<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[209560] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/209560">209560</a></dd>
<dt>Author</dt> <dd>jfbastien@apple.com</dd>
<dt>Date</dt> <dd>2016-12-08 13:09:06 -0800 (Thu, 08 Dec 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>WebAssembly JS API: wire up Instance imports
https://bugs.webkit.org/show_bug.cgi?id=165118

Reviewed by Saam Barati.

JSTests:

* wasm/js-api/test_Instance.js: add the test, disabled for now

Source/JavaScriptCore:

Change a bunch of the WebAssembly object model, and pipe the
necessary changes to be able to call JS imports from
WebAssembly. This will make it easier to call_indirect, and
unblock many other missing features.

As a follow-up I need to teach JSC::linkFor to live without a
CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
switch on the callee (or its type?) and then use that as the owner
(because the callee is alive if the instance is alive, ditto
module, and module owns the CallLinkInfo).

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* interpreter/CallFrame.h:
(JSC::ExecState::callee): give access to the callee as a JSCell
* jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
* jsc.cpp:
(callWasmFunction):
(functionTestWasmModuleFunctions):
* runtime/JSCellInlines.h:
(JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
* runtime/VM.cpp:
(JSC::VM::VM): store the &quot;top&quot; WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
* runtime/VM.h:
* testWasm.cpp:
(runWasmTests):
* wasm/JSWebAssembly.h:
* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
(JSC::Wasm::B3IRGenerator::addCall):
(JSC::Wasm::createJSToWasmWrapper):
(JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
* wasm/WasmB3IRGenerator.h:
* wasm/WasmBinding.cpp: Added.
(JSC::Wasm::importStubGenerator): stubs from wasm to JS
* wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
* wasm/WasmCallingConvention.h:
(JSC::Wasm::CallingConvention::setupFrameInPrologue):
* wasm/WasmFormat.h: fix the object model
(JSC::Wasm::CallableFunction::CallableFunction):
* wasm/WasmFunctionParser.h: simplify some of the failure condition checks
(JSC::Wasm::FunctionParser&lt;Context&gt;::FunctionParser): need function index space, not just internal functions
(JSC::Wasm::FunctionParser&lt;Context&gt;::parseExpression):
* wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
(JSC::Wasm::ModuleParser::parseImport):
(JSC::Wasm::ModuleParser::parseFunction):
(JSC::Wasm::ModuleParser::parseMemory):
(JSC::Wasm::ModuleParser::parseExport):
(JSC::Wasm::ModuleParser::parseCode):
* wasm/WasmModuleParser.h:
(JSC::Wasm::ModuleParser::functionIndexSpace):
(JSC::Wasm::ModuleParser::functionLocations):
* wasm/WasmParser.h:
(JSC::Wasm::Parser::consumeUTF8String):
* wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
(JSC::Wasm::Plan::run):
(JSC::Wasm::Plan::initializeCallees):
* wasm/WasmPlan.h:
(JSC::Wasm::Plan::exports):
(JSC::Wasm::Plan::internalFunctionCount):
(JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
(JSC::Wasm::Plan::takeModuleInformation):
(JSC::Wasm::Plan::takeCallLinkInfos):
(JSC::Wasm::Plan::takeWasmToJSStubs):
(JSC::Wasm::Plan::takeFunctionIndexSpace):
* wasm/WasmValidate.cpp: check function index space instead of only internal functions
(JSC::Wasm::Validate::addCall):
(JSC::Wasm::validateFunction):
* wasm/WasmValidate.h:
* wasm/js/JSWebAssemblyCallee.cpp:
(JSC::JSWebAssemblyCallee::finishCreation):
* wasm/js/JSWebAssemblyCallee.h:
(JSC::JSWebAssemblyCallee::create):
(JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
* wasm/js/JSWebAssemblyInstance.cpp:
(JSC::JSWebAssemblyInstance::create):
(JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
(JSC::JSWebAssemblyInstance::visitChildren):
* wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
(JSC::JSWebAssemblyInstance::importFunction):
(JSC::JSWebAssemblyInstance::importFunctions):
(JSC::JSWebAssemblyInstance::setImportFunction):
(JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
(JSC::JSWebAssemblyInstance::offsetOfImportFunction):
(JSC::JSWebAssemblyInstance::allocationSize):
* wasm/js/JSWebAssemblyModule.cpp:
(JSC::JSWebAssemblyModule::create):
(JSC::JSWebAssemblyModule::JSWebAssemblyModule):
(JSC::JSWebAssemblyModule::visitChildren):
* wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
(JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
(JSC::JSWebAssemblyModule::importCount):
(JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
* wasm/js/WebAssemblyFunction.cpp:
(JSC::callWebAssemblyFunction): set top Instance on VM
* wasm/js/WebAssemblyFunction.h:
(JSC::WebAssemblyFunction::instance):
* wasm/js/WebAssemblyInstanceConstructor.cpp:
(JSC::constructJSWebAssemblyInstance): handle function imports
* wasm/js/WebAssemblyModuleConstructor.cpp:
(JSC::constructJSWebAssemblyModule): generate the stubs for import functions
* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::link):
* wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
(JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
(JSC::WebAssemblyToJSCallee::createStructure):
(JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
(JSC::WebAssemblyToJSCallee::finishCreation):
(JSC::WebAssemblyToJSCallee::destroy):
* wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkJSTestswasmjsapitest_Instancejs">trunk/JSTests/wasm/js-api/test_Instance.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterCallFrameh">trunk/Source/JavaScriptCore/interpreter/CallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRegisterSetcpp">trunk/Source/JavaScriptCore/jit/RegisterSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellInlinesh">trunk/Source/JavaScriptCore/runtime/JSCellInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestWasmcpp">trunk/Source/JavaScriptCore/testWasm.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmJSWebAssemblyh">trunk/Source/JavaScriptCore/wasm/JSWebAssembly.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmB3IRGeneratorcpp">trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmB3IRGeneratorh">trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmCallingConventionh">trunk/Source/JavaScriptCore/wasm/WasmCallingConvention.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmFormath">trunk/Source/JavaScriptCore/wasm/WasmFormat.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmFunctionParserh">trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmModuleParsercpp">trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmModuleParserh">trunk/Source/JavaScriptCore/wasm/WasmModuleParser.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmParserh">trunk/Source/JavaScriptCore/wasm/WasmParser.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmPlancpp">trunk/Source/JavaScriptCore/wasm/WasmPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmPlanh">trunk/Source/JavaScriptCore/wasm/WasmPlan.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmValidatecpp">trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmValidateh">trunk/Source/JavaScriptCore/wasm/WasmValidate.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyCalleecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyCalleeh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstancecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstanceh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyModulecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyModuleh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyFunctionh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyInstanceConstructorcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModuleConstructorcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCorewasmWasmBindingcpp">trunk/Source/JavaScriptCore/wasm/WasmBinding.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmBindingh">trunk/Source/JavaScriptCore/wasm/WasmBinding.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyToJSCalleecpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyToJSCalleeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/JSTests/ChangeLog        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -1,3 +1,12 @@
</span><ins>+2016-12-08  JF Bastien  &lt;jfbastien@apple.com&gt;
+
+        WebAssembly JS API: wire up Instance imports
+        https://bugs.webkit.org/show_bug.cgi?id=165118
+
+        Reviewed by Saam Barati.
+
+        * wasm/js-api/test_Instance.js: add the test, disabled for now
+
</ins><span class="cx"> 2016-12-07  Keith Miller  &lt;keith_miller@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Add more missing trivial wasm ops.
</span></span></pre></div>
<a id="trunkJSTestswasmjsapitest_Instancejs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/wasm/js-api/test_Instance.js (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/wasm/js-api/test_Instance.js        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/JSTests/wasm/js-api/test_Instance.js        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -29,3 +29,36 @@
</span><span class="cx">     assert.isA(result, &quot;number&quot;);
</span><span class="cx">     assert.eq(result, 42);
</span><span class="cx"> })();
</span><ins>+
+/* FIXME this currently crashes as detailed in https://bugs.webkit.org/show_bug.cgi?id=165591
+(function Import() {
+    let counter = 0;
+    const counterSetter = v =&gt; counter = v;
+    const builder = (new Builder())
+        .Type().End()
+        .Import()
+            .Function(&quot;imp&quot;, &quot;func&quot;, { params: [&quot;i32&quot;] })
+        .End()
+        .Function().End()
+        .Export()
+            .Function(&quot;changeCounter&quot;)
+        .End()
+        .Code()
+            .Function(&quot;changeCounter&quot;, { params: [&quot;i32&quot;] })
+                .I32Const(42)
+                .GetLocal(0)
+                .I32Add()
+                .Call(0) // Calls func(param[0] + 42).
+            .End()
+        .End();
+    const bin = builder.WebAssembly().get();
+    const module = new WebAssembly.Module(bin);
+    const instance = new WebAssembly.Instance(module, { imp: { func: counterSetter } });
+    instance.exports.changeCounter(0);
+    assert.eq(counter, 42);
+    instance.exports.changeCounter(1);
+    assert.eq(counter, 43);
+    instance.exports.changeCounter(42);
+    assert.eq(counter, 84);
+})();
+*/
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -896,6 +896,7 @@
</span><span class="cx"> 
</span><span class="cx">     wasm/JSWebAssembly.cpp
</span><span class="cx">     wasm/WasmB3IRGenerator.cpp
</span><ins>+    wasm/WasmBinding.cpp
</ins><span class="cx">     wasm/WasmCallingConvention.cpp
</span><span class="cx">     wasm/WasmFormat.cpp
</span><span class="cx">     wasm/WasmMemory.cpp
</span><span class="lines">@@ -925,6 +926,7 @@
</span><span class="cx">     wasm/js/WebAssemblyRuntimeErrorPrototype.cpp
</span><span class="cx">     wasm/js/WebAssemblyTableConstructor.cpp
</span><span class="cx">     wasm/js/WebAssemblyTablePrototype.cpp
</span><ins>+    wasm/js/WebAssemblyToJSCallee.cpp
</ins><span class="cx"> 
</span><span class="cx">     yarr/RegularExpression.cpp
</span><span class="cx">     yarr/YarrCanonicalizeUCS2.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -1,3 +1,121 @@
</span><ins>+2016-12-08  JF Bastien  &lt;jfbastien@apple.com&gt;
+
+        WebAssembly JS API: wire up Instance imports
+        https://bugs.webkit.org/show_bug.cgi?id=165118
+
+        Reviewed by Saam Barati.
+
+        Change a bunch of the WebAssembly object model, and pipe the
+        necessary changes to be able to call JS imports from
+        WebAssembly. This will make it easier to call_indirect, and
+        unblock many other missing features.
+
+        As a follow-up I need to teach JSC::linkFor to live without a
+        CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
+        switch on the callee (or its type?) and then use that as the owner
+        (because the callee is alive if the instance is alive, ditto
+        module, and module owns the CallLinkInfo).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee): give access to the callee as a JSCell
+        * jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
+        * jsc.cpp:
+        (callWasmFunction):
+        (functionTestWasmModuleFunctions):
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
+        * runtime/VM.cpp:
+        (JSC::VM::VM): store the &quot;top&quot; WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
+        * runtime/VM.h:
+        * testWasm.cpp:
+        (runWasmTests):
+        * wasm/JSWebAssembly.h:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
+        (JSC::Wasm::B3IRGenerator::addCall):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmBinding.cpp: Added.
+        (JSC::Wasm::importStubGenerator): stubs from wasm to JS
+        * wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::setupFrameInPrologue):
+        * wasm/WasmFormat.h: fix the object model
+        (JSC::Wasm::CallableFunction::CallableFunction):
+        * wasm/WasmFunctionParser.h: simplify some of the failure condition checks
+        (JSC::Wasm::FunctionParser&lt;Context&gt;::FunctionParser): need function index space, not just internal functions
+        (JSC::Wasm::FunctionParser&lt;Context&gt;::parseExpression):
+        * wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseFunction):
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseExport):
+        (JSC::Wasm::ModuleParser::parseCode):
+        * wasm/WasmModuleParser.h:
+        (JSC::Wasm::ModuleParser::functionIndexSpace):
+        (JSC::Wasm::ModuleParser::functionLocations):
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::consumeUTF8String):
+        * wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
+        (JSC::Wasm::Plan::run):
+        (JSC::Wasm::Plan::initializeCallees):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::exports):
+        (JSC::Wasm::Plan::internalFunctionCount):
+        (JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
+        (JSC::Wasm::Plan::takeModuleInformation):
+        (JSC::Wasm::Plan::takeCallLinkInfos):
+        (JSC::Wasm::Plan::takeWasmToJSStubs):
+        (JSC::Wasm::Plan::takeFunctionIndexSpace):
+        * wasm/WasmValidate.cpp: check function index space instead of only internal functions
+        (JSC::Wasm::Validate::addCall):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h:
+        * wasm/js/JSWebAssemblyCallee.cpp:
+        (JSC::JSWebAssemblyCallee::finishCreation):
+        * wasm/js/JSWebAssemblyCallee.h:
+        (JSC::JSWebAssemblyCallee::create):
+        (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
+        (JSC::JSWebAssemblyInstance::importFunction):
+        (JSC::JSWebAssemblyInstance::importFunctions):
+        (JSC::JSWebAssemblyInstance::setImportFunction):
+        (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
+        (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
+        (JSC::JSWebAssemblyInstance::allocationSize):
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
+        (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
+        (JSC::JSWebAssemblyModule::importCount):
+        (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction): set top Instance on VM
+        * wasm/js/WebAssemblyFunction.h:
+        (JSC::WebAssemblyFunction::instance):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance): handle function imports
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule): generate the stubs for import functions
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::link):
+        * wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
+        (JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
+        (JSC::WebAssemblyToJSCallee::createStructure):
+        (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
+        (JSC::WebAssemblyToJSCallee::finishCreation):
+        (JSC::WebAssemblyToJSCallee::destroy):
+        * wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
+
</ins><span class="cx"> 2016-12-08  Mark Lam  &lt;mark.lam@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Enable JSC restricted options by default in the jsc shell.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -2008,7 +2008,11 @@
</span><span class="cx">                 AD4937C81DDD0AAE0077C807 /* WebAssemblyModuleRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */; };
</span><span class="cx">                 AD4937D31DDD27DE0077C807 /* WebAssemblyFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */; };
</span><span class="cx">                 AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */; };
</span><ins>+                AD4B1DF91DF244E20071AE32 /* WasmBinding.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */; };
+                AD4B1DFA1DF244E20071AE32 /* WasmBinding.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4B1DF81DF244D70071AE32 /* WasmBinding.h */; };
</ins><span class="cx">                 AD86A93E1AA4D88D002FE77F /* WeakGCMapInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = AD86A93D1AA4D87C002FE77F /* WeakGCMapInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                ADBC54D41DF8EA2B005BF738 /* WebAssemblyToJSCallee.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */; };
+                ADBC54D51DF8EA2B005BF738 /* WebAssemblyToJSCallee.h in Headers */ = {isa = PBXBuildFile; fileRef = ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */; };
</ins><span class="cx">                 ADDB1F6318D77DBE009B58A8 /* OpaqueRootSet.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDB1F6218D77DB7009B58A8 /* OpaqueRootSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 ADE39FFF16DD144B0003CD4A /* PropertyTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD1CF06816DCAB2D00B97123 /* PropertyTable.cpp */; };
</span><span class="cx">                 B59F89391891F29F00D5CCDC /* UnlinkedInstructionStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */; };
</span><span class="lines">@@ -4473,7 +4477,11 @@
