<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[195620] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/195620">195620</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-01-26 14:05:28 -0800 (Tue, 26 Jan 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>The thing that B3 uses to describe a stack slot should not be a Value
https://bugs.webkit.org/show_bug.cgi?id=153491
rdar://problem/24349446

Reviewed by Geoffrey Garen and Saam Barati.

Prior to this change, B3 represented stack slots by having a StackSlotValue that carried
two meanings:

- It represented a stack slot.

- It was a kind of Value for getting the base of the stack slot.

This seems like a good idea until you consider the following issues.

1) A Value can be killed if it is on an unreachable path, or if it has no effects and
   nobody refers to it. But the FTL uses StackSlotValue to allocate space on the stack.
   When it does this, it doesn't want it to be killed. It will dereference the object, so
   killing it is a bug.

2) A premise of B3 is that it should be always legal to perform the following
   transformation on a value:

   value-&gt;replaceWithIdentity(insertionSet.insertValue(index, proc.clone(value)));

   This inserts a new value just before the old one. The new value is a clone of the old
   one. Then the old one is essentially deleted (anything that becomes an identity dies
   shortly thereafter). Problem (1) prevents this from being legal, which breaks a major
   premise of B3 IR.

3) A premise of B3 is that it should be always legal to perform the following
   transformation on a value:

   Before:
           @42 = Thing(...)

   After:
           Branch(@doesntMatter, #yes, #no)
       BB#yes:
           @42_one = Thing(...)
           Upsilon(@42_one, ^42)
           Jump(#done)
       BB#no:
           @42_two = Thing(...)
           Upsilon(@42_two, ^42)
           Jump(#done)
       BB#done:
           @42 = Phi()

   But prior to this change, such a transformation makes absolutely no sense for
   StackSlot. It will &quot;work&quot; in the sense that the compiler will proceed undaunted, but
   it will disable SSA fix-up for the cloned stack slot and we will end up allocating two
   stack slots instead of one, and then we will assume that they both escape, which will
   disable efficient stack allocation. Note that the moral equivalent of this
   transformation could already happen due to tail duplication, and the only reason why
   it's not a bug right now is that we happen to hoist stack slots to the root block. But
   the whole point of our stack slots was supposed to be that they do not have to be
   hoisted.

This change fixes this issue by splitting StackSlotValue into two things: SlotBaseValue,
which is a pure operation for getting the base address of a StackSlot, and StackSlot,
which is a representation of the actual stack slot. StackSlot cannot get duplicated and
can only be killed if it's anonymous. SlotBaseValue can be killed, moved, cloned,
hoisted, etc. Since it has no effects and it has a ValueKey, it's one of the most
permissive Values in the IR, just as one would hope (after all, there is actually zero
code that needs to execute to evaluate SlotBaseValue).

