Imported WebKit commit 75bb2fc5882d2e1b3d5572c2961507996cbca5e3 (http://svn.webkit.org/repository/webkit/trunk@104681)

13 files changed, 625 insertions, 222 deletions

diff --git a/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp b/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp
new file mode 100644
index 000000000..4c108ecf1
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/CallLinkInfo.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallLinkInfo.h"
+
+#include "DFGOperations.h"
+#include "RepatchBuffer.h"
+
+#if ENABLE(JIT)
+namespace JSC {
+
+void CallLinkInfo::unlink(JSGlobalData& globalData, RepatchBuffer& repatchBuffer)
+{
+    ASSERT(isLinked());
+    
+    if (isDFG) {
+#if ENABLE(DFG_JIT)
+        repatchBuffer.relink(CodeLocationCall(callReturnLocation), callType == Construct ? DFG::operationLinkConstruct : DFG::operationLinkCall);
+#else
+        ASSERT_NOT_REACHED();
+#endif
+    } else
+        repatchBuffer.relink(CodeLocationNearCall(callReturnLocation), callType == Construct ? globalData.jitStubs->ctiVirtualConstructLink() : globalData.jitStubs->ctiVirtualCallLink());
+    hasSeenShouldRepatch = false;
+    callee.clear();
+
+    // It will be on a list if the callee has a code block.
+    if (isOnList())
+        remove();
+}
+
+} // namespace JSC
+#endif // ENABLE(JIT)
+
diff --git a/Source/JavaScriptCore/bytecode/CallLinkInfo.h b/Source/JavaScriptCore/bytecode/CallLinkInfo.h
new file mode 100644
index 000000000..8ec48e4e1
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/CallLinkInfo.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CallLinkInfo_h
+#define CallLinkInfo_h
+
+#include "CodeLocation.h"
+#include "JITWriteBarrier.h"
+#include "JSFunction.h"
+#include "Opcode.h"
+#include "WriteBarrier.h"
+#include <wtf/Platform.h>
+#include <wtf/SentinelLinkedList.h>
+
+namespace JSC {
+
+#if ENABLE(JIT)
+
+class RepatchBuffer;
+
+struct CallLinkInfo : public BasicRawSentinelNode<CallLinkInfo> {
+    enum CallType { None, Call, CallVarargs, Construct };
+    static CallType callTypeFor(OpcodeID opcodeID)
+    {
+        if (opcodeID == op_call || opcodeID == op_call_eval)
+            return Call;
+        if (opcodeID == op_construct)
+            return Construct;
+        ASSERT(opcodeID == op_call_varargs);
+        return CallVarargs;
+    }
+        
+    CallLinkInfo()
+        : hasSeenShouldRepatch(false)
+        , isDFG(false)
+        , callType(None)
+    {
+    }
+        
+    ~CallLinkInfo()
+    {
+        if (isOnList())
+            remove();
+    }
+
+    CodeLocationLabel callReturnLocation; // it's a near call in the old JIT, or a normal call in DFG
+    CodeLocationDataLabelPtr hotPathBegin;
+    CodeLocationNearCall hotPathOther;
+    JITWriteBarrier<JSFunction> callee;
