<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[278587] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/278587">278587</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2021-06-07 18:29:31 -0700 (Mon, 07 Jun 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, reverting <a href="http://trac.webkit.org/projects/webkit/changeset/278371">r278371</a> and <a href="http://trac.webkit.org/projects/webkit/changeset/278463">r278463</a>.
https://bugs.webkit.org/show_bug.cgi?id=226749

Break dumpDisassembly in JetStream2

Reverted changesets:

"We should drop B3 values while running Air"
https://bugs.webkit.org/show_bug.cgi?id=226187
https://trac.webkit.org/changeset/278371

"Drop the FTL(DFG) graph after lowering to B3"
https://bugs.webkit.org/show_bug.cgi?id=226556
https://trac.webkit.org/changeset/278463</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Generatecpp">trunk/Source/JavaScriptCore/b3/B3Generate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3PCToOriginMaph">trunk/Source/JavaScriptCore/b3/B3PCToOriginMap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Procedurecpp">trunk/Source/JavaScriptCore/b3/B3Procedure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3Procedureh">trunk/Source/JavaScriptCore/b3/B3Procedure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3SparseCollectionh">trunk/Source/JavaScriptCore/b3/B3SparseCollection.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirCodecpp">trunk/Source/JavaScriptCore/b3/air/AirCode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirCodeh">trunk/Source/JavaScriptCore/b3/air/AirCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3airAirGeneratecpp">trunk/Source/JavaScriptCore/b3/air/AirGenerate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3testb3_6cpp">trunk/Source/JavaScriptCore/b3/testb3_6.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCompilecpp">trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLSnippetParamscpp">trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLSnippetParamsh">trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLStatecpp">trunk/Source/JavaScriptCore/ftl/FTLState.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog    2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ChangeLog       2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2021-06-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, reverting r278371 and r278463.
+        https://bugs.webkit.org/show_bug.cgi?id=226749
+
+        Break dumpDisassembly in JetStream2
+
+        Reverted changesets:
+
+        "We should drop B3 values while running Air"
+        https://bugs.webkit.org/show_bug.cgi?id=226187
+        https://trac.webkit.org/changeset/278371
+
+        "Drop the FTL(DFG) graph after lowering to B3"
+        https://bugs.webkit.org/show_bug.cgi?id=226556
+        https://trac.webkit.org/changeset/278463
+
</ins><span class="cx"> 2021-06-07  Alexey Shvayka  <shvaikalesh@gmail.com>
</span><span class="cx"> 
</span><span class="cx">         Window should behave like a legacy platform object without indexed setter
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Generatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Generate.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Generate.cpp    2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/B3Generate.cpp       2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -133,7 +133,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     lowerToAir(procedure);
</span><del>-    procedure.freeUnneededB3ValuesAfterLowering();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::B3
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3PCToOriginMaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3PCToOriginMap.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3PCToOriginMap.h 2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/B3PCToOriginMap.h    2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx">     const Vector<OriginRange>& ranges() const  { return m_ranges; }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    Vector<OriginRange, 0> m_ranges;
</del><ins>+    Vector<OriginRange> m_ranges;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::B3
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Procedurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Procedure.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Procedure.cpp   2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/B3Procedure.cpp      2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -434,51 +434,6 @@
</span><span class="cx">     m_code->setNumEntrypoints(numEntrypoints);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Procedure::freeUnneededB3ValuesAfterLowering()
-{
-    // We cannot clear m_stackSlots() or m_tuples here, as they are unfortunately modified and read respectively by Air.
-    m_variables.clearAll();
-    m_blocks.clear();
-    m_cfg = nullptr;
-    m_dominators = nullptr;
-    m_naturalLoops = nullptr;
-    m_backwardsCFG = nullptr;
-    m_backwardsDominators = nullptr;
-    m_fastConstants.clear();
-
-    if (m_code->shouldPreserveB3Origins())
-        return;
-
-    BitVector valuesToPreserve;
-    valuesToPreserve.ensureSize(m_values.size());
-    for (Value* value : m_values) {
-        switch (value->opcode()) {
-        // Ideally we would also be able to get rid of all of those.
-        // But Air currently relies on these origins being preserved, see https://bugs.webkit.org/show_bug.cgi?id=194040
-        case WasmBoundsCheck:
-            valuesToPreserve.quickSet(value->index());
-            break;
-        case CCall:
-        case Patchpoint:
-        case CheckAdd:
-        case CheckSub:
-        case CheckMul:
-        case Check:
-            valuesToPreserve.quickSet(value->index());
-            for (Value* child : value->children())
-                valuesToPreserve.quickSet(child->index());
-            break;
-        default:
-            break;
-        }
-    }
-    for (Value* value : m_values) {
-        if (!valuesToPreserve.quickGet(value->index()))
-            m_values.remove(value);
-    }
-    m_values.packIndices();
-}
-
</del><span class="cx"> } } // namespace JSC::B3
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(B3_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3Procedureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3Procedure.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3Procedure.h     2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/B3Procedure.h        2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -258,11 +258,7 @@
</span><span class="cx">     JS_EXPORT_PRIVATE RegisterAtOffsetList calleeSaveRegisterAtOffsetList() const;
</span><span class="cx"> 
</span><span class="cx">     PCToOriginMap& pcToOriginMap() { return m_pcToOriginMap; }
</span><del>-    PCToOriginMap releasePCToOriginMap()
-    {
-        RELEASE_ASSERT(needsPCToOriginMap());
-        return WTFMove(m_pcToOriginMap);
-    }
</del><ins>+    PCToOriginMap releasePCToOriginMap() { return WTFMove(m_pcToOriginMap); }
</ins><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE void setWasmBoundsCheckGenerator(RefPtr<WasmBoundsCheckGenerator>);
</span><span class="cx"> 
</span><span class="lines">@@ -275,11 +271,6 @@
</span><span class="cx">     JS_EXPORT_PRIVATE RegisterSet mutableGPRs();
</span><span class="cx">     JS_EXPORT_PRIVATE RegisterSet mutableFPRs();
</span><span class="cx"> 
</span><del>-    void setNeedsPCToOriginMap() { m_needsPCToOriginMap = true; }
-    bool needsPCToOriginMap() { return m_needsPCToOriginMap; }
-
-    JS_EXPORT_PRIVATE void freeUnneededB3ValuesAfterLowering();
-
</del><span class="cx"> private:
</span><span class="cx">     friend class BlockInsertionSet;
</span><span class="cx"> 
</span><span class="lines">@@ -296,6 +287,7 @@
</span><span class="cx">     std::unique_ptr<BackwardsCFG> m_backwardsCFG;
</span><span class="cx">     std::unique_ptr<BackwardsDominators> m_backwardsDominators;
</span><span class="cx">     HashSet<ValueKey> m_fastConstants;
</span><ins>+    unsigned m_numEntrypoints { 1 };
</ins><span class="cx">     const char* m_lastPhaseName;
</span><span class="cx">     std::unique_ptr<OpaqueByproducts> m_byproducts;
</span><span class="cx">     std::unique_ptr<Air::Code> m_code;
</span><span class="lines">@@ -302,11 +294,9 @@
</span><span class="cx">     RefPtr<SharedTask<void(PrintStream&, Origin)>> m_originPrinter;
</span><span class="cx">     const void* m_frontendData;
</span><span class="cx">     PCToOriginMap m_pcToOriginMap;
</span><del>-    unsigned m_numEntrypoints { 1 };
</del><span class="cx">     unsigned m_optLevel { defaultOptLevel() };
</span><span class="cx">     bool m_needsUsedRegisters { true };
</span><span class="cx">     bool m_hasQuirks { false };
</span><del>-    bool m_needsPCToOriginMap { false };
</del><span class="cx"> };
</span><span class="cx">     
</span><span class="cx"> } } // namespace JSC::B3
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3SparseCollectionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3SparseCollection.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3SparseCollection.h      2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/B3SparseCollection.h 2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -111,12 +111,6 @@
</span><span class="cx">         m_vector.shrink(endIndex);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void clearAll()
-    {
-        m_indexFreeList.clear();
-        m_vector.clear();
-    }
-
</del><span class="cx">     unsigned size() const { return m_vector.size(); }
</span><span class="cx">     bool isEmpty() const { return m_vector.isEmpty(); }
</span><span class="cx">     
</span><span class="lines">@@ -160,8 +154,6 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">     private:
</span><del>-        friend class SparseCollection;
-
</del><span class="cx">         unsigned findNext(unsigned index)
</span><span class="cx">         {
</span><span class="cx">             while (index < m_collection->size() && !m_collection->at(index))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirCodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirCode.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirCode.cpp   2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/air/AirCode.cpp      2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx"> Code::Code(Procedure& proc)
</span><span class="cx">     : m_proc(proc)
</span><span class="cx">     , m_cfg(new CFG(*this))
</span><del>-    , m_preserveB3Origins(proc.needsPCToOriginMap() || Options::dumpAirGraphAtEachPhase() || Options::dumpFTLDisassembly())
</del><span class="cx">     , m_lastPhaseName("initial")
</span><span class="cx">     , m_defaultPrologueGenerator(createSharedTask<PrologueGeneratorFunction>(&defaultPrologueGenerator))
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirCode.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirCode.h     2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/air/AirCode.h        2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -354,10 +354,6 @@
</span><span class="cx">     void emitEpilogue(CCallHelpers&);
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr<GenerateAndAllocateRegisters> m_generateAndAllocateRegisters;
</span><del>-
-    bool shouldPreserveB3Origins() const { return m_preserveB3Origins; }
-
-    void forcePreservationOfB3Origins() { m_preserveB3Origins = true; }
</del><span class="cx">     
</span><span class="cx"> private:
</span><span class="cx">     friend class ::JSC::B3::Procedure;
</span><span class="lines">@@ -394,9 +390,7 @@
</span><span class="cx">     unsigned m_numFPTmps { 0 };
</span><span class="cx">     unsigned m_frameSize { 0 };
</span><span class="cx">     unsigned m_callArgAreaSize { 0 };
</span><del>-    unsigned m_optLevel { defaultOptLevel() };
</del><span class="cx">     bool m_stackIsAllocated { false };
</span><del>-    bool m_preserveB3Origins { true };
</del><span class="cx">     RegisterAtOffsetList m_uncorrectedCalleeSaveRegisterAtOffsetList;
</span><span class="cx">     RegisterSet m_calleeSaveRegisters;
</span><span class="cx">     StackSlot* m_calleeSaveStackSlot { nullptr };
</span><span class="lines">@@ -406,6 +400,7 @@
</span><span class="cx">     RefPtr<WasmBoundsCheckGenerator> m_wasmBoundsCheckGenerator;
