Changeset 155711 in webkit

Timestamp:

Sep 13, 2013 11:03:55 AM (11 years ago)

Author:

msaboff@apple.com

Message:

fourthTier: Change JSStack to grow from high to low addresses
​https://bugs.webkit.org/show_bug.cgi?id=118758

Reviewed by Oliver Hunt.

Changed the JSC stack to grow down. Effectively the JSC stack frame is flipped from
what it was. See JSStack.h for the new offsets. Changed JSStack begin() and end()
to be getBaseOfStack() and getLimitOfStack(). Most of the changes are address or offset
calculation changes. Decoupled a local register ordinal (loop variable or array index)
from the offset into the callFrame using localToOperand() and the inverse operandToLocal().

• assembler/MacroAssembler.h:

(JSC::MacroAssembler::trustedImm32ForShift):
(JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index

• assembler/X86Assembler.h:

(JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

• bytecode/CodeBlock.h:

(JSC::unmodifiedArgumentsRegister):
(JSC::CodeBlock::isCaptured):

• bytecode/CodeOrigin.h:

(JSC::CodeOrigin::stackOffset):

• bytecode/Operands.h:

(JSC::localToOperand):
(JSC::operandIsLocal):
(JSC::operandToLocal):
(JSC::operandIsArgument):
(JSC::operandToArgument):
(JSC::argumentToOperand):

• bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in

31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::addVar):
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
(JSC::BytecodeGenerator::newRegister):
(JSC::BytecodeGenerator::emitNewArray):

• bytecompiler/BytecodeGenerator.h:

(JSC::CallArguments::registerOffset):

• bytecompiler/NodesCodegen.cpp:

(JSC::CallArguments::CallArguments):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileFunction):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOperations.cpp:
• dfg/DFGScoreBoard.h:

(JSC::DFG::ScoreBoard::allocate):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callFrameSlot):
(JSC::DFG::SpeculativeJIT::argumentSlot):
(JSC::DFG::SpeculativeJIT::callFrameTagSlot):
(JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
(JSC::DFG::SpeculativeJIT::argumentTagSlot):
(JSC::DFG::SpeculativeJIT::argumentPayloadSlot):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::reportValidationContext):

• ftl/FTLLink.cpp:

(JSC::FTL::link):

• heap/ConservativeRoots.cpp:

(JSC::ConservativeRoots::genericAddSpan):

• interpreter/CallFrame.cpp:

(JSC::CallFrame::frameExtentInternal):

• interpreter/CallFrame.h:

(JSC::ExecState::init):
(JSC::ExecState::argumentOffset):
(JSC::ExecState::argumentOffsetIncludingThis):
(JSC::ExecState::argIndexForRegister):

• interpreter/Interpreter.cpp:

(JSC::loadVarargs):
(JSC::Interpreter::dumpRegisters):

• interpreter/JSStack.cpp:

(JSC::JSStack::JSStack):
(JSC::JSStack::~JSStack):
(JSC::JSStack::growSlowCase):
(JSC::JSStack::gatherConservativeRoots):
(JSC::JSStack::releaseExcessCapacity):
(JSC::JSStack::disableErrorStackReserve):

• interpreter/JSStack.h:

(JSC::JSStack::getBaseOfStack):
(JSC::JSStack::getLimitOfStack):
(JSC::JSStack::size):
(JSC::JSStack::end):
(JSC::JSStack::containsAddress):
(JSC::JSStack::lowAddress):
(JSC::JSStack::highAddress):
(JSC::JSStack::reservationEnd):
(JSC::JSStack::shrink):
(JSC::JSStack::grow):

• interpreter/JSStackInlines.h:

(JSC::JSStack::getTopOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
(JSC::JSStack::installTrapsAfterFrame):

• interpreter/StackVisitor.cpp:

(JSC::inlinedFrameOffset):
(JSC::StackVisitor::readInlinedFrame):

• jit/JIT.cpp:

(JSC::JIT::privateCompile):

• jit/JITCall.cpp:

(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):

• jit/JITCall32_64.cpp:

(JSC::JIT::compileLoadVarargs):
(JSC::JIT::compileOpCall):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_create_activation):
(JSC::JIT::emit_op_get_argument_by_val):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_get_argument_by_val):

• jit/JITStubs.cpp:

(JSC::throwExceptionFromOpCall):
(JSC::DEFINE_STUB_FUNCTION):

• jit/ThunkGenerators.cpp:

(JSC::arityFixup):

• llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::genericCall):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/ArgList.cpp:

(JSC::ArgList::getSlice):
(JSC::MarkedArgumentBuffer::slowAppend):

• runtime/ArgList.h:

(JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::slotFor):
(JSC::MarkedArgumentBuffer::mallocBase):
(JSC::ArgList::at):

• runtime/Arguments.cpp:

(JSC::Arguments::tearOff):

• runtime/ArrayConstructor.cpp:

(JSC::constructArrayWithSizeQuirk):

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/JSActivation.h:

(JSC::JSActivation::registersOffset):
(JSC::JSActivation::tearOff):
(JSC::JSActivation::isValidIndex):

• runtime/JSArray.h:

(JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::globalExec):

• runtime/JSGlobalObject.h:

(JSC::constructArrayNegativeIndexed):

• runtime/JSString.h:
• runtime/Operations.h:

(JSC::jsStringFromRegisterArray):

• runtime/SymbolTable.h:

(JSC::SharedSymbolTable::captureCount):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/MacroAssembler.h (modified) (3 diffs)
• assembler/MacroAssemblerX86_64.h (modified) (1 diff)
• assembler/X86Assembler.h (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (1 diff)
• bytecode/CodeBlock.h (modified) (2 diffs)
• bytecode/CodeOrigin.h (modified) (3 diffs)
• bytecode/Operands.h (modified) (2 diffs)
• bytecode/VirtualRegister.h (modified) (1 diff)
• bytecompiler/BytecodeGenerator.cpp (modified) (9 diffs)
• bytecompiler/BytecodeGenerator.h (modified) (1 diff)
• bytecompiler/NodesCodegen.cpp (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (7 diffs)
• dfg/DFGJITCompiler.cpp (modified) (1 diff)
• dfg/DFGOSREntry.cpp (modified) (1 diff)
• dfg/DFGOSRExitCompiler32_64.cpp (modified) (3 diffs)
• dfg/DFGOSRExitCompiler64.cpp (modified) (1 diff)
• dfg/DFGOperations.cpp (modified) (8 diffs)
• dfg/DFGScoreBoard.h (modified) (2 diffs)
• dfg/DFGSpeculativeJIT.cpp (modified) (4 diffs)
• dfg/DFGSpeculativeJIT.h (modified) (2 diffs)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (4 diffs)
• dfg/DFGSpeculativeJIT64.cpp (modified) (6 diffs)
• dfg/DFGValidate.cpp (modified) (1 diff)
• ftl/FTLLink.cpp (modified) (1 diff)
• heap/ConservativeRoots.cpp (modified) (1 diff)
• interpreter/CallFrame.cpp (modified) (1 diff)
• interpreter/CallFrame.h (modified) (4 diffs)
• interpreter/Interpreter.cpp (modified) (9 diffs)
• interpreter/JSStack.cpp (modified) (7 diffs)
• interpreter/JSStack.h (modified) (7 diffs)
• interpreter/JSStackInlines.h (modified) (4 diffs)
• interpreter/StackVisitor.cpp (modified) (2 diffs)
• jit/JIT.cpp (modified) (1 diff)
• jit/JITCall.cpp (modified) (3 diffs)
• jit/JITCall32_64.cpp (modified) (4 diffs)
• jit/JITOpcodes.cpp (modified) (2 diffs)
• jit/JITOpcodes32_64.cpp (modified) (1 diff)
• jit/JITStubs.cpp (modified) (3 diffs)
• jit/ThunkGenerators.cpp (modified) (5 diffs)
• llint/LLIntData.cpp (modified) (1 diff)
• llint/LLIntSlowPaths.cpp (modified) (6 diffs)
• llint/LowLevelInterpreter.asm (modified) (4 diffs)
• llint/LowLevelInterpreter32_64.asm (modified) (8 diffs)
• llint/LowLevelInterpreter64.asm (modified) (8 diffs)
• runtime/ArgList.cpp (modified) (2 diffs)
• runtime/ArgList.h (modified) (4 diffs)
• runtime/Arguments.cpp (modified) (2 diffs)
• runtime/ArrayConstructor.cpp (modified) (1 diff)
• runtime/CommonSlowPaths.cpp (modified) (1 diff)
• runtime/JSActivation.h (modified) (3 diffs)
• runtime/JSArray.h (modified) (1 diff)
• runtime/JSGlobalObject.cpp (modified) (1 diff)
• runtime/JSGlobalObject.h (modified) (2 diffs)
• runtime/JSString.h (modified) (1 diff)
• runtime/Operations.h (modified) (2 diffs)
• runtime/SymbolTable.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-09-12  Michael Saboff  <msaboff@apple.com>
+
+        fourthTier: Change JSStack to grow from high to low addresses
+        https://bugs.webkit.org/show_bug.cgi?id=118758
+
+        Reviewed by Oliver Hunt.
+
+        Changed the JSC stack to grow down.  Effectively the JSC stack frame is flipped from
+        what it was.  See JSStack.h for the new offsets.  Changed JSStack begin() and end()
+        to be getBaseOfStack() and getLimitOfStack().  Most of the changes are address or offset
+        calculation changes.  Decoupled a local register ordinal (loop variable or array index)
+        from the offset into the callFrame using localToOperand() and the inverse operandToLocal().
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::trustedImm32ForShift):
+        (JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (JSC::unmodifiedArgumentsRegister):
+        (JSC::CodeBlock::isCaptured):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::stackOffset):
+        * bytecode/Operands.h:
+        (JSC::localToOperand):
+        (JSC::operandIsLocal):
+        (JSC::operandToLocal):
+        (JSC::operandIsArgument):
+        (JSC::operandToArgument):
+        (JSC::argumentToOperand):
+        * bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in
+        31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::registerOffset):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::allocate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callFrameSlot):
+        (JSC::DFG::SpeculativeJIT::argumentSlot):
+        (JSC::DFG::SpeculativeJIT::callFrameTagSlot):
+        (JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
+        (JSC::DFG::SpeculativeJIT::argumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::reportValidationContext):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddSpan):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::frameExtentInternal):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::argumentOffset):
+        (JSC::ExecState::argumentOffsetIncludingThis):
+        (JSC::ExecState::argIndexForRegister):
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        (JSC::Interpreter::dumpRegisters):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::~JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::releaseExcessCapacity):
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStack.h:
+        (JSC::JSStack::getBaseOfStack):
+        (JSC::JSStack::getLimitOfStack):
+        (JSC::JSStack::size):
+        (JSC::JSStack::end):
+        (JSC::JSStack::containsAddress):
+        (JSC::JSStack::lowAddress):
+        (JSC::JSStack::highAddress):
+        (JSC::JSStack::reservationEnd):
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::getTopOfFrame):
+        (JSC::JSStack::pushFrame):
+        (JSC::JSStack::popFrame):
+        (JSC::JSStack::installTrapsAfterFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::inlinedFrameOffset):
+        (JSC::StackVisitor::readInlinedFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::throwExceptionFromOpCall):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::genericCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::slotFor):
+        (JSC::MarkedArgumentBuffer::mallocBase):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::registersOffset):
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::isValidIndex):
+        * runtime/JSArray.h:
+        (JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::globalExec):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/JSString.h:
+        * runtime/Operations.h:
+        (JSC::jsStringFromRegisterArray):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::captureCount):
+
 2013-09-13  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/JavaScriptCore/assembler/MacroAssembler.h

