Changeset 90423 in webkit

Timestamp:

Jul 5, 2011 5:56:49 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-07-05 Filip Pizlo <​fpizlo@apple.com>

DFG JIT does not implement op_call.
​https://bugs.webkit.org/show_bug.cgi?id=63858

Reviewed by Gavin Barraclough.

• bytecode/CodeBlock.cpp: (JSC::CodeBlock::unlinkCalls):
• bytecode/CodeBlock.h: (JSC::CodeBlock::setNumberOfCallLinkInfos): (JSC::CodeBlock::numberOfCallLinkInfos):
• bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitCall): (JSC::BytecodeGenerator::emitConstruct):
• dfg/DFGAliasTracker.h: (JSC::DFG::AliasTracker::lookupGetByVal): (JSC::DFG::AliasTracker::recordCall): (JSC::DFG::AliasTracker::equalIgnoringLaterNumericConversion):
• dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::ByteCodeParser): (JSC::DFG::ByteCodeParser::getLocal): (JSC::DFG::ByteCodeParser::getArgument): (JSC::DFG::ByteCodeParser::toInt32): (JSC::DFG::ByteCodeParser::addToGraph): (JSC::DFG::ByteCodeParser::addVarArgChild): (JSC::DFG::ByteCodeParser::predictInt32): (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::processPhiStack): (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
• dfg/DFGGraph.cpp: (JSC::DFG::Graph::opName): (JSC::DFG::Graph::dump): (JSC::DFG::Graph::refChildren):
• dfg/DFGGraph.h:
• dfg/DFGJITCodeGenerator.cpp: (JSC::DFG::JITCodeGenerator::useChildren): (JSC::DFG::JITCodeGenerator::emitCall):
• dfg/DFGJITCodeGenerator.h: (JSC::DFG::JITCodeGenerator::addressOfCallData):
• dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::compileFunction):
• dfg/DFGJITCompiler.h: (JSC::DFG::CallRecord::CallRecord): (JSC::DFG::JITCompiler::notifyCall): (JSC::DFG::JITCompiler::appendCallWithFastExceptionCheck): (JSC::DFG::JITCompiler::addJSCall): (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord): (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
• dfg/DFGNode.h: (JSC::DFG::Node::Node): (JSC::DFG::Node::child1): (JSC::DFG::Node::child2): (JSC::DFG::Node::child3): (JSC::DFG::Node::firstChild): (JSC::DFG::Node::numChildren):
• dfg/DFGNonSpeculativeJIT.cpp: (JSC::DFG::NonSpeculativeJIT::basicArithOp): (JSC::DFG::NonSpeculativeJIT::compare): (JSC::DFG::NonSpeculativeJIT::compile):
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGRepatch.cpp: (JSC::DFG::dfgLinkCall):
• dfg/DFGRepatch.h:
• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch): (JSC::DFG::SpeculativeJIT::compilePeepHoleCall): (JSC::DFG::SpeculativeJIT::compile):
• dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
• interpreter/CallFrame.h: (JSC::ExecState::calleeAsValue):
• jit/JIT.cpp: (JSC::JIT::JIT): (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases): (JSC::JIT::privateCompile): (JSC::JIT::linkCall): (JSC::JIT::linkConstruct):
• jit/JITCall.cpp: (JSC::JIT::compileOpCall):
• jit/JITCode.h: (JSC::JITCode::JITCode): (JSC::JITCode::jitType): (JSC::JITCode::HostFunction):
• runtime/JSFunction.h:
• runtime/JSGlobalData.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (2 diffs)
• bytecode/CodeBlock.h (modified) (2 diffs)
• bytecompiler/BytecodeGenerator.cpp (modified) (2 diffs)
• dfg/DFGAliasTracker.h (modified) (3 diffs)
• dfg/DFGByteCodeParser.cpp (modified) (14 diffs)
• dfg/DFGGraph.cpp (modified) (3 diffs)
• dfg/DFGGraph.h (modified) (1 diff)
• dfg/DFGJITCodeGenerator.cpp (modified) (2 diffs)
• dfg/DFGJITCodeGenerator.h (modified) (1 diff)
• dfg/DFGJITCompiler.cpp (modified) (4 diffs)
• dfg/DFGJITCompiler.h (modified) (8 diffs)
• dfg/DFGNode.h (modified) (8 diffs)
• dfg/DFGNonSpeculativeJIT.cpp (modified) (36 diffs)
• dfg/DFGOperations.cpp (modified) (2 diffs)
• dfg/DFGOperations.h (modified) (1 diff)
• dfg/DFGRepatch.cpp (modified) (1 diff)
• dfg/DFGRepatch.h (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (42 diffs)
• dfg/DFGSpeculativeJIT.h (modified) (1 diff)
• interpreter/CallFrame.h (modified) (1 diff)
• jit/JIT.cpp (modified) (6 diffs)
• jit/JITCall.cpp (modified) (1 diff)
• jit/JITCode.h (modified) (4 diffs)
• runtime/JSFunction.h (modified) (2 diffs)
• runtime/JSGlobalData.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement op_call.
+        https://bugs.webkit.org/show_bug.cgi?id=63858
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setNumberOfCallLinkInfos):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::lookupGetByVal):
+        (JSC::DFG::AliasTracker::recordCall):
+        (JSC::DFG::AliasTracker::equalIgnoringLaterNumericConversion):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::predictInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::opName):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::refChildren):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::useChildren):
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::addressOfCallData):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::CallRecord::CallRecord):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::appendCallWithFastExceptionCheck):
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compare):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkCall):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::jitType):
+        (JSC::JITCode::HostFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+
 2011-07-05  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -44 +44 @@
 #include <wtf/StringExtras.h>
 
+#if ENABLE(DFG_JIT)
+#include "DFGOperations.h"
+#endif
+
 #define DUMP_CODE_BLOCK_STATISTICS 0
 
 namespace JSC {
+
+#if ENABLE(DFG_JIT)
+using namespace DFG;
+#endif
 
 #if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
@@ -1740 +1748 @@
         if (!m_callLinkInfos[i].isLinked())
             continue;
-        repatchBuffer.relink(m_callLinkInfos[i].callReturnLocation, m_callLinkInfos[i].isCall ? m_globalData->jitStubs->ctiVirtualCallLink() : m_globalData->jitStubs->ctiVirtualConstructLink());
+        if (getJITCode().jitType() == JITCode::DFGJIT) {
+#if ENABLE(DFG_JIT)
+            repatchBuffer.relink(CodeLocationCall(m_callLinkInfos[i].callReturnLocation), operationLinkCall);
+#else
+            ASSERT_NOT_REACHED();
+#endif
+        } else
+            repatchBuffer.relink(CodeLocationNearCall(m_callLinkInfos[i].callReturnLocation), m_callLinkInfos[i].isCall ? m_globalData->jitStubs->ctiVirtualCallLink() : m_globalData->jitStubs->ctiVirtualConstructLink());
         m_callLinkInfos[i].unlink();
     }

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -103 +103 @@
         }
 
-        CodeLocationNearCall callReturnLocation;
+        CodeLocationLabel callReturnLocation; // it's a near call in the old JIT, or a normal call in DFG
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
@@ -379 +379 @@
         bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
 
+        void setNumberOfCallLinkInfos(size_t size) { m_callLinkInfos.grow(size); }
         size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
-        void addCallLinkInfo() { m_callLinkInfos.append(CallLinkInfo()); }
         CallLinkInfo& callLinkInfo(int index) { return m_callLinkInfos[index]; }
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -1753 +1753 @@
     emitExpressionInfo(divot, startOffset, endOffset);
 
-#if ENABLE(JIT)
-    m_codeBlock->addCallLinkInfo();
-#endif
-
     // Emit call.
     emitOpcode(opcodeID);
@@ -1869 +1865 @@
 
     emitExpressionInfo(divot, startOffset, endOffset);
-
-#if ENABLE(JIT)
-    m_codeBlock->addCallLinkInfo();
-#endif
 
     emitOpcode(op_construct);

trunk/Source/JavaScriptCore/dfg/DFGAliasTracker.h

@@ -61 +61 @@
             // integer index (this is good enough; the speculative path will only generate
             // optimized accesses to handle integer subscripts).
-            if (possibleAlias.child1 == base && equalIgnoringLaterNumericConversion(possibleAlias.child2, property))
+            if (possibleAlias.child1() == base && equalIgnoringLaterNumericConversion(possibleAlias.child2(), property))
                 return m_candidateAliasGetByVal;
         }
@@ -95 +95 @@
         m_candidateAliasGetByVal = NoNode;
     }
+    
+    void recordCall(NodeIndex call)
+    {
+        ASSERT_UNUSED(call, m_graph[call].op == Call);
+        m_candidateAliasGetByVal = NoNode;
+    }
 
 private:
@@ -107 +113 @@
             return true;
         Node& node2 = m_graph[op2];
-        return (node2.op == ValueToNumber || node2.op == ValueToInt32) && op1 == node2.child1;
+        return (node2.op == ValueToNumber || node2.op == ValueToInt32) && op1 == node2.child1();
     }
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -63 +63 @@
         , m_numLocals(codeBlock->m_numCalleeRegisters)
         , m_preservedVars(codeBlock->m_numVars)
+        , m_parameterSlots(0)
+        , m_numPassedVarArgs(0)
     {
     }
@@ -125 +127 @@
                 return nodeIndex;
             ASSERT(node.op == SetLocal);
-            return node.child1;
+            return node.child1();
         }
 
