Attachment 124374 Details for Bug 75812 – the patch

[patch] the patch

triple_tier_58.diff (text/plain), 436.23 KB, created by Filip Pizlo on 2012-01-27 14:50:37 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2012-01-27 14:50:37 PST

Size: 436.23 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 106153)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,399 @@
>+2012-01-26  Filip Pizlo  <fpizlo@apple.com>
>+
>+        JSC should be a triple-tier VM
>+        https://bugs.webkit.org/show_bug.cgi?id=75812
>+        <rdar://problem/10079694>
>+
>+        Reviewed by NOBODY (OOPS!).
>+        
>+        Implemented an interpreter that uses the JIT's calling convention. This
>+        interpreter is called LLInt, or the Low Level Interpreter. JSC will now
>+        will start by executing code in LLInt and will only tier up to the old
>+        JIT after the code is proven hot.
>+        
>+        LLInt is written in a modified form of our macro assembly. This new macro
>+        assembly is compiled by an offline assembler (see offlineasm), which
>+        implements many modern conveniences such as a Turing-complete CPS-based
>+        macro language and direct access to relevant C++ type information
>+        (basically offsets of fields and sizes of structs/classes).
>+        
>+        Code executing in LLInt appears to the rest of the JSC world "as if" it
>+        were executing in the old JIT. Hence, things like exception handling and
>+        cross-execution-engine calls just work and require pretty much no
>+        additional overhead.
>+        
>+        This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
>+        V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
>+        V8, and Kraken, but appear to get a double-digit improvement on real-world
>+        websites due to a huge reduction in the amount of JIT'ing.
>+        
>+        As an additional change, this patch makes bytecode dumping and JSValue
>+        dumping work in release builds, since debugging some of the nastier
>+        aspects of this patch would have been impossible without that. And I
>+        don't believe that we care about the miniscule code bloat that this
>+        introduces.
>+
>+        * CMakeLists.txt:
>+        * GNUmakefile.am:
>+        * GNUmakefile.list.am:
>+        * JavaScriptCore.pri:
>+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
>+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * Target.pri:
>+        * assembler/LinkBuffer.h:
>+        * bytecode/BytecodeConventions.h: Added.
>+        * bytecode/CallLinkStatus.cpp:
>+        (JSC::CallLinkStatus::computeFromLLInt):
>+        (JSC):
>+        (JSC::CallLinkStatus::computeFor):
>+        * bytecode/CallLinkStatus.h:
>+        (JSC::CallLinkStatus::isSet):
>+        (JSC::CallLinkStatus::operator!):
>+        (CallLinkStatus):
>+        * bytecode/CodeBlock.cpp:
>+        (JSC):
>+        (JSC::escapeQuotes):
>+        (JSC::CodeBlock::dump):
>+        (JSC::CodeBlock::CodeBlock):
>+        (JSC::CodeBlock::~CodeBlock):
>+        (JSC::CodeBlock::finalizeUnconditionally):
>+        (JSC::CodeBlock::stronglyVisitStrongReferences):
>+        (JSC::CodeBlock::unlinkCalls):
>+        (JSC::CodeBlock::unlinkIncomingCalls):
>+        (JSC::CodeBlock::bytecodeOffset):
>+        (JSC::ProgramCodeBlock::jettison):
>+        (JSC::EvalCodeBlock::jettison):
>+        (JSC::FunctionCodeBlock::jettison):
>+        (JSC::ProgramCodeBlock::jitCompileImpl):
>+        (JSC::EvalCodeBlock::jitCompileImpl):
>+        (JSC::FunctionCodeBlock::jitCompileImpl):
>+        (JSC::CodeBlock::handleBytecodeDiscardingOpportunity):
>+        (JSC::CodeBlock::usesOpcode):
>+        * bytecode/CodeBlock.h:
>+        (JSC):
>+        (CodeBlock):
>+        ():
>+        (JSC::CodeBlock::baselineVersion):
>+        (JSC::CodeBlock::linkIncomingCall):
>+        (JSC::CodeBlock::bytecodeOffset):
>+        (JSC::CodeBlock::jitCompile):
>+        (JSC::CodeBlock::hasOptimizedReplacement):
>+        (JSC::CodeBlock::addPropertyAccessInstruction):
>+        (JSC::CodeBlock::addGlobalResolveInstruction):
>+        (JSC::CodeBlock::addLLIntCallLinkInfo):
>+        (JSC::CodeBlock::addGlobalResolveInfo):
>+        (JSC::CodeBlock::numberOfMethodCallLinkInfos):
>+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
>+        (JSC::CodeBlock::likelyToTakeSlowCase):
>+        (JSC::CodeBlock::couldTakeSlowCase):
>+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
>+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
>+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
>+        (JSC::CodeBlock::addFrequentExitSite):
>+        (JSC::CodeBlock::dontJITAnytimeSoon):
>+        (JSC::CodeBlock::jitAfterWarmUp):
>+        (JSC::CodeBlock::jitSoon):
>+        (JSC::CodeBlock::llintExecuteCounter):
>+        (ProgramCodeBlock):
>+        (EvalCodeBlock):
>+        (FunctionCodeBlock):
>+        * bytecode/GetByIdStatus.cpp:
>+        (JSC::GetByIdStatus::computeFromLLInt):
>+        (JSC):
>+        (JSC::GetByIdStatus::computeFor):
>+        * bytecode/GetByIdStatus.h:
>+        (JSC::GetByIdStatus::GetByIdStatus):
>+        (JSC::GetByIdStatus::wasSeenInJIT):
>+        (GetByIdStatus):
>+        * bytecode/Instruction.h:
>+        (JSC):
>+        (JSC::Instruction::Instruction):
>+        (Instruction):
>+        ():
>+        * bytecode/LLIntCallLinkInfo.h: Added.
>+        (JSC):
>+        (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
>+        (LLIntCallLinkInfo):
>+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
>+        (JSC::LLIntCallLinkInfo::isLinked):
>+        (JSC::LLIntCallLinkInfo::unlink):
>+        * bytecode/MethodCallLinkStatus.cpp:
>+        (JSC::MethodCallLinkStatus::computeFor):
>+        * bytecode/Opcode.h:
>+        (JSC):
>+        ():
>+        * bytecode/PutByIdStatus.cpp:
>+        (JSC::PutByIdStatus::computeFromLLInt):
>+        (JSC):
>+        (JSC::PutByIdStatus::computeFor):
>+        * bytecode/PutByIdStatus.h:
>+        (PutByIdStatus):
>+        * bytecompiler/BytecodeGenerator.cpp:
>+        (JSC):
>+        (JSC::BytecodeGenerator::setDumpsGeneratedCode):
>+        (JSC::BytecodeGenerator::dumpsGeneratedCode):
>+        (JSC::BytecodeGenerator::generate):
>+        (JSC::BytecodeGenerator::emitResolve):
>+        (JSC::BytecodeGenerator::emitResolveWithBase):
>+        (JSC::BytecodeGenerator::emitResolveWithThis):
>+        (JSC::BytecodeGenerator::emitGetById):
>+        (JSC::BytecodeGenerator::emitPutById):
>+        (JSC::BytecodeGenerator::emitDirectPutById):
>+        (JSC::BytecodeGenerator::emitCall):
>+        (JSC::BytecodeGenerator::emitConstruct):
>+        (JSC::BytecodeGenerator::emitCatch):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
>+        (JSC::DFG::ByteCodeParser::handleInlining):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGCapabilities.h:
>+        (JSC::DFG::canCompileOpcode):
>+        * dfg/DFGOSRExitCompiler.cpp:
>+        ():
>+        * dfg/DFGOperations.cpp:
>+        ():
>+        * heap/AllocationSpace.h:
>+        (JSC):
>+        (AllocationSpace):
>+        ():
>+        * heap/Heap.cpp:
>+        (JSC::Heap::collect):
>+        * heap/Heap.h:
>+        (JSC):
>+        ():
>+        (Heap):
>+        * heap/MarkStack.cpp:
>+        (JSC::visitChildren):
>+        * heap/MarkedSpace.h:
>+        (JSC):
>+        (MarkedSpace):
>+        * interpreter/CallFrame.h:
>+        (ExecState):
>+        (JSC::ExecState::currentVPC):
>+        * interpreter/Interpreter.cpp:
>+        (JSC::Interpreter::~Interpreter):
>+        (JSC):
>+        (JSC::Interpreter::initialize):
>+        (JSC::Interpreter::isOpcode):
>+        (JSC::Interpreter::unwindCallFrame):
>+        (JSC::Interpreter::retrieveLastCaller):
>+        * interpreter/Interpreter.h:
>+        (JSC):
>+        ():
>+        (Interpreter):
>+        (JSC::Interpreter::getOpcode):
>+        (JSC::Interpreter::getOpcodeID):
>+        (JSC::Interpreter::enabled):
>+        * interpreter/RegisterFile.h:
>+        (JSC):
>+        (RegisterFile):
>+        * jit/HostCallReturnValue.cpp: Added.
>+        (JSC):
>+        (JSC::getHostCallReturnValueWithExecState):
>+        * jit/HostCallReturnValue.h: Added.
>+        (JSC):
>+        * jit/JIT.cpp:
>+        (JSC::JIT::privateCompileMainPass):
>+        (JSC::JIT::privateCompileSlowCases):
>+        (JSC::JIT::privateCompile):
>+        * jit/JITCode.h:
>+        ():
>+        (JSC::JITCode::isOptimizingJIT):
>+        (JITCode):
>+        (JSC::JITCode::isBaselineCode):
>+        (JSC::JITCode::JITCode):
>+        * jit/JITDriver.h:
>+        (JSC::jitCompileIfAppropriate):
>+        (JSC::jitCompileFunctionIfAppropriate):
>+        * jit/JITExceptions.cpp:
>+        (JSC::jitThrow):
>+        * jit/JITStubs.cpp:
>+        (JSC::DEFINE_STUB_FUNCTION):
>+        (JSC):
>+        * jit/JSInterfaceJIT.h:
>+        * llint: Added.
>+        * llint/LLIntCommon.h: Added.
>+        * llint/LLIntData.cpp: Added.
>+        (LLInt):
>+        (JSC::LLInt::Data::Data):
>+        (JSC::LLInt::Data::~Data):
>+        * llint/LLIntData.h: Added.
>+        (JSC):
>+        (LLInt):
>+        (Data):
>+        (JSC::LLInt::Data::exceptionInstructions):
>+        (JSC::LLInt::Data::opcodeMap):
>+        * llint/LLIntEntrypoints.cpp: Added.
>+        (LLInt):
>+        (JSC::LLInt::getFunctionEntrypoint):
>+        (JSC::LLInt::getEvalEntrypoint):
>+        (JSC::LLInt::getProgramEntrypoint):
>+        * llint/LLIntEntrypoints.h: Added.
>+        (JSC):
>+        (LLInt):
>+        (JSC::LLInt::getEntrypoint):
>+        * llint/LLIntExceptions.cpp: Added.
>+        (LLInt):
>+        (JSC::LLInt::interpreterThrowInCaller):
>+        (JSC::LLInt::returnToThrowForThrownException):
>+        (JSC::LLInt::returnToThrow):
>+        (JSC::LLInt::callToThrow):
>+        * llint/LLIntExceptions.h: Added.
>+        (JSC):
>+        (LLInt):
>+        * llint/LLIntHelpers.cpp: Added.
>+        (LLInt):
>+        (JSC::LLInt::llint_trace_operand):
>+        (JSC::LLInt::llint_trace_value):
>+        (JSC::LLInt::LLINT_HELPER_DECL):
>+        (JSC::LLInt::traceFunctionPrologue):
>+        (JSC::LLInt::shouldJIT):
>+        ():
>+        (JSC::LLInt::entryOSR):
>+        (JSC::LLInt::resolveGlobal):
>+        (JSC::LLInt::getByVal):
>+        (JSC::LLInt::handleHostCall):
>+        (JSC::LLInt::setUpCall):
>+        (JSC::LLInt::genericCall):
>+        * llint/LLIntHelpers.h: Added.
>+        (JSC):
>+        (LLInt):
>+        * llint/LLIntOfflineAsmConfig.h: Added.
>+        * llint/LLIntOffsetsExtractor.cpp: Added.
>+        (JSC):
>+        (LLIntOffsetsExtractor):
>+        (JSC::LLIntOffsetsExtractor::dummy):
>+        (main):
>+        * llint/LLIntThunks.cpp: Added.
>+        (LLInt):
>+        (JSC::LLInt::generateThunkWithJumpTo):
>+        (JSC::LLInt::functionForCallEntryThunkGenerator):
>+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
>+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
>+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
>+        (JSC::LLInt::evalEntryThunkGenerator):
>+        (JSC::LLInt::programEntryThunkGenerator):
>+        * llint/LLIntThunks.h: Added.
>+        (JSC):
>+        (LLInt):
>+        * llint/LowLevelInterpreter.asm: Added.
>+        * llint/LowLevelInterpreter.cpp: Added.
>+        * llint/LowLevelInterpreter.h: Added.
>+        * offlineasm: Added.
>+        * offlineasm/armv7.rb: Added.
>+        * offlineasm/asm.rb: Added.
>+        * offlineasm/ast.rb: Added.
>+        * offlineasm/backends.rb: Added.
>+        * offlineasm/generate_offset_extractor.rb: Added.
>+        * offlineasm/instructions.rb: Added.
>+        * offlineasm/offset_extractor_constants.rb: Added.
>+        * offlineasm/offsets.rb: Added.
>+        * offlineasm/parser.rb: Added.
>+        * offlineasm/registers.rb: Added.
>+        * offlineasm/self_hash.rb: Added.
>+        * offlineasm/settings.rb: Added.
>+        * offlineasm/transform.rb: Added.
>+        * offlineasm/x86.rb: Added.
>+        * runtime/CodeSpecializationKind.h: Added.
>+        (JSC):
>+        ():
>+        * runtime/CommonSlowPaths.h:
>+        (JSC::CommonSlowPaths::arityCheckFor):
>+        (CommonSlowPaths):
>+        (JSC::CommonSlowPaths::opInstanceOfSlow):
>+        * runtime/Executable.cpp:
>+        (JSC::jettisonCodeBlock):
>+        (JSC::EvalExecutable::jitCompile):
>+        (JSC):
>+        (JSC::samplingDescription):
>+        (JSC::EvalExecutable::compileInternal):
>+        (JSC::ProgramExecutable::jitCompile):
>+        (JSC::ProgramExecutable::compileInternal):
>+        (JSC::FunctionExecutable::baselineCodeBlockFor):
>+        (JSC::FunctionExecutable::jitCompileForCall):
>+        (JSC::FunctionExecutable::jitCompileForConstruct):
>+        (JSC::FunctionExecutable::compileForCallInternal):
>+        (JSC::FunctionExecutable::compileForConstructInternal):
>+        * runtime/Executable.h:
>+        (JSC):
>+        ():
>+        (EvalExecutable):
>+        (ProgramExecutable):
>+        (FunctionExecutable):
>+        (JSC::FunctionExecutable::jitCompileFor):
>+        * runtime/ExecutionHarness.h: Added.
