Attachment 219204 Details for Bug 125649 – FTL-on-C-stack now knows that 1+1=2

[patch] FTL-on-C-stack now knows that 1+1=2

blah.patch (text/plain), 43.53 KB, created by Filip Pizlo on 2013-12-13 15:13:55 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2013-12-13 15:13:55 PST

Size: 43.53 KB

patch

obsolete

>Index: Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
>===================================================================
>--- Source/JavaScriptCore/assembler/AbstractMacroAssembler.h	(revision 160566)
>+++ Source/JavaScriptCore/assembler/AbstractMacroAssembler.h	(working copy)
>@@ -123,7 +123,7 @@ public:
>         {
>             return Address(base, offset + additionalOffset);
>         }
>-
>+        
>         RegisterID base;
>         int32_t offset;
>     };
>Index: Source/JavaScriptCore/bytecode/StructureStubInfo.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/StructureStubInfo.h	(revision 160566)
>+++ Source/JavaScriptCore/bytecode/StructureStubInfo.h	(working copy)
>@@ -225,7 +225,6 @@ struct StructureStubInfo {
> 
>     struct {
>         int8_t registersFlushed;
>-        int8_t callFrameRegister;
>         int8_t baseGPR;
> #if USE(JSVALUE32_64)
>         int8_t valueTagGPR;
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 160566)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -213,8 +213,8 @@ void SpeculativeJIT::nonSpeculativeUInt3
> void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg resultGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
> {
>     JITGetByIdGenerator gen(
>-        m_jit.codeBlock(), codeOrigin, usedRegisters(), GPRInfo::callFrameRegister,
>-        JSValueRegs(baseGPR), JSValueRegs(resultGPR), spillMode != NeedToSpill);
>+        m_jit.codeBlock(), codeOrigin, usedRegisters(), JSValueRegs(baseGPR),
>+        JSValueRegs(resultGPR), spillMode != NeedToSpill);
>     gen.generateFastPath(m_jit);
>     
>     JITCompiler::JumpList slowCases;
>@@ -235,9 +235,8 @@ void SpeculativeJIT::cachedPutById(CodeO
>     writeBarrier(baseGPR, valueGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);
> 
>     JITPutByIdGenerator gen(
>-        m_jit.codeBlock(), codeOrigin, usedRegisters(), GPRInfo::callFrameRegister,
>-        JSValueRegs(baseGPR), JSValueRegs(valueGPR), scratchGPR, false,
>-        m_jit.ecmaModeFor(codeOrigin), putKind);
>+        m_jit.codeBlock(), codeOrigin, usedRegisters(), JSValueRegs(baseGPR),
>+        JSValueRegs(valueGPR), scratchGPR, false, m_jit.ecmaModeFor(codeOrigin), putKind);
>     gen.generateFastPath(m_jit);
>     
>     JITCompiler::JumpList slowCases;
>Index: Source/JavaScriptCore/ftl/FTLAbbreviations.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLAbbreviations.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLAbbreviations.h	(working copy)
>@@ -58,6 +58,7 @@ static inline LType floatType(LContext c
> static inline LType doubleType(LContext context) { return llvm->DoubleTypeInContext(context); }
> 
> static inline LType pointerType(LType type) { return llvm->PointerType(type, 0); }
>+static inline LType arrayType(LType type, unsigned count) { return llvm->ArrayType(type, count); }
> static inline LType vectorType(LType type, unsigned count) { return llvm->VectorType(type, count); }
> 
> enum PackingMode { NotPacked, Packed };
>Index: Source/JavaScriptCore/ftl/FTLCompile.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLCompile.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLCompile.cpp	(working copy)
>@@ -202,18 +202,17 @@ static void fixFunctionBasedOnStackMaps(
>             RegisterSet usedRegisters = RegisterSet::allRegisters();
>             
>             GPRReg result = record.locations[0].directGPR();
>-            GPRReg callFrameRegister = record.locations[1].directGPR();
>-            GPRReg base = record.locations[2].directGPR();
>+            GPRReg base = record.locations[1].directGPR();
>             
>             JITGetByIdGenerator gen(
>-                codeBlock, getById.codeOrigin(), usedRegisters, callFrameRegister,
>-                JSValueRegs(base), JSValueRegs(result), false);
>+                codeBlock, getById.codeOrigin(), usedRegisters, JSValueRegs(base),
>+                JSValueRegs(result), false);
>             
>             MacroAssembler::Label begin = slowPathJIT.label();
>             
>             MacroAssembler::Call call = callOperation(
>                 state, usedRegisters, slowPathJIT, operationGetByIdOptimize, result,
>-                callFrameRegister, gen.stubInfo(), base, getById.uid());
>+                gen.stubInfo(), base, getById.uid());
>             
>             gen.reportSlowPathCall(begin, call);
>             
>@@ -238,20 +237,19 @@ static void fixFunctionBasedOnStackMaps(
>             // FIXME: LLVM should tell us which registers are live.
