLinkInfos(size_t size) { m_callLinkInfos.resizeToFit(size); }
-    size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
-    CallLinkInfo&amp; callLinkInfo(int index) { return m_callLinkInfos[index]; }
</del><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     unsigned numberOfArgumentValueProfiles()
</span><span class="lines">@@ -968,7 +966,9 @@
</span><span class="cx">             m_constantRegisters[i].set(*m_vm, ownerExecutable(), constants[i].get());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void dumpBytecode(PrintStream&amp;, ExecState*, const Instruction* begin, const Instruction*&amp;, const StubInfoMap&amp; = StubInfoMap());
</del><ins>+    void dumpBytecode(
+        PrintStream&amp;, ExecState*, const Instruction* begin, const Instruction*&amp;,
+        const StubInfoMap&amp; = StubInfoMap(), const CallLinkInfoMap&amp; = CallLinkInfoMap());
</ins><span class="cx"> 
</span><span class="cx">     CString registerName(int r) const;
</span><span class="cx">     void printUnaryOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op);
</span><span class="lines">@@ -977,7 +977,7 @@
</span><span class="cx">     void printGetByIdOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;);
</span><span class="cx">     void printGetByIdCacheStatus(PrintStream&amp;, ExecState*, int location, const StubInfoMap&amp;);
</span><span class="cx">     enum CacheDumpMode { DumpCaches, DontDumpCaches };
</span><del>-    void printCallOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op, CacheDumpMode, bool&amp; hasPrintedProfiling);
</del><ins>+    void printCallOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op, CacheDumpMode, bool&amp; hasPrintedProfiling, const CallLinkInfoMap&amp;);
</ins><span class="cx">     void printPutByIdOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op);
</span><span class="cx">     void printLocationAndOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op);
</span><span class="cx">     void printLocationOpAndRegisterOperand(PrintStream&amp;, ExecState*, int location, const Instruction*&amp; it, const char* op, int operand);
</span><span class="lines">@@ -1064,7 +1064,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     Bag&lt;StructureStubInfo&gt; m_stubInfos;
</span><span class="cx">     Vector&lt;ByValInfo&gt; m_byValInfos;
</span><del>-    Vector&lt;CallLinkInfo&gt; m_callLinkInfos;
</del><ins>+    Bag&lt;CallLinkInfo&gt; m_callLinkInfos;
</ins><span class="cx">     SentinelLinkedList&lt;CallLinkInfo, BasicRawSentinelNode&lt;CallLinkInfo&gt;&gt; m_incomingCalls;
</span><span class="cx"> #endif
</span><span class="cx">     OwnPtr&lt;CompactJITCodeMap&gt; m_jitCodeMap;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1063,6 +1063,7 @@
</span><span class="cx">         // code block had gathered.
</span><span class="cx">         LazyOperandValueProfileParser m_lazyOperands;
</span><span class="cx">         
</span><ins>+        CallLinkInfoMap m_callLinkInfos;
</ins><span class="cx">         StubInfoMap m_stubInfos;
</span><span class="cx">         
</span><span class="cx">         // Did we see any returns? We need to handle the (uncommon but necessary)
</span><span class="lines">@@ -1180,7 +1181,8 @@
</span><span class="cx">             m_graph.valueOfJSConstant(callTarget)).setIsProved(true);
</span><span class="cx">     } else {
</span><span class="cx">         callLinkStatus = CallLinkStatus::computeFor(
</span><del>-            m_inlineStackTop-&gt;m_profiledBlock, currentCodeOrigin(), m_callContextMap);
</del><ins>+            m_inlineStackTop-&gt;m_profiledBlock, currentCodeOrigin(),
+            m_inlineStackTop-&gt;m_callLinkInfos, m_callContextMap);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (!callLinkStatus.canOptimize()) {
</span><span class="lines">@@ -3333,8 +3335,10 @@
</span><span class="cx">         // We do this while holding the lock because we want to encourage StructureStubInfo's
</span><span class="cx">         // to be potentially added to operations and because the profiled block could be in the
</span><span class="cx">         // middle of LLInt-&gt;JIT tier-up in which case we would be adding the info's right now.
</span><del>-        if (m_profiledBlock-&gt;hasBaselineJITProfiling())
</del><ins>+        if (m_profiledBlock-&gt;hasBaselineJITProfiling()) {
</ins><span class="cx">             m_profiledBlock-&gt;getStubInfoMap(locker, m_stubInfos);
</span><ins>+            m_profiledBlock-&gt;getCallLinkInfoMap(locker, m_callLinkInfos);
+        }
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     m_argumentPositions.resize(argumentCountIncludingThis);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITCode.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITCode.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITCode.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -117,7 +117,6 @@
</span><span class="cx">     Vector&lt;DFG::OSREntryData&gt; osrEntry;
</span><span class="cx">     SegmentedVector&lt;DFG::OSRExit, 8&gt; osrExit;
</span><span class="cx">     Vector&lt;DFG::SpeculationRecovery&gt; speculationRecovery;
</span><del>-    Vector&lt;unsigned&gt; slowPathCalls;
</del><span class="cx">     DFG::VariableEventStream variableEventStream;
</span><span class="cx">     DFG::MinifiedGraph minifiedDFG;
</span><span class="cx"> #if ENABLE(FTL_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITCompilercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -233,20 +233,16 @@
</span><span class="cx">         info.patch.deltaCallToSlowCase = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_ins[i].m_slowPathGenerator-&gt;label()));
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    RELEASE_ASSERT(!m_graph.m_plan.willTryToTierUp || m_jitCode-&gt;slowPathCalls.size() &gt;= m_jsCalls.size());
-    m_codeBlock-&gt;setNumberOfCallLinkInfos(m_jsCalls.size());
</del><span class="cx">     for (unsigned i = 0; i &lt; m_jsCalls.size(); ++i) {
</span><del>-        CallLinkInfo&amp; info = m_codeBlock-&gt;callLinkInfo(i);
-        info.callType = m_jsCalls[i].m_callType;
-        info.codeOrigin = m_jsCalls[i].m_codeOrigin;
</del><ins>+        JSCallRecord&amp; record = m_jsCalls[i];
+        CallLinkInfo&amp; info = *record.m_info;
</ins><span class="cx">         ThunkGenerator generator = linkThunkGeneratorFor(