</span><span class="cx">     const char* m_lastPhaseName;
</span><span class="cx">     std::unique_ptr<Disassembler> m_disassembler;
</span><ins>+    unsigned m_optLevel { defaultOptLevel() };
</ins><span class="cx">     Ref<PrologueGenerator> m_defaultPrologueGenerator;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3airAirGeneratecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/air/AirGenerate.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/air/AirGenerate.cpp       2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/air/AirGenerate.cpp  2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -214,12 +214,11 @@
</span><span class="cx"> 
</span><span class="cx">     PCToOriginMap& pcToOriginMap = code.proc().pcToOriginMap();
</span><span class="cx">     auto addItem = [&] (Inst& inst) {
</span><del>-        if (!code.shouldPreserveB3Origins())
</del><ins>+        if (!inst.origin) {
+            pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), Origin());
</ins><span class="cx">             return;
</span><del>-        if (inst.origin)
-            pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), inst.origin->origin());
-        else
-            pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), Origin());
</del><ins>+        }
+        pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), inst.origin->origin());
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     Disassembler* disassembler = code.disassembler();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3testb3_6cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/testb3_6.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/testb3_6.cpp      2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/b3/testb3_6.cpp 2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -2767,8 +2767,6 @@
</span><span class="cx">         root->appendNew<Const32Value>(proc, Origin(), 44),
</span><span class="cx">         ptr);
</span><span class="cx">     root->appendNew<Value>(proc, Return, Origin());
</span><del>-    // We'll look at the values after compiling
-    proc.code().forcePreservationOfB3Origins();
</del><span class="cx">     compileAndRun<int>(proc);
</span><span class="cx">     unsigned storeCount = 0;
</span><span class="cx">     for (Value* value : proc.values()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp     2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1861,26 +1861,6 @@
</span><span class="cx">     m_cpsCFG = nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Graph::freeDFGIRAfterLowering()
-{
-    m_blocks.clear();
-    m_roots.clear();
-    m_varArgChildren.clear();
-    m_nodes.clearAll();
-
-    m_bytecodeLiveness.clear();
-    m_safeToLoad.clear();
-    m_cpsDominators = nullptr;
-    m_ssaDominators = nullptr;
-    m_cpsNaturalLoops = nullptr;
-    m_ssaNaturalLoops = nullptr;
-    m_ssaCFG = nullptr;
-    m_cpsCFG = nullptr;
-    m_backwardsCFG = nullptr;
-    m_backwardsDominators = nullptr;
-    m_controlEquivalenceAnalysis = nullptr;
-}
-
</del><span class="cx"> void Prefix::dump(PrintStream& out) const
</span><span class="cx"> {
</span><span class="cx">     if (!m_enabled)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h       2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h  2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -1074,8 +1074,6 @@
</span><span class="cx">         m_catchEntrypoints.append(CatchEntrypointData { machineCode, FixedVector<FlushFormat>(WTFMove(argumentFormats)), bytecodeIndex });
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void freeDFGIRAfterLowering();
-
</del><span class="cx">     StackCheck m_stackChecker;
</span><span class="cx">     VM& m_vm;
</span><span class="cx">     Plan& m_plan;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCompilecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp   2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp      2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -58,9 +58,6 @@
</span><span class="cx">     if (shouldDumpDisassembly())
</span><span class="cx">         state.proc->code().setDisassembler(makeUnique<B3::Air::Disassembler>());
</span><span class="cx"> 
</span><del>-    if (!shouldDumpDisassembly() && !Options::asyncDisassembly() && !graph.compilation() && !state.proc->needsPCToOriginMap())
-        graph.freeDFGIRAfterLowering();
-
</del><span class="cx">     {
</span><span class="cx">         GraphSafepoint safepoint(state.graph, safepointResult);
</span><span class="cx"> 
</span><span class="lines">@@ -153,11 +150,10 @@
</span><span class="cx">         state.allocationFailed = true;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-
-    if (vm.shouldBuilderPCToCodeOriginMapping()) {
-        B3::PCToOriginMap originMap = state.proc->releasePCToOriginMap();
</del><ins>+    
+    B3::PCToOriginMap originMap = state.proc->releasePCToOriginMap();
+    if (vm.shouldBuilderPCToCodeOriginMapping())
</ins><span class="cx">         codeBlock->setPCToCodeOriginMap(makeUnique<PCToCodeOriginMap>(PCToCodeOriginMapBuilder(vm, WTFMove(originMap)), *state.finalizer->b3CodeLinkBuffer));
</span><del>-    }
</del><span class="cx"> 
</span><span class="cx">     CodeLocationLabel<JSEntryPtrTag> label = state.finalizer->b3CodeLinkBuffer->locationOf<JSEntryPtrTag>(state.proc->code().entrypointLabel(0));
</span><span class="cx">     state.generatedFunction = label;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp      2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -2384,7 +2384,6 @@
</span><span class="cx">         patchpoint->numGPScratchRegisters = 1;
</span><span class="cx">         patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -2415,12 +2414,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">                         if (mathICGenerationState->shouldSlowPathRepatch) {
</span><del>-                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, semanticNodeOrigin, exceptions.get(),
-                                repatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
</del><ins>+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                                repatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
</ins><span class="cx">                             mathICGenerationState->slowPathCall = call.call();
</span><span class="cx">                         } else {
</span><del>-                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, semanticNodeOrigin,
-                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr());
</del><ins>+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr());
</ins><span class="cx">                             mathICGenerationState->slowPathCall = call.call();
</span><span class="cx">                         }
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -2439,8 +2438,8 @@
</span><span class="cx">                     });
</span><span class="cx">                 } else {
</span><span class="cx">                     callOperation(
</span><del>-                        *state, params.unavailableRegisters(), jit, semanticNodeOrigin, exceptions.get(),
-                        nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr());
</del><ins>+                        *state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                        nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr());
</ins><span class="cx">                 }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(MATH_IC_STATS)
</span><span class="lines">@@ -2492,7 +2491,6 @@
</span><span class="cx">         patchpoint->numFPScratchRegisters = 2;
</span><span class="cx">         patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -2526,12 +2524,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">                         if (mathICGenerationState->shouldSlowPathRepatch) {
</span><del>-                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, semanticNodeOrigin, exceptions.get(),
-                                repatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr(), params[2].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
</del><ins>+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                                repatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr(), params[2].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
</ins><span class="cx">                             mathICGenerationState->slowPathCall = call.call();
</span><span class="cx">                         } else {
</span><del>-                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, semanticNodeOrigin,
-                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr(), params[2].gpr());
</del><ins>+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr(), params[2].gpr());
</ins><span class="cx">                             mathICGenerationState->slowPathCall = call.call();
</span><span class="cx">                         }
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -2550,8 +2548,8 @@
</span><span class="cx">                     });
</span><span class="cx">                 } else {
</span><span class="cx">                     callOperation(
</span><del>-                        *state, params.unavailableRegisters(), jit, semanticNodeOrigin, exceptions.get(),
-                        nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr(), params[2].gpr());
</del><ins>+                        *state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                        nonRepatchingFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr(), params[2].gpr());
</ins><span class="cx">                 }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(MATH_IC_STATS)
</span><span class="lines">@@ -3995,11 +3993,10 @@
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         bool baseIsCell = abstractValue(node->child1()).isType(SpecCell);
</span><del>-        CodeOrigin nodeSemanticOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><del>-                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
</del><ins>+                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -4014,7 +4011,7 @@
</span><span class="cx">                 GPRReg propertyGPR = params[2].gpr();
</span><span class="cx"> 
</span><span class="cx">                 auto generator = Box<JITGetByValGenerator>::create(
</span><del>-                    jit.codeBlock(), nodeSemanticOrigin, callSiteIndex, AccessType::GetPrivateName,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex, AccessType::GetPrivateName,
</ins><span class="cx">                     params.unavailableRegisters(), JSValueRegs(baseGPR), JSValueRegs(propertyGPR), JSValueRegs(resultGPR));
</span><span class="cx"> 
</span><span class="cx">                 CCallHelpers::Jump notCell;
</span><span class="lines">@@ -4032,9 +4029,9 @@
</span><span class="cx">                     generator->slowPathJump().link(&jit);
</span><span class="cx">                     CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                     CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                        *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
</del><ins>+                        *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                         exceptions.get(), operationGetPrivateNameOptimize, resultGPR,
</span><del>-                        jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
</del><ins>+                        jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                         CCallHelpers::TrustedImmPtr(generator->stubInfo()), baseGPR, propertyGPR).call();
</span><span class="cx">                     jit.jump().linkTo(done, &jit);
</span><span class="cx"> 
</span><span class="lines">@@ -4128,11 +4125,10 @@
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         bool baseIsCell = abstractValue(m_node->child1()).isType(SpecCell);
</span><del>-        CodeOrigin nodeSemanticOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">             AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><del>-            CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
</del><ins>+            CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">             // This is the direct exit target for operation calls.