>             RegisterSet usedRegisters = RegisterSet::allRegisters();
>             
>-            GPRReg callFrameRegister = record.locations[0].directGPR();
>-            GPRReg base = record.locations[1].directGPR();
>-            GPRReg value = record.locations[2].directGPR();
>+            GPRReg base = record.locations[0].directGPR();
>+            GPRReg value = record.locations[1].directGPR();
>             
>             JITPutByIdGenerator gen(
>-                codeBlock, putById.codeOrigin(), usedRegisters, callFrameRegister,
>-                JSValueRegs(base), JSValueRegs(value), MacroAssembler::scratchRegister,
>-                false, putById.ecmaMode(), putById.putKind());
>+                codeBlock, putById.codeOrigin(), usedRegisters, JSValueRegs(base),
>+                JSValueRegs(value), MacroAssembler::scratchRegister, false, putById.ecmaMode(),
>+                putById.putKind());
>             
>             MacroAssembler::Label begin = slowPathJIT.label();
>             
>             MacroAssembler::Call call = callOperation(
>-                state, usedRegisters, slowPathJIT, gen.slowPathFunction(), callFrameRegister,
>-                gen.stubInfo(), value, base, putById.uid());
>+                state, usedRegisters, slowPathJIT, gen.slowPathFunction(), gen.stubInfo(),
>+                value, base, putById.uid());
>             
>             gen.reportSlowPathCall(begin, call);
>             
>Index: Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h	(working copy)
>@@ -40,6 +40,7 @@ namespace JSC { namespace FTL {
>     macro(addWithOverflow32, "llvm.sadd.with.overflow.i32", functionType(structType(m_context, int32, boolean), int32, int32)) \
>     macro(addWithOverflow64, "llvm.sadd.with.overflow.i64", functionType(structType(m_context, int64, boolean), int64, int64)) \
>     macro(doubleAbs, "llvm.fabs.f64", functionType(doubleType, doubleType)) \
>+    macro(frameAddress, "llvm.frameaddress", functionType(pointerType(int8), int32)) \
>     macro(mulWithOverflow32, "llvm.smul.with.overflow.i32", functionType(structType(m_context, int32, boolean), int32, int32)) \
>     macro(mulWithOverflow64, "llvm.smul.with.overflow.i64", functionType(structType(m_context, int64, boolean), int64, int64)) \
>     macro(patchpointInt64, "llvm.experimental.patchpoint.i64", functionType(int64, int32, int32, ref8, int32, Variadic)) \
>Index: Source/JavaScriptCore/ftl/FTLJITCode.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLJITCode.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLJITCode.cpp	(working copy)
>@@ -54,21 +54,25 @@ void JITCode::addDataSection(RefCountedA
>     m_dataSections.append(dataSection);
> }
> 
>-void JITCode::initializeCode(CodeRef entrypoint)
>+void JITCode::initializeEntrypoint(CodeRef entrypoint)
> {
>     m_entrypoint = entrypoint;
> }
> 
>+void JITCode::initializeAddressForCall(CodePtr address)
>+{
>+    m_addressForCall = address;
>+}
>+
> JITCode::CodePtr JITCode::addressForCall()
> {
>-    RELEASE_ASSERT(m_entrypoint);
>-    return m_entrypoint.code();
>+    return m_addressForCall;
> }
> 
> void* JITCode::executableAddressAtOffset(size_t offset)
> {
>     RELEASE_ASSERT(m_entrypoint);
>-    return reinterpret_cast<char*>(m_entrypoint.code().executableAddress()) + offset;
>+    return reinterpret_cast<char*>(m_addressForCall.executableAddress()) + offset;
> }
> 
> void* JITCode::dataAddressAtOffset(size_t)
>Index: Source/JavaScriptCore/ftl/FTLJITCode.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLJITCode.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLJITCode.h	(working copy)
>@@ -56,7 +56,8 @@ public:
>     void initializeExitThunks(CodeRef);
>     void addHandle(PassRefPtr<ExecutableMemoryHandle>);
>     void addDataSection(RefCountedArray<LSectionWord>);
>-    void initializeCode(CodeRef entrypoint);
>+    void initializeEntrypoint(CodeRef);
>+    void initializeAddressForCall(CodePtr);
>     
>     const Vector<RefPtr<ExecutableMemoryHandle>>& handles() const { return m_handles; }
>     const Vector<RefCountedArray<LSectionWord>>& dataSections() const { return m_dataSections; }
>@@ -73,6 +74,7 @@ public:
> private:
>     Vector<RefCountedArray<LSectionWord>> m_dataSections;
>     Vector<RefPtr<ExecutableMemoryHandle>> m_handles;
>+    CodePtr m_addressForCall;
>     CodeRef m_entrypoint;
>     CodeRef m_exitThunks;
> };
>Index: Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp	(working copy)
>@@ -73,9 +73,7 @@ bool JITFinalizer::finalizeFunction()
>             exitThunksLinkBuffer->link(
>                 info.m_thunkJump,
>                 CodeLocationLabel(
>-                    m_plan.vm.ftlThunks->getOSRExitGenerationThunk(
>-                        m_plan.vm, Location::forStackmaps(
>-                            &jitCode->stackmaps, iter->value.locations[0])).code()));
>+                    m_plan.vm.getCTIStub(osrExitGenerationThunkGenerator).code()));
>         }
>         
>         jitCode->initializeExitThunks(
>@@ -105,7 +103,7 @@ bool JITFinalizer::finalizeFunction()
>     MacroAssemblerCodePtr withArityCheck;
>     if (arityCheck.isSet())
>         withArityCheck = entrypointLinkBuffer->locationOf(arityCheck);
>-    jitCode->initializeCode(
>+    jitCode->initializeEntrypoint(
>         FINALIZE_DFG_CODE(
>             *entrypointLinkBuffer,
>             ("FTL entrypoint thunk for %s with LLVM generated code at %p", toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data(), function)));
>Index: Source/JavaScriptCore/ftl/FTLLink.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLink.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLLink.cpp	(working copy)
>@@ -43,12 +43,6 @@ namespace JSC { namespace FTL {
> 
> using namespace DFG;
> 
>-static void compileEntry(CCallHelpers& jit)
>-{
>-    jit.emitFunctionPrologue();
>-    jit.emitPutImmediateToCallFrameHeader(jit.codeBlock(), JSStack::CodeBlock);
>-}
>-
> void link(State& state)
> {
>     CodeBlock* codeBlock = state.graph.m_codeBlock;
>@@ -71,64 +65,25 @@ void link(State& state)
>     
>     OwnPtr<LinkBuffer> linkBuffer;
>     CCallHelpers::Label arityCheck;
>+
>+    CCallHelpers::Address frame = CCallHelpers::Address(
>+        CCallHelpers::stackPointerRegister, -static_cast<int32_t>(sizeof(void*)));
>+    
>     switch (state.graph.m_plan.mode) {
>     case FTLMode: {
>-        compileEntry(jit);
>+        CCallHelpers::JumpList mainPathJumps;
>     
>-        // This part is only necessary for functions. We currently only compile functions.