</span><span class="cx">                 AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyModuleRecord.h; path = js/WebAssemblyModuleRecord.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyFunction.cpp; path = js/WebAssemblyFunction.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyFunction.h; path = js/WebAssemblyFunction.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmBinding.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                AD4B1DF81DF244D70071AE32 /* WasmBinding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmBinding.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 AD86A93D1AA4D87C002FE77F /* WeakGCMapInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMapInlines.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyToJSCallee.cpp; path = js/WebAssemblyToJSCallee.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyToJSCallee.h; path = js/WebAssemblyToJSCallee.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 ADDB1F6218D77DB7009B58A8 /* OpaqueRootSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpaqueRootSet.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 B59F89371891AD3300D5CCDC /* UnlinkedInstructionStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedInstructionStream.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedInstructionStream.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -5984,11 +5992,13 @@
</span><span class="cx">                 7B98D1331B60CD1E0023B1A4 /* wasm */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><ins>+                                AD2FCB8A1DB5840000B3E736 /* js */,
</ins><span class="cx">                                 AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */,
</span><span class="cx">                                 AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */,
</span><del>-                                AD2FCB8A1DB5840000B3E736 /* js */,
</del><span class="cx">                                 53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */,
</span><span class="cx">                                 53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */,
</span><ins>+                                AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */,
+                                AD4B1DF81DF244D70071AE32 /* WasmBinding.h */,
</ins><span class="cx">                                 53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */,
</span><span class="cx">                                 53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */,
</span><span class="cx">                                 AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */,
</span><span class="lines">@@ -5998,9 +6008,9 @@
</span><span class="cx">                                 535557131D9D9EA5006D583B /* WasmMemory.h */,
</span><span class="cx">                                 53F40E961D5A7BEC0099A1B6 /* WasmModuleParser.cpp */,
</span><span class="cx">                                 53F40E941D5A7AEF0099A1B6 /* WasmModuleParser.h */,
</span><ins>+                                53F40E8C1D5901F20099A1B6 /* WasmParser.h */,
</ins><span class="cx">                                 531374BE1D5CE95000AF7A0B /* WasmPlan.cpp */,
</span><span class="cx">                                 531374BC1D5CE67600AF7A0B /* WasmPlan.h */,
</span><del>-                                53F40E8C1D5901F20099A1B6 /* WasmParser.h */,
</del><span class="cx">                                 53F40E841D58F9770099A1B6 /* WasmSections.h */,
</span><span class="cx">                                 53FF7F9A1DBFD2B900A26CCC /* WasmValidate.cpp */,
</span><span class="cx">                                 53FF7F981DBFCD9000A26CCC /* WasmValidate.h */,
</span><span class="lines">@@ -7557,12 +7567,6 @@
</span><span class="cx">                 AD2FCB8A1DB5840000B3E736 /* js */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><del>-                                AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
-                                AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
-                                AD4937C51DDCDCF00077C807 /* WebAssemblyModuleRecord.cpp */,
-                                AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */,
-                                AD2FCC261DB838C400B3E736 /* WebAssemblyPrototype.cpp */,
-                                AD2FCC271DB838C400B3E736 /* WebAssemblyPrototype.h */,
</del><span class="cx">                                 79E423E01DEE65320078D355 /* JSWebAssemblyCallee.cpp */,
</span><span class="cx">                                 79E423E11DEE65320078D355 /* JSWebAssemblyCallee.h */,
</span><span class="cx">                                 AD2FCBA61DB58DA400B3E736 /* JSWebAssemblyCompileError.cpp */,
</span><span class="lines">@@ -7571,6 +7575,8 @@
</span><span class="cx">                                 AD2FCBA91DB58DA400B3E736 /* JSWebAssemblyInstance.h */,
</span><span class="cx">                                 AD2FCBAA1DB58DA400B3E736 /* JSWebAssemblyMemory.cpp */,
</span><span class="cx">                                 AD2FCBAB1DB58DA400B3E736 /* JSWebAssemblyMemory.h */,
</span><ins>+                                AD2FCB8C1DB5844000B3E736 /* JSWebAssemblyModule.cpp */,
+                                AD2FCB8D1DB5844000B3E736 /* JSWebAssemblyModule.h */,
</ins><span class="cx">                                 AD2FCBAC1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.cpp */,
</span><span class="cx">                                 AD2FCBAD1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.h */,
</span><span class="cx">                                 AD2FCBAE1DB58DA400B3E736 /* JSWebAssemblyTable.cpp */,
</span><span class="lines">@@ -7579,6 +7585,8 @@
</span><span class="cx">                                 AD2FCBB11DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.h */,
</span><span class="cx">                                 AD2FCBB21DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.cpp */,
</span><span class="cx">                                 AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */,
</span><ins>+                                AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
+                                AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
</ins><span class="cx">                                 AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */,
</span><span class="cx">                                 AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */,
</span><span class="cx">                                 AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */,
</span><span class="lines">@@ -7587,6 +7595,14 @@
</span><span class="cx">                                 AD2FCBB91DB58DA400B3E736 /* WebAssemblyMemoryConstructor.h */,
</span><span class="cx">                                 AD2FCBBA1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.cpp */,
</span><span class="cx">                                 AD2FCBBB1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.h */,
</span><ins>+                                AD2FCB981DB585A600B3E736 /* WebAssemblyModuleConstructor.cpp */,
+                                AD2FCB991DB585A600B3E736 /* WebAssemblyModuleConstructor.h */,
+                                AD2FCB9A1DB585A600B3E736 /* WebAssemblyModulePrototype.cpp */,
+                                AD2FCB9B1DB585A600B3E736 /* WebAssemblyModulePrototype.h */,
+                                AD4937C51DDCDCF00077C807 /* WebAssemblyModuleRecord.cpp */,
+                                AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */,
+                                AD2FCC261DB838C400B3E736 /* WebAssemblyPrototype.cpp */,
+                                AD2FCC271DB838C400B3E736 /* WebAssemblyPrototype.h */,
</ins><span class="cx">                                 AD2FCBBC1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp */,
</span><span class="cx">                                 AD2FCBBD1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.h */,
</span><span class="cx">                                 AD2FCBBE1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp */,
</span><span class="lines">@@ -7595,12 +7611,8 @@
</span><span class="cx">                                 AD2FCBC11DB58DA400B3E736 /* WebAssemblyTableConstructor.h */,
</span><span class="cx">                                 AD2FCBC21DB58DA400B3E736 /* WebAssemblyTablePrototype.cpp */,
</span><span class="cx">                                 AD2FCBC31DB58DA400B3E736 /* WebAssemblyTablePrototype.h */,
</span><del>-                                AD2FCB981DB585A600B3E736 /* WebAssemblyModuleConstructor.cpp */,
-                                AD2FCB991DB585A600B3E736 /* WebAssemblyModuleConstructor.h */,
-                                AD2FCB9A1DB585A600B3E736 /* WebAssemblyModulePrototype.cpp */,
-                                AD2FCB9B1DB585A600B3E736 /* WebAssemblyModulePrototype.h */,
-                                AD2FCB8C1DB5844000B3E736 /* JSWebAssemblyModule.cpp */,
-                                AD2FCB8D1DB5844000B3E736 /* JSWebAssemblyModule.h */,
</del><ins>+                                ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */,
+                                ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */,
</ins><span class="cx">                         );
</span><span class="cx">                         name = js;
</span><span class="cx">                         sourceTree = &quot;&lt;group&gt;&quot;;
</span><span class="lines">@@ -8313,6 +8325,7 @@
</span><span class="cx">                                 0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */,
</span><span class="cx">                                 0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */,
</span><span class="cx">                                 0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
</span><ins>+                                AD4B1DFA1DF244E20071AE32 /* WasmBinding.h in Headers */,
</ins><span class="cx">                                 0F0332C418B01763005F979A /* GetByIdVariant.h in Headers */,
</span><span class="cx">                                 7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */,
</span><span class="cx">                                 AD2FCC1C1DB59CB200B3E736 /* WebAssemblyModuleConstructor.lut.h in Headers */,
</span><span class="lines">@@ -8501,6 +8514,7 @@
</span><span class="cx">                                 0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */,
</span><span class="cx">                                 53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */,
</span><span class="cx">                                 0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */,
</span><ins>+                                ADBC54D51DF8EA2B005BF738 /* WebAssemblyToJSCallee.h in Headers */,
</ins><span class="cx">                                 797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */,
</span><span class="cx">                                 BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
</span><span class="cx">                                 53F40E8B1D5901BB0099A1B6 /* WasmFunctionParser.h in Headers */,
</span><span class="lines">@@ -9917,6 +9931,7 @@
</span><span class="cx">                                 62D2D38F1ADF103F000206C1 /* FunctionRareData.cpp in Sources */,
</span><span class="cx">                                 2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */,
</span><span class="cx">                                 0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */,
</span><ins>+                                AD4B1DF91DF244E20071AE32 /* WasmBinding.cpp in Sources */,
</ins><span class="cx">                                 2ADFA26318EF3540004F9FCC /* GCLogging.cpp in Sources */,
</span><span class="cx">                                 5341FC701DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp in Sources */,
</span><span class="cx">                                 0F93329F14CA7DCA0085F3C6 /* GetByIdStatus.cpp in Sources */,
</span><span class="lines">@@ -10055,6 +10070,7 @@
</span><span class="cx">                                 0F4A38F91C8E13DF00190318 /* SuperSampler.cpp in Sources */,
</span><span class="cx">                                 797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */,
</span><span class="cx">                                 DC454B8C1D00E822004C18AF /* AirDumpAsJS.cpp in Sources */,
</span><ins>+                                ADBC54D41DF8EA2B005BF738 /* WebAssemblyToJSCallee.cpp in Sources */,
</ins><span class="cx">                                 147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
</span><span class="cx">                                 A5FD0085189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp in Sources */,
</span><span class="cx">                                 A5C3A1A518C0490200C9593A /* JSGlobalObjectConsoleClient.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/CallFrame.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/CallFrame.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/interpreter/CallFrame.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -86,6 +86,7 @@
</span><span class="cx">     public:
</span><span class="cx">         static const int headerSizeInRegisters = CallFrameSlot::argumentCount + 1;
</span><span class="cx"> 
</span><ins>+        JSCell* callee() const { return this[CallFrameSlot::callee].unboxedCell(); }
</ins><span class="cx">         JSValue calleeAsValue() const { return this[CallFrameSlot::callee].jsValue(); }
</span><span class="cx">         JSObject* jsCallee() const { return this[CallFrameSlot::callee].object(); }
</span><span class="cx">         SUPPRESS_ASAN JSValue unsafeCallee() const { return this[CallFrameSlot::callee].asanUnsafeJSValue(); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRegisterSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/RegisterSet.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/RegisterSet.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/jit/RegisterSet.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -306,39 +306,6 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-#if ENABLE(WEBASSEMBLY)
-RegisterSet RegisterSet::webAssemblyCalleeSaveRegisters()
-{
-    RegisterSet result;
-#if CPU(X86)
-#elif CPU(X86_64)
-#if !OS(WINDOWS)
-    ASSERT(GPRInfo::regCS3 == GPRInfo::tagTypeNumberRegister);
-    ASSERT(GPRInfo::regCS4 == GPRInfo::tagMaskRegister);
-    result.set(GPRInfo::regCS3);
-    result.set(GPRInfo::regCS4);
-#else
-    ASSERT(GPRInfo::regCS5 == GPRInfo::tagTypeNumberRegister);
-    ASSERT(GPRInfo::regCS6 == GPRInfo::tagMaskRegister);
-    result.set(GPRInfo::regCS5);
-    result.set(GPRInfo::regCS6);
-#endif
-#elif CPU(ARM_THUMB2)
-#elif CPU(ARM_TRADITIONAL)
-#elif CPU(ARM64)
-    ASSERT(GPRInfo::regCS8 == GPRInfo::tagTypeNumberRegister);
-    ASSERT(GPRInfo::regCS9 == GPRInfo::tagMaskRegister);
-    result.set(GPRInfo::regCS8);
-    result.set(GPRInfo::regCS9);
-#elif CPU(MIPS)
-#elif CPU(SH4)
-#else
-    UNREACHABLE_FOR_PLATFORM();
-#endif
-    return result;
-}
-#endif
-
</del><span class="cx"> RegisterSet RegisterSet::argumentGPRS()
</span><span class="cx"> {
</span><span class="cx">     RegisterSet result;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -2592,7 +2592,7 @@
</span><span class="cx">     ProtoCallFrame protoCallFrame;
</span><span class="cx">     protoCallFrame.init(nullptr, globalObject-&gt;globalExec()-&gt;jsCallee(), firstArgument, argCount, remainingArgs);
</span><span class="cx"> 
</span><del>-    return JSValue::decode(vmEntryToWasm(wasmCallee-&gt;jsEntryPoint(), vm, &amp;protoCallFrame));
</del><ins>+    return JSValue::decode(vmEntryToWasm(wasmCallee-&gt;jsToWasmEntryPoint(), vm, &amp;protoCallFrame));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // testWasmModule(JSArrayBufferView source, number functionCount, ...[[WasmValue, [WasmValue]]]) where the ith copy of [[result, [args]]] is a list
</span><span class="lines">@@ -2618,7 +2618,7 @@
</span><span class="cx">         CRASH();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (plan.compiledFunctionCount() != functionCount)
</del><ins>+    if (plan.internalFunctionCount() != functionCount)
</ins><span class="cx">         CRASH();
</span><span class="cx"> 
</span><span class="cx">     MarkedArgumentBuffer callees;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCellInlines.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCellInlines.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/runtime/JSCellInlines.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -123,11 +123,11 @@
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE VM&amp; ExecState::vm() const
</span><span class="cx"> {
</span><del>-    ASSERT(jsCallee());
-    ASSERT(jsCallee()-&gt;vm());
-    ASSERT(!jsCallee()-&gt;isLargeAllocation());
</del><ins>+    ASSERT(callee());
+    ASSERT(callee()-&gt;vm());
+    ASSERT(!callee()-&gt;isLargeAllocation());
</ins><span class="cx">     // This is an important optimization since we access this so often.
</span><del>-    return *calleeAsValue().asCell()-&gt;markedBlock().vm();
</del><ins>+    return *callee()-&gt;markedBlock().vm();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -168,6 +168,7 @@
</span><span class="cx">     , clientData(0)
</span><span class="cx">     , topVMEntryFrame(nullptr)
</span><span class="cx">     , topCallFrame(CallFrame::noCaller())
</span><ins>+    , topJSWebAssemblyInstance(nullptr)
</ins><span class="cx">     , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
</span><span class="cx">     , propertyNames(nullptr)
</span><span class="cx">     , emptyList(new MarkedArgumentBuffer)
</span><span class="lines">@@ -229,6 +230,8 @@
</span><span class="cx">     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     webAssemblyCalleeStructure.set(*this, JSWebAssemblyCallee::createStructure(*this, 0, jsNull()));
</span><ins>+    webAssemblyToJSCalleeStructure.set(*this, WebAssemblyToJSCallee::createStructure(*this, 0, jsNull()));
+    webAssemblyToJSCallee.set(*this, WebAssemblyToJSCallee::create(*this, webAssemblyToJSCalleeStructure.get()));
</ins><span class="cx"> #endif
</span><span class="cx">     moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
</span><span class="cx">     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -96,6 +96,7 @@
</span><span class="cx"> class JSCustomGetterSetterFunction;
</span><span class="cx"> class JSGlobalObject;
</span><span class="cx"> class JSObject;
</span><ins>+class JSWebAssemblyInstance;
</ins><span class="cx"> class LLIntOffsetsExtractor;
</span><span class="cx"> class NativeExecutable;
</span><span class="cx"> class RegExpCache;
</span><span class="lines">@@ -292,7 +293,8 @@
</span><span class="cx">     // topVMEntryFrame.