>+        (JSC):
>+        (JSC::prepareForExecution):
>+        (JSC::prepareFunctionForExecution):
>+        * runtime/JSActivation.h:
>+        (JSC::JSActivation::tearOff):
>+        * runtime/JSArray.h:
>+        (JSC):
>+        (JSArray):
>+        * runtime/JSCell.h:
>+        (JSC):
>+        ():
>+        (JSCell):
>+        * runtime/JSFunction.h:
>+        (JSC):
>+        (JSFunction):
>+        * runtime/JSGlobalData.cpp:
>+        (JSC::JSGlobalData::JSGlobalData):
>+        * runtime/JSGlobalData.h:
>+        (JSC):
>+        (JSGlobalData):
>+        (JSC::JSGlobalData::scratchBufferForSize):
>+        * runtime/JSGlobalObject.h:
>+        (JSC):
>+        (JSGlobalObject):
>+        * runtime/JSObject.h:
>+        (JSC):
>+        ():
>+        (JSObject):
>+        (JSFinalObject):
>+        * runtime/JSPropertyNameIterator.h:
>+        (JSC):
>+        (JSPropertyNameIterator):
>+        * runtime/JSString.h:
>+        (JSC):
>+        (JSString):
>+        * runtime/JSTypeInfo.h:
>+        (JSC):
>+        (TypeInfo):
>+        * runtime/JSValue.cpp:
>+        (JSC):
>+        (JSC::JSValue::description):
>+        * runtime/JSValue.h:
>+        (JSValue):
>+        ():
>+        * runtime/JSVariableObject.h:
>+        (JSC):
>+        (JSVariableObject):
>+        * runtime/Options.cpp:
>+        (Options):
>+        (JSC::Options::initializeOptions):
>+        * runtime/Options.h:
>+        (Options):
>+        * runtime/ScopeChain.h:
>+        (JSC):
>+        (ScopeChainNode):
>+        * runtime/Structure.h:
>+        (JSC):
>+        (Structure):
>+        * runtime/StructureChain.h:
>+        (JSC):
>+        (StructureChain):
>+        * wtf/InlineASM.h:
>+        * wtf/Platform.h:
>+        * wtf/SentinelLinkedList.h:
>+        (SentinelLinkedList):
>+        (WTF::SentinelLinkedList::isEmpty):
>+        * wtf/text/StringImpl.h:
>+        (JSC):
>+        (StringImpl):
>+        ():
>+
> 2012-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
> 
>         [JSC] Asm-originated symbols should be marked as hidden
>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 106153)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -11,6 +11,7 @@ SET(JavaScriptCore_INCLUDE_DIRECTORIES
>     "${JAVASCRIPTCORE_DIR}/debugger"
>     "${JAVASCRIPTCORE_DIR}/interpreter"
>     "${JAVASCRIPTCORE_DIR}/jit"
>+    "${JAVASCRIPTCORE_DIR}/llint"
>     "${JAVASCRIPTCORE_DIR}/parser"
>     "${JAVASCRIPTCORE_DIR}/profiler"
>     "${JAVASCRIPTCORE_DIR}/runtime"
>@@ -94,6 +95,7 @@ SET(JavaScriptCore_SOURCES
>     interpreter/RegisterFile.cpp
> 
>     jit/ExecutableAllocator.cpp
>+    jit/HostCallReturnValue.cpp
>     jit/JITArithmetic32_64.cpp
>     jit/JITArithmetic.cpp
>     jit/JITCall32_64.cpp
>Index: Source/JavaScriptCore/GNUmakefile.am
>===================================================================
>--- Source/JavaScriptCore/GNUmakefile.am	(revision 106153)
>+++ Source/JavaScriptCore/GNUmakefile.am	(working copy)
>@@ -57,6 +57,7 @@ javascriptcore_cppflags += \
> 	-I$(srcdir)/Source/JavaScriptCore/interpreter \
> 	-I$(srcdir)/Source/JavaScriptCore/jit \
> 	-I$(srcdir)/Source/JavaScriptCore/jit \
>+	-I$(srcdir)/Source/JavaScriptCore/llint \
> 	-I$(srcdir)/Source/JavaScriptCore/parser \
> 	-I$(srcdir)/Source/JavaScriptCore/profiler \
> 	-I$(srcdir)/Source/JavaScriptCore/runtime \
>Index: Source/JavaScriptCore/GNUmakefile.list.am
>===================================================================
>--- Source/JavaScriptCore/GNUmakefile.list.am	(revision 106153)
>+++ Source/JavaScriptCore/GNUmakefile.list.am	(working copy)
>@@ -81,6 +81,7 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/assembler/RepatchBuffer.h \
> 	Source/JavaScriptCore/assembler/SH4Assembler.h \
> 	Source/JavaScriptCore/assembler/X86Assembler.h \
>+	Source/JavaScriptCore/bytecode/BytecodeConventions.h \
> 	Source/JavaScriptCore/bytecode/CallLinkInfo.cpp \
> 	Source/JavaScriptCore/bytecode/CallLinkInfo.h \
> 	Source/JavaScriptCore/bytecode/CallLinkStatus.cpp \
>@@ -102,6 +103,7 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/bytecode/Instruction.h \
> 	Source/JavaScriptCore/bytecode/JumpTable.cpp \
> 	Source/JavaScriptCore/bytecode/JumpTable.h \
>+	Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h \
> 	Source/JavaScriptCore/bytecode/LineInfo.h \
> 	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp \
> 	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h \
>@@ -277,6 +279,8 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/jit/CompactJITCodeMap.h \
> 	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
> 	Source/JavaScriptCore/jit/ExecutableAllocator.h \
>+	Source/JavaScriptCore/jit/HostCallReturnValue.cpp \
>+	Source/JavaScriptCore/jit/HostCallReturnValue.h \
> 	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
> 	Source/JavaScriptCore/jit/JITArithmetic.cpp \
> 	Source/JavaScriptCore/jit/JITCall32_64.cpp \
>@@ -300,6 +304,7 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
> 	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
> 	Source/JavaScriptCore/jit/ThunkGenerators.h \
>+	Source/JavaScriptCore/llint/LLIntData.h \
> 	Source/JavaScriptCore/os-win32/stdbool.h \
> 	Source/JavaScriptCore/os-win32/stdint.h \
> 	Source/JavaScriptCore/parser/ASTBuilder.h \
>@@ -350,6 +355,7 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/runtime/CallData.cpp \
> 	Source/JavaScriptCore/runtime/CallData.h \
> 	Source/JavaScriptCore/runtime/ClassInfo.h \
>+	Source/JavaScriptCore/runtime/CodeSpecializationKind.h \
> 	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
> 	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
> 	Source/JavaScriptCore/runtime/CommonSlowPaths.h \
>@@ -378,6 +384,7 @@ javascriptcore_sources += \
> 	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
> 	Source/JavaScriptCore/runtime/Executable.cpp \
> 	Source/JavaScriptCore/runtime/Executable.h \
>+	Source/JavaScriptCore/runtime/ExecutionHarness.h \
> 	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
> 	Source/JavaScriptCore/runtime/FunctionConstructor.h \
> 	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
>Index: Source/JavaScriptCore/JavaScriptCore.pri
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.pri	(revision 106153)
>+++ Source/JavaScriptCore/JavaScriptCore.pri	(working copy)
>@@ -20,6 +20,7 @@ INCLUDEPATH += \
>     $$SOURCE_DIR/debugger \
>     $$SOURCE_DIR/interpreter \
>     $$SOURCE_DIR/jit \
>+    $$SOURCE_DIR/llint \
>     $$SOURCE_DIR/parser \
>     $$SOURCE_DIR/profiler \
>     $$SOURCE_DIR/runtime \
>Index: Source/JavaScriptCore/Target.pri
>===================================================================
>--- Source/JavaScriptCore/Target.pri	(revision 106153)
>+++ Source/JavaScriptCore/Target.pri	(working copy)
>@@ -106,6 +106,7 @@ SOURCES += \
>     interpreter/RegisterFile.cpp \
>     jit/ExecutableAllocatorFixedVMPool.cpp \
>     jit/ExecutableAllocator.cpp \
>+    jit/HostCallReturnValue.cpp \
>     jit/JITArithmetic.cpp \
>     jit/JITArithmetic32_64.cpp \
>     jit/JITCall.cpp \
>Index: Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj	(revision 106153)
>+++ Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj	(working copy)
>@@ -1730,6 +1730,10 @@
> 				>
> 			</File>
> 			<File
>+				RelativePath="..\..\jit\HostCallReturnValue.cpp"
>+				>
>+			</File>
>+			<File
> 				RelativePath="..\..\jit\JIT.cpp"
> 				>
> 			</File>
>@@ -1815,6 +1819,14 @@
> 			</File>
> 		</Filter>
> 		<Filter
>+			Name="llint"
>+			>
>+			<File
>+				RelativePath="..\..\llint\LLIntData.h"
>+				>
>+			</File>
>+		</Filter>
>+		<Filter
> 			Name="interpreter"
> 			>
> 			<File
>Index: Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops	(revision 106153)
>+++ Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops	(working copy)
>@@ -6,7 +6,7 @@
> 	>
> 	<Tool
> 		Name="VCCLCompilerTool"
>-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
>+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../jit/;../../llint/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
> 		PreprocessorDefinitions="__STD_C"
> 		ForcedIncludeFiles="ICUVersion.h"
> 	/>
>Index: Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd	(revision 106153)
>+++ Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd	(working copy)
>@@ -43,6 +43,7 @@ for %%d in (
>     debugger
>     interpreter
>     jit
>+    llint
>     parser
>     profiler
>     runtime
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 106153)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -7,6 +7,15 @@
> 	objects = {
> 
> /* Begin PBXAggregateTarget section */
>+		0F4680A914BA7FD900BFE272 /* LLInt Offsets */ = {
>+			isa = PBXAggregateTarget;
>+			buildConfigurationList = 0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */;
>+			buildPhases = (
>+				0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */,
>+			);
>+			name = "LLInt Offsets";
>+			productName = "Derived Sources";
>+		};
> 		65FB3F6609D11E9100F49DEB /* Derived Sources */ = {
> 			isa = PBXAggregateTarget;
> 			buildConfigurationList = 65FB3F7709D11EBD00F49DEB /* Build configuration list for PBXAggregateTarget "Derived Sources" */;
>@@ -14,6 +23,9 @@
> 				65FB3F6509D11E9100F49DEB /* Generate Derived Sources */,
> 				5D35DEE10C7C140B008648B2 /* Generate DTrace header */,
> 			);
>+			dependencies = (
>+				0F4680B414BA821400BFE272 /* PBXTargetDependency */,
>+			);
> 			name = "Derived Sources";
> 			productName = "Derived Sources";
> 		};
>@@ -48,6 +60,10 @@
> 		0BAC94A01338728400CF135B /* ThreadRestrictionVerifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0BCD83571485845200EA2003 /* TemporaryChange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BCD83541485841200EA2003 /* TemporaryChange.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0BF28A2811A33DC300638F84 /* SizeLimits.cpp */; };
>+		0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */; };
>+		0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
>+		0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F /* LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B83A714BCF50700885B4F /* CodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F /* CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A814BCF55E00885B4F /* HandlerInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -58,9 +74,13 @@
> 		0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B83B714BCF8E100885B4F /* GlobalResolveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F16D726142C39C000CF784A /* BitVector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F16D724142C39A200CF784A /* BitVector.cpp */; };
> 		0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C26614BE5F5E00ADC64B /* JITDriver.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27A14BE727300ADC64B /* ExecutionHarness.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F2C556F14738F3100121E4F /* DFGCodeBlocks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F2C557014738F3500121E4F /* DFGCodeBlocks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */; };
>@@ -71,6 +91,19 @@
> 		0F431738146BAC69007E3890 /* ListableHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F431736146BAC65007E3890 /* ListableHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46808014BA572700BFE272 /* JITExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46807F14BA572700BFE272 /* JITExceptions.cpp */; };
>+		0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680A414BA7F8D00BFE272 /* LLIntHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809F14BA7F8200BFE272 /* LLIntHelpers.cpp */; settings = {COMPILER_FLAGS = "-Wno-unused-parameter"; }; };
>+		0F4680A514BA7F8D00BFE272 /* LLIntHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680A014BA7F8200BFE272 /* LLIntHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680A714BA7FA100BFE272 /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
>+		0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */; };
>+		0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C514BBB16900BFE272 /* LLIntCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */; };
>+		0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */; };
>+		0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680CF14BBB3D100BFE272 /* LLIntData.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */; };
>+		0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */; };
> 		0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55F0F214D1063600AC7649 /* AbstractPC.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -385,7 +418,7 @@
> 		86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B99AE1117E578100DF5A90 /* StringBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		86BB09C0138E381B0056702F /* DFGRepatch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BB09BE138E381B0056702F /* DFGRepatch.cpp */; };
> 		86BB09C1138E381B0056702F /* DFGRepatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BB09BF138E381B0056702F /* DFGRepatch.h */; };
>-		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; };
>+		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */; };
> 		86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */; };
> 		86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */; };
>@@ -752,6 +785,20 @@
> /* End PBXBuildFile section */
> 
> /* Begin PBXContainerItemProxy section */
>+		0F4680B114BA811500BFE272 /* PBXContainerItemProxy */ = {
>+			isa = PBXContainerItemProxy;
>+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
>+			proxyType = 1;
>+			remoteGlobalIDString = 0F4680A914BA7FD900BFE272;
>+			remoteInfo = "LLInt Offsets";
>+		};
>+		0F4680B314BA821400BFE272 /* PBXContainerItemProxy */ = {
>+			isa = PBXContainerItemProxy;
>+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
>+			proxyType = 1;
>+			remoteGlobalIDString = 0F46808E14BA7E5E00BFE272;
>+			remoteInfo = JSCLLIntOffsetsExtractor;
>+		};
> 		141214BE0A49190E00480255 /* PBXContainerItemProxy */ = {
> 			isa = PBXContainerItemProxy;
> 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
>@@ -797,6 +844,15 @@
> /* End PBXContainerItemProxy section */
> 
> /* Begin PBXCopyFilesBuildPhase section */
>+		0F46808D14BA7E5E00BFE272 /* CopyFiles */ = {
>+			isa = PBXCopyFilesBuildPhase;
>+			buildActionMask = 2147483647;
>+			dstPath = /usr/share/man/man1/;
>+			dstSubfolderSpec = 0;
>+			files = (
>+			);
>+			runOnlyForDeploymentPostprocessing = 1;
>+		};
> 		5DBB1511131D0B130056AD36 /* Copy Support Script */ = {
> 			isa = PBXCopyFilesBuildPhase;
> 			buildActionMask = 12;
>@@ -837,6 +893,10 @@
> 		0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadRestrictionVerifier.h; sourceTree = "<group>"; };
> 		0BCD83541485841200EA2003 /* TemporaryChange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemporaryChange.h; sourceTree = "<group>"; };
> 		0BF28A2811A33DC300638F84 /* SizeLimits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SizeLimits.cpp; sourceTree = "<group>"; };
>+		0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntEntrypoints.cpp; path = llint/LLIntEntrypoints.cpp; sourceTree = "<group>"; };
>+		0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntEntrypoints.h; path = llint/LLIntEntrypoints.h; sourceTree = "<group>"; };
>+		0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
>+		0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };
> 		0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };
> 		0F0B83A814BCF55E00885B4F /* HandlerInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandlerInfo.h; sourceTree = "<group>"; };
> 		0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExpressionRangeInfo.h; sourceTree = "<group>"; };
>@@ -847,9 +907,13 @@
> 		0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodCallLinkInfo.h; sourceTree = "<group>"; };
> 		0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlobalResolveInfo.h; sourceTree = "<group>"; };
> 		0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallReturnOffsetToBytecodeOffset.h; sourceTree = "<group>"; };
>+		0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntCallLinkInfo.h; sourceTree = "<group>"; };
> 		0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPaths.h; sourceTree = "<group>"; };
> 		0F16D724142C39A200CF784A /* BitVector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitVector.cpp; sourceTree = "<group>"; };
> 		0F21C26614BE5F5E00ADC64B /* JITDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDriver.h; sourceTree = "<group>"; };
>+		0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
>+		0F21C27A14BE727300ADC64B /* ExecutionHarness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionHarness.h; sourceTree = "<group>"; };
>+		0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = "<group>"; };
> 		0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakReferenceHarvester.h; sourceTree = "<group>"; };
> 		0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGCodeBlocks.cpp; sourceTree = "<group>"; };
> 		0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGCodeBlocks.h; sourceTree = "<group>"; };
>@@ -860,6 +924,20 @@
> 		0F431736146BAC65007E3890 /* ListableHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ListableHandler.h; sourceTree = "<group>"; };
> 		0F46807F14BA572700BFE272 /* JITExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITExceptions.cpp; sourceTree = "<group>"; };
> 		0F46808014BA572700BFE272 /* JITExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITExceptions.h; sourceTree = "<group>"; };
>+		0F46808F14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
>+		0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntExceptions.cpp; path = llint/LLIntExceptions.cpp; sourceTree = "<group>"; };
>+		0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntExceptions.h; path = llint/LLIntExceptions.h; sourceTree = "<group>"; };
>+		0F46809F14BA7F8200BFE272 /* LLIntHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntHelpers.cpp; path = llint/LLIntHelpers.cpp; sourceTree = "<group>"; };
>+		0F4680A014BA7F8200BFE272 /* LLIntHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntHelpers.h; path = llint/LLIntHelpers.h; sourceTree = "<group>"; };
>+		0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntOffsetsExtractor.cpp; path = llint/LLIntOffsetsExtractor.cpp; sourceTree = "<group>"; };
>+		0F4680C514BBB16900BFE272 /* LLIntCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCommon.h; path = llint/LLIntCommon.h; sourceTree = "<group>"; };
>+		0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntOfflineAsmConfig.h; path = llint/LLIntOfflineAsmConfig.h; sourceTree = "<group>"; };
>+		0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LowLevelInterpreter.cpp; path = llint/LowLevelInterpreter.cpp; sourceTree = "<group>"; };