+    WriteBarrier<JSFunction> lastSeenCallee;
+    bool hasSeenShouldRepatch : 1;
+    bool isDFG : 1;
+    CallType callType : 2;
+    unsigned bytecodeIndex;
+
+    bool isLinked() { return callee; }
+    void unlink(JSGlobalData&, RepatchBuffer&);
+
+    bool seenOnce()
+    {
+        return hasSeenShouldRepatch;
+    }
+
+    void setSeen()
+    {
+        hasSeenShouldRepatch = true;
+    }
+};
+
+inline void* getCallLinkInfoReturnLocation(CallLinkInfo* callLinkInfo)
+{
+    return callLinkInfo->callReturnLocation.executableAddress();
+}
+
+inline unsigned getCallLinkInfoBytecodeIndex(CallLinkInfo* callLinkInfo)
+{
+    return callLinkInfo->bytecodeIndex;
+}
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
+#endif // CallLinkInfo_h
diff --git a/Source/JavaScriptCore/bytecode/CallReturnOffsetToBytecodeOffset.h b/Source/JavaScriptCore/bytecode/CallReturnOffsetToBytecodeOffset.h
new file mode 100644
index 000000000..3a7448efd
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/CallReturnOffsetToBytecodeOffset.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CallReturnOffsetToBytecodeOffset_h
+#define CallReturnOffsetToBytecodeOffset_h
+
+#include <wtf/Platform.h>
+
+namespace JSC {
+
+#if ENABLE(JIT)
+// This structure is used to map from a call return location
+// (given as an offset in bytes into the JIT code) back to
+// the bytecode index of the corresponding bytecode operation.
+// This is then used to look up the corresponding handler.
+// FIXME: This should be made inlining aware! Currently it isn't
+// because we never inline code that has exception handlers.
+struct CallReturnOffsetToBytecodeOffset {
+    CallReturnOffsetToBytecodeOffset(unsigned callReturnOffset, unsigned bytecodeOffset)
+        : callReturnOffset(callReturnOffset)
+        , bytecodeOffset(bytecodeOffset)
+    {
+    }
+
+    unsigned callReturnOffset;
+    unsigned bytecodeOffset;
+};
+
+inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeOffset* pc)
+{
+    return pc->callReturnOffset;
+}
+#endif
+
+} // namespace JSC
+
+#endif // CallReturnOffsetToBytecodeOffset_h
+
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index a14ce64a1..47745268c 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1413,7 +1413,6 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_numCalleeRegisters(other.m_numCalleeRegisters)
     , m_numVars(other.m_numVars)
     , m_numCapturedVars(other.m_numCapturedVars)
-    , m_numParameters(other.m_numParameters)
     , m_isConstructor(other.m_isConstructor)
     , m_shouldDiscardBytecode(false)
     , m_ownerExecutable(*other.m_globalData, other.m_ownerExecutable.get(), other.m_ownerExecutable.get())
@@ -1448,6 +1447,7 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
 {
+    setNumParameters(other.numParameters());
     optimizeAfterWarmUp();
     