@@ -209 +209 @@
 #endif
 
+    // Immediate shifts only have 5 controllable bits
+    // so we'll consider them safe for now.
+    TrustedImm32 trustedImm32ForShift(Imm32 imm)
+    {
+        return TrustedImm32(imm.asTrustedImm32().m_value & 31);
+    }
+
     // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
     void branchPtr(RelationalCondition cond, RegisterID op1, TrustedImmPtr imm, Label target)
@@ -630 +637 @@
     }
     
+    void lshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        lshift64(trustedImm32ForShift(imm), srcDest);
+    }
+
     void negPtr(RegisterID dest)
     {
@@ -1412 +1424 @@
     }
     
-    // Immediate shifts only have 5 controllable bits
-    // so we'll consider them safe for now.
-    TrustedImm32 trustedImm32ForShift(Imm32 imm)
-    {
-        return TrustedImm32(imm.asTrustedImm32().m_value & 31);
-    }
-
     void lshift32(Imm32 imm, RegisterID dest)
     {

trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h

@@ -226 +226 @@
     }
     
+    void lshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shlq_i8r(imm.m_value, dest);
+    }
+    
     void neg64(RegisterID dest)
     {

trunk/Source/JavaScriptCore/assembler/X86Assembler.h

@@ -820 +820 @@
         }
     }
+
+    void shlq_i8r(int imm, RegisterID dst)
+    {
+        if (imm == 1)
+            m_formatter.oneByteOp64(OP_GROUP2_Ev1, GROUP2_OP_SHL, dst);
+        else {
+            m_formatter.oneByteOp64(OP_GROUP2_EvIb, GROUP2_OP_SHL, dst);
+            m_formatter.immediate8(imm);
+        }
+    }
 #endif
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -508 +508 @@
         out.printf(
             "; %d captured var(s) (from r%d to r%d, inclusive)",
-            symbolTable()->captureCount(), symbolTable()->captureStart(), symbolTable()->captureEnd() - 1);
+            symbolTable()->captureCount(), symbolTable()->captureStart(), symbolTable()->captureEnd() + 1);
     }
     if (usesArguments()) {

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -87 +87 @@
 class RepatchBuffer;
 
-inline int unmodifiedArgumentsRegister(int argumentsRegister) { return argumentsRegister - 1; }
+inline int unmodifiedArgumentsRegister(int argumentsRegister) { return argumentsRegister + 1; }
 
 static ALWAYS_INLINE int missingThisObjectMarker() { return std::numeric_limits<int>::max(); }
@@ -387 +387 @@
             return false;
 
-        return operand >= symbolTable()->captureStart()
-        && operand < symbolTable()->captureEnd();
+        return operand <= symbolTable()->captureStart()
+            && operand > symbolTable()->captureEnd();
     }
 

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -77 +77 @@
     ScriptExecutable* codeOriginOwner() const;
     
-    unsigned stackOffset() const;
+    int stackOffset() const;
     
     static unsigned inlineDepthForCallFrame(InlineCallFrame*);
@@ -98 +98 @@
     CodeOrigin caller;
     BitVector capturedVars; // Indexed by the machine call frame's variable numbering.
-    signed int stackOffset : 31;
+    signed stackOffset : 31;
     bool isCall : 1;
     
@@ -120 +120 @@
 };
 
-inline unsigned CodeOrigin::stackOffset() const
+inline int CodeOrigin::stackOffset() const
 {
     if (!inlineCallFrame)

trunk/Source/JavaScriptCore/bytecode/Operands.h

@@ -29 +29 @@
 #include "CallFrame.h"
 #include "JSObject.h"
-#include "VirtualRegister.h"
 #include <wtf/PrintStream.h>
 #include <wtf/Vector.h>
@@ -35 +34 @@
 namespace JSC {
 
-inline VirtualRegister localToOperand(int local) { return (VirtualRegister)local; }
-inline bool operandIsLocal(int operand) { return operand >= 0; }
-inline int operandToLocal(int operand) { return operand; }
+inline int localToOperand(int local) { return -local; }
+inline bool operandIsLocal(int operand) { return operand <= 0; }
+inline int operandToLocal(int operand) { return -operand; }
 
 // argument 0 is 'this'.
-inline bool operandIsArgument(int operand) { return operand < 0; }
-inline int operandToArgument(int operand) { return -operand + CallFrame::thisArgumentOffset(); }
-inline int argumentToOperand(int argument) { return -argument + CallFrame::thisArgumentOffset(); }
+inline bool operandIsArgument(int operand) { return operand > 0; }
+inline int operandToArgument(int operand) { return operand - CallFrame::thisArgumentOffset(); }
+inline int argumentToOperand(int argument) { return argument + CallFrame::thisArgumentOffset(); }
 
 template<typename T> struct OperandValueTraits;

trunk/Source/JavaScriptCore/bytecode/VirtualRegister.h

@@ -34 +34 @@
 // Type for a virtual register number (spill location).
 // Using an enum to make this type-checked at compile time, to avert programmer errors.
-enum VirtualRegister { InvalidVirtualRegister = 0x7fffffff };
+enum VirtualRegister { InvalidVirtualRegister = 0x3fffffff };
 COMPILE_ASSERT(sizeof(VirtualRegister) == sizeof(int), VirtualRegister_is_32bit);
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -117 +117 @@
 {
     ConcurrentJITLocker locker(symbolTable().m_lock);
-    int index = m_calleeRegisters.size();
+    int index = localToOperand(m_calleeRegisters.size());
     SymbolTableEntry newEntry(index, isConstant ? ReadOnly : 0);
     SymbolTable::Map::AddResult result = symbolTable().add(locker, ident.impl(), newEntry);
@@ -224 +224 @@
     }
 
-    m_symbolTable->setCaptureStart(m_codeBlock->m_numVars);
+    m_symbolTable->setCaptureStart(localToOperand(m_codeBlock->m_numVars));
 
     if (functionBody->usesArguments() || codeBlock->usesEval()) { // May reify arguments object.
@@ -311 +311 @@
     }
 
-    m_symbolTable->setCaptureEnd(codeBlock->m_numVars);
+    m_symbolTable->setCaptureEnd(localToOperand(codeBlock->m_numVars));
 
     m_firstLazyFunction = codeBlock->m_numVars;
@@ -326 +326 @@
             else {
                 emitInitLazyRegister(reg.get());
-                m_lazyFunctions.set(reg->index(), function);
+                m_lazyFunctions.set(localToOperand(reg->index()), function);
             }
         }
@@ -338 +338 @@
 
     if (shouldCaptureAllTheThings)
-        m_symbolTable->setCaptureEnd(codeBlock->m_numVars);
+        m_symbolTable->setCaptureEnd(localToOperand(codeBlock->m_numVars));
 
     FunctionParameters& parameters = *functionBody->parameters();
@@ -345 +345 @@
     // Add "this" as a parameter
     int nextParameterIndex = CallFrame::thisArgumentOffset();
-    m_thisRegister.setIndex(nextParameterIndex--);
+    m_thisRegister.setIndex(nextParameterIndex++);
     m_codeBlock->addParameter();
     
-    for (size_t i = 0; i < parameters.size(); ++i, --nextParameterIndex) {
+    for (size_t i = 0; i < parameters.size(); ++i, ++nextParameterIndex) {
         int index = nextParameterIndex;
         if (capturedArguments.size() && capturedArguments[i]) {
@@ -506 +506 @@
 RegisterID* BytecodeGenerator::createLazyRegisterIfNecessary(RegisterID* reg)
 {
-    if (m_lastLazyFunction <= reg->index() || reg->index() < m_firstLazyFunction)
+    int localVariableNumber = operandToLocal(reg->index());
+    
+    if (m_lastLazyFunction <= localVariableNumber || localVariableNumber < m_firstLazyFunction)
         return reg;
-    emitLazyNewFunction(reg, m_lazyFunctions.get(reg->index()));
+    emitLazyNewFunction(reg, m_lazyFunctions.get(localVariableNumber));
     return reg;
 }
@@ -514 +516 @@
 RegisterID* BytecodeGenerator::newRegister()
 {
-    m_calleeRegisters.append(m_calleeRegisters.size());
+    m_calleeRegisters.append(localToOperand(m_calleeRegisters.size()));
     m_codeBlock->m_numCalleeRegisters = max<int>(m_codeBlock->m_numCalleeRegisters, m_calleeRegisters.size());
     return &m_calleeRegisters.last();
@@ -1485 +1487 @@
         argv.append(newTemporary());
         // op_new_array requires the initial values to be a sequential range of registers
-        ASSERT(argv.size() == 1 || argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
+        ASSERT(argv.size() == 1 || argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() - 1);
         emitNode(argv.last().get(), n->value());
     }