</span><span class="cx">             Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -4146,7 +4142,7 @@
</span><span class="cx">             GPRReg brandGPR = params[1].gpr();
</span><span class="cx"> 
</span><span class="cx">             auto generator = Box<JITPrivateBrandAccessGenerator>::create(
</span><del>-                jit.codeBlock(), nodeSemanticOrigin, callSiteIndex, accessType,
</del><ins>+                jit.codeBlock(), node->origin.semantic, callSiteIndex, accessType,
</ins><span class="cx">                 params.unavailableRegisters(), JSValueRegs(baseGPR), JSValueRegs(brandGPR));
</span><span class="cx"> 
</span><span class="cx">             CCallHelpers::Jump notCell;
</span><span class="lines">@@ -4176,9 +4172,9 @@
</span><span class="cx">                 generator->slowPathJump().link(&jit);
</span><span class="cx">                 CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                 CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                    *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
</del><ins>+                    *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                     exceptions.get(), appropriatePrivateAccessFunction(accessType), InvalidGPRReg,
</span><del>-                    jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
</del><ins>+                    jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                     CCallHelpers::TrustedImmPtr(generator->stubInfo()), baseGPR, brandGPR).call();
</span><span class="cx">                 jit.jump().linkTo(done, &jit);
</span><span class="cx"> 
</span><span class="lines">@@ -4538,14 +4534,13 @@
</span><span class="cx">             preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-
-        CodeOrigin nodeSemanticOrigin = node->origin.semantic;
</del><ins>+        
</ins><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><del>-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
</del><ins>+                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions =
</span><span class="cx">                     exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -4554,7 +4549,7 @@
</span><span class="cx">                 exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
</span><span class="cx"> 
</span><span class="cx">                 auto generator = Box<JITPutByIdGenerator>::create(
</span><del>-                    jit.codeBlock(), nodeSemanticOrigin, callSiteIndex,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                     params.unavailableRegisters(), identifier, JSValueRegs(params[0].gpr()),
</span><span class="cx">                     JSValueRegs(params[1].gpr()), GPRInfo::patchpointScratchRegister, ecmaMode,
</span><span class="cx">                     putKind);
</span><span class="lines">@@ -4569,9 +4564,9 @@
</span><span class="cx">                         generator->slowPathJump().link(&jit);
</span><span class="cx">                         CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                         CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), generator->slowPathFunction(), InvalidGPRReg,
</span><del>-                            jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
</span><span class="cx">                             params[0].gpr(), identifier.rawBits()).call();
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -5258,11 +5253,10 @@
</span><span class="cx">             RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><span class="cx">             State* state = &m_ftlState;
</span><del>-            CodeOrigin nodeSemanticOrigin = node->origin.semantic;
</del><span class="cx">             patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><del>-                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
</del><ins>+                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -5277,7 +5271,7 @@
</span><span class="cx">                 GPRReg propertyGPR = params[2].gpr();
</span><span class="cx"> 
</span><span class="cx">                 auto generator = Box<JITGetByValGenerator>::create(
</span><del>-                    jit.codeBlock(), nodeSemanticOrigin, callSiteIndex, AccessType::GetByVal,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex, AccessType::GetByVal,
</ins><span class="cx">                     params.unavailableRegisters(), JSValueRegs(baseGPR), JSValueRegs(propertyGPR), JSValueRegs(resultGPR));
</span><span class="cx"> 
</span><span class="cx">                 generator->stubInfo()->propertyIsString = propertyIsString;
</span><span class="lines">@@ -5299,9 +5293,9 @@
</span><span class="cx">                     generator->slowPathJump().link(&jit);
</span><span class="cx">                     CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                     CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                        *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
</del><ins>+                        *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                         exceptions.get(), operationGetByValOptimize, resultGPR,
</span><del>-                        jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
</del><ins>+                        jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                         CCallHelpers::TrustedImmPtr(generator->stubInfo()), CCallHelpers::TrustedImmPtr(nullptr), baseGPR, propertyGPR).call();
</span><span class="cx">                     jit.jump().linkTo(done, &jit);
</span><span class="cx"> 
</span><span class="lines">@@ -5859,16 +5853,12 @@
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         Node* node = m_node;
</span><del>-        CodeOrigin nodeSemanticOrigin = node->origin.semantic;
-        auto child1UseKind = node->child1().useKind();
-        auto child2UseKind = node->child2().useKind();
-        auto ecmaMode = node->ecmaMode().value();
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><del>-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(nodeSemanticOrigin);
</del><ins>+                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions =
</span><span class="cx">                     exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -5880,7 +5870,7 @@
</span><span class="cx">                 ASSERT(base.gpr() != params.gpScratch(0));
</span><span class="cx">                 ASSERT(returnGPR != params.gpScratch(0));
</span><span class="cx"> 
</span><del>-                if (child1UseKind)
</del><ins>+                if (node->child1().useKind() == UntypedUse)
</ins><span class="cx">                     slowCases.append(jit.branchIfNotCell(base));
</span><span class="cx"> 
</span><span class="cx">                 constexpr auto optimizationFunction = [&] () {
</span><span class="lines">@@ -5895,7 +5885,7 @@
</span><span class="cx">                         return CCallHelpers::TrustedImmPtr(subscriptValue.rawBits());
</span><span class="cx">                     else {
</span><span class="cx">                         ASSERT(params.gpScratch(0) != params[2].gpr());
</span><del>-                        if (child2UseKind == UntypedUse)
</del><ins>+                        if (node->child2().useKind() == UntypedUse)
</ins><span class="cx">                             slowCases.append(jit.branchIfNotCell(JSValueRegs(params[2].gpr())));
</span><span class="cx">                         return JSValueRegs(params[2].gpr());
</span><span class="cx">                     }
</span><span class="lines">@@ -5904,12 +5894,12 @@
</span><span class="cx">                 const auto generator = [&] {
</span><span class="cx">                     if constexpr (kind == DelByKind::Normal) {
</span><span class="cx">                         return Box<JITDelByIdGenerator>::create(
</span><del>-                            jit.codeBlock(), nodeSemanticOrigin, callSiteIndex,
</del><ins>+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                             params.unavailableRegisters(), subscriptValue, base,
</span><span class="cx">                             JSValueRegs(returnGPR), params.gpScratch(0));
</span><span class="cx">                     } else {
</span><span class="cx">                         return Box<JITDelByValGenerator>::create(
</span><del>-                            jit.codeBlock(), nodeSemanticOrigin, callSiteIndex,
</del><ins>+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                             params.unavailableRegisters(), base,
</span><span class="cx">                             subscript, JSValueRegs(returnGPR), params.gpScratch(0));
</span><span class="cx">                     }
</span><span class="lines">@@ -5926,11 +5916,11 @@
</span><span class="cx">                         slowCases.link(&jit);
</span><span class="cx">                         CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                         CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, nodeSemanticOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), optimizationFunction, returnGPR,
</span><del>-                            jit.codeBlock()->globalObjectFor(nodeSemanticOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             CCallHelpers::TrustedImmPtr(generator->stubInfo()), base,
</span><del>-                            subscript, CCallHelpers::TrustedImm32(ecmaMode)).call();
</del><ins>+                            subscript, CCallHelpers::TrustedImm32(node->ecmaMode().value())).call();
</ins><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="cx"> 
</span><span class="cx">                         generator->reportSlowPathCall(slowPathBegin, slowPathCall);
</span><span class="lines">@@ -9786,8 +9776,6 @@
</span><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         VM* vm = &this->vm();
</span><del>-        CodeOrigin nodeSemanticOrigin = node->origin.semantic;
-        auto nodeOp = node->op();
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -9799,9 +9787,9 @@
</span><span class="cx">                     CCallHelpers::TrustedImm32(callSiteIndex.bits()),
</span><span class="cx">                     CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));
</span><span class="cx"> 
</span><del>-                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(nodeSemanticOrigin);
</del><ins>+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
</ins><span class="cx">                 callLinkInfo->setUpCall(
</span><del>-                    nodeOp == Construct ? CallLinkInfo::Construct : CallLinkInfo::Call, GPRInfo::regT0);