     if (other.m_rareData) {
@@ -1469,9 +1469,9 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
     , m_heap(&m_globalObject->globalData().heap)
     , m_numCalleeRegisters(0)
     , m_numVars(0)
-    , m_numParameters(0)
     , m_isConstructor(isConstructor)
     , m_shouldDiscardBytecode(false)
+    , m_numParameters(0)
     , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
     , m_globalData(0)
     , m_instructions(adoptRef(new Instructions))
@@ -1538,6 +1538,24 @@ CodeBlock::~CodeBlock()
 #endif
 }
 
+void CodeBlock::setNumParameters(int newValue)
+{
+    m_numParameters = newValue;
+
+#if ENABLE(VALUE_PROFILER)
+    m_argumentValueProfiles.resize(newValue);
+#endif
+}
+
+void CodeBlock::addParameter()
+{
+    m_numParameters++;
+
+#if ENABLE(VALUE_PROFILER)
+    m_argumentValueProfiles.append(ValueProfile());
+#endif
+}
+
 void CodeBlock::visitStructures(SlotVisitor& visitor, Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
@@ -2038,38 +2056,6 @@ void CodeBlock::createActivation(CallFrame* callFrame)
 }
     
 #if ENABLE(JIT)
-void CallLinkInfo::unlink(JSGlobalData& globalData, RepatchBuffer& repatchBuffer)
-{
-    ASSERT(isLinked());
-    
-    if (isDFG) {
-#if ENABLE(DFG_JIT)
-        repatchBuffer.relink(CodeLocationCall(callReturnLocation), callType == Construct ? operationLinkConstruct : operationLinkCall);
-#else
-        ASSERT_NOT_REACHED();
-#endif
-    } else
-        repatchBuffer.relink(CodeLocationNearCall(callReturnLocation), callType == Construct ? globalData.jitStubs->ctiVirtualConstructLink() : globalData.jitStubs->ctiVirtualCallLink());
-    hasSeenShouldRepatch = false;
-    callee.clear();
-
-    // It will be on a list if the callee has a code block.
-    if (isOnList())
-        remove();
-}
-
-void MethodCallLinkInfo::reset(RepatchBuffer& repatchBuffer, JITCode::JITType jitType)
-{
-    cachedStructure.clearToMaxUnsigned();
-    cachedPrototype.clear();
-    cachedPrototypeStructure.clearToMaxUnsigned();
-    cachedFunction.clear();
-    
-    ASSERT_UNUSED(jitType, jitType == JITCode::BaselineJIT);
-    
-    repatchBuffer.relink(callReturnLocation, cti_op_get_by_id_method_check);
-}
-
 void CodeBlock::unlinkCalls()
 {
     if (!!m_alternative)
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 159cb65de..c440c72e1 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -30,22 +30,31 @@
 #ifndef CodeBlock_h
 #define CodeBlock_h
 
+#include "CallLinkInfo.h"
+#include "CallReturnOffsetToBytecodeOffset.h"
 #include "CodeOrigin.h"
+#include "CodeType.h"
 #include "CompactJITCodeMap.h"
 #include "DFGCodeBlocks.h"
 #include "DFGExitProfile.h"
 #include "DFGOSREntry.h"
 #include "DFGOSRExit.h"
 #include "EvalCodeCache.h"
+#include "ExpressionRangeInfo.h"
+#include "GlobalResolveInfo.h"
+#include "HandlerInfo.h"
+#include "MethodCallLinkInfo.h"
 #include "Options.h"
 #include "Instruction.h"
 #include "JITCode.h"
 #include "JITWriteBarrier.h"
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
+#include "LineInfo.h"
 #include "Nodes.h"
 #include "PredictionTracker.h"
 #include "RegExpObject.h"
+#include "StructureStubInfo.h"
 #include "UString.h"
 #include "UnconditionalFinalizer.h"
 #include "ValueProfile.h"
@@ -53,12 +62,8 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/SegmentedVector.h>
-#include <wtf/SentinelLinkedList.h>
 #include <wtf/Vector.h>
-
-#if ENABLE(JIT)
 #include "StructureStubInfo.h"
-#endif
 
 // Register numbers used in bytecode operations have different meaning according to their ranges:
 //      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h.
@@ -68,191 +73,13 @@ static const int FirstConstantRegisterIndex = 0x40000000;
 
 namespace JSC {
 
-    enum HasSeenShouldRepatch {
-        hasSeenShouldRepatch
-    };
-
     class ExecState;
     class DFGCodeBlocks;
 
-    enum CodeType { GlobalCode, EvalCode, FunctionCode };
-
     inline int unmodifiedArgumentsRegister(int argumentsRegister) { return argumentsRegister - 1; }
 
     static ALWAYS_INLINE int missingThisObjectMarker() { return std::numeric_limits<int>::max(); }
 