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -67 +67 @@
         RegisterID* thisRegister() { return m_argv[0].get(); }
         RegisterID* argumentRegister(unsigned i) { return m_argv[i + 1].get(); }
-        unsigned registerOffset() { return m_argv.last()->index() + CallFrame::offsetFor(argumentCountIncludingThis()); }
+        unsigned registerOffset() { return -m_argv.last()->index() + CallFrame::offsetFor(argumentCountIncludingThis()); }
         unsigned argumentCountIncludingThis() { return m_argv.size(); }
         RegisterID* profileHookRegister() { return m_profileHookRegister.get(); }

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -394 +394 @@
     for (int i = argumentCountIncludingThis - 1; i >= 0; --i) {
         m_argv[i] = generator.newTemporary();
-        ASSERT(static_cast<size_t>(i) == m_argv.size() - 1 || m_argv[i]->index() == m_argv[i + 1]->index() + 1);
+        ASSERT(static_cast<size_t>(i) == m_argv.size() - 1 || m_argv[i]->index() == m_argv[i + 1]->index() - 1);
     }
 }

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -390 +390 @@
             if (!inlineCallFrame)
                 break;
-            if (operand >= static_cast<int>(inlineCallFrame->stackOffset - JSStack::CallFrameHeaderSize))
+            if (operand <= static_cast<int>(inlineCallFrame->stackOffset + JSStack::CallFrameHeaderSize))
                 continue;
             if (operand == inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset())
                 continue;
-            if (operand < static_cast<int>(inlineCallFrame->stackOffset - JSStack::CallFrameHeaderSize - inlineCallFrame->arguments.size()))
+            if (operand > static_cast<int>(inlineCallFrame->stackOffset + JSStack::CallFrameHeaderSize + inlineCallFrame->arguments.size()))
                 continue;
             int argument = operandToArgument(operand - inlineCallFrame->stackOffset);
@@ -774 +774 @@
             m_parameterSlots = JSStack::CallFrameHeaderSize + argCount;
 
-        int registerOffset = currentInstruction[4].u.operand;
+        int registerOffset = -currentInstruction[4].u.operand;
         int dummyThisArgument = op == Call ? 0 : 1;
         for (int i = 0 + dummyThisArgument; i < argCount; ++i)
@@ -1159 +1159 @@
     
     int argumentCountIncludingThis = currentInstruction[3].u.operand;
-    int registerOffset = currentInstruction[4].u.operand;
+    int registerOffset = -currentInstruction[4].u.operand;
 
     int resultOperand = currentInstruction[1].u.operand;
@@ -1284 +1284 @@
     // FIXME: Don't flush constants!
     
-    int inlineCallFrameStart = m_inlineStackTop->remapOperand(registerOffset) - JSStack::CallFrameHeaderSize;
+    int inlineCallFrameStart = m_inlineStackTop->remapOperand(registerOffset) + JSStack::CallFrameHeaderSize;
     
     // Make sure that the area used by the call frame is reserved.
@@ -1958 +1958 @@
             int numOperands = currentInstruction[3].u.operand;
             ArrayAllocationProfile* profile = currentInstruction[4].u.arrayAllocationProfile;
-            for (int operandIdx = startOperand; operandIdx < startOperand + numOperands; ++operandIdx)
+            for (int operandIdx = startOperand; operandIdx > startOperand - numOperands; --operandIdx)
                 addVarArgChild(get(operandIdx));
             set(currentInstruction[1].u.operand, addToGraph(Node::VarArg, NewArray, OpInfo(profile->selectIndexingType()), OpInfo(0)));
@@ -2238 +2238 @@
             OwnArrayPtr<Node*> toStringNodes = adoptArrayPtr(new Node*[numOperands]);
             for (int i = 0; i < numOperands; i++)
-                toStringNodes[i] = addToGraph(ToString, get(startOperand + i));
+                toStringNodes[i] = addToGraph(ToString, get(startOperand - i));
 
             for (int i = 0; i < numOperands; i++)
@@ -3370 +3370 @@
             byteCodeParser->m_codeBlock->ownerExecutable(), 
             codeBlock->ownerExecutable());
-        inlineCallFrame.stackOffset = inlineCallFrameStart + JSStack::CallFrameHeaderSize;
+        inlineCallFrame.stackOffset = inlineCallFrameStart - JSStack::CallFrameHeaderSize;
         if (callee) {
             initializeLazyWriteBarrierForInlineCallFrameCallee(

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -372 +372 @@
     // Plant a check that sufficient space is available in the JSStack.
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
-    addPtr(TrustedImm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
-    Jump stackCheck = branchPtr(Below, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), GPRInfo::regT1);
+    addPtr(TrustedImm32(-m_codeBlock->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
+    Jump stackCheck = branchPtr(Above, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), GPRInfo::regT1);
     // Return here after stack check.
     Label fromStackCheck = label();

trunk/Source/JavaScriptCore/dfg/DFGOSREntry.cpp

@@ -168 +168 @@
     //    would have otherwise just kept running albeit less quickly.
     
-    if (!vm->interpreter->stack().grow(&exec->registers()[codeBlock->m_numCalleeRegisters])) {
+    if (!vm->interpreter->stack().grow(&exec->registers()[localToOperand(codeBlock->m_numCalleeRegisters)])) {
         if (Options::verboseOSR())
             dataLogF("    OSR failed because stack growth failed.\n");

trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp

@@ -546 +546 @@
             case UnboxedBooleanInGPR: {
                 m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + poisonIndex(virtualRegister)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
-                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor(localToOperand(virtualRegister)));
+                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)localToOperand(virtualRegister)));
                 uint32_t tag = JSValue::EmptyValueTag;
                 if (recovery.technique() == InGPR)
@@ -554 +554 @@
                 else
                     tag = JSValue::BooleanTag;
-                m_jit.store32(AssemblyHelpers::TrustedImm32(tag), AssemblyHelpers::tagFor(localToOperand(virtualRegister)));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(tag), AssemblyHelpers::tagFor((VirtualRegister)localToOperand(virtualRegister)));
                 break;
             }
@@ -563 +563 @@
                 m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + poisonIndex(virtualRegister)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
                 m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + poisonIndex(virtualRegister)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag), GPRInfo::regT1);
-                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor(localToOperand(virtualRegister)));
-                m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor(localToOperand(virtualRegister)));
+                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)localToOperand(virtualRegister)));
+                m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor((VirtualRegister)localToOperand(virtualRegister)));
                 break;
                 

trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp

@@ -532 +532 @@
             case InFPR:
                 m_jit.load64(scratchDataBuffer + poisonIndex(virtualRegister), GPRInfo::regT0);
-                m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(localToOperand(virtualRegister)));
+                m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)localToOperand(virtualRegister)));
                 break;
                 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -1415 +1415 @@
     NativeCallFrameTracer tracer(vm, exec);
     
-    return bitwise_cast<char*>(constructArray(exec, arrayStructure, static_cast<JSValue*>(buffer), size));
+    return bitwise_cast<char*>(constructArrayNegativeIndexed(exec, arrayStructure, static_cast<JSValue*>(buffer), size));
 }
 
@@ -1441 +1441 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-    return bitwise_cast<char*>(constructArray(exec, arrayStructure, exec->codeBlock()->constantBuffer(start), size));
+    return bitwise_cast<char*>(constructArrayNegativeIndexed(exec, arrayStructure, exec->codeBlock()->constantBuffer(start), size));
 }
 
@@ -2259 +2259 @@
 HIDE_SYMBOL(getHostCallReturnValue) "\n"
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "mov -40(%r13), %r13\n"
+    "mov 40(%r13), %r13\n"
     "mov %r13, %rdi\n"
     "jmp " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
@@ -2269 +2269 @@
 HIDE_SYMBOL(getHostCallReturnValue) "\n"
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "mov -40(%edi), %edi\n"
+    "mov 40(%edi), %edi\n"
     "mov %edi, 4(%esp)\n"
     "jmp " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
@@ -2282 +2282 @@
 ".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "ldr r5, [r5, #-40]" "\n"
+    "ldr r5, [r5, #40]" "\n"
     "mov r0, r5" "\n"
     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
@@ -2293 +2293 @@
 INLINE_ARM_FUNCTION(getHostCallReturnValue)
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "ldr r5, [r5, #-40]" "\n"
+    "ldr r5, [r5, #40]" "\n"
     "mov r0, r5" "\n"
     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
@@ -2304 +2304 @@
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
     LOAD_FUNCTION_TO_T9(getHostCallReturnValueWithExecState)
-    "lw $s0, -40($s0)" "\n"
+    "lw $s0, 40($s0)" "\n"
     "move $a0, $s0" "\n"
     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
@@ -2314 +2314 @@
 HIDE_SYMBOL(getHostCallReturnValue) "\n"
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "add #-40, r14" "\n"
+    "add #40, r14" "\n"
     "mov.l @r14, r14" "\n"
     "mov r14, r4" "\n"

trunk/Source/JavaScriptCore/dfg/DFGScoreBoard.h

@@ -90 +90 @@
             ASSERT(!m_used[index]);
             m_highWatermark = std::max(m_highWatermark, static_cast<unsigned>(index) + 1);
-            return localToOperand(index);
+            return (VirtualRegister)localToOperand(index);
         }
 