</span><span class="cx">             info.callType == CallLinkInfo::Construct ? CodeForConstruct : CodeForCall,
</span><span class="cx">             RegisterPreservationNotRequired);
</span><del>-        linkBuffer.link(m_jsCalls[i].m_slowCall, FunctionPtr(m_vm-&gt;getCTIStub(generator).code().executableAddress()));
-        info.callReturnLocation = linkBuffer.locationOfNearCall(m_jsCalls[i].m_slowCall);
-        info.hotPathBegin = linkBuffer.locationOf(m_jsCalls[i].m_targetToCheck);
-        info.hotPathOther = linkBuffer.locationOfNearCall(m_jsCalls[i].m_fastCall);
-        info.calleeGPR = static_cast&lt;unsigned&gt;(m_jsCalls[i].m_callee);
</del><ins>+        linkBuffer.link(record.m_slowCall, FunctionPtr(m_vm-&gt;getCTIStub(generator).code().executableAddress()));
+        info.callReturnLocation = linkBuffer.locationOfNearCall(record.m_slowCall);
+        info.hotPathBegin = linkBuffer.locationOf(record.m_targetToCheck);
+        info.hotPathOther = linkBuffer.locationOfNearCall(record.m_fastCall);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     MacroAssemblerCodeRef osrExitThunk = vm()-&gt;getCTIStub(osrExitGenerationThunkGenerator);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITCompilerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -226,9 +226,9 @@
</span><span class="cx">         return m_jsCalls.size();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void addJSCall(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo::CallType callType, GPRReg callee, CodeOrigin codeOrigin)
</del><ins>+    void addJSCall(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo* info)
</ins><span class="cx">     {
</span><del>-        m_jsCalls.append(JSCallRecord(fastCall, slowCall, targetToCheck, callType, callee, codeOrigin));
</del><ins>+        m_jsCalls.append(JSCallRecord(fastCall, slowCall, targetToCheck, info));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     void addWeakReference(JSCell* target)
</span><span class="lines">@@ -353,22 +353,18 @@
</span><span class="cx">     Vector&lt;Label&gt; m_blockHeads;
</span><span class="cx"> 
</span><span class="cx">     struct JSCallRecord {
</span><del>-        JSCallRecord(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo::CallType callType, GPRReg callee, CodeOrigin codeOrigin)
</del><ins>+        JSCallRecord(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo* info)
</ins><span class="cx">             : m_fastCall(fastCall)
</span><span class="cx">             , m_slowCall(slowCall)
</span><span class="cx">             , m_targetToCheck(targetToCheck)
</span><del>-            , m_callType(callType)
-            , m_callee(callee)
-            , m_codeOrigin(codeOrigin)
</del><ins>+            , m_info(info)
</ins><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         Call m_fastCall;
</span><span class="cx">         Call m_slowCall;
</span><span class="cx">         DataLabelPtr m_targetToCheck;
</span><del>-        CallLinkInfo::CallType m_callType;
-        GPRReg m_callee;
-        CodeOrigin m_codeOrigin;
</del><ins>+        CallLinkInfo* m_info;
</ins><span class="cx">     };
</span><span class="cx">     
</span><span class="cx">     Vector&lt;InlineCacheWrapper&lt;JITGetByIdGenerator&gt;, 4&gt; m_getByIds;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompilerCommoncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -98,9 +98,11 @@
</span><span class="cx">         CodeBlock* baselineCodeBlock = jit.baselineCodeBlockFor(codeOrigin);
</span><span class="cx">         CodeBlock* baselineCodeBlockForCaller = jit.baselineCodeBlockFor(inlineCallFrame-&gt;caller);
</span><span class="cx">         unsigned callBytecodeIndex = inlineCallFrame-&gt;caller.bytecodeIndex;
</span><del>-        CallLinkInfo&amp; callLinkInfo = baselineCodeBlockForCaller-&gt;getCallLinkInfo(callBytecodeIndex);
</del><ins>+        CallLinkInfo* callLinkInfo =
+            baselineCodeBlockForCaller-&gt;getCallLinkInfoForBytecodeIndex(callBytecodeIndex);
+        RELEASE_ASSERT(callLinkInfo);
</ins><span class="cx">         
</span><del>-        void* jumpTarget = callLinkInfo.callReturnLocation.executableAddress();
</del><ins>+        void* jumpTarget = callLinkInfo-&gt;callReturnLocation.executableAddress();
</ins><span class="cx"> 
</span><span class="cx">         GPRReg callerFrameGPR;
</span><span class="cx">         if (inlineCallFrame-&gt;caller.inlineCallFrame) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1532,40 +1532,10 @@
</span><span class="cx">     m_isCheckingArgumentTypes = false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void SpeculativeJIT::prepareJITCodeForTierUp()
-{
-    unsigned numberOfCalls = 0;
-    
-    for (BlockIndex blockIndex = m_jit.graph().numBlocks(); blockIndex--;) {
-        BasicBlock* block = m_jit.graph().block(blockIndex);
-        if (!block)
-            continue;
-        
-        for (unsigned nodeIndex = block-&gt;size(); nodeIndex--;) {
-            Node* node = block-&gt;at(nodeIndex);
-            
-            switch (node-&gt;op()) {
-            case Call:
-            case Construct:
-                numberOfCalls++;
-                break;
-                
-            default:
-                break;
-            }
-        }
-    }
-    
-    m_jit.jitCode()-&gt;slowPathCalls.fill(0, numberOfCalls);
-}
-
</del><span class="cx"> bool SpeculativeJIT::compile()
</span><span class="cx"> {
</span><span class="cx">     checkArgumentTypes();
</span><span class="cx">     
</span><del>-    if (m_jit.graph().m_plan.willTryToTierUp)
-        prepareJITCodeForTierUp();
-    
</del><span class="cx">     ASSERT(!m_currentNode);
</span><span class="cx">     for (BlockIndex blockIndex = 0; blockIndex &lt; m_jit.graph().numBlocks(); ++blockIndex) {
</span><span class="cx">         m_jit.setForBlockIndex(blockIndex);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -120,8 +120,6 @@
</span><span class="cx"> 
</span><span class="cx">     bool compile();
</span><span class="cx">     
</span><del>-    void prepareJITCodeForTierUp();
-    
</del><span class="cx">     void createOSREntries();
</span><span class="cx">     void linkOSREntries(LinkBuffer&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -722,6 +722,8 @@
</span><span class="cx">         m_jit.move(calleePayloadGPR, GPRInfo::regT0);