</span><span class="cx">     // FIXME: This should be a void*, because it might not point to a CallFrame.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=160441
</span><del>-    ExecState* topCallFrame; 
</del><ins>+    ExecState* topCallFrame;
+    JSWebAssemblyInstance* topJSWebAssemblyInstance;
</ins><span class="cx">     Strong&lt;Structure&gt; structureStructure;
</span><span class="cx">     Strong&lt;Structure&gt; structureRareDataStructure;
</span><span class="cx">     Strong&lt;Structure&gt; terminatedExecutionErrorStructure;
</span><span class="lines">@@ -310,6 +312,8 @@
</span><span class="cx">     Strong&lt;Structure&gt; functionExecutableStructure;
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     Strong&lt;Structure&gt; webAssemblyCalleeStructure;
</span><ins>+    Strong&lt;Structure&gt; webAssemblyToJSCalleeStructure;
+    Strong&lt;JSCell&gt; webAssemblyToJSCallee;
</ins><span class="cx"> #endif
</span><span class="cx">     Strong&lt;Structure&gt; moduleProgramExecutableStructure;
</span><span class="cx">     Strong&lt;Structure&gt; regExpStructure;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestWasmcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/testWasm.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/testWasm.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/testWasm.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -175,13 +175,13 @@
</span><span class="cx">         CRASH();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (plan.compiledFunctionCount() != expectedNumberOfFunctions) {
</del><ins>+    if (plan.internalFunctionCount() != expectedNumberOfFunctions) {
</ins><span class="cx">         dataLogLn(&quot;Incorrect number of functions&quot;);
</span><span class="cx">         CRASH();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0; i &lt; expectedNumberOfFunctions; ++i) {
</span><del>-        if (!plan.compiledFunction(i)) {
</del><ins>+        if (!plan.jsToWasmEntryPointForFunction(i)) {
</ins><span class="cx">             dataLogLn(&quot;Function at index, &quot; , i, &quot; failed to compile correctly&quot;);
</span><span class="cx">             CRASH();
</span><span class="cx">         }
</span><span class="lines">@@ -222,10 +222,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 2);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 101);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(122) }), 123);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 2);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 101);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(122) }), 123);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -268,15 +268,15 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 213);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 212);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2) }), 211);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(3) }), 210);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(3) }), 210);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(4) }), 214);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(5) }), 214);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(-1) }), 214);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(-1000) }), 214);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 213);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 212);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2) }), 211);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(3) }), 210);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(3) }), 210);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(4) }), 214);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(5) }), 214);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(-1) }), 214);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(-1000) }), 214);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -306,10 +306,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 22);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 20);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(11) }), 20);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(-100) }), 20);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 22);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 20);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(11) }), 20);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(-100) }), 20);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -339,8 +339,8 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(32) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(32) }), 2);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(32) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(32) }), 2);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -366,8 +366,8 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(32) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(32) }), 2);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(32) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(32) }), 2);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -404,14 +404,14 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(2) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(6) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(6) }), 0);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(2) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(6) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(6) }), 0);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -434,10 +434,10 @@
</span><span class="cx">         checkPlan(plan, 2);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { boxf(0.0), boxf(1.5) }), -1.5f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { boxf(100.1234), boxf(12.5) }), 87.6234f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { boxf(0.0), boxf(1.5) }), -1.5f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { boxf(100.1234), boxf(12.5) }), 87.6234f));
</del><ins>+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(1), { boxf(0.0), boxf(1.5) }), -1.5f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(1), { boxf(100.1234), boxf(12.5) }), 87.6234f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(0), { boxf(0.0), boxf(1.5) }), -1.5f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(0), { boxf(100.1234), boxf(12.5) }), 87.6234f));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -460,10 +460,10 @@
</span><span class="cx">         checkPlan(plan, 2);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { boxf(0.0), boxf(1.5) }), 1.5f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { boxf(100.1234), boxf(12.5) }), 112.6234f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { boxf(0.0), boxf(1.5) }), 1.5f));
-        CHECK(isIdentical(invoke&lt;float&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { boxf(100.1234), boxf(12.5) }), 112.6234f));
</del><ins>+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(1), { boxf(0.0), boxf(1.5) }), 1.5f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(1), { boxf(100.1234), boxf(12.5) }), 112.6234f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(0), { boxf(0.0), boxf(1.5) }), 1.5f));
+        CHECK(isIdentical(invoke&lt;float&gt;(*plan.jsToWasmEntryPointForFunction(0), { boxf(100.1234), boxf(12.5) }), 112.6234f));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -491,11 +491,11 @@
</span><span class="cx">         checkPlan(plan, 2);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(100) }), 1200);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(1) }), 12);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2), box(3), box(4), box(5), box(6), box(7), box(8), box(9), box(10), box(11), box(12) }), 78);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2), box(3), box(4), box(5), box(6), box(7), box(8), box(9), box(10), box(11), box(100) }), 166);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(100) }), 1200);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(1) }), 12);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2), box(3), box(4), box(5), box(6), box(7), box(8), box(9), box(10), box(11), box(12) }), 78);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2), box(3), box(4), box(5), box(6), box(7), box(8), box(9), box(10), box(11), box(100) }), 166);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -522,10 +522,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2) }), 2);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(4) }), 24);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2) }), 2);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(4) }), 24);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -548,12 +548,12 @@
</span><span class="cx">         checkPlan(plan, 2);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(0), box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(100), box(0) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(1), box(15) }), 16);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 200);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 2);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(0), box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(100), box(0) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(1), box(15) }), 16);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 200);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 2);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -576,12 +576,12 @@
</span><span class="cx">         checkPlan(plan, 2);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(100) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(1)-&gt;jsEntryPoint, { box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(100) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(1), { box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -605,9 +605,9 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -632,9 +632,9 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -673,7 +673,7 @@
</span><span class="cx">         unsigned length = 5;
</span><span class="cx">         unsigned offset = sizeof(uint32_t);
</span><span class="cx">         uint32_t* memory = static_cast&lt;uint32_t*&gt;(plan.memory()-&gt;memory());
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(offset), box(length) });
</ins><span class="cx">         offset /= sizeof(uint32_t);
</span><span class="cx">         CHECK_EQ(memory[offset - 1], 0u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="lines">@@ -682,7 +682,7 @@
</span><span class="cx"> 
</span><span class="cx">         length = 10;
</span><span class="cx">         offset = 5 * sizeof(uint32_t);
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(5), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(5), box(offset), box(length) });
</ins><span class="cx">         offset /= sizeof(uint32_t);
</span><span class="cx">         CHECK_EQ(memory[offset - 1], 100u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="lines">@@ -725,7 +725,7 @@
</span><span class="cx">         unsigned length = 5;
</span><span class="cx">         unsigned offset = 1;
</span><span class="cx">         uint8_t* memory = static_cast&lt;uint8_t*&gt;(plan.memory()-&gt;memory());
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(offset), box(length) });
</ins><span class="cx">         CHECK_EQ(memory[offset - 1], 0u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="cx">         for (unsigned i = 0; i &lt; length; ++i)
</span><span class="lines">@@ -733,7 +733,7 @@
</span><span class="cx"> 
</span><span class="cx">         length = 10;
</span><span class="cx">         offset = 5;
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(5), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(5), box(offset), box(length) });
</ins><span class="cx">         CHECK_EQ(memory[offset - 1], 100u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="cx">         for (unsigned i = 0; i &lt; length; ++i)
</span><span class="lines">@@ -763,9 +763,9 @@
</span><span class="cx">         ASSERT(plan.memory()-&gt;size());
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -790,9 +790,9 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -817,10 +817,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(-12), box(plan.memory()-&gt;size() - sizeof(uint64_t)) }), -12);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(-12), box(plan.memory()-&gt;size() - sizeof(uint64_t)) }), -12);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -845,9 +845,9 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -886,7 +886,7 @@
</span><span class="cx">         unsigned length = 5;
</span><span class="cx">         unsigned offset = sizeof(uint32_t);
</span><span class="cx">         uint32_t* memory = static_cast&lt;uint32_t*&gt;(plan.memory()-&gt;memory());
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(offset), box(length) });
</ins><span class="cx">         offset /= sizeof(uint32_t);
</span><span class="cx">         CHECK_EQ(memory[offset - 1], 0u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="lines">@@ -895,7 +895,7 @@
</span><span class="cx"> 
</span><span class="cx">         length = 10;
</span><span class="cx">         offset = 5 * sizeof(uint32_t);
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(5), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(5), box(offset), box(length) });
</ins><span class="cx">         offset /= sizeof(uint32_t);
</span><span class="cx">         CHECK_EQ(memory[offset - 1], 100u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="lines">@@ -938,7 +938,7 @@
</span><span class="cx">         unsigned length = 5;
</span><span class="cx">         unsigned offset = 1;
</span><span class="cx">         uint8_t* memory = static_cast&lt;uint8_t*&gt;(plan.memory()-&gt;memory());
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(offset), box(length) });
</ins><span class="cx">         CHECK_EQ(memory[offset - 1], 0u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="cx">         for (unsigned i = 0; i &lt; length; ++i)
</span><span class="lines">@@ -946,7 +946,7 @@
</span><span class="cx"> 
</span><span class="cx">         length = 10;
</span><span class="cx">         offset = 5;
</span><del>-        invoke&lt;void&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(5), box(offset), box(length) });
</del><ins>+        invoke&lt;void&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(5), box(offset), box(length) });
</ins><span class="cx">         CHECK_EQ(memory[offset - 1], 100u);
</span><span class="cx">         CHECK_EQ(memory[offset + length], 0u);
</span><span class="cx">         for (unsigned i = 0; i &lt; length; ++i)
</span><span class="lines">@@ -976,9 +976,9 @@
</span><span class="cx">         ASSERT(plan.memory()-&gt;size());
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(10) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(2) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(100) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(10) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(2) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(100) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1003,9 +1003,9 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 100);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 100);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1030,14 +1030,14 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(0) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(2) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(6) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(6) }), 1);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(0) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(2) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(6) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(6) }), 1);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1068,14 +1068,14 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(2) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(6) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(6) }), 0);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(2) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(6) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(6) }), 0);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="lines">@@ -1092,7 +1092,7 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { }), 5);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { }), 5);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="lines">@@ -1110,7 +1110,7 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { }), 11);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { }), 11);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1127,7 +1127,7 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { }), 11);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { }), 11);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1144,7 +1144,7 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { }), 11);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { }), 11);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1160,10 +1160,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(1) }), 101);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(-1), box(1)}), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(std::numeric_limits&lt;int&gt;::max()), box(1) }), std::numeric_limits&lt;int&gt;::min());
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(1) }), 101);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(-1), box(1)}), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(std::numeric_limits&lt;int&gt;::max()), box(1) }), std::numeric_limits&lt;int&gt;::min());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1186,8 +1186,8 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(10) }), 10);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(10) }), 10);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1219,10 +1219,10 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2)}), 3);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100) }), 5050);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2)}), 3);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100) }), 5050);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1260,14 +1260,14 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(1) }), 2);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2) }), 2);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(2) }), 4);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(6) }), 12);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(6) }), 600);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(100) }), 10000);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(1) }), 2);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2) }), 2);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(2) }), 4);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(6) }), 12);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(6) }), 600);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(100) }), 10000);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="lines">@@ -1310,14 +1310,14 @@
</span><span class="cx">         checkPlan(plan, 1);
</span><span class="cx"> 
</span><span class="cx">         // Test this doesn't crash.
</span><del>-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(0), box(1) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(0) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(2) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(2) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(1), box(1) }), 0);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(2), box(6) }), 1);
-        CHECK_EQ(invoke&lt;int&gt;(*plan.compiledFunction(0)-&gt;jsEntryPoint, { box(100), box(6) }), 0);
</del><ins>+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(0), box(1) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(0) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(2) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(2) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(1), box(1) }), 0);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(2), box(6) }), 1);
+        CHECK_EQ(invoke&lt;int&gt;(*plan.jsToWasmEntryPointForFunction(0), { box(100), box(6) }), 0);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmJSWebAssemblyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/JSWebAssembly.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/JSWebAssembly.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/JSWebAssembly.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -50,6 +50,7 @@
</span><span class="cx"> #include &quot;js/WebAssemblyRuntimeErrorPrototype.h&quot;
</span><span class="cx"> #include &quot;js/WebAssemblyTableConstructor.h&quot;
</span><span class="cx"> #include &quot;js/WebAssemblyTablePrototype.h&quot;
</span><ins>+#include &quot;js/WebAssemblyToJSCallee.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmB3IRGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -130,7 +130,7 @@
</span><span class="cx"> 
</span><span class="cx">     static constexpr ExpressionType emptyExpression = nullptr;
</span><span class="cx"> 
</span><del>-    B3IRGenerator(Memory*, Procedure&amp;, FunctionCompilation*);
</del><ins>+    B3IRGenerator(Memory*, Procedure&amp;, WasmInternalFunction*, Vector&lt;UnlinkedWasmToWasmCall&gt;&amp;);
</ins><span class="cx"> 
</span><span class="cx">     bool WARN_UNUSED_RETURN addArguments(const Vector&lt;Type&gt;&amp;);
</span><span class="cx">     bool WARN_UNUSED_RETURN addLocal(Type, uint32_t);
</span><span class="lines">@@ -164,7 +164,7 @@
</span><span class="cx">     bool WARN_UNUSED_RETURN endBlock(ControlEntry&amp;, ExpressionList&amp; expressionStack);
</span><span class="cx">     bool WARN_UNUSED_RETURN addEndToUnreachable(ControlEntry&amp;);
</span><span class="cx"> 
</span><del>-    bool WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const FunctionInformation&amp;, Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result);
</del><ins>+    bool WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const Signature*, Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result);
</ins><span class="cx"> 
</span><span class="cx">     void dump(const Vector&lt;ControlEntry&gt;&amp; controlStack, const ExpressionList&amp; expressionStack);
</span><span class="cx"> 
</span><span class="lines">@@ -183,17 +183,16 @@
</span><span class="cx">     Procedure&amp; m_proc;
</span><span class="cx">     BasicBlock* m_currentBlock;
</span><span class="cx">     Vector&lt;Variable*&gt; m_locals;
</span><del>-    // m_unlikedCalls is list of each call site and the function index whose address it should be patched with.
-    Vector&lt;UnlinkedCall&gt;&amp; m_unlinkedCalls;
</del><ins>+    Vector&lt;UnlinkedWasmToWasmCall&gt;&amp; m_unlinkedWasmToWasmCalls; // List each call site and the function index whose address it should be patched with.
