Attachment 218117 Details for Bug 124883 – the patch

[patch] the patch

blah.patch (text/plain), 66.16 KB, created by Filip Pizlo on 2013-12-01 11:23:53 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2013-12-01 11:23:53 PST

Size: 66.16 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 159900)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,68 @@
>+2013-12-01  Filip Pizlo  <fpizlo@apple.com>
>+
>+        Stores to local captured variables should be intercepted
>+        https://bugs.webkit.org/show_bug.cgi?id=124883
>+
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        Previously, in bytecode, you could assign to a captured variable just as you would
>+        assign to any other kind of variable. This complicates closure variable constant
>+        inference because we don't have any place where we can intercept stores to captured
>+        variables in the LLInt.
>+        
>+        This patch institutes a policy that only certain instructions can store to captured
>+        variables. If you interpret those instructions and you are required to notifyWrite()
>+        then you need to check if the relevant variable is captured. Those instructions are
>+        tracked in CodeBlock.cpp's VerifyCapturedDef.
>+
>+        * GNUmakefile.list.am:
>+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * bytecode/BytecodeLivenessAnalysis.cpp:
>+        (JSC::stepOverInstruction):
>+        * bytecode/BytecodeUseDef.h: Added.
>+        (JSC::computeUsesForBytecodeOffset):
>+        (JSC::computeDefsForBytecodeOffset):
>+        * bytecode/CodeBlock.cpp:
>+        (JSC::CodeBlock::dumpBytecode):
>+        (JSC::CodeBlock::isCaptured):
>+        (JSC::CodeBlock::validate):
>+        * bytecode/CodeBlock.h:
>+        * bytecode/Opcode.h:
>+        (JSC::padOpcodeName):
>+        * bytecompiler/BytecodeGenerator.cpp:
>+        (JSC::BytecodeGenerator::BytecodeGenerator):
>+        (JSC::BytecodeGenerator::resolveCallee):
>+        (JSC::BytecodeGenerator::emitMove):
>+        (JSC::BytecodeGenerator::isCaptured):
>+        (JSC::BytecodeGenerator::local):
>+        (JSC::BytecodeGenerator::constLocal):
>+        (JSC::BytecodeGenerator::emitNewFunction):
>+        (JSC::BytecodeGenerator::emitLazyNewFunction):
>+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
>+        * bytecompiler/BytecodeGenerator.h:
>+        (JSC::Local::Local):
>+        (JSC::Local::isCaptured):
>+        (JSC::Local::captureMode):
>+        (JSC::BytecodeGenerator::captureMode):
>+        (JSC::BytecodeGenerator::emitNode):
>+        * bytecompiler/NodesCodegen.cpp:
>+        (JSC::PostfixNode::emitResolve):
>+        (JSC::PrefixNode::emitResolve):
>+        (JSC::ReadModifyResolveNode::emitBytecode):
>+        (JSC::AssignResolveNode::emitBytecode):
>+        (JSC::ConstDeclNode::emitCodeSingle):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGCapabilities.cpp:
>+        (JSC::DFG::capabilityLevel):
>+        * jit/JIT.cpp:
>+        (JSC::JIT::privateCompileMainPass):
>+        * llint/LowLevelInterpreter32_64.asm:
>+        * llint/LowLevelInterpreter64.asm:
>+        * runtime/SymbolTable.h:
>+        (JSC::SymbolTable::isCaptured):
>+
> 2013-11-29  Filip Pizlo  <fpizlo@apple.com>
> 
>         Finally remove those DFG_ENABLE things
>Index: Source/JavaScriptCore/GNUmakefile.list.am
>===================================================================
>--- Source/JavaScriptCore/GNUmakefile.list.am	(revision 159886)
>+++ Source/JavaScriptCore/GNUmakefile.list.am	(working copy)
>@@ -102,10 +102,11 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/bytecode/ByValInfo.h \
> 	Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp \
> 	Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h \
>+	Source/JavaScriptCore/bytecode/BytecodeConventions.h \
> 	Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp \
> 	Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.h \
> 	Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysisInlines.h \
>-	Source/JavaScriptCore/bytecode/BytecodeConventions.h \
>+	Source/JavaScriptCore/bytecode/BytecodeUseDef.h \
> 	Source/JavaScriptCore/bytecode/CallLinkInfo.cpp \
> 	Source/JavaScriptCore/bytecode/CallLinkInfo.h \
> 	Source/JavaScriptCore/bytecode/CallLinkStatus.cpp \
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(revision 159886)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(working copy)
>@@ -751,6 +751,7 @@
>     <ClInclude Include="..\bytecode\BytecodeBasicBlock.h" />
>     <ClInclude Include="..\bytecode\BytecodeLivenessAnalysis.h" />
>     <ClInclude Include="..\bytecode\BytecodeLivenessAnalysisInline.h" />
>+    <ClInclude Include="..\bytecode\BytecodeUseDef.h" />
>     <ClInclude Include="..\bytecode\CallLinkInfo.h" />
>     <ClInclude Include="..\bytecode\CallLinkStatus.h" />
>     <ClInclude Include="..\bytecode\CallReturnOffsetToBytecodeOffset.h" />
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 159886)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -289,6 +289,7 @@
> 		0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */; };
> 		0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */; };
> 		0F8F2B96172E04A3007DBDA5 /* FTLLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F2B94172E049E007DBDA5 /* FTLLink.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */; };
>@@ -1583,6 +1584,7 @@
> 		0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
> 		0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
> 		0F85A31E16AB76AE0077571E /* DFGVariadicFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariadicFunction.h; path = dfg/DFGVariadicFunction.h; sourceTree = "<group>"; };
>+		0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeUseDef.h; sourceTree = "<group>"; };
> 		0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLink.cpp; path = ftl/FTLLink.cpp; sourceTree = "<group>"; };
> 		0F8F2B94172E049E007DBDA5 /* FTLLink.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLLink.h; path = ftl/FTLLink.h; sourceTree = "<group>"; };
> 		0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredIdentifiers.cpp; path = dfg/DFGDesiredIdentifiers.cpp; sourceTree = "<group>"; };
>@@ -4058,6 +4060,7 @@
> 				C2FCAE0E17A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp */,
> 				C2FCAE0F17A9C24E0034C735 /* BytecodeLivenessAnalysis.h */,
> 				0F666EBE183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h */,
>+				0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */,
> 				0F8023E91613832300A0BA45 /* ByValInfo.h */,
> 				0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */,
> 				0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */,
>@@ -4269,6 +4272,7 @@
> 				BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
> 				BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
> 				0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */,
>+				0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,
> 				0FC712DF17CD877C008CC93C /* DeferredCompilationCallback.h in Headers */,
> 				A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
> 				A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
>Index: Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp	(revision 159886)
>+++ Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp	(working copy)
>@@ -27,6 +27,7 @@
> #include "BytecodeLivenessAnalysis.h"
> 
> #include "BytecodeLivenessAnalysisInlines.h"
>+#include "BytecodeUseDef.h"
> #include "CodeBlock.h"
> #include "FullBytecodeLiveness.h"
> #include "PreciseJumpTargets.h"
>@@ -67,424 +68,26 @@ static void setForOperand(CodeBlock* cod
>         bits.set(virtualReg.toLocal() - codeBlock->captureCount());
> }
> 
>-static void computeUsesForBytecodeOffset(CodeBlock* codeBlock, unsigned bytecodeOffset, FastBitVector& uses)
>-{
>-    Interpreter* interpreter = codeBlock->vm()->interpreter;
>-    Instruction* instructionsBegin = codeBlock->instructions().begin();
>-    Instruction* instruction = &instructionsBegin[bytecodeOffset];
>-    OpcodeID opcodeID = interpreter->getOpcodeID(instruction->u.opcode);
>-    switch (opcodeID) {
>-    // No uses.