>+		0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LowLevelInterpreter.h; path = llint/LowLevelInterpreter.h; sourceTree = "<group>"; };
>+		0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntData.cpp; path = llint/LLIntData.cpp; sourceTree = "<group>"; };
>+		0F4680CF14BBB3D100BFE272 /* LLIntData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntData.h; path = llint/LLIntData.h; sourceTree = "<group>"; };
>+		0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HostCallReturnValue.cpp; sourceTree = "<group>"; };
>+		0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HostCallReturnValue.h; sourceTree = "<group>"; };
> 		0F55F0F114D1063600AC7649 /* AbstractPC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractPC.cpp; sourceTree = "<group>"; };
> 		0F55F0F214D1063600AC7649 /* AbstractPC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractPC.h; sourceTree = "<group>"; };
> 		0F5F08CC146BE602000472A9 /* DFGByteCodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeCache.h; path = dfg/DFGByteCodeCache.h; sourceTree = "<group>"; };
>@@ -1579,6 +1657,13 @@
> /* End PBXFileReference section */
> 
> /* Begin PBXFrameworksBuildPhase section */
>+		0F46808C14BA7E5E00BFE272 /* Frameworks */ = {
>+			isa = PBXFrameworksBuildPhase;
>+			buildActionMask = 2147483647;
>+			files = (
>+			);
>+			runOnlyForDeploymentPostprocessing = 0;
>+		};
> 		1412111E0A48793C00480255 /* Frameworks */ = {
> 			isa = PBXFrameworksBuildPhase;
> 			buildActionMask = 2147483647;
>@@ -1637,6 +1722,7 @@
> 				141211200A48793C00480255 /* minidom */,
> 				14BD59BF0A3E8F9000BAF59C /* testapi */,
> 				6511230514046A4C002B101D /* testRegExp */,
>+				0F46808F14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */,
> 			);
> 			name = Products;
> 			sourceTree = "<group>";
>@@ -1667,6 +1753,7 @@
> 				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
> 				45E12D8806A49B0F00E9DF84 /* jsc.cpp */,
> 				F68EBB8C0255D4C601FF60F7 /* config.h */,
>+				0F46809C14BA7F4D00BFE272 /* llint */,
> 				1432EBD70A34CAD400717B9F /* API */,
> 				9688CB120ED12B4E001D649F /* assembler */,
> 				969A078F0ED1D3AE00F1F681 /* bytecode */,
>@@ -1705,6 +1792,28 @@
> 			tabWidth = 4;
> 			usesTabs = 0;
> 		};
>+		0F46809C14BA7F4D00BFE272 /* llint */ = {
>+			isa = PBXGroup;
>+			children = (
>+				0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */,
>+				0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */,
>+				0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */,
>+				0F0B839814BCF45A00885B4F /* LLIntThunks.h */,
>+				0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */,
>+				0F4680CF14BBB3D100BFE272 /* LLIntData.h */,
>+				0F4680C514BBB16900BFE272 /* LLIntCommon.h */,
>+				0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */,
>+				0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */,
>+				0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */,
>+				0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */,
>+				0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */,
>+				0F46809F14BA7F8200BFE272 /* LLIntHelpers.cpp */,
>+				0F4680A014BA7F8200BFE272 /* LLIntHelpers.h */,
>+				0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */,
>+			);
>+			name = llint;
>+			sourceTree = "<group>";
>+		};
> 		141211000A48772600480255 /* tests */ = {
> 			isa = PBXGroup;
> 			children = (
>@@ -1739,6 +1848,8 @@
> 		1429D92C0ED22D7000B89619 /* jit */ = {
> 			isa = PBXGroup;
> 			children = (
>+				0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */,
>+				0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */,
> 				0F46807F14BA572700BFE272 /* JITExceptions.cpp */,
> 				0F46808014BA572700BFE272 /* JITExceptions.h */,
> 				0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */,
>@@ -2166,6 +2277,8 @@
> 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
> 			isa = PBXGroup;
> 			children = (
>+				0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */,
>+				0F21C27A14BE727300ADC64B /* ExecutionHarness.h */,
> 				0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */,
> 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
> 				BCF605120E203EF800B9A64D /* ArgList.h */,
>@@ -2525,6 +2638,8 @@
> 		969A078F0ED1D3AE00F1F681 /* bytecode */ = {
> 			isa = PBXGroup;
> 			children = (
>+				0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */,
>+				0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
> 				0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */,
> 				0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */,
> 				0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */,
>@@ -3075,7 +3190,16 @@
> 				86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */,
> 				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
> 				0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */,
>+				0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */,
>+				0F4680A514BA7F8D00BFE272 /* LLIntHelpers.h in Headers */,
> 				0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */,
>+				0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */,
>+				0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */,
>+				0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */,
>+				0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */,
>+				0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */,
>+				0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */,
>+				0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */,
> 				0F0B83A714BCF50700885B4F /* CodeType.h in Headers */,
> 				0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
> 				0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
>@@ -3084,7 +3208,11 @@
> 				0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */,
> 				0F0B83B714BCF8E100885B4F /* GlobalResolveInfo.h in Headers */,
> 				0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */,
>+				0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */,
> 				0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */,
>+				0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */,
>+				0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */,
>+				0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */,
> 				0F7B294A14C3CD29007C3DB1 /* DFGCCallHelpers.h in Headers */,
> 				0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */,
> 				0F7B294C14C3CD43007C3DB1 /* DFGByteCodeCache.h in Headers */,
>@@ -3103,6 +3231,24 @@
> /* End PBXHeadersBuildPhase section */
> 
> /* Begin PBXNativeTarget section */
>+		0F46808E14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */ = {
>+			isa = PBXNativeTarget;
>+			buildConfigurationList = 0F46809A14BA7E5F00BFE272 /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */;
>+			buildPhases = (
>+				0F46808B14BA7E5E00BFE272 /* Sources */,
>+				0F46808C14BA7E5E00BFE272 /* Frameworks */,
>+				0F46808D14BA7E5E00BFE272 /* CopyFiles */,
>+			);
>+			buildRules = (
>+			);
>+			dependencies = (
>+				0F4680B214BA811500BFE272 /* PBXTargetDependency */,
>+			);
>+			name = JSCLLIntOffsetsExtractor;
>+			productName = JSCLLIntOffsetsExtractor;
>+			productReference = 0F46808F14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */;
>+			productType = "com.apple.product-type.tool";
>+		};
> 		1412111F0A48793C00480255 /* minidom */ = {
> 			isa = PBXNativeTarget;
> 			buildConfigurationList = 141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */;
>@@ -3229,11 +3375,29 @@
> 				14BD59BE0A3E8F9000BAF59C /* testapi */,
> 				932F5BDA0822A1C700736975 /* jsc */,
> 				651122F714046A4C002B101D /* testRegExp */,
>+				0F46808E14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */,
>+				0F4680A914BA7FD900BFE272 /* LLInt Offsets */,
> 			);
> 		};
> /* End PBXProject section */
> 
> /* Begin PBXShellScriptBuildPhase section */
>+		0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */ = {
>+			isa = PBXShellScriptBuildPhase;
>+			buildActionMask = 2147483647;
>+			files = (
>+			);
>+			inputPaths = (
>+				"$(SRCROOT)/llint/LowLevelAssembler.asm",
>+			);
>+			name = "Generate Derived Sources";
>+			outputPaths = (
>+				"$(BUILT_PRODUCTS_DIR)/LLIntOffsets/LLIntDesiredOffsets.h",
>+			);
>+			runOnlyForDeploymentPostprocessing = 0;
>+			shellPath = /bin/sh;
>+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/\"\n\n/usr/bin/env ruby \"${SRCROOT}/offlineasm/generate_offset_extractor.rb\" \"${SRCROOT}/llint/LowLevelInterpreter.asm\" \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/LLIntDesiredOffsets.h\"\n";
>+		};
> 		3713F014142905240036387F /* Check For Inappropriate Objective-C Class Names */ = {
> 			isa = PBXShellScriptBuildPhase;
> 			buildActionMask = 2147483647;
>@@ -3339,7 +3503,7 @@
> 			);
> 			runOnlyForDeploymentPostprocessing = 0;
> 			shellPath = /bin/sh;
>-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n";
>+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n\n/usr/bin/env ruby JavaScriptCore/offlineasm/asm.rb JavaScriptCore/llint/LowLevelInterpreter.asm ${BUILT_PRODUCTS_DIR}/JSCLLIntOffsetsExtractor LLIntAssembly.h\n";
> 		};
> 		9319586B09D9F91A00A56FD4 /* Check For Global Initializers */ = {
> 			isa = PBXShellScriptBuildPhase;
>@@ -3374,6 +3538,14 @@
> /* End PBXShellScriptBuildPhase section */
> 
> /* Begin PBXSourcesBuildPhase section */
>+		0F46808B14BA7E5E00BFE272 /* Sources */ = {
>+			isa = PBXSourcesBuildPhase;
>+			buildActionMask = 2147483647;
>+			files = (
>+				0F4680A714BA7FA100BFE272 /* LLIntOffsetsExtractor.cpp in Sources */,
>+			);
>+			runOnlyForDeploymentPostprocessing = 0;
>+		};
> 		1412111D0A48793C00480255 /* Sources */ = {
> 			isa = PBXSourcesBuildPhase;
> 			buildActionMask = 2147483647;
>@@ -3631,7 +3803,14 @@
> 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
> 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
> 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
>+				0F4680A414BA7F8D00BFE272 /* LLIntHelpers.cpp in Sources */,
>+				0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */,
> 				0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */,
>+				0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */,
>+				0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */,
>+				0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */,
>+				0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */,
>+				0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */,
> 				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
> 				0F0B83B414BCF86000885B4F /* MethodCallLinkInfo.cpp in Sources */,
> 				F69E86C314C6E551002C2C62 /* NumberOfCores.cpp in Sources */,
>@@ -3654,6 +3833,16 @@
> /* End PBXSourcesBuildPhase section */
> 
> /* Begin PBXTargetDependency section */
>+		0F4680B214BA811500BFE272 /* PBXTargetDependency */ = {
>+			isa = PBXTargetDependency;
>+			target = 0F4680A914BA7FD900BFE272 /* LLInt Offsets */;
>+			targetProxy = 0F4680B114BA811500BFE272 /* PBXContainerItemProxy */;
>+		};
>+		0F4680B414BA821400BFE272 /* PBXTargetDependency */ = {
>+			isa = PBXTargetDependency;
>+			target = 0F46808E14BA7E5E00BFE272 /* JSCLLIntOffsetsExtractor */;
>+			targetProxy = 0F4680B314BA821400BFE272 /* PBXContainerItemProxy */;
>+		};
> 		141214BF0A49190E00480255 /* PBXTargetDependency */ = {
> 			isa = PBXTargetDependency;
> 			target = 1412111F0A48793C00480255 /* minidom */;
>@@ -3687,6 +3876,148 @@
> /* End PBXTargetDependency section */
> 
> /* Begin XCBuildConfiguration section */
>+		0F46809614BA7E5E00BFE272 /* Debug */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				ALWAYS_SEARCH_USER_PATHS = NO;
>+				ARCHS = "$(ARCHS_STANDARD_64_BIT)";
>+				COPY_PHASE_STRIP = NO;
>+				GCC_C_LANGUAGE_STANDARD = gnu99;
>+				GCC_DYNAMIC_NO_PIC = NO;
>+				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
>+				GCC_OPTIMIZATION_LEVEL = 0;
>+				GCC_PREPROCESSOR_DEFINITIONS = (
>+					"DEBUG=1",
>+					"$(inherited)",
>+				);
>+				GCC_SYMBOLS_PRIVATE_EXTERN = NO;
>+				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
>+				GCC_WARN_64_TO_32_BIT_CONVERSION = NO;
>+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
>+				GCC_WARN_ABOUT_RETURN_TYPE = YES;
>+				GCC_WARN_UNUSED_VARIABLE = YES;
>+				"HEADER_SEARCH_PATHS[arch=*]" = (
>+					.,
>+					icu,
>+					"$(BUILT_PRODUCTS_DIR)/LLIntOffsets",
>+					"$(HEADER_SEARCH_PATHS)",
>+				);
>+				MACOSX_DEPLOYMENT_TARGET = 10.7;
>+				ONLY_ACTIVE_ARCH = YES;
>+				PRODUCT_NAME = "$(TARGET_NAME)";
>+				SDKROOT = macosx;
>+				USER_HEADER_SEARCH_PATHS = ". icu $(BUILT_PRODUCTS_DIR)/LLIntOffsets $(HEADER_SEARCH_PATHS)";
>+			};
>+			name = Debug;
>+		};
>+		0F46809714BA7E5E00BFE272 /* Release */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				ALWAYS_SEARCH_USER_PATHS = NO;
>+				ARCHS = "$(ARCHS_STANDARD_64_BIT)";
>+				COPY_PHASE_STRIP = YES;
>+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
>+				GCC_C_LANGUAGE_STANDARD = gnu99;
>+				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
>+				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
>+				GCC_WARN_64_TO_32_BIT_CONVERSION = NO;
>+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
>+				GCC_WARN_ABOUT_RETURN_TYPE = YES;
>+				GCC_WARN_UNUSED_VARIABLE = YES;
>+				"HEADER_SEARCH_PATHS[arch=*]" = (
>+					.,
>+					icu,
>+					"$(BUILT_PRODUCTS_DIR)/LLIntOffsets$(HEADER_SEARCH_PATHS)",
>+				);
>+				MACOSX_DEPLOYMENT_TARGET = 10.7;
>+				PRODUCT_NAME = "$(TARGET_NAME)";
>+				SDKROOT = macosx;
>+				USER_HEADER_SEARCH_PATHS = ". icu $(BUILT_PRODUCTS_DIR)/LLIntOffsets $(HEADER_SEARCH_PATHS)";
>+			};
>+			name = Release;
>+		};
>+		0F46809814BA7E5E00BFE272 /* Profiling */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				ALWAYS_SEARCH_USER_PATHS = NO;
>+				ARCHS = "$(ARCHS_STANDARD_64_BIT)";
>+				COPY_PHASE_STRIP = YES;
>+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
>+				GCC_C_LANGUAGE_STANDARD = gnu99;
>+				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
>+				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
>+				GCC_WARN_64_TO_32_BIT_CONVERSION = NO;
>+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
>+				GCC_WARN_ABOUT_RETURN_TYPE = YES;
>+				GCC_WARN_UNUSED_VARIABLE = YES;
>+				"HEADER_SEARCH_PATHS[arch=*]" = (
>+					.,
>+					icu,
>+					"$(BUILT_PRODUCTS_DIR)/LLIntOffsets",
>+					"$(HEADER_SEARCH_PATHS)",
>+				);
>+				MACOSX_DEPLOYMENT_TARGET = 10.7;
>+				PRODUCT_NAME = "$(TARGET_NAME)";
>+				SDKROOT = macosx;
>+				USER_HEADER_SEARCH_PATHS = ". icu $(BUILT_PRODUCTS_DIR)/LLIntOffsets $(HEADER_SEARCH_PATHS)";
>+			};
>+			name = Profiling;
>+		};
>+		0F46809914BA7E5E00BFE272 /* Production */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				ALWAYS_SEARCH_USER_PATHS = NO;
>+				ARCHS = "$(ARCHS_STANDARD_64_BIT)";
>+				COPY_PHASE_STRIP = YES;
>+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
>+				GCC_C_LANGUAGE_STANDARD = gnu99;
>+				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
>+				GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
>+				GCC_WARN_64_TO_32_BIT_CONVERSION = NO;
>+				GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
>+				GCC_WARN_ABOUT_RETURN_TYPE = YES;
>+				GCC_WARN_UNUSED_VARIABLE = YES;
>+				"HEADER_SEARCH_PATHS[arch=*]" = (
>+					.,
>+					icu,
>+					"$(BUILT_PRODUCTS_DIR)/LLIntOffsets",
>+					"$(HEADER_SEARCH_PATHS)",
>+				);
>+				MACOSX_DEPLOYMENT_TARGET = 10.7;
>+				PRODUCT_NAME = "$(TARGET_NAME)";
>+				SDKROOT = macosx;
>+				USER_HEADER_SEARCH_PATHS = ". icu $(BUILT_PRODUCTS_DIR)/LLIntOffsets $(HEADER_SEARCH_PATHS)";
>+			};
>+			name = Production;
>+		};
>+		0F4680AD14BA7FD900BFE272 /* Debug */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				PRODUCT_NAME = "Derived Sources copy";
>+			};
>+			name = Debug;
>+		};
>+		0F4680AE14BA7FD900BFE272 /* Release */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				PRODUCT_NAME = "Derived Sources copy";
>+			};
>+			name = Release;
>+		};
>+		0F4680AF14BA7FD900BFE272 /* Profiling */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				PRODUCT_NAME = "Derived Sources copy";
>+			};
>+			name = Profiling;
>+		};
>+		0F4680B014BA7FD900BFE272 /* Production */ = {
>+			isa = XCBuildConfiguration;
>+			buildSettings = {
>+				PRODUCT_NAME = "Derived Sources copy";
>+			};
>+			name = Production;
>+		};
> 		1412113A0A48798400480255 /* Debug */ = {
> 			isa = XCBuildConfiguration;
> 			buildSettings = {
>@@ -3928,6 +4259,28 @@
> /* End XCBuildConfiguration section */
> 
> /* Begin XCConfigurationList section */
>+		0F46809A14BA7E5F00BFE272 /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */ = {
>+			isa = XCConfigurationList;
>+			buildConfigurations = (
>+				0F46809614BA7E5E00BFE272 /* Debug */,
>+				0F46809714BA7E5E00BFE272 /* Release */,
>+				0F46809814BA7E5E00BFE272 /* Profiling */,
>+				0F46809914BA7E5E00BFE272 /* Production */,
>+			);
>+			defaultConfigurationIsVisible = 0;
>+			defaultConfigurationName = Production;
>+		};
>+		0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */ = {
>+			isa = XCConfigurationList;
>+			buildConfigurations = (
>+				0F4680AD14BA7FD900BFE272 /* Debug */,
>+				0F4680AE14BA7FD900BFE272 /* Release */,
>+				0F4680AF14BA7FD900BFE272 /* Profiling */,
>+				0F4680B014BA7FD900BFE272 /* Production */,
>+			);
>+			defaultConfigurationIsVisible = 0;
>+			defaultConfigurationName = Production;
>+		};
> 		141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */ = {
> 			isa = XCConfigurationList;
> 			buildConfigurations = (
>Index: Source/JavaScriptCore/assembler/LinkBuffer.h
>===================================================================
>--- Source/JavaScriptCore/assembler/LinkBuffer.h	(revision 106153)
>+++ Source/JavaScriptCore/assembler/LinkBuffer.h	(working copy)
>@@ -34,7 +34,7 @@
> #define GLOBAL_THUNK_ID reinterpret_cast<void*>(static_cast<intptr_t>(-1))
> #define REGEXP_CODE_ID reinterpret_cast<void*>(static_cast<intptr_t>(-2))
> 
>-#include <MacroAssembler.h>
>+#include "MacroAssembler.h"
> #include <wtf/Noncopyable.h>
> 
> namespace JSC {
>Index: Source/JavaScriptCore/bytecode/BytecodeConventions.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeConventions.h	(revision 0)
>+++ Source/JavaScriptCore/bytecode/BytecodeConventions.h	(revision 0)
>@@ -0,0 +1,36 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef BytecodeConventions_h
>+#define BytecodeConventions_h
>+
>+// Register numbers used in bytecode operations have different meaning according to their ranges:
>+//      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h.
>+//      0x00000000-0x3FFFFFFF  Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe.
>+//      0x40000000-0x7FFFFFFF  Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock.