This fixes a crash that we saw with GuardMalloc and ASan. It also makes the IR a lot more
easy to reason about.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* b3/B3EliminateCommonSubexpressions.cpp:
* b3/B3FixSSA.cpp:
(JSC::B3::demoteValues):
(JSC::B3::fixSSA):
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::run):
(JSC::B3::Air::LowerToAir::effectiveAddr):
(JSC::B3::Air::LowerToAir::lower):
* b3/B3Opcode.cpp:
(WTF::printInternal):
* b3/B3Opcode.h:
* b3/B3Procedure.cpp:
(JSC::B3::Procedure::setBlockOrderImpl):
(JSC::B3::Procedure::addStackSlot):
(JSC::B3::Procedure::addAnonymousStackSlot):
(JSC::B3::Procedure::clone):
(JSC::B3::Procedure::dump):
(JSC::B3::Procedure::blocksInPostOrder):
(JSC::B3::Procedure::deleteStackSlot):
(JSC::B3::Procedure::deleteValue):
(JSC::B3::Procedure::calleeSaveRegisters):
(JSC::B3::Procedure::addStackSlotIndex):
(JSC::B3::Procedure::addValueIndex):
* b3/B3Procedure.h:
(JSC::B3::Procedure::setBlockOrder):
(JSC::B3::Procedure::StackSlotsCollection::StackSlotsCollection):
(JSC::B3::Procedure::StackSlotsCollection::size):
(JSC::B3::Procedure::StackSlotsCollection::at):
(JSC::B3::Procedure::StackSlotsCollection::operator[]):
(JSC::B3::Procedure::StackSlotsCollection::iterator::iterator):
(JSC::B3::Procedure::StackSlotsCollection::iterator::operator*):
(JSC::B3::Procedure::StackSlotsCollection::iterator::operator++):
(JSC::B3::Procedure::StackSlotsCollection::iterator::operator==):
(JSC::B3::Procedure::StackSlotsCollection::iterator::operator!=):
(JSC::B3::Procedure::StackSlotsCollection::iterator::findNext):
(JSC::B3::Procedure::StackSlotsCollection::begin):
(JSC::B3::Procedure::StackSlotsCollection::end):
(JSC::B3::Procedure::stackSlots):
(JSC::B3::Procedure::ValuesCollection::ValuesCollection):
* b3/B3ReduceStrength.cpp:
* b3/B3SlotBaseValue.cpp: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.cpp.
(JSC::B3::SlotBaseValue::~SlotBaseValue):
(JSC::B3::SlotBaseValue::dumpMeta):
(JSC::B3::SlotBaseValue::cloneImpl):
(JSC::B3::StackSlotValue::~StackSlotValue): Deleted.
(JSC::B3::StackSlotValue::dumpMeta): Deleted.
(JSC::B3::StackSlotValue::cloneImpl): Deleted.
* b3/B3SlotBaseValue.h: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.h.
* b3/B3StackSlot.cpp: Added.
(JSC::B3::StackSlot::~StackSlot):
(JSC::B3::StackSlot::dump):
(JSC::B3::StackSlot::deepDump):
(JSC::B3::StackSlot::StackSlot):
* b3/B3StackSlot.h: Added.
(JSC::B3::StackSlot::byteSize):
(JSC::B3::StackSlot::kind):
(JSC::B3::StackSlot::isLocked):
(JSC::B3::StackSlot::index):
(JSC::B3::StackSlot::offsetFromFP):
(JSC::B3::StackSlot::setOffsetFromFP):
(JSC::B3::DeepStackSlotDump::DeepStackSlotDump):
(JSC::B3::DeepStackSlotDump::dump):
(JSC::B3::deepDump):
* b3/B3StackSlotValue.cpp: Removed.
* b3/B3StackSlotValue.h: Removed.
* b3/B3Validate.cpp:
* b3/B3Value.cpp:
(JSC::B3::Value::effects):
(JSC::B3::Value::key):
(JSC::B3::Value::checkOpcode):
* b3/B3ValueKey.cpp:
(JSC::B3::ValueKey::materialize):
* b3/air/AirCode.cpp:
(JSC::B3::Air::Code::addBlock):
(JSC::B3::Air::Code::addStackSlot):
(JSC::B3::Air::Code::addSpecial):
* b3/air/AirCode.h:
* b3/air/AirStackSlot.cpp:
(JSC::B3::Air::StackSlot::setOffsetFromFP):
(JSC::B3::Air::StackSlot::dump):
(JSC::B3::Air::StackSlot::deepDump):
(JSC::B3::Air::StackSlot::StackSlot):
* b3/air/AirStackSlot.h:
(JSC::B3::Air::StackSlot::alignment):
(JSC::B3::Air::StackSlot::b3Slot):
(JSC::B3::Air::StackSlot::offsetFromFP):
(WTF::printInternal):
(JSC::B3::Air::StackSlot::value): Deleted.
* b3/testb3.cpp:
(JSC::B3::testStackSlot):
(JSC::B3::testStoreLoadStackSlot):
* ftl/FTLB3Compile.cpp:
* ftl/FTLB3Output.cpp:
(JSC::FTL::Output::appendTo):
(JSC::FTL::Output::lockedStackSlot):
(JSC::FTL::Output::neg):
* ftl/FTLB3Output.h:
(JSC::FTL::Output::framePointer):
(JSC::FTL::Output::constBool):
(JSC::FTL::Output::constInt32):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::lower):
* ftl/FTLState.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3EliminateCommonSubexpressionscpp">trunk/Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3FixSSAcpp">trunk/Source/JavaScriptCore/b3/B3FixSSA.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3LowerToAircpp">trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Opcodecpp">trunk/Source/JavaScriptCore/b3/B3Opcode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Opcodeh">trunk/Source/JavaScriptCore/b3/B3Opcode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Procedurecpp">trunk/Source/JavaScriptCore/b3/B3Procedure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Procedureh">trunk/Source/JavaScriptCore/b3/B3Procedure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3ReduceStrengthcpp">trunk/Source/JavaScriptCore/b3/B3ReduceStrength.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Validatecpp">trunk/Source/JavaScriptCore/b3/B3Validate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Valuecpp">trunk/Source/JavaScriptCore/b3/B3Value.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3ValueKeycpp">trunk/Source/JavaScriptCore/b3/B3ValueKey.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirCodecpp">trunk/Source/JavaScriptCore/b3/air/AirCode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirCodeh">trunk/Source/JavaScriptCore/b3/air/AirCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirStackSlotcpp">trunk/Source/JavaScriptCore/b3/air/AirStackSlot.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirStackSloth">trunk/Source/JavaScriptCore/b3/air/AirStackSlot.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3testb3cpp">trunk/Source/JavaScriptCore/b3/testb3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLB3Compilecpp">trunk/Source/JavaScriptCore/ftl/FTLB3Compile.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLB3Outputcpp">trunk/Source/JavaScriptCore/ftl/FTLB3Output.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLB3Outputh">trunk/Source/JavaScriptCore/ftl/FTLB3Output.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLStateh">trunk/Source/JavaScriptCore/ftl/FTLState.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreb3B3SlotBaseValuecpp">trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3SlotBaseValueh">trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3StackSlotcpp">trunk/Source/JavaScriptCore/b3/B3StackSlot.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3StackSloth">trunk/Source/JavaScriptCore/b3/B3StackSlot.h</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreb3B3StackSlotValuecpp">trunk/Source/JavaScriptCore/b3/B3StackSlotValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3StackSlotValueh">trunk/Source/JavaScriptCore/b3/B3StackSlotValue.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -147,11 +147,12 @@
</span><span class="cx">     b3/B3ReduceDoubleToFloat.cpp
</span><span class="cx">     b3/B3ReduceStrength.cpp
</span><span class="cx">     b3/B3SSACalculator.cpp
</span><ins>+    b3/B3SlotBaseValue.cpp
</ins><span class="cx">     b3/B3StackmapGenerationParams.cpp
</span><span class="cx">     b3/B3StackmapSpecial.cpp
</span><span class="cx">     b3/B3StackmapValue.cpp
</span><span class="cx">     b3/B3StackSlotKind.cpp
</span><del>-    b3/B3StackSlotValue.cpp
</del><ins>+    b3/B3StackSlot.cpp
</ins><span class="cx">     b3/B3SwitchCase.cpp
</span><span class="cx">     b3/B3SwitchValue.cpp
</span><span class="cx">     b3/B3TimingScope.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,3 +1,181 @@
</span><ins>+2016-01-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        The thing that B3 uses to describe a stack slot should not be a Value
+        https://bugs.webkit.org/show_bug.cgi?id=153491
+        rdar://problem/24349446
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        Prior to this change, B3 represented stack slots by having a StackSlotValue that carried
+        two meanings:
+
+        - It represented a stack slot.
+
+        - It was a kind of Value for getting the base of the stack slot.
+
+        This seems like a good idea until you consider the following issues.
+
+        1) A Value can be killed if it is on an unreachable path, or if it has no effects and
+           nobody refers to it. But the FTL uses StackSlotValue to allocate space on the stack.
+           When it does this, it doesn't want it to be killed. It will dereference the object, so
+           killing it is a bug.
+
+        2) A premise of B3 is that it should be always legal to perform the following
+           transformation on a value:
+
+           value-&gt;replaceWithIdentity(insertionSet.insertValue(index, proc.clone(value)));
+
+           This inserts a new value just before the old one. The new value is a clone of the old
+           one. Then the old one is essentially deleted (anything that becomes an identity dies
+           shortly thereafter). Problem (1) prevents this from being legal, which breaks a major
+           premise of B3 IR.
+
+        3) A premise of B3 is that it should be always legal to perform the following
+           transformation on a value:
+
+           Before:
+                   @42 = Thing(...)
+
+           After:
+                   Branch(@doesntMatter, #yes, #no)
+               BB#yes:
+                   @42_one = Thing(...)
+                   Upsilon(@42_one, ^42)
+                   Jump(#done)
+               BB#no:
+                   @42_two = Thing(...)
+                   Upsilon(@42_two, ^42)
+                   Jump(#done)
+               BB#done:
+                   @42 = Phi()
+
+           But prior to this change, such a transformation makes absolutely no sense for
+           StackSlot. It will &quot;work&quot; in the sense that the compiler will proceed undaunted, but
+           it will disable SSA fix-up for the cloned stack slot and we will end up allocating two
+           stack slots instead of one, and then we will assume that they both escape, which will
+           disable efficient stack allocation. Note that the moral equivalent of this
+           transformation could already happen due to tail duplication, and the only reason why
+           it's not a bug right now is that we happen to hoist stack slots to the root block. But
+           the whole point of our stack slots was supposed to be that they do not have to be
+           hoisted.
+
+        This change fixes this issue by splitting StackSlotValue into two things: SlotBaseValue,
+        which is a pure operation for getting the base address of a StackSlot, and StackSlot,
+        which is a representation of the actual stack slot. StackSlot cannot get duplicated and
+        can only be killed if it's anonymous. SlotBaseValue can be killed, moved, cloned,
+        hoisted, etc. Since it has no effects and it has a ValueKey, it's one of the most
+        permissive Values in the IR, just as one would hope (after all, there is actually zero
+        code that needs to execute to evaluate SlotBaseValue).
+
+        This fixes a crash that we saw with GuardMalloc and ASan. It also makes the IR a lot more
+        easy to reason about.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3FixSSA.cpp:
+        (JSC::B3::demoteValues):
+        (JSC::B3::fixSSA):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::setBlockOrderImpl):
+        (JSC::B3::Procedure::addStackSlot):
+        (JSC::B3::Procedure::addAnonymousStackSlot):
+        (JSC::B3::Procedure::clone):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::blocksInPostOrder):
+        (JSC::B3::Procedure::deleteStackSlot):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::calleeSaveRegisters):
+        (JSC::B3::Procedure::addStackSlotIndex):
+        (JSC::B3::Procedure::addValueIndex):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setBlockOrder):
+        (JSC::B3::Procedure::StackSlotsCollection::StackSlotsCollection):
+        (JSC::B3::Procedure::StackSlotsCollection::size):
+        (JSC::B3::Procedure::StackSlotsCollection::at):
+        (JSC::B3::Procedure::StackSlotsCollection::operator[]):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::iterator):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator*):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator++):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator==):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator!=):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::findNext):