>-    case op_new_regexp:
>-    case op_new_array_buffer:
>-    case op_throw_static_error:
>-    case op_debug:
>-    case op_resolve_scope:
>-    case op_pop_scope:
>-    case op_jneq_ptr:
>-    case op_new_func_exp:
>-    case op_loop_hint:
>-    case op_jmp:
>-    case op_new_object:
>-    case op_init_lazy_reg:
>-    case op_get_callee:
>-    case op_enter:
>-    case op_catch:
>-        return;
>-    // First argument.
>-    case op_new_func:
>-    case op_create_activation: 
>-    case op_create_arguments:
>-    case op_to_this:
>-    case op_tear_off_activation:
>-    case op_profile_will_call:
>-    case op_profile_did_call:
>-    case op_throw:
>-    case op_push_with_scope:
>-    case op_end:
>-    case op_ret:
>-    case op_jtrue:
>-    case op_jfalse:
>-    case op_jeq_null:
>-    case op_jneq_null:
>-    case op_dec:
>-    case op_inc: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        return;
>-    }
>-    // First and second arguments.
>-    case op_del_by_id:
>-    case op_ret_object_or_this:
>-    case op_jlesseq:
>-    case op_jgreater:
>-    case op_jgreatereq:
>-    case op_jnless:
>-    case op_jnlesseq:
>-    case op_jngreater:
>-    case op_jngreatereq:
>-    case op_jless: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        return;
>-    }
>-    // First, second, and third arguments.
>-    case op_del_by_val:
>-    case op_put_by_val_direct:
>-    case op_put_by_val: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        return;
>-    }
>-    // First and third arguments.
>-    case op_put_by_index:
>-    case op_put_by_id_replace:
>-    case op_put_by_id_transition:
>-    case op_put_by_id_transition_direct:
>-    case op_put_by_id_transition_direct_out_of_line:
>-    case op_put_by_id_transition_normal:
>-    case op_put_by_id_transition_normal_out_of_line:
>-    case op_put_by_id_generic:
>-    case op_put_by_id_out_of_line:
>-    case op_put_by_id:
>-    case op_put_to_scope: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        return;
>-    }
>-    // First, third, and fourth arguments.
>-    case op_put_getter_setter: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[4].u.operand))
>-            setForOperand(codeBlock, uses, instruction[4].u.operand);
>-        return;
>-    }
>-    // Second argument.
>-    case op_init_global_const_nop:
>-    case op_init_global_const:
>-    case op_push_name_scope:
>-    case op_get_from_scope:
>-    case op_to_primitive:
>-    case op_get_by_id:
>-    case op_get_by_id_out_of_line:
>-    case op_get_by_id_self:
>-    case op_get_by_id_proto:
>-    case op_get_by_id_chain:
>-    case op_get_by_id_getter_self:
>-    case op_get_by_id_getter_proto:
>-    case op_get_by_id_getter_chain:
>-    case op_get_by_id_custom_self:
>-    case op_get_by_id_custom_proto:
>-    case op_get_by_id_custom_chain:
>-    case op_get_by_id_generic:
>-    case op_get_array_length:
>-    case op_get_string_length:
>-    case op_get_arguments_length:
>-    case op_typeof:
>-    case op_is_undefined:
>-    case op_is_boolean:
>-    case op_is_number:
>-    case op_is_string:
>-    case op_is_object:
>-    case op_is_function:
>-    case op_to_number:
>-    case op_negate:
>-    case op_neq_null:
>-    case op_eq_null:
>-    case op_not:
>-    case op_mov:
>-    case op_new_array_with_size:
>-    case op_create_this: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        return;
>-    }
>-    // Second and third arguments.
>-    case op_get_by_val:
>-    case op_get_argument_by_val:
>-    case op_in:
>-    case op_instanceof:
>-    case op_check_has_instance:
>-    case op_add:
>-    case op_mul:
>-    case op_div:
>-    case op_mod:
>-    case op_sub:
>-    case op_lshift:
>-    case op_rshift:
>-    case op_urshift:
>-    case op_bitand:
>-    case op_bitxor:
>-    case op_bitor:
>-    case op_less:
>-    case op_lesseq:
>-    case op_greater:
>-    case op_greatereq:
>-    case op_nstricteq:
>-    case op_stricteq:
>-    case op_neq:
>-    case op_eq: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        return;
>-    }
>-    // Second, third, and fourth arguments.
>-    case op_call_varargs:
>-    case op_get_pnames: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[4].u.operand))
>-            setForOperand(codeBlock, uses, instruction[4].u.operand);
>-        return;
>-    }
>-    // Second, third, fourth, and fifth arguments.
>-    case op_next_pname: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[4].u.operand))
>-            setForOperand(codeBlock, uses, instruction[4].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[5].u.operand))
>-            setForOperand(codeBlock, uses, instruction[5].u.operand);
>-        return;
>-    }
>-    // Second, third, fourth, fifth, and sixth arguments. 
>-    case op_get_by_pname: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[4].u.operand))
>-            setForOperand(codeBlock, uses, instruction[4].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[5].u.operand))
>-            setForOperand(codeBlock, uses, instruction[5].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, instruction[6].u.operand))
>-            setForOperand(codeBlock, uses, instruction[6].u.operand);
>-        return;
>-    }
>-    // Third argument.
>-    case op_switch_string:
>-    case op_switch_char:
>-    case op_switch_imm: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[3].u.operand))
>-            setForOperand(codeBlock, uses, instruction[3].u.operand);
>-        return;
>-    }
>-    // Variable number of arguments.
>-    case op_new_array:
>-    case op_strcat: {
>-        int base = instruction[2].u.operand;
>-        int count = instruction[3].u.operand;
>-        for (int i = 0; i < count; i++) {
>-            if (isValidRegisterForLiveness(codeBlock, base - i))
>-                setForOperand(codeBlock, uses, base - i);
>-        }
>-        return;
>-    }
>-    // Crazy stuff for calls.
>-    case op_construct:
>-    case op_call_eval:
>-    case op_call: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        int argCount = instruction[3].u.operand;
>-        int registerOffset = -instruction[4].u.operand;
>-        int lastArg = registerOffset + CallFrame::thisArgumentOffset();
>-        for (int i = opcodeID == op_construct ? 1 : 0; i < argCount; i++) {
>-            if (isValidRegisterForLiveness(codeBlock, lastArg + i))
>-                setForOperand(codeBlock, uses, lastArg + i);
>-        }
>-        return;
>-    }
>-    // Special stuff for tear off arguments.
>-    case op_tear_off_arguments: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, uses, instruction[1].u.operand);
>-        if (isValidRegisterForLiveness(codeBlock, unmodifiedArgumentsRegister(VirtualRegister(instruction[1].u.operand)).offset()))
>-            setForOperand(codeBlock, uses, unmodifiedArgumentsRegister(VirtualRegister(instruction[1].u.operand)).offset());
>-        if (isValidRegisterForLiveness(codeBlock, instruction[2].u.operand))
>-            setForOperand(codeBlock, uses, instruction[2].u.operand);
>-        return;
>-    }
>-    default:
>-        RELEASE_ASSERT_NOT_REACHED();
>-        break;
>-    }
>-}
>+namespace {
> 
>-static void computeDefsForBytecodeOffset(CodeBlock* codeBlock, unsigned bytecodeOffset, FastBitVector& defs)
>-{
>-    Interpreter* interpreter = codeBlock->vm()->interpreter;
>-    Instruction* instructionsBegin = codeBlock->instructions().begin();
>-    Instruction* instruction = &instructionsBegin[bytecodeOffset];
>-    OpcodeID opcodeID = interpreter->getOpcodeID(instruction->u.opcode);
>-    switch (opcodeID) {
>-    // These don't define anything.