</span><span class="cx">         m_jit.move(calleeTagGPR, GPRInfo::regT1);
</span><span class="cx">     }
</span><ins>+    CallLinkInfo* info = m_jit.codeBlock()-&gt;addCallLinkInfo();
+    m_jit.move(MacroAssembler::TrustedImmPtr(info), GPRInfo::regT2);
</ins><span class="cx">     JITCompiler::Call slowCall = m_jit.nearCall();
</span><span class="cx"> 
</span><span class="cx">     done.link(&amp;m_jit);
</span><span class="lines">@@ -730,7 +732,10 @@
</span><span class="cx"> 
</span><span class="cx">     jsValueResult(resultTagGPR, resultPayloadGPR, node, DataFormatJS, UseChildrenCalledExplicitly);
</span><span class="cx"> 
</span><del>-    m_jit.addJSCall(fastCall, slowCall, targetToCheck, callType, calleePayloadGPR, node-&gt;origin.semantic);
</del><ins>+    info-&gt;callType = callType;
+    info-&gt;codeOrigin = node-&gt;origin.semantic;
+    info-&gt;calleeGPR = calleePayloadGPR;
+    m_jit.addJSCall(fastCall, slowCall, targetToCheck, info);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;bool strict&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -721,14 +721,9 @@
</span><span class="cx">     
</span><span class="cx">     slowPath.link(&amp;m_jit);
</span><span class="cx">     
</span><del>-    if (m_jit.graph().m_plan.willTryToTierUp) {
-        m_jit.add32(
-            TrustedImm32(1),
-            MacroAssembler::AbsoluteAddress(
-                m_jit.jitCode()-&gt;slowPathCalls.begin() + m_jit.currentJSCallIndex()));
-    }
-    
</del><span class="cx">     m_jit.move(calleeGPR, GPRInfo::regT0); // Callee needs to be in regT0
</span><ins>+    CallLinkInfo* callLinkInfo = m_jit.codeBlock()-&gt;addCallLinkInfo();
+    m_jit.move(MacroAssembler::TrustedImmPtr(callLinkInfo), GPRInfo::regT2); // Link info needs to be in regT2
</ins><span class="cx">     JITCompiler::Call slowCall = m_jit.nearCall();
</span><span class="cx">     
</span><span class="cx">     done.link(&amp;m_jit);
</span><span class="lines">@@ -737,7 +732,11 @@
</span><span class="cx">     
</span><span class="cx">     jsValueResult(resultGPR, m_currentNode, DataFormatJS, UseChildrenCalledExplicitly);
</span><span class="cx">     
</span><del>-    m_jit.addJSCall(fastCall, slowCall, targetToCheck, callType, calleeGPR, m_currentNode-&gt;origin.semantic);
</del><ins>+    callLinkInfo-&gt;callType = callType;
+    callLinkInfo-&gt;codeOrigin = m_currentNode-&gt;origin.semantic;
+    callLinkInfo-&gt;calleeGPR = calleeGPR;
+    
+    m_jit.addJSCall(fastCall, slowCall, targetToCheck, callLinkInfo);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // Clang should allow unreachable [[clang::fallthrough]] in template functions if any template expansion uses it
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCompilecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -402,7 +402,6 @@
</span><span class="cx">     
</span><span class="cx">     std::sort(state.jsCalls.begin(), state.jsCalls.end());
</span><span class="cx">     
</span><del>-    codeBlock-&gt;setNumberOfCallLinkInfos(state.jsCalls.size());
</del><span class="cx">     for (unsigned i = state.jsCalls.size(); i--;) {
</span><span class="cx">         JSCall&amp; call = state.jsCalls[i];
</span><span class="cx"> 
</span><span class="lines">@@ -412,13 +411,15 @@
</span><span class="cx">         char* startOfIC = bitwise_cast&lt;char*&gt;(generatedFunction) + call.m_instructionOffset;
</span><span class="cx">         
</span><span class="cx">         LinkBuffer linkBuffer(vm, &amp;fastPathJIT, startOfIC, sizeOfCall());
</span><del>-        RELEASE_ASSERT(linkBuffer.isValid());
</del><ins>+        if (!linkBuffer.isValid()) {
+            dataLog(&quot;Failed to insert inline cache for call because we thought the size would be &quot;, sizeOfCall(), &quot; but it ended up being &quot;, fastPathJIT.m_assembler.codeSize(), &quot; prior to compaction.\n&quot;);
+            RELEASE_ASSERT_NOT_REACHED();
+        }
</ins><span class="cx">         
</span><span class="cx">         MacroAssembler::AssemblerType_T::fillNops(
</span><span class="cx">             startOfIC + linkBuffer.size(), sizeOfCall() - linkBuffer.size());
</span><span class="cx">         
</span><del>-        CallLinkInfo&amp; info = codeBlock-&gt;callLinkInfo(i);
-        call.link(vm, linkBuffer, info);
</del><ins>+        call.link(vm, linkBuffer);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     RepatchBuffer repatchBuffer(codeBlock);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLInlineCacheSizecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx"> #if CPU(ARM64)
</span><span class="cx">     return 44;
</span><span class="cx"> #else
</span><del>-    return 43;
</del><ins>+    return 53;
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLJSCallcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLJSCall.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLJSCall.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/ftl/FTLJSCall.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -34,7 +34,8 @@
</span><span class="cx"> 
</span><span class="cx"> JSCall::JSCall()
</span><span class="cx">     : m_stackmapID(UINT_MAX)
</span><del>-    , m_node(0)
</del><ins>+    , m_node(nullptr)
+    , m_callLinkInfo(nullptr)
</ins><span class="cx">     , m_instructionOffset(UINT_MAX)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -42,12 +43,15 @@
</span><span class="cx"> JSCall::JSCall(unsigned stackmapID, DFG::Node* node)
</span><span class="cx">     : m_stackmapID(stackmapID)
</span><span class="cx">     , m_node(node)
</span><ins>+    , m_callLinkInfo(nullptr)
</ins><span class="cx">     , m_instructionOffset(0)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSCall::emit(CCallHelpers&amp; jit)
</span><span class="cx"> {
</span><ins>+    m_callLinkInfo = jit.codeBlock()-&gt;addCallLinkInfo();
+    
</ins><span class="cx">     CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
</span><span class="cx">         CCallHelpers::NotEqual, GPRInfo::regT0, m_targetToCheck,
</span><span class="cx">         CCallHelpers::TrustedImmPtr(0));
</span><span class="lines">@@ -65,12 +69,14 @@
</span><span class="cx">     CCallHelpers::Jump done = jit.jump();
</span><span class="cx">     
</span><span class="cx">     slowPath.link(&amp;jit);
</span><ins>+    