+        (JSC::B3::Procedure::StackSlotsCollection::begin):
+        (JSC::B3::Procedure::StackSlotsCollection::end):
+        (JSC::B3::Procedure::stackSlots):
+        (JSC::B3::Procedure::ValuesCollection::ValuesCollection):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SlotBaseValue.cpp: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.cpp.
+        (JSC::B3::SlotBaseValue::~SlotBaseValue):
+        (JSC::B3::SlotBaseValue::dumpMeta):
+        (JSC::B3::SlotBaseValue::cloneImpl):
+        (JSC::B3::StackSlotValue::~StackSlotValue): Deleted.
+        (JSC::B3::StackSlotValue::dumpMeta): Deleted.
+        (JSC::B3::StackSlotValue::cloneImpl): Deleted.
+        * b3/B3SlotBaseValue.h: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.h.
+        * b3/B3StackSlot.cpp: Added.
+        (JSC::B3::StackSlot::~StackSlot):
+        (JSC::B3::StackSlot::dump):
+        (JSC::B3::StackSlot::deepDump):
+        (JSC::B3::StackSlot::StackSlot):
+        * b3/B3StackSlot.h: Added.
+        (JSC::B3::StackSlot::byteSize):
+        (JSC::B3::StackSlot::kind):
+        (JSC::B3::StackSlot::isLocked):
+        (JSC::B3::StackSlot::index):
+        (JSC::B3::StackSlot::offsetFromFP):
+        (JSC::B3::StackSlot::setOffsetFromFP):
+        (JSC::B3::DeepStackSlotDump::DeepStackSlotDump):
+        (JSC::B3::DeepStackSlotDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3StackSlotValue.cpp: Removed.
+        * b3/B3StackSlotValue.h: Removed.
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::checkOpcode):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addBlock):
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        * b3/air/AirCode.h:
+        * b3/air/AirStackSlot.cpp:
+        (JSC::B3::Air::StackSlot::setOffsetFromFP):
+        (JSC::B3::Air::StackSlot::dump):
+        (JSC::B3::Air::StackSlot::deepDump):
+        (JSC::B3::Air::StackSlot::StackSlot):
+        * b3/air/AirStackSlot.h:
+        (JSC::B3::Air::StackSlot::alignment):
+        (JSC::B3::Air::StackSlot::b3Slot):
+        (JSC::B3::Air::StackSlot::offsetFromFP):
+        (WTF::printInternal):
+        (JSC::B3::Air::StackSlot::value): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testStackSlot):
+        (JSC::B3::testStoreLoadStackSlot):
+        * ftl/FTLB3Compile.cpp:
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::neg):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::framePointer):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        * ftl/FTLState.h:
+
</ins><span class="cx"> 2016-01-26  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Remove a useless #include
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -533,6 +533,8 @@
</span><span class="cx">                 0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329B14CA7DC10085F3C6 /* StructureSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F93B4A918B92C4D00178A3F /* PutByIdVariant.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */; };
</span><span class="cx">                 0F93B4AA18B92C4D00178A3F /* PutByIdVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0F9495871C57F47500413A48 /* B3StackSlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9495851C57F47500413A48 /* B3StackSlot.cpp */; };
+                0F9495881C57F47500413A48 /* B3StackSlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9495861C57F47500413A48 /* B3StackSlot.h */; };
</ins><span class="cx">                 0F952ABC1B487A7700C367C5 /* TrackedReferences.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F952ABA1B487A7700C367C5 /* TrackedReferences.cpp */; };
</span><span class="cx">                 0F952ABD1B487A7700C367C5 /* TrackedReferences.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F952ABB1B487A7700C367C5 /* TrackedReferences.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -832,8 +834,8 @@
</span><span class="cx">                 0FEC85311BDACDAC0080FF74 /* B3StackmapSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */; };
</span><span class="cx">                 0FEC85321BDACDAC0080FF74 /* B3StackSlotKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84E81BDACDAC0080FF74 /* B3StackSlotKind.cpp */; };
</span><span class="cx">                 0FEC85331BDACDAC0080FF74 /* B3StackSlotKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E91BDACDAC0080FF74 /* B3StackSlotKind.h */; };
</span><del>-                0FEC85341BDACDAC0080FF74 /* B3StackSlotValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84EA1BDACDAC0080FF74 /* B3StackSlotValue.cpp */; };
-                0FEC85351BDACDAC0080FF74 /* B3StackSlotValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EB1BDACDAC0080FF74 /* B3StackSlotValue.h */; };
</del><ins>+                0FEC85341BDACDAC0080FF74 /* B3SlotBaseValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */; };
+                0FEC85351BDACDAC0080FF74 /* B3SlotBaseValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */; };
</ins><span class="cx">                 0FEC85361BDACDAC0080FF74 /* B3SuccessorCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */; };
</span><span class="cx">                 0FEC85371BDACDAC0080FF74 /* B3SwitchCase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */; };
</span><span class="cx">                 0FEC85381BDACDAC0080FF74 /* B3SwitchCase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */; };
</span><span class="lines">@@ -2715,6 +2717,8 @@
</span><span class="cx">                 0F93329B14CA7DC10085F3C6 /* StructureSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureSet.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PutByIdVariant.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutByIdVariant.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0F9495851C57F47500413A48 /* B3StackSlot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackSlot.cpp; path = b3/B3StackSlot.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F9495861C57F47500413A48 /* B3StackSlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackSlot.h; path = b3/B3StackSlot.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0F952ABA1B487A7700C367C5 /* TrackedReferences.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TrackedReferences.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F952ABB1B487A7700C367C5 /* TrackedReferences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrackedReferences.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueProfile.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -3028,8 +3032,8 @@
</span><span class="cx">                 0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackmapSpecial.h; path = b3/B3StackmapSpecial.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FEC84E81BDACDAC0080FF74 /* B3StackSlotKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackSlotKind.cpp; path = b3/B3StackSlotKind.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FEC84E91BDACDAC0080FF74 /* B3StackSlotKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackSlotKind.h; path = b3/B3StackSlotKind.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                0FEC84EA1BDACDAC0080FF74 /* B3StackSlotValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackSlotValue.cpp; path = b3/B3StackSlotValue.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0FEC84EB1BDACDAC0080FF74 /* B3StackSlotValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackSlotValue.h; path = b3/B3StackSlotValue.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><ins>+                0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SlotBaseValue.cpp; path = b3/B3SlotBaseValue.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SlotBaseValue.h; path = b3/B3SlotBaseValue.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SuccessorCollection.h; path = b3/B3SuccessorCollection.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SwitchCase.cpp; path = b3/B3SwitchCase.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SwitchCase.h; path = b3/B3SwitchCase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4853,6 +4857,8 @@
</span><span class="cx">                                 43422A651C16221E00E2EB98 /* B3ReduceDoubleToFloat.h */,
</span><span class="cx">                                 0FEC85B71BE1462F0080FF74 /* B3ReduceStrength.cpp */,
</span><span class="cx">                                 0FEC85B81BE1462F0080FF74 /* B3ReduceStrength.h */,
</span><ins>+                                0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */,
+                                0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */,
</ins><span class="cx">                                 0F6B8ADA1C4EFAC300969052 /* B3SSACalculator.cpp */,
</span><span class="cx">                                 0F6B8ADB1C4EFAC300969052 /* B3SSACalculator.h */,
</span><span class="cx">                                 0F33FCF51C136E2500323F67 /* B3StackmapGenerationParams.cpp */,
</span><span class="lines">@@ -4861,10 +4867,10 @@
</span><span class="cx">                                 0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */,
</span><span class="cx">                                 0F338DEF1BE93AD10013C88F /* B3StackmapValue.cpp */,
</span><span class="cx">                                 0F338DF01BE93AD10013C88F /* B3StackmapValue.h */,
</span><ins>+                                0F9495851C57F47500413A48 /* B3StackSlot.cpp */,
+                                0F9495861C57F47500413A48 /* B3StackSlot.h */,
</ins><span class="cx">                                 0FEC84E81BDACDAC0080FF74 /* B3StackSlotKind.cpp */,
</span><span class="cx">                                 0FEC84E91BDACDAC0080FF74 /* B3StackSlotKind.h */,
</span><del>-                                0FEC84EA1BDACDAC0080FF74 /* B3StackSlotValue.cpp */,
-                                0FEC84EB1BDACDAC0080FF74 /* B3StackSlotValue.h */,
</del><span class="cx">                                 0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */,
</span><span class="cx">                                 0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */,
</span><span class="cx">                                 0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */,
</span><span class="lines">@@ -7112,7 +7118,7 @@
</span><span class="cx">                                 0FEC85BD1BE1462F0080FF74 /* B3ReduceStrength.h in Headers */,
</span><span class="cx">                                 0FEC85311BDACDAC0080FF74 /* B3StackmapSpecial.h in Headers */,
</span><span class="cx">                                 0FEC85331BDACDAC0080FF74 /* B3StackSlotKind.h in Headers */,
</span><del>-                                0FEC85351BDACDAC0080FF74 /* B3StackSlotValue.h in Headers */,
</del><ins>+                                0FEC85351BDACDAC0080FF74 /* B3SlotBaseValue.h in Headers */,
</ins><span class="cx">                                 0FEC85361BDACDAC0080FF74 /* B3SuccessorCollection.h in Headers */,
</span><span class="cx">                                 0FEC85381BDACDAC0080FF74 /* B3SwitchCase.h in Headers */,
</span><span class="cx">                                 0FEC853A1BDACDAC0080FF74 /* B3SwitchValue.h in Headers */,
</span><span class="lines">@@ -7223,6 +7229,7 @@
</span><span class="cx">                                 C218D1401655CFD50062BB81 /* CopyWorkList.h in Headers */,
</span><span class="cx">                                 C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */,
</span><span class="cx">                                 0F338E1C1BF286EA0013C88F /* B3BlockInsertionSet.h in Headers */,
</span><ins>+                                0F9495881C57F47500413A48 /* B3StackSlot.h in Headers */,
</ins><span class="cx">                                 C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */,
</span><span class="cx">                                 5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
</span><span class="cx">                                 9959E92B1BD17FA4001AA413 /* cssmin.py in Headers */,
</span><span class="lines">@@ -8807,7 +8814,7 @@