>-    case op_init_global_const:
>-    case op_init_global_const_nop:
>-    case op_push_name_scope:
>-    case op_push_with_scope:
>-    case op_put_to_scope:
>-    case op_pop_scope:
>-    case op_end:
>-    case op_profile_will_call:
>-    case op_profile_did_call:
>-    case op_throw:
>-    case op_throw_static_error:
>-    case op_debug:
>-    case op_ret:
>-    case op_ret_object_or_this:
>-    case op_jmp:
>-    case op_jtrue:
>-    case op_jfalse:
>-    case op_jeq_null:
>-    case op_jneq_null:
>-    case op_jneq_ptr:
>-    case op_jless:
>-    case op_jlesseq:
>-    case op_jgreater:
>-    case op_jgreatereq:
>-    case op_jnless:
>-    case op_jnlesseq:
>-    case op_jngreater:
>-    case op_jngreatereq:
>-    case op_loop_hint:
>-    case op_switch_imm:
>-    case op_switch_char:
>-    case op_switch_string:
>-    case op_put_by_id:
>-    case op_put_by_id_out_of_line:
>-    case op_put_by_id_replace:
>-    case op_put_by_id_transition:
>-    case op_put_by_id_transition_direct:
>-    case op_put_by_id_transition_direct_out_of_line:
>-    case op_put_by_id_transition_normal:
>-    case op_put_by_id_transition_normal_out_of_line:
>-    case op_put_by_id_generic:
>-    case op_put_getter_setter:
>-    case op_put_by_val:
>-    case op_put_by_val_direct:
>-    case op_put_by_index:
>-    case op_del_by_id:
>-    case op_del_by_val:
>-#define LLINT_HELPER_OPCODES(opcode, length) case opcode:
>-        FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
>-#undef LLINT_HELPER_OPCODES
>-        return;
>-    // These all have a single destination for the first argument.
>-    case op_next_pname:
>-    case op_get_pnames:
>-    case op_resolve_scope:
>-    case op_strcat:
>-    case op_tear_off_activation:
>-    case op_to_primitive:
>-    case op_catch:
>-    case op_create_this:
>-    case op_new_array:
>-    case op_new_array_buffer:
>-    case op_new_array_with_size:
>-    case op_new_regexp:
>-    case op_new_func:
>-    case op_new_func_exp:
>-    case op_call_varargs:
>-    case op_get_from_scope:
>-    case op_call:
>-    case op_call_eval:
>-    case op_construct:
>-    case op_get_by_id:
>-    case op_get_by_id_out_of_line:
>-    case op_get_by_id_self:
>-    case op_get_by_id_proto:
>-    case op_get_by_id_chain:
>-    case op_get_by_id_getter_self:
>-    case op_get_by_id_getter_proto:
>-    case op_get_by_id_getter_chain:
>-    case op_get_by_id_custom_self:
>-    case op_get_by_id_custom_proto:
>-    case op_get_by_id_custom_chain:
>-    case op_get_by_id_generic:
>-    case op_get_array_length:
>-    case op_get_string_length:
>-    case op_check_has_instance:
>-    case op_instanceof:
>-    case op_get_by_val:
>-    case op_get_argument_by_val:
>-    case op_get_by_pname:
>-    case op_get_arguments_length:
>-    case op_typeof:
>-    case op_is_undefined:
>-    case op_is_boolean:
>-    case op_is_number:
>-    case op_is_string:
>-    case op_is_object:
>-    case op_is_function:
>-    case op_in:
>-    case op_to_number:
>-    case op_negate:
>-    case op_add:
>-    case op_mul:
>-    case op_div:
>-    case op_mod:
>-    case op_sub:
>-    case op_lshift:
>-    case op_rshift:
>-    case op_urshift:
>-    case op_bitand:
>-    case op_bitxor:
>-    case op_bitor:
>-    case op_inc:
>-    case op_dec:
>-    case op_eq:
>-    case op_neq:
>-    case op_stricteq:
>-    case op_nstricteq:
>-    case op_less:
>-    case op_lesseq:
>-    case op_greater:
>-    case op_greatereq:
>-    case op_neq_null:
>-    case op_eq_null:
>-    case op_not:
>-    case op_mov:
>-    case op_new_object:
>-    case op_to_this:
>-    case op_get_callee:
>-    case op_init_lazy_reg:
>-    case op_create_activation:
>-    case op_create_arguments: {
>-        if (isValidRegisterForLiveness(codeBlock, instruction[1].u.operand))
>-            setForOperand(codeBlock, defs, instruction[1].u.operand);
>-        return;
>+class SetBit {
>+public:
>+    SetBit(FastBitVector& bits)
>+        : m_bits(bits)
>+    {
>     }
>-    case op_tear_off_arguments: {
>-        int operand = unmodifiedArgumentsRegister(
>-            VirtualRegister(instruction[1].u.operand)).offset();
>+    
>+    void operator()(CodeBlock* codeBlock, Instruction*, OpcodeID, int operand)
>+    {
>         if (isValidRegisterForLiveness(codeBlock, operand))
>-            setForOperand(codeBlock, defs, operand);
>-        return;
>+            setForOperand(codeBlock, m_bits, operand);
>     }
>-    case op_enter: {
>-        defs.setAll();
>-        return;
>-    } }
>-    RELEASE_ASSERT_NOT_REACHED();
>-}
>+    
>+private:
>+    FastBitVector& m_bits;
>+};
>+
>+} // anonymous namespace
> 
> static unsigned getLeaderOffsetForBasicBlock(RefPtr<BytecodeBasicBlock>* basicBlock)
> {
>@@ -535,8 +138,10 @@ static void stepOverInstruction(CodeBloc
>     uses.clearAll();
>     defs.clearAll();
>     
>-    computeUsesForBytecodeOffset(codeBlock, bytecodeOffset, uses);
>-    computeDefsForBytecodeOffset(codeBlock, bytecodeOffset, defs);
>+    SetBit setUses(uses);
>+    SetBit setDefs(defs);
>+    computeUsesForBytecodeOffset(codeBlock, bytecodeOffset, setUses);
>+    computeDefsForBytecodeOffset(codeBlock, bytecodeOffset, setDefs);
>     
>     out.exclude(defs);
>     out.merge(uses);
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 0)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -0,0 +1,411 @@
>+/*
>+ * Copyright (C) 2013 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+ * THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#ifndef BytecodeUseDef_h
>+#define BytecodeUseDef_h
>+
>+#include "CodeBlock.h"
>+
>+namespace JSC {
>+
>+template<typename Functor>
>+void computeUsesForBytecodeOffset(
>+    CodeBlock* codeBlock, unsigned bytecodeOffset, Functor& functor)
>+{
>+    Interpreter* interpreter = codeBlock->vm()->interpreter;
>+    Instruction* instructionsBegin = codeBlock->instructions().begin();
>+    Instruction* instruction = &instructionsBegin[bytecodeOffset];
>+    OpcodeID opcodeID = interpreter->getOpcodeID(instruction->u.opcode);
>+    switch (opcodeID) {
>+    // No uses.