+    jit.move(CCallHelpers::TrustedImmPtr(m_callLinkInfo), GPRInfo::regT2);
</ins><span class="cx">     m_slowCall = jit.nearCall();
</span><span class="cx">     
</span><span class="cx">     done.link(&amp;jit);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JSCall::link(VM&amp; vm, LinkBuffer&amp; linkBuffer, CallLinkInfo&amp; callInfo)
</del><ins>+void JSCall::link(VM&amp; vm, LinkBuffer&amp; linkBuffer)
</ins><span class="cx"> {
</span><span class="cx">     ThunkGenerator generator = linkThunkGeneratorFor(
</span><span class="cx">         m_node-&gt;op() == DFG::Construct ? CodeForConstruct : CodeForCall,
</span><span class="lines">@@ -79,13 +85,13 @@
</span><span class="cx">     linkBuffer.link(
</span><span class="cx">         m_slowCall, FunctionPtr(vm.getCTIStub(generator).code().executableAddress()));
</span><span class="cx">     
</span><del>-    callInfo.isFTL = true;
-    callInfo.callType = m_node-&gt;op() == DFG::Construct ? CallLinkInfo::Construct : CallLinkInfo::Call;
-    callInfo.codeOrigin = m_node-&gt;origin.semantic;
-    callInfo.callReturnLocation = linkBuffer.locationOfNearCall(m_slowCall);
-    callInfo.hotPathBegin = linkBuffer.locationOf(m_targetToCheck);
-    callInfo.hotPathOther = linkBuffer.locationOfNearCall(m_fastCall);
-    callInfo.calleeGPR = GPRInfo::regT0;
</del><ins>+    m_callLinkInfo-&gt;isFTL = true;
+    m_callLinkInfo-&gt;callType = m_node-&gt;op() == DFG::Construct ? CallLinkInfo::Construct : CallLinkInfo::Call;
+    m_callLinkInfo-&gt;codeOrigin = m_node-&gt;origin.semantic;
+    m_callLinkInfo-&gt;callReturnLocation = linkBuffer.locationOfNearCall(m_slowCall);
+    m_callLinkInfo-&gt;hotPathBegin = linkBuffer.locationOf(m_targetToCheck);
+    m_callLinkInfo-&gt;hotPathOther = linkBuffer.locationOfNearCall(m_fastCall);
+    m_callLinkInfo-&gt;calleeGPR = GPRInfo::regT0;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::FTL
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLJSCallh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLJSCall.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLJSCall.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/ftl/FTLJSCall.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">     JSCall(unsigned stackmapID, DFG::Node*);
</span><span class="cx">     
</span><span class="cx">     void emit(CCallHelpers&amp;);
</span><del>-    void link(VM&amp;, LinkBuffer&amp;, CallLinkInfo&amp;);
</del><ins>+    void link(VM&amp;, LinkBuffer&amp;);
</ins><span class="cx">     
</span><span class="cx">     unsigned stackmapID() const { return m_stackmapID; }
</span><span class="cx">     
</span><span class="lines">@@ -62,6 +62,7 @@
</span><span class="cx">     CCallHelpers::DataLabelPtr m_targetToCheck;
</span><span class="cx">     CCallHelpers::Call m_fastCall;
</span><span class="cx">     CCallHelpers::Call m_slowCall;
</span><ins>+    CallLinkInfo* m_callLinkInfo;
</ins><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     uint32_t m_instructionOffset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2009, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -294,7 +294,7 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RELEASE_ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
</del><ins>+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
</ins><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx">     // Reset this, in order to guard its use with ASSERTs.
</span><span class="lines">@@ -425,7 +425,7 @@
</span><span class="cx"> 
</span><span class="cx">     RELEASE_ASSERT(m_getByIdIndex == m_getByIds.size());
</span><span class="cx">     RELEASE_ASSERT(m_putByIdIndex == m_putByIds.size());
</span><del>-    RELEASE_ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
</del><ins>+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
</ins><span class="cx">     RELEASE_ASSERT(numberOfValueProfiles == m_codeBlock-&gt;numberOfValueProfiles());
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -643,15 +643,12 @@
</span><span class="cx">             differenceBetweenCodePtr(badTypeJump, doneTarget),
</span><span class="cx">             differenceBetweenCodePtr(returnAddress, slowPathTarget));
</span><span class="cx">     }
</span><del>-    m_codeBlock-&gt;setNumberOfCallLinkInfos(m_callStructureStubCompilationInfo.size());
-    for (unsigned i = 0; i &lt; m_codeBlock-&gt;numberOfCallLinkInfos(); ++i) {
-        CallLinkInfo&amp; info = m_codeBlock-&gt;callLinkInfo(i);
-        info.callType = m_callStructureStubCompilationInfo[i].callType;
-        info.codeOrigin = CodeOrigin(m_callStructureStubCompilationInfo[i].bytecodeIndex);
-        info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
-        info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
-        info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
-        info.calleeGPR = regT0;
</del><ins>+    for (unsigned i = 0; i &lt; m_callCompilationInfo.size(); ++i) {
+        CallCompilationInfo&amp; compilationInfo = m_callCompilationInfo[i];
+        CallLinkInfo&amp; info = *compilationInfo.callLinkInfo;
+        info.callReturnLocation = patchBuffer.locationOfNearCall(compilationInfo.callReturnLocation);
+        info.hotPathBegin = patchBuffer.locationOf(compilationInfo.hotPathBegin);
+        info.hotPathOther = patchBuffer.locationOfNearCall(compilationInfo.hotPathOther);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     CompactJITCodeMap::Encoder jitCodeMapEncoder;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JIT.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -167,12 +167,11 @@
</span><span class="cx">         MacroAssembler::Call returnAddress;
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    struct StructureStubCompilationInfo {
</del><ins>+    struct CallCompilationInfo {
</ins><span class="cx">         MacroAssembler::DataLabelPtr hotPathBegin;
</span><span class="cx">         MacroAssembler::Call hotPathOther;
</span><span class="cx">         MacroAssembler::Call callReturnLocation;
</span><del>-        CallLinkInfo::CallType callType;
-        unsigned bytecodeIndex;
</del><ins>+        CallLinkInfo* callLinkInfo;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     // Near calls can only be patched to other JIT code, regular calls can be patched to JIT code or relinked to stub functions.