</span><span class="cx">                                 0FEC85BC1BE1462F0080FF74 /* B3ReduceStrength.cpp in Sources */,
</span><span class="cx">                                 0FEC85301BDACDAC0080FF74 /* B3StackmapSpecial.cpp in Sources */,
</span><span class="cx">                                 0FEC85321BDACDAC0080FF74 /* B3StackSlotKind.cpp in Sources */,
</span><del>-                                0FEC85341BDACDAC0080FF74 /* B3StackSlotValue.cpp in Sources */,
</del><ins>+                                0FEC85341BDACDAC0080FF74 /* B3SlotBaseValue.cpp in Sources */,
</ins><span class="cx">                                 0FEC85371BDACDAC0080FF74 /* B3SwitchCase.cpp in Sources */,
</span><span class="cx">                                 0FEC85391BDACDAC0080FF74 /* B3SwitchValue.cpp in Sources */,
</span><span class="cx">                                 0F4570401BE584CA0062A629 /* B3TimingScope.cpp in Sources */,
</span><span class="lines">@@ -9033,6 +9040,7 @@
</span><span class="cx">                                 0FE254F61ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp in Sources */,
</span><span class="cx">                                 0F6E845A19030BEF00562741 /* DFGVariableAccessData.cpp in Sources */,
</span><span class="cx">                                 0FDDBFB51666EED800C55FEF /* DFGVariableAccessDataDump.cpp in Sources */,
</span><ins>+                                0F9495871C57F47500413A48 /* B3StackSlot.cpp in Sources */,
</ins><span class="cx">                                 0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */,
</span><span class="cx">                                 0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */,
</span><span class="cx">                                 0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3EliminateCommonSubexpressionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -37,7 +37,8 @@
</span><span class="cx"> #include &quot;B3PhaseScope.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><span class="cx"> #include &quot;B3PureCSE.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3ValueKey.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> #include &quot;DFGGraph.h&quot;
</span><span class="lines">@@ -130,7 +131,7 @@
</span><span class="cx">             m_impureBlockData[m_block] = m_data;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        for (StackSlotValue* stack : m_stacks)
</del><ins>+        for (SlotBaseValue* stack : m_stacks)
</ins><span class="cx">             m_insertionSet.insertValue(0, stack);
</span><span class="cx">         for (BasicBlock* block : m_proc) {
</span><span class="cx">             for (unsigned valueIndex = 0; valueIndex &lt; block-&gt;size(); ++valueIndex) {
</span><span class="lines">@@ -369,8 +370,8 @@
</span><span class="cx">         // Right now we're relying on the fact that CSE's position in the phase order is
</span><span class="cx">         // almost right before SSA fixup.
</span><span class="cx">             
</span><del>-        StackSlotValue* stack = m_proc.add&lt;StackSlotValue&gt;(
-            m_value-&gt;origin(), sizeofType(m_value-&gt;type()), StackSlotKind::Anonymous);
</del><ins>+        SlotBaseValue* stack = m_proc.add&lt;SlotBaseValue&gt;(
+            m_value-&gt;origin(), m_proc.addAnonymousStackSlot(m_value-&gt;type()));
</ins><span class="cx">         m_stacks.append(stack);
</span><span class="cx"> 
</span><span class="cx">         MemoryValue* load = m_insertionSet.insert&lt;MemoryValue&gt;(
</span><span class="lines">@@ -498,7 +499,7 @@
</span><span class="cx">     unsigned m_index;
</span><span class="cx">     Value* m_value;
</span><span class="cx"> 
</span><del>-    Vector&lt;StackSlotValue*&gt; m_stacks;
</del><ins>+    Vector&lt;SlotBaseValue*&gt; m_stacks;
</ins><span class="cx">     HashMap&lt;Value*, Vector&lt;Value*&gt;&gt; m_stores;
</span><span class="cx"> 
</span><span class="cx">     InsertionSet m_insertionSet;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3FixSSAcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3FixSSA.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3FixSSA.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3FixSSA.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -38,7 +38,8 @@
</span><span class="cx"> #include &quot;B3PhaseScope.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><span class="cx"> #include &quot;B3SSACalculator.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> #include &lt;wtf/CommaPrinter.h&gt;
</span><span class="lines">@@ -51,19 +52,19 @@
</span><span class="cx"> 
</span><span class="cx"> void demoteValues(Procedure&amp; proc, const IndexSet&lt;Value&gt;&amp; values)
</span><span class="cx"> {
</span><del>-    HashMap&lt;Value*, StackSlotValue*&gt; map;
-    HashMap&lt;Value*, StackSlotValue*&gt; phiMap;
</del><ins>+    HashMap&lt;Value*, SlotBaseValue*&gt; map;
+    HashMap&lt;Value*, SlotBaseValue*&gt; phiMap;
</ins><span class="cx"> 
</span><span class="cx">     // Create stack slots.
</span><span class="cx">     InsertionSet insertionSet(proc);
</span><span class="cx">     for (Value* value : values.values(proc.values())) {
</span><del>-        StackSlotValue* stack = insertionSet.insert&lt;StackSlotValue&gt;(
-            0, value-&gt;origin(), sizeofType(value-&gt;type()), StackSlotKind::Anonymous);
</del><ins>+        SlotBaseValue* stack = insertionSet.insert&lt;SlotBaseValue&gt;(
+            0, value-&gt;origin(), proc.addAnonymousStackSlot(value-&gt;type()));
</ins><span class="cx">         map.add(value, stack);
</span><span class="cx"> 
</span><span class="cx">         if (value-&gt;opcode() == Phi) {
</span><del>-            StackSlotValue* phiStack = insertionSet.insert&lt;StackSlotValue&gt;(
-                0, value-&gt;origin(), sizeofType(value-&gt;type()), StackSlotKind::Anonymous);
</del><ins>+            SlotBaseValue* phiStack = insertionSet.insert&lt;SlotBaseValue&gt;(
+                0, value-&gt;origin(), proc.addAnonymousStackSlot(value-&gt;type()));
</ins><span class="cx">             phiMap.add(value, phiStack);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -89,31 +90,31 @@
</span><span class="cx">             Value* value = block-&gt;at(valueIndex);
</span><span class="cx"> 
</span><span class="cx">             if (value-&gt;opcode() == Phi) {
</span><del>-                if (StackSlotValue* stack = phiMap.get(value)) {
</del><ins>+                if (SlotBaseValue* slotBase = phiMap.get(value)) {
</ins><span class="cx">                     value-&gt;replaceWithIdentity(
</span><span class="cx">                         insertionSet.insert&lt;MemoryValue&gt;(
</span><del>-                            valueIndex, Load, value-&gt;type(), value-&gt;origin(), stack));
</del><ins>+                            valueIndex, Load, value-&gt;type(), value-&gt;origin(), slotBase));
</ins><span class="cx">                 }
</span><span class="cx">             } else {
</span><span class="cx">                 for (Value*&amp; child : value-&gt;children()) {
</span><del>-                    if (StackSlotValue* stack = map.get(child)) {
</del><ins>+                    if (SlotBaseValue* slotBase = map.get(child)) {
</ins><span class="cx">                         child = insertionSet.insert&lt;MemoryValue&gt;(
</span><del>-                            valueIndex, Load, child-&gt;type(), value-&gt;origin(), stack);
</del><ins>+                            valueIndex, Load, child-&gt;type(), value-&gt;origin(), slotBase);
</ins><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx"> 
</span><span class="cx">                 if (UpsilonValue* upsilon = value-&gt;as&lt;UpsilonValue&gt;()) {
</span><del>-                    if (StackSlotValue* stack = phiMap.get(upsilon-&gt;phi())) {
</del><ins>+                    if (SlotBaseValue* slotBase = phiMap.get(upsilon-&gt;phi())) {
</ins><span class="cx">                         insertionSet.insert&lt;MemoryValue&gt;(
</span><del>-                            valueIndex, Store, upsilon-&gt;origin(), upsilon-&gt;child(0), stack);
</del><ins>+                            valueIndex, Store, upsilon-&gt;origin(), upsilon-&gt;child(0), slotBase);
</ins><span class="cx">                         value-&gt;replaceWithNop();
</span><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            if (StackSlotValue* stack = map.get(value)) {
</del><ins>+            if (SlotBaseValue* slotBase = map.get(value)) {
</ins><span class="cx">                 insertionSet.insert&lt;MemoryValue&gt;(
</span><del>-                    valueIndex + 1, Store, value-&gt;origin(), value, stack);
</del><ins>+                    valueIndex + 1, Store, value-&gt;origin(), value, slotBase);
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         insertionSet.execute(block);
</span><span class="lines">@@ -126,9 +127,10 @@
</span><span class="cx">     
</span><span class="cx">     // Collect the stack &quot;variables&quot;. If there aren't any, then we don't have anything to do.
</span><span class="cx">     // That's a fairly common case.
</span><del>-    HashMap&lt;StackSlotValue*, Type&gt; stackVariable;
</del><ins>+    HashMap&lt;StackSlot*, Type&gt; stackVariable;
</ins><span class="cx">     for (Value* value : proc.values()) {
</span><del>-        if (StackSlotValue* stack = value-&gt;as&lt;StackSlotValue&gt;()) {
</del><ins>+        if (SlotBaseValue* slotBase = value-&gt;as&lt;SlotBaseValue&gt;()) {
+            StackSlot* stack = slotBase-&gt;slot();
</ins><span class="cx">             if (stack-&gt;kind() == StackSlotKind::Anonymous)
</span><span class="cx">                 stackVariable.add(stack, Void);
</span><span class="cx">         }
</span><span class="lines">@@ -141,14 +143,16 @@
</span><span class="cx">     // Store on anonymous variables.
</span><span class="cx">     for (Value* value : proc.values()) {
</span><span class="cx">         auto reject = [&amp;] (Value* value) {
</span><del>-            if (StackSlotValue* stack = value-&gt;as&lt;StackSlotValue&gt;())
-                stackVariable.remove(stack);
</del><ins>+            if (SlotBaseValue* slotBase = value-&gt;as&lt;SlotBaseValue&gt;())
+                stackVariable.remove(slotBase-&gt;slot());
</ins><span class="cx">         };
</span><span class="cx">         
</span><span class="cx">         auto handleAccess = [&amp;] (Value* access, Type type) {
</span><del>-            StackSlotValue* stack = access-&gt;lastChild()-&gt;as&lt;StackSlotValue&gt;();
-            if (!stack)
</del><ins>+            SlotBaseValue* slotBase = access-&gt;lastChild()-&gt;as&lt;SlotBaseValue&gt;();
+            if (!slotBase)
</ins><span class="cx">                 return;
</span><ins>+
+            StackSlot* stack = slotBase-&gt;slot();
</ins><span class="cx">             
</span><span class="cx">             if (value-&gt;as&lt;MemoryValue&gt;()-&gt;offset()) {
</span><span class="cx">                 stackVariable.remove(stack);
</span><span class="lines">@@ -184,16 +188,14 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    Vector&lt;StackSlotValue*&gt; deadValues;
</del><ins>+    Vector&lt;StackSlot*&gt; deadSlots;
</ins><span class="cx">     for (auto&amp; entry : stackVariable) {
</span><span class="cx">         if (entry.value == Void)
</span><del>-            deadValues.append(entry.key);
</del><ins>+            deadSlots.append(entry.key);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    for (StackSlotValue* deadValue : deadValues) {
-        deadValue-&gt;replaceWithNop();
-        stackVariable.remove(deadValue);
-    }
</del><ins>+    for (StackSlot* deadSlot : deadSlots)
+        stackVariable.remove(deadSlot);
</ins><span class="cx"> 
</span><span class="cx">     if (stackVariable.isEmpty())
</span><span class="cx">         return false;
</span><span class="lines">@@ -204,11 +206,11 @@
</span><span class="cx">     SSACalculator ssa(proc);
</span><span class="cx"> 
</span><span class="cx">     // Create a SSACalculator::Variable for every stack variable.
</span><del>-    Vector&lt;StackSlotValue*&gt; variableToStack;
-    HashMap&lt;StackSlotValue*, SSACalculator::Variable*&gt; stackToVariable;
</del><ins>+    Vector&lt;StackSlot*&gt; variableToStack;