</ins><span class="cx">     GPRReg m_memoryBaseGPR;
</span><span class="cx">     GPRReg m_memorySizeGPR;
</span><span class="cx">     Value* m_zeroValues[numTypes];
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-B3IRGenerator::B3IRGenerator(Memory* memory, Procedure&amp; procedure, FunctionCompilation* compilation)
</del><ins>+B3IRGenerator::B3IRGenerator(Memory* memory, Procedure&amp; procedure, WasmInternalFunction* compilation, Vector&lt;UnlinkedWasmToWasmCall&gt;&amp; unlinkedWasmToWasmCalls)
</ins><span class="cx">     : m_memory(memory)
</span><span class="cx">     , m_proc(procedure)
</span><del>-    , m_unlinkedCalls(compilation-&gt;unlinkedCalls)
</del><ins>+    , m_unlinkedWasmToWasmCalls(unlinkedWasmToWasmCalls)
</ins><span class="cx"> {
</span><span class="cx">     m_currentBlock = m_proc.addBlock();
</span><span class="cx"> 
</span><span class="lines">@@ -595,14 +594,14 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool B3IRGenerator::addCall(unsigned functionIndex, const FunctionInformation&amp; info, Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result)
</del><ins>+bool B3IRGenerator::addCall(unsigned functionIndex, const Signature* signature, Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result)
</ins><span class="cx"> {
</span><del>-    ASSERT(info.signature-&gt;arguments.size() == args.size());
</del><ins>+    ASSERT(signature-&gt;arguments.size() == args.size());
</ins><span class="cx"> 
</span><del>-    Type returnType = info.signature-&gt;returnType;
</del><ins>+    Type returnType = signature-&gt;returnType;
</ins><span class="cx"> 
</span><del>-    size_t callIndex = m_unlinkedCalls.size();
-    m_unlinkedCalls.grow(callIndex + 1);
</del><ins>+    size_t callIndex = m_unlinkedWasmToWasmCalls.size();
+    m_unlinkedWasmToWasmCalls.grow(callIndex + 1);
</ins><span class="cx">     result = wasmCallingConvention().setupCall(m_proc, m_currentBlock, Origin(), args, toB3Type(returnType),
</span><span class="cx">         [&amp;] (PatchpointValue* patchpoint) {
</span><span class="cx">             patchpoint-&gt;effects.writesPinned = true;
</span><span class="lines">@@ -614,7 +613,7 @@
</span><span class="cx">                 CCallHelpers::Call call = jit.call();
</span><span class="cx"> 
</span><span class="cx">                 jit.addLinkTask([=] (LinkBuffer&amp; linkBuffer) {
</span><del>-                    m_unlinkedCalls[callIndex] = { linkBuffer.locationOf(call), functionIndex };
</del><ins>+                    m_unlinkedWasmToWasmCalls[callIndex] = { linkBuffer.locationOf(call), functionIndex };
</ins><span class="cx">                 });
</span><span class="cx">             });
</span><span class="cx">         });
</span><span class="lines">@@ -660,7 +659,7 @@
</span><span class="cx">     dataLogLn(&quot;\n&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static std::unique_ptr&lt;Compilation&gt; createJSWrapper(VM&amp; vm, const Signature* signature, MacroAssemblerCodePtr mainFunction, Memory* memory)
</del><ins>+static std::unique_ptr&lt;Compilation&gt; createJSToWasmWrapper(VM&amp; vm, const Signature* signature, MacroAssemblerCodePtr mainFunction, Memory* memory)
</ins><span class="cx"> {
</span><span class="cx">     Procedure proc;
</span><span class="cx">     BasicBlock* block = proc.addBlock();
</span><span class="lines">@@ -739,13 +738,13 @@
</span><span class="cx">     return std::make_unique&lt;Compilation&gt;(vm, proc);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-std::unique_ptr&lt;FunctionCompilation&gt; parseAndCompile(VM&amp; vm, const uint8_t* functionStart, size_t functionLength, Memory* memory, const Signature* signature, const Vector&lt;FunctionInformation&gt;&amp; functions, unsigned optLevel)
</del><ins>+std::unique_ptr&lt;WasmInternalFunction&gt; parseAndCompile(VM&amp; vm, const uint8_t* functionStart, size_t functionLength, Memory* memory, const Signature* signature, Vector&lt;UnlinkedWasmToWasmCall&gt;&amp; unlinkedWasmToWasmCalls, const FunctionIndexSpace&amp; functionIndexSpace, unsigned optLevel)
</ins><span class="cx"> {
</span><del>-    auto result = std::make_unique&lt;FunctionCompilation&gt;();
</del><ins>+    auto result = std::make_unique&lt;WasmInternalFunction&gt;();
</ins><span class="cx"> 
</span><span class="cx">     Procedure procedure;
</span><del>-    B3IRGenerator context(memory, procedure, result.get());
-    FunctionParser&lt;B3IRGenerator&gt; parser(context, functionStart, functionLength, signature, functions);
</del><ins>+    B3IRGenerator context(memory, procedure, result.get(), unlinkedWasmToWasmCalls);
+    FunctionParser&lt;B3IRGenerator&gt; parser(context, functionStart, functionLength, signature, functionIndexSpace);
</ins><span class="cx">     if (!parser.parse())
</span><span class="cx">         RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> 
</span><span class="lines">@@ -759,7 +758,7 @@
</span><span class="cx">         dataLog(&quot;Post SSA: &quot;, procedure);
</span><span class="cx"> 
</span><span class="cx">     result-&gt;code = std::make_unique&lt;Compilation&gt;(vm, procedure, optLevel);
</span><del>-    result-&gt;jsEntryPoint = createJSWrapper(vm, signature, result-&gt;code-&gt;code(), memory);
</del><ins>+    result-&gt;jsToWasmEntryPoint = createJSToWasmWrapper(vm, signature, result-&gt;code-&gt;code(), memory);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmB3IRGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> 
</span><span class="cx"> class Memory;
</span><span class="cx"> 
</span><del>-std::unique_ptr&lt;FunctionCompilation&gt; parseAndCompile(VM&amp;, const uint8_t*, size_t, Memory*, const Signature*, const Vector&lt;FunctionInformation&gt;&amp;, unsigned optLevel = 1);
</del><ins>+std::unique_ptr&lt;WasmInternalFunction&gt; parseAndCompile(VM&amp;, const uint8_t*, size_t, Memory*, const Signature*, Vector&lt;UnlinkedWasmToWasmCall&gt;&amp;, const FunctionIndexSpace&amp;, unsigned optLevel = 1);
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::Wasm
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmBindingcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/wasm/WasmBinding.cpp (0 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmBinding.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/wasm/WasmBinding.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -0,0 +1,238 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;WasmBinding.h&quot;
+
+#if ENABLE(WEBASSEMBLY)
+
+#include &quot;AssemblyHelpers.h&quot;
+#include &quot;JSCJSValueInlines.h&quot;
+#include &quot;JSWebAssemblyInstance.h&quot;
+#include &quot;LinkBuffer.h&quot;
+#include &quot;WasmCallingConvention.h&quot;
+
+namespace JSC { namespace Wasm {
+
+WasmToJSStub importStubGenerator(VM* vm, Bag&lt;CallLinkInfo&gt;&amp; callLinkInfos, Signature* signature, unsigned importIndex)
+{
+    const WasmCallingConvention&amp; wasmCC = wasmCallingConvention();
+    const JSCCallingConvention&amp; jsCC = jscCallingConvention();
+    unsigned argCount = signature-&gt;arguments.size();
+    typedef AssemblyHelpers JIT;
+    JIT jit(vm, nullptr);
+
+    // Below, we assume that the JS calling convention is always on the stack.
+    ASSERT(!jsCC.m_gprArgs.size());
+    ASSERT(!jsCC.m_fprArgs.size());
+
+    jit.emitFunctionPrologue();
+    jit.breakpoint(); // FIXME make calling to JavaScript work. https://bugs.webkit.org/show_bug.cgi?id=165591
+    jit.store64(JIT::TrustedImm32(0), JIT::Address(GPRInfo::callFrameRegister, CallFrameSlot::codeBlock * static_cast&lt;int&gt;(sizeof(Register)))); // FIXME Stop using 0 as codeBlocks. https://bugs.webkit.org/show_bug.cgi?id=165321
+    jit.storePtr(JIT::TrustedImmPtr(vm-&gt;webAssemblyToJSCallee.get()), JIT::Address(GPRInfo::callFrameRegister, CallFrameSlot::callee * static_cast&lt;int&gt;(sizeof(Register))));
+
+    // Here we assume that the JS calling convention saves at least all the wasm callee saved. We therefore don't need to save and restore more registers since the wasm callee already took care of this.
+    RegisterSet missingCalleeSaves = wasmCC.m_calleeSaveRegisters;
+    missingCalleeSaves.exclude(jsCC.m_calleeSaveRegisters);
+    ASSERT(missingCalleeSaves.isEmpty());
+
+    // FIXME perform a stack check before updating SP. https://bugs.webkit.org/show_bug.cgi?id=165546
+
+    unsigned numberOfParameters = argCount + 1; // There is a &quot;this&quot; argument.
+    unsigned numberOfRegsForCall = CallFrame::headerSizeInRegisters + numberOfParameters;
+    unsigned numberOfBytesForCall = numberOfRegsForCall * sizeof(Register) - sizeof(CallerFrameAndPC);
+    const unsigned stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), numberOfBytesForCall);
+    jit.subPtr(MacroAssembler::TrustedImm32(stackOffset), MacroAssembler::stackPointerRegister);
+    JIT::Address calleeFrame = CCallHelpers::Address(MacroAssembler::stackPointerRegister, -static_cast&lt;ptrdiff_t&gt;(sizeof(CallerFrameAndPC)));
+
+    // FIXME make this a loop which switches on Signature if there are many arguments on the stack. It'll otherwise be huge for huge signatures. https://bugs.webkit.org/show_bug.cgi?id=165547
+    unsigned marshalledGPRs = 0;
+    unsigned marshalledFPRs = 0;
+    unsigned calleeFrameOffset = CallFrameSlot::firstArgument * static_cast&lt;int&gt;(sizeof(Register));
+    unsigned frOffset = CallFrameSlot::firstArgument * static_cast&lt;int&gt;(sizeof(Register));
+    for (unsigned argNum = 0; argNum &lt; argCount; ++argNum) {
+        Type argType = signature-&gt;arguments[argNum];
+        switch (argType) {
+        case Void:
+        case Func:
+        case Anyfunc:
+        case I64:
+            // For the JavaScript embedding, imports with these types in their signature arguments are a WebAssembly.Module validation error.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        case I32: {
+            GPRReg gprReg;
+            if (marshalledGPRs &lt; wasmCC.m_gprArgs.size())
+                gprReg = wasmCC.m_gprArgs[marshalledGPRs].gpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                gprReg = GPRInfo::argumentGPR0;
+                jit.load64(JIT::Address(GPRInfo::callFrameRegister, frOffset), gprReg);
+                frOffset += sizeof(Register);
+            }
+            ++marshalledGPRs;
+            jit.boxInt32(gprReg, JSValueRegs(gprReg), DoNotHaveTagRegisters);
+            jit.store64(gprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            break;
+        }
+        case F32: {
+            FPRReg fprReg;
+            if (marshalledFPRs &lt; wasmCC.m_fprArgs.size())
+                fprReg = wasmCC.m_fprArgs[marshalledFPRs].fpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                fprReg = FPRInfo::argumentFPR0;
+                jit.loadFloat(JIT::Address(GPRInfo::callFrameRegister, frOffset), fprReg);
+                frOffset += sizeof(Register);
+            }
+            jit.convertFloatToDouble(fprReg, fprReg);
+            jit.purifyNaN(fprReg);
+            jit.storeDouble(fprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            ++marshalledFPRs;
+            break;
+        }
+        case F64: {
+            FPRReg fprReg;
+            if (marshalledFPRs &lt; wasmCC.m_fprArgs.size())
+                fprReg = wasmCC.m_fprArgs[marshalledFPRs].fpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                fprReg = FPRInfo::argumentFPR0;
+                jit.loadDouble(JIT::Address(GPRInfo::callFrameRegister, frOffset), fprReg);
+                frOffset += sizeof(Register);
+            }
+            jit.purifyNaN(fprReg);
+            jit.storeDouble(fprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            ++marshalledFPRs;
+            break;
+        }
+        }
+    }
+
+    GPRReg importJSCellGPRReg = GPRInfo::regT0; // Callee needs to be in regT0 for slow path below.
+    ASSERT(!wasmCC.m_calleeSaveRegisters.get(importJSCellGPRReg));
+
+    // Each JS -&gt; wasm entry sets the WebAssembly.Instance whose export is being called. We're calling out of this Instance, and can therefore figure out the import being called.
+    jit.loadPtr(&amp;vm-&gt;topJSWebAssemblyInstance, importJSCellGPRReg);
+    jit.loadPtr(JIT::Address(importJSCellGPRReg, JSWebAssemblyInstance::offsetOfImportFunction(importIndex)), importJSCellGPRReg);
+
+    uint64_t thisArgument = ValueUndefined; // FIXME what does the WebAssembly spec say this should be? https://bugs.webkit.org/show_bug.cgi?id=165471
+    jit.store64(importJSCellGPRReg, calleeFrame.withOffset(CallFrameSlot::callee * static_cast&lt;int&gt;(sizeof(Register))));
+    jit.store32(JIT::TrustedImm32(numberOfParameters), calleeFrame.withOffset(CallFrameSlot::argumentCount * static_cast&lt;int&gt;(sizeof(Register)) + PayloadOffset));
+    jit.store64(JIT::TrustedImm64(thisArgument), calleeFrame.withOffset(CallFrameSlot::thisArgument * static_cast&lt;int&gt;(sizeof(Register))));
+
+    // FIXME Tail call if the wasm return type is void and no registers were spilled. https://bugs.webkit.org/show_bug.cgi?id=165488
+
+    CallLinkInfo* callLinkInfo = callLinkInfos.add();
+    callLinkInfo-&gt;setUpCall(CallLinkInfo::Call, CodeOrigin(), importJSCellGPRReg);
+    JIT::DataLabelPtr targetToCheck;
+    JIT::TrustedImmPtr initialRightValue(0);
+    JIT::Jump slowPath = jit.branchPtrWithPatch(MacroAssembler::NotEqual, importJSCellGPRReg, targetToCheck, initialRightValue);
+    JIT::Call fastCall = jit.nearCall();
+    JIT::Jump done = jit.jump();
+    slowPath.link(&amp;jit);
+    // Callee needs to be in regT0 here.
+    jit.move(MacroAssembler::TrustedImmPtr(callLinkInfo), GPRInfo::regT2); // Link info needs to be in regT2.
+    JIT::Call slowCall = jit.nearCall();
+    done.link(&amp;jit);
+
+    switch (signature-&gt;returnType) {
+    case Void:
+        // Discard.
+        break;
+    case Func:
+    case Anyfunc:
+        // For the JavaScript embedding, imports with these types in their signature return are a WebAssembly.Module validation error.
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    case I32: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.truncateDoubleToInt32(FPRInfo::returnValueFPR, GPRInfo::returnValueGPR);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&amp;jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        checkJSNumber.link(&amp;jit);
+        break;
+    }
+    case I64: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.truncateDoubleToInt64(FPRInfo::returnValueFPR, GPRInfo::returnValueGPR);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&amp;jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        checkJSNumber.link(&amp;jit);
+        break;
+    }
+    case F32: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.convertDoubleToFloat(FPRInfo::returnValueFPR, FPRInfo::returnValueFPR);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&amp;jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        jit.convertInt64ToFloat(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        checkJSNumber.link(&amp;jit);
+        break;
+    }
+    case F64: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&amp;jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        jit.convertInt64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        checkJSNumber.link(&amp;jit);
+        break;
+    }
+    }
+
+    jit.emitFunctionEpilogue();
+    jit.ret();
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    patchBuffer.link(slowCall, FunctionPtr(vm-&gt;getCTIStub(linkCallThunkGenerator).code().executableAddress()));
+    CodeLocationLabel callReturnLocation(patchBuffer.locationOfNearCall(slowCall));
+    CodeLocationLabel hotPathBegin(patchBuffer.locationOf(targetToCheck));
+    CodeLocationNearCall hotPathOther = patchBuffer.locationOfNearCall(fastCall);
+    callLinkInfo-&gt;setCallLocations(callReturnLocation, hotPathBegin, hotPathOther);
+    return FINALIZE_CODE(patchBuffer, (&quot;WebAssembly import[%i] stub for signature %p&quot;, importIndex, signature));
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmBindinghfromrev209559trunkSourceJavaScriptCorewasmWasmValidateh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/wasm/WasmBinding.h (from rev 209559, trunk/Source/JavaScriptCore/wasm/WasmValidate.h) (0 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmBinding.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/wasm/WasmBinding.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include &quot;B3Compilation.h&quot;
+#include &quot;VM.h&quot;
+#include &quot;WasmFormat.h&quot;
+#include &lt;wtf/Bag.h&gt;
+
+namespace JSC {
+
+class CallLinkInfo;
+
+namespace Wasm {
+
+WasmToJSStub importStubGenerator(VM*, Bag&lt;CallLinkInfo&gt;&amp;, Signature*, unsigned);
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmCallingConventionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmCallingConvention.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmCallingConvention.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmCallingConvention.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -83,7 +83,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    void setupFrameInPrologue(FunctionCompilation* compilation, B3::Procedure&amp; proc, B3::Origin origin, B3::BasicBlock* block) const
</del><ins>+    void setupFrameInPrologue(WasmInternalFunction* compilation, B3::Procedure&amp; proc, B3::Origin origin, B3::BasicBlock* block) const
</ins><span class="cx">     {
</span><span class="cx">         static_assert(CallFrameSlot::callee * sizeof(Register) &lt; headerSize, &quot;We rely on this here for now.&quot;);
</span><span class="cx">         static_assert(CallFrameSlot::codeBlock * sizeof(Register) &lt; headerSize, &quot;We rely on this here for now.&quot;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmFormath"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmFormat.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmFormat.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmFormat.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include &quot;B3Type.h&quot;
</span><span class="cx"> #include &quot;CodeLocation.h&quot;
</span><span class="cx"> #include &quot;Identifier.h&quot;
</span><ins>+#include &quot;MacroAssemblerCodeRef.h&quot;
</ins><span class="cx"> #include &quot;WasmOps.h&quot;
</span><span class="cx"> #include &lt;wtf/Vector.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -91,20 +92,9 @@
</span><span class="cx">     Identifier module;
</span><span class="cx">     Identifier field;
</span><span class="cx">     External::Kind kind;
</span><del>-    union {
-        Signature* functionSignature;
-        // FIXME implement Table https://bugs.webkit.org/show_bug.cgi?id=164135
-        // FIXME implement Memory https://bugs.webkit.org/show_bug.cgi?id=164134
-        // FIXME implement Global https://bugs.webkit.org/show_bug.cgi?id=164133
-    };
</del><ins>+    unsigned kindIndex; // Index in the vector of the corresponding kind.