</span><span class="lines">@@ -795,7 +794,7 @@
</span><span class="cx">         Vector&lt;JITGetByIdGenerator&gt; m_getByIds;
</span><span class="cx">         Vector&lt;JITPutByIdGenerator&gt; m_putByIds;
</span><span class="cx">         Vector&lt;ByValCompilationInfo&gt; m_byValCompilationInfo;
</span><del>-        Vector&lt;StructureStubCompilationInfo&gt; m_callStructureStubCompilationInfo;
</del><ins>+        Vector&lt;CallCompilationInfo&gt; m_callCompilationInfo;
</ins><span class="cx">         Vector&lt;JumpTable&gt; m_jmpTable;
</span><span class="cx"> 
</span><span class="cx">         unsigned m_bytecodeOffset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITCallcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITCall.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITCall.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JITCall.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -157,6 +157,7 @@
</span><span class="cx">     linkSlowCase(iter);
</span><span class="cx"> 
</span><span class="cx">     load64(Address(stackPointerRegister, sizeof(Register) * JSStack::Callee - sizeof(CallerFrameAndPC)), regT0);
</span><ins>+    move(TrustedImmPtr(&amp;CallLinkInfo::dummy()), regT2);
</ins><span class="cx">     emitNakedCall(m_vm-&gt;getCTIStub(virtualCallThunkGenerator).code());
</span><span class="cx">     addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
</span><span class="cx">     checkStackPointerAlignment();
</span><span class="lines">@@ -219,16 +220,19 @@
</span><span class="cx">     Jump slowCase = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(0));
</span><span class="cx">     addSlowCase(slowCase);
</span><span class="cx"> 
</span><del>-    ASSERT(m_callStructureStubCompilationInfo.size() == callLinkInfoIndex);
-    m_callStructureStubCompilationInfo.append(StructureStubCompilationInfo());
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callType = CallLinkInfo::callTypeFor(opcodeID);
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].bytecodeIndex = m_bytecodeOffset;
</del><ins>+    ASSERT(m_callCompilationInfo.size() == callLinkInfoIndex);
+    CallLinkInfo* info = m_codeBlock-&gt;addCallLinkInfo();
+    info-&gt;callType = CallLinkInfo::callTypeFor(opcodeID);
+    info-&gt;codeOrigin = CodeOrigin(m_bytecodeOffset);
+    info-&gt;calleeGPR = regT0;
+    m_callCompilationInfo.append(CallCompilationInfo());
+    m_callCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
+    m_callCompilationInfo[callLinkInfoIndex].callLinkInfo = info;
</ins><span class="cx"> 
</span><span class="cx">     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT2);
</span><span class="cx">     store64(regT2, Address(MacroAssembler::stackPointerRegister, JSStack::ScopeChain * sizeof(Register) - sizeof(CallerFrameAndPC)));
</span><span class="cx"> 
</span><del>-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
</del><ins>+    m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
</ins><span class="cx"> 
</span><span class="cx">     addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
</span><span class="cx">     checkStackPointerAlignment();
</span><span class="lines">@@ -251,7 +255,8 @@
</span><span class="cx">         opcodeID == op_construct ? CodeForConstruct : CodeForCall,
</span><span class="cx">         RegisterPreservationNotRequired);
</span><span class="cx">     
</span><del>-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm-&gt;getCTIStub(generator).code());
</del><ins>+    move(TrustedImmPtr(m_callCompilationInfo[callLinkInfoIndex].callLinkInfo), regT2);
+    m_callCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm-&gt;getCTIStub(generator).code());
</ins><span class="cx"> 
</span><span class="cx">     addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
</span><span class="cx">     checkStackPointerAlignment();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITCall32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITCall32_64.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITCall32_64.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JITCall32_64.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -233,6 +233,7 @@
</span><span class="cx"> 
</span><span class="cx">     loadPtr(Address(stackPointerRegister, sizeof(Register) * JSStack::Callee - sizeof(CallerFrameAndPC)), regT0);
</span><span class="cx">     loadPtr(Address(stackPointerRegister, sizeof(Register) * JSStack::Callee - sizeof(CallerFrameAndPC)), regT1);
</span><ins>+    move(TrustedImmPtr(&amp;CallLinkInfo::dummy()), regT2);
</ins><span class="cx"> 
</span><span class="cx">     emitLoad(JSStack::Callee, regT1, regT0);
</span><span class="cx">     emitNakedCall(m_vm-&gt;getCTIStub(virtualCallThunkGenerator).code());
</span><span class="lines">@@ -299,18 +300,21 @@
</span><span class="cx">     addSlowCase(slowCase);
</span><span class="cx">     addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
</span><span class="cx"> 
</span><del>-    ASSERT(m_callStructureStubCompilationInfo.size() == callLinkInfoIndex);
-    m_callStructureStubCompilationInfo.append(StructureStubCompilationInfo());
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callType = CallLinkInfo::callTypeFor(opcodeID);
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].bytecodeIndex = m_bytecodeOffset;
</del><ins>+    ASSERT(m_callCompilationInfo.size() == callLinkInfoIndex);
+    CallLinkInfo* info = m_codeBlock-&gt;addCallLinkInfo();
+    info-&gt;callType = CallLinkInfo::callTypeFor(opcodeID);
+    info-&gt;codeOrigin = CodeOrigin(m_bytecodeOffset);
+    info-&gt;calleeGPR = regT0;
+    m_callCompilationInfo.append(CallCompilationInfo());
+    m_callCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
+    m_callCompilationInfo[callLinkInfoIndex].callLinkInfo = info;
</ins><span class="cx"> 
</span><span class="cx">     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT2);
</span><span class="cx">     store32(regT2, Address(MacroAssembler::stackPointerRegister, JSStack::ScopeChain * sizeof(Register) + PayloadOffset - sizeof(CallerFrameAndPC)));
</span><span class="cx">     store32(TrustedImm32(JSValue::CellTag), Address(stackPointerRegister, JSStack::ScopeChain * sizeof(Register) + TagOffset - sizeof(CallerFrameAndPC)));
</span><span class="cx"> 
</span><span class="cx">     checkStackPointerAlignment();
</span><del>-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
</del><ins>+    m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
</ins><span class="cx"> 