+    HashMap&lt;StackSlot*, SSACalculator::Variable*&gt; stackToVariable;
</ins><span class="cx"> 
</span><span class="cx">     for (auto&amp; entry : stackVariable) {
</span><del>-        StackSlotValue* stack = entry.key;
</del><ins>+        StackSlot* stack = entry.key;
</ins><span class="cx">         SSACalculator::Variable* variable = ssa.newVariable();
</span><span class="cx">         RELEASE_ASSERT(variable-&gt;index() == variableToStack.size());
</span><span class="cx">         variableToStack.append(stack);
</span><span class="lines">@@ -221,10 +223,12 @@
</span><span class="cx">             if (value-&gt;opcode() != Store)
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            StackSlotValue* stack = value-&gt;child(1)-&gt;as&lt;StackSlotValue&gt;();
-            if (!stack)
</del><ins>+            SlotBaseValue* slotBase = value-&gt;child(1)-&gt;as&lt;SlotBaseValue&gt;();
+            if (!slotBase)
</ins><span class="cx">                 continue;
</span><span class="cx"> 
</span><ins>+            StackSlot* stack = slotBase-&gt;slot();
+
</ins><span class="cx">             if (SSACalculator::Variable* variable = stackToVariable.get(stack))
</span><span class="cx">                 ssa.newDef(variable, block, value-&gt;child(0));
</span><span class="cx">         }
</span><span class="lines">@@ -233,8 +237,8 @@
</span><span class="cx">     // Decide where Phis are to be inserted. This creates them but does not insert them.
</span><span class="cx">     ssa.computePhis(
</span><span class="cx">         [&amp;] (SSACalculator::Variable* variable, BasicBlock* block) -&gt; Value* {
</span><del>-            StackSlotValue* stack = variableToStack[variable-&gt;index()];
-            Value* phi = proc.add&lt;Value&gt;(Phi, stackVariable.get(stack), stack-&gt;origin());
</del><ins>+            StackSlot* stack = variableToStack[variable-&gt;index()];
+            Value* phi = proc.add&lt;Value&gt;(Phi, stackVariable.get(stack), block-&gt;at(0)-&gt;origin());
</ins><span class="cx">             if (verbose) {
</span><span class="cx">                 dataLog(
</span><span class="cx">                     &quot;Adding Phi for &quot;, pointerDump(stack), &quot; at &quot;, *block, &quot;: &quot;,
</span><span class="lines">@@ -245,12 +249,12 @@
</span><span class="cx"> 
</span><span class="cx">     // Now perform the conversion.
</span><span class="cx">     InsertionSet insertionSet(proc);
</span><del>-    HashMap&lt;StackSlotValue*, Value*&gt; mapping;
</del><ins>+    HashMap&lt;StackSlot*, Value*&gt; mapping;
</ins><span class="cx">     for (BasicBlock* block : proc.blocksInPreOrder()) {
</span><span class="cx">         mapping.clear();
</span><span class="cx"> 
</span><span class="cx">         for (auto&amp; entry : stackToVariable) {
</span><del>-            StackSlotValue* stack = entry.key;
</del><ins>+            StackSlot* stack = entry.key;
</ins><span class="cx">             SSACalculator::Variable* variable = entry.value;
</span><span class="cx"> 
</span><span class="cx">             SSACalculator::Def* def = ssa.reachingDefAtHead(block, variable);
</span><span class="lines">@@ -259,7 +263,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         for (SSACalculator::Def* phiDef : ssa.phisForBlock(block)) {
</span><del>-            StackSlotValue* stack = variableToStack[phiDef-&gt;variable()-&gt;index()];
</del><ins>+            StackSlot* stack = variableToStack[phiDef-&gt;variable()-&gt;index()];
</ins><span class="cx"> 
</span><span class="cx">             insertionSet.insertValue(0, phiDef-&gt;value());
</span><span class="cx">             mapping.set(stack, phiDef-&gt;value());
</span><span class="lines">@@ -271,7 +275,8 @@
</span><span class="cx"> 
</span><span class="cx">             switch (value-&gt;opcode()) {
</span><span class="cx">             case Load: {
</span><del>-                if (StackSlotValue* stack = value-&gt;child(0)-&gt;as&lt;StackSlotValue&gt;()) {
</del><ins>+                if (SlotBaseValue* slotBase = value-&gt;child(0)-&gt;as&lt;SlotBaseValue&gt;()) {
+                    StackSlot* stack = slotBase-&gt;slot();
</ins><span class="cx">                     if (Value* replacement = mapping.get(stack))
</span><span class="cx">                         value-&gt;replaceWithIdentity(replacement);
</span><span class="cx">                 }
</span><span class="lines">@@ -279,7 +284,8 @@
</span><span class="cx">             }
</span><span class="cx">                 
</span><span class="cx">             case Store: {
</span><del>-                if (StackSlotValue* stack = value-&gt;child(1)-&gt;as&lt;StackSlotValue&gt;()) {
</del><ins>+                if (SlotBaseValue* slotBase = value-&gt;child(1)-&gt;as&lt;SlotBaseValue&gt;()) {
+                    StackSlot* stack = slotBase-&gt;slot();
</ins><span class="cx">                     if (stackToVariable.contains(stack)) {
</span><span class="cx">                         mapping.set(stack, value-&gt;child(0));
</span><span class="cx">                         value-&gt;replaceWithNop();
</span><span class="lines">@@ -299,7 +305,7 @@
</span><span class="cx">             for (SSACalculator::Def* phiDef : ssa.phisForBlock(successorBlock)) {
</span><span class="cx">                 Value* phi = phiDef-&gt;value();
</span><span class="cx">                 SSACalculator::Variable* variable = phiDef-&gt;variable();
</span><del>-                StackSlotValue* stack = variableToStack[variable-&gt;index()];
</del><ins>+                StackSlot* stack = variableToStack[variable-&gt;index()];
</ins><span class="cx"> 
</span><span class="cx">                 Value* mappedValue = mapping.get(stack);
</span><span class="cx">                 if (verbose) {
</span><span class="lines">@@ -319,10 +325,6 @@
</span><span class="cx">         insertionSet.execute(block);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // Finally, kill the stack slots.
-    for (StackSlotValue* stack : variableToStack)
-        stack-&gt;replaceWithNop();
-
</del><span class="cx">     if (verbose) {
</span><span class="cx">         dataLog(&quot;B3 after SSA conversion:\n&quot;);
</span><span class="cx">         dataLog(proc);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3LowerToAircpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3LowerToAir.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -47,7 +47,8 @@
</span><span class="cx"> #include &quot;B3PhaseScope.h&quot;
</span><span class="cx"> #include &quot;B3PhiChildren.h&quot;
</span><span class="cx"> #include &quot;B3Procedure.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3UseCounts.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="lines">@@ -92,16 +93,14 @@
</span><span class="cx">                     dataLog(&quot;Phi tmp for &quot;, *value, &quot;: &quot;, m_phiToTmp[value], &quot;\n&quot;);
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><del>-            case B3::StackSlot: {
-                StackSlotValue* stackSlotValue = value-&gt;as&lt;StackSlotValue&gt;();
-                m_stackToStack.add(stackSlotValue, m_code.addStackSlot(stackSlotValue));
-                break;
-            }
</del><span class="cx">             default:
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        for (B3::StackSlot* stack : m_procedure.stackSlots())
+            m_stackToStack.add(stack, m_code.addStackSlot(stack));
+
</ins><span class="cx">         // Figure out which blocks are not rare.
</span><span class="cx">         m_fastWorklist.push(m_procedure[0]);
</span><span class="cx">         while (B3::BasicBlock* block = m_fastWorklist.pop()) {
</span><span class="lines">@@ -433,8 +432,8 @@
</span><span class="cx">         case FramePointer:
</span><span class="cx">             return Arg::addr(Tmp(GPRInfo::callFrameRegister), offset);
</span><span class="cx"> 
</span><del>-        case B3::StackSlot:
-            return Arg::stack(m_stackToStack.get(address-&gt;as&lt;StackSlotValue&gt;()), offset);
</del><ins>+        case SlotBase:
+            return Arg::stack(m_stackToStack.get(address-&gt;as&lt;SlotBaseValue&gt;()-&gt;slot()), offset);
</ins><span class="cx"> 
</span><span class="cx">         default:
</span><span class="cx">             return fallback();
</span><span class="lines">@@ -1914,10 +1913,10 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case B3::StackSlot: {
</del><ins>+        case SlotBase: {
</ins><span class="cx">             append(
</span><span class="cx">                 Lea,
</span><del>-                Arg::stack(m_stackToStack.get(m_value-&gt;as&lt;StackSlotValue&gt;())),
</del><ins>+                Arg::stack(m_stackToStack.get(m_value-&gt;as&lt;SlotBaseValue&gt;()-&gt;slot())),
</ins><span class="cx">                 tmp(m_value));
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -2284,7 +2283,7 @@
</span><span class="cx">     IndexMap&lt;Value, Tmp&gt; m_valueToTmp; // These are values that must have a Tmp in Air. We say that a Value* with a non-null Tmp is &quot;pinned&quot;.
</span><span class="cx">     IndexMap&lt;Value, Tmp&gt; m_phiToTmp; // Each Phi gets its own Tmp.
</span><span class="cx">     IndexMap&lt;B3::BasicBlock, Air::BasicBlock*&gt; m_blockToBlock;
</span><del>-    HashMap&lt;StackSlotValue*, Air::StackSlot*&gt; m_stackToStack;
</del><ins>+    HashMap&lt;B3::StackSlot*, Air::StackSlot*&gt; m_stackToStack;
</ins><span class="cx"> 
</span><span class="cx">     UseCounts m_useCounts;
</span><span class="cx">     PhiChildren m_phiChildren;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Opcodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Opcode.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Opcode.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Opcode.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -95,8 +95,8 @@
</span><span class="cx">     case ConstFloat:
</span><span class="cx">         out.print(&quot;ConstFloat&quot;);
</span><span class="cx">         return;
</span><del>-    case StackSlot:
-        out.print(&quot;StackSlot&quot;);
</del><ins>+    case SlotBase:
+        out.print(&quot;SlotBase&quot;);
</ins><span class="cx">         return;
</span><span class="cx">     case ArgumentReg:
</span><span class="cx">         out.print(&quot;ArgumentReg&quot;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Opcodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Opcode.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Opcode.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Opcode.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">     // The magical stack slot. This is viewed as executing at the top of the program regardless of
</span><span class="cx">     // where in control flow you put it. Each instance of a StackSlot Value gets a disjoint range of
</span><span class="cx">     // stack memory. Use the StackSlotValue class.
</span><del>-    StackSlot,
</del><ins>+    SlotBase,
</ins><span class="cx"> 
</span><span class="cx">     // The magical argument register. This is viewed as executing at the top of the program
</span><span class="cx">     // regardless of where in control flow you put it, and the compiler takes care to ensure that we
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Procedurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Procedure.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Procedure.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Procedure.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -36,6 +36,7 @@
</span><span class="cx"> #include &quot;B3DataSection.h&quot;
</span><span class="cx"> #include &quot;B3Dominators.h&quot;
</span><span class="cx"> #include &quot;B3OpaqueByproducts.h&quot;
</span><ins>+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace B3 {
</span><span class="lines">@@ -91,6 +92,20 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+StackSlot* Procedure::addStackSlot(unsigned byteSize, StackSlotKind kind)
+{
+    size_t index = addStackSlotIndex();
+    std::unique_ptr&lt;StackSlot&gt; slot(new StackSlot(index, byteSize, kind));
+    StackSlot* result = slot.get();
+    m_stackSlots[index] = WTFMove(slot);
+    return result;
+}
+
+StackSlot* Procedure::addAnonymousStackSlot(Type type)
+{