>-        
>-        CCallHelpers::Label fromArityCheck = jit.label();
>-        
>-        // Plant a check that sufficient space is available in the JSStack.
>-        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
>-        jit.addPtr(
>-            CCallHelpers::TrustedImm32(virtualRegisterForLocal(state.jitCode->common.requiredRegisterCountForExit).offset() * sizeof(Register)),
>-            GPRInfo::callFrameRegister, GPRInfo::regT1);
>-        CCallHelpers::Jump stackCheck = jit.branchPtr(
>-            CCallHelpers::Above,
>-            CCallHelpers::AbsoluteAddress(state.graph.m_vm.addressOfJSStackLimit()),
>-            GPRInfo::regT1);
>-        CCallHelpers::Label fromStackCheck = jit.label();
>-        
>-        jit.setupArgumentsExecState();
>-        jit.move(
>-            CCallHelpers::TrustedImmPtr(reinterpret_cast<void*>(state.generatedFunction)),
>-            GPRInfo::nonArgGPR0);
>-        jit.call(GPRInfo::nonArgGPR0);
>-        jit.emitFunctionEpilogue();
>-        jit.ret();
>-        
>-        stackCheck.link(&jit);
>-        jit.move(CCallHelpers::TrustedImmPtr(codeBlock), GPRInfo::argumentGPR1);
>-        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
>-        jit.store32(
>-            CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
>-            CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
>-        jit.storePtr(GPRInfo::callFrameRegister, &state.graph.m_vm.topCallFrame);
>-        CCallHelpers::Call callStackCheck = jit.call();
>-#if !ASSERT_DISABLED
>-        // FIXME: need to make this call register with exception handling somehow. This is
>-        // part of a bigger problem: FTL should be able to handle exceptions.
>-        // https://bugs.webkit.org/show_bug.cgi?id=113622
>-        // Until then, use a JIT ASSERT.
>-        jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT0);
>-        jit.jitAssertIsNull(GPRInfo::regT0);
>-#endif
>-        jit.jump(fromStackCheck);
>-        
>-        arityCheck = jit.label();
>-        compileEntry(jit);
>         jit.load32(
>-            CCallHelpers::payloadFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)),
>+            frame.withOffset(sizeof(Register) * JSStack::ArgumentCount),
>             GPRInfo::regT1);
>-        jit.branch32(
>+        mainPathJumps.append(jit.branch32(
>             CCallHelpers::AboveOrEqual, GPRInfo::regT1,
>-            CCallHelpers::TrustedImm32(codeBlock->numParameters()))
>-            .linkTo(fromArityCheck, &jit);
>+            CCallHelpers::TrustedImm32(codeBlock->numParameters())));
>+        jit.emitFunctionPrologue();
>         jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
>         jit.store32(
>             CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
>-            CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
>+            CCallHelpers::tagFor(JSStack::ArgumentCount));
>         jit.storePtr(GPRInfo::callFrameRegister, &state.graph.m_vm.topCallFrame);
>         CCallHelpers::Call callArityCheck = jit.call();
> #if !ASSERT_DISABLED
>@@ -139,16 +94,20 @@ void link(State& state)
>         jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT1);
>         jit.jitAssertIsNull(GPRInfo::regT1);
> #endif
>-        if (GPRInfo::returnValueGPR != GPRInfo::regT0)
>-            jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
>-        jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0).linkTo(fromArityCheck, &jit);
>+        jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
>+        jit.emitFunctionEpilogue();
>+        mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));
>+        jit.emitFunctionPrologue();
>         CCallHelpers::Call callArityFixup = jit.call();
>-        jit.jump(fromArityCheck);
>-        
>+        jit.emitFunctionEpilogue();
>+        mainPathJumps.append(jit.jump());
>+
>         linkBuffer = adoptPtr(new LinkBuffer(state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
>-        linkBuffer->link(callStackCheck, operationStackCheck);
>         linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
>         linkBuffer->link(callArityFixup, FunctionPtr((state.graph.m_vm.getCTIStub(arityFixup)).code().executableAddress()));
>+        linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
>+
>+        state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));
>         break;
>     }
>         
>@@ -157,16 +116,15 @@ void link(State& state)
>         // values into the scratch buffer. Everything should be good to go - at this
>         // point we've even done the stack check. Basically we just have to make the
>         // call to the LLVM-generated code.