@@ -156 +158 @@
                 return nodeIndex;
             ASSERT(node.op == SetLocal);
-            return node.child1;
+            return node.child1();
         }
 
@@ -192 +194 @@
 
         if (node.op == UInt32ToNumber)
-            return node.child1;
+            return node.child1();
 
         // Check for numeric constants boxed as JSValues.
@@ -383 +385 @@
         return resultIndex;
     }
+    
+    NodeIndex addToGraph(Node::VarArgTag, NodeType op)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(Node::VarArg, op, m_currentIndex, m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs));
+        
+        m_numPassedVarArgs = 0;
+        
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+    void addVarArgChild(NodeIndex child)
+    {
+        m_graph.m_varArgChildren.append(child);
+        m_numPassedVarArgs++;
+    }
 
     void predictArray(NodeIndex nodeIndex)
@@ -397 +416 @@
 
         if (nodePtr->op == ValueToNumber)
-            nodePtr = &m_graph[nodePtr->child1];
+            nodePtr = &m_graph[nodePtr->child1()];
 
         if (nodePtr->op == ValueToInt32)
-            nodePtr = &m_graph[nodePtr->child1];
+            nodePtr = &m_graph[nodePtr->child1()];
 
         if (nodePtr->op == GetLocal)
@@ -454 +473 @@
     // temporaries that persist across blocks (dues to ?:, &&, ||, etc).
     unsigned m_preservedVars;
+    // The number of slots (in units of sizeof(Register)) that we need to
+    // preallocate for calls emanating from this frame. This includes the
+    // size of the CallFrame, only if this is not a leaf function.  (I.e.
+    // this is 0 if and only if this function is a leaf.)
+    unsigned m_parameterSlots;
+    // The number of var args passed to the next var arg node.
+    unsigned m_numPassedVarArgs;
 
     struct PhiStackEntry {
@@ -1040 +1066 @@
             LAST_OPCODE(op_ret);
         }
+            
+        case op_call: {
+            addVarArgChild(get(currentInstruction[1].u.operand));
+            int argCount = currentInstruction[2].u.operand;
+            int registerOffset = currentInstruction[3].u.operand;
+            int firstArg = registerOffset - argCount - RegisterFile::CallFrameHeaderSize;
+            for (int argIdx = firstArg; argIdx < firstArg + argCount; argIdx++)
+                addVarArgChild(get(argIdx));
+            NodeIndex call = addToGraph(Node::VarArg, Call);
+            aliases.recordCall(call);
+            Instruction* putInstruction = currentInstruction + OPCODE_LENGTH(op_call);
+            if (interpreter->getOpcodeID(putInstruction->u.opcode) == op_call_put_result)
+                set(putInstruction[1].u.operand, call);
+            if (RegisterFile::CallFrameHeaderSize + (unsigned)argCount > m_parameterSlots)
+                m_parameterSlots = RegisterFile::CallFrameHeaderSize + argCount;
+            NEXT_OPCODE(op_call);
+        }
+            
+        case op_call_put_result: {
+#if !ASSERT_DISABLED
+            Instruction* callInstruction = currentInstruction - OPCODE_LENGTH(op_call);
+            ASSERT(interpreter->getOpcodeID(callInstruction->u.opcode) == op_call);
+#endif
+            NEXT_OPCODE(op_call_put_result);
+        }
 
         default:
@@ -1072 +1123 @@
                 phiStack.append(PhiStackEntry(predecessorBlock, valueInPredecessor, varNo));
             } else if (m_graph[valueInPredecessor].op == GetLocal)
-                valueInPredecessor = m_graph[valueInPredecessor].child1;
+                valueInPredecessor = m_graph[valueInPredecessor].child1();
             ASSERT(m_graph[valueInPredecessor].op == SetLocal || m_graph[valueInPredecessor].op == Phi);
 
@@ -1078 +1129 @@
                 m_graph.ref(valueInPredecessor);
 
-            if (phiNode.child1 == NoNode) {
-                phiNode.child1 = valueInPredecessor;
+            if (phiNode.child1() == NoNode) {
+                phiNode.children.fixed.child1 = valueInPredecessor;
                 continue;
             }
-            if (phiNode.child2 == NoNode) {
-                phiNode.child2 = valueInPredecessor;
+            if (phiNode.child2() == NoNode) {
+                phiNode.children.fixed.child2 = valueInPredecessor;
                 continue;
             }
-            if (phiNode.child3 == NoNode) {
-                phiNode.child3 = valueInPredecessor;
+            if (phiNode.child3() == NoNode) {
+                phiNode.children.fixed.child3 = valueInPredecessor;
                 continue;
             }
@@ -1096 +1147 @@
                 m_graph.ref(newPhi);
 
-            newPhiNode.child1 = phiNode.child1;
-            newPhiNode.child2 = phiNode.child2;
-            newPhiNode.child3 = phiNode.child3;
-
-            phiNode.child1 = newPhi;
-            phiNode.child1 = valueInPredecessor;
-            phiNode.child3 = NoNode;
+            newPhiNode.children.fixed.child1 = phiNode.child1();
+            newPhiNode.children.fixed.child2 = phiNode.child2();
+            newPhiNode.children.fixed.child3 = phiNode.child3();
+
+            phiNode.children.fixed.child1 = newPhi;
+            phiNode.children.fixed.child1 = valueInPredecessor;
+            phiNode.children.fixed.child3 = NoNode;
         }
     }
@@ -1130 +1181 @@
     for (size_t i = 0; i < sizeExcludingPhiNodes; ++i) {
         Node& node = m_graph[i];
+        
         if (!node.shouldGenerate())
             continue;
-
+        
         // GetLocal nodes are effectively phi nodes in the graph, referencing
         // results from prior blocks.
@@ -1140 +1192 @@
             // order so that if a child is on its last use, and a
             // VirtualRegister is freed, then it may be reused for node.
-            scoreBoard.use(node.child1);
-            scoreBoard.use(node.child2);
-            scoreBoard.use(node.child3);
+            if (node.op & NodeHasVarArgs) {
+                for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                    scoreBoard.use(m_graph.m_varArgChildren[childIdx]);
+            } else {
+                scoreBoard.use(node.child1());
+                scoreBoard.use(node.child2());
+                scoreBoard.use(node.child3());
+            }
         }
 
@@ -1158 +1215 @@
     // for the function (and checked for on entry). Since we perform a new and
     // different allocation of temporaries, more registers may now be required.
-    unsigned calleeRegisters = scoreBoard.allocatedCount() + m_preservedVars;
+    unsigned calleeRegisters = scoreBoard.allocatedCount() + m_preservedVars + m_parameterSlots;
     if ((unsigned)m_codeBlock->m_numCalleeRegisters < calleeRegisters)
         m_codeBlock->m_numCalleeRegisters = calleeRegisters;

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -42 +42 @@
 };
 
+const char *Graph::opName(NodeType op)
+{
+    return dfgOpNames[op & NodeIdMask];
+}
+
 void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
 {
@@ -76 +81 @@
     else
         printf("-");
-    printf(">\t%s(", dfgOpNames[op & NodeIdMask]);
-    if (node.child1 != NoNode)
-        printf("@%u", node.child1);
-    if (node.child2 != NoNode)
-        printf(", @%u", node.child2);
-    if (node.child3 != NoNode)
-        printf(", @%u", node.child3);
-    bool hasPrinted = node.child1 != NoNode;
+    printf(">\t%s(", opName(op));
+    bool hasPrinted;
+    if (op & NodeHasVarArgs) {
+        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++) {
+            if (hasPrinted)
+                printf(", ");
+            else
+                hasPrinted = true;
+            printf("@%u", m_varArgChildren[childIdx]);
+        }
+    } else {
+        if (node.child1() != NoNode)
+            printf("@%u", node.child1());
+        if (node.child2() != NoNode)
+            printf(", @%u", node.child2());
+        if (node.child3() != NoNode)
+            printf(", @%u", node.child3());
+        hasPrinted = node.child1() != NoNode;
+    }
 
     if (node.hasVarNumber()) {
@@ -139 +155 @@
     Node& node = at(op);
 
-    if (node.child1 == NoNode) {
-        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
-        return;
+    if (node.op & NodeHasVarArgs) {
+        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+            ref(m_varArgChildren[childIdx]);
+    } else {
+        if (node.child1() == NoNode) {
+            ASSERT(node.child2() == NoNode && node.child3() == NoNode);
+            return;
+        }
+        ref(node.child1());
+
+        if (node.child2() == NoNode) {
+            ASSERT(node.child3() == NoNode);
+            return;
+        }
+        ref(node.child2());
+
+        if (node.child3() == NoNode)
+            return;
+        ref(node.child3());
     }
-    ref(node.child1);
-
-    if (node.child2 == NoNode) {
-        ASSERT(node.child3 == NoNode);
-        return;
-    }
-    ref(node.child2);
-
-    if (node.child3 == NoNode)
-        return;
-    ref(node.child3);
 }
 

trunk/Source/JavaScriptCore/dfg/DFGGraph.h

@@ -161 +161 @@
     }
 
+#ifndef NDEBUG
+    static const char *opName(NodeType);
+#endif
+
     Vector< OwnPtr<BasicBlock> , 8> m_blocks;
+    Vector<NodeIndex, 16> m_varArgChildren;
 private:
 