</del><ins>+                    node->op() == Construct ? CallLinkInfo::Construct : CallLinkInfo::Call, GPRInfo::regT0);
</ins><span class="cx"> 
</span><span class="cx">                 auto slowPath = callLinkInfo->emitFastPath(jit, GPRInfo::regT0, InvalidGPRReg, CallLinkInfo::UseDataIC::No);
</span><span class="cx">                 CCallHelpers::Jump done = jit.jump();
</span><span class="lines">@@ -9808,7 +9796,7 @@
</span><span class="cx"> 
</span><span class="cx">                 slowPath.link(&jit);
</span><span class="cx">                 auto slowPathStart = jit.label();
</span><del>-                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(nodeSemanticOrigin)), GPRInfo::regT3);
</del><ins>+                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(node->origin.semantic)), GPRInfo::regT3);
</ins><span class="cx">                 callLinkInfo->emitSlowPath(*vm, jit);
</span><span class="cx"> 
</span><span class="cx">                 done.link(&jit);
</span><span class="lines">@@ -9898,7 +9886,6 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="lines">@@ -9932,7 +9919,7 @@
</span><span class="cx">                     shuffleData.numPassedArgs = numPassedArgs;
</span><span class="cx">                     shuffleData.setupCalleeSaveRegisters(jit.codeBlock());
</span><span class="cx">                     
</span><del>-                    CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(semanticNodeOrigin);
</del><ins>+                    CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
</ins><span class="cx">                     callLinkInfo->setUpCall(CallLinkInfo::DirectTailCall, InvalidGPRReg);
</span><span class="cx">                     
</span><span class="cx">                     CCallHelpers::Label mainPath = jit.label();
</span><span class="lines">@@ -9949,7 +9936,7 @@
</span><span class="cx">                     CCallHelpers::Label slowPath = jit.label();
</span><span class="cx">                     callOperation(
</span><span class="cx">                         *state, toSave, jit,
</span><del>-                        semanticNodeOrigin, exceptions.get(), operationLinkDirectCall,
</del><ins>+                        node->origin.semantic, exceptions.get(), operationLinkDirectCall,
</ins><span class="cx">                         InvalidGPRReg, CCallHelpers::TrustedImmPtr(callLinkInfo), calleeGPR).call();
</span><span class="cx">                     jit.jump().linkTo(mainPath, &jit);
</span><span class="cx">                     callLinkInfo->setExecutableDuringCompilation(executable);
</span><span class="lines">@@ -9964,7 +9951,7 @@
</span><span class="cx">                     return;
</span><span class="cx">                 }
</span><span class="cx">                 
</span><del>-                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(semanticNodeOrigin);
</del><ins>+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
</ins><span class="cx">                 callLinkInfo->setUpCall(
</span><span class="cx">                     isConstruct ? CallLinkInfo::DirectConstruct : CallLinkInfo::DirectCall, InvalidGPRReg);
</span><span class="cx"> 
</span><span class="lines">@@ -9991,7 +9978,7 @@
</span><span class="cx">                         
</span><span class="cx">                         callOperation(
</span><span class="cx">                             *state, params.unavailableRegisters(), jit,
</span><del>-                            semanticNodeOrigin, exceptions.get(), operationLinkDirectCall,
</del><ins>+                            node->origin.semantic, exceptions.get(), operationLinkDirectCall,
</ins><span class="cx">                             InvalidGPRReg, CCallHelpers::TrustedImmPtr(callLinkInfo),
</span><span class="cx">                             calleeGPR).call();
</span><span class="cx">                         jit.jump().linkTo(mainPath, &jit);
</span><span class="lines">@@ -10067,7 +10054,6 @@
</span><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         VM* vm = &this->vm();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -10105,7 +10091,7 @@
</span><span class="cx">                 slowPathShuffler.setCalleeJSValueRegs(JSValueRegs(GPRInfo::regT0));
</span><span class="cx">                 slowPathShuffler.prepareForSlowPath();
</span><span class="cx"> 
</span><del>-                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(semanticNodeOrigin)), GPRInfo::regT3);
</del><ins>+                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(node->origin.semantic)), GPRInfo::regT3);
</ins><span class="cx">                 callLinkInfo->emitSlowPath(*vm, jit);
</span><span class="cx"> 
</span><span class="cx">                 auto doneLocation = jit.label();
</span><span class="lines">@@ -10119,60 +10105,7 @@
</span><span class="cx">                     });
</span><span class="cx">             });
</span><span class="cx">     }
</span><del>-
-    struct CapturedForPhantomNewArrayWithSpreadCase {
-        unsigned parameterOffset;
-    };
-    struct CapturedForPhantomNewArrayBufferCase {
-        int64_t value;
-        int32_t currentStoreOffset;
-    };
-    struct CapturedForPhantomNewArrayBufferEnd {
-        unsigned arrayLength;
-    };
-    struct CapturedForPhantomCreateRest {
-        InlineCallFrame* inlineCallFrame;
-        unsigned numberOfArgumentsToSkip;
-        unsigned parameterOffset;
-    };
-    struct VarargsSpreadArgumentToEmit {
-        enum Type {
-            PhantomNewArrayWithSpreadCase,
-            PhantomNewArrayBufferCase,
-            PhantomNewArrayBufferEnd,
-            PhantomCreateRest
-        } m_type;
-        union {
-            CapturedForPhantomNewArrayWithSpreadCase m_phantomNewArrayWithSpreadCase;
-            CapturedForPhantomNewArrayBufferCase m_phantomNewArrayBufferCase;
-            CapturedForPhantomNewArrayBufferEnd m_phantomNewArrayBufferEnd;
-            CapturedForPhantomCreateRest m_phantomCreateRest;
-        };
-
-        VarargsSpreadArgumentToEmit(VarargsSpreadArgumentToEmit::Type t, unsigned arg)
-            : m_type(t)
-        {
-            if (m_type == PhantomNewArrayWithSpreadCase)
-                m_phantomNewArrayWithSpreadCase = { arg };
-            else {
-                ASSERT(t == PhantomNewArrayBufferEnd);
-                m_phantomNewArrayBufferEnd = { arg };
-            }
-        }
-        VarargsSpreadArgumentToEmit(VarargsSpreadArgumentToEmit::Type t, int64_t value, int32_t currentStoreOffset)
-            : m_type(t)
-            , m_phantomNewArrayBufferCase({ value, currentStoreOffset })
-        {
-            ASSERT(t == PhantomNewArrayBufferCase);
-        }
-        VarargsSpreadArgumentToEmit(VarargsSpreadArgumentToEmit::Type t, InlineCallFrame* inlineCallFrame, unsigned numberOfArgumentsToSkip, unsigned parameterOffset)
-            : m_type(t)
-            , m_phantomCreateRest({ inlineCallFrame, numberOfArgumentsToSkip, parameterOffset })
-        {
-            ASSERT(t == PhantomCreateRest);
-        }
-    };
-
</del><ins>+    
</ins><span class="cx">     void compileCallOrConstructVarargsSpread()
</span><span class="cx">     {
</span><span class="cx">         Node* node = m_node;
</span><span class="lines">@@ -10187,20 +10120,13 @@
</span><span class="cx">         Vector<LValue, 2> spreadLengths;
</span><span class="cx">         Vector<LValue, 8> patchpointArguments;
</span><span class="cx">         HashMap<InlineCallFrame*, LValue, WTF::DefaultHash<InlineCallFrame*>, WTF::NullableHashTraits<InlineCallFrame*>> cachedSpreadLengths;
</span><del>-        // Because the patchpoint generator runs late in Air, the dfg graph will be long gone.
-        // So we must load everything relevant right now, and make sure that they are captured by value by the lambda that acts as the generator
-        // One particularly tricky point is that the generator would like to walk over the tree rooted at this node, exploring through PhantomNewArrayWithSpread and PhantomNewArrayBuffer, emitting code along the way.
-        // Instead, we do that walk here, and record just enough information in the following vector to emit the right code at the end of Air.
-        Vector<VarargsSpreadArgumentToEmit> argumentsToEmitFromRightToLeft;
-        int storeOffset = CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register));
-        unsigned paramsOffset = 4;
-        unsigned index = 0;
</del><span class="cx">         auto pushAndCountArgumentsFromRightToLeft = recursableLambda([&](auto self, Node* target) -> void {
</span><del>-            switch (target->op()) {
-            case PhantomSpread:
</del><ins>+            if (target->op() == PhantomSpread) {
</ins><span class="cx">                 self(target->child1().node());
</span><span class="cx">                 return;
</span><del>-            case PhantomNewArrayWithSpread: {
</del><ins>+            }
+
+            if (target->op() == PhantomNewArrayWithSpread) {
</ins><span class="cx">                 BitVector* bitVector = target->bitVector();
</span><span class="cx">                 for (unsigned i = target->numChildren(); i--; ) {
</span><span class="cx">                     if (bitVector->get(i))
</span><span class="lines">@@ -10209,45 +10135,27 @@
</span><span class="cx">                         ++staticArgumentCount;
</span><span class="cx">                         LValue argument = this->lowJSValue(m_graph.varArgChild(target, i));
</span><span class="cx">                         patchpointArguments.append(argument);
</span><del>-                        argumentsToEmitFromRightToLeft.append({ VarargsSpreadArgumentToEmit::Type::PhantomNewArrayWithSpreadCase, paramsOffset + (index++)});
</del><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx">                 return;
</span><span class="cx">             }
</span><del>-            case PhantomNewArrayBuffer: {
-                auto* array = target->castOperand<JSImmutableButterfly*>();
-                unsigned arrayLength = array->length();
-                staticArgumentCount += arrayLength;
-                Checked<int32_t> offsetCount { 1 };
-                for (unsigned i = arrayLength; i--; ++offsetCount) {
-                    Checked<int32_t> currentStoreOffset { storeOffset };
-                    currentStoreOffset -= (offsetCount * static_cast<int32_t>(sizeof(Register)));
-                    // Because varargs values are drained as JSValue, we should not generate value
-                    // in Double form even if PhantomNewArrayBuffer's indexingType is ArrayWithDouble.