>-        jit.setupArgumentsExecState();
>-        jit.move(
>-            CCallHelpers::TrustedImmPtr(reinterpret_cast<void*>(state.generatedFunction)),
>-            GPRInfo::nonArgGPR0);
>-        jit.call(GPRInfo::nonArgGPR0);
>+        CCallHelpers::Label start = jit.label();
>         jit.emitFunctionEpilogue();
>-        jit.ret();
>+        CCallHelpers::Jump mainPathJump = jit.jump();
>         
>         linkBuffer = adoptPtr(new LinkBuffer(
>             state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
>+        linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
>+
>+        state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));
>         break;
>     }
>         
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp	(working copy)
>@@ -51,6 +51,10 @@ using namespace DFG;
> 
> static int compileCounter;
> 
>+// FIXME: Get rid of this and introduce a real stack check.
>+// https://bugs.webkit.org/show_bug.cgi?id=125650
>+static uintptr_t stackLimit;
>+
> // Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
> // significantly less dead code.
> #define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \
>@@ -92,16 +96,29 @@ public:
>             llvm->ModuleCreateWithNameInContext(name.data(), m_ftlState.context);
>         
>         m_ftlState.function = addFunction(
>-            m_ftlState.module, name.data(), functionType(m_out.int64, m_out.intPtr));
>+            m_ftlState.module, name.data(), functionType(m_out.int64));
>         setFunctionCallingConv(m_ftlState.function, LLVMCCallConv);
>         
>         m_out.initialize(m_ftlState.module, m_ftlState.function, m_heaps);
>         
>-        m_prologue = appendBasicBlock(m_ftlState.context, m_ftlState.function);
>-        m_out.appendTo(m_prologue);
>+        m_prologue = FTL_NEW_BLOCK(m_out, ("Prologue"));
>+        LBasicBlock stackOverflow = FTL_NEW_BLOCK(m_out, ("Stack overflow"));
>+        m_out.appendTo(m_prologue, stackOverflow);
>         createPhiVariables();
>+        m_captured = m_out.ptrToInt(
>+            m_out.alloca(arrayType(m_out.int64, m_graph.m_nextMachineLocal)),
>+            m_out.intPtr);
>+        
>+        // We should not create any alloca's after this point, since they will cease to
>+        // be mem2reg candidates.
>+        
>+        m_ftlState.capturedStackmapID = m_stackmapIDs++;
>+        m_out.call(
>+            m_out.stackmapIntrinsic(), m_out.constInt32(m_ftlState.capturedStackmapID),
>+            m_out.int32Zero);
>         
>-        m_callFrame = m_out.param(0);
>+        m_callFrame = m_out.ptrToInt(
>+            m_out.call(m_out.frameAddressIntrinsic(), m_out.int32Zero), m_out.intPtr);
>         m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
>         m_tagMask = m_out.constInt64(TagMask);
>         
>@@ -112,8 +129,14 @@ public:
>             m_blocks.add(m_highBlock, FTL_NEW_BLOCK(m_out, ("Block ", *m_highBlock)));
>         }
>         
>-        m_out.appendTo(m_prologue);
>-        m_out.jump(lowBlock(m_graph.block(0)));
>+        m_out.storePtr(m_out.constIntPtr(codeBlock()), addressFor(JSStack::CodeBlock));
>+        m_out.branch(
>+            m_out.below(m_callFrame, m_out.loadPtr(m_out.absolute(&stackLimit))),
>+            stackOverflow, lowBlock(m_graph.block(0)));
>+        
>+        m_out.appendTo(stackOverflow, lowBlock(m_graph.block(0)));
>+        // FIXME: Handle exceptions. https://bugs.webkit.org/show_bug.cgi?id=113622
>+        m_out.crash();
>         
>         Vector<BasicBlock*> depthFirst;
>         m_graph.getBlocksInDepthFirstOrder(depthFirst);
>@@ -1270,7 +1293,7 @@ private:
>         LValue call = m_out.call(
>             m_out.patchpointInt64Intrinsic(),
>             m_out.constInt32(stackmapID), m_out.constInt32(sizeOfGetById()),
>-            constNull(m_out.ref8), m_out.constInt32(2), m_callFrame, base);
>+            constNull(m_out.ref8), m_out.constInt32(1), base);
>         setInstructionCallingConvention(call, LLVMAnyRegCallConv);
>         setJSValue(call);
>         
>@@ -1295,7 +1318,7 @@ private:
>         LValue call = m_out.call(
>             m_out.patchpointVoidIntrinsic(),
>             m_out.constInt32(stackmapID), m_out.constInt32(sizeOfPutById()),
>-            constNull(m_out.ref8), m_out.constInt32(3), m_callFrame, base, value);
>+            constNull(m_out.ref8), m_out.constInt32(2), base, value);
>         setInstructionCallingConvention(call, LLVMAnyRegCallConv);
>         
>         m_ftlState.putByIds.append(PutByIdDescriptor(
>@@ -4003,7 +4026,6 @@ private:
>         OSRExit& exit, ExitArgumentList& arguments, FormattedValue lowValue,
>         CodeOrigin codeOrigin)
>     {
>-        arguments.append(m_callFrame);
>         if (!!lowValue)
>             arguments.append(lowValue.value());
>         
>@@ -4260,35 +4282,42 @@ private:
>     }
>     TypedPointer payloadFor(LValue base, int operand)
>     {
>-        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
>+        return addressFor(base, operand, PayloadOffset);
>     }
>     TypedPointer tagFor(LValue base, int operand)
>     {
>-        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
>+        return addressFor(base, operand, TagOffset);
>     }
>-    TypedPointer addressFor(int operand)
>+    TypedPointer addressFor(int operand, ptrdiff_t offset = 0)
>     {
>-        return addressFor(m_callFrame, operand);
>+        return addressFor(VirtualRegister(operand), offset);
>     }
>-    TypedPointer addressFor(VirtualRegister operand)
>+    TypedPointer addressFor(VirtualRegister operand, ptrdiff_t offset = 0)