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

@@ -301 +301 @@
 void JITCodeGenerator::useChildren(Node& node)
 {
-    NodeIndex child1 = node.child1;
-    if (child1 == NoNode) {
-        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
-        return;
-    }
-    use(child1);
-
-    NodeIndex child2 = node.child2;
-    if (child2 == NoNode) {
-        ASSERT(node.child3 == NoNode);
-        return;
-    }
-    use(child2);
-
-    NodeIndex child3 = node.child3;
-    if (child3 == NoNode)
-        return;
-    use(child3);
+    if (node.op & NodeHasVarArgs) {
+        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+            use(m_jit.graph().m_varArgChildren[childIdx]);
+    } else {
+        NodeIndex child1 = node.child1();
+        if (child1 == NoNode) {
+            ASSERT(node.child2() == NoNode && node.child3() == NoNode);
+            return;
+        }
+        use(child1);
+        
+        NodeIndex child2 = node.child2();
+        if (child2 == NoNode) {
+            ASSERT(node.child3() == NoNode);
+            return;
+        }
+        use(child2);
+        
+        NodeIndex child3 = node.child3();
+        if (child3 == NoNode)
+            return;
+        use(child3);
+    }
 }
 
@@ -424 +429 @@
 
     m_jit.addPropertyAccess(functionCall, checkImmToCall, callToCheck, callToStore, callToSlowCase, callToDone, static_cast<int8_t>(baseGPR), static_cast<int8_t>(valueGPR), static_cast<int8_t>(scratchGPR));
+}
+
+void JITCodeGenerator::emitCall(Node& node, GPRReg targetGPR)
+{
+    // the call instruction's first child is either the function (normal call) or the
+    // receiver (method call). subsequent children are the arguments.
+    int numArgs = node.numChildren() - 1;
+    
+    // amount of stuff (in units of sizeof(Register)) that we need to place at the
+    // top of the JS stack.
+    int callDataSize = 0;
+
+    // first there are the arguments
+    callDataSize += numArgs;
+    
+    // and then there is the call frame header
+    callDataSize += RegisterFile::CallFrameHeaderSize;
+    
+    m_jit.storePtr(MacroAssembler::TrustedImmPtr(JSValue::encode(jsNumber(numArgs))), addressOfCallData(RegisterFile::ArgumentCount));
+    m_jit.storePtr(GPRInfo::callFrameRegister, addressOfCallData(RegisterFile::CallerFrame));
+    
+    for (int argIdx = 0; argIdx < numArgs; argIdx++) {
+        JSValueOperand arg(this, m_jit.graph().m_varArgChildren[node.firstChild() + 1 + argIdx]);
+        GPRReg argGPR = arg.gpr();
+        
+        m_jit.storePtr(argGPR, addressOfCallData(-callDataSize + argIdx));
+    }
+    
+    switch (node.op) {
+    case Call:
+        m_jit.storePtr(targetGPR, addressOfCallData(RegisterFile::Callee));
+        break;
+        
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    
+    flushRegisters();
+    
+    GPRResult result(this);
+    GPRReg resultGPR = result.gpr();
+
+    JITCompiler::DataLabelPtr targetToCheck;
+    JITCompiler::Jump slowPath;
+    
+    switch (node.op) {
+    case Call:
+        slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, targetGPR, targetToCheck, MacroAssembler::TrustedImmPtr(JSValue::encode(JSValue())));
+        m_jit.loadPtr(MacroAssembler::Address(targetGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);
+        m_jit.storePtr(resultGPR, addressOfCallData(RegisterFile::ScopeChain));
+        break;
+        
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    
+    JITCompiler::Call fastCall = m_jit.nearCall();
+    m_jit.notifyCall(fastCall, m_jit.graph()[m_compileIndex].exceptionInfo);
+    
+    JITCompiler::Jump done = m_jit.jump();
+    
+    slowPath.link(&m_jit);
+    
+    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    JITCompiler::Call slowCall = m_jit.appendCallWithFastExceptionCheck(operationLinkCall, m_jit.graph()[m_compileIndex].exceptionInfo);
+    m_jit.move(Imm32(numArgs), GPRInfo::regT1);
+    m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
+    m_jit.notifyCall(m_jit.call(GPRInfo::returnValueGPR), m_jit.graph()[m_compileIndex].exceptionInfo);
+    
+    done.link(&m_jit);
+    
+    m_jit.move(GPRInfo::returnValueGPR, resultGPR);
+    
+    jsValueResult(resultGPR, m_compileIndex);
+    
+    m_jit.addJSCall(fastCall, slowCall, targetToCheck, true, m_jit.graph()[m_compileIndex].exceptionInfo);
 }
 

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h

@@ -523 +523 @@
     void cachedGetById(GPRReg baseGPR, GPRReg resultGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget = JITCompiler::Jump());
     void cachedPutById(GPRReg baseGPR, GPRReg valueGPR, GPRReg scratchGPR, unsigned identifierNumber, PutKind, JITCompiler::Jump slowPathTarget = JITCompiler::Jump());
+    
+    MacroAssembler::Address addressOfCallData(int idx)
+    {
+        return MacroAssembler::Address(GPRInfo::callFrameRegister, (m_jit.codeBlock()->m_numCalleeRegisters + idx) * static_cast<int>(sizeof(Register)));
+    }
+    
+    void emitCall(Node&, GPRReg targetGPR);
 
     // Called once a node has completed code generation but prior to setting

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -295 +295 @@
         m_calls.clear();
         m_propertyAccesses.clear();
+        m_jsCalls.clear();
         rewindToLabel(speculativePathBegin);
 
@@ -370 +371 @@
 
     // Link all calls out from the JIT code to their respective functions.
-    for (unsigned i = 0; i < m_calls.size(); ++i)
-        linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
+    for (unsigned i = 0; i < m_calls.size(); ++i) {
+        if (m_calls[i].m_function.value())
+            linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
+    }
 
     if (m_codeBlock->needsCallReturnIndices()) {
         m_codeBlock->callReturnIndexVector().reserveCapacity(exceptionCheckCount);
         for (unsigned i = 0; i < m_calls.size(); ++i) {
-            if (m_calls[i].m_exceptionCheck.isSet()) {
+            if (m_calls[i].m_handlesExceptions) {
                 unsigned returnAddressOffset = linkBuffer.returnAddressOffset(m_calls[i].m_call);
                 unsigned exceptionInfo = m_calls[i].m_exceptionInfo;
@@ -397 +400 @@
         info.u.unset.scratchGPR = m_propertyAccesses[i].m_scratchGPR;
     }
-
+    
+    m_codeBlock->setNumberOfCallLinkInfos(m_jsCalls.size());
+    for (unsigned i = 0; i < m_jsCalls.size(); ++i) {
+        CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
+        info.isCall = m_jsCalls[i].m_isCall;
+        info.callReturnLocation = CodeLocationLabel(linkBuffer.locationOf(m_jsCalls[i].m_slowCall));
+        info.hotPathBegin = linkBuffer.locationOf(m_jsCalls[i].m_targetToCheck);
+        info.hotPathOther = linkBuffer.locationOfNearCall(m_jsCalls[i].m_fastCall);
+    }
+    
     // FIXME: switch the register file check & arity check over to DFGOpertaion style calls, not JIT stubs.
     linkBuffer.link(callRegisterFileCheck, cti_register_file_check);
@@ -403 +415 @@
 
     entryWithArityCheck = linkBuffer.locationOf(arityCheck);
-    entry = linkBuffer.finalizeCode();
+    entry = JITCode(linkBuffer.finalizeCode(), JITCode::DFGJIT);
 }
 

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.h

@@ -66 +66 @@
         : m_call(call)
         , m_function(function)
+        , m_handlesExceptions(false)
     {
     }
@@ -75 +76 @@
         , m_exceptionCheck(exceptionCheck)
         , m_exceptionInfo(exceptionInfo)
+        , m_handlesExceptions(true)
+    {
+    }
+
+    // Constructor for a call that may cause exceptions, but which are handled
+    // through some mechanism other than the in-line exception handler.
+    CallRecord(MacroAssembler::Call call, FunctionPtr function, ExceptionInfo exceptionInfo)
+        : m_call(call)
+        , m_function(function)
+        , m_exceptionInfo(exceptionInfo)
+        , m_handlesExceptions(true)
     {
     }
@@ -82 +94 @@
     MacroAssembler::Jump m_exceptionCheck;
     ExceptionInfo m_exceptionInfo;
+    bool m_handlesExceptions;
 };
 
@@ -159 +172 @@
         return Address(GPRInfo::callFrameRegister, virtualRegister * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     }
+    
+    // Notify the JIT of a call that does not require linking.
+    void notifyCall(Call call, unsigned exceptionInfo)
+    {
+        m_calls.append(CallRecord(call, FunctionPtr(), exceptionInfo));
+    }
 