>+    case op_new_regexp:
>+    case op_new_array_buffer:
>+    case op_throw_static_error:
>+    case op_debug:
>+    case op_resolve_scope:
>+    case op_pop_scope:
>+    case op_jneq_ptr:
>+    case op_new_func_exp:
>+    case op_loop_hint:
>+    case op_jmp:
>+    case op_new_object:
>+    case op_init_lazy_reg:
>+    case op_get_callee:
>+    case op_enter:
>+    case op_catch:
>+        return;
>+    case op_new_func:
>+    case op_new_captured_func:
>+    case op_create_activation: 
>+    case op_create_arguments:
>+    case op_to_this:
>+    case op_tear_off_activation:
>+    case op_profile_will_call:
>+    case op_profile_did_call:
>+    case op_throw:
>+    case op_push_with_scope:
>+    case op_end:
>+    case op_ret:
>+    case op_jtrue:
>+    case op_jfalse:
>+    case op_jeq_null:
>+    case op_jneq_null:
>+    case op_dec:
>+    case op_inc: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        return;
>+    }
>+    case op_ret_object_or_this:
>+    case op_jlesseq:
>+    case op_jgreater:
>+    case op_jgreatereq:
>+    case op_jnless:
>+    case op_jnlesseq:
>+    case op_jngreater:
>+    case op_jngreatereq:
>+    case op_jless: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        return;
>+    }
>+    case op_put_by_val_direct:
>+    case op_put_by_val: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        return;
>+    }
>+    case op_put_by_index:
>+    case op_put_by_id_replace:
>+    case op_put_by_id_transition:
>+    case op_put_by_id_transition_direct:
>+    case op_put_by_id_transition_direct_out_of_line:
>+    case op_put_by_id_transition_normal:
>+    case op_put_by_id_transition_normal_out_of_line:
>+    case op_put_by_id_generic:
>+    case op_put_by_id_out_of_line:
>+    case op_put_by_id:
>+    case op_put_to_scope: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        return;
>+    }
>+    case op_put_getter_setter: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
>+        return;
>+    }
>+    case op_init_global_const_nop:
>+    case op_init_global_const:
>+    case op_push_name_scope:
>+    case op_get_from_scope:
>+    case op_to_primitive:
>+    case op_get_by_id:
>+    case op_get_by_id_out_of_line:
>+    case op_get_by_id_self:
>+    case op_get_by_id_proto:
>+    case op_get_by_id_chain:
>+    case op_get_by_id_getter_self:
>+    case op_get_by_id_getter_proto:
>+    case op_get_by_id_getter_chain:
>+    case op_get_by_id_custom_self:
>+    case op_get_by_id_custom_proto:
>+    case op_get_by_id_custom_chain:
>+    case op_get_by_id_generic:
>+    case op_get_array_length:
>+    case op_get_string_length:
>+    case op_get_arguments_length:
>+    case op_typeof:
>+    case op_is_undefined:
>+    case op_is_boolean:
>+    case op_is_number:
>+    case op_is_string:
>+    case op_is_object:
>+    case op_is_function:
>+    case op_to_number:
>+    case op_negate:
>+    case op_neq_null:
>+    case op_eq_null:
>+    case op_not:
>+    case op_mov:
>+    case op_captured_mov:
>+    case op_new_array_with_size:
>+    case op_create_this:
>+    case op_get_pnames:
>+    case op_del_by_id: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        return;
>+    }
>+    case op_get_by_val:
>+    case op_get_argument_by_val:
>+    case op_in:
>+    case op_instanceof:
>+    case op_check_has_instance:
>+    case op_add:
>+    case op_mul:
>+    case op_div:
>+    case op_mod:
>+    case op_sub:
>+    case op_lshift:
>+    case op_rshift:
>+    case op_urshift:
>+    case op_bitand:
>+    case op_bitxor:
>+    case op_bitor:
>+    case op_less:
>+    case op_lesseq:
>+    case op_greater:
>+    case op_greatereq:
>+    case op_nstricteq:
>+    case op_stricteq:
>+    case op_neq:
>+    case op_eq:
>+    case op_del_by_val: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        return;
>+    }
>+    case op_call_varargs: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
>+        return;
>+    }
>+    case op_next_pname: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
>+        return;
>+    }
>+    case op_get_by_pname: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[6].u.operand);
>+        return;
>+    }
>+    case op_switch_string:
>+    case op_switch_char:
>+    case op_switch_imm: {
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        return;
>+    }
>+    case op_new_array:
>+    case op_strcat: {
>+        int base = instruction[2].u.operand;
>+        int count = instruction[3].u.operand;
>+        for (int i = 0; i < count; i++)
>+            functor(codeBlock, instruction, opcodeID, base - i);
>+        return;
>+    }
>+    case op_construct:
>+    case op_call_eval:
>+    case op_call: {
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        int argCount = instruction[3].u.operand;
>+        int registerOffset = -instruction[4].u.operand;
>+        int lastArg = registerOffset + CallFrame::thisArgumentOffset();
>+        for (int i = opcodeID == op_construct ? 1 : 0; i < argCount; i++)
>+            functor(codeBlock, instruction, opcodeID, lastArg + i);
>+        return;
>+    }
>+    case op_tear_off_arguments: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, unmodifiedArgumentsRegister(VirtualRegister(instruction[1].u.operand)).offset());
>+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
>+        return;
>+    }
>+    default:
>+        RELEASE_ASSERT_NOT_REACHED();
>+        break;
>+    }
>+}
>+
>+template<typename Functor>
>+void computeDefsForBytecodeOffset(CodeBlock* codeBlock, unsigned bytecodeOffset, Functor& functor)
>+{
>+    Interpreter* interpreter = codeBlock->vm()->interpreter;
>+    Instruction* instructionsBegin = codeBlock->instructions().begin();
>+    Instruction* instruction = &instructionsBegin[bytecodeOffset];
>+    OpcodeID opcodeID = interpreter->getOpcodeID(instruction->u.opcode);
>+    switch (opcodeID) {
>+    // These don't define anything.
>+    case op_init_global_const:
>+    case op_init_global_const_nop:
>+    case op_push_name_scope:
>+    case op_push_with_scope:
>+    case op_put_to_scope:
>+    case op_pop_scope:
>+    case op_end:
>+    case op_profile_will_call:
>+    case op_profile_did_call:
>+    case op_throw:
>+    case op_throw_static_error:
>+    case op_debug:
>+    case op_ret:
>+    case op_ret_object_or_this:
>+    case op_jmp:
>+    case op_jtrue:
>+    case op_jfalse:
>+    case op_jeq_null:
>+    case op_jneq_null:
>+    case op_jneq_ptr:
>+    case op_jless:
>+    case op_jlesseq:
>+    case op_jgreater:
>+    case op_jgreatereq:
>+    case op_jnless:
>+    case op_jnlesseq:
>+    case op_jngreater:
>+    case op_jngreatereq:
>+    case op_loop_hint:
>+    case op_switch_imm:
>+    case op_switch_char:
>+    case op_switch_string:
>+    case op_put_by_id:
>+    case op_put_by_id_out_of_line:
>+    case op_put_by_id_replace:
>+    case op_put_by_id_transition:
>+    case op_put_by_id_transition_direct:
>+    case op_put_by_id_transition_direct_out_of_line:
>+    case op_put_by_id_transition_normal:
>+    case op_put_by_id_transition_normal_out_of_line:
>+    case op_put_by_id_generic:
>+    case op_put_getter_setter:
>+    case op_put_by_val:
>+    case op_put_by_val_direct:
>+    case op_put_by_index:
>+    case op_tear_off_arguments:
>+#define LLINT_HELPER_OPCODES(opcode, length) case opcode:
>+        FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
>+#undef LLINT_HELPER_OPCODES
>+        return;
>+    // These all have a single destination for the first argument.