>     {
>-        return addressFor(m_callFrame, operand.offset());
>+        if (operand.isLocal()) {
>+            return TypedPointer(
>+                m_heaps.variables[operand.offset()],
>+                m_out.add(
>+                    m_captured,
>+                    m_out.constIntPtr(operand.toLocal() * sizeof(Register))));
>+        }
>+        return addressFor(m_callFrame, operand.offset(), offset);
>     }
>     TypedPointer payloadFor(int operand)
>     {
>-        return payloadFor(m_callFrame, operand);
>+        return payloadFor(VirtualRegister(operand));
>     }
>     TypedPointer payloadFor(VirtualRegister operand)
>     {
>-        return payloadFor(m_callFrame, operand.offset());
>+        return addressFor(operand, PayloadOffset);
>     }
>     TypedPointer tagFor(int operand)
>     {
>-        return tagFor(m_callFrame, operand);
>+        return tagFor(VirtualRegister(operand));
>     }
>     TypedPointer tagFor(VirtualRegister operand)
>     {
>-        return tagFor(m_callFrame, operand.offset());
>+        return addressFor(operand, TagOffset);
>     }
>     
>     VM& vm() { return m_graph.m_vm; }
>@@ -4303,6 +4332,7 @@ private:
>     HashMap<BasicBlock*, LBasicBlock> m_blocks;
>     
>     LValue m_callFrame;
>+    LValue m_captured;
>     LValue m_tagTypeNumber;
>     LValue m_tagMask;
>     
>Index: Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp	(working copy)
>@@ -79,13 +79,12 @@ static void compileStub(
>     
>     // Get the call frame and tag thingies.
>     // Restore the exiting function's callFrame value into a regT4
>-    record->locations[0].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT4);
>     jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
>     jit.move(MacroAssembler::TrustedImm64(TagMask), GPRInfo::tagMaskRegister);
>     
>     // Do some value profiling.
>     if (exit.m_profileValueFormat != InvalidValueFormat) {
>-        record->locations[1].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
>+        record->locations[0].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
>         reboxAccordingToFormat(
>             exit.m_profileValueFormat, jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
>         
>@@ -129,7 +128,7 @@ static void compileStub(
>         case ExitValueInJSStackAsInt32:
>         case ExitValueInJSStackAsInt52:
>         case ExitValueInJSStackAsDouble:
>-            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister(), GPRInfo::regT4), GPRInfo::regT0);
>+            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
>             break;
>             
>         default:
>@@ -149,19 +148,9 @@ static void compileStub(
>         jit.load64(scratch + index, GPRInfo::regT0);
>         reboxAccordingToFormat(
>             value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
>-        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast<VirtualRegister>(operand), GPRInfo::regT4));
>+        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast<VirtualRegister>(operand)));
>     }
>     
>-    // Restore the old stack pointer and then put regT4 into callFrameRegister. The idea is
>-    // that the FTL call frame is pushed onto the JS call frame and we can recover the old
>-    // value of the stack pointer by popping the FTL call frame. We already know what the
>-    // frame pointer in the JS call frame was because it would have been passed as an argument
>-    // to the FTL call frame.
>-    jit.move(MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
>-    jit.pop(GPRInfo::nonArgGPR0);
>-    jit.pop(GPRInfo::nonArgGPR0);
>-    jit.move(GPRInfo::regT4, GPRInfo::callFrameRegister);
>-    
>     handleExitCounts(jit, exit);
>     reifyInlinedCallFrames(jit, exit);
>     adjustAndJumpToTarget(jit, exit);
>Index: Source/JavaScriptCore/ftl/FTLOutput.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLOutput.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLOutput.h	(working copy)
>@@ -210,6 +210,7 @@ public:
>     LValue castToInt32(LValue value) { return intCast(value, int32); }
>     LValue fpCast(LValue value, LType type) { return buildFPCast(m_builder, value, type); }
>     LValue intToPtr(LValue value, LType type) { return buildIntToPtr(m_builder, value, type); }
>+    LValue ptrToInt(LValue value, LType type) { return buildPtrToInt(m_builder, value, type); }
>     LValue bitCast(LValue value, LType type) { return buildBitCast(m_builder, value, type); }
>     
>     LValue alloca(LType type) { return buildAlloca(m_builder, type); }
>Index: Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp	(working copy)
>@@ -158,13 +158,13 @@ private:
> } // anonymous namespace
> 
> MacroAssembler::Call callOperation(
>-    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit, 
>-    J_JITOperation_ESsiJI operation, GPRReg result, GPRReg callFrameRegister,
>-    StructureStubInfo* stubInfo, GPRReg object, StringImpl* uid)
>+    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit,
>+    J_JITOperation_ESsiJI operation, GPRReg result, StructureStubInfo* stubInfo, GPRReg object,
>+    StringImpl* uid)
> {
>     CallContext context(state, usedRegisters, jit, 4, result);
>-    jit.setupArguments(
>-        callFrameRegister, CCallHelpers::TrustedImmPtr(stubInfo), object,
>+    jit.setupArgumentsWithExecState(
>+        CCallHelpers::TrustedImmPtr(stubInfo), object,
>         CCallHelpers::TrustedImmPtr(uid));
>     return context.makeCall(bitwise_cast<void*>(operation));
>     // FIXME: FTL should support exceptions.