@@ -97 +97 @@
         m_used.append(0);
         m_highWatermark = std::max(m_highWatermark, static_cast<unsigned>(next) + 1);
-        return localToOperand(next);
+        return (VirtualRegister)localToOperand(next);
     }
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -4033 +4033 @@
     
     m_jit.move(propertyReg, resultReg);
-    m_jit.neg32(resultReg);
     m_jit.signExtend32ToPtr(resultReg, resultReg);
     m_jit.loadPtr(
@@ -4043 +4042 @@
         MacroAssembler::BaseIndex(
             scratchReg, resultReg, MacroAssembler::TimesEight,
-            CallFrame::thisArgumentOffset() * sizeof(Register) - sizeof(Register) +
+            CallFrame::thisArgumentOffset() * sizeof(Register) + sizeof(Register) +
             OBJECT_OFFSETOF(JSValue, u.asBits.tag)),
         resultTagReg);
@@ -4049 +4048 @@
         MacroAssembler::BaseIndex(
             scratchReg, resultReg, MacroAssembler::TimesEight,
-            CallFrame::thisArgumentOffset() * sizeof(Register) - sizeof(Register) +
+            CallFrame::thisArgumentOffset() * sizeof(Register) + sizeof(Register) +
             OBJECT_OFFSETOF(JSValue, u.asBits.payload)),
         resultReg);
@@ -4057 +4056 @@
         MacroAssembler::BaseIndex(
             scratchReg, resultReg, MacroAssembler::TimesEight,
-            CallFrame::thisArgumentOffset() * sizeof(Register) - sizeof(Register)),
+            CallFrame::thisArgumentOffset() * sizeof(Register) + sizeof(Register)),
         resultReg);
     jsValueResult(resultReg, node);

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -751 +751 @@
     MacroAssembler::Address callFrameSlot(int slot)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)));
     }
 
@@ -757 +757 @@
     MacroAssembler::Address argumentSlot(int argument)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)));
     }
 
     MacroAssembler::Address callFrameTagSlot(int slot)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
     }
 
     MacroAssembler::Address callFramePayloadSlot(int slot)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + slot) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     }
 
     MacroAssembler::Address argumentTagSlot(int argument)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
     }
 
     MacroAssembler::Address argumentPayloadSlot(int argument)
     {
-        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (-m_jit.codeBlock()->m_numCalleeRegisters + argumentToOperand(argument)) * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     }
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -740 +740 @@
     m_jit.beginCall(node->codeOrigin, token);
     
-    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(-(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register))), GPRInfo::callFrameRegister);
     
     slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));
@@ -4425 +4425 @@
 
         int captureEnd = symbolTable->captureEnd();
-        for (int i = symbolTable->captureStart(); i < captureEnd; ++i) {
+        for (int i = symbolTable->captureStart(); i > captureEnd; --i) {
             m_jit.loadPtr(
                 JITCompiler::Address(
@@ -4612 +4612 @@
         slowArgumentOutOfBounds.link(&m_jit);
 
-        m_jit.neg32(resultPayloadGPR);
-        
         m_jit.load32(
             JITCompiler::BaseIndex(
@@ -4688 +4686 @@
         slowArgumentOutOfBounds.link(&m_jit);
 
-        m_jit.neg32(resultPayloadGPR);
-        
         m_jit.load32(
             JITCompiler::BaseIndex(

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -706 +706 @@
     m_jit.beginCall(node->codeOrigin, token);
     
-    m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.addPtr(TrustedImm32(-(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register))), GPRInfo::callFrameRegister);
     
     slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleeGPR, targetToCheck, MacroAssembler::TrustedImmPtr(0)));
@@ -2765 +2765 @@
     
             m_jit.move(propertyReg, scratch2Reg);
-            m_jit.neg32(scratch2Reg);
             m_jit.signExtend32ToPtr(scratch2Reg, scratch2Reg);
             m_jit.loadPtr(
@@ -2775 +2774 @@
                 MacroAssembler::BaseIndex(
                     scratchReg, scratch2Reg, MacroAssembler::TimesEight,
-                    CallFrame::thisArgumentOffset() * sizeof(Register) - sizeof(Register)));
+                    CallFrame::thisArgumentOffset() * sizeof(Register) + sizeof(Register)));
             
             noResult(node);
@@ -4303 +4302 @@
 
         int captureEnd = symbolTable->captureEnd();
-        for (int i = symbolTable->captureStart(); i < captureEnd; ++i) {
+        for (int i = symbolTable->captureStart(); i > captureEnd; --i) {
             m_jit.load64(
                 JITCompiler::Address(
@@ -4454 +4453 @@
         slowArgumentOutOfBounds.link(&m_jit);
 
-        m_jit.neg32(resultGPR);
         m_jit.signExtend32ToPtr(resultGPR, resultGPR);
             
@@ -4519 +4517 @@
         slowArgumentOutOfBounds.link(&m_jit);
 
-        m_jit.neg32(resultGPR);
         m_jit.signExtend32ToPtr(resultGPR, resultGPR);
         

trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp

@@ -432 +432 @@
     void reportValidationContext(VirtualRegister local, BasicBlock* block)
     {
+        if (!block) {
+            dataLog("r", static_cast<int>(local), " in null Block ");
+            return;
+        }
+
         dataLog("r", static_cast<int>(local), " in Block ", *block);
     }

trunk/Source/JavaScriptCore/ftl/FTLLink.cpp

@@ -76 +76 @@
         // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
         jit.addPtr(
-            CCallHelpers::TrustedImm32(codeBlock->m_numCalleeRegisters * sizeof(Register)),
+            CCallHelpers::TrustedImm32(-codeBlock->m_numCalleeRegisters * sizeof(Register)),
             GPRInfo::callFrameRegister, GPRInfo::regT1);
         CCallHelpers::Jump stackCheck = jit.branchPtr(
-            CCallHelpers::Below,
+            CCallHelpers::Above,
             CCallHelpers::AbsoluteAddress(state.graph.m_vm.interpreter->stack().addressOfEnd()),
             GPRInfo::regT1);

trunk/Source/JavaScriptCore/heap/ConservativeRoots.cpp

@@ -94 +94 @@
 void ConservativeRoots::genericAddSpan(void* begin, void* end, MarkHook& markHook)
 {
-    ASSERT(begin <= end);
+    if (begin > end) {
+        void* swapTemp = begin;
+        begin = end;
+        end = swapTemp;
+    }
+
     ASSERT((static_cast<char*>(end) - static_cast<char*>(begin)) < 0x1000000);
     ASSERT(isPointerAligned(begin));

trunk/Source/JavaScriptCore/interpreter/CallFrame.cpp

@@ -95 +95 @@
     CodeBlock* codeBlock = this->codeBlock();
     ASSERT(codeBlock);
-    return registers() + codeBlock->m_numCalleeRegisters;
+    return registers() - codeBlock->m_numCalleeRegisters;
 }
 

trunk/Source/JavaScriptCore/interpreter/CallFrame.h

@@ -215 +215 @@
         {
             ASSERT(callerFrame); // Use noCaller() rather than 0 for the outer host call frame caller.
-            ASSERT(callerFrame == noCaller() || callerFrame->removeHostCallFrameFlag()->stack()->end() >= this);
+            ASSERT(callerFrame == noCaller() || callerFrame->removeHostCallFrameFlag()->stack()->containsAddress(this));
 
             setCodeBlock(codeBlock);
@@ -233 +233 @@
         size_t argumentCount() const { return argumentCountIncludingThis() - 1; }
         size_t argumentCountIncludingThis() const { return this[JSStack::ArgumentCount].payload(); }
-        static int argumentOffset(int argument) { return s_firstArgumentOffset - argument; }
-        static int argumentOffsetIncludingThis(int argument) { return s_thisArgumentOffset - argument; }
+        static int argumentOffset(int argument) { return (s_firstArgumentOffset + argument); }
+        static int argumentOffsetIncludingThis(int argument) { return (s_thisArgumentOffset + argument); }
 
         // In the following (argument() and setArgument()), the 'argument'
@@ -294 +294 @@
     private:
         static const intptr_t HostCallFrameFlag = 1;
-        static const int s_thisArgumentOffset = -1 - JSStack::CallFrameHeaderSize;
-        static const int s_firstArgumentOffset = s_thisArgumentOffset - 1;
+        static const int s_thisArgumentOffset = JSStack::CallFrameHeaderSize + 1;
+        static const int s_firstArgumentOffset = s_thisArgumentOffset + 1;
 
 #ifndef NDEBUG
@@ -319 +319 @@
             // Hence:
             //       argIndex = s_firstArgumentOffset - offset;
-            size_t argIndex = s_firstArgumentOffset - offset;
+            size_t argIndex = offset - s_firstArgumentOffset;
             return argIndex;
         }

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -153 +153 @@
     if (!arguments) { // f.apply(x, arguments), with arguments unmodified.
         unsigned argumentCountIncludingThis = callFrame->argumentCountIncludingThis();
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + argumentCountIncludingThis + JSStack::CallFrameHeaderSize);
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister - argumentCountIncludingThis - JSStack::CallFrameHeaderSize);
         if (argumentCountIncludingThis > Arguments::MaxArguments + 1 || !stack->grow(newCallFrame->registers())) {
             callFrame->vm().throwException(callFrame, createStackOverflowError(callFrame));
@@ -167 +167 @@
 
     if (arguments.isUndefinedOrNull()) {
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + 1 + JSStack::CallFrameHeaderSize);
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister - 1 - JSStack::CallFrameHeaderSize);
         if (!stack->grow(newCallFrame->registers())) {
             callFrame->vm().throwException(callFrame, createStackOverflowError(callFrame));
@@ -185 +185 @@
         Arguments* argsObject = asArguments(arguments);
         unsigned argCount = argsObject->length(callFrame);
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister - CallFrame::offsetFor(argCount + 1));
         if (argCount > Arguments::MaxArguments || !stack->grow(newCallFrame->registers())) {
             callFrame->vm().throwException(callFrame, createStackOverflowError(callFrame));
@@ -199 +199 @@
         JSArray* array = asArray(arguments);
         unsigned argCount = array->length();
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister - CallFrame::offsetFor(argCount + 1));
         if (argCount > Arguments::MaxArguments || !stack->grow(newCallFrame->registers())) {
             callFrame->vm().throwException(callFrame, createStackOverflowError(callFrame));
@@ -212 +212 @@
     JSObject* argObject = asObject(arguments);
     unsigned argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
-    CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
+    CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister - CallFrame::offsetFor(argCount + 1));
     if (argCount > Arguments::MaxArguments || !stack->grow(newCallFrame->registers())) {
         callFrame->vm().throwException(callFrame,  createStackOverflowError(callFrame));
@@ -314 +314 @@
     const Register* end;
 