</ins><span class="cx"> };
</span><span class="cx"> 
</span><del>-struct FunctionInformation {
-    Signature* signature;
-    size_t start;
-    size_t end;
-};
-
</del><span class="cx"> class Memory;
</span><span class="cx"> 
</span><span class="cx"> struct Export {
</span><span class="lines">@@ -118,10 +108,20 @@
</span><span class="cx">     };
</span><span class="cx"> };
</span><span class="cx"> 
</span><ins>+struct FunctionLocationInBinary {
+    size_t start;
+    size_t end;
+};
+
+
</ins><span class="cx"> struct ModuleInformation {
</span><span class="cx">     Vector&lt;Signature&gt; signatures;
</span><span class="cx">     Vector&lt;Import&gt; imports;
</span><del>-    Vector&lt;FunctionInformation&gt; functions;
</del><ins>+    Vector&lt;Signature*&gt; importFunctions;
+    // FIXME implement import Table https://bugs.webkit.org/show_bug.cgi?id=164135
+    // FIXME implement import Memory https://bugs.webkit.org/show_bug.cgi?id=164134
+    // FIXME implement import Global https://bugs.webkit.org/show_bug.cgi?id=164133
+    Vector&lt;Signature*&gt; internalFunctionSignatures;
</ins><span class="cx">     std::unique_ptr&lt;Memory&gt; memory;
</span><span class="cx">     Vector&lt;Export&gt; exports;
</span><span class="cx"> 
</span><span class="lines">@@ -128,20 +128,32 @@
</span><span class="cx">     ~ModuleInformation();
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-struct UnlinkedCall {
</del><ins>+struct UnlinkedWasmToWasmCall {
</ins><span class="cx">     CodeLocationCall callLocation;
</span><span class="cx">     size_t functionIndex;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-struct FunctionCompilation {
-    Vector&lt;UnlinkedCall&gt; unlinkedCalls;
</del><ins>+struct WasmInternalFunction {
</ins><span class="cx">     CodeLocationDataLabelPtr calleeMoveLocation;
</span><span class="cx">     std::unique_ptr&lt;B3::Compilation&gt; code;
</span><del>-    std::unique_ptr&lt;B3::Compilation&gt; jsEntryPoint;
</del><ins>+    std::unique_ptr&lt;B3::Compilation&gt; jsToWasmEntryPoint;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><del>-typedef Vector&lt;std::unique_ptr&lt;FunctionCompilation&gt;&gt; CompiledFunctions;
</del><ins>+typedef MacroAssemblerCodeRef WasmToJSStub;
</ins><span class="cx"> 
</span><ins>+// WebAssembly direct calls and call_indirect use indices into &quot;function index space&quot;. This space starts with all imports, and then all internal functions.
+// CallableFunction and FunctionIndexSpace are only meant as fast lookup tables for these opcodes, and do not own code.
+struct CallableFunction {
+    CallableFunction(Signature* signature)
+        : signature(signature)
+        , code(nullptr)
+    {
+    }
+    Signature* signature; // FIXME pack this inside a (uniqued) integer (for correctness the parser should unique Signatures), and then pack that integer into the code pointer. https://bugs.webkit.org/show_bug.cgi?id=165511
+    void* code;
+};
+typedef Vector&lt;CallableFunction&gt; FunctionIndexSpace;
+
</ins><span class="cx"> } } // namespace JSC::Wasm
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(WEBASSEMBLY)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmFunctionParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx">     typedef typename Context::ControlType ControlType;
</span><span class="cx">     typedef typename Context::ExpressionList ExpressionList;
</span><span class="cx"> 
</span><del>-    FunctionParser(Context&amp;, const uint8_t* functionStart, size_t functionLength, const Signature*, const Vector&lt;FunctionInformation&gt;&amp; functions);
</del><ins>+    FunctionParser(Context&amp;, const uint8_t* functionStart, size_t functionLength, const Signature*, const FunctionIndexSpace&amp;);
</ins><span class="cx"> 
</span><span class="cx">     bool WARN_UNUSED_RETURN parse();
</span><span class="cx"> 
</span><span class="lines">@@ -77,16 +77,16 @@
</span><span class="cx">     ExpressionList m_expressionStack;
</span><span class="cx">     Vector&lt;ControlEntry&gt; m_controlStack;
</span><span class="cx">     const Signature* m_signature;
</span><del>-    const Vector&lt;FunctionInformation&gt;&amp; m_functions;
</del><ins>+    const FunctionIndexSpace&amp; m_functionIndexSpace;
</ins><span class="cx">     unsigned m_unreachableBlocks { 0 };
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Context&gt;
</span><del>-FunctionParser&lt;Context&gt;::FunctionParser(Context&amp; context, const uint8_t* functionStart, size_t functionLength, const Signature* signature, const Vector&lt;FunctionInformation&gt;&amp; functions)
</del><ins>+FunctionParser&lt;Context&gt;::FunctionParser(Context&amp; context, const uint8_t* functionStart, size_t functionLength, const Signature* signature, const FunctionIndexSpace&amp; functionIndexSpace)
</ins><span class="cx">     : Parser(functionStart, functionLength)
</span><span class="cx">     , m_context(context)
</span><span class="cx">     , m_signature(signature)
</span><del>-    , m_functions(functions)
</del><ins>+    , m_functionIndexSpace(functionIndexSpace)
</ins><span class="cx"> {
</span><span class="cx">     if (verbose)
</span><span class="cx">         dataLogLn(&quot;Parsing function starting at: &quot;, (uintptr_t)functionStart, &quot; of length: &quot;, functionLength);
</span><span class="lines">@@ -350,23 +350,23 @@
</span><span class="cx">         if (!parseVarUInt32(functionIndex))
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        if (functionIndex &gt;= m_functions.size())
</del><ins>+        if (functionIndex &gt;= m_functionIndexSpace.size())
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        const FunctionInformation&amp; info = m_functions[functionIndex];
</del><ins>+        const Signature* calleeSignature = m_functionIndexSpace[functionIndex].signature;
</ins><span class="cx"> 
</span><del>-        if (info.signature-&gt;arguments.size() &gt; m_expressionStack.size())
</del><ins>+        if (calleeSignature-&gt;arguments.size() &gt; m_expressionStack.size())
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        size_t firstArgumentIndex = m_expressionStack.size() - info.signature-&gt;arguments.size();
</del><ins>+        size_t firstArgumentIndex = m_expressionStack.size() - calleeSignature-&gt;arguments.size();
</ins><span class="cx">         Vector&lt;ExpressionType&gt; args;
</span><del>-        args.reserveInitialCapacity(info.signature-&gt;arguments.size());
</del><ins>+        args.reserveInitialCapacity(calleeSignature-&gt;arguments.size());
</ins><span class="cx">         for (unsigned i = firstArgumentIndex; i &lt; m_expressionStack.size(); ++i)
</span><span class="cx">             args.append(m_expressionStack[i]);
</span><span class="cx">         m_expressionStack.shrink(firstArgumentIndex);
</span><span class="cx"> 
</span><span class="cx">         ExpressionType result = Context::emptyExpression;
</span><del>-        if (!m_context.addCall(functionIndex, info, args, result))
</del><ins>+        if (!m_context.addCall(functionIndex, calleeSignature, args, result))
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="cx">         if (result != Context::emptyExpression)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmModuleParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -218,7 +218,9 @@
</span><span class="cx">     uint32_t importCount;
</span><span class="cx">     if (!parseVarUInt32(importCount))
</span><span class="cx">         return false;
</span><del>-    if (!m_module-&gt;imports.tryReserveCapacity(importCount))
</del><ins>+    if (!m_module-&gt;imports.tryReserveCapacity(importCount) // FIXME this over-allocates when we fix the FIXMEs below.
+        || !m_module-&gt;importFunctions.tryReserveCapacity(importCount) // FIXME this over-allocates when we fix the FIXMEs below.
+        || !m_functionIndexSpace.tryReserveCapacity(importCount)) // FIXME this over-allocates when we fix the FIXMEs below. We'll allocate some more here when we know how many functions to expect.
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     for (uint32_t importNumber = 0; importNumber != importCount; ++importNumber) {
</span><span class="lines">@@ -225,17 +227,15 @@
</span><span class="cx">         Import imp;
</span><span class="cx">         uint32_t moduleLen;
</span><span class="cx">         uint32_t fieldLen;
</span><del>-        if (!parseVarUInt32(moduleLen))
-            return false;
</del><span class="cx">         String moduleString;
</span><del>-        if (!consumeUTF8String(moduleString, moduleLen))
</del><ins>+        String fieldString;
+        if (!parseVarUInt32(moduleLen)
+            || !consumeUTF8String(moduleString, moduleLen))
</ins><span class="cx">             return false;
</span><span class="cx">         imp.module = Identifier::fromString(m_vm, moduleString);
</span><del>-        if (!parseVarUInt32(fieldLen))
</del><ins>+        if (!parseVarUInt32(fieldLen)
+            || !consumeUTF8String(fieldString, fieldLen))
</ins><span class="cx">             return false;
</span><del>-        String fieldString;
-        if (!consumeUTF8String(fieldString, fieldLen))
-            return false;
</del><span class="cx">         imp.field = Identifier::fromString(m_vm, fieldString);
</span><span class="cx">         if (!parseExternalKind(imp.kind))
</span><span class="cx">             return false;
</span><span class="lines">@@ -242,11 +242,13 @@
</span><span class="cx">         switch (imp.kind) {
</span><span class="cx">         case External::Function: {
</span><span class="cx">             uint32_t functionSignatureIndex;
</span><del>-            if (!parseVarUInt32(functionSignatureIndex))
</del><ins>+            if (!parseVarUInt32(functionSignatureIndex)
+                || functionSignatureIndex &gt;= m_module-&gt;signatures.size())
</ins><span class="cx">                 return false;
</span><del>-            if (functionSignatureIndex &gt;= m_module-&gt;signatures.size())
-                return false;
-            imp.functionSignature = &amp;m_module-&gt;signatures[functionSignatureIndex];
</del><ins>+            imp.kindIndex = m_module-&gt;importFunctions.size();
+            Signature* signature = &amp;m_module-&gt;signatures[functionSignatureIndex];
+            m_module-&gt;importFunctions.uncheckedAppend(signature);
+            m_functionIndexSpace.uncheckedAppend(signature);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case External::Table: {
</span><span class="lines">@@ -273,23 +275,25 @@
</span><span class="cx"> bool ModuleParser::parseFunction()
</span><span class="cx"> {
</span><span class="cx">     uint32_t count;
</span><del>-    if (!parseVarUInt32(count))
</del><ins>+    if (!parseVarUInt32(count)
+        || !m_module-&gt;internalFunctionSignatures.tryReserveCapacity(count)
+        || !m_functionLocationInBinary.tryReserveCapacity(count)
+        || !m_functionIndexSpace.tryReserveCapacity(m_functionIndexSpace.size() + count))
</ins><span class="cx">         return false;
</span><del>-    if (!m_module-&gt;functions.tryReserveCapacity(count))
-        return false;
</del><span class="cx"> 
</span><span class="cx">     for (uint32_t i = 0; i != count; ++i) {
</span><span class="cx">         uint32_t typeNumber;
</span><del>-        if (!parseVarUInt32(typeNumber))
</del><ins>+        if (!parseVarUInt32(typeNumber)
+            || typeNumber &gt;= m_module-&gt;signatures.size())
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        if (typeNumber &gt;= m_module-&gt;signatures.size())
-            return false;
-
</del><ins>+        Signature* signature = &amp;m_module-&gt;signatures[typeNumber];
</ins><span class="cx">         // The Code section fixes up start and end.