>+static const int FirstConstantRegisterIndex = 0x40000000;
>+
>+#endif // BytecodeConventions_h
>+
>Index: Source/JavaScriptCore/bytecode/CallLinkStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CallLinkStatus.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/CallLinkStatus.cpp	(working copy)
>@@ -27,17 +27,40 @@
> #include "CallLinkStatus.h"
> 
> #include "CodeBlock.h"
>+#include "LLIntCallLinkInfo.h"
> 
> namespace JSC {
> 
>+CallLinkStatus CallLinkStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex)
>+{
>+    UNUSED_PARAM(profiledBlock);
>+    UNUSED_PARAM(bytecodeIndex);
>+#if ENABLE(LLINT)
>+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
>+    LLIntCallLinkInfo* callLinkInfo = instruction[4].u.callLinkInfo;
>+    
>+    return CallLinkStatus(callLinkInfo->lastSeenCallee.get(), false);
>+#else
>+    return CallLinkStatus(0, false);
>+#endif
>+}
>+
> CallLinkStatus CallLinkStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex)
> {
>     UNUSED_PARAM(profiledBlock);
>     UNUSED_PARAM(bytecodeIndex);
> #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
>-    return CallLinkStatus(
>-        profiledBlock->getCallLinkInfo(bytecodeIndex).lastSeenCallee.get(),
>-        profiledBlock->couldTakeSlowCase(bytecodeIndex));
>+    if (!profiledBlock->numberOfCallLinkInfos())
>+        return computeFromLLInt(profiledBlock, bytecodeIndex);
>+    
>+    if (profiledBlock->couldTakeSlowCase(bytecodeIndex))
>+        return CallLinkStatus(0, true);
>+    
>+    JSFunction* target = profiledBlock->getCallLinkInfo(bytecodeIndex).lastSeenCallee.get();
>+    if (!target)
>+        return computeFromLLInt(profiledBlock, bytecodeIndex);
>+    
>+    return CallLinkStatus(target, false);
> #else
>     return CallLinkStatus(0, false);
> #endif
>Index: Source/JavaScriptCore/bytecode/CallLinkStatus.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/CallLinkStatus.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/CallLinkStatus.h	(working copy)
>@@ -47,15 +47,17 @@ public:
>     
>     static CallLinkStatus computeFor(CodeBlock*, unsigned bytecodeIndex);
>     
>-    bool isSet() const { return !!m_callTarget; }
>+    bool isSet() const { return !!m_callTarget || m_couldTakeSlowPath; }
>     
>-    bool operator!() const { return !m_callTarget; }
>+    bool operator!() const { return !isSet(); }
>     
>     bool couldTakeSlowPath() const { return m_couldTakeSlowPath; }
>     
>     JSFunction* callTarget() const { return m_callTarget; }
>     
> private:
>+    static CallLinkStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex);
>+    
>     JSFunction* m_callTarget;
>     bool m_couldTakeSlowPath;
> };
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -42,6 +42,7 @@
> #include "JSFunction.h"
> #include "JSStaticScopeObject.h"
> #include "JSValue.h"
>+#include "LowLevelInterpreter.h"
> #include "RepatchBuffer.h"
> #include "UStringConcatenate.h"
> #include <stdio.h>
>@@ -59,8 +60,6 @@ namespace JSC {
> using namespace DFG;
> #endif
> 
>-#if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
>-
> static UString escapeQuotes(const UString& str)
> {
>     UString result = str;
>@@ -358,10 +357,10 @@ void CodeBlock::dump(ExecState* exec) co
>     for (size_t i = 0; i < instructions().size(); i += opcodeLengths[exec->interpreter()->getOpcodeID(instructions()[i].u.opcode)])
>         ++instructionCount;
> 
>-    printf("%lu m_instructions; %lu bytes at %p; %d parameter(s); %d callee register(s)\n\n",
>+    printf("%lu m_instructions; %lu bytes at %p; %d parameter(s); %d callee register(s); %d variable(s)\n\n",
>         static_cast<unsigned long>(instructionCount),
>         static_cast<unsigned long>(instructions().size() * sizeof(Instruction)),
>-        this, m_numParameters, m_numCalleeRegisters);
>+        this, m_numParameters, m_numCalleeRegisters, m_numVars);
> 
>     Vector<Instruction>::const_iterator begin = instructions().begin();
>     Vector<Instruction>::const_iterator end = instructions().end();
>@@ -898,6 +897,14 @@ void CodeBlock::dump(ExecState* exec, co
>             printPutByIdOp(exec, location, it, "put_by_id_transition");
>             break;
>         }
>+        case op_put_by_id_transition_direct: {
>+            printPutByIdOp(exec, location, it, "put_by_id_transition_direct");
>+            break;
>+        }
>+        case op_put_by_id_transition_normal: {
>+            printPutByIdOp(exec, location, it, "put_by_id_transition_normal");
>+            break;
>+        }
>         case op_put_by_id_generic: {
>             printPutByIdOp(exec, location, it, "put_by_id_generic");
>             break;
>@@ -1291,8 +1298,6 @@ void CodeBlock::dump(ExecState* exec, co
>     }
> }
> 
>-#endif // !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
>-
> #if DUMP_CODE_BLOCK_STATISTICS
> static HashSet<CodeBlock*> liveCodeBlockSet;
> #endif
>@@ -1459,6 +1464,7 @@ CodeBlock::CodeBlock(CopyParsedBlockTag,
> {
>     setNumParameters(other.numParameters());
>     optimizeAfterWarmUp();
>+    jitAfterWarmUp();
>     
>     if (other.m_rareData) {
>         createRareDataIfNecessary();
>@@ -1507,6 +1513,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     ASSERT(m_source);
>     
>     optimizeAfterWarmUp();
>+    jitAfterWarmUp();
> 
> #if DUMP_CODE_BLOCK_STATISTICS
>     liveCodeBlockSet.add(this);
>@@ -1524,7 +1531,11 @@ CodeBlock::~CodeBlock()
> #if ENABLE(VERBOSE_VALUE_PROFILE)
>     dumpValueProfiles();
> #endif
>-    
>+
>+#if ENABLE(LLINT)    
>+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
>+        m_incomingLLIntCalls.begin()->remove();
>+#endif // ENABLE(LLINT)
> #if ENABLE(JIT)
>     // We may be destroyed before any CodeBlocks that refer to us are destroyed.
>     // Consider that two CodeBlocks become unreachable at the same time. There
>@@ -1736,8 +1747,59 @@ void CodeBlock::finalizeUnconditionally(
> #else
>     static const bool verboseUnlinking = false;
> #endif
>-#endif
>+#endif // ENABLE(JIT)
>     
>+#if ENABLE(LLINT)
>+    Interpreter* interpreter = m_globalData->interpreter;
>+    // interpreter->enabled() returns true if the old C++ interpreter is enabled. If that's enabled
>+    // then we're not using LLInt.
>+    if (!interpreter->enabled()) {
>+        for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
>+            Instruction* curInstruction = &instructions()[m_propertyAccessInstructions[i]];
>+            switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
>+            case op_get_by_id:
>+            case op_put_by_id:
>+                if (!curInstruction[4].u.structure || Heap::isMarked(curInstruction[4].u.structure.get()))
>+                    break;
>+                curInstruction[4].u.structure.clear();
>+                curInstruction[5].u.operand = 0;
>+                break;
>+            case op_put_by_id_transition_direct:
>+            case op_put_by_id_transition_normal:
>+                if (Heap::isMarked(curInstruction[4].u.structure.get())
>+                    && Heap::isMarked(curInstruction[6].u.structure.get())
>+                    && Heap::isMarked(curInstruction[7].u.structureChain.get()))
>+                    break;
>+                curInstruction[4].u.structure.clear();
>+                curInstruction[6].u.structure.clear();
>+                curInstruction[7].u.structureChain.clear();
>+                curInstruction[0].u.opcode = interpreter->getOpcode(op_put_by_id);
>+                break;
>+            default:
>+                ASSERT_NOT_REACHED();
>+            }
>+        }
>+        for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i) {
>+            Instruction* curInstruction = &instructions()[m_globalResolveInstructions[i]];
>+            ASSERT(interpreter->getOpcodeID(curInstruction[0].u.opcode) == op_resolve_global
>+                   || interpreter->getOpcodeID(curInstruction[0].u.opcode) == op_resolve_global_dynamic);
>+            if (!curInstruction[3].u.structure || Heap::isMarked(curInstruction[3].u.structure.get()))
>+                continue;
>+            curInstruction[3].u.structure.clear();
>+            curInstruction[4].u.operand = 0;
>+        }
>+        for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {
>+            if (m_llintCallLinkInfos[i].isLinked() && !Heap::isMarked(m_llintCallLinkInfos[i].callee.get())) {
>+                if (verboseUnlinking)
>+                    printf("Clearing LLInt call from %p.\n", this);
>+                m_llintCallLinkInfos[i].unlink();
>+            }
>+            if (!!m_llintCallLinkInfos[i].lastSeenCallee && !Heap::isMarked(m_llintCallLinkInfos[i].lastSeenCallee.get()))
>+                m_llintCallLinkInfos[i].lastSeenCallee.clear();
>+        }
>+    }
>+#endif // ENABLE(LLINT)
>+
> #if ENABLE(DFG_JIT)
>     // Check if we're not live. If we are, then jettison.
>     if (!(shouldImmediatelyAssumeLivenessDuringScan() || m_dfgData->livenessHasBeenProved)) {
>@@ -1858,10 +1920,12 @@ void CodeBlock::stronglyVisitStrongRefer
>     for (size_t i = 0; i < m_functionDecls.size(); ++i)
>         visitor.append(&m_functionDecls[i]);
> #if ENABLE(INTERPRETER)
>-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
>-        visitStructures(visitor, &instructions()[m_propertyAccessInstructions[i]]);
>-    for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
>-        visitStructures(visitor, &instructions()[m_globalResolveInstructions[i]]);
>+    if (m_globalData->interpreter->enabled()) {
>+        for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
>+            visitStructures(visitor, &instructions()[m_propertyAccessInstructions[i]]);
>+        for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
>+            visitStructures(visitor, &instructions()[m_globalResolveInstructions[i]]);
>+    }
> #endif
> 
> #if ENABLE(DFG_JIT)
>@@ -2070,6 +2134,12 @@ void CodeBlock::unlinkCalls()
> {
>     if (!!m_alternative)
>         m_alternative->unlinkCalls();
>+#if ENABLE(LLINT)
>+    for (size_t i = 0; i < m_llintCallLinkInfos.size(); ++i) {
>+        if (m_llintCallLinkInfos[i].isLinked())
>+            m_llintCallLinkInfos[i].unlink();
>+    }
>+#endif
>     if (!(m_callLinkInfos.size() || m_methodCallLinkInfos.size()))
>         return;
>     if (!m_globalData->canUseJIT())
>@@ -2084,10 +2154,39 @@ void CodeBlock::unlinkCalls()
> 
> void CodeBlock::unlinkIncomingCalls()
> {
>+#if ENABLE(LLINT)
>+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
>+        m_incomingLLIntCalls.begin()->unlink();
>+#endif
>+    if (m_incomingCalls.isEmpty())
>+        return;
>     RepatchBuffer repatchBuffer(this);
>     while (m_incomingCalls.begin() != m_incomingCalls.end())
>         m_incomingCalls.begin()->unlink(*m_globalData, repatchBuffer);
> }
>+
>+unsigned CodeBlock::bytecodeOffset(ExecState* exec, ReturnAddressPtr returnAddress)
>+{
>+#if ENABLE(LLINT)
>+    if (returnAddress.value() >= bitwise_cast<void*>(&llint_begin)
>+        && returnAddress.value() <= bitwise_cast<void*>(&llint_end)) {
>+        ASSERT(exec->codeBlock());
>+        ASSERT(exec->codeBlock() == this);
>+        ASSERT(JITCode::isBaselineCode(getJITType()));
>+        Instruction* instruction = exec->currentVPC();
>+        ASSERT(instruction);
>+        return bytecodeOffset(instruction);
>+    }
>+#else
>+    UNUSED_PARAM(exec);
>+#endif
>+    if (!m_rareData)
>+        return 1;
>+    Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
>+    if (!callIndices.size())
>+        return 1;
>+    return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
>+}
> #endif
> 
> void CodeBlock::clearEvalCache()
>@@ -2183,24 +2282,45 @@ bool FunctionCodeBlock::canCompileWithDF
> 
> void ProgramCodeBlock::jettison()
> {
>-    ASSERT(getJITType() != JITCode::BaselineJIT);
>+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
>     ASSERT(this == replacement());
>     static_cast<ProgramExecutable*>(ownerExecutable())->jettisonOptimizedCode(*globalData());
> }
> 
> void EvalCodeBlock::jettison()
> {
>-    ASSERT(getJITType() != JITCode::BaselineJIT);
>+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
>     ASSERT(this == replacement());
>     static_cast<EvalExecutable*>(ownerExecutable())->jettisonOptimizedCode(*globalData());
> }
> 
> void FunctionCodeBlock::jettison()
> {
>-    ASSERT(getJITType() != JITCode::BaselineJIT);
>+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
>     ASSERT(this == replacement());
>     static_cast<FunctionExecutable*>(ownerExecutable())->jettisonOptimizedCodeFor(*globalData(), m_isConstructor ? CodeForConstruct : CodeForCall);
> }
>+
>+void ProgramCodeBlock::jitCompileImpl(JSGlobalData& globalData)
>+{
>+    ASSERT(getJITType() == JITCode::InterpreterThunk);
>+    ASSERT(this == replacement());
>+    return static_cast<ProgramExecutable*>(ownerExecutable())->jitCompile(globalData);
>+}
>+
>+void EvalCodeBlock::jitCompileImpl(JSGlobalData& globalData)
>+{
>+    ASSERT(getJITType() == JITCode::InterpreterThunk);
>+    ASSERT(this == replacement());
>+    return static_cast<EvalExecutable*>(ownerExecutable())->jitCompile(globalData);
>+}
>+
>+void FunctionCodeBlock::jitCompileImpl(JSGlobalData& globalData)
>+{
>+    ASSERT(getJITType() == JITCode::InterpreterThunk);
>+    ASSERT(this == replacement());
>+    return static_cast<FunctionExecutable*>(ownerExecutable())->jitCompileFor(globalData, m_isConstructor ? CodeForConstruct : CodeForCall);
>+}
> #endif
> 
> #if ENABLE(VALUE_PROFILER)
>@@ -2303,6 +2423,18 @@ void CodeBlock::dumpValueProfiles()
> }
> #endif
> 
>+void CodeBlock::handleBytecodeDiscardingOpportunity()
>+{
>+#if !ENABLE(OPCODE_SAMPLING) && !ENABLE(LLINT)
>+    if (BytecodeGenerator::dumpsGeneratedCode())
>+        return;
>+    if (!!alternative())
>+        discardBytecode();
>+    else
>+        discardBytecodeLater();
>+#endif
>+}
>+
> #ifndef NDEBUG
> bool CodeBlock::usesOpcode(OpcodeID opcodeID)
> {
>Index: Source/JavaScriptCore/bytecode/CodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.h	(working copy)
>@@ -30,6 +30,7 @@
> #ifndef CodeBlock_h
> #define CodeBlock_h
> 
>+#include "BytecodeConventions.h"
> #include "CallLinkInfo.h"
> #include "CallReturnOffsetToBytecodeOffset.h"
> #include "CodeOrigin.h"
>@@ -50,6 +51,7 @@
> #include "JITWriteBarrier.h"
> #include "JSGlobalObject.h"
> #include "JumpTable.h"
>+#include "LLIntCallLinkInfo.h"
> #include "LineInfo.h"
> #include "Nodes.h"
> #include "PredictionTracker.h"
>@@ -65,16 +67,11 @@
> #include <wtf/Vector.h>
> #include "StructureStubInfo.h"
> 
>-// Register numbers used in bytecode operations have different meaning according to their ranges:
>-//      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h.
>-//      0x00000000-0x3FFFFFFF  Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe.
>-//      0x40000000-0x7FFFFFFF  Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock.