-    it = callFrame->registers() - JSStack::CallFrameHeaderSize - callFrame->argumentCountIncludingThis();
-    end = callFrame->registers() - JSStack::CallFrameHeaderSize;
-    while (it < end) {
+    it = callFrame->registers() + JSStack::CallFrameHeaderSize + callFrame->argumentCountIncludingThis();
+    end = callFrame->registers() + JSStack::CallFrameHeaderSize;
+    while (it > end) {
         JSValue v = it->jsValue();
         int registerNumber = it - callFrame->registers();
@@ -326 +326 @@
     dataLogF("-----------------------------------------------------------------------------\n");
     dataLogF("[ArgumentCount]            | %10p | %lu \n", it, (unsigned long) callFrame->argumentCount());
-    ++it;
+    --it;
     dataLogF("[CallerFrame]              | %10p | %p \n", it, callFrame->callerFrame());
-    ++it;
+    --it;
     dataLogF("[Callee]                   | %10p | %p \n", it, callFrame->callee());
-    ++it;
+    --it;
     dataLogF("[ScopeChain]               | %10p | %p \n", it, callFrame->scope());
-    ++it;
+    --it;
 #if ENABLE(JIT)
     AbstractPC pc = callFrame->abstractReturnPC(callFrame->vm());
@@ -343 +343 @@
 
     dataLogF("[CodeBlock]                | %10p | %p \n", it, callFrame->codeBlock());
-    ++it;
+    --it;
     dataLogF("-----------------------------------------------------------------------------\n");
 
     int registerCount = 0;
 
-    end = it + codeBlock->m_numVars;
+    end = it - codeBlock->m_numVars;
     if (it != end) {
         do {
@@ -355 +355 @@
             String name = codeBlock->nameForRegister(registerNumber);
             dataLogF("[r% 3d %14s]      | %10p | %-16s 0x%lld \n", registerNumber, name.ascii().data(), it, toCString(v).data(), (long long)JSValue::encode(v));
-            ++it;
-            ++registerCount;
+            --it;
+            --registerCount;
         } while (it != end);
     }

trunk/Source/JavaScriptCore/interpreter/JSStack.cpp

@@ -51 +51 @@
 
     m_reservation = PageReservation::reserve(roundUpAllocationSize(capacity * sizeof(Register), commitSize), OSAllocator::JSVMStackPages);
-    m_end = static_cast<Register*>(m_reservation.base());
-    m_commitEnd = static_cast<Register*>(m_reservation.base());
+    m_end = highAddress();
+    m_commitEnd = highAddress();
 
     disableErrorStackReserve();
@@ -61 +61 @@
 JSStack::~JSStack()
 {
-    void* base = m_reservation.base();
-    m_reservation.decommit(base, reinterpret_cast<intptr_t>(m_commitEnd) - reinterpret_cast<intptr_t>(base));
-    addToCommittedByteCount(-(reinterpret_cast<intptr_t>(m_commitEnd) - reinterpret_cast<intptr_t>(base)));
+    void* highAddress = reinterpret_cast_ptr<void*>(static_cast<char*>(m_reservation.base()) + m_reservation.size());
+    m_reservation.decommit(reinterpret_cast_ptr<void*>(m_commitEnd), reinterpret_cast<intptr_t>(highAddress) - reinterpret_cast<intptr_t>(m_commitEnd));
+    addToCommittedByteCount(-(reinterpret_cast<intptr_t>(highAddress) - reinterpret_cast<intptr_t>(m_commitEnd)));
     m_reservation.deallocate();
 }
@@ -71 +71 @@
     // If we have already committed enough memory to satisfy this request,
     // just update the end pointer and return.
-    if (newEnd <= m_commitEnd) {
+    if (newEnd >= m_commitEnd) {
         m_end = newEnd;
         return true;
@@ -79 +79 @@
     // have it is still within our budget. If not, we'll fail to grow and
     // return false.
-    long delta = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
-    if (reinterpret_cast<char*>(m_commitEnd) + delta > reinterpret_cast<char*>(m_useableEnd))
+    long delta = roundUpAllocationSize(reinterpret_cast<char*>(m_commitEnd) - reinterpret_cast<char*>(newEnd), commitSize);
+    if (reinterpret_cast<char*>(m_commitEnd) - delta <= reinterpret_cast<char*>(m_useableEnd))
         return false;
 
     // Otherwise, the growth is still within our budget. Go ahead and commit
     // it and return true.
-    m_reservation.commit(m_commitEnd, delta);
+    m_reservation.commit(reinterpret_cast<char*>(m_commitEnd) - delta, delta);
     addToCommittedByteCount(delta);
-    m_commitEnd = reinterpret_cast_ptr<Register*>(reinterpret_cast<char*>(m_commitEnd) + delta);
+    m_commitEnd = reinterpret_cast_ptr<Register*>(reinterpret_cast<char*>(m_commitEnd) - delta);
     m_end = newEnd;
     return true;
@@ -94 +94 @@
 void JSStack::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
 {
-    conservativeRoots.add(begin(), getTopOfStack());
+    conservativeRoots.add(getBaseOfStack(), getTopOfStack());
 }
 
 void JSStack::gatherConservativeRoots(ConservativeRoots& conservativeRoots, JITStubRoutineSet& jitStubRoutines, CodeBlockSet& codeBlocks)
 {
-    conservativeRoots.add(begin(), getTopOfStack(), jitStubRoutines, codeBlocks);
+    conservativeRoots.add(getBaseOfStack(), getTopOfStack(), jitStubRoutines, codeBlocks);
 }
 
 void JSStack::releaseExcessCapacity()
 {
-    ptrdiff_t delta = reinterpret_cast<uintptr_t>(m_commitEnd) - reinterpret_cast<uintptr_t>(m_reservation.base());
-    m_reservation.decommit(m_reservation.base(), delta);
+    ptrdiff_t delta = reinterpret_cast<uintptr_t>(highAddress()) - reinterpret_cast<uintptr_t>(m_commitEnd);
+    m_reservation.decommit(m_commitEnd, delta);
     addToCommittedByteCount(-delta);
-    m_commitEnd = static_cast<Register*>(m_reservation.base());
+    m_commitEnd = highAddress();
 }
 
@@ -135 +135 @@
 void JSStack::disableErrorStackReserve()
 {
-    char* useableEnd = reinterpret_cast<char*>(reservationEnd()) - commitSize;
+    char* useableEnd = reinterpret_cast<char*>(reservationEnd()) + commitSize;
     m_useableEnd = reinterpret_cast_ptr<Register*>(useableEnd);
 
@@ -143 +143 @@
     // enabled the reserve was not previously in use. Hence, it is safe to
     // shrink back to that m_useableEnd.
-    if (m_end > m_useableEnd) {
-        ASSERT(m_topCallFrame->frameExtent() <= m_useableEnd);
+    if (m_end < m_useableEnd) {
+        ASSERT(m_topCallFrame->frameExtent() >= m_useableEnd);
         shrink(m_useableEnd);
     }

trunk/Source/JavaScriptCore/interpreter/JSStack.h

@@ -55 +55 @@
             CallFrameHeaderSize = 6,
 
-            ArgumentCount = -6,
-            CallerFrame = -5,
-            Callee = -4,
-            ScopeChain = -3,
-            ReturnPC = -2, // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
-            CodeBlock = -1,
+            ArgumentCount = 6,
+            CallerFrame = 5,
+            Callee = 4,
+            ScopeChain = 3,
+            ReturnPC = 2, // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
+            CodeBlock = 1,
         };
 
@@ -74 +74 @@
         void gatherConservativeRoots(ConservativeRoots&, JITStubRoutineSet&, CodeBlockSet&);
 
-        Register* begin() const { return static_cast<Register*>(m_reservation.base()); }
-        Register* end() const { return m_end; }
-        size_t size() const { return end() - begin(); }
+        Register* getBaseOfStack() const
+        {
+            return highAddress() - 1;
+        }
+
+        Register* getLimitOfStack() const { return m_end; }
+        size_t size() const { return highAddress() - lowAddress(); }
 
         bool grow(Register*);
@@ -91 +95 @@
         Register* getStartOfFrame(CallFrame*);
         Register* getTopOfStack();
+        Register* end() const { return m_end; }
 
         CallFrame* pushFrame(CallFrame* callerFrame, class CodeBlock*,
@@ -96 +101 @@
 
         void popFrame(CallFrame*);
+
+        bool containsAddress(Register* address) { return (lowAddress() <= address && address <= highAddress()); }
 
         void enableErrorStackReserve();
@@ -110 +117 @@
 
     private:
+        Register* lowAddress() const
+        {
+            return m_end;
+        }
+
+        Register* highAddress() const
+        {
+            return reinterpret_cast_ptr<Register*>(static_cast<char*>(m_reservation.base()) + m_reservation.size());
+        }
+
         Register* reservationEnd() const
         {
-            char* base = static_cast<char*>(m_reservation.base());
-            char* reservationEnd = base + m_reservation.size();
+            char* reservationEnd = static_cast<char*>(m_reservation.base());
             return reinterpret_cast_ptr<Register*>(reservationEnd);
         }
@@ -143 +159 @@
             return;
         m_end = newEnd;
-        if (m_end == m_reservation.base() && (m_commitEnd - begin()) >= maxExcessCapacity)
+        if (m_end == getBaseOfStack() && (m_commitEnd - getBaseOfStack()) >= maxExcessCapacity)
             releaseExcessCapacity();
     }
@@ -149 +165 @@
     inline bool JSStack::grow(Register* newEnd)
     {
-        if (newEnd <= m_end)
+        if (newEnd >= m_end)
             return true;
         return growSlowCase(newEnd);

trunk/Source/JavaScriptCore/interpreter/JSStackInlines.h

@@ -36 +36 @@
 {
     if (UNLIKELY(!frame))
-        return begin();
+        return getBaseOfStack();
     return frame->frameExtent();
 }
@@ -65 +65 @@
     }
 