-    struct HandlerInfo {
-        uint32_t start;
-        uint32_t end;
-        uint32_t target;
-        uint32_t scopeDepth;
-#if ENABLE(JIT)
-        CodeLocationLabel nativeCode;
-#endif
-    };
-
-    struct ExpressionRangeInfo {
-        enum {
-            MaxOffset = (1 << 7) - 1, 
-            MaxDivot = (1 << 25) - 1
-        };
-        uint32_t instructionOffset : 25;
-        uint32_t divotPoint : 25;
-        uint32_t startOffset : 7;
-        uint32_t endOffset : 7;
-    };
-
-    struct LineInfo {
-        uint32_t instructionOffset;
-        int32_t lineNumber;
-    };
-
-#if ENABLE(JIT)
-    struct CallLinkInfo : public BasicRawSentinelNode<CallLinkInfo> {
-        enum CallType { None, Call, CallVarargs, Construct };
-        static CallType callTypeFor(OpcodeID opcodeID)
-        {
-            if (opcodeID == op_call || opcodeID == op_call_eval)
-                return Call;
-            if (opcodeID == op_construct)
-                return Construct;
-            ASSERT(opcodeID == op_call_varargs);
-            return CallVarargs;
-        }
-        
-        CallLinkInfo()
-            : hasSeenShouldRepatch(false)
-            , isDFG(false)
-            , callType(None)
-        {
-        }
-        
-        ~CallLinkInfo()
-        {
-            if (isOnList())
-                remove();
-        }
-
-        CodeLocationLabel callReturnLocation; // it's a near call in the old JIT, or a normal call in DFG
-        CodeLocationDataLabelPtr hotPathBegin;
-        CodeLocationNearCall hotPathOther;
-        JITWriteBarrier<JSFunction> callee;
-        WriteBarrier<JSFunction> lastSeenCallee;
-        bool hasSeenShouldRepatch : 1;
-        bool isDFG : 1;
-        CallType callType : 2;
-        unsigned bytecodeIndex;
-
-        bool isLinked() { return callee; }
-        void unlink(JSGlobalData&, RepatchBuffer&);
-
-        bool seenOnce()
-        {
-            return hasSeenShouldRepatch;
-        }
-
-        void setSeen()
-        {
-            hasSeenShouldRepatch = true;
-        }
-    };
-
-    struct MethodCallLinkInfo {
-        MethodCallLinkInfo()
-            : seen(false)
-        {
-        }
-
-        bool seenOnce()
-        {
-            return seen;
-        }
-
-        void setSeen()
-        {
-            seen = true;
-        }
-        
-        void reset(RepatchBuffer&, JITCode::JITType);
-
-        unsigned bytecodeIndex;
-        CodeLocationCall callReturnLocation;
-        JITWriteBarrier<Structure> cachedStructure;
-        JITWriteBarrier<Structure> cachedPrototypeStructure;
-        // We'd like this to actually be JSFunction, but InternalFunction and JSFunction
-        // don't have a common parent class and we allow specialisation on both
-        JITWriteBarrier<JSObject> cachedFunction;
-        JITWriteBarrier<JSObject> cachedPrototype;
-        bool seen;
-    };
-
-    struct GlobalResolveInfo {
-        GlobalResolveInfo(unsigned bytecodeOffset)
-            : offset(0)
-            , bytecodeOffset(bytecodeOffset)
-        {
-        }
-
-        WriteBarrier<Structure> structure;
-        unsigned offset;
-        unsigned bytecodeOffset;
-    };
-
-    // This structure is used to map from a call return location
-    // (given as an offset in bytes into the JIT code) back to
-    // the bytecode index of the corresponding bytecode operation.
-    // This is then used to look up the corresponding handler.
-    // FIXME: This should be made inlining aware! Currently it isn't
-    // because we never inline code that has exception handlers.
-    struct CallReturnOffsetToBytecodeOffset {
-        CallReturnOffsetToBytecodeOffset(unsigned callReturnOffset, unsigned bytecodeOffset)
-            : callReturnOffset(callReturnOffset)
-            , bytecodeOffset(bytecodeOffset)
-        {
-        }
-
-        unsigned callReturnOffset;
-        unsigned bytecodeOffset;
-    };
-
-    // valueAtPosition helpers for the binarySearch algorithm.
-
-    inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
-    {
-        return structureStubInfo->callReturnLocation.executableAddress();
-    }
-
-    inline unsigned getStructureStubInfoBytecodeIndex(StructureStubInfo* structureStubInfo)
-    {
-        return structureStubInfo->bytecodeIndex;
-    }
-
-    inline void* getCallLinkInfoReturnLocation(CallLinkInfo* callLinkInfo)
-    {
-        return callLinkInfo->callReturnLocation.executableAddress();
-    }
-
-    inline unsigned getCallLinkInfoBytecodeIndex(CallLinkInfo* callLinkInfo)
-    {
-        return callLinkInfo->bytecodeIndex;
-    }
-
-    inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
-    {
-        return methodCallLinkInfo->callReturnLocation.executableAddress();
-    }
-
-    inline unsigned getMethodCallLinkInfoBytecodeIndex(MethodCallLinkInfo* methodCallLinkInfo)
-    {
-        return methodCallLinkInfo->bytecodeIndex;
-    }
-
-    inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeOffset* pc)
-    {
-        return pc->callReturnOffset;
-    }
-#endif
-
     class CodeBlock : public UnconditionalFinalizer, public WeakReferenceHarvester {
         WTF_MAKE_FAST_ALLOCATED;
         friend class JIT;
@@ -268,6 +95,13 @@ namespace JSC {
 