</span><span class="cx">     addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
</span><span class="cx">     checkStackPointerAlignment();
</span><span class="lines">@@ -333,7 +337,8 @@
</span><span class="cx">         opcodeID == op_construct ? CodeForConstruct : CodeForCall,
</span><span class="cx">         RegisterPreservationNotRequired);
</span><span class="cx">     
</span><del>-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm-&gt;getCTIStub(generator).code());
</del><ins>+    move(TrustedImmPtr(m_callCompilationInfo[callLinkInfoIndex].callLinkInfo), regT2);
+    m_callCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm-&gt;getCTIStub(generator).code());
</ins><span class="cx"> 
</span><span class="cx">     addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
</span><span class="cx">     checkStackPointerAlignment();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -674,7 +674,8 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline char* linkFor(
</span><del>-    ExecState* execCallee, CodeSpecializationKind kind, RegisterPreservationMode registers)
</del><ins>+    ExecState* execCallee, CallLinkInfo* callLinkInfo, CodeSpecializationKind kind,
+    RegisterPreservationMode registers)
</ins><span class="cx"> {
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="lines">@@ -692,7 +693,6 @@
</span><span class="cx"> 
</span><span class="cx">     MacroAssemblerCodePtr codePtr;
</span><span class="cx">     CodeBlock* codeBlock = 0;
</span><del>-    CallLinkInfo&amp; callLinkInfo = exec-&gt;codeBlock()-&gt;getCallLinkInfo(execCallee-&gt;returnPC());
</del><span class="cx">     if (executable-&gt;isHostFunction())
</span><span class="cx">         codePtr = executable-&gt;entrypointFor(*vm, kind, MustCheckArity, registers);
</span><span class="cx">     else {
</span><span class="lines">@@ -705,37 +705,37 @@
</span><span class="cx">         }
</span><span class="cx">         codeBlock = functionExecutable-&gt;codeBlockFor(kind);
</span><span class="cx">         ArityCheckMode arity;
</span><del>-        if (execCallee-&gt;argumentCountIncludingThis() &lt; static_cast&lt;size_t&gt;(codeBlock-&gt;numParameters()) || callLinkInfo.callType == CallLinkInfo::CallVarargs)
</del><ins>+        if (execCallee-&gt;argumentCountIncludingThis() &lt; static_cast&lt;size_t&gt;(codeBlock-&gt;numParameters()) || callLinkInfo-&gt;callType == CallLinkInfo::CallVarargs)
</ins><span class="cx">             arity = MustCheckArity;
</span><span class="cx">         else
</span><span class="cx">             arity = ArityCheckNotRequired;
</span><span class="cx">         codePtr = functionExecutable-&gt;entrypointFor(*vm, kind, arity, registers);
</span><span class="cx">     }
</span><del>-    if (!callLinkInfo.seenOnce())
-        callLinkInfo.setSeen();
</del><ins>+    if (!callLinkInfo-&gt;seenOnce())
+        callLinkInfo-&gt;setSeen();
</ins><span class="cx">     else
</span><del>-        linkFor(execCallee, callLinkInfo, codeBlock, callee, codePtr, kind, registers);
</del><ins>+        linkFor(execCallee, *callLinkInfo, codeBlock, callee, codePtr, kind, registers);
</ins><span class="cx">     return reinterpret_cast&lt;char*&gt;(codePtr.executableAddress());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkCall(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><del>-    return linkFor(execCallee, CodeForCall, RegisterPreservationNotRequired);
</del><ins>+    return linkFor(execCallee, callLinkInfo, CodeForCall, RegisterPreservationNotRequired);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkConstruct(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkConstruct(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><del>-    return linkFor(execCallee, CodeForConstruct, RegisterPreservationNotRequired);
</del><ins>+    return linkFor(execCallee, callLinkInfo, CodeForConstruct, RegisterPreservationNotRequired);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkCallThatPreservesRegs(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkCallThatPreservesRegs(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><del>-    return linkFor(execCallee, CodeForCall, MustPreserveRegisters);
</del><ins>+    return linkFor(execCallee, callLinkInfo, CodeForCall, MustPreserveRegisters);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkConstructThatPreservesRegs(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkConstructThatPreservesRegs(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><del>-    return linkFor(execCallee, CodeForConstruct, MustPreserveRegisters);
</del><ins>+    return linkFor(execCallee, callLinkInfo, CodeForConstruct, MustPreserveRegisters);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline char* virtualForWithFunction(
</span><span class="lines">@@ -813,46 +813,44 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkClosureCall(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkClosureCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><span class="cx">     JSCell* calleeAsFunctionCell;
</span><span class="cx">     char* result = virtualForWithFunction(execCallee, CodeForCall, RegisterPreservationNotRequired, calleeAsFunctionCell);
</span><del>-    CallLinkInfo&amp; callLinkInfo = execCallee-&gt;callerFrame()-&gt;codeBlock()-&gt;getCallLinkInfo(execCallee-&gt;returnPC());
</del><span class="cx"> 
</span><del>-    if (!attemptToOptimizeClosureCall(execCallee, RegisterPreservationNotRequired, calleeAsFunctionCell, callLinkInfo))
-        linkSlowFor(execCallee, callLinkInfo, CodeForCall, RegisterPreservationNotRequired);
</del><ins>+    if (!attemptToOptimizeClosureCall(execCallee, RegisterPreservationNotRequired, calleeAsFunctionCell, *callLinkInfo))
+        linkSlowFor(execCallee, *callLinkInfo, CodeForCall, RegisterPreservationNotRequired);
</ins><span class="cx">     
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationVirtualCall(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationVirtualCall(ExecState* execCallee, CallLinkInfo*)
</ins><span class="cx"> {    
</span><span class="cx">     return virtualFor(execCallee, CodeForCall, RegisterPreservationNotRequired);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationVirtualConstruct(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationVirtualConstruct(ExecState* execCallee, CallLinkInfo*)
</ins><span class="cx"> {