>+    case op_next_pname:
>+    case op_resolve_scope:
>+    case op_strcat:
>+    case op_tear_off_activation:
>+    case op_to_primitive:
>+    case op_catch:
>+    case op_create_this:
>+    case op_new_array:
>+    case op_new_array_buffer:
>+    case op_new_array_with_size:
>+    case op_new_regexp:
>+    case op_new_func:
>+    case op_new_captured_func:
>+    case op_new_func_exp:
>+    case op_call_varargs:
>+    case op_get_from_scope:
>+    case op_call:
>+    case op_call_eval:
>+    case op_construct:
>+    case op_get_by_id:
>+    case op_get_by_id_out_of_line:
>+    case op_get_by_id_self:
>+    case op_get_by_id_proto:
>+    case op_get_by_id_chain:
>+    case op_get_by_id_getter_self:
>+    case op_get_by_id_getter_proto:
>+    case op_get_by_id_getter_chain:
>+    case op_get_by_id_custom_self:
>+    case op_get_by_id_custom_proto:
>+    case op_get_by_id_custom_chain:
>+    case op_get_by_id_generic:
>+    case op_get_array_length:
>+    case op_get_string_length:
>+    case op_check_has_instance:
>+    case op_instanceof:
>+    case op_get_by_val:
>+    case op_get_argument_by_val:
>+    case op_get_by_pname:
>+    case op_get_arguments_length:
>+    case op_typeof:
>+    case op_is_undefined:
>+    case op_is_boolean:
>+    case op_is_number:
>+    case op_is_string:
>+    case op_is_object:
>+    case op_is_function:
>+    case op_in:
>+    case op_to_number:
>+    case op_negate:
>+    case op_add:
>+    case op_mul:
>+    case op_div:
>+    case op_mod:
>+    case op_sub:
>+    case op_lshift:
>+    case op_rshift:
>+    case op_urshift:
>+    case op_bitand:
>+    case op_bitxor:
>+    case op_bitor:
>+    case op_inc:
>+    case op_dec:
>+    case op_eq:
>+    case op_neq:
>+    case op_stricteq:
>+    case op_nstricteq:
>+    case op_less:
>+    case op_lesseq:
>+    case op_greater:
>+    case op_greatereq:
>+    case op_neq_null:
>+    case op_eq_null:
>+    case op_not:
>+    case op_mov:
>+    case op_captured_mov:
>+    case op_new_object:
>+    case op_to_this:
>+    case op_get_callee:
>+    case op_init_lazy_reg:
>+    case op_create_activation:
>+    case op_create_arguments:
>+    case op_del_by_id:
>+    case op_del_by_val: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        return;
>+    }
>+    case op_get_pnames: {
>+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
>+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
>+        return;
>+    }
>+    case op_enter: {
>+        for (unsigned i = codeBlock->m_numVars; i--;)
>+            functor(codeBlock, instruction, opcodeID, virtualRegisterForLocal(i).offset());
>+        return;
>+    } }
>+}
>+
>+} // namespace JSC
>+
>+#endif // BytecodeUseDef_h
>+
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 159886)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -31,6 +31,7 @@
> #include "CodeBlock.h"
> 
> #include "BytecodeGenerator.h"
>+#include "BytecodeUseDef.h"
> #include "CallLinkStatus.h"
> #include "DFGCapabilities.h"
> #include "DFGCommon.h"
>@@ -759,6 +760,13 @@ void CodeBlock::dumpBytecode(PrintStream
>             out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
>             break;
>         }
>+        case op_captured_mov: {
>+            int r0 = (++it)->u.operand;
>+            int r1 = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "captured_mov");
>+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
>+            break;
>+        }
>         case op_not: {
>             printUnaryOp(out, exec, location, it, "not");
>             break;
>@@ -1210,6 +1218,14 @@ void CodeBlock::dumpBytecode(PrintStream
>             out.printf("%s, f%d, %s", registerName(r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
>             break;
>         }
>+        case op_new_captured_func: {
>+            int r0 = (++it)->u.operand;
>+            int f0 = (++it)->u.operand;
>+            int shouldCheck = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "new_captured_func");
>+            out.printf("%s, f%d, %s", registerName(r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
>+            break;
>+        }
>         case op_new_func_exp: {
>             int r0 = (++it)->u.operand;
>             int f0 = (++it)->u.operand;
>@@ -2469,8 +2485,7 @@ bool CodeBlock::isCaptured(VirtualRegist
>     if (!symbolTable())
>         return false;
> 
>-    return operand.offset() <= symbolTable()->captureStart()
>-        && operand.offset() > symbolTable()->captureEnd();
>+    return symbolTable()->isCaptured(operand.offset());
> }
> 
> int CodeBlock::framePointerOffsetToGetActivationRegisters(int machineCaptureStart)
>@@ -3427,6 +3442,49 @@ String CodeBlock::nameForRegister(Virtua
>     return "";
> }
> 
>+namespace {
>+
>+struct VerifyCapturedDef {
>+    void operator()(CodeBlock* codeBlock, Instruction* instruction, OpcodeID opcodeID, int operand)
>+    {
>+        unsigned bytecodeOffset = instruction - codeBlock->instructions().begin();
>+        
>+        if (codeBlock->isConstantRegisterIndex(operand)) {
>+            codeBlock->beginValidationDidFail();
>+            dataLog("    At bc#", bytecodeOffset, " encountered a definition of a constant.\n");
>+            codeBlock->endValidationDidFail();
>+            return;
>+        }
>+
>+        switch (opcodeID) {
>+        case op_enter:
>+        case op_captured_mov:
>+        case op_init_lazy_reg:
>+        case op_create_arguments:
>+        case op_new_captured_func:
>+            return;
>+        default:
>+            break;
>+        }
>+        
>+        VirtualRegister virtualReg(operand);
>+        if (!virtualReg.isLocal())
>+            return;
>+        
>+        if (codeBlock->captureCount()
>+            && operand <= codeBlock->captureStart() && operand > codeBlock->captureEnd()) {
>+            codeBlock->beginValidationDidFail();
>+            dataLog("    At bc#", bytecodeOffset, " encountered invalid assignment to captured variable loc", virtualReg.toLocal(), ".\n");
>+            codeBlock->endValidationDidFail();
>+            return;
>+        }
>+        
>+        return;
>+    }
>+};
>+
>+} // anonymous namespace
>+
> void CodeBlock::validate()
> {
>     BytecodeLivenessAnalysis liveness(this); // Compute directly from scratch so it doesn't effect CodeBlock footprint.
>@@ -3464,6 +3522,16 @@ void CodeBlock::validate()
>             }
>         }
>     }
>+    
>+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructions().size();) {
>+        Instruction* currentInstruction = instructions().begin() + bytecodeOffset;
>+        OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(currentInstruction->u.opcode);
>+        
>+        VerifyCapturedDef verifyCapturedDef;
>+        computeDefsForBytecodeOffset(this, bytecodeOffset, verifyCapturedDef);
>+        
>+        bytecodeOffset += opcodeLength(opcodeID);
>+    }
> }
> 
> void CodeBlock::beginValidationDidFail()
>Index: Source/JavaScriptCore/bytecode/CodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.h	(revision 159886)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.h	(working copy)
>@@ -930,7 +930,12 @@ public:
>     bool m_allTransitionsHaveBeenMarked; // Initialized and used on every GC.