</span><span class="cx">         size_t start = 0;
</span><span class="cx">         size_t end = 0;
</span><del>-        m_module-&gt;functions.uncheckedAppend({ &amp;m_module-&gt;signatures[typeNumber], start, end });
</del><ins>+        m_module-&gt;internalFunctionSignatures.uncheckedAppend(signature);
+        m_functionLocationInBinary.uncheckedAppend({ start, end });
+        m_functionIndexSpace.uncheckedAppend(signature);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return true;
</span><span class="lines">@@ -311,21 +315,18 @@
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     uint8_t flags;
</span><del>-    if (!parseVarUInt1(flags))
-        return false;
-
</del><span class="cx">     uint32_t size;
</span><del>-    if (!parseVarUInt32(size))
</del><ins>+    if (!parseVarUInt1(flags)
+        || !parseVarUInt32(size)
+        || size &gt; maxPageCount)
</ins><span class="cx">         return false;
</span><del>-    if (size &gt; maxPageCount)
-        return false;
</del><span class="cx"> 
</span><span class="cx">     uint32_t capacity = maxPageCount;
</span><span class="cx">     if (flags) {
</span><del>-        if (!parseVarUInt32(capacity))
</del><ins>+        if (!parseVarUInt32(capacity)
+            || size &gt; capacity
+            || capacity &gt; maxPageCount)
</ins><span class="cx">             return false;
</span><del>-        if (size &gt; capacity || capacity &gt; maxPageCount)
-            return false;
</del><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     capacity *= pageSize;
</span><span class="lines">@@ -345,18 +346,16 @@
</span><span class="cx"> bool ModuleParser::parseExport()
</span><span class="cx"> {
</span><span class="cx">     uint32_t exportCount;
</span><del>-    if (!parseVarUInt32(exportCount))
</del><ins>+    if (!parseVarUInt32(exportCount)
+        || !m_module-&gt;exports.tryReserveCapacity(exportCount))
</ins><span class="cx">         return false;
</span><del>-    if (!m_module-&gt;exports.tryReserveCapacity(exportCount))
-        return false;
</del><span class="cx"> 
</span><span class="cx">     for (uint32_t exportNumber = 0; exportNumber != exportCount; ++exportNumber) {
</span><span class="cx">         Export exp;
</span><span class="cx">         uint32_t fieldLen;
</span><del>-        if (!parseVarUInt32(fieldLen))
-            return false;
</del><span class="cx">         String fieldString;
</span><del>-        if (!consumeUTF8String(fieldString, fieldLen))
</del><ins>+        if (!parseVarUInt32(fieldLen)
+            || !consumeUTF8String(fieldString, fieldLen))
</ins><span class="cx">             return false;
</span><span class="cx">         exp.field = Identifier::fromString(m_vm, fieldString);
</span><span class="cx">         if (!parseExternalKind(exp.kind))
</span><span class="lines">@@ -363,10 +362,9 @@
</span><span class="cx">             return false;
</span><span class="cx">         switch (exp.kind) {
</span><span class="cx">         case External::Function: {
</span><del>-            if (!parseVarUInt32(exp.functionIndex))
</del><ins>+            if (!parseVarUInt32(exp.functionIndex)
+                || exp.functionIndex &gt;= m_functionIndexSpace.size())
</ins><span class="cx">                 return false;
</span><del>-            if (exp.functionIndex &gt;= m_module-&gt;functions.size())
-                return false;
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case External::Table: {
</span><span class="lines">@@ -405,23 +403,20 @@
</span><span class="cx"> bool ModuleParser::parseCode()
</span><span class="cx"> {
</span><span class="cx">     uint32_t count;
</span><del>-    if (!parseVarUInt32(count))
</del><ins>+    if (!parseVarUInt32(count)
+        || count != m_functionLocationInBinary.size())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    if (count != m_module-&gt;functions.size())
-        return false;
-
</del><span class="cx">     for (uint32_t i = 0; i != count; ++i) {
</span><span class="cx">         uint32_t functionSize;
</span><del>-        if (!parseVarUInt32(functionSize))
</del><ins>+        if (!parseVarUInt32(functionSize)
+            || functionSize &gt; length()
+            || functionSize &gt; length() - m_offset)
</ins><span class="cx">             return false;
</span><del>-        if (functionSize &gt; length() || functionSize &gt; length() - m_offset)
-            return false;
</del><span class="cx"> 
</span><del>-        FunctionInformation&amp; info = m_module-&gt;functions[i];
-        info.start = m_offset;
-        info.end = m_offset + functionSize;
-        m_offset = info.end;
</del><ins>+        m_functionLocationInBinary[i].start = m_offset;
+        m_functionLocationInBinary[i].end = m_offset + functionSize;
+        m_offset = m_functionLocationInBinary[i].end;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmModuleParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmModuleParser.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmModuleParser.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmModuleParser.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -61,6 +61,18 @@
</span><span class="cx">         return m_module;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    FunctionIndexSpace&amp; functionIndexSpace()
+    {
+        RELEASE_ASSERT(!failed());
+        return m_functionIndexSpace;
+    }
+
+    Vector&lt;FunctionLocationInBinary&gt;&amp; functionLocationInBinary()
+    {
+        RELEASE_ASSERT(!failed());
+        return m_functionLocationInBinary;
+    }
+
</ins><span class="cx"> private:
</span><span class="cx"> #define WASM_SECTION_DECLARE_PARSER(NAME, ID, DESCRIPTION) bool WARN_UNUSED_RETURN parse ## NAME();
</span><span class="cx">     FOR_EACH_WASM_SECTION(WASM_SECTION_DECLARE_PARSER)
</span><span class="lines">@@ -68,6 +80,8 @@
</span><span class="cx"> 
</span><span class="cx">     VM* m_vm;
</span><span class="cx">     std::unique_ptr&lt;ModuleInformation&gt; m_module;
</span><ins>+    FunctionIndexSpace m_functionIndexSpace;
+    Vector&lt;FunctionLocationInBinary&gt; m_functionLocationInBinary;
</ins><span class="cx">     bool m_failed { true };
</span><span class="cx">     String m_errorMessage;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmParser.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmParser.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmParser.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -102,7 +102,7 @@
</span><span class="cx"> ALWAYS_INLINE bool Parser::consumeUTF8String(String&amp; result, size_t stringLength)
</span><span class="cx"> {
</span><span class="cx">     if (stringLength == 0) {
</span><del>-        result = String();
</del><ins>+        result = emptyString();
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx">     if (length() &lt; stringLength || m_offset &gt; length() - stringLength)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmPlan.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmPlan.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmPlan.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -33,11 +33,13 @@
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="cx"> #include &quot;JSWebAssemblyCallee.h&quot;
</span><span class="cx"> #include &quot;WasmB3IRGenerator.h&quot;
</span><ins>+#include &quot;WasmBinding.h&quot;
</ins><span class="cx"> #include &quot;WasmCallingConvention.h&quot;
</span><span class="cx"> #include &quot;WasmMemory.h&quot;
</span><span class="cx"> #include &quot;WasmModuleParser.h&quot;
</span><span class="cx"> #include &quot;WasmValidate.h&quot;
</span><span class="cx"> #include &lt;wtf/DataLog.h&gt;
</span><ins>+#include &lt;wtf/StdLibExtras.h&gt;
</ins><span class="cx"> #include &lt;wtf/text/StringBuilder.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace Wasm {
</span><span class="lines">@@ -69,27 +71,52 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_moduleInformation = WTFMove(moduleParser.moduleInformation());
</span><ins>+        m_functionLocationInBinary = WTFMove(moduleParser.functionLocationInBinary());
+        m_functionIndexSpace = WTFMove(moduleParser.functionIndexSpace());
</ins><span class="cx">     }
</span><span class="cx">     if (verbose)
</span><span class="cx">         dataLogLn(&quot;Parsed module.&quot;);
</span><span class="cx"> 
</span><del>-    if (!m_compiledFunctions.tryReserveCapacity(m_moduleInformation-&gt;functions.size())) {
-        StringBuilder builder;
-        builder.appendLiteral(&quot;Failed allocating enough space for &quot;);
-        builder.appendNumber(m_moduleInformation-&gt;functions.size());
-        builder.appendLiteral(&quot; compiled functions&quot;);
-        m_errorMessage = builder.toString();
</del><ins>+    auto tryReserveCapacity = [this] (auto&amp; vector, size_t size, const char* what) {
+        if (UNLIKELY(!vector.tryReserveCapacity(size))) {
+            StringBuilder builder;
+            builder.appendLiteral(&quot;Failed allocating enough space for &quot;);
+            builder.appendNumber(size);
+            builder.append(what);
+            m_errorMessage = builder.toString();
+            return false;
+        }
+        return true;
+    };
+    Vector&lt;Vector&lt;UnlinkedWasmToWasmCall&gt;&gt; unlinkedWasmToWasmCalls;
+    if (!tryReserveCapacity(m_wasmToJSStubs, m_moduleInformation-&gt;importFunctions.size(), &quot; WebAssembly to JavaScript stubs&quot;)
+        || !tryReserveCapacity(unlinkedWasmToWasmCalls, m_functionLocationInBinary.size(), &quot; unlinked WebAssembly to WebAssembly calls&quot;)
+        || !tryReserveCapacity(m_wasmInternalFunctions, m_functionLocationInBinary.size(), &quot; WebAssembly functions&quot;))
</ins><span class="cx">         return;
</span><ins>+
+    for (unsigned importIndex = 0; importIndex &lt; m_moduleInformation-&gt;imports.size(); ++importIndex) {
+        Import* import = &amp;m_moduleInformation-&gt;imports[importIndex];
+        if (import-&gt;kind != External::Function)
+            continue;
+        unsigned importFunctionIndex = m_wasmToJSStubs.size();
+        if (verbose)
+            dataLogLn(&quot;Processing import function number &quot;, importFunctionIndex, &quot;: &quot;, import-&gt;module, &quot;: &quot;, import-&gt;field);
+        Signature* signature = m_moduleInformation-&gt;importFunctions.at(import-&gt;kindIndex);
+        m_wasmToJSStubs.uncheckedAppend(importStubGenerator(m_vm, m_callLinkInfos, signature, importFunctionIndex));
+        m_functionIndexSpace[importFunctionIndex].code = m_wasmToJSStubs[importFunctionIndex].code().executableAddress();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    for (const FunctionInformation&amp; info : m_moduleInformation-&gt;functions) {
</del><ins>+    for (unsigned functionIndex = 0; functionIndex &lt; m_functionLocationInBinary.size(); ++functionIndex) {
</ins><span class="cx">         if (verbose)
</span><del>-            dataLogLn(&quot;Processing function starting at: &quot;, info.start, &quot; and ending at: &quot;, info.end);
-        const uint8_t* functionStart = m_source + info.start;
-        size_t functionLength = info.end - info.start;
</del><ins>+            dataLogLn(&quot;Processing function starting at: &quot;, m_functionLocationInBinary[functionIndex].start, &quot; and ending at: &quot;, m_functionLocationInBinary[functionIndex].end);
+        const uint8_t* functionStart = m_source + m_functionLocationInBinary[functionIndex].start;
+        size_t functionLength = m_functionLocationInBinary[functionIndex].end - m_functionLocationInBinary[functionIndex].start;
</ins><span class="cx">         ASSERT(functionLength &lt;= m_sourceLength);
</span><ins>+        Signature* signature = m_moduleInformation-&gt;internalFunctionSignatures[functionIndex];
+        unsigned functionIndexSpace = m_wasmToJSStubs.size() + functionIndex;
+        ASSERT(m_functionIndexSpace[functionIndexSpace].signature == signature);
</ins><span class="cx"> 
</span><del>-        String error = validateFunction(functionStart, functionLength, info.signature, m_moduleInformation-&gt;functions);
</del><ins>+        String error = validateFunction(functionStart, functionLength, signature, m_functionIndexSpace);
</ins><span class="cx">         if (!error.isNull()) {
</span><span class="cx">             if (verbose) {
</span><span class="cx">                 for (unsigned i = 0; i &lt; functionLength; ++i)
</span><span class="lines">@@ -100,14 +127,15 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        m_compiledFunctions.uncheckedAppend(parseAndCompile(*m_vm, functionStart, functionLength, m_moduleInformation-&gt;memory.get(), info.signature, m_moduleInformation-&gt;functions));
</del><ins>+        unlinkedWasmToWasmCalls.uncheckedAppend(Vector&lt;UnlinkedWasmToWasmCall&gt;());
+        m_wasmInternalFunctions.uncheckedAppend(parseAndCompile(*m_vm, functionStart, functionLength, m_moduleInformation-&gt;memory.get(), signature, unlinkedWasmToWasmCalls.at(functionIndex), m_functionIndexSpace));
+        m_functionIndexSpace[functionIndexSpace].code = m_wasmInternalFunctions[functionIndex]-&gt;code-&gt;code().executableAddress();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // Patch the call sites for each function.
-    for (std::unique_ptr&lt;FunctionCompilation&gt;&amp; functionPtr : m_compiledFunctions) {
-        FunctionCompilation* function = functionPtr.get();
-        for (auto&amp; call : function-&gt;unlinkedCalls)
-            MacroAssembler::repatchCall(call.callLocation, CodeLocationLabel(m_compiledFunctions[call.functionIndex]-&gt;code-&gt;code()));
</del><ins>+    // Patch the call sites for each WebAssembly function.
+    for (auto&amp; unlinked : unlinkedWasmToWasmCalls) {
+        for (auto&amp; call : unlinked)
+            MacroAssembler::repatchCall(call.callLocation, CodeLocationLabel(m_functionIndexSpace[call.functionIndex].code));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_failed = false;
</span><span class="lines">@@ -116,10 +144,10 @@
</span><span class="cx"> void Plan::initializeCallees(JSGlobalObject* globalObject, std::function&lt;void(unsigned, JSWebAssemblyCallee*)&gt; callback)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!failed());
</span><del>-    for (unsigned i = 0; i &lt; m_compiledFunctions.size(); i++) {
-        std::unique_ptr&lt;FunctionCompilation&gt;&amp; compilation = m_compiledFunctions[i];
-        CodeLocationDataLabelPtr calleeMoveLocation = compilation-&gt;calleeMoveLocation;
-        JSWebAssemblyCallee* callee = JSWebAssemblyCallee::create(globalObject-&gt;vm(), WTFMove(compilation));
</del><ins>+    for (unsigned internalFunctionIndex = 0; internalFunctionIndex &lt; m_wasmInternalFunctions.size(); ++internalFunctionIndex) {
+        WasmInternalFunction* function = m_wasmInternalFunctions[internalFunctionIndex].get();
+        CodeLocationDataLabelPtr calleeMoveLocation = function-&gt;calleeMoveLocation;
+        JSWebAssemblyCallee* callee = JSWebAssemblyCallee::create(globalObject-&gt;vm(), WTFMove(function-&gt;code), WTFMove(function-&gt;jsToWasmEntryPoint));
</ins><span class="cx"> 
</span><span class="cx">         MacroAssembler::repatchPointer(calleeMoveLocation, callee);
</span><span class="cx"> 
</span><span class="lines">@@ -126,7 +154,7 @@
</span><span class="cx">         if (verbose)
</span><span class="cx">             dataLogLn(&quot;Made Wasm callee: &quot;, RawPointer(callee));
</span><span class="cx"> 
</span><del>-        callback(i, callee);
</del><ins>+        callback(internalFunctionIndex, callee);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmPlanh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmPlan.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmPlan.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmPlan.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -30,11 +30,13 @@
</span><span class="cx"> #include &quot;CompilationResult.h&quot;
</span><span class="cx"> #include &quot;VM.h&quot;
</span><span class="cx"> #include &quot;WasmFormat.h&quot;
</span><ins>+#include &lt;wtf/Bag.h&gt;
</ins><span class="cx"> #include &lt;wtf/ThreadSafeRefCounted.h&gt;
</span><span class="cx"> #include &lt;wtf/Vector.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+class CallLinkInfo;
</ins><span class="cx"> class JSGlobalObject;
</span><span class="cx"> class JSWebAssemblyCallee;
</span><span class="cx"> 
</span><span class="lines">@@ -58,31 +60,61 @@
</span><span class="cx">         RELEASE_ASSERT(failed());
</span><span class="cx">         return m_errorMessage;
</span><span class="cx">     }
</span><del>-    
-    std::unique_ptr&lt;ModuleInformation&gt;&amp; getModuleInformation()
</del><ins>+
+    Vector&lt;Export&gt;&amp; exports() const
</ins><span class="cx">     {
</span><span class="cx">         RELEASE_ASSERT(!failed());
</span><del>-        return m_moduleInformation;
</del><ins>+        return m_moduleInformation-&gt;exports;
</ins><span class="cx">     }
</span><ins>+
</ins><span class="cx">     const Memory* memory() const
</span><span class="cx">     {
</span><span class="cx">         RELEASE_ASSERT(!failed());
</span><span class="cx">         return m_moduleInformation-&gt;memory.get();
</span><span class="cx">     }
</span><del>-    size_t compiledFunctionCount() const
</del><ins>+
+    size_t internalFunctionCount() const
</ins><span class="cx">     {
</span><span class="cx">         RELEASE_ASSERT(!failed());
</span><del>-        return m_compiledFunctions.size();
</del><ins>+        return m_wasmInternalFunctions.size();
</ins><span class="cx">     }
</span><del>-    const FunctionCompilation* compiledFunction(size_t i) const
</del><ins>+    B3::Compilation* jsToWasmEntryPointForFunction(size_t i) const
</ins><span class="cx">     {
</span><ins>+        ASSERT(i &gt; m_wasmToJSStubs.size());
+        return m_wasmInternalFunctions.at(i - m_wasmToJSStubs.size())-&gt;jsToWasmEntryPoint.get();
+    }
+
+    std::unique_ptr&lt;ModuleInformation&gt;&amp;&amp; takeModuleInformation()
+    {
</ins><span class="cx">         RELEASE_ASSERT(!failed());
</span><del>-        return m_compiledFunctions.at(i).get();
</del><ins>+        return WTFMove(m_moduleInformation);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    Bag&lt;CallLinkInfo&gt;&amp;&amp; takeCallLinkInfos()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_callLinkInfos);
+    }
+
+    Vector&lt;WasmToJSStub&gt;&amp;&amp; takeWasmToJSStubs()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_wasmToJSStubs);
+    }
+
+    FunctionIndexSpace&amp;&amp; takeFunctionIndexSpace()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_functionIndexSpace);
+    }
+
</ins><span class="cx"> private:
</span><span class="cx">     std::unique_ptr&lt;ModuleInformation&gt; m_moduleInformation;
</span><del>-    CompiledFunctions m_compiledFunctions;
</del><ins>+    Vector&lt;FunctionLocationInBinary&gt; m_functionLocationInBinary;
+    Bag&lt;CallLinkInfo&gt; m_callLinkInfos;
+    Vector&lt;WasmToJSStub&gt; m_wasmToJSStubs;
+    Vector&lt;std::unique_ptr&lt;WasmInternalFunction&gt;&gt; m_wasmInternalFunctions;
+    FunctionIndexSpace m_functionIndexSpace;
</ins><span class="cx"> 
</span><span class="cx">     VM* m_vm;
</span><span class="cx">     const uint8_t* m_source;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -111,7 +111,7 @@
</span><span class="cx">     bool WARN_UNUSED_RETURN addEndToUnreachable(ControlEntry&amp;);
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-    bool WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const FunctionInformation&amp;, const Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result);
</del><ins>+    bool WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const Signature*, const Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result);
</ins><span class="cx"> 
</span><span class="cx">     void dump(const Vector&lt;ControlEntry&gt;&amp; controlStack, const ExpressionList&amp; expressionStack);
</span><span class="cx"> 
</span><span class="lines">@@ -320,12 +320,12 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool Validate::addCall(unsigned, const FunctionInformation&amp; info, const Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result)
</del><ins>+bool Validate::addCall(unsigned, const Signature* signature, const Vector&lt;ExpressionType&gt;&amp; args, ExpressionType&amp; result)
</ins><span class="cx"> {
</span><del>-    if (info.signature-&gt;arguments.size() != args.size()) {
</del><ins>+    if (signature-&gt;arguments.size() != args.size()) {
</ins><span class="cx">         StringBuilder builder;
</span><span class="cx">         builder.append(&quot;Arity mismatch in call, expected: &quot;);
</span><del>-        builder.appendNumber(info.signature-&gt;arguments.size());
</del><ins>+        builder.appendNumber(signature-&gt;arguments.size());
</ins><span class="cx">         builder.append(&quot; but got: &quot;);
</span><span class="cx">         builder.appendNumber(args.size());
</span><span class="cx">         m_errorMessage = builder.toString();
</span><span class="lines">@@ -333,13 +333,13 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0; i &lt; args.size(); ++i) {
</span><del>-        if (args[i] != info.signature-&gt;arguments[i]) {
-            m_errorMessage = makeString(&quot;Expected argument type: &quot;, toString(info.signature-&gt;arguments[i]), &quot; does not match passed argument type: &quot;, toString(args[i]));
</del><ins>+        if (args[i] != signature-&gt;arguments[i]) {
+            m_errorMessage = makeString(&quot;Expected argument type: &quot;, toString(signature-&gt;arguments[i]), &quot; does not match passed argument type: &quot;, toString(args[i]));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    result = info.signature-&gt;returnType;
</del><ins>+    result = signature-&gt;returnType;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -367,10 +367,10 @@
</span><span class="cx">     // Think of this as penance for the sin of bad error messages.