</span><span class="cx">     return virtualFor(execCallee, CodeForConstruct, RegisterPreservationNotRequired);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationLinkClosureCallThatPreservesRegs(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationLinkClosureCallThatPreservesRegs(ExecState* execCallee, CallLinkInfo* callLinkInfo)
</ins><span class="cx"> {
</span><span class="cx">     JSCell* calleeAsFunctionCell;
</span><span class="cx">     char* result = virtualForWithFunction(execCallee, CodeForCall, MustPreserveRegisters, calleeAsFunctionCell);
</span><del>-    CallLinkInfo&amp; callLinkInfo = execCallee-&gt;callerFrame()-&gt;codeBlock()-&gt;getCallLinkInfo(execCallee-&gt;returnPC());
</del><span class="cx"> 
</span><del>-    if (!attemptToOptimizeClosureCall(execCallee, MustPreserveRegisters, calleeAsFunctionCell, callLinkInfo))
-        linkSlowFor(execCallee, callLinkInfo, CodeForCall, MustPreserveRegisters);
</del><ins>+    if (!attemptToOptimizeClosureCall(execCallee, MustPreserveRegisters, calleeAsFunctionCell, *callLinkInfo))
+        linkSlowFor(execCallee, *callLinkInfo, CodeForCall, MustPreserveRegisters);
</ins><span class="cx">     
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationVirtualCallThatPreservesRegs(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationVirtualCallThatPreservesRegs(ExecState* execCallee, CallLinkInfo*)
</ins><span class="cx"> {    
</span><span class="cx">     return virtualFor(execCallee, CodeForCall, MustPreserveRegisters);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-char* JIT_OPERATION operationVirtualConstructThatPreservesRegs(ExecState* execCallee)
</del><ins>+char* JIT_OPERATION operationVirtualConstructThatPreservesRegs(ExecState* execCallee, CallLinkInfo*)
</ins><span class="cx"> {
</span><span class="cx">     return virtualFor(execCallee, CodeForConstruct, MustPreserveRegisters);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.h (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.h        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.h        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -60,6 +60,7 @@
</span><span class="cx">     Aap: ArrayAllocationProfile*
</span><span class="cx">     C: JSCell*
</span><span class="cx">     Cb: CodeBlock*
</span><ins>+    Cli: CallLinkInfo*
</ins><span class="cx">     D: double
</span><span class="cx">     E: ExecState*
</span><span class="cx">     F: CallFrame*
</span><span class="lines">@@ -168,6 +169,7 @@
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EVm)(ExecState*, VM*);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_E)(ExecState*);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_EC)(ExecState*, JSCell*);
</span><ins>+typedef char* JIT_OPERATION (*P_JITOperation_ECli)(ExecState*, CallLinkInfo*);
</ins><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_EJS)(ExecState*, EncodedJSValue, size_t);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_EO)(ExecState*, JSObject*);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_EOS)(ExecState*, JSObject*, size_t);
</span><span class="lines">@@ -218,16 +220,16 @@
</span><span class="cx"> void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationCallEval(ExecState*, ExecState*) WTF_INTERNAL;
</span><del>-char* JIT_OPERATION operationLinkCall(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationLinkClosureCall(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationVirtualCall(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationVirtualConstruct(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationLinkConstruct(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationLinkCallThatPreservesRegs(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationLinkClosureCallThatPreservesRegs(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationVirtualCallThatPreservesRegs(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationVirtualConstructThatPreservesRegs(ExecState*) WTF_INTERNAL;
-char* JIT_OPERATION operationLinkConstructThatPreservesRegs(ExecState*) WTF_INTERNAL;
</del><ins>+char* JIT_OPERATION operationLinkCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationLinkClosureCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationVirtualCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationVirtualConstruct(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationLinkConstruct(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationLinkCallThatPreservesRegs(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationLinkClosureCallThatPreservesRegs(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationVirtualCallThatPreservesRegs(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationVirtualConstructThatPreservesRegs(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+char* JIT_OPERATION operationLinkConstructThatPreservesRegs(ExecState*, CallLinkInfo*) WTF_INTERNAL;
</ins><span class="cx"> 
</span><span class="cx"> size_t JIT_OPERATION operationCompareLess(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> size_t JIT_OPERATION operationCompareLessEq(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
</span><span class="lines">@@ -297,7 +299,7 @@
</span><span class="cx"> 
</span><span class="cx"> } // extern &quot;C&quot;
</span><span class="cx"> 
</span><del>-inline P_JITOperation_E operationLinkFor(
</del><ins>+inline P_JITOperation_ECli operationLinkFor(
</ins><span class="cx">     CodeSpecializationKind kind, RegisterPreservationMode registers)
</span><span class="cx"> {
</span><span class="cx">     switch (kind) {
</span><span class="lines">@@ -322,7 +324,7 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline P_JITOperation_E operationVirtualFor(
</del><ins>+inline P_JITOperation_ECli operationVirtualFor(
</ins><span class="cx">     CodeSpecializationKind kind, RegisterPreservationMode registers)
</span><span class="cx"> {
</span><span class="cx">     switch (kind) {
</span><span class="lines">@@ -347,7 +349,7 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline P_JITOperation_E operationLinkClosureCallFor(RegisterPreservationMode registers)
</del><ins>+inline P_JITOperation_ECli operationLinkClosureCallFor(RegisterPreservationMode registers)
</ins><span class="cx"> {
</span><span class="cx">     switch (registers) {
</span><span class="cx">     case RegisterPreservationNotRequired:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRepatchcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/Repatch.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -1452,9 +1452,10 @@