-                    int64_t value = JSValue::encode(array->get(i));
-                    argumentsToEmitFromRightToLeft.append({ VarargsSpreadArgumentToEmit::Type::PhantomNewArrayBufferCase, value, currentStoreOffset.value() });
-                }
-                argumentsToEmitFromRightToLeft.append({ VarargsSpreadArgumentToEmit::Type::PhantomNewArrayBufferEnd, arrayLength });
</del><ins>+
+            if (target->op() == PhantomNewArrayBuffer) {
+                staticArgumentCount += target->castOperand<JSImmutableButterfly*>()->length();
</ins><span class="cx">                 return;
</span><span class="cx">             }
</span><del>-            case PhantomCreateRest: {
-                InlineCallFrame* inlineCallFrame = target->origin.semantic.inlineCallFrame();
-                unsigned numberOfArgumentsToSkip = target->numberOfArgumentsToSkip();
-                unsigned parameterOffset = paramsOffset + (index++);
-                LValue length = cachedSpreadLengths.ensure(inlineCallFrame, [&] () {
-                    return m_out.zeroExtPtr(this->getSpreadLengthFromInlineCallFrame(inlineCallFrame, numberOfArgumentsToSkip));
-                }).iterator->value;
-                patchpointArguments.append(length);
-                spreadLengths.append(length);
-                argumentsToEmitFromRightToLeft.append({ VarargsSpreadArgumentToEmit::Type::PhantomCreateRest, inlineCallFrame, numberOfArgumentsToSkip, parameterOffset });
-                return;
-            }
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-            }
</del><ins>+
+            RELEASE_ASSERT(target->op() == PhantomCreateRest);
+            InlineCallFrame* inlineCallFrame = target->origin.semantic.inlineCallFrame();
+            unsigned numberOfArgumentsToSkip = target->numberOfArgumentsToSkip();
+            LValue length = cachedSpreadLengths.ensure(inlineCallFrame, [&] () {
+                return m_out.zeroExtPtr(this->getSpreadLengthFromInlineCallFrame(inlineCallFrame, numberOfArgumentsToSkip));
+            }).iterator->value;
+            patchpointArguments.append(length);
+            spreadLengths.append(length);
</ins><span class="cx">         });
</span><ins>+
</ins><span class="cx">         pushAndCountArgumentsFromRightToLeft(arguments);
</span><del>-
</del><span class="cx">         LValue argumentCountIncludingThis = m_out.constIntPtr(staticArgumentCount + 1);
</span><span class="cx">         for (LValue length : spreadLengths)
</span><span class="cx">             argumentCountIncludingThis = m_out.add(length, argumentCountIncludingThis);
</span><span class="lines">@@ -10275,14 +10183,12 @@
</span><span class="cx">             WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(EncodedJSValue));
</span><span class="cx"> 
</span><span class="cx">         m_proc.requestCallArgAreaSizeInBytes(minimumJSCallAreaSize);
</span><del>-
</del><ins>+        
</ins><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         VM* vm = &this->vm();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
-        auto nodeOp = node->op();
</del><span class="cx">         patchpoint->setGenerator(
</span><del>-            [=, argumentsToEmit = WTFMove(argumentsToEmitFromRightToLeft)] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</del><ins>+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</ins><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><span class="cx">                     state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(codeOrigin);
</span><span class="lines">@@ -10296,7 +10202,7 @@
</span><span class="cx">                     CCallHelpers::TrustedImm32(callSiteIndex.bits()),
</span><span class="cx">                     CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));
</span><span class="cx"> 
</span><del>-                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(semanticNodeOrigin);
</del><ins>+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 RegisterSet usedRegisters = RegisterSet::allRegisters();
</span><span class="cx">                 usedRegisters.exclude(RegisterSet::volatileRegistersForJSCall());
</span><span class="lines">@@ -10360,54 +10266,74 @@
</span><span class="cx"> 
</span><span class="cx">                     jit.store32(scratchGPR2, CCallHelpers::Address(scratchGPR1, CallFrameSlot::argumentCountIncludingThis * static_cast<int>(sizeof(Register)) + PayloadOffset));
</span><span class="cx"> 
</span><del>-                    for (const auto& argumentToEmit : argumentsToEmit) {
-                        switch (argumentToEmit.m_type) {
-                        case VarargsSpreadArgumentToEmit::PhantomNewArrayWithSpreadCase: {
-                            unsigned parameterOffset = argumentToEmit.m_phantomNewArrayWithSpreadCase.parameterOffset;
-                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
-                            getValueFromRep(params[parameterOffset], scratchGPR3);
-                            jit.store64(scratchGPR3, CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
-                            continue;
</del><ins>+                    int storeOffset = CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register));
+
+                    unsigned paramsOffset = 4;
+                    unsigned index = 0;
+                    auto emitArgumentsFromRightToLeft = recursableLambda([&](auto self, Node* target) -> void {
+                        if (target->op() == PhantomSpread) {
+                            self(target->child1().node());
+                            return;
</ins><span class="cx">                         }
</span><del>-                        case VarargsSpreadArgumentToEmit::PhantomNewArrayBufferCase: {
-                            int64_t value = argumentToEmit.m_phantomNewArrayBufferCase.value;
-                            int32_t currentStoreOffset = argumentToEmit.m_phantomNewArrayBufferCase.currentStoreOffset;
-                            jit.move(CCallHelpers::TrustedImm64(value), scratchGPR3);
-                            jit.store64(scratchGPR3, CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, currentStoreOffset));
-                            continue;
</del><ins>+
+                        if (target->op() == PhantomNewArrayWithSpread) {
+                            BitVector* bitVector = target->bitVector();
+                            for (unsigned i = target->numChildren(); i--; ) {
+                                if (bitVector->get(i))
+                                    self(state->graph.varArgChild(target, i).node());
+                                else {
+                                    jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
+                                    getValueFromRep(params[paramsOffset + (index++)], scratchGPR3);
+                                    jit.store64(scratchGPR3,
+                                        CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
+                                }
+                            }
+                            return;
</ins><span class="cx">                         }
</span><del>-                        case VarargsSpreadArgumentToEmit::PhantomNewArrayBufferEnd: {
-                            size_t arrayLength = static_cast<size_t>(argumentToEmit.m_phantomNewArrayBufferEnd.arrayLength);
-                            jit.subPtr(CCallHelpers::TrustedImmPtr(arrayLength), scratchGPR2);
-                            continue;
</del><ins>+
+                        if (target->op() == PhantomNewArrayBuffer) {
+                            auto* array = target->castOperand<JSImmutableButterfly*>();
+                            Checked<int32_t> offsetCount { 1 };
+                            for (unsigned i = array->length(); i--; ++offsetCount) {
+                                // Because varargs values are drained as JSValue, we should not generate value
+                                // in Double form even if PhantomNewArrayBuffer's indexingType is ArrayWithDouble.