>-static const int FirstConstantRegisterIndex = 0x40000000;
>-
> namespace JSC {
> 
>-    class ExecState;
>     class DFGCodeBlocks;
>+    class ExecState;
>+    class LLIntOffsetsExtractor;
> 
>     inline int unmodifiedArgumentsRegister(int argumentsRegister) { return argumentsRegister - 1; }
> 
>@@ -83,6 +80,7 @@ namespace JSC {
>     class CodeBlock : public UnconditionalFinalizer, public WeakReferenceHarvester {
>         WTF_MAKE_FAST_ALLOCATED;
>         friend class JIT;
>+        friend class LLIntOffsetsExtractor;
>     public:
>         enum CopyParsedBlockTag { CopyParsedBlock };
>     protected:
>@@ -123,7 +121,7 @@ namespace JSC {
>             while (result->alternative())
>                 result = result->alternative();
>             ASSERT(result);
>-            ASSERT(result->getJITType() == JITCode::BaselineJIT);
>+            ASSERT(JITCode::isBaselineCode(result->getJITType()));
>             return result;
>         }
> #endif
>@@ -134,11 +132,9 @@ namespace JSC {
> 
>         static void dumpStatistics();
> 
>-#if !defined(NDEBUG) || ENABLE_OPCODE_SAMPLING
>         void dump(ExecState*) const;
>         void printStructures(const Instruction*) const;
>         void printStructure(const char* name, const Instruction*, int operand) const;
>-#endif
> 
>         bool isStrictMode() const { return m_isStrictMode; }
> 
>@@ -194,15 +190,7 @@ namespace JSC {
>             return *(binarySearch<MethodCallLinkInfo, unsigned, getMethodCallLinkInfoBytecodeIndex>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), bytecodeIndex));
>         }
> 
>-        unsigned bytecodeOffset(ReturnAddressPtr returnAddress)
>-        {
>-            if (!m_rareData)
>-                return 1;
>-            Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
>-            if (!callIndices.size())
>-                return 1;
>-            return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
>-        }
>+        unsigned bytecodeOffset(ExecState*, ReturnAddressPtr);
> 
>         unsigned bytecodeOffsetForCallAtIndex(unsigned index)
>         {
>@@ -223,11 +211,17 @@ namespace JSC {
>         {
>             m_incomingCalls.push(incoming);
>         }
>+#if ENABLE(LLINT)
>+        void linkIncomingCall(LLIntCallLinkInfo* incoming)
>+        {
>+            m_incomingLLIntCalls.push(incoming);
>+        }
>+#endif // ENABLE(LLINT)
>         
>         void unlinkIncomingCalls();
>-#endif
>+#endif // ENABLE(JIT)
> 
>-#if ENABLE(DFG_JIT)
>+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
>         void setJITCodeMap(PassOwnPtr<CompactJITCodeMap> jitCodeMap)
>         {
>             m_jitCodeMap = jitCodeMap;
>@@ -236,7 +230,9 @@ namespace JSC {
>         {
>             return m_jitCodeMap.get();
>         }
>+#endif
>         
>+#if ENABLE(DFG_JIT)
>         void createDFGDataIfNecessary()
>         {
>             if (!!m_dfgData)
>@@ -335,12 +331,11 @@ namespace JSC {
>         }
> #endif
> 
>-#if ENABLE(INTERPRETER)
>         unsigned bytecodeOffset(Instruction* returnAddress)
>         {
>+            ASSERT(returnAddress >= instructions().begin() && returnAddress < instructions().end());
>             return static_cast<Instruction*>(returnAddress) - instructions().begin();
>         }
>-#endif
> 
>         void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
>         bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
>@@ -354,17 +349,9 @@ namespace JSC {
>         {
>             m_shouldDiscardBytecode = true;
>         }
>-        void handleBytecodeDiscardingOpportunity()
>-        {
>-            if (!!alternative())
>-                discardBytecode();
>-            else
>-                discardBytecodeLater();
>-        }
>+        void handleBytecodeDiscardingOpportunity();
>         
>-#ifndef NDEBUG
>         bool usesOpcode(OpcodeID);
>-#endif
> 
>         unsigned instructionCount() { return m_instructionCount; }
>         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
>@@ -387,17 +374,26 @@ namespace JSC {
>         ExecutableMemoryHandle* executableMemory() { return getJITCode().getExecutableMemory(); }
>         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*) = 0;
>         virtual void jettison() = 0;
>+        bool jitCompile(JSGlobalData& globalData)
>+        {
>+            if (getJITType() != JITCode::InterpreterThunk) {
>+                ASSERT(getJITType() == JITCode::BaselineJIT);
>+                return false;
>+            }
>+            jitCompileImpl(globalData);
>+            return true;
>+        }
>         virtual CodeBlock* replacement() = 0;
>         virtual bool canCompileWithDFG() = 0;
>         bool hasOptimizedReplacement()
>         {
>-            ASSERT(getJITType() == JITCode::BaselineJIT);
>+            ASSERT(JITCode::isBaselineCode(getJITType()));
>             bool result = replacement()->getJITType() > getJITType();
> #if !ASSERT_DISABLED
>             if (result)
>                 ASSERT(replacement()->getJITType() == JITCode::DFGJIT);
>             else {
>-                ASSERT(replacement()->getJITType() == JITCode::BaselineJIT);
>+                ASSERT(JITCode::isBaselineCode(replacement()->getJITType()));
>                 ASSERT(replacement() == this);
>             }
> #endif
>@@ -456,18 +452,21 @@ namespace JSC {
> 
>         void clearEvalCache();
> 
>-#if ENABLE(INTERPRETER)
>         void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
>         {
>-            if (!m_globalData->canUseJIT())
>-                m_propertyAccessInstructions.append(propertyAccessInstruction);
>+            m_propertyAccessInstructions.append(propertyAccessInstruction);
>         }
>         void addGlobalResolveInstruction(unsigned globalResolveInstruction)
>         {
>-            if (!m_globalData->canUseJIT())
>-                m_globalResolveInstructions.append(globalResolveInstruction);
>+            m_globalResolveInstructions.append(globalResolveInstruction);
>         }
>         bool hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset);
>+#if ENABLE(LLINT)
>+        LLIntCallLinkInfo* addLLIntCallLinkInfo()
>+        {
>+            m_llintCallLinkInfos.append(LLIntCallLinkInfo());
>+            return &m_llintCallLinkInfos.last();
>+        }
> #endif
> #if ENABLE(JIT)
>         void setNumberOfStructureStubInfos(size_t size) { m_structureStubInfos.grow(size); }
>@@ -476,8 +475,7 @@ namespace JSC {
> 
>         void addGlobalResolveInfo(unsigned globalResolveInstruction)
>         {
>-            if (m_globalData->canUseJIT())
>-                m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction));
>+            m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction));
>         }
>         GlobalResolveInfo& globalResolveInfo(int index) { return m_globalResolveInfos[index]; }
>         bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
>@@ -488,6 +486,7 @@ namespace JSC {
> 
>         void addMethodCallLinkInfos(unsigned n) { ASSERT(m_globalData->canUseJIT()); m_methodCallLinkInfos.grow(n); }
>         MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
>+        size_t numberOfMethodCallLinkInfos() { return m_methodCallLinkInfos.size(); }
> #endif
>         
> #if ENABLE(VALUE_PROFILER)
>@@ -528,6 +527,10 @@ namespace JSC {
>                                    bytecodeOffset].u.opcode)) - 1].u.profile == result);
>             return result;
>         }
>+        PredictedType valueProfilePredictionForBytecodeOffset(int bytecodeOffset)
>+        {
>+            return valueProfileForBytecodeOffset(bytecodeOffset)->computeUpdatedPrediction();
>+        }
>         
>         unsigned totalNumberOfValueProfiles()
>         {
>@@ -554,12 +557,16 @@ namespace JSC {
>         
>         bool likelyToTakeSlowCase(int bytecodeOffset)
>         {
>+            if (!numberOfRareCaseProfiles())
>+                return false;
>             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             return value >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
>         }
>         
>         bool couldTakeSlowCase(int bytecodeOffset)
>         {
>+            if (!numberOfRareCaseProfiles())
>+                return false;
>             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             return value >= Options::couldTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::couldTakeSlowCaseThreshold;
>         }
>@@ -578,12 +585,16 @@ namespace JSC {
>         
>         bool likelyToTakeSpecialFastCase(int bytecodeOffset)
>         {
>+            if (!numberOfRareCaseProfiles())
>+                return false;
>             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             return specialFastCaseCount >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(specialFastCaseCount) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
>         }
>         
>         bool likelyToTakeDeepestSlowCase(int bytecodeOffset)
>         {
>+            if (!numberOfRareCaseProfiles())
>+                return false;
>             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             unsigned value = slowCaseCount - specialFastCaseCount;
>@@ -592,6 +603,8 @@ namespace JSC {
>         
>         bool likelyToTakeAnySlowCase(int bytecodeOffset)
>         {
>+            if (!numberOfRareCaseProfiles())
>+                return false;
>             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
>             unsigned value = slowCaseCount + specialFastCaseCount;
>@@ -689,7 +702,7 @@ namespace JSC {
>         
>         bool addFrequentExitSite(const DFG::FrequentExitSite& site)
>         {
>-            ASSERT(getJITType() == JITCode::BaselineJIT);
>+            ASSERT(JITCode::isBaselineCode(getJITType()));
>             return m_exitProfile.add(site);
>         }
> 
>@@ -794,6 +807,29 @@ namespace JSC {
>         void copyPostParseDataFrom(CodeBlock* alternative);
>         void copyPostParseDataFromAlternative();
>         
>+        // Functions for controlling when JITting kicks in, in a mixed mode
>+        // execution world.
>+        
>+        void dontJITAnytimeSoon()
>+        {
>+            m_llintExecuteCounter = Options::executionCounterValueForDontJITAnytimeSoon;
>+        }
>+        
>+        void jitAfterWarmUp()
>+        {
>+            m_llintExecuteCounter = Options::executionCounterValueForJITAfterWarmUp;
>+        }
>+        
>+        void jitSoon()
>+        {
>+            m_llintExecuteCounter = Options::executionCounterValueForJITSoon;
>+        }
>+        
>+        int32_t llintExecuteCounter() const
>+        {
>+            return m_llintExecuteCounter;
>+        }
>+        
>         // Functions for controlling when tiered compilation kicks in. This
>         // controls both when the optimizing compiler is invoked and when OSR
>         // entry happens. Two triggers exist: the loop trigger and the return
>@@ -986,6 +1022,7 @@ namespace JSC {
>         bool m_shouldDiscardBytecode;
> 
>     protected:
>+        virtual void jitCompileImpl(JSGlobalData&) = 0;
>         virtual void visitWeakReferences(SlotVisitor&);
>         virtual void finalizeUnconditionally();
>         
>@@ -998,7 +1035,6 @@ namespace JSC {
>         void tallyFrequentExitSites() { }
> #endif
>         
>-#if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING)
>         void dump(ExecState*, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator&) const;
> 
>         CString registerName(ExecState*, int r) const;
>@@ -1008,7 +1044,6 @@ namespace JSC {
>         void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
>         void printCallOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
>         void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
>-#endif
>         void visitStructures(SlotVisitor&, Instruction* vPC) const;
>         
> #if ENABLE(DFG_JIT)
>@@ -1069,9 +1104,11 @@ namespace JSC {
>         RefPtr<SourceProvider> m_source;
>         unsigned m_sourceOffset;
> 
>-#if ENABLE(INTERPRETER)
>         Vector<unsigned> m_propertyAccessInstructions;
>         Vector<unsigned> m_globalResolveInstructions;
>+#if ENABLE(LLINT)
>+        SegmentedVector<LLIntCallLinkInfo, 8> m_llintCallLinkInfos;
>+        SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo> > m_incomingLLIntCalls;
> #endif
> #if ENABLE(JIT)
>         Vector<StructureStubInfo> m_structureStubInfos;
>@@ -1082,9 +1119,10 @@ namespace JSC {
>         MacroAssemblerCodePtr m_jitCodeWithArityCheck;
>         SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo> > m_incomingCalls;
> #endif
>-#if ENABLE(DFG_JIT)
>+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
>         OwnPtr<CompactJITCodeMap> m_jitCodeMap;
>-        
>+#endif
>+#if ENABLE(DFG_JIT)
>         struct WeakReferenceTransition {
>             WeakReferenceTransition() { }
>             
>@@ -1147,12 +1185,14 @@ namespace JSC {
> 
>         OwnPtr<CodeBlock> m_alternative;
>         
>+        int32_t m_llintExecuteCounter;
>+        
>         int32_t m_jitExecuteCounter;
>         uint32_t m_speculativeSuccessCounter;
>         uint32_t m_speculativeFailCounter;
>         uint8_t m_optimizationDelayCounter;
>         uint8_t m_reoptimizationRetryCounter;
>-
>+        
>         struct RareData {
>            WTF_MAKE_FAST_ALLOCATED;
>         public:
>@@ -1225,6 +1265,7 @@ namespace JSC {
>     protected:
>         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
>         virtual void jettison();
>+        virtual void jitCompileImpl(JSGlobalData&);
>         virtual CodeBlock* replacement();
>         virtual bool canCompileWithDFG();
> #endif
>@@ -1259,6 +1300,7 @@ namespace JSC {
>     protected:
>         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
>         virtual void jettison();
>+        virtual void jitCompileImpl(JSGlobalData&);
>         virtual CodeBlock* replacement();
>         virtual bool canCompileWithDFG();
> #endif
>@@ -1296,6 +1338,7 @@ namespace JSC {
>     protected:
>         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
>         virtual void jettison();
>+        virtual void jitCompileImpl(JSGlobalData&);
>         virtual CodeBlock* replacement();
>         virtual bool canCompileWithDFG();
> #endif
>Index: Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/GetByIdStatus.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/GetByIdStatus.cpp	(working copy)
>@@ -27,20 +27,49 @@
> #include "GetByIdStatus.h"
> 
> #include "CodeBlock.h"
>+#include "LowLevelInterpreter.h"
> 
> namespace JSC {
> 
>+GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
>+{
>+    UNUSED_PARAM(profiledBlock);
>+    UNUSED_PARAM(bytecodeIndex);
>+    UNUSED_PARAM(ident);
>+#if ENABLE(LLINT)
>+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
>+    
>+    if (instruction[0].u.opcode == llint_op_method_check)
>+        instruction++;
>+
>+    Structure* structure = instruction[4].u.structure.get();
>+    if (!structure)
>+        return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
>+    
>+    size_t offset = structure->get(*profiledBlock->globalData(), ident);
>+    if (offset == notFound)
>+        return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
>+    
>+    return GetByIdStatus(SimpleDirect, StructureSet(structure), offset, false);
>+#else
>+    return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
>+#endif
>+}
>+
> GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
> {
>     UNUSED_PARAM(profiledBlock);
>     UNUSED_PARAM(bytecodeIndex);
>     UNUSED_PARAM(ident);
> #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
>+    if (!profiledBlock->numberOfStructureStubInfos())
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>+    
>     // First check if it makes either calls, in which case we want to be super careful, or
>     // if it's not set at all, in which case we punt.
>     StructureStubInfo& stubInfo = profiledBlock->getStubInfo(bytecodeIndex);
>     if (!stubInfo.seen)
>-        return GetByIdStatus(NoInformation, StructureSet(), notFound);
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>     
>     PolymorphicAccessStructureList* list;
>     int listSize;
>@@ -60,18 +89,19 @@ GetByIdStatus GetByIdStatus::computeFor(
>     }
>     for (int i = 0; i < listSize; ++i) {
>         if (!list->list[i].isDirect)
>-            return GetByIdStatus(MakesCalls, StructureSet(), notFound);
>+            return GetByIdStatus(MakesCalls, StructureSet(), notFound, true);
>     }
>     
>     // Next check if it takes slow case, in which case we want to be kind of careful.
>     if (profiledBlock->likelyToTakeSlowCase(bytecodeIndex))
>-        return GetByIdStatus(TakesSlowPath, StructureSet(), notFound);
>+        return GetByIdStatus(TakesSlowPath, StructureSet(), notFound, true);
>     
>     // Finally figure out if we can derive an access strategy.
>     GetByIdStatus result;
>+    result.m_wasSeenInJIT = true;
>     switch (stubInfo.accessType) {
>     case access_unset:
>-        return GetByIdStatus(NoInformation, StructureSet(), notFound);
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>         
>     case access_get_by_id_self: {
>         Structure* structure = stubInfo.u.getByIdSelf.baseObjectStructure.get();
>@@ -130,7 +160,7 @@ GetByIdStatus GetByIdStatus::computeFor(
>     
>     return result;
> #else // ENABLE(JIT)
>-    return GetByIdStatus(NoInformation, StructureSet(), notFound);
>+    return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
> #endif // ENABLE(JIT)
> }
> 
>Index: Source/JavaScriptCore/bytecode/GetByIdStatus.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/GetByIdStatus.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/GetByIdStatus.h	(working copy)
>@@ -49,10 +49,11 @@ public:
>     {
>     }
>     
>-    GetByIdStatus(State state, const StructureSet& structureSet, size_t offset)
>+    GetByIdStatus(State state, const StructureSet& structureSet, size_t offset, bool wasSeenInJIT)
>         : m_state(state)
>         , m_structureSet(structureSet)
>         , m_offset(offset)
>+        , m_wasSeenInJIT(wasSeenInJIT)
>     {
>         ASSERT((state == SimpleDirect) == (offset != notFound));
>     }
>@@ -70,10 +71,15 @@ public:
>     const StructureSet& structureSet() const { return m_structureSet; }
>     size_t offset() const { return m_offset; }
>     
>+    bool wasSeenInJIT() const { return m_wasSeenInJIT; }
>+    
> private:
>+    static GetByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, Identifier&);
>+    
>     State m_state;
>     StructureSet m_structureSet;
>     size_t m_offset;
>+    bool m_wasSeenInJIT;
> };
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/bytecode/Instruction.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/Instruction.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/Instruction.h	(working copy)
>@@ -48,6 +48,7 @@ namespace JSC {
>     class JSCell;
>     class Structure;
>     class StructureChain;
>+    struct LLIntCallLinkInfo;
>     struct ValueProfile;
> 
> #if ENABLE(JIT)
>@@ -146,6 +147,11 @@ namespace JSC {
> #endif
> 
>     struct Instruction {
>+        Instruction()
>+        {
>+            u.jsCell.clear();
>+        }
>+        
>         Instruction(Opcode opcode)
>         {
> #if !ENABLE(COMPUTED_GOTO_INTERPRETER)
>@@ -182,6 +188,8 @@ namespace JSC {
> 
>         Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
>         
>+        Instruction(LLIntCallLinkInfo* callLinkInfo) { u.callLinkInfo = callLinkInfo; }
>+        
>         Instruction(ValueProfile* profile) { u.profile = profile; }
> 
>         union {
>@@ -191,7 +199,9 @@ namespace JSC {
>             WriteBarrierBase<StructureChain> structureChain;
>             WriteBarrierBase<JSCell> jsCell;
>             PropertySlot::GetValueFunc getterFunc;
>+            LLIntCallLinkInfo* callLinkInfo;
>             ValueProfile* profile;
>+            void* pointer;
>         } u;
>         
>     private:
>Index: Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h	(revision 0)
>+++ Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h	(revision 0)
>@@ -0,0 +1,66 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntCallLinkInfo_h
>+#define LLIntCallLinkInfo_h
>+
>+#include "JSFunction.h"
>+#include "MacroAssemblerCodeRef.h"
>+#include <wtf/SentinelLinkedList.h>
>+
>+namespace JSC {
>+
>+struct Instruction;
>+
>+struct LLIntCallLinkInfo : public BasicRawSentinelNode<LLIntCallLinkInfo> {
>+    LLIntCallLinkInfo()
>+    {
>+    }
>+    
>+    ~LLIntCallLinkInfo()
>+    {
>+        if (isOnList())
>+            remove();
>+    }
>+    
>+    bool isLinked() { return callee; }
>+    
>+    void unlink()
>+    {
>+        callee.clear();
>+        machineCodeTarget = MacroAssemblerCodePtr();
>+        if (isOnList())
>+            remove();
>+    }
>+    
>+    WriteBarrier<JSFunction> callee;
>+    WriteBarrier<JSFunction> lastSeenCallee;
>+    MacroAssemblerCodePtr machineCodeTarget;
>+};
>+
>+} // namespace JSC
>+
>+#endif // LLIntCallLinkInfo_h
>+
>Index: Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp	(working copy)
>@@ -35,6 +35,11 @@ MethodCallLinkStatus MethodCallLinkStatu
>     UNUSED_PARAM(profiledBlock);
>     UNUSED_PARAM(bytecodeIndex);
> #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
>+    // NOTE: This does not have an LLInt fall-back because LLInt does not do any method
>+    // call link caching.