-    Register* newCallFrameSlot = oldEnd + paddedArgsCount + JSStack::CallFrameHeaderSize;
+    Register* newCallFrameSlot = oldEnd - paddedArgsCount - JSStack::CallFrameHeaderSize;
+
 #if ENABLE(DEBUG_JSSTACK)
-    newCallFrameSlot += JSStack::FenceSize;
+    newCallFrameSlot -= JSStack::FenceSize;
 #endif
+
     Register* newEnd = newCallFrameSlot;
     if (!!codeBlock)
-        newEnd += codeBlock->m_numCalleeRegisters;
+        newEnd -= codeBlock->m_numCalleeRegisters;
 
     // Ensure that we have the needed stack capacity to push the new frame:
@@ -121 +123 @@
     // are no more frames on the stack.
     if (!callerFrame)
-        shrink(begin());
+        shrink(getBaseOfStack());
 
     installTrapsAfterFrame(callerFrame);
@@ -213 +215 @@
     const int sizeOfTrap = 64;
     int32_t* startOfTrap = reinterpret_cast<int32_t*>(topOfFrame);
-    int32_t* endOfTrap = startOfTrap + sizeOfTrap;
+    int32_t* endOfTrap = startOfTrap - sizeOfTrap;
     int32_t* endOfCommitedMemory = reinterpret_cast<int32_t*>(m_commitEnd);
 
     // Make sure we're not exceeding the amount of available memory to write to:
-    if (endOfTrap > endOfCommitedMemory)
+    if (endOfTrap < endOfCommitedMemory)
         endOfTrap = endOfCommitedMemory;
 
     // Lay the traps:
     int32_t* p = startOfTrap;
-    while (p < endOfTrap)
-        *p++ = 0xabadcafe; // A bad word to trigger a crash if deref'ed.
+    while (p > endOfTrap)
+        *p-- = 0xabadcafe; // A bad word to trigger a crash if deref'ed.
 }
 #endif // ENABLE(DEBUG_JSSTACK)

trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp

@@ -118 +118 @@
 
 #if ENABLE(DFG_JIT)
-static unsigned inlinedFrameOffset(CodeOrigin* codeOrigin)
+static int inlinedFrameOffset(CodeOrigin* codeOrigin)
 {
     InlineCallFrame* inlineCallFrame = codeOrigin->inlineCallFrame;
-    unsigned frameOffset = inlineCallFrame ? inlineCallFrame->stackOffset : 0;
+    int frameOffset = inlineCallFrame ? inlineCallFrame->stackOffset : 0;
     return frameOffset;
 }
@@ -130 +130 @@
     ASSERT(!callFrame->hasHostCallFrameFlag());
 
-    unsigned frameOffset = inlinedFrameOffset(codeOrigin);
+    int frameOffset = inlinedFrameOffset(codeOrigin);
     bool isInlined = !!frameOffset;
     if (isInlined) {

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -617 +617 @@
 #endif
 
-        addPtr(TrustedImm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
-        stackCheck = branchPtr(Below, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT1);
+        addPtr(TrustedImm32(-m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+        stackCheck = branchPtr(Above, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT1);
     }
 

trunk/Source/JavaScriptCore/jit/JITCall.cpp

@@ -89 +89 @@
 
         move(regT0, regT1);
-        add32(TrustedImm32(firstFreeRegister + JSStack::CallFrameHeaderSize), regT1);
-        lshift32(TrustedImm32(3), regT1);
+        neg64(regT1);
+        add64(TrustedImm32(firstFreeRegister - JSStack::CallFrameHeaderSize), regT1);
+        lshift64(TrustedImm32(3), regT1);
         addPtr(callFrameRegister, regT1);
         // regT1: newCallFrame
 
-        slowCase.append(branchPtr(Below, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT1));
+        slowCase.append(branchPtr(Above, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT1));
 
         // Initialize ArgumentCount.
@@ -104 +105 @@
 
         // Copy arguments.
-        neg32(regT0);
         signExtend32ToPtr(regT0, regT0);
-        end.append(branchAdd64(Zero, TrustedImm32(1), regT0));
-        // regT0: -argumentCount
+        end.append(branchSub64(Zero, TrustedImm32(1), regT0));
+        // regT0: argumentCount
 
         Label copyLoop = label();
         load64(BaseIndex(callFrameRegister, regT0, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT2);
         store64(regT2, BaseIndex(regT1, regT0, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))));
-        branchAdd64(NonZero, TrustedImm32(1), regT0).linkTo(copyLoop, this);
+        branchSub64(NonZero, TrustedImm32(1), regT0).linkTo(copyLoop, this);
 
         end.append(jump());
@@ -176 +176 @@
     else {
         int argCount = instruction[3].u.operand;
-        int registerOffset = instruction[4].u.operand;
+        int registerOffset = -instruction[4].u.operand;
 
         if (opcodeID == op_call && shouldEmitProfiling()) {

trunk/Source/JavaScriptCore/jit/JITCall32_64.cpp

@@ -158 +158 @@
 
         move(regT2, regT3);
-        add32(TrustedImm32(firstFreeRegister + JSStack::CallFrameHeaderSize), regT3);
+        neg32(regT3);
+        add32(TrustedImm32(firstFreeRegister - JSStack::CallFrameHeaderSize), regT3);
         lshift32(TrustedImm32(3), regT3);
         addPtr(callFrameRegister, regT3);
         // regT3: newCallFrame
 
-        slowCase.append(branchPtr(Below, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT3));
+        slowCase.append(branchPtr(Above, AbsoluteAddress(m_vm->interpreter->stack().addressOfEnd()), regT3));
 
         // Initialize ArgumentCount.
@@ -174 +175 @@
 
         // Copy arguments.
-        neg32(regT2);
-        end.append(branchAdd32(Zero, TrustedImm32(1), regT2));
-        // regT2: -argumentCount;
+        end.append(branchSub32(Zero, TrustedImm32(1), regT2));
+        // regT2: argumentCount;
 
         Label copyLoop = label();
@@ -183 +183 @@
         store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) +(CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
         store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) +(CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
-        branchAdd32(NonZero, TrustedImm32(1), regT2).linkTo(copyLoop, this);
+        branchSub32(NonZero, TrustedImm32(1), regT2).linkTo(copyLoop, this);
 
         end.append(jump());
@@ -247 +247 @@
     else {
         int argCount = instruction[3].u.operand;
-        int registerOffset = instruction[4].u.operand;
+        int registerOffset = -instruction[4].u.operand;
         
         if (opcodeID == op_call && shouldEmitProfiling()) {

trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -845 +845 @@
     
     Jump activationCreated = branchTest64(NonZero, Address(callFrameRegister, sizeof(Register) * dst));
-    JITStubCall(this, cti_op_push_activation).call(currentInstruction[1].u.operand);
-    emitPutVirtualRegister(dst);
+    JITStubCall(this, cti_op_push_activation).call(dst);
     activationCreated.link(this);
 }
@@ -1116 +1115 @@
     addSlowCase(branch32(AboveOrEqual, regT1, regT2));
 
-    neg32(regT1);
     signExtend32ToPtr(regT1, regT1);
     load64(BaseIndex(callFrameRegister, regT1, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT0);

trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

@@ -1244 +1244 @@
     addSlowCase(branch32(AboveOrEqual, regT2, regT3));
     
-    neg32(regT2);
     loadPtr(BaseIndex(callFrameRegister, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) + CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT0);
     loadPtr(BaseIndex(callFrameRegister, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) + CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT1);

trunk/Source/JavaScriptCore/jit/JITStubs.cpp

@@ -409 +409 @@
     CallFrame* callFrame = newCallFrame->callerFrame()->removeHostCallFrameFlag();
     jitStackFrame.callFrame = callFrame;
+    ASSERT(callFrame);
     callFrame->vm().topCallFrame = callFrame;
     if (createError)
@@ -439 +440 @@
     CallFrame* callFrame = stackFrame.callFrame;
 
-    if (UNLIKELY(!stackFrame.stack->grow(&callFrame->registers()[callFrame->codeBlock()->m_numCalleeRegisters]))) {
+    if (UNLIKELY(!stackFrame.stack->grow(&callFrame->registers()[-callFrame->codeBlock()->m_numCalleeRegisters]))) {
         ErrorWithExecFunctor functor = ErrorWithExecFunctor(createStackOverflowError);
         return throwExceptionFromOpCall<void*>(stackFrame, callFrame, STUB_RETURN_ADDRESS, &functor);
@@ -1478 +1479 @@
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return constructArray(stackFrame.callFrame, stackFrame.args[2].arrayAllocationProfile(), reinterpret_cast<JSValue*>(&stackFrame.callFrame->registers()[stackFrame.args[0].int32()]), stackFrame.args[1].int32());
+    return constructArrayNegativeIndexed(stackFrame.callFrame, stackFrame.args[2].arrayAllocationProfile(), reinterpret_cast<JSValue*>(&stackFrame.callFrame->registers()[stackFrame.args[0].int32()]), stackFrame.args[1].int32());
 }
 

trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

@@ -429 +429 @@
     jit.pop(JSInterfaceJIT::regT4);
 #  endif
-    jit.addPtr(JSInterfaceJIT::TrustedImm32(-8), JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
+    jit.neg64(JSInterfaceJIT::regT0);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
     jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, JSStack::ArgumentCount * 8), JSInterfaceJIT::regT2);
     jit.add32(JSInterfaceJIT::TrustedImm32(JSStack::CallFrameHeaderSize), JSInterfaceJIT::regT2);
 