+    return addStackSlot(sizeofType(type), StackSlotKind::Anonymous);
+}
+
</ins><span class="cx"> Value* Procedure::clone(Value* value)
</span><span class="cx"> {
</span><span class="cx">     std::unique_ptr&lt;Value&gt; clone(value-&gt;cloneImpl());
</span><span class="lines">@@ -192,6 +207,11 @@
</span><span class="cx">         }
</span><span class="cx">         dataLog(&quot;    &quot;, deepDump(*this, value), &quot;\n&quot;);
</span><span class="cx">     }
</span><ins>+    if (stackSlots().size()) {
+        out.print(&quot;Stack slots:\n&quot;);
+        for (StackSlot* slot : stackSlots())
+            out.print(&quot;    &quot;, pointerDump(slot), &quot;: &quot;, deepDump(slot), &quot;\n&quot;);
+    }
</ins><span class="cx">     if (m_byproducts-&gt;count())
</span><span class="cx">         out.print(*m_byproducts);
</span><span class="cx"> }
</span><span class="lines">@@ -206,6 +226,14 @@
</span><span class="cx">     return B3::blocksInPostOrder(at(0));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void Procedure::deleteStackSlot(StackSlot* stackSlot)
+{
+    RELEASE_ASSERT(m_stackSlots[stackSlot-&gt;index()].get() == stackSlot);
+    RELEASE_ASSERT(!stackSlot-&gt;isLocked());
+    m_stackSlotIndexFreeList.append(stackSlot-&gt;index());
+    m_stackSlots[stackSlot-&gt;index()] = nullptr;
+}
+
</ins><span class="cx"> void Procedure::deleteValue(Value* value)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(m_values[value-&gt;index()].get() == value);
</span><span class="lines">@@ -282,6 +310,17 @@
</span><span class="cx">     return code().calleeSaveRegisters();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+size_t Procedure::addStackSlotIndex()
+{
+    if (m_stackSlotIndexFreeList.isEmpty()) {
+        size_t index = m_stackSlots.size();
+        m_stackSlots.append(nullptr);
+        return index;
+    }
+    
+    return m_stackSlotIndexFreeList.takeLast();
+}
+
</ins><span class="cx"> size_t Procedure::addValueIndex()
</span><span class="cx"> {
</span><span class="cx">     if (m_valueIndexFreeList.isEmpty()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Procedureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Procedure.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Procedure.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Procedure.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;B3OpaqueByproducts.h&quot;
</span><span class="cx"> #include &quot;B3Origin.h&quot;
</span><ins>+#include &quot;B3StackSlotKind.h&quot;
</ins><span class="cx"> #include &quot;B3Type.h&quot;
</span><span class="cx"> #include &quot;B3ValueKey.h&quot;
</span><span class="cx"> #include &quot;PureNaN.h&quot;
</span><span class="lines">@@ -49,6 +50,7 @@
</span><span class="cx"> class BlockInsertionSet;
</span><span class="cx"> class CFG;
</span><span class="cx"> class Dominators;
</span><ins>+class StackSlot;
</ins><span class="cx"> class Value;
</span><span class="cx"> 
</span><span class="cx"> namespace Air { class Code; }
</span><span class="lines">@@ -90,6 +92,9 @@
</span><span class="cx">             blocks.append(block);
</span><span class="cx">         setBlockOrderImpl(blocks);
</span><span class="cx">     }
</span><ins>+
+    JS_EXPORT_PRIVATE StackSlot* addStackSlot(unsigned byteSize, StackSlotKind);
+    JS_EXPORT_PRIVATE StackSlot* addAnonymousStackSlot(Type);
</ins><span class="cx">     
</span><span class="cx">     template&lt;typename ValueType, typename... Arguments&gt;
</span><span class="cx">     ValueType* add(Arguments...);
</span><span class="lines">@@ -172,6 +177,75 @@
</span><span class="cx">     Vector&lt;BasicBlock*&gt; blocksInPreOrder();
</span><span class="cx">     Vector&lt;BasicBlock*&gt; blocksInPostOrder();
</span><span class="cx"> 
</span><ins>+    class StackSlotsCollection {
+    public:
+        StackSlotsCollection(const Procedure&amp; proc)
+            : m_proc(proc)
+        {
+        }
+
+        unsigned size() const { return m_proc.m_stackSlots.size(); }
+        StackSlot* at(unsigned index) const { return m_proc.m_stackSlots[index].get(); }
+        StackSlot* operator[](unsigned index) const { return at(index); }
+
+        class iterator {
+        public:
+            iterator()
+                : m_collection(nullptr)
+                , m_index(0)
+            {
+            }
+
+            iterator(const StackSlotsCollection&amp; collection, unsigned index)
+                : m_collection(&amp;collection)
+                , m_index(findNext(index))
+            {
+            }
+
+            StackSlot* operator*()
+            {
+                return m_collection-&gt;at(m_index);
+            }
+
+            iterator&amp; operator++()
+            {
+                m_index = findNext(m_index + 1);
+                return *this;
+            }
+
+            bool operator==(const iterator&amp; other) const
+            {
+                return m_index == other.m_index;
+            }
+
+            bool operator!=(const iterator&amp; other) const
+            {
+                return !(*this == other);
+            }
+
+        private:
+            unsigned findNext(unsigned index)
+            {
+                while (index &lt; m_collection-&gt;size() &amp;&amp; !m_collection-&gt;at(index))
+                    index++;
+                return index;
+            }
+            
+            const StackSlotsCollection* m_collection;
+            unsigned m_index;
+        };
+
+        iterator begin() const { return iterator(*this, 0); }
+        iterator end() const { return iterator(*this, size()); }
+
+    private:
+        const Procedure&amp; m_proc;
+    };
+
+    StackSlotsCollection stackSlots() const { return StackSlotsCollection(*this); }
+
+    void deleteStackSlot(StackSlot*);
+    
</ins><span class="cx">     class ValuesCollection {
</span><span class="cx">     public:
</span><span class="cx">         ValuesCollection(const Procedure&amp; procedure)
</span><span class="lines">@@ -292,10 +366,13 @@
</span><span class="cx">     
</span><span class="cx">     void setBlockOrderImpl(Vector&lt;BasicBlock*&gt;&amp;);
</span><span class="cx"> 
</span><ins>+    size_t addStackSlotIndex();
</ins><span class="cx">     JS_EXPORT_PRIVATE size_t addValueIndex();
</span><del>-    
</del><ins>+
+    Vector&lt;std::unique_ptr&lt;StackSlot&gt;&gt; m_stackSlots;
</ins><span class="cx">     Vector&lt;std::unique_ptr&lt;BasicBlock&gt;&gt; m_blocks;
</span><span class="cx">     Vector&lt;std::unique_ptr&lt;Value&gt;&gt; m_values;
</span><ins>+    Vector&lt;size_t&gt; m_stackSlotIndexFreeList;
</ins><span class="cx">     Vector&lt;size_t&gt; m_valueIndexFreeList;
</span><span class="cx">     std::unique_ptr&lt;CFG&gt; m_cfg;
</span><span class="cx">     std::unique_ptr&lt;Dominators&gt; m_dominators;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3ReduceStrengthcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3ReduceStrength.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3ReduceStrength.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3ReduceStrength.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -40,6 +40,8 @@
</span><span class="cx"> #include &quot;B3PhiChildren.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><span class="cx"> #include &quot;B3PureCSE.h&quot;
</span><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3ValueKeyInlines.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="lines">@@ -2075,14 +2077,18 @@
</span><span class="cx">                 break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        IndexSet&lt;StackSlot&gt; liveStackSlots;
+        
</ins><span class="cx">         for (BasicBlock* block : m_proc) {
</span><span class="cx">             size_t sourceIndex = 0;
</span><span class="cx">             size_t targetIndex = 0;
</span><span class="cx">             while (sourceIndex &lt; block-&gt;size()) {
</span><span class="cx">                 Value* value = block-&gt;at(sourceIndex++);
</span><del>-                if (worklist.saw(value))
</del><ins>+                if (worklist.saw(value)) {
+                    if (SlotBaseValue* slotBase = value-&gt;as&lt;SlotBaseValue&gt;())
+                        liveStackSlots.add(slotBase-&gt;slot());
</ins><span class="cx">                     block-&gt;at(targetIndex++) = value;
</span><del>-                else {
</del><ins>+                } else {
</ins><span class="cx">                     m_proc.deleteValue(value);
</span><span class="cx">                     
</span><span class="cx">                     // It's not entirely clear if this is needed. I think it makes sense to have
</span><span class="lines">@@ -2094,6 +2100,12 @@
</span><span class="cx">             }
</span><span class="cx">             block-&gt;values().resize(targetIndex);
</span><span class="cx">         }
</span><ins>+
+        for (StackSlot* slot : m_proc.stackSlots()) {
+            if (slot-&gt;isLocked() || liveStackSlots.contains(slot))
+                continue;
+            m_proc.deleteStackSlot(slot);
+        }
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void simplifySSA()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3SlotBaseValuecppfromrev195584trunkSourceJavaScriptCoreb3B3StackSlotValuecpp"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.cpp (from rev 195584, trunk/Source/JavaScriptCore/b3/B3StackSlotValue.cpp) (0 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;B3SlotBaseValue.h&quot;
+
+#if ENABLE(B3_JIT)
+
+#include &quot;B3StackSlot.h&quot;
+
+namespace JSC { namespace B3 {
+
+SlotBaseValue::~SlotBaseValue()
+{
+}
+
+void SlotBaseValue::dumpMeta(CommaPrinter&amp; comma, PrintStream&amp; out) const
+{
+    out.print(comma, pointerDump(m_slot));
+}
+
+Value* SlotBaseValue::cloneImpl() const
+{
+    return new SlotBaseValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3SlotBaseValuehfromrev195584trunkSourceJavaScriptCoreb3B3StackSlotValueh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.h (from rev 195584, trunk/Source/JavaScriptCore/b3/B3StackSlotValue.h) (0 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3SlotBaseValue.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -0,0 +1,67 @@
</span><ins>+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef B3SlotBaseValue_h
+#define B3SlotBaseValue_h
+
+#if ENABLE(B3_JIT)
+
+#include &quot;B3Value.h&quot;
+
+namespace JSC { namespace B3 {
+
+class StackSlot;
+
+class JS_EXPORT_PRIVATE SlotBaseValue : public Value {
+public:
+    static bool accepts(Opcode opcode) { return opcode == SlotBase; }
+
+    ~SlotBaseValue();
+
+    StackSlot* slot() const { return m_slot; }
+
+protected:
+    void dumpMeta(CommaPrinter&amp;, PrintStream&amp;) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    SlotBaseValue(unsigned index, Origin origin, StackSlot* slot)
+        : Value(index, CheckedOpcode, SlotBase, pointerType(), origin)
+        , m_slot(slot)
+    {
+    }
+
+    StackSlot* m_slot;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
+#endif // B3SlotBaseValue_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3StackSlotcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/b3/B3StackSlot.cpp (0 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3StackSlot.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3StackSlot.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;B3StackSlot.h&quot;
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+StackSlot::~StackSlot()
+{
+}
+
+void StackSlot::dump(PrintStream&amp; out) const
+{
+    out.print(&quot;stack&quot;, m_index);
+}
+
+void StackSlot::deepDump(PrintStream&amp; out) const
+{
+    out.print(&quot;byteSize = &quot;, m_byteSize, &quot;, offsetFromFP = &quot;, m_offsetFromFP, &quot;, kind = &quot;, m_kind);
+}
+
+StackSlot::StackSlot(unsigned index, unsigned byteSize, StackSlotKind kind)
+    : m_index(index)
+    , m_byteSize(byteSize)
+    , m_kind(kind)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3StackSloth"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/b3/B3StackSlot.h (0 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3StackSlot.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/b3/B3StackSlot.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -0,0 +1,110 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef B3StackSlot_h