     // Add a call out from JIT code, without an exception check.
@@ -172 +191 @@
         Call functionCall = call();
         Jump exceptionCheck = branchTestPtr(NonZero, AbsoluteAddress(&globalData()->exception));
+        m_calls.append(CallRecord(functionCall, function, exceptionCheck, exceptionInfo));
+        return functionCall;
+    }
+    
+    // Add a call out from JIT code, with a fast exception check that tests if the return value is zero.
+    Call appendCallWithFastExceptionCheck(const FunctionPtr& function, unsigned exceptionInfo)
+    {
+        Call functionCall = call();
+        Jump exceptionCheck = branchTestPtr(Zero, GPRInfo::returnValueGPR);
         m_calls.append(CallRecord(functionCall, function, exceptionCheck, exceptionInfo));
         return functionCall;
@@ -240 +268 @@
         m_propertyAccesses.append(PropertyAccessRecord(functionCall, deltaCheckImmToCall, deltaCallToStructCheck, deltaCallToLoadOrStore, deltaCallToSlowCase, deltaCallToDone,  baseGPR, valueGPR, scratchGPR));
     }
+    
+    void addJSCall(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, bool isCall, unsigned exceptionInfo)
+    {
+        m_jsCalls.append(JSCallRecord(fastCall, slowCall, targetToCheck, isCall, exceptionInfo));
+    }
 
 private:
@@ -262 +295 @@
 
     struct PropertyAccessRecord {
-        PropertyAccessRecord(JITCompiler::Call functionCall, int8_t deltaCheckImmToCall, int8_t deltaCallToStructCheck, int8_t deltaCallToLoadOrStore, int8_t deltaCallToSlowCase, int8_t deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
+        PropertyAccessRecord(Call functionCall, int8_t deltaCheckImmToCall, int8_t deltaCallToStructCheck, int8_t deltaCallToLoadOrStore, int8_t deltaCallToSlowCase, int8_t deltaCallToDone, int8_t baseGPR, int8_t valueGPR, int8_t scratchGPR)
             : m_functionCall(functionCall)
             , m_deltaCheckImmToCall(deltaCheckImmToCall)
@@ -285 +318 @@
         int8_t m_scratchGPR;
     };
+    
+    struct JSCallRecord {
+        JSCallRecord(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, bool isCall, unsigned exceptionInfo)
+            : m_fastCall(fastCall)
+            , m_slowCall(slowCall)
+            , m_targetToCheck(targetToCheck)
+            , m_isCall(isCall)
+            , m_exceptionInfo(exceptionInfo)
+        {
+        }
+        
+        Call m_fastCall;
+        Call m_slowCall;
+        DataLabelPtr m_targetToCheck;
+        bool m_isCall;
+        unsigned m_exceptionInfo;
+    };
 
     Vector<PropertyAccessRecord, 4> m_propertyAccesses;
+    Vector<JSCallRecord, 4> m_jsCalls;
 };
 

trunk/Source/JavaScriptCore/dfg/DFGNode.h

@@ -77 +77 @@
 #define NodeIsBranch      0x80000
 #define NodeIsTerminal   0x100000
+#define NodeHasVarArgs   0x200000
 
 // These values record the result type of the node (as checked by NodeResultMask, above), 0 for no result.
@@ -139 +140 @@
     macro(CompareStrictEq, NodeResultJS) \
     \
+    /* Calls. */\
+    macro(Call, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    \
     /* Nodes for misc operations. */\
     macro(Breakpoint, NodeMustGenerate) \
@@ -178 +182 @@
 // Node represents a single operation in the data flow graph.
 struct Node {
+    enum VarArgTag { VarArg };
+
     // Construct a node with up to 3 children, no immediate value.
     Node(NodeType op, ExceptionInfo exceptionInfo, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
         : op(op)
         , exceptionInfo(exceptionInfo)
-        , child1(child1)
-        , child2(child2)
-        , child3(child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
     {
+        ASSERT(!(op & NodeHasVarArgs));
+        children.fixed.child1 = child1;
+        children.fixed.child2 = child2;
+        children.fixed.child3 = child3;
     }
 
@@ -194 +201 @@
         : op(op)
         , exceptionInfo(exceptionInfo)
-        , child1(child1)
-        , child2(child2)
-        , child3(child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
         , m_opInfo(imm.m_value)
     {
+        ASSERT(!(op & NodeHasVarArgs));
+        children.fixed.child1 = child1;
+        children.fixed.child2 = child2;
+        children.fixed.child3 = child3;
     }
 
@@ -207 +215 @@
         : op(op)
         , exceptionInfo(exceptionInfo)
-        , child1(child1)
-        , child2(child2)
-        , child3(child3)
         , m_virtualRegister(InvalidVirtualRegister)
         , m_refCount(0)
@@ -215 +220 @@
         , m_opInfo2(imm2.m_value)
     {
+        ASSERT(!(op & NodeHasVarArgs));
+        children.fixed.child1 = child1;
+        children.fixed.child2 = child2;
+        children.fixed.child3 = child3;
+    }
+    
+    // Construct a node with a variable number of children and no immediate values.
+    Node(VarArgTag, NodeType op, ExceptionInfo exceptionInfo, unsigned firstChild, unsigned numChildren)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , m_virtualRegister(InvalidVirtualRegister)
+        , m_refCount(0)
+    {
+        ASSERT(op & NodeHasVarArgs);
+        children.variable.firstChild = firstChild;
+        children.variable.numChildren = numChildren;
     }
 
@@ -355 +376 @@
         return mustGenerate() ? m_refCount - 1 : m_refCount;
     }
-
+    
+    NodeIndex child1()
+    {
+        ASSERT(!(op & NodeHasVarArgs));
+        return children.fixed.child1;
+    }
+
+    NodeIndex child2()
+    {
+        ASSERT(!(op & NodeHasVarArgs));
+        return children.fixed.child2;
+    }
+
+    NodeIndex child3()
+    {
+        ASSERT(!(op & NodeHasVarArgs));
+        return children.fixed.child3;
+    }
+    
+    unsigned firstChild()
+    {
+        ASSERT(op & NodeHasVarArgs);
+        return children.variable.firstChild;
+    }
+    
+    unsigned numChildren()
+    {
+        ASSERT(op & NodeHasVarArgs);
+        return children.variable.numChildren;
+    }
+    
     // This enum value describes the type of the node.
     NodeType op;
@@ -361 +412 @@
     ExceptionInfo exceptionInfo;
     // References to up to 3 children (0 for no child).
-    NodeIndex child1, child2, child3;
+    union {
+        struct {
+            NodeIndex child1, child2, child3;
+        } fixed;
+        struct {
+            unsigned firstChild;
+            unsigned numChildren;
+        } variable;
+    } children;
 
 private:

trunk/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp

@@ -266 +266 @@
 void NonSpeculativeJIT::basicArithOp(NodeType op, Node &node)
 {
-    JSValueOperand arg1(this, node.child1);
-    JSValueOperand arg2(this, node.child2);
+    JSValueOperand arg1(this, node.child1());
+    JSValueOperand arg2(this, node.child2());
     
     GPRReg arg1GPR = arg1.gpr();
@@ -278 +278 @@
     JITCompiler::JumpList slowPath;
     
-    if (!isKnownInteger(node.child1))
+    if (!isKnownInteger(node.child1()))
         slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));
-    if (!isKnownInteger(node.child2))
+    if (!isKnownInteger(node.child2()))
         slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));
     
@@ -347 +347 @@
     // FIXME: should do some peephole to fuse compare/branch
         
-    JSValueOperand arg1(this, node.child1);
-    JSValueOperand arg2(this, node.child2);
+    JSValueOperand arg1(this, node.child1());
+    JSValueOperand arg2(this, node.child2());
     GPRReg arg1GPR = arg1.gpr();
     GPRReg arg2GPR = arg2.gpr();
@@ -357 +357 @@
     JITCompiler::JumpList slowPath;
     
-    if (!isKnownInteger(node.child1))
+    if (!isKnownInteger(node.child1()))
         slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));
-    if (!isKnownInteger(node.child2))
+    if (!isKnownInteger(node.child2()))
         slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));
     
@@ -398 +398 @@
     switch (op) {
     case ConvertThis: {
-        JSValueOperand thisValue(this, node.child1);
+        JSValueOperand thisValue(this, node.child1());
         GPRReg thisGPR = thisValue.gpr();
         flushRegisters();
@@ -425 +425 @@
 
     case SetLocal: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         m_jit.storePtr(value.gpr(), JITCompiler::addressFor(node.local()));
         noResult(m_compileIndex);
@@ -434 +434 @@
     case BitOr:
     case BitXor:
-        if (isInt32Constant(node.child1)) {
-            IntegerOperand op2(this, node.child2);
+        if (isInt32Constant(node.child1())) {
+            IntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op2);
 
-            bitOp(op, valueOfInt32Constant(node.child1), op2.gpr(), result.gpr());
+            bitOp(op, valueOfInt32Constant(node.child1()), op2.gpr(), result.gpr());
 
             integerResult(result.gpr(), m_compileIndex);
-        } else if (isInt32Constant(node.child2)) {
-            IntegerOperand op1(this, node.child1);
+        } else if (isInt32Constant(node.child2())) {
+            IntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
 
-            bitOp(op, valueOfInt32Constant(node.child2), op1.gpr(), result.gpr());
+            bitOp(op, valueOfInt32Constant(node.child2()), op1.gpr(), result.gpr());
 
             integerResult(result.gpr(), m_compileIndex);
         } else {
-            IntegerOperand op1(this, node.child1);
-            IntegerOperand op2(this, node.child2);
+            IntegerOperand op1(this, node.child1());
+            IntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op1, op2);
 
@@ -464 +464 @@
     case BitLShift:
     case BitURShift:
-        if (isInt32Constant(node.child2)) {
-            IntegerOperand op1(this, node.child1);
+        if (isInt32Constant(node.child2())) {
+            IntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
 
-            int shiftAmount = valueOfInt32Constant(node.child2) & 0x1f;
+            int shiftAmount = valueOfInt32Constant(node.child2()) & 0x1f;
             // Shifts by zero should have been optimized out of the graph!
             ASSERT(shiftAmount);
@@ -476 +476 @@
         } else {
             // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
-            IntegerOperand op1(this, node.child1);
-            IntegerOperand op2(this, node.child2);
+            IntegerOperand op1(this, node.child1());
+            IntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op1);
 