-    // Move current frame regT0 number of slots
+    // Move current frame down regT0 number of slots
     JSInterfaceJIT::Label copyLoop(jit.label());
     jit.load64(JSInterfaceJIT::regT3, JSInterfaceJIT::regT1);
     jit.store64(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
-    jit.subPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
     jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(copyLoop, &jit);
 
@@ -445 +446 @@
     JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
     jit.store64(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight));
-    jit.subPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
-    jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
 
     // Adjust call frame register to account for missing args
-    jit.lshift32(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT0);
+    jit.lshift64(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT0);
     jit.addPtr(JSInterfaceJIT::regT0, JSInterfaceJIT::callFrameRegister);
 
@@ -460 +461 @@
     jit.pop(JSInterfaceJIT::regT4);
 #  endif
-    jit.addPtr(JSInterfaceJIT::TrustedImm32(-8), JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
+    jit.neg32(JSInterfaceJIT::regT0);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
     jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, JSStack::ArgumentCount * 8), JSInterfaceJIT::regT2);
     jit.add32(JSInterfaceJIT::TrustedImm32(JSStack::CallFrameHeaderSize), JSInterfaceJIT::regT2);
 
-    // Move current frame regT0 number of slots
+    // Move current frame down regT0 number of slots
     JSInterfaceJIT::Label copyLoop(jit.label());
     jit.load32(JSInterfaceJIT::regT3, JSInterfaceJIT::regT1);
@@ -470 +472 @@
     jit.load32(MacroAssembler::Address(JSInterfaceJIT::regT3, 4), JSInterfaceJIT::regT1);
     jit.store32(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight, 4));
-    jit.subPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
     jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(copyLoop, &jit);
 
@@ -481 +483 @@
     jit.store32(JSInterfaceJIT::regT1, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::regT0, JSInterfaceJIT::TimesEight, 4));
 
-    jit.subPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
-    jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::regT2).linkTo(fillUndefinedLoop, &jit);
 
     // Adjust call frame register to account for missing args

trunk/Source/JavaScriptCore/llint/LLIntData.cpp

@@ -72 +72 @@
     // prepared to change LowLevelInterpreter.asm as well!!
     ASSERT(JSStack::CallFrameHeaderSize * 8 == 48);
-    ASSERT(JSStack::ArgumentCount * 8 == -48);
-    ASSERT(JSStack::CallerFrame * 8 == -40);
-    ASSERT(JSStack::Callee * 8 == -32);
-    ASSERT(JSStack::ScopeChain * 8 == -24);
-    ASSERT(JSStack::ReturnPC * 8 == -16);
-    ASSERT(JSStack::CodeBlock * 8 == -8);
-    ASSERT(CallFrame::argumentOffsetIncludingThis(0) == -JSStack::CallFrameHeaderSize - 1);
+    ASSERT(JSStack::ArgumentCount * 8 == 48);
+    ASSERT(JSStack::CallerFrame * 8 == 40);
+    ASSERT(JSStack::Callee * 8 == 32);
+    ASSERT(JSStack::ScopeChain * 8 == 24);
+    ASSERT(JSStack::ReturnPC * 8 == 16);
+    ASSERT(JSStack::CodeBlock * 8 == 8);
+    ASSERT(CallFrame::argumentOffsetIncludingThis(0) == JSStack::CallFrameHeaderSize + 1);
 #if CPU(BIG_ENDIAN)
     ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 0);

trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -246 +246 @@
 LLINT_SLOW_PATH_DECL(trace)
 {
-    dataLogF("%p / %p: executing bc#%zu, %s, scope %p\n",
+    dataLogF("%p / %p: executing bc#%zu, %s, scope %p, pc = %p\n",
             exec->codeBlock(),
             exec,
             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
             opcodeNames[exec->vm().interpreter->getOpcodeID(pc[0].u.opcode)],
-            exec->scope());
+            exec->scope(), pc);
     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
         dataLogF("Will be returning to %p\n", exec->returnPC().value());
@@ -430 +430 @@
     dataLogF("Current end is at %p.\n", exec->vm().interpreter->stack().end());
 #endif
-    ASSERT(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters] > exec->vm().interpreter->stack().end());
-    if (UNLIKELY(!vm.interpreter->stack().grow(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters]))) {
+    ASSERT(!exec->vm().interpreter->stack().containsAddress(&exec->registers()[-exec->codeBlock()->m_numCalleeRegisters]));
+    if (UNLIKELY(!vm.interpreter->stack().grow(&exec->registers()[-exec->codeBlock()->m_numCalleeRegisters]))) {
         ReturnAddressPtr returnPC = exec->returnPC();
         exec = exec->callerFrame();
@@ -460 +460 @@
 {
     LLINT_BEGIN();
-    LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
+    LLINT_RETURN(constructArrayNegativeIndexed(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
 }
 
@@ -1055 +1055 @@
     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
     
-    ExecState* execCallee = exec + pc[4].u.operand;
+    ExecState* execCallee = exec - pc[4].u.operand;
     
     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
@@ -1104 +1104 @@
     JSValue calleeAsValue = LLINT_OP(2).jsValue();
     
-    ExecState* execCallee = exec + pc[4].u.operand;
+    ExecState* execCallee = exec - pc[4].u.operand;
     
     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
@@ -1144 +1144 @@
 {
     LLINT_BEGIN();
-    LLINT_RETURN(jsString(exec, &LLINT_OP(2), pc[3].u.operand));
+    LLINT_RETURN(jsStringFromRegisterArray(exec, &LLINT_OP(2), pc[3].u.operand));
 }
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

@@ -34 +34 @@
 const CallFrameHeaderSize = 48
 const CallFrameHeaderSlots = 6
-const ArgumentCount = -48
-const CallerFrame = -40
-const Callee = -32
-const ScopeChain = -24
-const ReturnPC = -16
-const CodeBlock = -8
-
-const ThisArgumentOffset = -CallFrameHeaderSize - 8
+const ArgumentCount = 48
+const CallerFrame = 40
+const Callee = 32
+const ScopeChain = 24
+const ReturnPC = 16
+const CodeBlock = 8
+
+const ThisArgumentOffset = CallFrameHeaderSize + 8
 
 # Some value representation constants.
@@ -67 +67 @@
 if JSVALUE64
     # - Use a pair of registers to represent the PC: one register for the
-    #   base of the stack, and one register for the index.
+    #   base of the bytecodes, and one register for the index.
     # - The PC base (or PB for short) should be stored in the csr. It will
     #   get clobbered on calls to other JS code, but will get saved on calls
@@ -351 +351 @@
         loadp CodeBlock::m_argumentValueProfiles + VectorBufferOffset[t1], t3
         mulp sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
-        negp t0
         lshiftp 3, t0
         addp t2, t3
     .argumentProfileLoop:
         if JSVALUE64
-            loadq ThisArgumentOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            loadq ThisArgumentOffset - 8 + profileArgSkip * 8[cfr, t0], t2
             subp sizeof ValueProfile, t3
             storeq t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets[t3]
         else
-            loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            loadi ThisArgumentOffset + TagOffset - 8 + profileArgSkip * 8[cfr, t0], t2
             subp sizeof ValueProfile, t3
             storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
-            loadi ThisArgumentOffset + PayloadOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+            loadi ThisArgumentOffset + PayloadOffset - 8 + profileArgSkip * 8[cfr, t0], t2
             storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
         end
-        baddpnz 8, t0, .argumentProfileLoop
+        baddpnz -8, t0, .argumentProfileLoop
     .argumentProfileDone:
     end
@@ -374 +373 @@
     loadp CodeBlock::m_vm[t1], t2
     loadp VM::interpreter[t2], t2   # FIXME: Can get to the JSStack from the JITStackFrame
-    lshifti 3, t0
-    addp t0, cfr, t0
-    bpaeq Interpreter::m_stack + JSStack::m_end[t2], t0, .stackHeightOK
+    lshiftp 3, t0
+    subp cfr, t0, t0
+    bpbeq Interpreter::m_stack + JSStack::m_end[t2], t0, .stackHeightOK
 
     # Stack height check failed - need to call a slow_path.

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -314 +314 @@
     btiz t1, .continue
 
-    // Move frame down "t1" slots
+    // Move frame up "t1" slots
+    negi t1
     move cfr, t3
-    subp 8, t3
+    addp 8, t3
     loadi PayloadOffset + ArgumentCount[cfr], t2
     addi CallFrameHeaderSlots, t2
@@ -324 +325 @@
     loadi TagOffset[t3], t0
     storei t0, TagOffset[t3, t1, 8]
-    subp 8, t3
+    addp 8, t3
     bsubinz 1, t2, .copyLoop
 