>+    if (!profiledBlock->numberOfMethodCallLinkInfos())
>+        return MethodCallLinkStatus();
>+    
>     MethodCallLinkInfo& methodCall = profiledBlock->getMethodCallLinkInfo(bytecodeIndex);
>     
>     if (!methodCall.seen || !methodCall.cachedStructure)
>Index: Source/JavaScriptCore/bytecode/Opcode.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/Opcode.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/Opcode.h	(working copy)
>@@ -123,6 +123,8 @@ namespace JSC {
>         macro(op_get_arguments_length, 4) \
>         macro(op_put_by_id, 9) \
>         macro(op_put_by_id_transition, 9) \
>+        macro(op_put_by_id_transition_direct, 9) \
>+        macro(op_put_by_id_transition_normal, 9) \
>         macro(op_put_by_id_replace, 9) \
>         macro(op_put_by_id_generic, 9) \
>         macro(op_del_by_id, 4) \
>@@ -202,6 +204,7 @@ namespace JSC {
>         typedef enum { FOR_EACH_OPCODE_ID(OPCODE_ID_ENUM) } OpcodeID;
>     #undef OPCODE_ID_ENUM
> 
>+    const int maxOpcodeLength = 9;
>     const int numOpcodeIDs = op_end + 1;
> 
>     #define OPCODE_ID_LENGTHS(id, length) const int id##_length = length;
>@@ -218,7 +221,7 @@ namespace JSC {
>         FOR_EACH_OPCODE_ID(VERIFY_OPCODE_ID);
>     #undef VERIFY_OPCODE_ID
> 
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(COMPUTED_GOTO_INTERPRETER) || ENABLE(LLINT)
> #if COMPILER(RVCT) || COMPILER(INTEL)
>     typedef void* Opcode;
> #else
>Index: Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdStatus.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/PutByIdStatus.cpp	(working copy)
>@@ -27,27 +27,69 @@
> #include "PutByIdStatus.h"
> 
> #include "CodeBlock.h"
>+#include "LowLevelInterpreter.h"
> #include "Structure.h"
> #include "StructureChain.h"
> 
> namespace JSC {
> 
>+PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
>+{
>+    UNUSED_PARAM(profiledBlock);
>+    UNUSED_PARAM(bytecodeIndex);
>+    UNUSED_PARAM(ident);
>+#if ENABLE(LLINT)
>+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
>+
>+    Structure* structure = instruction[4].u.structure.get();
>+    if (!structure)
>+        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+    
>+    if (instruction[0].u.opcode == llint_op_put_by_id) {
>+        size_t offset = structure->get(*profiledBlock->globalData(), ident);
>+        if (offset == notFound)
>+            return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+        
>+        return PutByIdStatus(SimpleReplace, structure, 0, 0, offset);
>+    }
>+    
>+    ASSERT(instruction[0].u.opcode == llint_op_put_by_id_transition_direct
>+           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal);
>+    
>+    Structure* newStructure = instruction[6].u.structure.get();
>+    StructureChain* chain = instruction[7].u.structureChain.get();
>+    ASSERT(newStructure);
>+    ASSERT(chain);
>+    
>+    size_t offset = newStructure->get(*profiledBlock->globalData(), ident);
>+    if (offset == notFound)
>+        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+    
>+    return PutByIdStatus(SimpleTransition, structure, newStructure, chain, offset);
>+#else
>+    return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+#endif
>+}
>+
> PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
> {
>     UNUSED_PARAM(profiledBlock);
>     UNUSED_PARAM(bytecodeIndex);
>     UNUSED_PARAM(ident);
> #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
>+    if (!profiledBlock->numberOfStructureStubInfos())
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>+    
>     if (profiledBlock->likelyToTakeSlowCase(bytecodeIndex))
>         return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
>     
>     StructureStubInfo& stubInfo = profiledBlock->getStubInfo(bytecodeIndex);
>     if (!stubInfo.seen)
>-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>     
>     switch (stubInfo.accessType) {
>     case access_unset:
>-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
>+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
>         
>     case access_put_by_id_replace: {
>         size_t offset = stubInfo.u.putByIdReplace.baseObjectStructure->get(
>Index: Source/JavaScriptCore/bytecode/PutByIdStatus.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/PutByIdStatus.h	(revision 106153)
>+++ Source/JavaScriptCore/bytecode/PutByIdStatus.h	(working copy)
>@@ -93,6 +93,8 @@ public:
>     size_t offset() const { return m_offset; }
>     
> private:
>+    static PutByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, Identifier&);
>+    
>     State m_state;
>     Structure* m_oldStructure;
>     Structure* m_newStructure;
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 106153)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -33,6 +33,7 @@
> #include "BatchedTransitionOptimizer.h"
> #include "JSFunction.h"
> #include "Interpreter.h"
>+#include "LowLevelInterpreter.h"
> #include "ScopeChain.h"
> #include "StrongInlines.h"
> #include "UString.h"
>@@ -116,26 +117,16 @@ namespace JSC {
>     expected by the callee.
> */
> 
>-#ifndef NDEBUG
> static bool s_dumpsGeneratedCode = false;
>-#endif
> 
> void BytecodeGenerator::setDumpsGeneratedCode(bool dumpsGeneratedCode)
> {
>-#ifndef NDEBUG
>     s_dumpsGeneratedCode = dumpsGeneratedCode;
>-#else
>-    UNUSED_PARAM(dumpsGeneratedCode);
>-#endif
> }
> 
> bool BytecodeGenerator::dumpsGeneratedCode()
> {
>-#ifndef NDEBUG
>     return s_dumpsGeneratedCode;
>-#else
>-    return false;
>-#endif
> }
> 
> JSObject* BytecodeGenerator::generate()
>@@ -148,10 +139,8 @@ JSObject* BytecodeGenerator::generate()
> 
>     m_codeBlock->setInstructionCount(m_codeBlock->instructions().size());
> 
>-#ifndef NDEBUG
>     if (s_dumpsGeneratedCode)
>         m_codeBlock->dump(m_scopeChain->globalObject->globalExec());
>-#endif
> 
>     if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
>         symbolTable().clear();
>@@ -1276,9 +1265,7 @@ RegisterID* BytecodeGenerator::emitResol
> #if ENABLE(JIT)
>         m_codeBlock->addGlobalResolveInfo(instructions().size());
> #endif
>-#if ENABLE(INTERPRETER)
>         m_codeBlock->addGlobalResolveInstruction(instructions().size());
>-#endif
>         ValueProfile* profile = emitProfiledOpcode(requiresDynamicChecks ? op_resolve_global_dynamic : op_resolve_global);
>         instructions().append(dst->index());
>         instructions().append(addConstant(property));
>@@ -1440,9 +1427,7 @@ RegisterID* BytecodeGenerator::emitResol
> #if ENABLE(JIT)
>     m_codeBlock->addGlobalResolveInfo(instructions().size());
> #endif
>-#if ENABLE(INTERPRETER)
>     m_codeBlock->addGlobalResolveInstruction(instructions().size());
>-#endif
>     ValueProfile* profile = emitProfiledOpcode(requiresDynamicChecks ? op_resolve_global_dynamic : op_resolve_global);
>     instructions().append(propDst->index());
>     instructions().append(addConstant(property));
>@@ -1490,9 +1475,7 @@ RegisterID* BytecodeGenerator::emitResol
> #if ENABLE(JIT)
>     m_codeBlock->addGlobalResolveInfo(instructions().size());
> #endif
>-#if ENABLE(INTERPRETER)
>     m_codeBlock->addGlobalResolveInstruction(instructions().size());
>-#endif
>     ValueProfile* profile = emitProfiledOpcode(requiresDynamicChecks ? op_resolve_global_dynamic : op_resolve_global);
>     instructions().append(propDst->index());
>     instructions().append(addConstant(property));
>@@ -1511,9 +1494,7 @@ void BytecodeGenerator::emitMethodCheck(
> 
> RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
> {
>-#if ENABLE(INTERPRETER)
>     m_codeBlock->addPropertyAccessInstruction(instructions().size());
>-#endif
> 
>     ValueProfile* profile = emitProfiledOpcode(op_get_by_id);
>     instructions().append(dst->index());
>@@ -1539,9 +1520,7 @@ RegisterID* BytecodeGenerator::emitGetAr
> 
> RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, const Identifier& property, RegisterID* value)
> {
>-#if ENABLE(INTERPRETER)
>     m_codeBlock->addPropertyAccessInstruction(instructions().size());
>-#endif
> 
>     emitOpcode(op_put_by_id);
>     instructions().append(base->index());
>@@ -1557,9 +1536,7 @@ RegisterID* BytecodeGenerator::emitPutBy
> 
> RegisterID* BytecodeGenerator::emitDirectPutById(RegisterID* base, const Identifier& property, RegisterID* value)
> {
>-#if ENABLE(INTERPRETER)
>     m_codeBlock->addPropertyAccessInstruction(instructions().size());
>-#endif
>     
>     emitOpcode(op_put_by_id);
>     instructions().append(base->index());
>@@ -1848,7 +1825,11 @@ RegisterID* BytecodeGenerator::emitCall(
>     instructions().append(func->index()); // func
>     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
>     instructions().append(callArguments.registerOffset()); // registerOffset
>+#if ENABLE(LLINT)
>+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
>+#else
>     instructions().append(0);
>+#endif
>     instructions().append(0);
>     if (dst != ignoredResult()) {
>         ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
>@@ -1952,7 +1933,11 @@ RegisterID* BytecodeGenerator::emitConst
>     instructions().append(func->index()); // func
>     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
>     instructions().append(callArguments.registerOffset()); // registerOffset
>+#if ENABLE(LLINT)
>+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
>+#else
>     instructions().append(0);
>+#endif
>     instructions().append(0);
>     if (dst != ignoredResult()) {
>         ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
>@@ -2213,7 +2198,11 @@ RegisterID* BytecodeGenerator::emitCatch
> {
>     m_usesExceptions = true;
> #if ENABLE(JIT)
>+#if ENABLE(LLINT)
>+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel(bitwise_cast<void*>(&llint_op_catch)) };
>+#else
>     HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
>+#endif
> #else
>     HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
> #endif
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 106153)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -604,9 +604,7 @@ private:
>     {
>         UNUSED_PARAM(nodeIndex);
>         
>-        ValueProfile* profile = m_inlineStackTop->m_profiledBlock->valueProfileForBytecodeOffset(bytecodeIndex);
>-        ASSERT(profile);
>-        PredictedType prediction = profile->computeUpdatedPrediction();
>+        PredictedType prediction = m_inlineStackTop->m_profiledBlock->valueProfilePredictionForBytecodeOffset(bytecodeIndex);
> #if DFG_ENABLE(DEBUG_VERBOSE)
>         printf("Dynamic [@%u, bc#%u] prediction: %s\n", nodeIndex, bytecodeIndex, predictionToString(prediction));
> #endif
>@@ -1041,6 +1039,9 @@ bool ByteCodeParser::handleInlining(bool
>     
>     // If we get here then it looks like we should definitely inline this code. Proceed
>     // with parsing the code to get bytecode, so that we can then parse the bytecode.
>+    // Note that if LLInt is enabled, the bytecode will always be available. Also note
>+    // that if LLInt is enabled, we may inline a code block that has never been JITted
>+    // before!
>     CodeBlock* codeBlock = m_codeBlockCache.get(CodeBlockKey(executable, kind), expectedFunction->scope());
>     if (!codeBlock)
>         return false;
>@@ -1741,7 +1742,7 @@ bool ByteCodeParser::parseBlock(unsigned
>                 m_inlineStackTop->m_profiledBlock, m_currentIndex);
>             
>             if (methodCallStatus.isSet()
>-                && !getByIdStatus.isSet()
>+                && !getByIdStatus.wasSeenInJIT()
>                 && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)) {
>                 // It's monomorphic as far as we can tell, since the method_check was linked
>                 // but the slow path (i.e. the normal get_by_id) never fired.
>@@ -1810,7 +1811,9 @@ bool ByteCodeParser::parseBlock(unsigned
> 
>             NEXT_OPCODE(op_get_by_id);
>         }
>-        case op_put_by_id: {
>+        case op_put_by_id:
>+        case op_put_by_id_transition_direct:
>+        case op_put_by_id_transition_normal: {
>             NodeIndex value = get(currentInstruction[3].u.operand);
>             NodeIndex base = get(currentInstruction[1].u.operand);
>             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.h	(revision 106153)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.h	(working copy)
>@@ -111,6 +111,8 @@ inline bool canCompileOpcode(OpcodeID op
>     case op_put_scoped_var:
>     case op_get_by_id:
>     case op_put_by_id:
>+    case op_put_by_id_transition_direct:
>+    case op_put_by_id_transition_normal:
>     case op_get_global_var:
>     case op_put_global_var:
>     case op_jmp:
>Index: Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp	(revision 106153)
>+++ Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp	(working copy)
>@@ -48,6 +48,21 @@ void compileOSRExit(ExecState* exec)
>     uint32_t exitIndex = globalData->osrExitIndex;
>     OSRExit& exit = codeBlock->osrExit(exitIndex);
>     
>+    // Make sure all code on our inline stack is JIT compiled. This is necessary since
>+    // we may opt to inline a code block even before it had ever been compiled by the
>+    // JIT, but our OSR exit infrastructure currently only works if the target of the
>+    // OSR exit is JIT code. This could be changed since there is nothing particularly
>+    // hard about doing an OSR exit into the interpreter, but for now this seems to make
>+    // sense in that if we're OSR exiting from inlined code of a DFG code block, then
>+    // probably it's a good sign that the thing we're exiting into is hot. Even more
>+    // interestingly, since the code was inlined, it may never otherwise get JIT
>+    // compiled since the act of inlining it may ensure that it otherwise never runs.
>+    for (CodeOrigin codeOrigin = exit.m_codeOrigin; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
>+        static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
>+            ->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
>+            ->jitCompile(*globalData);
>+    }
>+    
>     SpeculationRecovery* recovery = 0;
>     if (exit.m_recoveryIndex)
>         recovery = &codeBlock->speculationRecovery(exit.m_recoveryIndex - 1);
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 106153)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -31,6 +31,7 @@
> #include "CodeBlock.h"
> #include "DFGOSRExit.h"
> #include "DFGRepatch.h"
>+#include "HostCallReturnValue.h"
> #include "GetterSetter.h"
> #include "InlineASM.h"
> #include "Interpreter.h"
>@@ -673,50 +674,6 @@ size_t DFG_OPERATION operationCompareStr
>     return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
> }
> 
>-EncodedJSValue DFG_OPERATION getHostCallReturnValue();
>-EncodedJSValue DFG_OPERATION getHostCallReturnValueWithExecState(ExecState*);
>-
>-#if CPU(X86_64)
>-asm (
>-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>-HIDE_SYMBOL(getHostCallReturnValue) "\n"
>-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>-    "mov -40(%r13), %r13\n"
>-    "mov %r13, %rdi\n"
>-    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>-);
>-#elif CPU(X86)
>-asm (
>-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>-HIDE_SYMBOL(getHostCallReturnValue) "\n"
>-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>-    "mov -40(%edi), %edi\n"
>-    "mov %edi, 4(%esp)\n"
>-    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>-);
>-#elif CPU(ARM_THUMB2)
>-asm (
>-".text" "\n"
>-".align 2" "\n"
>-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>-HIDE_SYMBOL(getHostCallReturnValue) "\n"
>-".thumb" "\n"
>-".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
>-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>-    "ldr r5, [r5, #-40]" "\n"
>-    "cpy r0, r5" "\n"
>-    "b " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>-);
>-#endif
>-
>-EncodedJSValue DFG_OPERATION getHostCallReturnValueWithExecState(ExecState* exec)
>-{
>-    JSGlobalData* globalData = &exec->globalData();
>-    NativeCallFrameTracer tracer(globalData, exec);
>-    
>-    return JSValue::encode(exec->globalData().hostCallReturnValue);
>-}
>-
> static void* handleHostCall(ExecState* execCallee, JSValue callee, CodeSpecializationKind kind)
> {
>     ExecState* exec = execCallee->callerFrame();
>Index: Source/JavaScriptCore/heap/Heap.cpp
>===================================================================
>--- Source/JavaScriptCore/heap/Heap.cpp	(revision 106153)
>+++ Source/JavaScriptCore/heap/Heap.cpp	(working copy)
>@@ -837,7 +837,7 @@ void Heap::collect(SweepToggle sweepTogg
>         setHighWaterMark(max(proportionalBytes, m_minBytesPerCycle));
>     }
>     JAVASCRIPTCORE_GC_END();
>-
>+    
>     (*m_activityCallback)();
> }
> 
>Index: Source/JavaScriptCore/heap/Heap.h
>===================================================================
>--- Source/JavaScriptCore/heap/Heap.h	(revision 106153)
>+++ Source/JavaScriptCore/heap/Heap.h	(working copy)
>@@ -49,6 +49,7 @@ namespace JSC {
>     class JSGlobalData;
>     class JSValue;
>     class LiveObjectIterator;
>+    class LLIntOffsetsExtractor;
>     class MarkedArgumentBuffer;
>     class RegisterFile;
>     class UString;
>@@ -135,11 +136,12 @@ namespace JSC {
>         void getConservativeRegisterRoots(HashSet<JSCell*>& roots);
> 
>     private:
>+        friend class CodeBlock;
>+        friend class LLIntOffsetsExtractor;
>         friend class MarkedSpace;
>         friend class MarkedBlock;
>         friend class BumpSpace;
>         friend class SlotVisitor;
>-        friend class CodeBlock;
> 
>         size_t waterMark();
>         size_t highWaterMark();
>Index: Source/JavaScriptCore/heap/MarkStack.cpp
>===================================================================
>--- Source/JavaScriptCore/heap/MarkStack.cpp	(revision 106153)
>+++ Source/JavaScriptCore/heap/MarkStack.cpp	(working copy)
>@@ -304,7 +304,7 @@ ALWAYS_INLINE static void visitChildren(
> #endif
> 
>     ASSERT(Heap::isMarked(cell));
>-
>+    
>     if (isJSString(cell)) {
>         JSString::visitChildren(const_cast<JSCell*>(cell), visitor);
>         return;
>Index: Source/JavaScriptCore/heap/MarkedSpace.h
>===================================================================
>--- Source/JavaScriptCore/heap/MarkedSpace.h	(revision 106153)
>+++ Source/JavaScriptCore/heap/MarkedSpace.h	(working copy)
>@@ -40,6 +40,7 @@ namespace JSC {
> class Heap;
> class JSCell;
> class LiveObjectIterator;
>+class LLIntOffsetsExtractor;
> class WeakGCHandle;
> class SlotVisitor;
> 
>@@ -87,6 +88,8 @@ public:
>     void freeBlocks(MarkedBlock* head);
> 
> private:
>+    friend class LLIntOffsetsExtractor;
>+    
>     void* allocateSlowCase(SizeClass&);
>     void* tryAllocateHelper(MarkedSpace::SizeClass&);
>     void* tryAllocate(MarkedSpace::SizeClass&);
>Index: Source/JavaScriptCore/interpreter/CallFrame.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/CallFrame.h	(revision 106153)
>+++ Source/JavaScriptCore/interpreter/CallFrame.h	(working copy)
>@@ -122,6 +122,9 @@ namespace JSC  {
> #if ENABLE(INTERPRETER)
>         Instruction* returnVPC() const { return this[RegisterFile::ReturnPC].vPC(); }
> #endif
>+#if ENABLE(LLINT)
>+        Instruction* currentVPC() const { return bitwise_cast<Instruction*>(this[RegisterFile::ArgumentCount].tag()); }
>+#endif
> 
>         void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
>         void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
>Index: Source/JavaScriptCore/interpreter/Interpreter.cpp
>===================================================================
>--- Source/JavaScriptCore/interpreter/Interpreter.cpp	(revision 106153)
>+++ Source/JavaScriptCore/interpreter/Interpreter.cpp	(working copy)
>@@ -69,7 +69,7 @@
> #include "JIT.h"
> #endif
> 
>-#define WTF_USE_GCC_COMPUTED_GOTO_WORKAROUND (ENABLE(COMPUTED_GOTO_INTERPRETER) && !defined(__llvm__))
>+#define WTF_USE_GCC_COMPUTED_GOTO_WORKAROUND ((ENABLE(COMPUTED_GOTO_INTERPRETER) || ENABLE(LLINT)) && !defined(__llvm__))
> 
> using namespace std;
> 
>@@ -547,17 +547,43 @@ Interpreter::Interpreter()
> {
> }
> 
>-void Interpreter::initialize(bool canUseJIT)
>+Interpreter::~Interpreter()
> {
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(LLINT)
>+    if (m_enabled)
>+        delete[] m_opcodeTable;
>+#endif
>+}
>+
>+void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
>+{
>+    UNUSED_PARAM(llintData);
>+    UNUSED_PARAM(canUseJIT);
>+#if ENABLE(COMPUTED_GOTO_INTERPRETER) || ENABLE(LLINT)
>+#if !ENABLE(COMPUTED_GOTO_INTERPRETER)
>+    // Having LLInt enabled, but not being able to use the JIT, and not having
>+    // a computed goto interpreter, is not supported. Not because we cannot
>+    // support it, but because I decided to draw the line at the number of
>+    // permutations of execution engines that I wanted this code to grok.