>     
>     bool m_didFailFTLCompilation;
>-    
>+
>+    // Internal methods for use by validation code. It would be private if it wasn't
>+    // for the fact that we use it from anonymous namespaces.
>+    void beginValidationDidFail();
>+    NO_RETURN_DUE_TO_CRASH void endValidationDidFail();
>+
> protected:
>     virtual void visitWeakReferences(SlotVisitor&) OVERRIDE;
>     virtual void finalizeUnconditionally() OVERRIDE;
>@@ -1031,9 +1036,6 @@ private:
>             m_rareData = adoptPtr(new RareData);
>     }
>     
>-    void beginValidationDidFail();
>-    NO_RETURN_DUE_TO_CRASH void endValidationDidFail();
>-
> #if ENABLE(JIT)
>     void resetStubInternal(RepatchBuffer&, StructureStubInfo&);
>     void resetStubDuringGCInternal(RepatchBuffer&, StructureStubInfo&);
>Index: Source/JavaScriptCore/bytecode/Opcode.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/Opcode.h	(revision 159886)
>+++ Source/JavaScriptCore/bytecode/Opcode.h	(working copy)
>@@ -54,6 +54,7 @@ namespace JSC {
>     macro(op_new_array_buffer, 5) \
>     macro(op_new_regexp, 3) \
>     macro(op_mov, 3) \
>+    macro(op_captured_mov, 3) \
>     \
>     macro(op_not, 3) \
>     macro(op_eq, 4) \
>@@ -153,6 +154,7 @@ namespace JSC {
>     macro(op_switch_string, 4) \
>     \
>     macro(op_new_func, 4) \
>+    macro(op_new_captured_func, 4) \
>     macro(op_new_func_exp, 3) \
>     macro(op_call, 8) /* has value profiling */ \
>     macro(op_call_eval, 8) /* has value profiling */ \
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 159886)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -307,7 +307,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>                     instructions().append(m_activationRegister->index());
>                 }
>                 m_functions.add(ident.impl());
>-                emitNewFunction(addVar(ident, false), function);
>+                emitNewFunction(addVar(ident, false), IsCaptured, function);
>             }
>         }
>         for (size_t i = 0; i < varStack.size(); ++i) {
>@@ -335,7 +335,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>             // Don't lazily create functions that override the name 'arguments'
>             // as this would complicate lazy instantiation of actual arguments.
>             if (!canLazilyCreateFunctions || ident == propertyNames().arguments)
>-                emitNewFunction(reg.get(), function);
>+                emitNewFunction(reg.get(), NotCaptured, function);
>             else {
>                 emitInitLazyRegister(reg.get());
>                 m_lazyFunctions.set(reg->virtualRegister().toLocal(), function);
>@@ -472,7 +472,7 @@ RegisterID* BytecodeGenerator::resolveCa
>         return &m_calleeRegister;
> 
>     // Move the callee into the captured section of the stack.
>-    return emitMove(addVar(), &m_calleeRegister);
>+    return emitMove(addVar(), IsCaptured, &m_calleeRegister);
> }
> 
> void BytecodeGenerator::addCallee(FunctionBodyNode* functionBodyNode, RegisterID* calleeRegister)
>@@ -997,16 +997,21 @@ unsigned BytecodeGenerator::addRegExp(Re
>     return m_codeBlock->addRegExp(r);
> }
> 
>-RegisterID* BytecodeGenerator::emitMove(RegisterID* dst, RegisterID* src)
>+RegisterID* BytecodeGenerator::emitMove(RegisterID* dst, CaptureMode captureMode, RegisterID* src)
> {
>     m_staticPropertyAnalyzer.mov(dst->index(), src->index());
> 
>-    emitOpcode(op_mov);
>+    emitOpcode(captureMode == IsCaptured ? op_captured_mov : op_mov);
>     instructions().append(dst->index());
>     instructions().append(src->index());
>     return dst;
> }
> 
>+RegisterID* BytecodeGenerator::emitMove(RegisterID* dst, RegisterID* src)
>+{
>+    return emitMove(dst, captureMode(dst->index()), src);
>+}
>+
> RegisterID* BytecodeGenerator::emitUnaryOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src)
> {
>     emitOpcode(opcodeID);
>@@ -1157,11 +1162,16 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+bool BytecodeGenerator::isCaptured(int operand)
>+{
>+    return m_symbolTable && m_symbolTable->isCaptured(operand);
>+}
>+
> Local BytecodeGenerator::local(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier)
>-        return Local(thisRegister(), ReadOnly);
>-
>+        return Local(thisRegister(), ReadOnly, NotCaptured);
>+    
>     if (property == propertyNames().arguments)
>         createArgumentsIfNecessary();
> 
>@@ -1173,7 +1183,7 @@ Local BytecodeGenerator::local(const Ide
>         return Local();
> 
>     RegisterID* local = createLazyRegisterIfNecessary(&registerFor(entry.getIndex()));
>-    return Local(local, entry.getAttributes());
>+    return Local(local, entry.getAttributes(), captureMode(local->index()));
> }
> 
> Local BytecodeGenerator::constLocal(const Identifier& property)
>@@ -1186,7 +1196,7 @@ Local BytecodeGenerator::constLocal(cons
>         return Local();
> 
>     RegisterID* local = createLazyRegisterIfNecessary(&registerFor(entry.getIndex()));
>-    return Local(local, entry.getAttributes());
>+    return Local(local, entry.getAttributes(), captureMode(local->index()));
> }
> 
> void BytecodeGenerator::emitCheckHasInstance(RegisterID* dst, RegisterID* value, RegisterID* base, Label* target)
>@@ -1547,9 +1557,9 @@ RegisterID* BytecodeGenerator::emitNewAr
>     return dst;
> }
> 
>-RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
>+RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, CaptureMode captureMode, FunctionBodyNode* function)
> {
>-    return emitNewFunctionInternal(dst, m_codeBlock->addFunctionDecl(makeFunction(function)), false);
>+    return emitNewFunctionInternal(dst, captureMode, m_codeBlock->addFunctionDecl(makeFunction(function)), false);
> }
> 
> RegisterID* BytecodeGenerator::emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* function)
>@@ -1557,13 +1567,13 @@ RegisterID* BytecodeGenerator::emitLazyN
>     FunctionOffsetMap::AddResult ptr = m_functionOffsets.add(function, 0);
>     if (ptr.isNewEntry)
>         ptr.iterator->value = m_codeBlock->addFunctionDecl(makeFunction(function));
>-    return emitNewFunctionInternal(dst, ptr.iterator->value, true);
>+    return emitNewFunctionInternal(dst, NotCaptured, ptr.iterator->value, true);
> }
> 
>-RegisterID* BytecodeGenerator::emitNewFunctionInternal(RegisterID* dst, unsigned index, bool doNullCheck)
>+RegisterID* BytecodeGenerator::emitNewFunctionInternal(RegisterID* dst, CaptureMode captureMode, unsigned index, bool doNullCheck)
> {
>     createActivationIfNecessary();
>-    emitOpcode(op_new_func);
>+    emitOpcode(captureMode == IsCaptured ? op_new_captured_func : op_new_func);
>     instructions().append(dst->index());
>     instructions().append(index);
>     instructions().append(doNullCheck);
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 159886)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -114,6 +114,11 @@ namespace JSC {
>         TryData* tryData;
>     };
> 
>+    enum CaptureMode {
>+        NotCaptured,
>+        IsCaptured
>+    };
>+
>     class Local {
>     public:
>         Local()
>@@ -122,9 +127,10 @@ namespace JSC {
>         {
>         }
> 
>-        Local(RegisterID* local, unsigned attributes)
>+        Local(RegisterID* local, unsigned attributes, CaptureMode captureMode)
>             : m_local(local)
>             , m_attributes(attributes)
>+            , m_isCaptured(captureMode == IsCaptured)
>         {
>         }
> 
>@@ -133,10 +139,14 @@ namespace JSC {
>         RegisterID* get() { return m_local; }
> 
>         bool isReadOnly() { return m_attributes & ReadOnly; }
>+        
>+        bool isCaptured() { return m_isCaptured; }
>+        CaptureMode captureMode() { return isCaptured() ? IsCaptured : NotCaptured; }
> 
>     private:
>         RegisterID* m_local;
>         unsigned m_attributes;
>+        bool m_isCaptured;
>     };
> 
>     struct TryRange {
>@@ -171,6 +181,9 @@ namespace JSC {
>         bool willResolveToArguments(const Identifier&);
>         RegisterID* uncheckedRegisterForArguments();
> 
>+        bool isCaptured(int operand);
>+        CaptureMode captureMode(int operand) { return isCaptured(operand) ? IsCaptured : NotCaptured; }
>+        
>         Local local(const Identifier&);
>         Local constLocal(const Identifier&);
> 
>@@ -231,6 +244,8 @@ namespace JSC {
>         {
>             // Node::emitCode assumes that dst, if provided, is either a local or a referenced temporary.