@@ -489 +489 @@
 
     case UInt32ToNumber: {
-        IntegerOperand op1(this, node.child1);
+        IntegerOperand op1(this, node.child1());
         FPRTemporary boxer(this);
         GPRTemporary result(this, op1);
@@ -514 +514 @@
 
     case ValueToInt32: {
-        ASSERT(!isInt32Constant(node.child1));
-
-        if (isKnownInteger(node.child1)) {
-            IntegerOperand op1(this, node.child1);
+        ASSERT(!isInt32Constant(node.child1()));
+
+        if (isKnownInteger(node.child1())) {
+            IntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
             m_jit.move(op1.gpr(), result.gpr());
@@ -524 +524 @@
         }
 
-        GenerationInfo& childInfo = m_generationInfo[m_jit.graph()[node.child1].virtualRegister()];
+        GenerationInfo& childInfo = m_generationInfo[m_jit.graph()[node.child1()].virtualRegister()];
         if ((childInfo.registerFormat() | DataFormatJS) == DataFormatJSDouble) {
-            DoubleOperand op1(this, node.child1);
+            DoubleOperand op1(this, node.child1());
             GPRTemporary result(this);
             numberToInt32(op1.fpr(), result.gpr());
@@ -533 +533 @@
         }
 
-        JSValueOperand op1(this, node.child1);
+        JSValueOperand op1(this, node.child1());
         GPRTemporary result(this, op1);
         valueToInt32(op1, result.gpr());
@@ -541 +541 @@
 
     case ValueToNumber: {
-        ASSERT(!isInt32Constant(node.child1));
-        ASSERT(!isDoubleConstant(node.child1));
-
-        if (isKnownNumeric(node.child1)) {
-            JSValueOperand op1(this, node.child1);
+        ASSERT(!isInt32Constant(node.child1()));
+        ASSERT(!isDoubleConstant(node.child1()));
+
+        if (isKnownNumeric(node.child1())) {
+            JSValueOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
             m_jit.move(op1.gpr(), result.gpr());
@@ -552 +552 @@
         }
 
-        JSValueOperand op1(this, node.child1);
+        JSValueOperand op1(this, node.child1());
         GPRTemporary result(this);
         valueToNumber(op1, result.gpr());
@@ -561 +561 @@
     case ValueAdd:
     case ArithAdd: {
-        if (isInt32Constant(node.child1)) {
-            knownConstantArithOp(op, node.child2, node.child1, true);
+        if (isInt32Constant(node.child1())) {
+            knownConstantArithOp(op, node.child2(), node.child1(), true);
             break;
         }
         
-        if (isInt32Constant(node.child2)) {
-            knownConstantArithOp(op, node.child1, node.child2, false);
+        if (isInt32Constant(node.child2())) {
+            knownConstantArithOp(op, node.child1(), node.child2(), false);
             break;
         }
@@ -576 +576 @@
         
     case ArithSub: {
-        if (isInt32Constant(node.child2)) {
-            knownConstantArithOp(ArithSub, node.child1, node.child2, false);
+        if (isInt32Constant(node.child2())) {
+            knownConstantArithOp(ArithSub, node.child1(), node.child2(), false);
             break;
         }
@@ -591 +591 @@
 
     case ArithDiv: {
-        DoubleOperand op1(this, node.child1);
-        DoubleOperand op2(this, node.child2);
+        DoubleOperand op1(this, node.child1());
+        DoubleOperand op2(this, node.child2());
         FPRTemporary result(this, op1);
         FPRReg op1FPR = op1.fpr();
@@ -605 +605 @@
 
     case ArithMod: {
-        JSValueOperand op1(this, node.child1);
-        JSValueOperand op2(this, node.child2);
+        JSValueOperand op1(this, node.child1());
+        JSValueOperand op2(this, node.child2());
         GPRTemporary eax(this, X86Registers::eax);
         GPRTemporary edx(this, X86Registers::edx);
@@ -624 +624 @@
         JITCompiler::Jump modByZero;
     
-        if (!isKnownInteger(node.child1))
+        if (!isKnownInteger(node.child1()))
             firstOpNotInt = m_jit.branchPtr(MacroAssembler::Below, op1GPR, GPRInfo::tagTypeNumberRegister);
-        if (!isKnownInteger(node.child2))
+        if (!isKnownInteger(node.child2()))
             secondOpNotInt = m_jit.branchPtr(MacroAssembler::Below, op2GPR, GPRInfo::tagTypeNumberRegister);
     
@@ -656 +656 @@
         done.append(m_jit.jump());
     
-        if (!isKnownInteger(node.child1)) {
+        if (!isKnownInteger(node.child1())) {
             firstOpNotInt.link(&m_jit);
         
             JITCompiler::Jump secondOpNotInt2;
         
-            if (!isKnownInteger(node.child2))
+            if (!isKnownInteger(node.child2()))
                 secondOpNotInt2 = m_jit.branchPtr(MacroAssembler::Below, op2GPR, GPRInfo::tagTypeNumberRegister);
             
@@ -667 +667 @@
             m_jit.convertInt32ToDouble(op2GPR, op2FPR);
 
-            if (!isKnownInteger(node.child2)) {
+            if (!isKnownInteger(node.child2())) {
                 JITCompiler::Jump gotSecondOp = m_jit.jump();
             
@@ -683 +683 @@
         }
     
-        if (!isKnownInteger(node.child2)) {
+        if (!isKnownInteger(node.child2())) {
             secondOpNotInt.link(&m_jit);
         
@@ -691 +691 @@
         }
     
-        if (!isKnownInteger(node.child1))
+        if (!isKnownInteger(node.child1()))
             gotDoubleArgs.link(&m_jit);
     
-        if (!isKnownInteger(node.child1) || !isKnownInteger(node.child2)) {
+        if (!isKnownInteger(node.child1()) || !isKnownInteger(node.child2())) {
             silentSpillAllRegisters(X86Registers::edx);
             setupTwoStubArgs<FPRInfo::argumentFPR0, FPRInfo::argumentFPR1>(op1FPR, op2FPR);
@@ -709 +709 @@
 
     case LogicalNot: {
-        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg1(this, node.child1());
         GPRTemporary result(this);
 
@@ -758 +758 @@
 
     case GetByVal: {
-        JSValueOperand base(this, node.child1);
-        JSValueOperand property(this, node.child2);
+        JSValueOperand base(this, node.child1());
+        JSValueOperand property(this, node.child2());
 
         GPRTemporary storage(this);
@@ -810 +810 @@
     case PutByVal:
     case PutByValAlias: {
-        JSValueOperand arg1(this, node.child1);
-        JSValueOperand arg2(this, node.child2);
-        JSValueOperand arg3(this, node.child3);
+        JSValueOperand arg1(this, node.child1());
+        JSValueOperand arg2(this, node.child2());
+        JSValueOperand arg3(this, node.child3());
         GPRReg arg1GPR = arg1.gpr();
         GPRReg arg2GPR = arg2.gpr();
@@ -826 +826 @@
 
     case GetById: {
-        JSValueOperand base(this, node.child1);
+        JSValueOperand base(this, node.child1());
         GPRReg baseGPR = base.gpr();
         GPRTemporary result(this, base);
@@ -840 +840 @@
 
     case PutById: {
-        JSValueOperand base(this, node.child1);
-        JSValueOperand value(this, node.child2);
+        JSValueOperand base(this, node.child1());
+        JSValueOperand value(this, node.child2());
         GPRTemporary scratch(this);
         GPRReg valueGPR = value.gpr();
@@ -855 +855 @@
 
     case PutByIdDirect: {
-        JSValueOperand base(this, node.child1);
-        JSValueOperand value(this, node.child2);
+        JSValueOperand base(this, node.child1());
+        JSValueOperand value(this, node.child2());
         GPRTemporary scratch(this);
         GPRReg valueGPR = value.gpr();
@@ -881 +881 @@
 
     case PutGlobalVar: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         GPRTemporary globalObject(this);
         GPRTemporary scratch(this);
@@ -908 +908 @@
 
     case Branch: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         GPRReg valueGPR = value.gpr();
         flushRegisters();
@@ -937 +937 @@
 
         // Return the result in returnValueGPR.
-        JSValueOperand op1(this, node.child1);
+        JSValueOperand op1(this, node.child1());
         m_jit.move(op1.gpr(), GPRInfo::returnValueGPR);
 
@@ -953 +953 @@
 
     case CheckHasInstance: {
-        JSValueOperand base(this, node.child1);
+        JSValueOperand base(this, node.child1());
         GPRTemporary structure(this);
 
@@ -981 +981 @@
 
     case InstanceOf: {
-        JSValueOperand value(this, node.child1);
-        JSValueOperand base(this, node.child2);
-        JSValueOperand prototype(this, node.child3);
+        JSValueOperand value(this, node.child1());
+        JSValueOperand base(this, node.child2());
+        JSValueOperand prototype(this, node.child3());
         GPRTemporary scratch(this, base);
 
@@ -1052 +1052 @@
         ASSERT_NOT_REACHED();
 #endif
+        break;
+        
+    case Call:
+        JSValueOperand callee(this, m_jit.graph().m_varArgChildren[node.firstChild()]);
+        GPRReg calleeGPR = callee.gpr();
+        emitCall(node, calleeGPR);
+        break;
     }
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -43 +43 @@
         "jmp _" STRINGIZE(function) "WithReturnAddress" "\n" \
     );
+#define FUNCTION_WRAPPER_WITH_ARG2_RETURN_ADDRESS(function) FUNCTION_WRAPPER_WITH_RETURN_ADDRESS(function, rsi)
 #define FUNCTION_WRAPPER_WITH_ARG4_RETURN_ADDRESS(function) FUNCTION_WRAPPER_WITH_RETURN_ADDRESS(function, rcx)
 #define FUNCTION_WRAPPER_WITH_ARG5_RETURN_ADDRESS(function) FUNCTION_WRAPPER_WITH_RETURN_ADDRESS(function, r8)
@@ -398 +399 @@
 }
 