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx">     stubJit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), GPRInfo::regT1);
</span><span class="cx"> #endif
</span><del>-    stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::regT2);
</del><ins>+    stubJit.move(CCallHelpers::TrustedImmPtr(&amp;callLinkInfo), GPRInfo::regT2);
+    stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::regT4);
</ins><span class="cx">     
</span><del>-    stubJit.restoreReturnAddressBeforeReturn(GPRInfo::regT2);
</del><ins>+    stubJit.restoreReturnAddressBeforeReturn(GPRInfo::regT4);
</ins><span class="cx">     AssemblyHelpers::Jump slow = stubJit.jump();
</span><span class="cx">     
</span><span class="cx">     LinkBuffer patchBuffer(*vm, &amp;stubJit, callerCodeBlock);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitThunkGeneratorscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp (166134 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp        2014-03-23 02:43:52 UTC (rev 166134)
+++ trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -79,13 +79,13 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void slowPathFor(
</span><del>-    CCallHelpers&amp; jit, VM* vm, P_JITOperation_E slowPathFunction)
</del><ins>+    CCallHelpers&amp; jit, VM* vm, P_JITOperation_ECli slowPathFunction)
</ins><span class="cx"> {
</span><span class="cx">     jit.emitFunctionPrologue();
</span><span class="cx">     jit.storePtr(GPRInfo::callFrameRegister, &amp;vm-&gt;topCallFrame);
</span><span class="cx">     if (maxFrameExtentForSlowPathCall)
</span><span class="cx">         jit.addPtr(CCallHelpers::TrustedImm32(-maxFrameExtentForSlowPathCall), CCallHelpers::stackPointerRegister);
</span><del>-    jit.setupArgumentsExecState();
</del><ins>+    jit.setupArgumentsWithExecState(GPRInfo::regT2);
</ins><span class="cx">     jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast&lt;void*&gt;(slowPathFunction)), GPRInfo::nonArgGPR0);
</span><span class="cx">     emitPointerValidation(jit, GPRInfo::nonArgGPR0);
</span><span class="cx">     jit.call(GPRInfo::nonArgGPR0);
</span><span class="lines">@@ -174,39 +174,45 @@
</span><span class="cx">     CCallHelpers jit(vm);
</span><span class="cx">     
</span><span class="cx">     CCallHelpers::JumpList slowCase;
</span><ins>+    
+    // This is a slow path execution, and regT2 contains the CallLinkInfo. Count the
+    // slow path execution for the profiler.
+    jit.add32(
+        CCallHelpers::TrustedImm32(1),
+        CCallHelpers::Address(GPRInfo::regT2, OBJECT_OFFSETOF(CallLinkInfo, slowPathCount)));
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: we should have a story for eliminating these checks. In many cases,
</span><span class="cx">     // the DFG knows that the value is definitely a cell, or definitely a function.
</span><span class="cx">     
</span><span class="cx"> #if USE(JSVALUE64)
</span><del>-    jit.move(CCallHelpers::TrustedImm64(TagMask), GPRInfo::regT2);
</del><ins>+    jit.move(CCallHelpers::TrustedImm64(TagMask), GPRInfo::regT4);
</ins><span class="cx">     
</span><span class="cx">     slowCase.append(
</span><span class="cx">         jit.branchTest64(
</span><del>-            CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::regT2));
</del><ins>+            CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::regT4));
</ins><span class="cx"> #else
</span><span class="cx">     slowCase.append(
</span><span class="cx">         jit.branch32(
</span><span class="cx">             CCallHelpers::NotEqual, GPRInfo::regT1,
</span><span class="cx">             CCallHelpers::TrustedImm32(JSValue::CellTag)));
</span><span class="cx"> #endif
</span><del>-    AssemblyHelpers::emitLoadStructure(jit, GPRInfo::regT0, GPRInfo::regT2, GPRInfo::regT1);
</del><ins>+    AssemblyHelpers::emitLoadStructure(jit, GPRInfo::regT0, GPRInfo::regT4, GPRInfo::regT1);
</ins><span class="cx">     slowCase.append(
</span><span class="cx">         jit.branchPtr(
</span><span class="cx">             CCallHelpers::NotEqual,
</span><del>-            CCallHelpers::Address(GPRInfo::regT2, Structure::classInfoOffset()),
</del><ins>+            CCallHelpers::Address(GPRInfo::regT4, Structure::classInfoOffset()),
</ins><span class="cx">             CCallHelpers::TrustedImmPtr(JSFunction::info())));
</span><span class="cx">     
</span><span class="cx">     // Now we know we have a JSFunction.
</span><span class="cx">     
</span><span class="cx">     jit.loadPtr(
</span><span class="cx">         CCallHelpers::Address(GPRInfo::regT0, JSFunction::offsetOfExecutable()),
</span><del>-        GPRInfo::regT2);
</del><ins>+        GPRInfo::regT4);
</ins><span class="cx">     jit.loadPtr(
</span><span class="cx">         CCallHelpers::Address(
</span><del>-            GPRInfo::regT2, ExecutableBase::offsetOfJITCodeWithArityCheckFor(kind, registers)),
-        GPRInfo::regT2);
-    slowCase.append(jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::regT2));
</del><ins>+            GPRInfo::regT4, ExecutableBase::offsetOfJITCodeWithArityCheckFor(kind, registers)),
+        GPRInfo::regT4);
+    slowCase.append(jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::regT4));
</ins><span class="cx">     
</span><span class="cx">     // Now we know that we have a CodeBlock, and we're committed to making a fast
</span><span class="cx">     // call.
</span><span class="lines">@@ -223,8 +229,8 @@
</span><span class="cx"> #endif
</span><span class="cx">     
</span><span class="cx">     // Make a tail call. This will return back to JIT code.
</span><del>-    emitPointerValidation(jit, GPRInfo::regT2);
-    jit.jump(GPRInfo::regT2);
</del><ins>+    emitPointerValidation(jit, GPRInfo::regT4);
+    jit.jump(GPRInfo::regT4);
</ins><span class="cx"> 
</span><span class="cx">     slowCase.link(&amp;jit);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressevalthatisnotevaljs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/eval-that-is-not-eval.js (0 => 166135)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/eval-that-is-not-eval.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/eval-that-is-not-eval.js        2014-03-23 04:34:38 UTC (rev 166135)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+function foo(a) {
+    return eval(a);
+}
+
+noInline(foo);
+
+eval = function(a) { return a + 1; }
+
+for (var i = 0; i &lt; 10000; ++i) {
+    var result = foo(42);
+    if (result != 43)
+        throw &quot;Error: bad result: &quot; + result;
+}
+
</ins></span></pre>
</div>
</div>

</body>
</html>