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-String validateFunction(const uint8_t* source, size_t length, const Signature* signature, const Vector&lt;FunctionInformation&gt;&amp; functions)
</del><ins>+String validateFunction(const uint8_t* source, size_t length, const Signature* signature, const FunctionIndexSpace&amp; functionIndexSpace)
</ins><span class="cx"> {
</span><span class="cx">     Validate context(signature-&gt;returnType);
</span><del>-    FunctionParser&lt;Validate&gt; validator(context, source, length, signature, functions);
</del><ins>+    FunctionParser&lt;Validate&gt; validator(context, source, length, signature, functionIndexSpace);
</ins><span class="cx">     if (!validator.parse()) {
</span><span class="cx">         // FIXME: add better location information here. see: https://bugs.webkit.org/show_bug.cgi?id=164288
</span><span class="cx">         // FIXME: We should never not have an error message if we return false.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmValidateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmValidate.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmValidate.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/WasmValidate.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace Wasm {
</span><span class="cx"> 
</span><del>-String validateFunction(const uint8_t*, size_t, const Signature*, const Vector&lt;FunctionInformation&gt;&amp;);
</del><ins>+String validateFunction(const uint8_t*, size_t, const Signature*, const FunctionIndexSpace&amp;);
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::Wasm
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyCalleecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -38,12 +38,12 @@
</span><span class="cx">     : Base(vm, vm.webAssemblyCalleeStructure.get())
</span><span class="cx"> { }
</span><span class="cx"> 
</span><del>-void JSWebAssemblyCallee::finishCreation(VM&amp; vm, std::unique_ptr&lt;Wasm::FunctionCompilation&gt;&amp;&amp; compilation)
</del><ins>+void JSWebAssemblyCallee::finishCreation(VM&amp; vm, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp; code, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp; jsToWasmEntryPoint)
</ins><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx"> 
</span><del>-    m_code = WTFMove(compilation-&gt;code);
-    m_jsEntryPoint = WTFMove(compilation-&gt;jsEntryPoint);
</del><ins>+    m_code = WTFMove(code);
+    m_jsToWasmEntryPoint = WTFMove(jsToWasmEntryPoint);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSWebAssemblyCallee::destroy(JSCell* cell)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyCalleeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -37,10 +37,10 @@
</span><span class="cx">     typedef JSCell Base;
</span><span class="cx">     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</span><span class="cx"> 
</span><del>-    static JSWebAssemblyCallee* create(VM&amp; vm, std::unique_ptr&lt;Wasm::FunctionCompilation&gt;&amp;&amp; compilation)
</del><ins>+    static JSWebAssemblyCallee* create(VM&amp; vm, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp; code, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp; jsToWasmEntryPoint)
</ins><span class="cx">     {
</span><span class="cx">         JSWebAssemblyCallee* callee = new (NotNull, allocateCell&lt;JSWebAssemblyCallee&gt;(vm.heap)) JSWebAssemblyCallee(vm);
</span><del>-        callee-&gt;finishCreation(vm, WTFMove(compilation));
</del><ins>+        callee-&gt;finishCreation(vm, std::forward&lt;std::unique_ptr&lt;B3::Compilation&gt;&gt;(code), std::forward&lt;std::unique_ptr&lt;B3::Compilation&gt;&gt;(jsToWasmEntryPoint));
</ins><span class="cx">         return callee;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -53,14 +53,14 @@
</span><span class="cx">     static const bool needsDestruction = true;
</span><span class="cx">     static void destroy(JSCell*);
</span><span class="cx"> 
</span><del>-    void* jsEntryPoint() { return m_jsEntryPoint-&gt;code().executableAddress(); }
</del><ins>+    void* jsToWasmEntryPoint() { return m_jsToWasmEntryPoint-&gt;code().executableAddress(); }
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    void finishCreation(VM&amp;, std::unique_ptr&lt;Wasm::FunctionCompilation&gt;&amp;&amp;);
</del><ins>+    void finishCreation(VM&amp;, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp;, std::unique_ptr&lt;B3::Compilation&gt;&amp;&amp;);
</ins><span class="cx">     JSWebAssemblyCallee(VM&amp;);
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;B3::Compilation&gt; m_code;
</span><del>-    std::unique_ptr&lt;B3::Compilation&gt; m_jsEntryPoint;
</del><ins>+    std::unique_ptr&lt;B3::Compilation&gt; m_jsToWasmEntryPoint;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstancecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -33,12 +33,13 @@
</span><span class="cx"> #include &quot;JSModuleEnvironment.h&quot;
</span><span class="cx"> #include &quot;JSModuleNamespaceObject.h&quot;
</span><span class="cx"> #include &quot;JSWebAssemblyModule.h&quot;
</span><ins>+#include &lt;wtf/StdLibExtras.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-JSWebAssemblyInstance* JSWebAssemblyInstance::create(VM&amp; vm, Structure* structure, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject)
</del><ins>+JSWebAssemblyInstance* JSWebAssemblyInstance::create(VM&amp; vm, Structure* structure, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject, unsigned numImportFunctions)
</ins><span class="cx"> {
</span><del>-    auto* instance = new (NotNull, allocateCell&lt;JSWebAssemblyInstance&gt;(vm.heap)) JSWebAssemblyInstance(vm, structure);
</del><ins>+    auto* instance = new (NotNull, allocateCell&lt;JSWebAssemblyInstance&gt;(vm.heap, allocationSize(numImportFunctions))) JSWebAssemblyInstance(vm, structure, numImportFunctions);
</ins><span class="cx">     instance-&gt;finishCreation(vm, module, moduleNamespaceObject);
</span><span class="cx">     return instance;
</span><span class="cx"> }
</span><span class="lines">@@ -48,9 +49,11 @@
</span><span class="cx">     return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSWebAssemblyInstance::JSWebAssemblyInstance(VM&amp; vm, Structure* structure)
</del><ins>+JSWebAssemblyInstance::JSWebAssemblyInstance(VM&amp; vm, Structure* structure, unsigned numImportFunctions)
</ins><span class="cx">     : Base(vm, structure)
</span><ins>+    , m_numImportFunctions(numImportFunctions)
</ins><span class="cx"> {
</span><ins>+    memset(importFunctions(), 0, m_numImportFunctions * sizeof(WriteBarrier&lt;JSCell&gt;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSWebAssemblyInstance::finishCreation(VM&amp; vm, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject)
</span><span class="lines">@@ -75,6 +78,8 @@
</span><span class="cx">     Base::visitChildren(thisObject, visitor);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_module);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_moduleNamespaceObject);
</span><ins>+    for (unsigned i = 0; i &lt; thisObject-&gt;m_numImportFunctions; ++i)
+        visitor.append(thisObject-&gt;importFunction(i));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSWebAssemblyInstance::s_info = { &quot;WebAssembly.Instance&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyInstance) };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstanceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     typedef JSDestructibleObject Base;
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-    static JSWebAssemblyInstance* create(VM&amp;, Structure*, JSWebAssemblyModule*, JSModuleNamespaceObject*);
</del><ins>+    static JSWebAssemblyInstance* create(VM&amp;, Structure*, JSWebAssemblyModule*, JSModuleNamespaceObject*, unsigned);
</ins><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="lines">@@ -51,8 +51,39 @@
</span><span class="cx">         return m_module.get();
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    WriteBarrier&lt;JSCell&gt;* importFunction(unsigned idx)
+    {
+        RELEASE_ASSERT(idx &lt; m_numImportFunctions);
+        return &amp;importFunctions()[idx];
+    }
+
+    WriteBarrier&lt;JSCell&gt;* importFunctions()
+    {
+        return bitwise_cast&lt;WriteBarrier&lt;JSCell&gt;*&gt;(bitwise_cast&lt;char*&gt;(this) + offsetOfImportFunctions());
+    }
+
+    void setImportFunction(VM&amp; vm, JSCell* value, unsigned idx)
+    {
+        importFunction(idx)-&gt;set(vm, this, value);
+    }
+
+    static size_t offsetOfImportFunctions()
+    {
+        return WTF::roundUpToMultipleOf&lt;sizeof(WriteBarrier&lt;JSCell&gt;)&gt;(sizeof(JSWebAssemblyInstance));
+    }
+
+    static size_t offsetOfImportFunction(unsigned idx)
+    {
+        return offsetOfImportFunctions() + sizeof(WriteBarrier&lt;JSCell&gt;) * idx;
+    }
+
+    static size_t allocationSize(unsigned numImportFunctions)
+    {
+        return offsetOfImportFunctions() + sizeof(WriteBarrier&lt;JSCell&gt;) * numImportFunctions;
+    }
+
</ins><span class="cx"> protected:
</span><del>-    JSWebAssemblyInstance(VM&amp;, Structure*);
</del><ins>+    JSWebAssemblyInstance(VM&amp;, Structure*, unsigned);
</ins><span class="cx">     void finishCreation(VM&amp;, JSWebAssemblyModule*, JSModuleNamespaceObject*);
</span><span class="cx">     static void destroy(JSCell*);
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="lines">@@ -60,6 +91,7 @@
</span><span class="cx"> private:
</span><span class="cx">     WriteBarrier&lt;JSWebAssemblyModule&gt; m_module;
</span><span class="cx">     WriteBarrier&lt;JSModuleNamespaceObject&gt; m_moduleNamespaceObject;
</span><ins>+    unsigned m_numImportFunctions;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyModulecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -38,10 +38,9 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSWebAssemblyModule::s_info = { &quot;WebAssembly.Module&quot;, &amp;Base::s_info, nullptr, CREATE_METHOD_TABLE(JSWebAssemblyModule) };
</span><span class="cx"> 
</span><del>-JSWebAssemblyModule* JSWebAssemblyModule::create(VM&amp; vm, Structure* structure, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp; moduleInformation,
-    SymbolTable* exportSymbolTable, unsigned calleeCount)
</del><ins>+JSWebAssemblyModule* JSWebAssemblyModule::create(VM&amp; vm, Structure* structure, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;&amp; moduleInformation, Bag&lt;CallLinkInfo&gt;&amp;&amp; callLinkInfos, Vector&lt;Wasm::WasmToJSStub&gt;&amp;&amp; wasmToJSStubs, Wasm::FunctionIndexSpace&amp;&amp; functionIndexSpace, SymbolTable* exportSymbolTable, unsigned calleeCount)
</ins><span class="cx"> {
</span><del>-    auto* instance = new (NotNull, allocateCell&lt;JSWebAssemblyModule&gt;(vm.heap, allocationSize(calleeCount))) JSWebAssemblyModule(vm, structure, moduleInformation, calleeCount);
</del><ins>+    auto* instance = new (NotNull, allocateCell&lt;JSWebAssemblyModule&gt;(vm.heap, allocationSize(calleeCount))) JSWebAssemblyModule(vm, structure, std::forward&lt;std::unique_ptr&lt;Wasm::ModuleInformation&gt;&gt;(moduleInformation), std::forward&lt;Bag&lt;CallLinkInfo&gt;&gt;(callLinkInfos), std::forward&lt;Vector&lt;Wasm::WasmToJSStub&gt;&gt;(wasmToJSStubs), std::forward&lt;Wasm::FunctionIndexSpace&gt;(functionIndexSpace), calleeCount);
</ins><span class="cx">     instance-&gt;finishCreation(vm, exportSymbolTable);
</span><span class="cx">     return instance;
</span><span class="cx"> }
</span><span class="lines">@@ -51,9 +50,12 @@
</span><span class="cx">     return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSWebAssemblyModule::JSWebAssemblyModule(VM&amp; vm, Structure* structure, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp; moduleInformation, unsigned calleeCount)
</del><ins>+JSWebAssemblyModule::JSWebAssemblyModule(VM&amp; vm, Structure* structure, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;&amp; moduleInformation, Bag&lt;CallLinkInfo&gt;&amp;&amp; callLinkInfos, Vector&lt;Wasm::WasmToJSStub&gt;&amp;&amp; wasmToJSStubs, Wasm::FunctionIndexSpace&amp;&amp; functionIndexSpace, unsigned calleeCount)
</ins><span class="cx">     : Base(vm, structure)
</span><span class="cx">     , m_moduleInformation(WTFMove(moduleInformation))
</span><ins>+    , m_callLinkInfos(WTFMove(callLinkInfos))
+    , m_wasmToJSStubs(WTFMove(wasmToJSStubs))
+    , m_functionIndexSpace(WTFMove(functionIndexSpace))
</ins><span class="cx">     , m_calleeCount(calleeCount)
</span><span class="cx"> {
</span><span class="cx">     memset(callees(), 0, m_calleeCount * sizeof(WriteBarrier&lt;JSWebAssemblyCallee&gt;));
</span><span class="lines">@@ -78,6 +80,8 @@
</span><span class="cx"> 
</span><span class="cx">     Base::visitChildren(thisObject, visitor);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_exportSymbolTable);
</span><ins>+    for (auto iter = thisObject-&gt;m_callLinkInfos.begin(); !!iter; ++iter)
+        (*iter)-&gt;visitWeak(*thisObject-&gt;vm());
</ins><span class="cx">     for (unsigned i = 0; i &lt; thisObject-&gt;m_calleeCount; i++) {
</span><span class="cx">         WriteBarrier&lt;JSWebAssemblyCallee&gt;* callee = &amp;thisObject-&gt;callees()[i];
</span><span class="cx">         visitor.append(callee);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyModuleh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -30,6 +30,8 @@
</span><span class="cx"> #include &quot;JSDestructibleObject.h&quot;
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><span class="cx"> #include &quot;WasmFormat.h&quot;
</span><ins>+#include &lt;wtf/Bag.h&gt;
+#include &lt;wtf/Vector.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -40,7 +42,7 @@
</span><span class="cx"> public:
</span><span class="cx">     typedef JSDestructibleObject Base;
</span><span class="cx"> 
</span><del>-    static JSWebAssemblyModule* create(VM&amp;, Structure*, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;, SymbolTable* exports, unsigned calleeCount);
</del><ins>+    static JSWebAssemblyModule* create(VM&amp;, Structure*, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;&amp;, Bag&lt;CallLinkInfo&gt;&amp;&amp;, Vector&lt;Wasm::WasmToJSStub&gt;&amp;&amp;, Wasm::FunctionIndexSpace&amp;&amp;, SymbolTable*, unsigned);
</ins><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="lines">@@ -47,9 +49,13 @@
</span><span class="cx"> 
</span><span class="cx">     const Wasm::ModuleInformation&amp; moduleInformation() const { return *m_moduleInformation.get(); }
</span><span class="cx">     SymbolTable* exportSymbolTable() const { return m_exportSymbolTable.get(); }
</span><ins>+    Wasm::Signature* signatureForFunctionIndexSpace(unsigned functionIndexSpace) const { return m_functionIndexSpace.at(functionIndexSpace).signature; }
+    unsigned importCount() const { return m_wasmToJSStubs.size(); }
</ins><span class="cx"> 
</span><del>-    JSWebAssemblyCallee* callee(unsigned calleeIndex)
</del><ins>+    JSWebAssemblyCallee* calleeFromFunctionIndexSpace(unsigned functionIndexSpace)
</ins><span class="cx">     {
</span><ins>+        RELEASE_ASSERT(functionIndexSpace &gt;= importCount());
+        unsigned calleeIndex = functionIndexSpace - importCount();
</ins><span class="cx">         RELEASE_ASSERT(calleeIndex &lt; m_calleeCount);
</span><span class="cx">         return callees()[calleeIndex].get();
</span><span class="cx">     }
</span><span class="lines">@@ -60,7 +66,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><del>-    JSWebAssemblyModule(VM&amp;, Structure*, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;, unsigned calleeCount);
</del><ins>+    JSWebAssemblyModule(VM&amp;, Structure*, std::unique_ptr&lt;Wasm::ModuleInformation&gt;&amp;&amp;, Bag&lt;CallLinkInfo&gt;&amp;&amp;, Vector&lt;Wasm::WasmToJSStub&gt;&amp;&amp;, Wasm::FunctionIndexSpace&amp;&amp;, unsigned calleeCount);
</ins><span class="cx">     void finishCreation(VM&amp;, SymbolTable*);
</span><span class="cx">     static void destroy(JSCell*);