>@@ -173,12 +173,12 @@ MacroAssembler::Call callOperation(
> 
> MacroAssembler::Call callOperation(
>     State& state, const RegisterSet& usedRegisters, CCallHelpers& jit, 
>-    V_JITOperation_ESsiJJI operation, GPRReg callFrameRegister,
>-    StructureStubInfo* stubInfo, GPRReg value, GPRReg object, StringImpl* uid)
>+    V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, GPRReg value, GPRReg object,
>+    StringImpl* uid)
> {
>     CallContext context(state, usedRegisters, jit, 5, InvalidGPRReg);
>-    jit.setupArguments(
>-        callFrameRegister, CCallHelpers::TrustedImmPtr(stubInfo), value, object,
>+    jit.setupArgumentsWithExecState(
>+        CCallHelpers::TrustedImmPtr(stubInfo), value, object,
>         CCallHelpers::TrustedImmPtr(uid));
>     return context.makeCall(bitwise_cast<void*>(operation));
>     // FIXME: FTL should support exceptions.
>Index: Source/JavaScriptCore/ftl/FTLSlowPathCall.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLSlowPathCall.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLSlowPathCall.h	(working copy)
>@@ -57,12 +57,10 @@ private:
> 
> MacroAssembler::Call callOperation(
>     State&, const RegisterSet&, CCallHelpers&, J_JITOperation_ESsiJI,
>-    GPRReg result, GPRReg callFrameRegister, StructureStubInfo*, GPRReg object,
>-    StringImpl* uid);
>+    GPRReg result, StructureStubInfo*, GPRReg object, StringImpl* uid);
> MacroAssembler::Call callOperation(
>     State&, const RegisterSet&, CCallHelpers&, V_JITOperation_ESsiJJI,
>-    GPRReg callFrameRegister, StructureStubInfo*, GPRReg value, GPRReg object,
>-    StringImpl* uid);
>+    StructureStubInfo*, GPRReg value, GPRReg object, StringImpl* uid);
> 
> } } // namespace JSC::FTL
> 
>Index: Source/JavaScriptCore/ftl/FTLState.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLState.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLState.h	(working copy)
>@@ -57,6 +57,7 @@ public:
>     RefPtr<JITCode> jitCode;
>     GeneratedFunction generatedFunction;
>     JITFinalizer* finalizer;
>+    unsigned capturedStackmapID;
>     SegmentedVector<GetByIdDescriptor> getByIds;
>     SegmentedVector<PutByIdDescriptor> putByIds;
>     Vector<CString> codeSectionNames;
>Index: Source/JavaScriptCore/ftl/FTLThunks.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLThunks.cpp	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLThunks.cpp	(working copy)
>@@ -39,9 +39,9 @@ namespace JSC { namespace FTL {
> 
> using namespace DFG;
> 
>-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM& vm, const Location& location)
>+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
> {
>-    AssemblyHelpers jit(&vm, 0);
>+    AssemblyHelpers jit(vm, 0);
>     
>     // Note that the "return address" will be the OSR exit ID.
>     
>@@ -51,7 +51,7 @@ MacroAssemblerCodeRef osrExitGenerationT
>     jit.push(GPRInfo::regT0);
>     jit.push(GPRInfo::regT0);
>     
>-    ScratchBuffer* scratchBuffer = vm.scratchBufferForSize(requiredScratchMemorySizeInBytes());
>+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(requiredScratchMemorySizeInBytes());
>     char* buffer = static_cast<char*>(scratchBuffer->dataBuffer());
>     
>     saveAllRegisters(jit, buffer);
>@@ -60,7 +60,7 @@ MacroAssemblerCodeRef osrExitGenerationT
>     jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
>     jit.storePtr(MacroAssembler::TrustedImmPtr(requiredScratchMemorySizeInBytes()), GPRInfo::nonArgGPR1);
> 
>-    location.restoreInto(jit, buffer, GPRInfo::argumentGPR0, 1);
>+    jit.loadPtr(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
>     jit.peek(GPRInfo::argumentGPR1, 3);
>     MacroAssembler::Call functionCall = jit.call();
>     
>@@ -88,9 +88,9 @@ MacroAssemblerCodeRef osrExitGenerationT
> 
>     jit.ret();
>     
>-    LinkBuffer patchBuffer(vm, &jit, GLOBAL_THUNK_ID);
>+    LinkBuffer patchBuffer(*vm, &jit, GLOBAL_THUNK_ID);
>     patchBuffer.link(functionCall, compileFTLOSRExit);
>-    return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk for callFrame at %s", toCString(location).data()));
>+    return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk"));
> }
> 
> MacroAssemblerCodeRef slowPathCallThunkGenerator(VM& vm, const SlowPathCallKey& key)
>Index: Source/JavaScriptCore/ftl/FTLThunks.h
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLThunks.h	(revision 160566)
>+++ Source/JavaScriptCore/ftl/FTLThunks.h	(working copy)
>@@ -41,7 +41,7 @@ class VM;
> 
> namespace FTL {
> 
>-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM&, const Location&);
>+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM*);
> MacroAssemblerCodeRef slowPathCallThunkGenerator(VM&, const SlowPathCallKey&);
> 
> template<typename KeyTypeArgument>
>@@ -78,12 +78,6 @@ typename MapType::KeyType keyForThunk(Ma
> 
> class Thunks {
> public:
>-    MacroAssemblerCodeRef getOSRExitGenerationThunk(VM& vm, const Location& location)
>-    {
>-        return generateIfNecessary(
>-            vm, m_osrExitThunks, location, osrExitGenerationThunkGenerator);
>-    }
>-    
>     MacroAssemblerCodeRef getSlowPathCallThunk(VM& vm, const SlowPathCallKey& key)
>     {
>         return generateIfNecessary(
>@@ -96,7 +90,6 @@ public:
>     }
>     
> private:
>-    ThunkMap<Location> m_osrExitThunks;
>     ThunkMap<SlowPathCallKey> m_slowPathCallThunks;
> };
> 
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 160566)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -216,7 +216,7 @@ public:
>     static Address tagFor(VirtualRegister virtualRegister)
>     {
>         ASSERT(virtualRegister.isValid());
>-        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
>+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + TagOffset);