+EncodedJSValue getHostCallReturnValue();
+EncodedJSValue getHostCallReturnValueWithExecState(ExecState*);
+
+asm (
+".globl _" STRINGIZE(getHostCallReturnValue) "\n"
+"_" STRINGIZE(getHostCallReturnValue) ":" "\n"
+    "mov -40(%r13), %r13\n"
+    "mov %r13, %rdi\n"
+    "jmp _" STRINGIZE(getHostCallReturnValueWithExecState) "\n"
+);
+
+EncodedJSValue getHostCallReturnValueWithExecState(ExecState* exec)
+{
+    return JSValue::encode(exec->globalData().hostCallReturnValue);
+}
+
+static void* handleHostCall(ExecState* execCallee, JSValue callee)
+{
+    ExecState* exec = execCallee->callerFrame();
+    JSGlobalData* globalData = &exec->globalData();
+    CallData callData;
+    CallType callType = getCallData(callee, callData);
+    
+    ASSERT(callType != CallTypeJS);
+    
+    if (callType == CallTypeHost) {
+        if (!globalData->interpreter->registerFile().grow(execCallee->registers())) {
+            globalData->exception = createStackOverflowError(exec);
+            return 0;
+        }
+        
+        execCallee->setScopeChain(exec->scopeChain());
+        
+        globalData->hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
+        
+        if (globalData->exception)
+            return 0;
+        return reinterpret_cast<void*>(getHostCallReturnValue);
+    }
+    
+    ASSERT(callType == CallTypeNone);
+    exec->globalData().exception = createNotAFunctionError(exec, callee);
+    return 0;
+}
+
+void* operationLinkCallWithReturnAddress(ExecState*, ReturnAddressPtr);
+FUNCTION_WRAPPER_WITH_ARG2_RETURN_ADDRESS(operationLinkCall);
+void* operationLinkCallWithReturnAddress(ExecState* execCallee, ReturnAddressPtr returnAddress)
+{
+    ExecState* exec = execCallee->callerFrame();
+    JSGlobalData* globalData = &exec->globalData();
+    JSValue calleeAsValue = execCallee->calleeAsValue();
+    JSCell* calleeAsFunctionCell = getJSFunction(*globalData, calleeAsValue);
+    if (!calleeAsFunctionCell)
+        return handleHostCall(execCallee, calleeAsValue);
+    JSFunction* callee = asFunction(calleeAsFunctionCell);
+    ExecutableBase* executable = callee->executable();
+    
+    MacroAssemblerCodePtr codePtr;
+    CodeBlock* codeBlock = 0;
+    if (executable->isHostFunction())
+        codePtr = executable->generatedJITCodeForCall().addressForCall();
+    else {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+        JSObject* error = functionExecutable->compileForCall(exec, callee->scope());
+        if (error) {
+            globalData->exception = createStackOverflowError(exec);
+            return 0;
+        }
+        codeBlock = &functionExecutable->generatedBytecodeForCall();
+        if (execCallee->argumentCountIncludingThis() == static_cast<size_t>(codeBlock->m_numParameters))
+            codePtr = functionExecutable->generatedJITCodeForCall().addressForCall();
+        else
+            codePtr = functionExecutable->generatedJITCodeForCallWithArityCheck();
+        execCallee->setScopeChain(callee->scope());
+    }
+    CallLinkInfo& callLinkInfo = exec->codeBlock()->getCallLinkInfo(returnAddress);
+    if (!callLinkInfo.seenOnce())
+        callLinkInfo.setSeen();
+    else
+        dfgLinkCall(execCallee, callLinkInfo, codeBlock, callee, codePtr);
+    return codePtr.executableAddress();
+}
+
+void* operationVirtualCall(ExecState* execCallee)
+{
+    ExecState* exec = execCallee->callerFrame();
+    JSGlobalData* globalData = &exec->globalData();
+    JSValue calleeAsValue = execCallee->calleeAsValue();
+    JSCell* calleeAsFunctionCell = getJSFunction(*globalData, calleeAsValue);
+    if (!calleeAsFunctionCell)
+        return handleHostCall(execCallee, calleeAsValue);
+    
+    JSFunction* function = asFunction(calleeAsFunctionCell);
+    ExecutableBase* executable = function->executable();
+    if (executable->isHostFunction())
+        return executable->generatedJITCodeForCall().addressForCall().executableAddress();
+
+    FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+    JSObject* error = functionExecutable->compileForCall(exec, function->scope());
+    if (error) {
+        exec->globalData().exception = error;
+        return 0;
+    }
+    execCallee->setScopeChain(function->scope());
+    return functionExecutable->generatedJITCodeForCallWithArityCheck().executableAddress();
+}
+
 EncodedJSValue operationInstanceOf(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, EncodedJSValue encodedPrototype)
 {

trunk/Source/JavaScriptCore/dfg/DFGOperations.h

@@ -81 +81 @@
 bool operationCompareEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
 bool operationCompareStrictEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+void* operationVirtualCall(ExecState*);
+void* operationLinkCall(ExecState*);
 
 // This method is used to lookup an exception hander, keyed by faultLocation, which is

trunk/Source/JavaScriptCore/dfg/DFGRepatch.cpp

@@ -376 +376 @@
 }
 
+void dfgLinkCall(ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock, JSFunction* callee, MacroAssemblerCodePtr codePtr)
+{
+    CodeBlock* callerCodeBlock = exec->callerFrame()->codeBlock();
+    
+    RepatchBuffer repatchBuffer(callerCodeBlock);
+    
+    if (!calleeCodeBlock || static_cast<int>(exec->argumentCountIncludingThis()) == calleeCodeBlock->m_numParameters) {
+        ASSERT(!callLinkInfo.isLinked());
+        callLinkInfo.callee.set(exec->callerFrame()->globalData(), callLinkInfo.hotPathBegin, callerCodeBlock->ownerExecutable(), callee);
+        repatchBuffer.relink(callLinkInfo.hotPathOther, codePtr);
+    }
+    
+    repatchBuffer.relink(CodeLocationCall(callLinkInfo.callReturnLocation), operationVirtualCall);
+}
+
 } } // namespace JSC::DFG
 

trunk/Source/JavaScriptCore/dfg/DFGRepatch.h

@@ -37 +37 @@
 void dfgBuildGetByIDList(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&);
 void dfgRepatchPutByID(ExecState*, JSValue, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
+void dfgLinkCall(ExecState*, CallLinkInfo&, CodeBlock*, JSFunction* callee, MacroAssemblerCodePtr);
 
 } } // namespace JSC::DFG

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -364 +364 @@
     }
 
-    if (isInt32Constant(node.child1)) {
-        int32_t imm = valueOfInt32Constant(node.child1);
-        SpeculateIntegerOperand op2(this, node.child2);
+    if (isInt32Constant(node.child1())) {
+        int32_t imm = valueOfInt32Constant(node.child1());
+        SpeculateIntegerOperand op2(this, node.child2());
         addBranch(m_jit.branch32(condition, JITCompiler::Imm32(imm), op2.gpr()), taken);
-    } else if (isInt32Constant(node.child2)) {
-        SpeculateIntegerOperand op1(this, node.child1);
-        int32_t imm = valueOfInt32Constant(node.child2);
+    } else if (isInt32Constant(node.child2())) {
+        SpeculateIntegerOperand op1(this, node.child1());
+        int32_t imm = valueOfInt32Constant(node.child2());
         addBranch(m_jit.branch32(condition, op1.gpr(), JITCompiler::Imm32(imm)), taken);
     } else {
-        SpeculateIntegerOperand op1(this, node.child1);
-        SpeculateIntegerOperand op2(this, node.child2);
+        SpeculateIntegerOperand op1(this, node.child1());
+        SpeculateIntegerOperand op2(this, node.child2());
         addBranch(m_jit.branch32(condition, op1.gpr(), op2.gpr()), taken);
     }
@@ -399 +399 @@
     }
 
-    JSValueOperand op1(this, node.child1);
-    JSValueOperand op2(this, node.child2);
+    JSValueOperand op1(this, node.child1());
+    JSValueOperand op2(this, node.child2());
     GPRReg op1GPR = op1.gpr();
     GPRReg op2GPR = op2.gpr();
@@ -424 +424 @@
         ASSERT(node.adjustedRefCount() == 1);
 
-        if (shouldSpeculateInteger(node.child1, node.child2))
+        if (shouldSpeculateInteger(node.child1(), node.child2()))
             compilePeepHoleIntegerBranch(node, branchNodeIndex, condition);
         else
             compilePeepHoleCall(node, branchNodeIndex, operation);
 
-        use(node.child1);
-        use(node.child2);
+        use(node.child1());
+        use(node.child2());
         m_compileIndex = branchNodeIndex;
         return true;
@@ -436 +436 @@
 
     // Normal case, not fused to branch.
-    SpeculateIntegerOperand op1(this, node.child1);
-    SpeculateIntegerOperand op2(this, node.child2);
+    SpeculateIntegerOperand op1(this, node.child1());
+    SpeculateIntegerOperand op2(this, node.child2());
     GPRTemporary result(this, op1, op2);
 