+                                int64_t value = JSValue::encode(array->get(i));
+                                jit.move(CCallHelpers::TrustedImm64(value), scratchGPR3);
+                                Checked<int32_t> currentStoreOffset { storeOffset };
+                                currentStoreOffset -= (offsetCount * static_cast<int32_t>(sizeof(Register)));
+                                jit.store64(scratchGPR3,
+                                    CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, currentStoreOffset));
+                            }
+                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(array->length())), scratchGPR2);
+                            return;
</ins><span class="cx">                         }
</span><del>-                        case VarargsSpreadArgumentToEmit::PhantomCreateRest: {
-                            InlineCallFrame* inlineCallFrame = argumentToEmit.m_phantomCreateRest.inlineCallFrame;
-                            unsigned numberOfArgumentsToSkip = argumentToEmit.m_phantomCreateRest.numberOfArgumentsToSkip;
-                            unsigned parameterOffset = argumentToEmit.m_phantomCreateRest.parameterOffset;
</del><span class="cx"> 
</span><del>-                            B3::ValueRep numArgumentsToCopy = params[parameterOffset];
-                            getValueFromRep(numArgumentsToCopy, scratchGPR3);
-                            int loadOffset = (AssemblyHelpers::argumentsStart(inlineCallFrame).offset() + numberOfArgumentsToSkip) * static_cast<int>(sizeof(Register));
</del><ins>+                        RELEASE_ASSERT(target->op() == PhantomCreateRest);
+                        InlineCallFrame* inlineCallFrame = target->origin.semantic.inlineCallFrame();
</ins><span class="cx"> 
</span><del>-                            auto done = jit.branchTestPtr(MacroAssembler::Zero, scratchGPR3);
-                            auto loopStart = jit.label();
-                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR3);
-                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
-                            jit.load64(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR3, CCallHelpers::TimesEight, loadOffset), scratchGPR4);
-                            jit.store64(scratchGPR4,
-                                CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
-                            jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR3).linkTo(loopStart, &jit);
-                            done.link(&jit);
-                        }
-                        }
-                    }
</del><ins>+                        unsigned numberOfArgumentsToSkip = target->numberOfArgumentsToSkip();
+
+                        B3::ValueRep numArgumentsToCopy = params[paramsOffset + (index++)];
+                        getValueFromRep(numArgumentsToCopy, scratchGPR3);
+                        int loadOffset = (AssemblyHelpers::argumentsStart(inlineCallFrame).offset() + numberOfArgumentsToSkip) * static_cast<int>(sizeof(Register));
+
+                        auto done = jit.branchTestPtr(MacroAssembler::Zero, scratchGPR3);
+                        auto loopStart = jit.label();
+                        jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR3);
+                        jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
+                        jit.load64(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR3, CCallHelpers::TimesEight, loadOffset), scratchGPR4);
+                        jit.store64(scratchGPR4,
+                            CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
+                        jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR3).linkTo(loopStart, &jit);
+                        done.link(&jit);
+                    });
+                    emitArgumentsFromRightToLeft(arguments);
</ins><span class="cx">                 }
</span><span class="cx"> 
</span><span class="cx">                 {
</span><span class="cx">                     CCallHelpers::Jump dontThrow = jit.jump();
</span><span class="cx">                     slowCase.link(&jit);
</span><del>-                    jit.setupArguments<decltype(operationThrowStackOverflowForVarargs)>(jit.codeBlock()->globalObjectFor(semanticNodeOrigin));
</del><ins>+                    jit.setupArguments<decltype(operationThrowStackOverflowForVarargs)>(jit.codeBlock()->globalObjectFor(node->origin.semantic));
</ins><span class="cx">                     jit.prepareCallOperation(jit.vm());
</span><span class="cx">                     callWithExceptionCheck(operationThrowStackOverflowForVarargs);
</span><span class="cx">                     jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
</span><span class="lines">@@ -10421,9 +10347,9 @@
</span><span class="cx">                 jit.store64(scratchGPR3, CCallHelpers::calleeArgumentSlot(0));
</span><span class="cx">                 
</span><span class="cx">                 CallLinkInfo::CallType callType;
</span><del>-                if (nodeOp == ConstructVarargs || nodeOp == ConstructForwardVarargs)
</del><ins>+                if (node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs)
</ins><span class="cx">                     callType = CallLinkInfo::ConstructVarargs;
</span><del>-                else if (nodeOp == TailCallVarargs || nodeOp == TailCallForwardVarargs)
</del><ins>+                else if (node->op() == TailCallVarargs || node->op() == TailCallForwardVarargs)
</ins><span class="cx">                     callType = CallLinkInfo::TailCallVarargs;
</span><span class="cx">                 else
</span><span class="cx">                     callType = CallLinkInfo::CallVarargs;
</span><span class="lines">@@ -10451,7 +10377,7 @@
</span><span class="cx"> 
</span><span class="cx">                 if (isTailCall)
</span><span class="cx">                     jit.emitRestoreCalleeSaves();
</span><del>-                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(semanticNodeOrigin)), GPRInfo::regT3);
</del><ins>+                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(node->origin.semantic)), GPRInfo::regT3);
</ins><span class="cx">                 callLinkInfo->emitSlowPath(*vm, jit);
</span><span class="cx">                 
</span><span class="cx">                 if (isTailCall)
</span><span class="lines">@@ -10557,14 +10483,6 @@
</span><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         VM* vm = &this->vm();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
-        InlineCallFrame* inlineCallFrame;
-        if (node->child3())
-            inlineCallFrame = node->child3()->origin.semantic.inlineCallFrame();
-        else
-            inlineCallFrame = semanticNodeOrigin.inlineCallFrame();
-        CallVarargsData* data = node->callVarargsData();
-        auto nodeOp = node->op();
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -10580,7 +10498,8 @@
</span><span class="cx">                     CCallHelpers::TrustedImm32(callSiteIndex.bits()),
</span><span class="cx">                     CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));
</span><span class="cx"> 
</span><del>-                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(semanticNodeOrigin);
</del><ins>+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
+                CallVarargsData* data = node->callVarargsData();
</ins><span class="cx"> 
</span><span class="cx">                 unsigned argIndex = 1;
</span><span class="cx">                 GPRReg calleeGPR = params[argIndex++].gpr();
</span><span class="lines">@@ -10664,6 +10583,11 @@
</span><span class="cx">                     jit.move(CCallHelpers::TrustedImm32(originalStackHeight / sizeof(EncodedJSValue)), scratchGPR2);
</span><span class="cx">                     
</span><span class="cx">                     CCallHelpers::JumpList slowCase;
</span><ins>+                    InlineCallFrame* inlineCallFrame;
+                    if (node->child3())
+                        inlineCallFrame = node->child3()->origin.semantic.inlineCallFrame();
+                    else
+                        inlineCallFrame = node->origin.semantic.inlineCallFrame();
</ins><span class="cx"> 
</span><span class="cx">                     // emitSetupVarargsFrameFastCase modifies the stack pointer if it succeeds.
</span><span class="cx">                     emitSetupVarargsFrameFastCase(*vm, jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, inlineCallFrame, data->firstVarArgOffset, slowCase);
</span><span class="lines">@@ -10670,7 +10594,7 @@
</span><span class="cx"> 
</span><span class="cx">                     CCallHelpers::Jump done = jit.jump();
</span><span class="cx">                     slowCase.link(&jit);
</span><del>-                    jit.setupArguments<decltype(operationThrowStackOverflowForVarargs)>(jit.codeBlock()->globalObjectFor(semanticNodeOrigin));
</del><ins>+                    jit.setupArguments<decltype(operationThrowStackOverflowForVarargs)>(jit.codeBlock()->globalObjectFor(node->origin.semantic));
</ins><span class="cx">                     jit.prepareCallOperation(jit.vm());
</span><span class="cx">                     callWithExceptionCheck(bitwise_cast<void(*)()>(operationThrowStackOverflowForVarargs));
</span><span class="cx">                     jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
</span><span class="lines">@@ -10678,7 +10602,7 @@
</span><span class="cx">                     done.link(&jit);
</span><span class="cx">                 } else {
</span><span class="cx">                     jit.move(CCallHelpers::TrustedImm32(originalStackHeight / sizeof(EncodedJSValue)), scratchGPR1);
</span><del>-                    jit.setupArguments<decltype(operationSizeFrameForVarargs)>(jit.codeBlock()->globalObjectFor(semanticNodeOrigin), argumentsGPR, scratchGPR1, CCallHelpers::TrustedImm32(data->firstVarArgOffset));
</del><ins>+                    jit.setupArguments<decltype(operationSizeFrameForVarargs)>(jit.codeBlock()->globalObjectFor(node->origin.semantic), argumentsGPR, scratchGPR1, CCallHelpers::TrustedImm32(data->firstVarArgOffset));
</ins><span class="cx">                     jit.prepareCallOperation(jit.vm());
</span><span class="cx">                     callWithExceptionCheck(bitwise_cast<void(*)()>(operationSizeFrameForVarargs));
</span><span class="cx"> 
</span><span class="lines">@@ -10687,7 +10611,7 @@
</span><span class="cx">                     argumentsLateRep.emitRestore(jit, argumentsGPR);
</span><span class="cx">                     emitSetVarargsFrame(jit, scratchGPR1, false, scratchGPR2, scratchGPR2);
</span><span class="cx">                     jit.addPtr(CCallHelpers::TrustedImm32(-minimumJSCallAreaSize), scratchGPR2, CCallHelpers::stackPointerRegister);
</span><del>-                    jit.setupArguments<decltype(operationSetupVarargsFrame)>(jit.codeBlock()->globalObjectFor(semanticNodeOrigin), scratchGPR2, argumentsGPR, CCallHelpers::TrustedImm32(data->firstVarArgOffset), scratchGPR1);
</del><ins>+                    jit.setupArguments<decltype(operationSetupVarargsFrame)>(jit.codeBlock()->globalObjectFor(node->origin.semantic), scratchGPR2, argumentsGPR, CCallHelpers::TrustedImm32(data->firstVarArgOffset), scratchGPR1);
</ins><span class="cx">                     jit.prepareCallOperation(jit.vm());