@@ -334 +335 @@
     move UndefinedTag, t0
     storei t0, TagOffset[t3, t1, 8]
-    subp 8, t3
-    bsubinz 1, t2, .fillLoop
+    addp 8, t3
+    baddinz 1, t2, .fillLoop
 
     lshiftp 3, t1
@@ -356 +357 @@
     move UndefinedTag, t0
     move 0, t1
+    negi t2
 .opEnterLoop:
-    subi 1, t2
+    addi 1, t2
     storei t0, TagOffset[cfr, t2, 8]
     storei t1, PayloadOffset[cfr, t2, 8]
@@ -1233 +1235 @@
     loadi ArgumentCount + PayloadOffset[cfr], t1
     biaeq t2, t1, .opGetArgumentByValSlow
-    negi t2
     loadi 4[PC], t3
     loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
@@ -1575 +1576 @@
     if VALUE_PROFILER
         loadi 16[PC], t3
+        negi t3
         bineq ThisArgumentOffset + TagOffset[cfr, t3, 8], CellTag, .done
         loadi ThisArgumentOffset + PayloadOffset[cfr, t3, 8], t0
@@ -1592 +1594 @@
     loadi 16[PC], t3
     lshifti 3, t3
+    negi t3
     addp cfr, t3  # t3 contains the new value of cfr
     loadp JSFunction::m_scope[t2], t0
@@ -1622 +1625 @@
     traceExecution()
     loadi 4[PC], t0
-    subi 1, t0   # Get the unmodifiedArgumentsRegister
+    addi 1, t0   # Get the unmodifiedArgumentsRegister
     bieq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffArgumentsNotCreated
     callSlowPath(_llint_slow_path_tear_off_arguments)

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -200 +200 @@
     btiz t1, .continue
 
-    // Move frame down "t1" slots
+    // Move frame up "t1" slots
+    negq t1
     move cfr, t3
-    subp 8, t3
+    addp 8, t3
     loadi PayloadOffset + ArgumentCount[cfr], t2
     addi CallFrameHeaderSlots, t2
@@ -208 +209 @@
     loadq [t3], t0
     storeq t0, [t3, t1, 8]
-    subp 8, t3
+    addp 8, t3
     bsubinz 1, t2, .copyLoop
 
@@ -216 +217 @@
 .fillLoop:
     storeq t0, [t3, t1, 8]
-    subp 8, t3
-    bsubinz 1, t2, .fillLoop
+    addp 8, t3
+    baddinz 1, t2, .fillLoop
 
     lshiftp 3, t1
@@ -239 +240 @@
     btiz t2, .opEnterDone
     move ValueUndefined, t0
+    negi t2
+    sxi2q t2, t2
 .opEnterLoop:
-    subi 1, t2
+    addq 1, t2
     storeq t0, [cfr, t2, 8]
-    btinz t2, .opEnterLoop
+    btqnz t2, .opEnterLoop
 .opEnterDone:
     dispatch(1)
@@ -1080 +1083 @@
     loadi ArgumentCount + PayloadOffset[cfr], t1
     biaeq t2, t1, .opGetArgumentByValSlow
-    negi t2
-    sxi2q t2, t2
     loadisFromInstruction(1, t3)
     loadpFromInstruction(5, t1)
@@ -1423 +1424 @@
     if VALUE_PROFILER
         loadisFromInstruction(4, t3)
+        negp t3
         loadq ThisArgumentOffset[cfr, t3, 8], t0
         btqnz t0, tagMask, .done
@@ -1440 +1442 @@
     loadisFromInstruction(4, t3)
     lshifti 3, t3
+    negp t3
     addp cfr, t3
     loadp JSFunction::m_scope[t2], t0
@@ -1468 +1471 @@
     traceExecution()
     loadisFromInstruction(1, t0)
-    subi 1, t0   # Get the unmodifiedArgumentsRegister
+    addq 1, t0   # Get the unmodifiedArgumentsRegister
     btqz [cfr, t0, 8], .opTearOffArgumentsNotCreated
     callSlowPath(_llint_slow_path_tear_off_arguments)

trunk/Source/JavaScriptCore/runtime/ArgList.cpp

@@ -38 +38 @@
     }
 
-    result.m_args = m_args - startIndex;
+    result.m_args = m_args + startIndex;
     result.m_argCount =  m_argCount - startIndex;
 }
@@ -55 +55 @@
 {
     int newCapacity = m_capacity * 4;
-    EncodedJSValue* newBuffer = &(new EncodedJSValue[newCapacity])[newCapacity - 1];
+    EncodedJSValue* newBuffer = new EncodedJSValue[newCapacity];
     for (int i = 0; i < m_capacity; ++i)
-        newBuffer[-i] = m_buffer[-i];
+        newBuffer[i] = m_buffer[i];
 
     if (EncodedJSValue* base = mallocBase())

trunk/Source/JavaScriptCore/runtime/ArgList.h

@@ -47 +47 @@
         : m_size(0)
         , m_capacity(inlineCapacity)
-        , m_buffer(&m_inlineBuffer[m_capacity - 1])
+        , m_buffer(m_inlineBuffer)
         , m_markSet(0)
     {
@@ -105 +105 @@
     EncodedJSValue& slotFor(int item) const
     {
-        return m_buffer[-item];
+        return m_buffer[item];
     }
         
@@ -112 +112 @@
         if (m_capacity == static_cast<int>(inlineCapacity))
             return 0;
-        return &slotFor(m_capacity - 1);
+        return &slotFor(0);
     }
         
@@ -164 +164 @@
         if (i >= m_argCount)
             return jsUndefined();
-        return m_args[-i];
+        return m_args[i];
     }
 

trunk/Source/JavaScriptCore/runtime/Arguments.cpp

@@ -313 +313 @@
     
     m_registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[m_numArguments]);
-    m_registers = m_registerArray.get() + CallFrame::offsetFor(m_numArguments + 1);
+    m_registers = m_registerArray.get() - CallFrame::offsetFor(1) - 1;
 
     // If we have a captured argument that logically aliases activation storage,
@@ -359 +359 @@
     
     m_registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[m_numArguments]);
-    m_registers = m_registerArray.get() + CallFrame::offsetFor(m_numArguments + 1);
+    m_registers = m_registerArray.get() - CallFrame::offsetFor(1) - 1;
 
     tearOffForInlineCallFrame(

trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp

@@ -77 +77 @@
 {
     if (!length.isNumber())
-        return constructArray(exec, profile, globalObject, &length, 1);
+        return constructArrayNegativeIndexed(exec, profile, globalObject, &length, 1);
     
     uint32_t n = length.toUInt32(exec);

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -464 +464 @@
 {
     BEGIN();
-    RETURN(jsString(exec, &OP(2), pc[3].u.operand));
+    RETURN(jsStringFromRegisterArray(exec, &OP(2), pc[3].u.operand));
 }
 

trunk/Source/JavaScriptCore/runtime/JSActivation.h

@@ -136 +136 @@
     inline int JSActivation::registersOffset(SharedSymbolTable* symbolTable)
     {
-        return storageOffset() - (symbolTable->captureStart() * sizeof(WriteBarrier<Unknown>));
+        return storageOffset() + ((symbolTable->captureCount() - symbolTable->captureStart()  - 1) * sizeof(WriteBarrier<Unknown>));
     }
 
@@ -148 +148 @@
 
         int captureEnd = symbolTable()->captureEnd();
-        for (int i = symbolTable()->captureStart(); i < captureEnd; ++i)
+        for (int i = symbolTable()->captureStart(); i > captureEnd; --i)
             dst[i].set(vm, this, src[i].get());
 
@@ -181 +181 @@
     inline bool JSActivation::isValidIndex(int index) const
     {
-        if (index < symbolTable()->captureStart())
+        if (index > symbolTable()->captureStart())
             return false;
-        if (index >= symbolTable()->captureEnd())
+        if (index <= symbolTable()->captureEnd())
             return false;
         return true;

trunk/Source/JavaScriptCore/runtime/JSArray.h

@@ -321 +321 @@
 }
 
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
+{
+    VM& vm = exec->vm();
+    JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    RELEASE_ASSERT(array);
+
+    for (int i = 0; i < static_cast<int>(length); ++i)
+        array->initializeIndex(vm, i, values[-i]);
+    return array;
+}
+
 } // namespace JSC
 

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

@@ -654 +654 @@
 ExecState* JSGlobalObject::globalExec()
 {
-    return CallFrame::create(m_globalCallFrame + JSStack::CallFrameHeaderSize);
+    return CallFrame::create(m_globalCallFrame);
 }
 

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

@@ -141 +141 @@
 protected:
 
-    Register m_globalCallFrame[JSStack::CallFrameHeaderSize];
+    // Add one so we don't need to index with -1 to get current frame pointer.
+    // An index of -1 is an error for some compilers.
+    Register m_globalCallFrame[JSStack::CallFrameHeaderSize + 1];
 
     WriteBarrier<JSObject> m_globalThis;
@@ -605 +607 @@
 }
 
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length)
+{
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, globalObject->arrayStructureForProfileDuringAllocation(profile), values, length));
+}
+
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length)
+{
+    return constructArrayNegativeIndexed(exec, profile, exec->lexicalGlobalObject(), values, length);
+}
+
 class DynamicGlobalObjectScope {
     WTF_MAKE_NONCOPYABLE(DynamicGlobalObjectScope);

trunk/Source/JavaScriptCore/runtime/JSString.h

@@ -313 +313 @@
             
     private:
-        friend JSValue jsString(ExecState*, Register*, unsigned);
+        friend JSValue jsStringFromRegisterArray(ExecState*, Register*, unsigned);
         friend JSValue jsStringFromArguments(ExecState*, JSValue);
 

trunk/Source/JavaScriptCore/runtime/Operations.h

@@ -80 +80 @@
 }
 
-ALWAYS_INLINE JSValue jsString(ExecState* exec, Register* strings, unsigned count)
+ALWAYS_INLINE JSValue jsStringFromRegisterArray(ExecState* exec, Register* strings, unsigned count)
 {
     VM* vm = &exec->vm();
@@ -88 +88 @@
 
     for (unsigned i = 0; i < count; ++i) {
-        JSValue v = strings[i].jsValue();
+        JSValue v = strings[-static_cast<int>(i)].jsValue();
         ropeBuilder.append(v.toString(exec));
 

trunk/Source/JavaScriptCore/runtime/SymbolTable.h

@@ -465 +465 @@
     void setCaptureEnd(int captureEnd) { m_captureEnd = captureEnd; }
 
-    int captureCount() { return m_captureEnd - m_captureStart; }
+    int captureCount() { return -(m_captureEnd - m_captureStart); }
 
     int parameterCount() { return m_parameterCountIncludingThis - 1; }