     public:
         virtual ~CodeBlock();
+        
+        int numParameters() const { return m_numParameters; }
+        void setNumParameters(int newValue);
+        void addParameter();
+        
+        int* addressOfNumParameters() { return &m_numParameters; }
+        static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
 
         CodeBlock* alternative() { return m_alternative.get(); }
         PassOwnPtr<CodeBlock> releaseAlternative() { return m_alternative.release(); }
@@ -657,12 +491,10 @@ namespace JSC {
 #endif
         
 #if ENABLE(VALUE_PROFILER)
-        void setArgumentValueProfileSize(unsigned size)
-        {
-            m_argumentValueProfiles.resize(size);
-        }
         unsigned numberOfArgumentValueProfiles()
         {
+            ASSERT(m_numParameters >= 0);
+            ASSERT(m_argumentValueProfiles.size() == static_cast<unsigned>(m_numParameters));
             return m_argumentValueProfiles.size();
         }
         ValueProfile* valueProfileForArgument(unsigned argumentIndex)
@@ -1131,7 +963,6 @@ namespace JSC {
         int m_numCalleeRegisters;
         int m_numVars;
         int m_numCapturedVars;
-        int m_numParameters;
         bool m_isConstructor;
 
         // This is public because otherwise we would have many friends.
@@ -1195,6 +1026,8 @@ namespace JSC {
                 m_rareData = adoptPtr(new RareData);
         }
         
+        int m_numParameters;
+
         WriteBarrier<ScriptExecutable> m_ownerExecutable;
         JSGlobalData* m_globalData;
 