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="lines">@@ -77,7 +83,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;Wasm::ModuleInformation&gt; m_moduleInformation;
</span><ins>+    Bag&lt;CallLinkInfo&gt; m_callLinkInfos;
</ins><span class="cx">     WriteBarrier&lt;SymbolTable&gt; m_exportSymbolTable;
</span><ins>+    Vector&lt;Wasm::WasmToJSStub&gt; m_wasmToJSStubs;
+    Wasm::FunctionIndexSpace m_functionIndexSpace;
</ins><span class="cx">     unsigned m_calleeCount;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -97,7 +97,11 @@
</span><span class="cx">     ProtoCallFrame protoCallFrame;
</span><span class="cx">     protoCallFrame.init(nullptr, wasmFunction, firstArgument, argCount, remainingArgs);
</span><span class="cx">     
</span><del>-    EncodedJSValue rawResult = vmEntryToWasm(wasmFunction-&gt;webAssemblyCallee()-&gt;jsEntryPoint(), &amp;vm, &amp;protoCallFrame);
</del><ins>+    JSWebAssemblyInstance* prevJSWebAssemblyInstance = vm.topJSWebAssemblyInstance;
+    vm.topJSWebAssemblyInstance = wasmFunction-&gt;instance();
+    EncodedJSValue rawResult = vmEntryToWasm(wasmFunction-&gt;webAssemblyCallee()-&gt;jsToWasmEntryPoint(), &amp;vm, &amp;protoCallFrame);
+    vm.topJSWebAssemblyInstance = prevJSWebAssemblyInstance;
+
</ins><span class="cx">     // FIXME is this correct? https://bugs.webkit.org/show_bug.cgi?id=164876
</span><span class="cx">     switch (signature-&gt;returnType) {
</span><span class="cx">     case Wasm::Void:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><span class="cx">     JSWebAssemblyCallee* webAssemblyCallee() const { return m_wasmCallee.get(); }
</span><del>-    const JSWebAssemblyInstance* instance() const { return m_instance.get(); }
</del><ins>+    JSWebAssemblyInstance* instance() const { return m_instance.get(); }
</ins><span class="cx">     const Wasm::Signature* signature()
</span><span class="cx">     { 
</span><span class="cx">         ASSERT(m_signature);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyInstanceConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -31,8 +31,10 @@
</span><span class="cx"> #include &quot;FunctionPrototype.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;JSModuleEnvironment.h&quot;
</span><ins>+#include &quot;JSModuleNamespaceObject.h&quot;
</ins><span class="cx"> #include &quot;JSWebAssemblyInstance.h&quot;
</span><span class="cx"> #include &quot;JSWebAssemblyModule.h&quot;
</span><ins>+#include &quot;WebAssemblyFunction.h&quot;
</ins><span class="cx"> #include &quot;WebAssemblyInstancePrototype.h&quot;
</span><span class="cx"> #include &quot;WebAssemblyModuleRecord.h&quot;
</span><span class="cx"> 
</span><span class="lines">@@ -73,21 +75,95 @@
</span><span class="cx"> 
</span><span class="cx">     Identifier moduleKey = Identifier::fromUid(PrivateName(PrivateName::Description, &quot;WebAssemblyInstance&quot;));
</span><span class="cx">     WebAssemblyModuleRecord* moduleRecord = WebAssemblyModuleRecord::create(state, vm, globalObject-&gt;webAssemblyModuleRecordStructure(), moduleKey, moduleInformation);
</span><del>-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx"> 
</span><span class="cx">     Structure* instanceStructure = InternalFunction::createSubclassStructure(state, state-&gt;newTarget(), globalObject-&gt;WebAssemblyInstanceStructure());
</span><del>-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx"> 
</span><del>-    JSWebAssemblyInstance* instance = JSWebAssemblyInstance::create(vm, instanceStructure, jsModule, moduleRecord-&gt;getModuleNamespace(state));
-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    JSWebAssemblyInstance* instance = JSWebAssemblyInstance::create(vm, instanceStructure, jsModule, moduleRecord-&gt;getModuleNamespace(state), moduleInformation.imports.size());
+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx"> 
</span><ins>+    // Let funcs, memories and tables be initially-empty lists of callable JavaScript objects, WebAssembly.Memory objects and WebAssembly.Table objects, respectively.
+    // Let imports be an initially-empty list of external values.
+    unsigned numImportFunctions = 0;
+
+    // FIXME implement Table https://bugs.webkit.org/show_bug.cgi?id=164135
+    // FIXME implement Memory https://bugs.webkit.org/show_bug.cgi?id=164134
+    // FIXME implement Global https://bugs.webkit.org/show_bug.cgi?id=164133
+
+    // For each import i in module.imports:
+    for (auto&amp; import : moduleInformation.imports) {
+        // 1. Let o be the resultant value of performing Get(importObject, i.module_name).
+        JSValue importModuleValue = importObject-&gt;get(state, import.module);
+        RETURN_IF_EXCEPTION(scope, { });
+        // 2. If Type(o) is not Object, throw a TypeError.
+        if (!importModuleValue.isObject())
+            return JSValue::encode(throwException(state, scope, createTypeError(state, ASCIILiteral(&quot;import must be an object&quot;), defaultSourceAppender, runtimeTypeForValue(importModuleValue))));
+        // 3. Let v be the value of performing Get(o, i.item_name)
+        JSObject* object = jsCast&lt;JSObject*&gt;(importModuleValue);
+        JSValue value = object-&gt;get(state, import.field);
+        RETURN_IF_EXCEPTION(scope, { });
+        switch (import.kind) {
+        case Wasm::External::Function: {
+            // 4. If i is a function import:
+            // i. If IsCallable(v) is false, throw a TypeError.
+            if (!value.isFunction())
+                return JSValue::encode(throwException(state, scope, createTypeError(state, ASCIILiteral(&quot;import function must be callable&quot;), defaultSourceAppender, runtimeTypeForValue(value))));
+            JSCell* cell = value.asCell();
+            // ii. If v is an Exported Function Exotic Object:
+            if (WebAssemblyFunction* importedExports = jsDynamicCast&lt;WebAssemblyFunction*&gt;(object)) {
+                // FIXME handle Function Exotic Object properly. https://bugs.webkit.org/show_bug.cgi?id=165282
+                // a. If the signature of v does not match the signature of i, throw a TypeError.
+                // b. Let closure be v.[[Closure]].
+                RELEASE_ASSERT_NOT_REACHED();
+                UNUSED_PARAM(importedExports);
+                break;
+            }
+            // iii. Otherwise:
+            // a. Let closure be a new host function of the given signature which calls v by coercing WebAssembly arguments to JavaScript arguments via ToJSValue and returns the result, if any, by coercing via ToWebAssemblyValue.
+            // Note: done as part of Plan compilation.
+            // iv. Append v to funcs.
+            instance-&gt;setImportFunction(vm, cell, numImportFunctions++);
+            // v. Append closure to imports.
+            break;
+        }
+        case Wasm::External::Table: {
+            // 7. Otherwise (i is a table import):
+            // FIXME implement Table https://bugs.webkit.org/show_bug.cgi?id=164135
+            // i. If v is not a WebAssembly.Table object, throw a TypeError.
+            // ii. Append v to tables.
+            // iii. Append v.[[Table]] to imports.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        case Wasm::External::Memory: {
+            // 6. If i is a memory import:
+            // FIXME implement Memory https://bugs.webkit.org/show_bug.cgi?id=164134
+            // i. If v is not a WebAssembly.Memory object, throw a TypeError.
+            // ii. Append v to memories.
+            // iii. Append v.[[Memory]] to imports.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        case Wasm::External::Global: {
+            // 5. If i is a global import:
+            // FIXME implement Global https://bugs.webkit.org/show_bug.cgi?id=164133
+            // i. If i is not an immutable global, throw a TypeError.
+            // ii. If Type(v) is not Number, throw a TypeError.
+            // iii. Append ToWebAssemblyValue(v) to imports.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        }
+    }
+
</ins><span class="cx">     moduleRecord-&gt;link(state, instance);
</span><del>-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx">     if (verbose)
</span><span class="cx">         moduleRecord-&gt;dump();
</span><span class="cx">     JSValue startResult = moduleRecord-&gt;evaluate(state);
</span><span class="cx">     UNUSED_PARAM(startResult);
</span><del>-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(instance);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModuleConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -79,17 +79,18 @@
</span><span class="cx"> 
</span><span class="cx">     // On success, a new WebAssembly.Module object is returned with [[Module]] set to the validated Ast.module.
</span><span class="cx">     auto* structure = InternalFunction::createSubclassStructure(state, state-&gt;newTarget(), asInternalFunction(state-&gt;jsCallee())-&gt;globalObject()-&gt;WebAssemblyModuleStructure());
</span><del>-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+    RETURN_IF_EXCEPTION(scope, { });
</ins><span class="cx"> 
</span><span class="cx">     // The export symbol table is the same for all Instances of a Module.
</span><span class="cx">     SymbolTable* exportSymbolTable = SymbolTable::create(vm);
</span><del>-    for (auto&amp; exp : plan.getModuleInformation()-&gt;exports) {
</del><ins>+    for (auto&amp; exp : plan.exports()) {
</ins><span class="cx">         auto offset = exportSymbolTable-&gt;takeNextScopeOffset(NoLockingNecessary);
</span><span class="cx">         exportSymbolTable-&gt;set(NoLockingNecessary, exp.field.impl(), SymbolTableEntry(VarOffset(offset)));
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    unsigned calleeCount = plan.compiledFunctionCount();
-    JSWebAssemblyModule* result = JSWebAssemblyModule::create(vm, structure, plan.getModuleInformation(), exportSymbolTable, calleeCount);
</del><ins>+    // Only wasm-internal functions have a callee, stubs to JS do not.
+    unsigned calleeCount = plan.internalFunctionCount();
+    JSWebAssemblyModule* result = JSWebAssemblyModule::create(vm, structure, plan.takeModuleInformation(), plan.takeCallLinkInfos(), plan.takeWasmToJSStubs(), plan.takeFunctionIndexSpace(), exportSymbolTable, calleeCount);
</ins><span class="cx">     plan.initializeCallees(state-&gt;jsCallee()-&gt;globalObject(), 
</span><span class="cx">         [&amp;] (unsigned calleeIndex, JSWebAssemblyCallee* callee) {
</span><span class="cx">             result-&gt;callees()[calleeIndex].set(vm, result, callee);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp (209559 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2016-12-08 20:57:59 UTC (rev 209559)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -105,8 +105,10 @@
</span><span class="cx">     UNUSED_PARAM(scope);
</span><span class="cx">     auto* globalObject = state-&gt;lexicalGlobalObject();
</span><span class="cx"> 
</span><del>-    const Wasm::ModuleInformation&amp; moduleInformation = instance-&gt;module()-&gt;moduleInformation();
-    SymbolTable* exportSymbolTable = instance-&gt;module()-&gt;exportSymbolTable();
</del><ins>+    JSWebAssemblyModule* module = instance-&gt;module();
+    const Wasm::ModuleInformation&amp; moduleInformation = module-&gt;moduleInformation();
+    SymbolTable* exportSymbolTable = module-&gt;exportSymbolTable();
+    unsigned importCount = module-&gt;importCount();
</ins><span class="cx"> 
</span><span class="cx">     // FIXME wire up the imports. https://bugs.webkit.org/show_bug.cgi?id=165118
</span><span class="cx"> 
</span><span class="lines">@@ -119,12 +121,16 @@
</span><span class="cx">             // 1. If e is a closure c:
</span><span class="cx">             //   i. If there is an Exported Function Exotic Object func in funcs whose func.[[Closure]] equals c, then return func.
</span><span class="cx">             //   ii. (Note: At most one wrapper is created for any closure, so func is unique, even if there are multiple occurrances in the list. Moreover, if the item was an import that is already an Exported Function Exotic Object, then the original function object will be found. For imports that are regular JS functions, a new wrapper will be created.)
</span><ins>+            if (exp.functionIndex &lt; importCount) {
+                // FIXME Implement re-exporting an import. https://bugs.webkit.org/show_bug.cgi?id=165510
+                RELEASE_ASSERT_NOT_REACHED();
+            }
</ins><span class="cx">             //   iii. Otherwise:
</span><span class="cx">             //     a. Let func be an Exported Function Exotic Object created from c.
</span><span class="cx">             //     b. Append func to funcs.
</span><span class="cx">             //     c. Return func.
</span><del>-            JSWebAssemblyCallee* wasmCallee = instance-&gt;module()-&gt;callee(exp.functionIndex);
-            Wasm::Signature* signature = moduleInformation.functions.at(exp.functionIndex).signature;
</del><ins>+            JSWebAssemblyCallee* wasmCallee = module-&gt;calleeFromFunctionIndexSpace(exp.functionIndex);
+            Wasm::Signature* signature = module-&gt;signatureForFunctionIndexSpace(exp.functionIndex);
</ins><span class="cx">             WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, signature-&gt;arguments.size(), exp.field.string(), instance, wasmCallee, signature);
</span><span class="cx">             exportedValue = function;
</span><span class="cx">             break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyToJSCalleecppfromrev209559trunkSourceJavaScriptCorewasmjsJSWebAssemblyCalleecpp"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp (from rev 209559, trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp) (0 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -0,0 +1,66 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;WebAssemblyToJSCallee.h&quot;
+
+#if ENABLE(WEBASSEMBLY)
+
+#include &quot;JSCInlines.h&quot;
+
+namespace JSC {
+
+const ClassInfo WebAssemblyToJSCallee::s_info = { &quot;WebAssemblyToJSCallee&quot;, nullptr, 0, CREATE_METHOD_TABLE(WebAssemblyToJSCallee) };
+
+WebAssemblyToJSCallee* WebAssemblyToJSCallee::create(VM&amp; vm, Structure* structure)
+{
+    WebAssemblyToJSCallee* callee = new (NotNull, allocateCell&lt;WebAssemblyToJSCallee&gt;(vm.heap)) WebAssemblyToJSCallee(vm, structure);
+    callee-&gt;finishCreation(vm);
+    return callee;
+}
+
+Structure* WebAssemblyToJSCallee::createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+WebAssemblyToJSCallee::WebAssemblyToJSCallee(VM&amp; vm, Structure* structure)
+    : Base(vm, structure)
+{ }
+
+void WebAssemblyToJSCallee::finishCreation(VM&amp; vm)
+{
+    Base::finishCreation(vm);
+}
+
+void WebAssemblyToJSCallee::destroy(JSCell* cell)
+{
+    WebAssemblyToJSCallee* thisObject = jsCast&lt;WebAssemblyToJSCallee*&gt;(cell);
+    thisObject-&gt;WebAssemblyToJSCallee::~WebAssemblyToJSCallee();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyToJSCalleehfromrev209559trunkSourceJavaScriptCorewasmWasmB3IRGeneratorh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.h (from rev 209559, trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.h) (0 => 209560)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.h        2016-12-08 21:09:06 UTC (rev 209560)
</span><span class="lines">@@ -0,0 +1,53 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include &quot;JSCell.h&quot;
+
+namespace JSC {
+
+class WebAssemblyToJSCallee : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static WebAssemblyToJSCallee* create(VM&amp;, Structure*);
+    static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
+
+    DECLARE_EXPORT_INFO;
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+private:
+    void finishCreation(VM&amp;);
+    WebAssemblyToJSCallee(VM&amp;, Structure* structure);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
</ins></span></pre>
</div>
</div>

</body>
</html>