+#define B3StackSlot_h
+
+#if ENABLE(B3_JIT)
+
+#include &quot;B3StackSlotKind.h&quot;
+#include &lt;wtf/FastMalloc.h&gt;
+#include &lt;wtf/Noncopyable.h&gt;
+#include &lt;wtf/PrintStream.h&gt;
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+namespace Air {
+class StackSlot;
+} // namespace Air
+
+class StackSlot {
+    WTF_MAKE_NONCOPYABLE(StackSlot);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    ~StackSlot();
+
+    unsigned byteSize() const { return m_byteSize; }
+    StackSlotKind kind() const { return m_kind; }
+    bool isLocked() const { return m_kind == StackSlotKind::Locked; }
+    unsigned index() const { return m_index; }
+
+    // This gets assigned at the end of compilation. But, you can totally pin stack slots. Use the
+    // set method to do that.
+    intptr_t offsetFromFP() const { return m_offsetFromFP; }
+
+    // Note that this is meaningless unless the stack slot is Locked.
+    void setOffsetFromFP(intptr_t value)
+    {
+        m_offsetFromFP = value;
+    }
+
+    void dump(PrintStream&amp; out) const;
+    void deepDump(PrintStream&amp;) const;
+
+private:
+    friend class Air::StackSlot;
+    friend class Procedure;
+
+    StackSlot(unsigned index, unsigned byteSize, StackSlotKind);
+
+    unsigned m_index;
+    unsigned m_byteSize;
+    StackSlotKind m_kind;
+    intptr_t m_offsetFromFP { 0 };
+};
+
+class DeepStackSlotDump {
+public:
+    DeepStackSlotDump(const StackSlot* slot)
+        : m_slot(slot)
+    {
+    }
+
+    void dump(PrintStream&amp; out) const
+    {
+        if (m_slot)
+            m_slot-&gt;deepDump(out);
+        else
+            out.print(&quot;&lt;null&gt;&quot;);
+    }
+
+private:
+    const StackSlot* m_slot;
+};
+
+inline DeepStackSlotDump deepDump(const StackSlot* slot)
+{
+    return DeepStackSlotDump(slot);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
+#endif // B3StackSlot_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3StackSlotValuecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/b3/B3StackSlotValue.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3StackSlotValue.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3StackSlotValue.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,49 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;B3StackSlotValue.h&quot;
-
-#if ENABLE(B3_JIT)
-
-namespace JSC { namespace B3 {
-
-StackSlotValue::~StackSlotValue()
-{
-}
-
-void StackSlotValue::dumpMeta(CommaPrinter&amp; comma, PrintStream&amp; out) const
-{
-    out.print(comma, &quot;byteSize = &quot;, m_byteSize, &quot;, kind = &quot;, m_kind);
-}
-
-Value* StackSlotValue::cloneImpl() const
-{
-    return new StackSlotValue(*this);
-}
-
-} } // namespace JSC::B3
-
-#endif // ENABLE(B3_JIT)
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3StackSlotValueh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/b3/B3StackSlotValue.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3StackSlotValue.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3StackSlotValue.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,86 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef B3StackSlotValue_h
-#define B3StackSlotValue_h
-
-#if ENABLE(B3_JIT)
-
-#include &quot;B3StackSlotKind.h&quot;
-#include &quot;B3Value.h&quot;
-
-namespace JSC { namespace B3 {
-
-namespace Air {
-class StackSlot;
-} // namespace Air
-
-class JS_EXPORT_PRIVATE StackSlotValue : public Value {
-public:
-    static bool accepts(Opcode opcode) { return opcode == StackSlot; }
-
-    ~StackSlotValue();
-
-    unsigned byteSize() const { return m_byteSize; }
-    StackSlotKind kind() const { return m_kind; }
-
-    // This gets assigned at the end of compilation. But, you can totally pin stack slots. Use the
-    // set method to do that.
-    intptr_t offsetFromFP() const { return m_offsetFromFP; }
-
-    // Note that this is meaningless unless the stack slot is Locked.
-    void setOffsetFromFP(intptr_t value)
-    {
-        m_offsetFromFP = value;
-    }
-
-protected:
-    void dumpMeta(CommaPrinter&amp;, PrintStream&amp;) const override;
-
-    Value* cloneImpl() const override;
-
-private:
-    friend class Air::StackSlot;
-    friend class Procedure;
-
-    StackSlotValue(unsigned index, Origin origin, unsigned byteSize, StackSlotKind kind)
-        : Value(index, CheckedOpcode, StackSlot, pointerType(), origin)
-        , m_byteSize(byteSize)
-        , m_kind(kind)
-        , m_offsetFromFP(0)
-    {
-    }
-
-    unsigned m_byteSize;
-    StackSlotKind m_kind;
-    intptr_t m_offsetFromFP;
-};
-
-} } // namespace JSC::B3
-
-#endif // ENABLE(B3_JIT)
-
-#endif // B3StackSlotValue_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Validatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Validate.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Validate.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Validate.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -33,7 +33,8 @@
</span><span class="cx"> #include &quot;B3Dominators.h&quot;
</span><span class="cx"> #include &quot;B3MemoryValue.h&quot;
</span><span class="cx"> #include &quot;B3Procedure.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> #include &lt;wtf/HashSet.h&gt;
</span><span class="lines">@@ -152,7 +153,7 @@
</span><span class="cx">                 VALIDATE(!value-&gt;numChildren(), (&quot;At &quot;, *value));
</span><span class="cx">                 VALIDATE(value-&gt;type() == Float, (&quot;At &quot;, *value));
</span><span class="cx">                 break;
</span><del>-            case StackSlot:
</del><ins>+            case SlotBase:
</ins><span class="cx">             case FramePointer:
</span><span class="cx">                 VALIDATE(!value-&gt;numChildren(), (&quot;At &quot;, *value));
</span><span class="cx">                 VALIDATE(value-&gt;type() == pointerType(), (&quot;At &quot;, *value));
</span><span class="lines">@@ -410,10 +411,12 @@
</span><span class="cx">     void validateStackAccess(Value* value)
</span><span class="cx">     {
</span><span class="cx">         MemoryValue* memory = value-&gt;as&lt;MemoryValue&gt;();
</span><del>-        StackSlotValue* stack = value-&gt;lastChild()-&gt;as&lt;StackSlotValue&gt;();
-        if (!stack)
</del><ins>+        SlotBaseValue* slotBase = value-&gt;lastChild()-&gt;as&lt;SlotBaseValue&gt;();
+        if (!slotBase)
</ins><span class="cx">             return;
</span><span class="cx"> 
</span><ins>+        StackSlot* stack = slotBase-&gt;slot();
+
</ins><span class="cx">         VALIDATE(memory-&gt;offset() &gt;= 0, (&quot;At &quot;, *value));
</span><span class="cx">         VALIDATE(memory-&gt;offset() + memory-&gt;accessByteSize() &lt;= stack-&gt;byteSize(), (&quot;At &quot;, *value));
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Valuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Value.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Value.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3Value.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -34,7 +34,8 @@
</span><span class="cx"> #include &quot;B3MemoryValue.h&quot;
</span><span class="cx"> #include &quot;B3OriginDump.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> #include &quot;B3ValueKeyInlines.h&quot;
</span><span class="lines">@@ -383,7 +384,7 @@
</span><span class="cx">     case Const64:
</span><span class="cx">     case ConstDouble:
</span><span class="cx">     case ConstFloat:
</span><del>-    case StackSlot:
</del><ins>+    case SlotBase:
</ins><span class="cx">     case ArgumentReg:
</span><span class="cx">     case FramePointer:
</span><span class="cx">     case Add:
</span><span class="lines">@@ -535,6 +536,10 @@
</span><span class="cx">         return ValueKey(
</span><span class="cx">             ArgumentReg, type(),
</span><span class="cx">             static_cast&lt;int64_t&gt;(as&lt;ArgumentRegValue&gt;()-&gt;argumentReg().index()));
</span><ins>+    case SlotBase:
+        return ValueKey(
+            SlotBase, type(),
+            static_cast&lt;int64_t&gt;(as&lt;SlotBaseValue&gt;()-&gt;slot()-&gt;index()));
</ins><span class="cx">     default:
</span><span class="cx">         return ValueKey();
</span><span class="cx">     }
</span><span class="lines">@@ -565,7 +570,7 @@
</span><span class="cx">     ASSERT(!ControlValue::accepts(opcode));
</span><span class="cx">     ASSERT(!MemoryValue::accepts(opcode));
</span><span class="cx">     ASSERT(!PatchpointValue::accepts(opcode));
</span><del>-    ASSERT(!StackSlotValue::accepts(opcode));
</del><ins>+    ASSERT(!SlotBaseValue::accepts(opcode));
</ins><span class="cx">     ASSERT(!UpsilonValue::accepts(opcode));
</span><span class="cx"> }
</span><span class="cx"> #endif // !ASSERT_DISABLED
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3ValueKeycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3ValueKey.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3ValueKey.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/B3ValueKey.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;B3ArgumentRegValue.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><ins>+#include &quot;B3SlotBaseValue.h&quot;
</ins><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="cx"> #include &quot;B3ValueKeyInlines.h&quot;
</span><span class="cx"> 
</span><span class="lines">@@ -104,6 +105,8 @@
</span><span class="cx">         return proc.add&lt;ConstFloatValue&gt;(origin, floatValue());
</span><span class="cx">     case ArgumentReg:
</span><span class="cx">         return proc.add&lt;ArgumentRegValue&gt;(origin, Reg::fromIndex(static_cast&lt;unsigned&gt;(value())));
</span><ins>+    case SlotBase:
+        return proc.add&lt;SlotBaseValue&gt;(origin, proc.stackSlots()[value()]);
</ins><span class="cx">     default:
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirCodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirCode.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirCode.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/air/AirCode.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -30,7 +30,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;AirCCallSpecial.h&quot;
</span><span class="cx"> #include &quot;B3BasicBlockUtils.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace B3 { namespace Air {
</span><span class="cx"> 
</span><span class="lines">@@ -52,17 +52,17 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-StackSlot* Code::addStackSlot(unsigned byteSize, StackSlotKind kind, StackSlotValue* value)
</del><ins>+StackSlot* Code::addStackSlot(unsigned byteSize, StackSlotKind kind, B3::StackSlot* b3Slot)
</ins><span class="cx"> {
</span><del>-    std::unique_ptr&lt;StackSlot&gt; slot(new StackSlot(byteSize, m_stackSlots.size(), kind, value));
</del><ins>+    std::unique_ptr&lt;StackSlot&gt; slot(new StackSlot(byteSize, m_stackSlots.size(), kind, b3Slot));
</ins><span class="cx">     StackSlot* result = slot.get();
</span><span class="cx">     m_stackSlots.append(WTFMove(slot));
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-StackSlot* Code::addStackSlot(StackSlotValue* value)
</del><ins>+StackSlot* Code::addStackSlot(B3::StackSlot* b3Slot)
</ins><span class="cx"> {
</span><del>-    return addStackSlot(value-&gt;byteSize(), value-&gt;kind(), value);
</del><ins>+    return addStackSlot(b3Slot-&gt;byteSize(), b3Slot-&gt;kind(), b3Slot);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Special* Code::addSpecial(std::unique_ptr&lt;Special&gt; special)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirCode.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirCode.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/air/AirCode.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx">     // of any prior stack slot. In fact, all stack slots you create in the future will have an index
</span><span class="cx">     // that is &gt;= stackSlots().size().
</span><span class="cx">     JS_EXPORT_PRIVATE StackSlot* addStackSlot(
</span><del>-        unsigned byteSize, StackSlotKind, StackSlotValue* = nullptr);
-    StackSlot* addStackSlot(StackSlotValue*);
</del><ins>+        unsigned byteSize, StackSlotKind, B3::StackSlot* = nullptr);