diff --git a/Source/JavaScriptCore/bytecode/CodeType.h b/Source/JavaScriptCore/bytecode/CodeType.h
new file mode 100644
index 000000000..03485e564
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/CodeType.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CodeType_h
+#define CodeType_h
+
+namespace JSC {
+
+enum CodeType { GlobalCode, EvalCode, FunctionCode };
+
+}
+
+#endif // CodeType_h
+
diff --git a/Source/JavaScriptCore/bytecode/ExpressionRangeInfo.h b/Source/JavaScriptCore/bytecode/ExpressionRangeInfo.h
new file mode 100644
index 000000000..f4949a686
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/ExpressionRangeInfo.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ExpressionRangeInfo_h
+#define ExpressionRangeInfo_h
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+struct ExpressionRangeInfo {
+    enum {
+        MaxOffset = (1 << 7) - 1, 
+        MaxDivot = (1 << 25) - 1
+    };
+    uint32_t instructionOffset : 25;
+    uint32_t divotPoint : 25;
+    uint32_t startOffset : 7;
+    uint32_t endOffset : 7;
+};
+
+} // namespace JSC
+
+#endif // ExpressionRangeInfo_h
+
diff --git a/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
new file mode 100644
index 000000000..5576cfacd
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GlobalResolveInfo_h
+#define GlobalResolveInfo_h
+
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+struct GlobalResolveInfo {
+    GlobalResolveInfo(unsigned bytecodeOffset)
+        : offset(0)
+        , bytecodeOffset(bytecodeOffset)
+    {
+    }
+    
+    WriteBarrier<Structure> structure;
+    unsigned offset;
+    unsigned bytecodeOffset;
+};
+
+} // namespace JSC
+
+#endif // GlobalResolveInfo_h
+
diff --git a/Source/JavaScriptCore/bytecode/HandlerInfo.h b/Source/JavaScriptCore/bytecode/HandlerInfo.h
new file mode 100644
index 000000000..8396c9607
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/HandlerInfo.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HandlerInfo_h
+#define HandlerInfo_h
+
+#include "CodeLocation.h"
+#include <wtf/Platform.h>
+
+namespace JSC {
+
+struct HandlerInfo {
+    uint32_t start;
+    uint32_t end;
+    uint32_t target;
+    uint32_t scopeDepth;
+#if ENABLE(JIT)
+    CodeLocationLabel nativeCode;
+#endif
+};
+
+} // namespace JSC
+
+#endif // HandlerInfo_h
+
diff --git a/Source/JavaScriptCore/bytecode/LineInfo.h b/Source/JavaScriptCore/bytecode/LineInfo.h
new file mode 100644
index 000000000..e9e70138a
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/LineInfo.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LineInfo_h
+#define LineInfo_h
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+struct LineInfo {
+    uint32_t instructionOffset;
+    int32_t lineNumber;
+};
+
+} // namespace JSC
+
+#endif // LineInfo_h
+
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp b/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp
new file mode 100644
index 000000000..1fcf5850f
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MethodCallLinkInfo.h"
+
+#if ENABLE(JIT)
+
+#include "JITStubs.h"
+#include "RepatchBuffer.h"
+
+namespace JSC {
+
+void MethodCallLinkInfo::reset(RepatchBuffer& repatchBuffer, JITCode::JITType jitType)
+{
+    cachedStructure.clearToMaxUnsigned();
+    cachedPrototype.clear();
+    cachedPrototypeStructure.clearToMaxUnsigned();
+    cachedFunction.clear();
+    
+    ASSERT_UNUSED(jitType, jitType == JITCode::BaselineJIT);
+    
+    repatchBuffer.relink(callReturnLocation, cti_op_get_by_id_method_check);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h b/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h
new file mode 100644
index 000000000..2243bc24e
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MethodCallLinkInfo_h
+#define MethodCallLinkInfo_h
+
+#include "CodeLocation.h"
+#include "JITCode.h"
+#include "JITWriteBarrier.h"
+#include <wtf/Platform.h>
+
+namespace JSC {
+
+#if ENABLE(JIT)
+
+class RepatchBuffer;
+
+struct MethodCallLinkInfo {
+    MethodCallLinkInfo()
+        : seen(false)
+    {
+    }
+
+    bool seenOnce()
+    {
+        return seen;
+    }
+
+    void setSeen()
+    {
+        seen = true;
+    }
+        
+    void reset(RepatchBuffer&, JITCode::JITType);
+
+    unsigned bytecodeIndex;
+    CodeLocationCall callReturnLocation;
+    JITWriteBarrier<Structure> cachedStructure;
+    JITWriteBarrier<Structure> cachedPrototypeStructure;
+    // We'd like this to actually be JSFunction, but InternalFunction and JSFunction
+    // don't have a common parent class and we allow specialisation on both
+    JITWriteBarrier<JSObject> cachedFunction;
+    JITWriteBarrier<JSObject> cachedPrototype;
+    bool seen;
+};
+
+inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
+{
+    return methodCallLinkInfo->callReturnLocation.executableAddress();
+}
+
+inline unsigned getMethodCallLinkInfoBytecodeIndex(MethodCallLinkInfo* methodCallLinkInfo)
+{
+    return methodCallLinkInfo->bytecodeIndex;
+}
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
+#endif // MethodCallLinkInfo_h
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 830b75594..5c7ee0bb8 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -231,8 +231,18 @@ namespace JSC {
         CodeLocationLabel hotPathBegin;
     };
 
+    inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
+    {
+        return structureStubInfo->callReturnLocation.executableAddress();
+    }
+
+    inline unsigned getStructureStubInfoBytecodeIndex(StructureStubInfo* structureStubInfo)
+    {
+        return structureStubInfo->bytecodeIndex;
+    }
+
 } // namespace JSC
 
-#endif
+#endif // ENABLE(JIT)
 
 #endif // StructureStubInfo_h