@@ -483 +483 @@
         switch (m_jit.graph().getPrediction(node.local())) {
         case PredictInt32: {
-            SpeculateIntegerOperand value(this, node.child1);
+            SpeculateIntegerOperand value(this, node.child1());
             m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
             noResult(m_compileIndex);
@@ -489 +489 @@
         }
         case PredictArray: {
-            SpeculateCellOperand cell(this, node.child1);
+            SpeculateCellOperand cell(this, node.child1());
             m_jit.storePtr(cell.gpr(), JITCompiler::addressFor(node.local()));
             noResult(m_compileIndex);
@@ -496 +496 @@
 
         default: {
-            JSValueOperand value(this, node.child1);
+            JSValueOperand value(this, node.child1());
             m_jit.storePtr(value.gpr(), JITCompiler::addressFor(node.local()));
             noResult(m_compileIndex);
@@ -508 +508 @@
     case BitOr:
     case BitXor:
-        if (isInt32Constant(node.child1)) {
-            SpeculateIntegerOperand op2(this, node.child2);
+        if (isInt32Constant(node.child1())) {
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op2);
 
-            bitOp(op, valueOfInt32Constant(node.child1), op2.gpr(), result.gpr());
+            bitOp(op, valueOfInt32Constant(node.child1()), op2.gpr(), result.gpr());
 
             integerResult(result.gpr(), m_compileIndex);
-        } else if (isInt32Constant(node.child2)) {
-            SpeculateIntegerOperand op1(this, node.child1);
+        } else if (isInt32Constant(node.child2())) {
+            SpeculateIntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
 
-            bitOp(op, valueOfInt32Constant(node.child2), op1.gpr(), result.gpr());
+            bitOp(op, valueOfInt32Constant(node.child2()), op1.gpr(), result.gpr());
 
             integerResult(result.gpr(), m_compileIndex);
         } else {
-            SpeculateIntegerOperand op1(this, node.child1);
-            SpeculateIntegerOperand op2(this, node.child2);
+            SpeculateIntegerOperand op1(this, node.child1());
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op1, op2);
 
@@ -538 +538 @@
     case BitLShift:
     case BitURShift:
-        if (isInt32Constant(node.child2)) {
-            SpeculateIntegerOperand op1(this, node.child1);
+        if (isInt32Constant(node.child2())) {
+            SpeculateIntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
 
-            shiftOp(op, op1.gpr(), valueOfInt32Constant(node.child2) & 0x1f, result.gpr());
+            shiftOp(op, op1.gpr(), valueOfInt32Constant(node.child2()) & 0x1f, result.gpr());
 
             integerResult(result.gpr(), m_compileIndex);
         } else {
             // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
-            SpeculateIntegerOperand op1(this, node.child1);
-            SpeculateIntegerOperand op2(this, node.child2);
+            SpeculateIntegerOperand op1(this, node.child1());
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op1);
 
@@ -560 +560 @@
 
     case UInt32ToNumber: {
-        IntegerOperand op1(this, node.child1);
+        IntegerOperand op1(this, node.child1());
         GPRTemporary result(this, op1);
 
@@ -572 +572 @@
 
     case ValueToInt32: {
-        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op1(this, node.child1());
         GPRTemporary result(this, op1);
         m_jit.move(op1.gpr(), result.gpr());
@@ -580 +580 @@
 
     case ValueToNumber: {
-        if (isInteger(node.child1)) {
-            SpeculateIntegerOperand op1(this, node.child1);
+        if (isInteger(node.child1())) {
+            SpeculateIntegerOperand op1(this, node.child1());
             GPRTemporary result(this, op1);
             m_jit.move(op1.gpr(), result.gpr());
@@ -587 +587 @@
             break;
         }
-        SpeculateDoubleOperand op1(this, node.child1);
+        SpeculateDoubleOperand op1(this, node.child1());
         FPRTemporary result(this, op1);
         m_jit.moveDouble(op1.fpr(), result.fpr());
@@ -596 +596 @@
     case ValueAdd:
     case ArithAdd: {
-        if (shouldSpeculateInteger(node.child1, node.child2)) {
-            if (isInt32Constant(node.child1)) {
-                int32_t imm1 = valueOfInt32Constant(node.child1);
-                SpeculateIntegerOperand op2(this, node.child2);
+        if (shouldSpeculateInteger(node.child1(), node.child2())) {
+            if (isInt32Constant(node.child1())) {
+                int32_t imm1 = valueOfInt32Constant(node.child1());
+                SpeculateIntegerOperand op2(this, node.child2());
                 GPRTemporary result(this);
 
@@ -608 +608 @@
             }
                 
-            if (isInt32Constant(node.child2)) {
-                SpeculateIntegerOperand op1(this, node.child1);
-                int32_t imm2 = valueOfInt32Constant(node.child2);
+            if (isInt32Constant(node.child2())) {
+                SpeculateIntegerOperand op1(this, node.child1());
+                int32_t imm2 = valueOfInt32Constant(node.child2());
                 GPRTemporary result(this);
 
@@ -619 +619 @@
             }
                 
-            SpeculateIntegerOperand op1(this, node.child1);
-            SpeculateIntegerOperand op2(this, node.child2);
+            SpeculateIntegerOperand op1(this, node.child1());
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this, op1, op2);
 
@@ -639 +639 @@
         }
 
-        SpeculateDoubleOperand op1(this, node.child1);
-        SpeculateDoubleOperand op2(this, node.child2);
+        SpeculateDoubleOperand op1(this, node.child1());
+        SpeculateDoubleOperand op2(this, node.child2());
         FPRTemporary result(this, op1, op2);
 
@@ -652 +652 @@
 
     case ArithSub: {
-        if (shouldSpeculateInteger(node.child1, node.child2)) {
-            if (isInt32Constant(node.child2)) {
-                SpeculateIntegerOperand op1(this, node.child1);
-                int32_t imm2 = valueOfInt32Constant(node.child2);
+        if (shouldSpeculateInteger(node.child1(), node.child2())) {
+            if (isInt32Constant(node.child2())) {
+                SpeculateIntegerOperand op1(this, node.child1());
+                int32_t imm2 = valueOfInt32Constant(node.child2());
                 GPRTemporary result(this);
 
@@ -664 +664 @@
             }
                 
-            SpeculateIntegerOperand op1(this, node.child1);
-            SpeculateIntegerOperand op2(this, node.child2);
+            SpeculateIntegerOperand op1(this, node.child1());
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this);
 
@@ -674 +674 @@
         }
 
-        SpeculateDoubleOperand op1(this, node.child1);
-        SpeculateDoubleOperand op2(this, node.child2);
+        SpeculateDoubleOperand op1(this, node.child1());
+        SpeculateDoubleOperand op2(this, node.child2());
         FPRTemporary result(this, op1);
 
@@ -687 +687 @@
 
     case ArithMul: {
-        if (shouldSpeculateInteger(node.child1, node.child2)) {
-            SpeculateIntegerOperand op1(this, node.child1);
-            SpeculateIntegerOperand op2(this, node.child2);
+        if (shouldSpeculateInteger(node.child1(), node.child2())) {
+            SpeculateIntegerOperand op1(this, node.child1());
+            SpeculateIntegerOperand op2(this, node.child2());
             GPRTemporary result(this);
 
@@ -705 +705 @@
         }
 
-        SpeculateDoubleOperand op1(this, node.child1);
-        SpeculateDoubleOperand op2(this, node.child2);
+        SpeculateDoubleOperand op1(this, node.child1());
+        SpeculateDoubleOperand op2(this, node.child2());
         FPRTemporary result(this, op1, op2);
 
@@ -719 +719 @@
 
     case ArithDiv: {
-        SpeculateDoubleOperand op1(this, node.child1);
-        SpeculateDoubleOperand op2(this, node.child2);
+        SpeculateDoubleOperand op1(this, node.child1());
+        SpeculateDoubleOperand op2(this, node.child2());
         FPRTemporary result(this, op1);
 
@@ -732 +732 @@
 
     case ArithMod: {
-        SpeculateIntegerOperand op1(this, node.child1);
-        SpeculateIntegerOperand op2(this, node.child2);
+        SpeculateIntegerOperand op1(this, node.child1());
+        SpeculateIntegerOperand op2(this, node.child2());
         GPRTemporary eax(this, X86Registers::eax);
         GPRTemporary edx(this, X86Registers::edx);
@@ -760 +760 @@
 
     case LogicalNot: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
 
@@ -799 +799 @@
 
     case CompareStrictEq: {
-        SpeculateIntegerOperand op1(this, node.child1);
-        SpeculateIntegerOperand op2(this, node.child2);
+        SpeculateIntegerOperand op1(this, node.child1());
+        SpeculateIntegerOperand op2(this, node.child2());
         GPRTemporary result(this, op1, op2);
 
@@ -812 +812 @@
 
     case GetByVal: {
-        NodeIndex alias = node.child3;
+        NodeIndex alias = node.child3();
         if (alias != NoNode) {
             // FIXME: result should be able to reuse child1, child2. Should have an 'UnusedOperand' type.
-            JSValueOperand aliasedValue(this, node.child3);
+            JSValueOperand aliasedValue(this, node.child3());
             GPRTemporary result(this, aliasedValue);
             m_jit.move(aliasedValue.gpr(), result.gpr());
@@ -822 +822 @@
         }
 
-        SpeculateCellOperand base(this, node.child1);
-        SpeculateStrictInt32Operand property(this, node.child2);
+        SpeculateCellOperand base(this, node.child1());
+        SpeculateStrictInt32Operand property(this, node.child2());
         GPRTemporary storage(this);
 