>     }
>     static Address tagFor(int operand)
>     {
>@@ -226,7 +226,7 @@ public:
>     static Address payloadFor(VirtualRegister virtualRegister)
>     {
>         ASSERT(virtualRegister.isValid());
>-        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
>+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + PayloadOffset);
>     }
>     static Address payloadFor(int operand)
>     {
>Index: Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp	(revision 160566)
>+++ Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp	(working copy)
>@@ -49,7 +49,7 @@ JITInlineCacheGenerator::JITInlineCacheG
> 
> JITByIdGenerator::JITByIdGenerator(
>     CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet& usedRegisters,
>-    GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value, bool registersFlushed)
>+    JSValueRegs base, JSValueRegs value, bool registersFlushed)
>     : JITInlineCacheGenerator(codeBlock, codeOrigin)
>     , m_base(base)
>     , m_value(value)
>@@ -62,7 +62,6 @@ JITByIdGenerator::JITByIdGenerator(
>     m_stubInfo->patch.usedRegisters.set(base);
>     m_stubInfo->patch.usedRegisters.set(value);
>     
>-    m_stubInfo->patch.callFrameRegister = static_cast<int8_t>(callFrameRegister);
>     m_stubInfo->patch.baseGPR = static_cast<int8_t>(base.payloadGPR());
>     m_stubInfo->patch.valueGPR = static_cast<int8_t>(value.payloadGPR());
> #if USE(JSVALUE32_64)
>@@ -130,11 +129,9 @@ void JITGetByIdGenerator::generateFastPa
> 
> JITPutByIdGenerator::JITPutByIdGenerator(
>     CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet& usedRegisters,
>-    GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value, GPRReg scratch,
>-    bool registersFlushed, ECMAMode ecmaMode, PutKind putKind)
>-    : JITByIdGenerator(
>-        codeBlock, codeOrigin, usedRegisters, callFrameRegister, base, value,
>-        registersFlushed)
>+    JSValueRegs base, JSValueRegs value, GPRReg scratch, bool registersFlushed,
>+    ECMAMode ecmaMode, PutKind putKind)
>+    : JITByIdGenerator(codeBlock, codeOrigin, usedRegisters, base, value, registersFlushed)
>     , m_scratch(scratch)
>     , m_ecmaMode(ecmaMode)
>     , m_putKind(putKind)
>Index: Source/JavaScriptCore/jit/JITInlineCacheGenerator.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlineCacheGenerator.h	(revision 160566)
>+++ Source/JavaScriptCore/jit/JITInlineCacheGenerator.h	(working copy)
>@@ -56,8 +56,8 @@ protected:
>     JITByIdGenerator() { }
> 
>     JITByIdGenerator(
>-        CodeBlock*, CodeOrigin, const RegisterSet&, GPRReg callFrameRegister,
>-        JSValueRegs base, JSValueRegs value, bool registersFlushed);
>+        CodeBlock*, CodeOrigin, const RegisterSet&, JSValueRegs base, JSValueRegs value,
>+        bool registersFlushed);
>     
> public:
>     void reportSlowPathCall(MacroAssembler::Label slowPathBegin, MacroAssembler::Call call)
>@@ -96,11 +96,8 @@ public:
> 
>     JITGetByIdGenerator(
>         CodeBlock* codeBlock, CodeOrigin codeOrigin, const RegisterSet& usedRegisters,
>-        GPRReg callFrameRegister, JSValueRegs base, JSValueRegs value,
>-        bool registersFlushed)
>-        : JITByIdGenerator(
>-            codeBlock, codeOrigin, usedRegisters, callFrameRegister, base, value,
>-            registersFlushed)
>+        JSValueRegs base, JSValueRegs value, bool registersFlushed)
>+        : JITByIdGenerator(codeBlock, codeOrigin, usedRegisters, base, value, registersFlushed)
>     {
>     }
>     
>@@ -112,9 +109,8 @@ public:
>     JITPutByIdGenerator() { }
> 
>     JITPutByIdGenerator(
>-        CodeBlock*, CodeOrigin, const RegisterSet& usedRegisters, GPRReg callFrameRegister,
>-        JSValueRegs base, JSValueRegs value, GPRReg scratch, bool registersFlushed,
>-        ECMAMode, PutKind);
>+        CodeBlock*, CodeOrigin, const RegisterSet& usedRegisters, JSValueRegs base,
>+        JSValueRegs value, GPRReg scratch, bool registersFlushed, ECMAMode, PutKind);
>     
>     void generateFastPath(MacroAssembler&);
>     
>Index: Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(revision 160566)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(working copy)
>@@ -519,7 +519,7 @@ void JIT::emit_op_get_by_id(Instruction*
> 
>     JITGetByIdGenerator gen(
>         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
>-        callFrameRegister, JSValueRegs(regT0), JSValueRegs(regT0), true);
>+        JSValueRegs(regT0), JSValueRegs(regT0), true);
>     gen.generateFastPath(*this);
>     addSlowCase(gen.slowPathJump());
>     m_getByIds.append(gen);
>@@ -565,8 +565,8 @@ void JIT::emit_op_put_by_id(Instruction*
> 
>     JITPutByIdGenerator gen(
>         m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
>-        callFrameRegister, JSValueRegs(regT0), JSValueRegs(regT1), regT2, true,
>-        m_codeBlock->ecmaMode(), direct ? Direct : NotDirect);
>+        JSValueRegs(regT0), JSValueRegs(regT1), regT2, true, m_codeBlock->ecmaMode(),
>+        direct ? Direct : NotDirect);
>     
>     gen.generateFastPath(*this);
>     addSlowCase(gen.slowPathJump());
>Index: Source/JavaScriptCore/jit/Repatch.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/Repatch.cpp	(revision 160566)
>+++ Source/JavaScriptCore/jit/Repatch.cpp	(working copy)
>@@ -47,11 +47,6 @@ namespace JSC {
> // that would ordinarily have well-known values:
> // - tagTypeNumberRegister
> // - tagMaskRegister
>-// - callFrameRegister **
>-//
>-// We currently only use the callFrameRegister for closure call patching, and we're not going to
>-// give the FTL closure call patching support until we switch to the C stack - but when we do that,
>-// callFrameRegister will disappear.