>             ASSERT(!dst || dst == ignoredResult() || !dst->isTemporary() || dst->refCount());
>+            // Should never store directly into a captured variable.
>+            ASSERT(!dst || dst == ignoredResult() || !isCaptured(dst->index()));
>             if (!m_vm->isSafeToRecurse()) {
>                 emitThrowExpressionTooDeepException();
>                 return;
>@@ -247,6 +262,8 @@ namespace JSC {
>         {
>             // Node::emitCode assumes that dst, if provided, is either a local or a referenced temporary.
>             ASSERT(!dst || dst == ignoredResult() || !dst->isTemporary() || dst->refCount());
>+            // Should never store directly into a captured variable.
>+            ASSERT(!dst || dst == ignoredResult() || !isCaptured(dst->index()));
>             if (!m_vm->isSafeToRecurse())
>                 return emitThrowExpressionTooDeepException();
>             return n->emitBytecode(*this, dst);
>@@ -329,12 +346,13 @@ namespace JSC {
>         RegisterID* emitNewObject(RegisterID* dst);
>         RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
> 
>-        RegisterID* emitNewFunction(RegisterID* dst, FunctionBodyNode* body);
>+        RegisterID* emitNewFunction(RegisterID* dst, CaptureMode, FunctionBodyNode* body);
>         RegisterID* emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* body);
>-        RegisterID* emitNewFunctionInternal(RegisterID* dst, unsigned index, bool shouldNullCheck);
>+        RegisterID* emitNewFunctionInternal(RegisterID* dst, CaptureMode, unsigned index, bool shouldNullCheck);
>         RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func);
>         RegisterID* emitNewRegExp(RegisterID* dst, RegExp*);
> 
>+        RegisterID* emitMove(RegisterID* dst, CaptureMode, RegisterID* src);
>         RegisterID* emitMove(RegisterID* dst, RegisterID* src);
> 
>         RegisterID* emitToNumber(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_to_number, dst, src); }
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 159886)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -673,11 +673,22 @@ RegisterID* PostfixNode::emitResolve(Byt
>     const Identifier& ident = resolve->identifier();
> 
>     if (Local local = generator.local(ident)) {
>+        RegisterID* localReg = local.get();
>         if (local.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>-            local = Local(generator.emitMove(generator.tempDestination(dst), local.get()), 0);
>+            localReg = generator.emitMove(generator.tempDestination(dst), localReg);
>         }
>-        return emitPostIncOrDec(generator, generator.finalDestination(dst), local.get(), m_operator);
>+        if (local.isCaptured()) {
>+            ASSERT(dst);
>+            ASSERT(dst != localReg);
>+            RefPtr<RegisterID> tempDstSrc = generator.newTemporary();
>+            generator.emitToNumber(dst, localReg);
>+            generator.emitMove(tempDstSrc.get(), localReg);
>+            emitIncOrDec(generator, tempDstSrc.get(), m_operator);
>+            generator.emitMove(localReg, tempDstSrc.get());
>+            return dst;
>+        }
>+        return emitPostIncOrDec(generator, generator.finalDestination(dst), localReg, m_operator);
>     }
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>@@ -838,12 +849,20 @@ RegisterID* PrefixNode::emitResolve(Byte
>     const Identifier& ident = resolve->identifier();
> 
>     if (Local local = generator.local(ident)) {
>+        RegisterID* localReg = local.get();
>         if (local.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>-            local = Local(generator.emitMove(generator.tempDestination(dst), local.get()), 0);
>+            localReg = generator.emitMove(generator.tempDestination(dst), localReg);
>         }
>-        emitIncOrDec(generator, local.get(), m_operator);
>-        return generator.moveToDestinationIfNeeded(dst, local.get());
>+        if (local.isCaptured()) {
>+            RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
>+            generator.emitMove(tempDst.get(), localReg);
>+            emitIncOrDec(generator, tempDst.get(), m_operator);
>+            generator.emitMove(localReg, tempDst.get());
>+            return generator.moveToDestinationIfNeeded(dst, tempDst.get());
>+        }
>+        emitIncOrDec(generator, localReg, m_operator);
>+        return generator.moveToDestinationIfNeeded(dst, localReg);
>     }
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>@@ -1327,7 +1346,8 @@ RegisterID* ReadModifyResolveNode::emitB
>             return emitReadModifyAssignment(generator, generator.finalDestination(dst), local.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
>         }
>         
>-        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
>+        if (local.isCaptured()
>+            || generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
>             RefPtr<RegisterID> result = generator.newTemporary();
>             generator.emitMove(result.get(), local.get());
>             emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
>@@ -1356,6 +1376,12 @@ RegisterID* AssignResolveNode::emitBytec
>             generator.emitReadOnlyExceptionIfNeeded();
>             return generator.emitNode(dst, m_right);
>         }
>+        if (local.isCaptured()) {
>+            RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
>+            generator.emitNode(tempDst.get(), m_right);
>+            generator.emitMove(local.get(), tempDst.get());
>+            return generator.moveToDestinationIfNeeded(dst, tempDst.get());
>+        }
>         RegisterID* result = generator.emitNode(local.get(), m_right);
>         return generator.moveToDestinationIfNeeded(dst, result);
>     }
>@@ -1451,11 +1477,17 @@ RegisterID* CommaNode::emitBytecode(Byte
> RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
> {
>     // FIXME: This code does not match the behavior of const in Firefox.