@@ -836 +836 @@
         // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
         // If we have predicted the base to be type array, we can skip the check.
-        Node& baseNode = m_jit.graph()[node.child1];
+        Node& baseNode = m_jit.graph()[node.child1()];
         if (baseNode.op != GetLocal || m_jit.graph().getPrediction(baseNode.local()) != PredictArray)
             speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
@@ -853 +853 @@
 
     case PutByVal: {
-        SpeculateCellOperand base(this, node.child1);
-        SpeculateStrictInt32Operand property(this, node.child2);
-        JSValueOperand value(this, node.child3);
+        SpeculateCellOperand base(this, node.child1());
+        SpeculateStrictInt32Operand property(this, node.child2());
+        JSValueOperand value(this, node.child3());
         GPRTemporary scratch(this);
 
@@ -868 +868 @@
         // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
         // If we have predicted the base to be type array, we can skip the check.
-        Node& baseNode = m_jit.graph()[node.child1];
+        Node& baseNode = m_jit.graph()[node.child1()];
         if (baseNode.op != GetLocal || m_jit.graph().getPrediction(baseNode.local()) != PredictArray)
             speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
@@ -910 +910 @@
 
     case PutByValAlias: {
-        SpeculateCellOperand base(this, node.child1);
-        SpeculateStrictInt32Operand property(this, node.child2);
-        JSValueOperand value(this, node.child3);
+        SpeculateCellOperand base(this, node.child1());
+        SpeculateStrictInt32Operand property(this, node.child2());
+        JSValueOperand value(this, node.child3());
         GPRTemporary scratch(this);
         
@@ -942 +942 @@
 
     case Branch: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         GPRReg valueReg = value.gpr();
 
@@ -978 +978 @@
 
         // Return the result in returnValueGPR.
-        JSValueOperand op1(this, node.child1);
+        JSValueOperand op1(this, node.child1());
         m_jit.move(op1.gpr(), GPRInfo::returnValueGPR);
 
@@ -994 +994 @@
 
     case ConvertThis: {
-        SpeculateCellOperand thisValue(this, node.child1);
+        SpeculateCellOperand thisValue(this, node.child1());
         GPRTemporary temp(this);
 
@@ -1005 +1005 @@
 
     case GetById: {
-        SpeculateCellOperand base(this, node.child1);
+        SpeculateCellOperand base(this, node.child1());
         GPRTemporary result(this, base);
 
@@ -1017 +1017 @@
 
     case PutById: {
-        SpeculateCellOperand base(this, node.child1);
-        JSValueOperand value(this, node.child2);
+        SpeculateCellOperand base(this, node.child1());
+        JSValueOperand value(this, node.child2());
         GPRTemporary scratch(this);
 
@@ -1028 +1028 @@
 
     case PutByIdDirect: {
-        SpeculateCellOperand base(this, node.child1);
-        JSValueOperand value(this, node.child2);
+        SpeculateCellOperand base(this, node.child1());
+        JSValueOperand value(this, node.child2());
         GPRTemporary scratch(this);
 
@@ -1050 +1050 @@
 
     case PutGlobalVar: {
-        JSValueOperand value(this, node.child1);
+        JSValueOperand value(this, node.child1());
         GPRTemporary globalObject(this);
         GPRTemporary scratch(this);
@@ -1069 +1069 @@
 
     case CheckHasInstance: {
-        SpeculateCellOperand base(this, node.child1);
+        SpeculateCellOperand base(this, node.child1());
         GPRTemporary structure(this);
 
@@ -1081 +1081 @@
 
     case InstanceOf: {
-        SpeculateCellOperand value(this, node.child1);
+        SpeculateCellOperand value(this, node.child1());
         // Base unused since we speculate default InstanceOf behaviour in CheckHasInstance.
-        SpeculateCellOperand prototype(this, node.child3);
+        SpeculateCellOperand prototype(this, node.child3());
 
         GPRTemporary scratch(this);
@@ -1126 +1126 @@
         ASSERT_NOT_REACHED();
 #endif
+        break;
+        
+    case Call:
+        JSValueOperand callee(this, m_jit.graph().m_varArgChildren[node.firstChild()]);
+        GPRReg calleeGPR = callee.gpr();
+        emitCall(node, calleeGPR);
+        break;
     }
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@ -153 +153 @@
         // Check if the lastNode is a branch on this node.
         Node& lastNode = m_jit.graph()[lastNodeIndex];
-        return lastNode.op == Branch && lastNode.child1 == m_compileIndex ? lastNodeIndex : NoNode;
+        return lastNode.op == Branch && lastNode.child1() == m_compileIndex ? lastNodeIndex : NoNode;
     }
 

trunk/Source/JavaScriptCore/interpreter/CallFrame.h

@@ -39 +39 @@
     class ExecState : private Register {
     public:
+        JSValue calleeAsValue() const { return this[RegisterFile::Callee].jsValue(); }
         JSObject* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -75 +75 @@
     , m_codeBlock(codeBlock)
     , m_labels(codeBlock ? codeBlock->instructions().size() : 0)
-    , m_callStructureStubCompilationInfo(codeBlock ? codeBlock->numberOfCallLinkInfos() : 0)
     , m_bytecodeOffset((unsigned)-1)
 #if USE(JSVALUE32_64)
@@ -356 +355 @@
     }
 
-    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
 
 #ifndef NDEBUG
@@ -465 +464 @@
 
     ASSERT(m_propertyAccessInstructionIndex == m_propertyAccessCompilationInfo.size());
-    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_callLinkInfoIndex == m_callStructureStubCompilationInfo.size());
 
 #ifndef NDEBUG
@@ -589 +588 @@
         info.hotPathBegin = patchBuffer.locationOf(m_propertyAccessCompilationInfo[i].hotPathBegin);
     }
+    m_codeBlock->setNumberOfCallLinkInfos(m_callStructureStubCompilationInfo.size());
     for (unsigned i = 0; i < m_codeBlock->numberOfCallLinkInfos(); ++i) {
         CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
         info.isCall = m_callStructureStubCompilationInfo[i].isCall;
-        info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
+        info.callReturnLocation = CodeLocationLabel(patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation));
         info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
         info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
@@ -607 +607 @@
         *functionEntryArityCheck = patchBuffer.locationOf(arityCheck);
 
-    return patchBuffer.finalizeCode();
+    return JITCode(patchBuffer.finalizeCode(), JITCode::BaselineJIT);
 }
 
@@ -624 +624 @@
     // patch the call so we do not continue to try to link.
     if (kind == CodeForCall) {
-        repatchBuffer.relink(callLinkInfo->callReturnLocation, globalData->jitStubs->ctiVirtualCall());
+        repatchBuffer.relink(CodeLocationNearCall(callLinkInfo->callReturnLocation), globalData->jitStubs->ctiVirtualCall());
         return;
     }
 
     ASSERT(kind == CodeForConstruct);
-    repatchBuffer.relink(callLinkInfo->callReturnLocation, globalData->jitStubs->ctiVirtualConstruct());
+    repatchBuffer.relink(CodeLocationNearCall(callLinkInfo->callReturnLocation), globalData->jitStubs->ctiVirtualConstruct());
 }
 

trunk/Source/JavaScriptCore/jit/JITCall.cpp

@@ -133 +133 @@
     addSlowCase(jumpToSlow);
     ASSERT_JIT_OFFSET(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow), patchOffsetOpCallCompareToJump);
+    
+    ASSERT(m_callStructureStubCompilationInfo.size() == callLinkInfoIndex);
+    m_callStructureStubCompilationInfo.append(StructureStubCompilationInfo());
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
     m_callStructureStubCompilationInfo[callLinkInfoIndex].isCall = opcodeID != op_construct;

trunk/Source/JavaScriptCore/jit/JITCode.h

@@ -38 +38 @@
     class JSGlobalData;
     class RegisterFile;
-
+    
     class JITCode {
         typedef MacroAssemblerCodeRef CodeRef;
         typedef MacroAssemblerCodePtr CodePtr;
     public:
+        enum JITType { HostCallThunk, BaselineJIT, DFGJIT };
+
         JITCode()
         {
         }
 
-        JITCode(const CodeRef ref)
+        JITCode(const CodeRef ref, JITType jitType)
             : m_ref(ref)
+            , m_jitType(jitType)
         {
         }
@@ -94 +97 @@
             return m_ref.m_executablePool.get();
         }
+        
+        JITType jitType()
+        {
+            return m_jitType;
+        }
 
         // Host functions are a bit special; they have a m_code pointer but they
@@ -99 +107 @@
         static JITCode HostFunction(CodePtr code)
         {
-            return JITCode(code.dataLocation(), 0, 0);
+            return JITCode(code.dataLocation(), 0, 0, HostCallThunk);
         }
 
@@ -109 +117 @@
 
     private:
-        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size, JITType jitType)
             : m_ref(code, executablePool, size)
+            , m_jitType(jitType)
         {
         }
 
         CodeRef m_ref;
+        JITType m_jitType;
     };
 

trunk/Source/JavaScriptCore/runtime/JSFunction.h

@@ -36 +36 @@
     class NativeExecutable;
     class VPtrHackExecutable;
+    namespace DFG {
+    class JITCodeGenerator;
+    }
 
     EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState*);
@@ -41 +44 @@
     class JSFunction : public JSObjectWithGlobalObject {
         friend class JIT;
+        friend class DFG::JITCodeGenerator;
         friend class JSGlobalData;
 

trunk/Source/JavaScriptCore/runtime/JSGlobalData.h

@@ -235 +235 @@
 #if ENABLE(JIT)
         ReturnAddressPtr exceptionLocation;
+        JSValue hostCallReturnValue;
 #endif