> 
> static FunctionPtr readCallTarget(RepatchBuffer& repatchBuffer, CodeLocationCall call)
> {
>@@ -495,7 +490,6 @@ static bool tryBuildGetByIDList(ExecStat
>         
>         stubInfo.u.getByIdSelfList.listSize++;
>         
>-        GPRReg callFrameRegister = static_cast<GPRReg>(stubInfo.patch.callFrameRegister);
>         GPRReg baseGPR = static_cast<GPRReg>(stubInfo.patch.baseGPR);
> #if USE(JSVALUE32_64)
>         GPRReg resultTagGPR = static_cast<GPRReg>(stubInfo.patch.valueTagGPR);
>@@ -519,6 +513,10 @@ static bool tryBuildGetByIDList(ExecStat
>         MacroAssembler::Jump success;
>         
>         if (slot.isCacheableGetter() || slot.isCacheableCustom()) {
>+            // FIXME: This code shouldn't be assuming that the top of stack is set up for JSC
>+            // JIT-style C calls, since we may be currently on top of an FTL frame.
>+            // https://bugs.webkit.org/show_bug.cgi?id=125711
>+            
>             if (slot.isCacheableGetter()) {
>                 ASSERT(scratchGPR != InvalidGPRReg);
>                 ASSERT(baseGPR != scratchGPR);
>@@ -536,11 +534,11 @@ static bool tryBuildGetByIDList(ExecStat
>                     stubJit.load32(MacroAssembler::Address(scratchGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
> #endif
>                 }
>-                stubJit.setupArguments(callFrameRegister, baseGPR, scratchGPR);
>+                stubJit.setupArgumentsWithExecState(baseGPR, scratchGPR);
>                 operationFunction = operationCallGetter;
>             } else {
>-                stubJit.setupArguments(
>-                    callFrameRegister, baseGPR,
>+                stubJit.setupArgumentsWithExecState(
>+                    baseGPR,
>                     MacroAssembler::TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()),
>                     MacroAssembler::TrustedImmPtr(ident.impl()));
>                 operationFunction = operationCallCustomGetter;
>@@ -793,7 +791,6 @@ static void emitPutTransitionStub(
> {
>     VM* vm = &exec->vm();
> 
>-    GPRReg callFrameRegister = static_cast<GPRReg>(stubInfo.patch.callFrameRegister);
>     GPRReg baseGPR = static_cast<GPRReg>(stubInfo.patch.baseGPR);
> #if USE(JSVALUE32_64)
>     GPRReg valueTagGPR = static_cast<GPRReg>(stubInfo.patch.valueTagGPR);
>@@ -950,9 +947,9 @@ static void emitPutTransitionStub(
>         ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(allocator.desiredScratchBufferSize());
>         allocator.preserveUsedRegistersToScratchBuffer(stubJit, scratchBuffer, scratchGPR1);
> #if USE(JSVALUE64)
>-        stubJit.setupArguments(callFrameRegister, baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR);
>+        stubJit.setupArgumentsWithExecState(baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR);
> #else
>-        stubJit.setupArguments(callFrameRegister, baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR, valueTagGPR);
>+        stubJit.setupArgumentsWithExecState(baseGPR, MacroAssembler::TrustedImmPtr(structure), MacroAssembler::TrustedImm32(slot.cachedOffset()), valueGPR, valueTagGPR);
> #endif
>         operationCall = stubJit.call();
>         allocator.restoreUsedRegistersFromScratchBuffer(stubJit, scratchBuffer, scratchGPR1);
>Index: Source/JavaScriptCore/runtime/JSCJSValue.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSCJSValue.h	(revision 160566)
>+++ Source/JavaScriptCore/runtime/JSCJSValue.h	(working copy)
>@@ -97,6 +97,9 @@ union EncodedValueDescriptor {
> #endif
> };
> 
>+#define TagOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag))
>+#define PayloadOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload))
>+
> enum WhichValueWord {
>     TagWord,
>     PayloadWord

Actions: View | Formatted Diff | Diff

Attachments on bug 125649: 219116 | 219199 | 219204 | 219232 | 219254