</span><span class="cx">                     callWithExceptionCheck(bitwise_cast<void(*)()>(operationSetupVarargsFrame));
</span><span class="cx">                     
</span><span class="lines">@@ -10704,9 +10628,9 @@
</span><span class="cx">                 jit.store64(thisGPR, CCallHelpers::calleeArgumentSlot(0));
</span><span class="cx">                 
</span><span class="cx">                 CallLinkInfo::CallType callType;
</span><del>-                if (nodeOp == ConstructVarargs || nodeOp == ConstructForwardVarargs)
</del><ins>+                if (node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs)
</ins><span class="cx">                     callType = CallLinkInfo::ConstructVarargs;
</span><del>-                else if (nodeOp == TailCallVarargs || nodeOp == TailCallForwardVarargs)
</del><ins>+                else if (node->op() == TailCallVarargs || node->op() == TailCallForwardVarargs)
</ins><span class="cx">                     callType = CallLinkInfo::TailCallVarargs;
</span><span class="cx">                 else
</span><span class="cx">                     callType = CallLinkInfo::CallVarargs;
</span><span class="lines">@@ -10732,7 +10656,7 @@
</span><span class="cx"> 
</span><span class="cx">                 if (isTailCall)
</span><span class="cx">                     jit.emitRestoreCalleeSaves();
</span><del>-                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(semanticNodeOrigin)), GPRInfo::regT3);
</del><ins>+                jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()->globalObjectFor(node->origin.semantic)), GPRInfo::regT3);
</ins><span class="cx">                 callLinkInfo->emitSlowPath(*vm, jit);
</span><span class="cx">                 
</span><span class="cx">                 if (isTailCall)
</span><span class="lines">@@ -10806,8 +10730,6 @@
</span><span class="cx">         CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         VM& vm = this->vm();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
-        auto ecmaMode = node->ecmaMode().value();
</del><span class="cx">         JSGlobalObject* globalObject = m_graph.globalObjectFor(m_origin.semantic);
</span><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=, &vm] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="lines">@@ -10822,7 +10744,7 @@
</span><span class="cx">                     CCallHelpers::TrustedImm32(callSiteIndex.bits()),
</span><span class="cx">                     CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));
</span><span class="cx">                 
</span><del>-                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(semanticNodeOrigin);
</del><ins>+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo(node->origin.semantic);
</ins><span class="cx">                 callLinkInfo->setUpCall(CallLinkInfo::Call, GPRInfo::regT0);
</span><span class="cx">                 
</span><span class="cx">                 jit.addPtr(CCallHelpers::TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), CCallHelpers::stackPointerRegister, GPRInfo::regT1);
</span><span class="lines">@@ -10834,7 +10756,7 @@
</span><span class="cx">                 unsigned requiredBytes = sizeof(CallerFrameAndPC) + sizeof(CallFrame*) * 2;
</span><span class="cx">                 requiredBytes = WTF::roundUpToMultipleOf(stackAlignmentBytes(), requiredBytes);
</span><span class="cx">                 jit.subPtr(CCallHelpers::TrustedImm32(requiredBytes), CCallHelpers::stackPointerRegister);
</span><del>-                jit.move(CCallHelpers::TrustedImm32(ecmaMode), GPRInfo::regT2);
</del><ins>+                jit.move(CCallHelpers::TrustedImm32(node->ecmaMode().value()), GPRInfo::regT2);
</ins><span class="cx">                 jit.setupArguments<decltype(operationCallEval)>(globalObject, GPRInfo::regT1, GPRInfo::regT2);
</span><span class="cx">                 jit.prepareCallOperation(vm);
</span><span class="cx">                 jit.move(CCallHelpers::TrustedImmPtr(tagCFunction<OperationPtrTag>(operationCallEval)), GPRInfo::nonPreservedNonArgumentGPR0);
</span><span class="lines">@@ -12383,12 +12305,12 @@
</span><span class="cx">         RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = m_node->origin.semantic;
</del><ins>+        Node* node = m_node;
</ins><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><del>-                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(semanticNodeOrigin);
</del><ins>+                CallSiteIndex callSiteIndex = state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="lines">@@ -12406,12 +12328,12 @@
</span><span class="cx">                 const auto generator = [&] {
</span><span class="cx">                     if constexpr (kind == InByKind::Normal) {
</span><span class="cx">                         return Box<JITInByIdGenerator>::create(
</span><del>-                            jit.codeBlock(), semanticNodeOrigin, callSiteIndex,
</del><ins>+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                             params.unavailableRegisters(), subscriptValue, base,
</span><span class="cx">                             JSValueRegs(returnGPR));
</span><span class="cx">                     } else {
</span><span class="cx">                         return Box<JITInByValGenerator>::create(
</span><del>-                            jit.codeBlock(), semanticNodeOrigin, callSiteIndex,
</del><ins>+                            jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                             params.unavailableRegisters(), base, subscript,
</span><span class="cx">                             JSValueRegs(returnGPR));
</span><span class="cx">                     }
</span><span class="lines">@@ -12429,16 +12351,16 @@
</span><span class="cx">                         CCallHelpers::Call slowPathCall;
</span><span class="cx">                         if constexpr (kind == InByKind::Normal) {
</span><span class="cx">                             slowPathCall = callOperation(
</span><del>-                                *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                                 exceptions.get(), operationInByIdOptimize, returnGPR,
</span><del>-                                jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                                jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                                 CCallHelpers::TrustedImmPtr(generator->stubInfo()),
</span><span class="cx">                                 base, subscript).call();
</span><span class="cx">                         } else {
</span><span class="cx">                             slowPathCall = callOperation(
</span><del>-                                *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                                 exceptions.get(), operationInByValOptimize, returnGPR,
</span><del>-                                jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                                jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                                 CCallHelpers::TrustedImmPtr(generator->stubInfo()),
</span><span class="cx">                                 CCallHelpers::TrustedImmPtr(nullptr), base, subscript).call();
</span><span class="cx">                         }
</span><span class="lines">@@ -12665,7 +12587,6 @@
</span><span class="cx">         RefPtr<PatchpointExceptionHandle> exceptionHandle =
</span><span class="cx">             preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -12689,7 +12610,7 @@
</span><span class="cx">                     slowCases.append(jit.branchIfNotCell(prototypeGPR));
</span><span class="cx">                 
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><del>-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(semanticNodeOrigin);
</del><ins>+                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx">                 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions =
</span><span class="lines">@@ -12696,7 +12617,7 @@
</span><span class="cx">                     exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="cx">                 
</span><span class="cx">                 auto generator = Box<JITInstanceOfGenerator>::create(
</span><del>-                    jit.codeBlock(), semanticNodeOrigin, callSiteIndex,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                     params.unavailableRegisters(), resultGPR, valueGPR, prototypeGPR, scratchGPR,
</span><span class="cx">                     scratch2GPR, prototypeIsObject);
</span><span class="cx">                 generator->generateFastPath(jit);
</span><span class="lines">@@ -12711,9 +12632,9 @@
</span><span class="cx">                         slowCases.link(&jit);
</span><span class="cx">                         CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                         CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), optimizationFunction, resultGPR,
</span><del>-                            jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             CCallHelpers::TrustedImmPtr(generator->stubInfo()), valueGPR,
</span><span class="cx">                             prototypeGPR).call();
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -14171,13 +14092,12 @@
</span><span class="cx">             preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><del>-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(semanticNodeOrigin);
</del><ins>+                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions =
</span><span class="lines">@@ -14189,7 +14109,7 @@
</span><span class="cx">                 exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
</span><span class="cx"> 
</span><span class="cx">                 auto generator = Box<JITGetByIdGenerator>::create(
</span><del>-                    jit.codeBlock(), semanticNodeOrigin, callSiteIndex,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                     params.unavailableRegisters(), identifier, JSValueRegs(params[1].gpr()),
</span><span class="cx">                     JSValueRegs(params[0].gpr()), type);
</span><span class="cx"> 
</span><span class="lines">@@ -14205,9 +14125,9 @@
</span><span class="cx">                         generator->slowPathJump().link(&jit);
</span><span class="cx">                         CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                         CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), optimizationFunction, params[0].gpr(),
</span><del>-                            jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
</span><span class="cx">                             CCallHelpers::TrustedImmPtr(identifier.rawBits())).call();
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -14241,13 +14161,12 @@
</span><span class="cx">             preparePatchpointForExceptions(patchpoint);
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="cx"> 
</span><span class="cx">                 CallSiteIndex callSiteIndex =
</span><del>-                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(semanticNodeOrigin);
</del><ins>+                    state->jitCode->common.codeOrigins->addUniqueCallSiteIndex(node->origin.semantic);
</ins><span class="cx"> 
</span><span class="cx">                 // This is the direct exit target for operation calls.