>-    if (RegisterID* local = generator.constLocal(m_ident).get()) {
>+    if (Local local = generator.constLocal(m_ident)) {
>         if (!m_init)
>-            return local;
>+            return local.get();
> 
>-        return generator.emitNode(local, m_init);
>+        if (local.isCaptured()) {
>+            RefPtr<RegisterID> tempDst = generator.newTemporary();
>+            generator.emitNode(tempDst.get(), m_init);
>+            return generator.emitMove(local.get(), tempDst.get());
>+        }
>+        
>+        return generator.emitNode(local.get(), m_init);
>     }
> 
>     RefPtr<RegisterID> value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 159886)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -2141,7 +2141,8 @@ bool ByteCodeParser::parseBlock(unsigned
>             addToGraph(Breakpoint);
>             NEXT_OPCODE(op_debug);
> #endif
>-        case op_mov: {
>+        case op_mov:
>+        case op_captured_mov: {
>             Node* op = get(VirtualRegister(currentInstruction[2].u.operand));
>             set(VirtualRegister(currentInstruction[1].u.operand), op);
>             NEXT_OPCODE(op_mov);
>@@ -3221,7 +3222,8 @@ bool ByteCodeParser::parseBlock(unsigned
>             NEXT_OPCODE(op_get_argument_by_val);
>         }
>             
>-        case op_new_func: {
>+        case op_new_func:
>+        case op_new_captured_func: {
>             if (!currentInstruction[3].u.operand) {
>                 set(VirtualRegister(currentInstruction[1].u.operand),
>                     addToGraph(NewFunctionNoCheck, OpInfo(currentInstruction[2].u.operand)));
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 159886)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -102,6 +102,7 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_debug:
> #endif
>     case op_mov:
>+    case op_captured_mov:
>     case op_check_has_instance:
>     case op_instanceof:
>     case op_is_undefined:
>@@ -201,6 +202,7 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_create_activation:
>     case op_tear_off_activation:
>     case op_new_func:
>+    case op_new_captured_func:
>     case op_new_func_exp:
>     case op_switch_string: // Don't inline because we don't want to copy string tables in the concurrent JIT.
>         return CanCompile;
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 159886)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -250,6 +250,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_loop_hint)
>         DEFINE_OP(op_lshift)
>         DEFINE_OP(op_mod)
>+        case op_captured_mov:
>         DEFINE_OP(op_mov)
>         DEFINE_OP(op_mul)
>         DEFINE_OP(op_negate)
>@@ -258,6 +259,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_new_array)
>         DEFINE_OP(op_new_array_with_size)
>         DEFINE_OP(op_new_array_buffer)
>+        case op_new_captured_func:
>         DEFINE_OP(op_new_func)
>         DEFINE_OP(op_new_func_exp)
>         DEFINE_OP(op_new_object)
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 159886)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -542,6 +542,16 @@ _llint_op_mov:
>     dispatch(3)
> 
> 
>+_llint_op_captured_mov:
>+    traceExecution()
>+    loadi 8[PC], t1
>+    loadi 4[PC], t0
>+    loadConstantOrVariable(t1, t2, t3)
>+    storei t2, TagOffset[cfr, t0, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+    dispatch(3)
>+
>+
> _llint_op_not:
>     traceExecution()
>     loadi 8[PC], t0
>@@ -1662,6 +1672,17 @@ _llint_op_new_func:
>     dispatch(4)
> 
> 
>+_llint_op_new_captured_func:
>+    traceExecution()
>+    btiz 12[PC], .opNewCapturedFuncUnchecked
>+    loadi 4[PC], t1
>+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNewCapturedFuncDone
>+.opNewCapturedFuncUnchecked:
>+    callSlowPath(_llint_slow_path_new_func)
>+.opNewCapturedFuncDone:
>+    dispatch(4)
>+
>+
> macro arrayProfileForCall()
>     if VALUE_PROFILER
>         loadi 16[PC], t3
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 159886)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -418,6 +418,15 @@ _llint_op_mov:
>     dispatch(3)
> 
> 
>+_llint_op_captured_mov:
>+    traceExecution()
>+    loadisFromInstruction(2, t1)
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariable(t1, t2)
>+    storeq t2, [cfr, t0, 8]
>+    dispatch(3)
>+
>+
> _llint_op_not:
>     traceExecution()
>     loadisFromInstruction(2, t0)
>@@ -1514,6 +1523,18 @@ _llint_op_new_func:
>     dispatch(4)
> 
> 
>+_llint_op_new_captured_func:
>+    traceExecution()
>+    loadisFromInstruction(3, t2)
>+    btiz t2, .opNewCapturedFuncUnchecked
>+    loadisFromInstruction(1, t1)
>+    btqnz [cfr, t1, 8], .opNewCapturedFuncDone
>+.opNewCapturedFuncUnchecked:
>+    callSlowPath(_llint_slow_path_new_func)
>+.opNewCapturedFuncDone:
>+    dispatch(4)
>+
>+
> macro arrayProfileForCall()
>     if VALUE_PROFILER
>         loadisFromInstruction(4, t3)
>Index: Source/JavaScriptCore/runtime/SymbolTable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolTable.h	(revision 159886)
>+++ Source/JavaScriptCore/runtime/SymbolTable.h	(working copy)
>@@ -453,6 +453,11 @@ public:
>     void setCaptureEnd(int captureEnd) { m_captureEnd = captureEnd; }
> 
>     int captureCount() const { return -(m_captureEnd - m_captureStart); }
>+    
>+    bool isCaptured(int operand)
>+    {
>+        return operand <= captureStart() && operand > captureEnd();
>+    }
> 
>     int parameterCount() { return m_parameterCountIncludingThis - 1; }
>     int parameterCountIncludingThis() { return m_parameterCountIncludingThis; }
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 159900)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2013-12-01  Filip Pizlo  <fpizlo@apple.com>
>+
>+        Stores to local captured variables should be intercepted
>+        https://bugs.webkit.org/show_bug.cgi?id=124883
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * js/regress/captured-assignments-expected.txt: Added.
>+        * js/regress/captured-assignments.html: Added.
>+        * js/regress/script-tests/captured-assignments.js: Added.
>+
> 2013-11-29  MichaÅ PakuÅa vel Rutka  <m.pakula@samsung.com>
> 
>         Unreviewed EFL gardening
>Index: LayoutTests/js/regress/captured-assignments-expected.txt
>===================================================================
>--- LayoutTests/js/regress/captured-assignments-expected.txt	(revision 0)
>+++ LayoutTests/js/regress/captured-assignments-expected.txt	(working copy)
>@@ -0,0 +1,10 @@
>+JSRegress/captured-assignments
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS no exception thrown
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/js/regress/captured-assignments.html
>===================================================================
>--- LayoutTests/js/regress/captured-assignments.html	(revision 0)
>+++ LayoutTests/js/regress/captured-assignments.html	(working copy)
>@@ -0,0 +1,12 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="resources/regress-pre.js"></script>
>+<script src="script-tests/captured-assignments.js"></script>
>+<script src="resources/regress-post.js"></script>
>+<script src="../../resources/js-test-post.js"></script>
>+</body>
>+</html>
>Index: LayoutTests/js/regress/script-tests/captured-assignments.js
>===================================================================
>--- LayoutTests/js/regress/script-tests/captured-assignments.js	(revision 0)
>+++ LayoutTests/js/regress/script-tests/captured-assignments.js	(working copy)
>@@ -0,0 +1,19 @@
>+function foo() {
>+    var x = 0;
>+    ++x;
>+    x++;
>+    var y = x++;
>+    var z = y++;
>+    z = x++;
>+    x += 2;
>+    z -= 1;
>+    x *= 2;
>+    z <<= 1;
>+    x |= 5;
>+    return function() { return x++ + z; }
>+}
>+
>+for (var i = 0; i < 100; ++i) {
>+    if (foo()() != 17)
>+        throw "Error";
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 124883: 217863 | 218084 | 218113 | 218117 | 218119 | 218121