+    StackSlot* addStackSlot(B3::StackSlot*);
</ins><span class="cx"> 
</span><span class="cx">     Special* addSpecial(std::unique_ptr&lt;Special&gt;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirStackSlotcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirStackSlot.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirStackSlot.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/air/AirStackSlot.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -28,15 +28,15 @@
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(B3_JIT)
</span><span class="cx"> 
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace B3 { namespace Air {
</span><span class="cx"> 
</span><span class="cx"> void StackSlot::setOffsetFromFP(intptr_t value)
</span><span class="cx"> {
</span><span class="cx">     m_offsetFromFP = value;
</span><del>-    if (m_value)
-        m_value-&gt;m_offsetFromFP = value;
</del><ins>+    if (m_b3Slot)
+        m_b3Slot-&gt;m_offsetFromFP = value;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void StackSlot::dump(PrintStream&amp; out) const
</span><span class="lines">@@ -47,16 +47,16 @@
</span><span class="cx"> void StackSlot::deepDump(PrintStream&amp; out) const
</span><span class="cx"> {
</span><span class="cx">     out.print(&quot;byteSize = &quot;, m_byteSize, &quot;, offsetFromFP = &quot;, m_offsetFromFP, &quot;, kind = &quot;, m_kind);
</span><del>-    if (m_value)
-        out.print(&quot;, value = &quot;, *m_value);
</del><ins>+    if (m_b3Slot)
+        out.print(&quot;, b3Slot = &quot;, *m_b3Slot, &quot;: (&quot;, B3::deepDump(m_b3Slot), &quot;)&quot;);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-StackSlot::StackSlot(unsigned byteSize, unsigned index, StackSlotKind kind, StackSlotValue* value)
</del><ins>+StackSlot::StackSlot(unsigned byteSize, unsigned index, StackSlotKind kind, B3::StackSlot* b3Slot)
</ins><span class="cx">     : m_byteSize(byteSize)
</span><span class="cx">     , m_index(index)
</span><del>-    , m_offsetFromFP(value ? value-&gt;offsetFromFP() : 0)
</del><ins>+    , m_offsetFromFP(b3Slot ? b3Slot-&gt;offsetFromFP() : 0)
</ins><span class="cx">     , m_kind(kind)
</span><del>-    , m_value(value)
</del><ins>+    , m_b3Slot(b3Slot)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(byteSize);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirStackSloth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirStackSlot.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirStackSlot.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/air/AirStackSlot.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace B3 {
</span><span class="cx"> 
</span><del>-class StackSlotValue;
</del><ins>+class StackSlot;
</ins><span class="cx"> 
</span><span class="cx"> namespace Air {
</span><span class="cx"> 
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">         return 8;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    StackSlotValue* value() const { return m_value; }
</del><ins>+    B3::StackSlot* b3Slot() const { return m_b3Slot; }
</ins><span class="cx"> 
</span><span class="cx">     // Zero means that it's not yet assigned.
</span><span class="cx">     intptr_t offsetFromFP() const { return m_offsetFromFP; }
</span><span class="lines">@@ -80,13 +80,13 @@
</span><span class="cx"> private:
</span><span class="cx">     friend class Code;
</span><span class="cx"> 
</span><del>-    StackSlot(unsigned byteSize, unsigned index, StackSlotKind, StackSlotValue*);
</del><ins>+    StackSlot(unsigned byteSize, unsigned index, StackSlotKind, B3::StackSlot*);
</ins><span class="cx">     
</span><span class="cx">     unsigned m_byteSize;
</span><span class="cx">     unsigned m_index;
</span><span class="cx">     intptr_t m_offsetFromFP;
</span><span class="cx">     StackSlotKind m_kind;
</span><del>-    StackSlotValue* m_value;
</del><ins>+    B3::StackSlot* m_b3Slot;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class DeepStackSlotDump {
</span><span class="lines">@@ -119,7 +119,7 @@
</span><span class="cx"> 
</span><span class="cx"> inline void printInternal(PrintStream&amp; out, JSC::B3::Air::StackSlot* stackSlot)
</span><span class="cx"> {
</span><del>-    out.print(*stackSlot);
</del><ins>+    out.print(pointerDump(stackSlot));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WTF
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3testb3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/testb3.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/testb3.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/b3/testb3.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -37,7 +37,8 @@
</span><span class="cx"> #include &quot;B3MathExtras.h&quot;
</span><span class="cx"> #include &quot;B3MemoryValue.h&quot;
</span><span class="cx"> #include &quot;B3Procedure.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;B3StackmapGenerationParams.h&quot;
</span><span class="cx"> #include &quot;B3SwitchValue.h&quot;
</span><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="lines">@@ -4987,7 +4988,8 @@
</span><span class="cx">     BasicBlock* root = proc.addBlock();
</span><span class="cx">     root-&gt;appendNew&lt;ControlValue&gt;(
</span><span class="cx">         proc, Return, Origin(),
</span><del>-        root-&gt;appendNew&lt;StackSlotValue&gt;(proc, Origin(), 1, StackSlotKind::Anonymous));
</del><ins>+        root-&gt;appendNew&lt;SlotBaseValue&gt;(
+            proc, Origin(), proc.addStackSlot(1, StackSlotKind::Anonymous)));
</ins><span class="cx"> 
</span><span class="cx">     void* stackSlot = compileAndRun&lt;void*&gt;(proc);
</span><span class="cx">     CHECK(stackSlot &lt; &amp;proc);
</span><span class="lines">@@ -5015,8 +5017,8 @@
</span><span class="cx">     Procedure proc;
</span><span class="cx">     BasicBlock* root = proc.addBlock();
</span><span class="cx"> 
</span><del>-    StackSlotValue* stack = root-&gt;appendNew&lt;StackSlotValue&gt;(
-        proc, Origin(), sizeof(int), StackSlotKind::Anonymous);
</del><ins>+    SlotBaseValue* stack = root-&gt;appendNew&lt;SlotBaseValue&gt;(
+        proc, Origin(), proc.addStackSlot(sizeof(int), StackSlotKind::Anonymous));
</ins><span class="cx"> 
</span><span class="cx">     root-&gt;appendNew&lt;MemoryValue&gt;(
</span><span class="cx">         proc, Store, Origin(),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLB3Compilecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLB3Compile.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLB3Compile.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ftl/FTLB3Compile.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx"> #include &quot;AirCode.h&quot;
</span><span class="cx"> #include &quot;B3Generate.h&quot;
</span><span class="cx"> #include &quot;B3ProcedureInlines.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3StackSlot.h&quot;
</ins><span class="cx"> #include &quot;CodeBlockWithJITType.h&quot;
</span><span class="cx"> #include &quot;CCallHelpers.h&quot;
</span><span class="cx"> #include &quot;DFGCommon.h&quot;
</span><span class="lines">@@ -84,6 +84,12 @@
</span><span class="cx"> 
</span><span class="cx">     int localsOffset =
</span><span class="cx">         state.capturedValue-&gt;offsetFromFP() / sizeof(EncodedJSValue) + graph.m_nextMachineLocal;
</span><ins>+    if (shouldDumpDisassembly()) {
+        dataLog(
+            &quot;localsOffset = &quot;, localsOffset, &quot; for stack slot: &quot;,
+            pointerDump(state.capturedValue), &quot; at &quot;, RawPointer(state.capturedValue), &quot;\n&quot;);
+    }
+    
</ins><span class="cx">     for (unsigned i = graph.m_inlineVariableData.size(); i--;) {
</span><span class="cx">         InlineCallFrame* inlineCallFrame = graph.m_inlineVariableData[i].inlineCallFrame;
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLB3Outputcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLB3Output.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLB3Output.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ftl/FTLB3Output.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -79,9 +79,10 @@
</span><span class="cx">     m_block = block;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-StackSlotValue* Output::lockedStackSlot(size_t bytes)
</del><ins>+SlotBaseValue* Output::lockedStackSlot(size_t bytes)
</ins><span class="cx"> {
</span><del>-    return m_block-&gt;appendNew&lt;StackSlotValue&gt;(m_proc, origin(), bytes, StackSlotKind::Locked);
</del><ins>+    return m_block-&gt;appendNew&lt;SlotBaseValue&gt;(
+        m_proc, origin(), m_proc.addStackSlot(bytes, StackSlotKind::Locked));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> LValue Output::neg(LValue value)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLB3Outputh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLB3Output.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLB3Output.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ftl/FTLB3Output.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> #include &quot;B3ControlValue.h&quot;
</span><span class="cx"> #include &quot;B3MemoryValue.h&quot;
</span><span class="cx"> #include &quot;B3Procedure.h&quot;
</span><del>-#include &quot;B3StackSlotValue.h&quot;
</del><ins>+#include &quot;B3SlotBaseValue.h&quot;
</ins><span class="cx"> #include &quot;B3SwitchValue.h&quot;
</span><span class="cx"> #include &quot;B3UpsilonValue.h&quot;
</span><span class="cx"> #include &quot;B3ValueInlines.h&quot;
</span><span class="lines">@@ -102,7 +102,7 @@
</span><span class="cx"> 
</span><span class="cx">     LValue framePointer() { return m_block-&gt;appendNew&lt;B3::Value&gt;(m_proc, B3::FramePointer, origin()); }
</span><span class="cx"> 
</span><del>-    B3::StackSlotValue* lockedStackSlot(size_t bytes);
</del><ins>+    B3::SlotBaseValue* lockedStackSlot(size_t bytes);
</ins><span class="cx"> 
</span><span class="cx">     LValue constBool(bool value) { return m_block-&gt;appendNew&lt;B3::Const32Value&gt;(m_proc, origin(), value); }
</span><span class="cx">     LValue constInt32(int32_t value) { return m_block-&gt;appendNew&lt;B3::Const32Value&gt;(m_proc, origin(), value); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -207,9 +207,9 @@
</span><span class="cx"> 
</span><span class="cx"> #if FTL_USES_B3
</span><span class="cx">         size_t sizeOfCaptured = sizeof(JSValue) * m_graph.m_nextMachineLocal;
</span><del>-        B3::StackSlotValue* capturedBase = m_out.lockedStackSlot(sizeOfCaptured);
</del><ins>+        B3::SlotBaseValue* capturedBase = m_out.lockedStackSlot(sizeOfCaptured);
</ins><span class="cx">         m_captured = m_out.add(capturedBase, m_out.constIntPtr(sizeOfCaptured));
</span><del>-        state-&gt;capturedValue = capturedBase;
</del><ins>+        state-&gt;capturedValue = capturedBase-&gt;slot();
</ins><span class="cx"> #else // FTL_USES_B3
</span><span class="cx">         LValue capturedAlloca = m_out.alloca(arrayType(m_out.int64, m_graph.m_nextMachineLocal));
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLState.h (195619 => 195620)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLState.h        2016-01-26 21:55:08 UTC (rev 195619)
+++ trunk/Source/JavaScriptCore/ftl/FTLState.h        2016-01-26 22:05:28 UTC (rev 195620)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace B3 {
</span><span class="cx"> class PatchpointValue;
</span><del>-class StackSlotValue;
</del><ins>+class StackSlot;
</ins><span class="cx"> } // namespace B3
</span><span class="cx"> 
</span><span class="cx"> namespace FTL {
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx">     // are no applicable catch blocks anywhere in the Graph.
</span><span class="cx">     RefPtr&lt;PatchpointExceptionHandle&gt; defaultExceptionHandle;
</span><span class="cx">     Box&lt;CCallHelpers::Label&gt; exceptionHandler { Box&lt;CCallHelpers::Label&gt;::create() };
</span><del>-    B3::StackSlotValue* capturedValue { nullptr };
</del><ins>+    B3::StackSlot* capturedValue { nullptr };
</ins><span class="cx"> #else // FTL_USES_B3
</span><span class="cx">     unsigned handleStackOverflowExceptionStackmapID { UINT_MAX };
</span><span class="cx">     unsigned handleExceptionStackmapID { UINT_MAX };
</span></span></pre>
</div>
</div>

</body>
</html>