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions =
</span><span class="lines">@@ -14259,7 +14178,7 @@
</span><span class="cx">                 exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
</span><span class="cx"> 
</span><span class="cx">                 auto generator = Box<JITGetByIdWithThisGenerator>::create(
</span><del>-                    jit.codeBlock(), semanticNodeOrigin, callSiteIndex,
</del><ins>+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
</ins><span class="cx">                     params.unavailableRegisters(), identifier, JSValueRegs(params[0].gpr()),
</span><span class="cx">                     JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()));
</span><span class="cx"> 
</span><span class="lines">@@ -14275,9 +14194,9 @@
</span><span class="cx">                         generator->slowPathJump().link(&jit);
</span><span class="cx">                         CCallHelpers::Label slowPathBegin = jit.label();
</span><span class="cx">                         CCallHelpers::Call slowPathCall = callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), optimizationFunction, params[0].gpr(),
</span><del>-                            jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
</span><span class="cx">                             params[2].gpr(), CCallHelpers::TrustedImmPtr(identifier.rawBits())).call();
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="lines">@@ -14672,7 +14591,6 @@
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         Node* node = m_node;
</span><span class="cx">         NodeType op = m_node->op();
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         JSValue child1Constant = m_state.forNode(m_node->child1()).value();
</span><span class="cx"> 
</span><span class="cx">         auto nodeIndex = m_nodeIndexInGraph;
</span><span class="lines">@@ -14694,7 +14612,7 @@
</span><span class="cx"> 
</span><span class="cx">                 RefPtr<OSRExitHandle> handle = exitDescriptor->emitOSRExitLater(*state, BadType, origin, params, nodeIndex, osrExitArgumentOffset);
</span><span class="cx"> 
</span><del>-                SnippetParams domJITParams(*state, params, semanticNodeOrigin, nullptr, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
</del><ins>+                SnippetParams domJITParams(*state, params, node, nullptr, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
</ins><span class="cx">                 CCallHelpers::JumpList failureCases = domJIT->generator()->run(jit, domJITParams);
</span><span class="cx">                 CCallHelpers::JumpList notJSCastFailureCases;
</span><span class="cx">                 if (op == CheckNotJSCast) {
</span><span class="lines">@@ -14814,7 +14732,6 @@
</span><span class="cx"> 
</span><span class="cx">         State* state = &m_ftlState;
</span><span class="cx">         Node* node = m_node;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -14836,7 +14753,7 @@
</span><span class="cx"> 
</span><span class="cx">                 Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
</span><span class="cx"> 
</span><del>-                SnippetParams domJITParams(*state, params, semanticNodeOrigin, exceptions, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
</del><ins>+                SnippetParams domJITParams(*state, params, node, exceptions, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
</ins><span class="cx">                 domJIT->generator()->run(jit, domJITParams);
</span><span class="cx">             });
</span><span class="cx">         patchpoint->effects = Effects::forCall();
</span><span class="lines">@@ -15593,7 +15510,6 @@
</span><span class="cx">         patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><span class="cx">         patchpoint->resultConstraints = { ValueRep::SomeEarlyRegister };
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -15619,16 +15535,16 @@
</span><span class="cx">                             
</span><span class="cx">                             generator->slowPathJumpList().link(&jit);
</span><span class="cx">                             callOperation(
</span><del>-                                *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                                 exceptions.get(), slowPathFunction, params[0].gpr(),
</span><del>-                                jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                                jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                                 params[1].gpr(), params[2].gpr());
</span><span class="cx">                             jit.jump().linkTo(done, &jit);
</span><span class="cx">                         });
</span><span class="cx">                 } else {
</span><span class="cx">                     callOperation(
</span><del>-                        *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
-                        exceptions.get(), slowPathFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(semanticNodeOrigin), params[1].gpr(),
</del><ins>+                        *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                        exceptions.get(), slowPathFunction, params[0].gpr(), jit.codeBlock()->globalObjectFor(node->origin.semantic), params[1].gpr(),
</ins><span class="cx">                         params[2].gpr());
</span><span class="cx">                 }
</span><span class="cx">             });
</span><span class="lines">@@ -15661,7 +15577,6 @@
</span><span class="cx">         patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><span class="cx">         patchpoint->resultConstraints = { ValueRep::SomeEarlyRegister };
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -15683,9 +15598,9 @@
</span><span class="cx">                             
</span><span class="cx">                         generator->slowPathJumpList().link(&jit);
</span><span class="cx">                         callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), slowPathFunction, params[0].gpr(),
</span><del>-                            jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             params[1].gpr(), params[2].gpr());
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="cx">                     });
</span><span class="lines">@@ -15719,7 +15634,6 @@
</span><span class="cx">         patchpoint->clobber(RegisterSet::macroScratchRegisters());
</span><span class="cx">         patchpoint->resultConstraints = { ValueRep::SomeEarlyRegister };
</span><span class="cx">         State* state = &m_ftlState;
</span><del>-        CodeOrigin semanticNodeOrigin = node->origin.semantic;
</del><span class="cx">         patchpoint->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -15747,9 +15661,9 @@
</span><span class="cx">                             ? operationValueBitRShift : operationValueBitURShift;
</span><span class="cx">                         
</span><span class="cx">                         callOperation(
</span><del>-                            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">                             exceptions.get(), slowPathFunction, params[0].gpr(),
</span><del>-                            jit.codeBlock()->globalObjectFor(semanticNodeOrigin),
</del><ins>+                            jit.codeBlock()->globalObjectFor(node->origin.semantic),
</ins><span class="cx">                             params[1].gpr(), params[2].gpr());
</span><span class="cx">                         jit.jump().linkTo(done, &jit);
</span><span class="cx">                     });
</span><span class="lines">@@ -20092,7 +20006,6 @@
</span><span class="cx">         BlockIndex blockIndex = block->index;
</span><span class="cx">         unsigned nodeIndex = node ? node->index() : UINT_MAX;
</span><span class="cx"> #if !ASSERT_ENABLED
</span><del>-        auto nodeOp = node ? node->op() : LastNodeType;
</del><span class="cx">         m_out.patchpoint(Void)->setGenerator(
</span><span class="cx">             [=] (CCallHelpers& jit, const StackmapGenerationParams&) {
</span><span class="cx">                 AllowMacroScratchRegisterUsage allowScratch(jit);
</span><span class="lines">@@ -20100,7 +20013,7 @@
</span><span class="cx">                 jit.move(CCallHelpers::TrustedImm32(blockIndex), GPRInfo::regT0);
</span><span class="cx">                 jit.move(CCallHelpers::TrustedImm32(nodeIndex), GPRInfo::regT1);
</span><span class="cx">                 if (node)
</span><del>-                    jit.move(CCallHelpers::TrustedImm32(nodeOp), GPRInfo::regT2);
</del><ins>+                    jit.move(CCallHelpers::TrustedImm32(node->op()), GPRInfo::regT2);
</ins><span class="cx">                 jit.abortWithReason(FTLCrash);
</span><span class="cx">             });
</span><span class="cx"> #else // ASSERT_ENABLED
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLSnippetParamscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.cpp     2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.cpp        2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> namespace JSC { namespace FTL {
</span><span class="cx"> 
</span><span class="cx"> template<typename OperationType, typename ResultType, typename Arguments, size_t... ArgumentsIndex>
</span><del>-static void dispatch(CCallHelpers& jit, FTL::State* state, const B3::StackmapGenerationParams& params, CodeOrigin semanticNodeOrigin, Box<CCallHelpers::JumpList> exceptions, CCallHelpers::JumpList from, OperationType operation, ResultType result, Arguments arguments, std::index_sequence<ArgumentsIndex...>)
</del><ins>+static void dispatch(CCallHelpers& jit, FTL::State* state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, CCallHelpers::JumpList from, OperationType operation, ResultType result, Arguments arguments, std::index_sequence<ArgumentsIndex...>)
</ins><span class="cx"> {
</span><span class="cx">     CCallHelpers::Label done = jit.label();
</span><span class="cx">     params.addLatePath([=] (CCallHelpers& jit) {
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> 
</span><span class="cx">         from.link(&jit);
</span><span class="cx">         callOperation(
</span><del>-            *state, params.unavailableRegisters(), jit, semanticNodeOrigin,
</del><ins>+            *state, params.unavailableRegisters(), jit, node->origin.semantic,
</ins><span class="cx">             exceptions.get(), operation, extractResult(result), std::get<ArgumentsIndex>(arguments)...);
</span><span class="cx">         jit.jump().linkTo(done, &jit);
</span><span class="cx">     });
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx"> #define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) \
</span><span class="cx">     void SnippetParams::addSlowPathCallImpl(CCallHelpers::JumpList from, CCallHelpers& jit, OperationType operation, ResultType result, std::tuple<__VA_ARGS__> args) \
</span><span class="cx">     { \
</span><del>-        dispatch(jit, &m_state, m_params, m_semanticNodeOrigin, m_exceptions, from, operation, result, args, std::make_index_sequence<std::tuple_size<decltype(args)>::value>()); \
</del><ins>+        dispatch(jit, &m_state, m_params, m_node, m_exceptions, from, operation, result, args, std::make_index_sequence<std::tuple_size<decltype(args)>::value>()); \
</ins><span class="cx">     } \
</span><span class="cx"> 
</span><span class="cx"> SNIPPET_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLSnippetParamsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.h (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.h       2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ftl/FTLSnippetParams.h  2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -38,11 +38,11 @@
</span><span class="cx"> 
</span><span class="cx"> class SnippetParams final : public JSC::SnippetParams {
</span><span class="cx"> public:
</span><del>-    SnippetParams(State& state, const B3::StackmapGenerationParams& params, CodeOrigin semanticNodeOrigin, Box<CCallHelpers::JumpList> exceptions, Vector<Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
</del><ins>+    SnippetParams(State& state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, Vector<Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
</ins><span class="cx">         : JSC::SnippetParams(state.vm(), WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
</span><span class="cx">         , m_state(state)
</span><span class="cx">         , m_params(params)
</span><del>-        , m_semanticNodeOrigin(semanticNodeOrigin)
</del><ins>+        , m_node(node)
</ins><span class="cx">         , m_exceptions(exceptions)
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx"> 
</span><span class="cx">     State& m_state;
</span><span class="cx">     const B3::StackmapGenerationParams& m_params;
</span><del>-    CodeOrigin m_semanticNodeOrigin;
</del><ins>+    DFG::Node* m_node;
</ins><span class="cx">     Box<CCallHelpers::JumpList> m_exceptions;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLStatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLState.cpp (278586 => 278587)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLState.cpp     2021-06-08 01:28:30 UTC (rev 278586)
+++ trunk/Source/JavaScriptCore/ftl/FTLState.cpp        2021-06-08 01:29:31 UTC (rev 278587)
</span><span class="lines">@@ -63,9 +63,6 @@
</span><span class="cx"> 
</span><span class="cx">     proc = makeUnique<Procedure>();
</span><span class="cx"> 
</span><del>-    if (graph.m_vm.shouldBuilderPCToCodeOriginMapping())
-        proc->setNeedsPCToOriginMap();
-
</del><span class="cx">     proc->setOriginPrinter(
</span><span class="cx">         [] (PrintStream& out, B3::Origin origin) {
</span><span class="cx">             out.print(bitwise_cast<Node*>(origin.data()));
</span></span></pre>
</div>
</div>

</body>
</html>