>+    ASSERT(canUseJIT);
>+#endif
>     if (canUseJIT) {
>+#if ENABLE(LLINT)
>+        m_opcodeTable = llintData->opcodeMap();
>+        for (int i = 0; i < numOpcodeIDs; ++i)
>+            m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
>+#else
>         // If the JIT is present, don't use jump destinations for opcodes.
>         
>         for (int i = 0; i < numOpcodeIDs; ++i) {
>             Opcode opcode = bitwise_cast<void*>(static_cast<uintptr_t>(i));
>             m_opcodeTable[i] = opcode;
>         }
>+#endif
>     } else {
>+#if ENABLE(LLINT)
>+        m_opcodeTable = new Opcode[numOpcodeIDs];
>+#endif
>         privateExecute(InitializeAndReturn, 0, 0);
>         
>         for (int i = 0; i < numOpcodeIDs; ++i)
>@@ -566,7 +592,6 @@ void Interpreter::initialize(bool canUse
>         m_enabled = true;
>     }
> #else
>-    UNUSED_PARAM(canUseJIT);
> #if ENABLE(INTERPRETER)
>     m_enabled = true;
> #else
>@@ -667,9 +692,11 @@ void Interpreter::dumpRegisters(CallFram
> 
> bool Interpreter::isOpcode(Opcode opcode)
> {
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(COMPUTED_GOTO_INTERPRETER) || ENABLE(LLINT)
>+#if !ENABLE(LLINT)
>     if (!m_enabled)
>         return opcode >= 0 && static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode)) <= op_end;
>+#endif
>     return opcode != HashTraits<Opcode>::emptyValue()
>         && !HashTraits<Opcode>::isDeletedValue(opcode)
>         && m_opcodeIDTable.contains(opcode);
>@@ -726,11 +753,11 @@ NEVER_INLINE bool Interpreter::unwindCal
>     // have to subtract 1.
> #if ENABLE(JIT) && ENABLE(INTERPRETER)
>     if (callerFrame->globalData().canUseJIT())
>-        bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnPC());
>+        bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
>     else
>         bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
> #elif ENABLE(JIT)
>-    bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnPC());
>+    bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
> #else
>     bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
> #endif
>@@ -5170,10 +5197,10 @@ void Interpreter::retrieveLastCaller(Cal
>         bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnVPC());
> #if ENABLE(JIT)
>     else
>-        bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnPC());
>+        bytecodeOffset = callerCodeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
> #endif
> #else
>-    bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnPC());
>+    bytecodeOffset = callerCodeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
> #endif
>     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
>     sourceID = callerCodeBlock->ownerExecutable()->sourceID();
>Index: Source/JavaScriptCore/interpreter/Interpreter.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/Interpreter.h	(revision 106153)
>+++ Source/JavaScriptCore/interpreter/Interpreter.h	(working copy)
>@@ -33,6 +33,7 @@
> #include "JSCell.h"
> #include "JSValue.h"
> #include "JSObject.h"
>+#include "LLIntData.h"
> #include "Opcode.h"
> #include "RegisterFile.h"
> 
>@@ -45,6 +46,7 @@ namespace JSC {
>     class FunctionExecutable;
>     class JSFunction;
>     class JSGlobalObject;
>+    class LLIntOffsetsExtractor;
>     class ProgramExecutable;
>     class Register;
>     class ScopeChainNode;
>@@ -100,19 +102,21 @@ namespace JSC {
> 
>     class Interpreter {
>         WTF_MAKE_FAST_ALLOCATED;
>-        friend class JIT;
>         friend class CachedCall;
>+        friend class LLIntOffsetsExtractor;
>+        friend class JIT;
>     public:
>         Interpreter();
>+        ~Interpreter();
>         
>-        void initialize(bool canUseJIT);
>+        void initialize(LLInt::Data*, bool canUseJIT);
> 
>         RegisterFile& registerFile() { return m_registerFile; }
>         
>         Opcode getOpcode(OpcodeID id)
>         {
>             ASSERT(m_initialized);
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(COMPUTED_GOTO_INTERPRETER) || ENABLE(LLINT)
>             return m_opcodeTable[id];
> #else
>             return id;
>@@ -122,7 +126,10 @@ namespace JSC {
>         OpcodeID getOpcodeID(Opcode opcode)
>         {
>             ASSERT(m_initialized);
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(LLINT)
>+            ASSERT(isOpcode(opcode));
>+            return m_opcodeIDTable.get(opcode);
>+#elif ENABLE(COMPUTED_GOTO_INTERPRETER)
>             ASSERT(isOpcode(opcode));
>             if (!m_enabled)
>                 return static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode));
>@@ -132,6 +139,11 @@ namespace JSC {
>             return opcode;
> #endif
>         }
>+        
>+        bool enabled()
>+        {
>+            return m_enabled;
>+        }
> 
>         bool isOpcode(Opcode);
> 
>@@ -199,7 +211,10 @@ namespace JSC {
> 
>         RegisterFile m_registerFile;
>         
>-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
>+#if ENABLE(LLINT)
>+        Opcode* m_opcodeTable; // Maps OpcodeID => Opcode for compiling
>+        HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
>+#elif ENABLE(COMPUTED_GOTO_INTERPRETER)
>         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling
>         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
> #endif
>Index: Source/JavaScriptCore/interpreter/RegisterFile.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/RegisterFile.h	(revision 106153)
>+++ Source/JavaScriptCore/interpreter/RegisterFile.h	(working copy)
>@@ -39,6 +39,7 @@ namespace JSC {
> 
>     class ConservativeRoots;
>     class DFGCodeBlocks;
>+    class LLIntOffsetsExtractor;
> 
>     class RegisterFile {
>         WTF_MAKE_NONCOPYABLE(RegisterFile);
>@@ -81,6 +82,8 @@ namespace JSC {
>         }
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         bool growSlowCase(Register*);
>         void releaseExcessCapacity();
>         void addToCommittedByteCount(long);
>Index: Source/JavaScriptCore/jit/HostCallReturnValue.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/HostCallReturnValue.cpp	(revision 0)
>+++ Source/JavaScriptCore/jit/HostCallReturnValue.cpp	(revision 0)
>@@ -0,0 +1,82 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "HostCallReturnValue.h"
>+
>+#if COMPILER(GCC)
>+
>+#include "CallFrame.h"
>+#include "InlineASM.h"
>+#include "JSObject.h"
>+#include "JSValueInlineMethods.h"
>+#include "ScopeChain.h"
>+
>+namespace JSC {
>+
>+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState*);
>+
>+#if CPU(X86_64)
>+asm (
>+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>+HIDE_SYMBOL(getHostCallReturnValue) "\n"
>+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>+    "mov -40(%r13), %r13\n"
>+    "mov %r13, %rdi\n"
>+    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>+);
>+#elif CPU(X86)
>+asm (
>+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>+HIDE_SYMBOL(getHostCallReturnValue) "\n"
>+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>+    "mov -40(%edi), %edi\n"
>+    "mov %edi, 4(%esp)\n"
>+    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>+);
>+#elif CPU(ARM_THUMB2)
>+asm (
>+".text" "\n"
>+".align 2" "\n"
>+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
>+HIDE_SYMBOL(getHostCallReturnValue) "\n"
>+".thumb" "\n"
>+".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
>+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
>+    "ldr r5, [r5, #-40]" "\n"
>+    "cpy r0, r5" "\n"
>+    "b " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
>+);
>+#endif
>+
>+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState* exec)
>+{
>+    return JSValue::encode(exec->globalData().hostCallReturnValue);
>+}
>+
>+} // namespace JSC
>+
>+#endif // COMPILER(GCC)
>+
>Index: Source/JavaScriptCore/jit/HostCallReturnValue.h
>===================================================================
>--- Source/JavaScriptCore/jit/HostCallReturnValue.h	(revision 0)
>+++ Source/JavaScriptCore/jit/HostCallReturnValue.h	(revision 0)
>@@ -0,0 +1,51 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef HostCallReturnValue_h
>+#define HostCallReturnValue_h
>+
>+#include "JSValue.h"
>+#include "MacroAssemblerCodeRef.h"
>+#include <wtf/Platform.h>
>+
>+// Unfortunately this only works on GCC-like compilers. And it's currently only used
>+// by LLInt and DFG, which also are restricted to GCC-like compilers. We should
>+// probably fix that at some point.
>+#if COMPILER(GCC)
>+
>+#if CALLING_CONVENTION_IS_STDCALL
>+#define HOST_CALL_RETURN_VALUE_OPTION CDECL
>+#else
>+#define HOST_CALL_RETURN_VALUE_OPTION
>+#endif
>+
>+namespace JSC {
>+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValue();
>+}
>+
>+#endif // COMPILER(GCC)
>+
>+#endif // HostCallReturnValue_h
>+
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 106153)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -325,6 +325,8 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_will_call)
>         DEFINE_OP(op_push_new_scope)
>         DEFINE_OP(op_push_scope)
>+        case op_put_by_id_transition_direct:
>+        case op_put_by_id_transition_normal:
>         DEFINE_OP(op_put_by_id)
>         DEFINE_OP(op_put_by_index)
>         DEFINE_OP(op_put_by_val)
>@@ -487,6 +489,8 @@ void JIT::privateCompileSlowCases()
>         DEFINE_SLOWCASE_OP(op_post_inc)
>         DEFINE_SLOWCASE_OP(op_pre_dec)
>         DEFINE_SLOWCASE_OP(op_pre_inc)
>+        case op_put_by_id_transition_direct:
>+        case op_put_by_id_transition_normal:
>         DEFINE_SLOWCASE_OP(op_put_by_id)
>         DEFINE_SLOWCASE_OP(op_put_by_val)
>         DEFINE_SLOWCASE_OP(op_resolve_global)
>@@ -526,6 +530,10 @@ void JIT::privateCompileSlowCases()
> 
> JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
> {
>+#if ENABLE(JIT_VERBOSE_OSR)
>+    printf("Compiling JIT code!\n");
>+#endif
>+    
> #if ENABLE(VALUE_PROFILER)
>     m_canBeOptimized = m_codeBlock->canCompileWithDFG();
> #endif
>@@ -690,8 +698,12 @@ JITCode JIT::privateCompile(CodePtr* fun
>         info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
>     }
> 
>-#if ENABLE(DFG_JIT)
>-    if (m_canBeOptimized) {
>+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
>+    if (m_canBeOptimized
>+#if ENABLE(LLINT)
>+        || true
>+#endif
>+        ) {
>         CompactJITCodeMap::Encoder jitCodeMapEncoder;
>         for (unsigned bytecodeOffset = 0; bytecodeOffset < m_labels.size(); ++bytecodeOffset) {
>             if (m_labels[bytecodeOffset].isSet())
>Index: Source/JavaScriptCore/jit/JITCode.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITCode.h	(revision 106153)
>+++ Source/JavaScriptCore/jit/JITCode.h	(working copy)
>@@ -48,7 +48,7 @@ namespace JSC {
>         JITCode() { }
> #endif
>     public:
>-        enum JITType { HostCallThunk, BaselineJIT, DFGJIT };
>+        enum JITType { None, HostCallThunk, InterpreterThunk, BaselineJIT, DFGJIT };
>         
>         static JITType bottomTierJIT()
>         {
>@@ -66,8 +66,19 @@ namespace JSC {
>             return DFGJIT;
>         }
>         
>+        static bool isOptimizingJIT(JITType jitType)
>+        {
>+            return jitType == DFGJIT;
>+        }
>+        
>+        static bool isBaselineCode(JITType jitType)
>+        {
>+            return jitType == InterpreterThunk || jitType == BaselineJIT;
>+        }
>+        
> #if ENABLE(JIT)
>         JITCode()
>+            : m_jitType(None)
>         {
>         }
> 
>@@ -75,6 +86,7 @@ namespace JSC {
>             : m_ref(ref)
>             , m_jitType(jitType)
>         {
>+            ASSERT(jitType != None);
>         }
>         
>         bool operator !() const
>Index: Source/JavaScriptCore/jit/JITDriver.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITDriver.h	(revision 106153)
>+++ Source/JavaScriptCore/jit/JITDriver.h	(working copy)
>@@ -33,15 +33,21 @@
> #include "BytecodeGenerator.h"
> #include "DFGDriver.h"
> #include "JIT.h"
>+#include "LLIntEntrypoints.h"
> 
> namespace JSC {
> 
> template<typename CodeBlockType>
> inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType)
> {
>+    if (jitType == codeBlock->getJITType())
>+        return true;
>+    
>     if (!globalData.canUseJIT())
>         return true;
>     
>+    codeBlock->unlinkIncomingCalls();
>+    
>     bool dfgCompiled = false;
>     if (jitType == JITCode::DFGJIT)
>         dfgCompiled = DFG::tryCompile(globalData, codeBlock.get(), jitCode);
>@@ -55,10 +61,7 @@ inline bool jitCompileIfAppropriate(JSGl
>         }
>         jitCode = JIT::compile(&globalData, codeBlock.get());
>     }
>-#if !ENABLE(OPCODE_SAMPLING)
>-    if (!BytecodeGenerator::dumpsGeneratedCode())
>-        codeBlock->handleBytecodeDiscardingOpportunity();
>-#endif
>+    codeBlock->handleBytecodeDiscardingOpportunity();
>     codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr());
>     
>     return true;
>@@ -66,9 +69,14 @@ inline bool jitCompileIfAppropriate(JSGl
> 
> inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType)
> {
>+    if (jitType == codeBlock->getJITType())
>+        return true;
>+    
>     if (!globalData.canUseJIT())
>         return true;
>     
>+    codeBlock->unlinkIncomingCalls();
>+    
>     bool dfgCompiled = false;
>     if (jitType == JITCode::DFGJIT)
>         dfgCompiled = DFG::tryCompileFunction(globalData, codeBlock.get(), jitCode, jitCodeWithArityCheck);
>@@ -83,11 +91,7 @@ inline bool jitCompileFunctionIfAppropri
>         }
>         jitCode = JIT::compile(&globalData, codeBlock.get(), &jitCodeWithArityCheck);
>     }
>-#if !ENABLE(OPCODE_SAMPLING)
>-    if (!BytecodeGenerator::dumpsGeneratedCode())
>-        codeBlock->handleBytecodeDiscardingOpportunity();
>-#endif
>-    
>+    codeBlock->handleBytecodeDiscardingOpportunity();
>     codeBlock->setJITCode(jitCode, jitCodeWithArityCheck);
>     
>     return true;
>Index: Source/JavaScriptCore/jit/JITExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITExceptions.cpp	(revision 106153)
>+++ Source/JavaScriptCore/jit/JITExceptions.cpp	(working copy)
>@@ -64,7 +64,7 @@ ExceptionHandler genericThrow(JSGlobalDa
> 
> ExceptionHandler jitThrow(JSGlobalData* globalData, ExecState* callFrame, JSValue exceptionValue, ReturnAddressPtr faultLocation)
> {
>-    return genericThrow(globalData, callFrame, exceptionValue, callFrame->codeBlock()->bytecodeOffset(faultLocation));
>+    return genericThrow(globalData, callFrame, exceptionValue, callFrame->codeBlock()->bytecodeOffset(callFrame, faultLocation));
> }
> 
> }
>Index: Source/JavaScriptCore/jit/JITStubs.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITStubs.cpp	(revision 106153)
>+++ Source/JavaScriptCore/jit/JITStubs.cpp	(working copy)
>@@ -1928,7 +1928,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from
>     unsigned bytecodeIndex = stackFrame.args[0].int32();
> 
> #if ENABLE(JIT_VERBOSE_OSR)
>-    printf("Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
>+    printf("%p: Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
> #endif
> 
>     if (codeBlock->hasOptimizedReplacement()) {
>@@ -2183,45 +2183,13 @@ DEFINE_STUB_FUNCTION(void*, op_construct
>     return result;
> }
> 
>-inline CallFrame* arityCheckFor(CallFrame* callFrame, RegisterFile* registerFile, CodeSpecializationKind kind)
>-{
>-    JSFunction* callee = asFunction(callFrame->callee());
>-    ASSERT(!callee->isHostFunction());
>-    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecodeFor(kind);
>-    int argumentCountIncludingThis = callFrame->argumentCountIncludingThis();
>-
>-    // This ensures enough space for the worst case scenario of zero arguments passed by the caller.
>-    if (!registerFile->grow(callFrame->registers() + newCodeBlock->numParameters() + newCodeBlock->m_numCalleeRegisters))
>-        return 0;
>-
>-    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
>-
>-    // Too few arguments -- copy call frame and arguments, then fill in missing arguments with undefined.
>-    size_t delta = newCodeBlock->numParameters() - argumentCountIncludingThis;
>-    Register* src = callFrame->registers();
>-    Register* dst = callFrame->registers() + delta;
>-
>-    int i;
>-    int end = -CallFrame::offsetFor(argumentCountIncludingThis);
>-    for (i = -1; i >= end; --i)
>-        dst[i] = src[i];
>-
>-    end -= delta;
>-    for ( ; i >= end; --i)
>-        dst[i] = jsUndefined();
>-
>-    CallFrame* newCallFrame = CallFrame::create(dst);
>-    ASSERT((void*)newCallFrame <= registerFile->end());
>-    return newCallFrame;
>-}
>-
> DEFINE_STUB_FUNCTION(void*, op_call_arityCheck)
> {
>     STUB_INIT_STACK_FRAME(stackFrame);
> 
>     CallFrame* callFrame = stackFrame.callFrame;
> 
>-    CallFrame* newCallFrame = arityCheckFor(callFrame, stackFrame.registerFile, CodeForCall);
>+    CallFrame* newCallFrame = CommonSlowPaths::arityCheckFor(callFrame, stackFrame.registerFile, CodeForCall);
>     if (!newCallFrame)
>         return throwExceptionFromOpCall<void*>(stackFrame, callFrame, STUB_RETURN_ADDRESS, createStackOverflowError(callFrame->callerFrame()));
> 
>@@ -2234,7 +2202,7 @@ DEFINE_STUB_FUNCTION(void*, op_construct
> 
>     CallFrame* callFrame = stackFrame.callFrame;
> 
>-    CallFrame* newCallFrame = arityCheckFor(callFrame, stackFrame.registerFile, CodeForConstruct);
>+    CallFrame* newCallFrame = CommonSlowPaths::arityCheckFor(callFrame, stackFrame.registerFile, CodeForConstruct);
>     if (!newCallFrame)
>         return throwExceptionFromOpCall<void*>(stackFrame, callFrame, STUB_RETURN_ADDRESS, createStackOverflowError(callFrame->callerFrame()));
> 
>Index: Source/JavaScriptCore/jit/JSInterfaceJIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JSInterfaceJIT.h	(revision 106153)
>+++ Source/JavaScriptCore/jit/JSInterfaceJIT.h	(working copy)
>@@ -26,8 +26,10 @@
> #ifndef JSInterfaceJIT_h
> #define JSInterfaceJIT_h
> 
>+#include "BytecodeConventions.h"
> #include "JITCode.h"
> #include "JITStubs.h"
>+#include "JSString.h"
> #include "JSValue.h"
> #include "MacroAssembler.h"
> #include "RegisterFile.h"
>Index: Source/JavaScriptCore/llint/LLIntCommon.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntCommon.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntCommon.h	(revision 0)
>@@ -0,0 +1,33 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntCommon_h
>+#define LLIntCommon_h
>+
>+#define LLINT_EXECUTION_TRACING 0
>+#define LLINT_HELPER_TRACING 0
>+
>+#endif // LLIntCommon_h
>+
>Index: Source/JavaScriptCore/llint/LLIntData.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntData.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntData.cpp	(revision 0)
>@@ -0,0 +1,56 @@
>+/*
>+ * Copyright (C) 2011 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LLIntData.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "Instruction.h"
>+#include "LowLevelInterpreter.h"
>+#include "Opcode.h"
>+
>+namespace JSC { namespace LLInt {
>+
>+Data::Data()
>+    : m_exceptionInstructions(new Instruction[maxOpcodeLength + 1])
>+    , m_opcodeMap(new Opcode[numOpcodeIDs])
>+{
>+    for (int i = 0; i < maxOpcodeLength + 1; ++i)
>+        m_exceptionInstructions[i].u.pointer = bitwise_cast<void*>(&llint_throw_from_helper_trampoline);
>+#define OPCODE_ENTRY(opcode, length) m_opcodeMap[opcode] = bitwise_cast<void*>(&llint_##opcode);
>+    FOR_EACH_OPCODE_ID(OPCODE_ENTRY);
>+#undef OPCODE_ENTRY
>+}
>+
>+Data::~Data()
>+{
>+    delete[] m_exceptionInstructions;
>+    delete[] m_opcodeMap;
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LLIntData.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntData.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntData.h	(revision 0)
>@@ -0,0 +1,88 @@
>+/*
>+ * Copyright (C) 2011 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntData_h
>+#define LLIntData_h
>+
>+#include "Opcode.h"
>+#include <wtf/Platform.h>
>+
>+namespace JSC {
>+
>+struct Instruction;
>+
>+namespace LLInt {
>+
>+#if ENABLE(LLINT)
>+class Data {
>+public:
>+    Data();
>+    ~Data();
>+    
>+    Instruction* exceptionInstructions()
>+    {
>+        return m_exceptionInstructions;
>+    }
>+    
>+    Opcode* opcodeMap()
>+    {
>+        return m_opcodeMap;
>+    }
>+private:
>+    Instruction* m_exceptionInstructions;
>+    Opcode* m_opcodeMap;
>+};
>+#else // ENABLE(LLINT)
>+
>+#if COMPILER(CLANG)
>+#pragma clang diagnostic push
>+#pragma clang diagnostic ignored "-Wmissing-noreturn"
>+#endif
>+
>+class Data {
>+public:
>+    Instruction* exceptionInstructions()
>+    {
>+        ASSERT_NOT_REACHED();
>+        return 0;
>+    }
>+    
>+    Opcode* opcodeMap()
>+    {
>+        ASSERT_NOT_REACHED();
>+        return 0;
>+    }
>+};
>+
>+#if COMPILER(CLANG)
>+#pragma clang diagnostic pop
>+#endif
>+
>+#endif // ENABLE(LLINT)
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // LLIntData_h
>+
>Index: Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntEntrypoints.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntEntrypoints.cpp	(revision 0)
>@@ -0,0 +1,86 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LLIntEntrypoints.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "JITCode.h"
>+#include "JSGlobalData.h"
>+#include "LLIntThunks.h"
>+#include "LowLevelInterpreter.h"
>+
>+namespace JSC { namespace LLInt {
>+
>+void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind, JITCode& jitCode, MacroAssemblerCodePtr& arityCheck)
>+{
>+    if (!globalData.canUseJIT()) {
>+        if (kind == CodeForCall) {
>+            jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_prologue))));
>+            arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_arity_check));
>+            return;
>+        }
>+
>+        ASSERT(kind == CodeForConstruct);
>+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_prologue))));
>+        arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_arity_check));
>+        return;
>+    }
>+    
>+    if (kind == CodeForCall) {
>+        jitCode = JITCode(globalData.getCTIStub(functionForCallEntryThunkGenerator), JITCode::InterpreterThunk);
>+        arityCheck = globalData.getCTIStub(functionForCallArityCheckThunkGenerator).code();
>+        return;
>+    }
>+
>+    ASSERT(kind == CodeForConstruct);
>+    jitCode = JITCode(globalData.getCTIStub(functionForConstructEntryThunkGenerator), JITCode::InterpreterThunk);
>+    arityCheck = globalData.getCTIStub(functionForConstructArityCheckThunkGenerator).code();
>+}
>+
>+void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
>+{
>+    if (!globalData.canUseJIT()) {
>+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_eval_prologue))));
>+        return;
>+    }
>+    
>+    jitCode = JITCode(globalData.getCTIStub(evalEntryThunkGenerator), JITCode::InterpreterThunk);
>+}
>+
>+void getProgramEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
>+{
>+    if (!globalData.canUseJIT()) {
>+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_program_prologue))));
>+        return;
>+    }
>+    
>+    jitCode = JITCode(globalData.getCTIStub(programEntryThunkGenerator), JITCode::InterpreterThunk);
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LLIntEntrypoints.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntEntrypoints.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntEntrypoints.h	(revision 0)
>@@ -0,0 +1,64 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntEntrypoints_h
>+#define LLIntEntrypoints_h
>+
>+#include <wtf/Platform.h>
>+
>+#if ENABLE(LLINT)
>+
>+#include "CodeSpecializationKind.h"
>+
>+namespace JSC {
>+
>+class EvalCodeBlock;
>+class JITCode;
>+class JSGlobalData;
>+class MacroAssemblerCodePtr;
>+class MacroAssemblerCodeRef;
>+class ProgramCodeBlock;
>+
>+namespace LLInt {
>+
>+void getFunctionEntrypoint(JSGlobalData&, CodeSpecializationKind, JITCode&, MacroAssemblerCodePtr& arityCheck);
>+void getEvalEntrypoint(JSGlobalData&, JITCode&);
>+void getProgramEntrypoint(JSGlobalData&, JITCode&);
>+
>+inline void getEntrypoint(JSGlobalData& globalData, EvalCodeBlock*, JITCode& jitCode)
>+{
>+    getEvalEntrypoint(globalData, jitCode);
>+}
>+
>+inline void getEntrypoint(JSGlobalData& globalData, ProgramCodeBlock*, JITCode& jitCode)
>+{
>+    getProgramEntrypoint(globalData, jitCode);
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>+
>+#endif // LLIntEntrypoints_h
>Index: Source/JavaScriptCore/llint/LLIntExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntExceptions.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntExceptions.cpp	(revision 0)
>@@ -0,0 +1,80 @@
>+/*
>+ * Copyright (C) 2011 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LLIntExceptions.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "CallFrame.h"
>+#include "CodeBlock.h"
>+#include "Instruction.h"
>+#include "JITExceptions.h"
>+#include "LLIntCommon.h"
>+#include "LowLevelInterpreter.h"
>+
>+namespace JSC { namespace LLInt {
>+
>+void interpreterThrowInCaller(ExecState* exec)
>+{
>+    JSGlobalData* globalData = &exec->globalData();
>+#if LLINT_HELPER_TRACING
>+    printf("Throwing exception %s.\n", globalData->exception.description());
>+#endif
>+    genericThrow(
>+        globalData, exec->callerFrame(), globalData->exception,
>+        exec->callerFrame()->codeBlock()->bytecodeOffset(exec->callerFrame(), exec->returnPC()));
>+}
>+
>+Instruction* returnToThrowForThrownException(ExecState* exec)
>+{
>+    return exec->globalData().llintData.exceptionInstructions();
>+}
>+
>+Instruction* returnToThrow(ExecState* exec, Instruction* pc)
>+{
>+    JSGlobalData* globalData = &exec->globalData();
>+#if LLINT_HELPER_TRACING
>+    printf("Throwing exception %s (returnToThrow).\n", globalData->exception.description());
>+#endif
>+    genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
>+    
>+    return globalData->llintData.exceptionInstructions();
>+}
>+
>+void* callToThrow(ExecState* exec, Instruction* pc)
>+{
>+    JSGlobalData* globalData = &exec->globalData();
>+#if LLINT_HELPER_TRACING
>+    printf("Throwing exception %s (callToThrow).\n", globalData->exception.description());
>+#endif
>+    genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
>+    
>+    return bitwise_cast<void*>(&llint_throw_during_call_trampoline);
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LLIntExceptions.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntExceptions.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntExceptions.h	(revision 0)
>@@ -0,0 +1,64 @@
>+/*
>+ * Copyright (C) 2011 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntExceptions_h
>+#define LLIntExceptions_h
>+
>+#include <wtf/Platform.h>
>+#include <wtf/StdLibExtras.h>
>+
>+#if ENABLE(LLINT)
>+
>+namespace JSC {
>+
>+class ExecState;
>+struct Instruction;
>+
>+namespace LLInt {
>+
>+// Throw the currently active exception in the context of the caller's call frame.
>+void interpreterThrowInCaller(ExecState*);
>+
>+// Tells you where to jump to if you want to return-to-throw, after you've already
>+// set up all information needed to throw the exception.
>+Instruction* returnToThrowForThrownException(ExecState*);
>+
>+// Saves the current PC in the global data for safe-keeping, and gives you a PC
>+// that you can tell the interpreter to go to, which when advanced between 1
>+// and 9 slots will give you an "instruction" that threads to the interpreter's
>+// exception handler. Note that if you give it the PC for exception handling,
>+// it's smart enough to just return that PC without doing anything else; this
>+// lets you thread exception handling through common helper functions used by
>+// other helpers.
>+Instruction* returnToThrow(ExecState*, Instruction*);
>+
>+// Use this when you're throwing to a call thunk.
>+void* callToThrow(ExecState*, Instruction*);
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>+
>+#endif // LLIntExceptions_h
>Index: Source/JavaScriptCore/llint/LLIntHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntHelpers.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntHelpers.cpp	(revision 0)
>@@ -0,0 +1,1429 @@
>+/*
>+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LLIntHelpers.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "Arguments.h"
>+#include "CallFrame.h"
>+#include "CommonSlowPaths.h"
>+#include "HostCallReturnValue.h"
>+#include "Interpreter.h"
>+#include "JIT.h"
>+#include "JITDriver.h"
>+#include "JSActivation.h"
>+#include "JSByteArray.h"
>+#include "JSGlobalObjectFunctions.h"
>+#include "JSPropertyNameIterator.h"
>+#include "JSStaticScopeObject.h"
>+#include "JSString.h"
>+#include "JSValue.h"
>+#include "LLIntCommon.h"
>+#include "LLIntExceptions.h"
>+#include "LowLevelInterpreter.h"
>+#include "Operations.h"
>+
>+namespace JSC { namespace LLInt {
>+
>+#define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
>+#define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
>+
>+#define LLINT_RETURN_TWO(first, second) do {       \
>+        union {                                    \
>+            struct {                               \
>+                void* a;                           \
>+                void* b;                           \
>+            } pair;                                \
>+            int64_t i;                             \
>+        } __rt_u;                                  \
>+        __rt_u.pair.a = first;                     \
>+        __rt_u.pair.b = second;                    \
>+        return __rt_u.i;                           \
>+    } while (false)
>+
>+#define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, exec)
>+
>+#define LLINT_THROW(exceptionToThrow) do {                        \
>+        JSGlobalData& __t_globalData = exec->globalData();        \
>+        __t_globalData.exception = (exceptionToThrow);            \
>+        pc = returnToThrow(exec, pc);                             \
>+        LLINT_END_IMPL();                                         \
>+    } while (false)
>+
>+#define LLINT_CHECK_EXCEPTION() do {                    \
>+        if (UNLIKELY(exec->globalData().exception)) {   \
>+            pc = returnToThrow(exec, pc);               \
>+            LLINT_END_IMPL();                           \
>+        }                                               \
>+    } while (false)
>+
>+#define LLINT_END() do {                        \
>+        LLINT_CHECK_EXCEPTION();                \
>+        LLINT_END_IMPL();                       \
>+    } while (false)
>+
>+#define LLINT_BRANCH(opcode, condition) do {                      \
>+        bool __b_condition = (condition);                         \
>+        LLINT_CHECK_EXCEPTION();                                  \
>+        if (__b_condition)                                        \
>+            pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
>+        else                                                      \
>+            pc += OPCODE_LENGTH(opcode);                          \
>+        LLINT_END_IMPL();                                         \
>+    } while (false)
>+
>+#define LLINT_RETURN(value) do {                \
>+        JSValue __r_returnValue = (value);      \
>+        LLINT_CHECK_EXCEPTION();                \
>+        LLINT_OP(1) = __r_returnValue;          \
>+        LLINT_END_IMPL();                       \
>+    } while (false)
>+
>+#define LLINT_RETURN_PROFILED(opcode, value) do {               \
>+        JSValue __rp_returnValue = (value);                     \
>+        LLINT_CHECK_EXCEPTION();                                \
>+        LLINT_OP(1) = __rp_returnValue;                         \
>+        pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
>+            JSValue::encode(__rp_returnValue);                  \
>+        LLINT_END_IMPL();                                       \
>+    } while (false)
>+
>+#define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
>+
>+#define LLINT_CALL_THROW(exec, pc, exceptionToThrow) do {               \
>+        ExecState* __ct_exec = (exec);                                  \
>+        Instruction* __ct_pc = (pc);                                    \
>+        JSGlobalData& __ct_globalData = (__ct_exec)->globalData();      \
>+        __ct_globalData.exception = (exceptionToThrow);                 \
>+        LLINT_CALL_END_IMPL(__ct_exec, callToThrow(__ct_exec, __ct_pc)); \
>+    } while (false)
>+
>+#define LLINT_CALL_CHECK_EXCEPTION(exec, pc) do {                       \
>+        ExecState* __cce_exec = (exec);                                 \
>+        Instruction* __cce_pc = (pc);                                   \
>+        if (UNLIKELY(__cce_exec->globalData().exception))               \
>+            LLINT_CALL_END_IMPL(__cce_exec, callToThrow(__cce_exec, __cce_pc)); \
>+    } while (false)
>+
>+#define LLINT_CALL_RETURN(exec, pc, callTarget) do {                    \
>+        ExecState* __cr_exec = (exec);                                  \
>+        Instruction* __cr_pc = (pc);                                    \
>+        void* __cr_callTarget = (callTarget);                           \
>+        LLINT_CALL_CHECK_EXCEPTION(__cr_exec->callerFrame(), __cr_pc);  \
>+        LLINT_CALL_END_IMPL(__cr_exec, __cr_callTarget);                \
>+    } while (false)
>+
>+extern "C" HelperReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
>+{
>+    printf("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
>+           exec->codeBlock(),
>+           exec,
>+           static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
>+           exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
>+           fromWhere,
>+           operand,
>+           pc[operand].u.operand);
>+    LLINT_END();
>+}
>+
>+extern "C" HelperReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
>+{
>+    JSValue value = LLINT_OP_C(operand).jsValue();
>+    union {
>+        struct {
>+            uint32_t tag;
>+            uint32_t payload;
>+        } bits;
>+        EncodedJSValue asValue;
>+    } u;
>+    u.asValue = JSValue::encode(value);
>+    printf("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x",
>+           exec->codeBlock(),
>+           exec,
>+           static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
>+           exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
>+           fromWhere,
>+           operand,
>+           pc[operand].u.operand,
>+           u.bits.tag,
>+           u.bits.payload);
>+#ifndef NDEBUG
>+    printf(": %s", value.description());
>+#endif
>+    printf("\n");
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(trace_prologue)
>+{
>+    printf("%p / %p: in prologue.\n", exec->codeBlock(), exec);
>+    LLINT_END();
>+}
>+
>+static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
>+{
>+    JSFunction* callee = asFunction(exec->callee());
>+    FunctionExecutable* executable = callee->jsExecutable();
>+    CodeBlock* codeBlock = &executable->generatedBytecodeFor(kind);
>+    printf("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeRegisters = %u.\n",
>+           codeBlock, exec, comment, callee, executable,
>+           codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeRegisters);
>+}
>+
>+LLINT_HELPER_DECL(trace_prologue_function_for_call)
>+{
>+    traceFunctionPrologue(exec, "call prologue", CodeForCall);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(trace_prologue_function_for_construct)
>+{
>+    traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(trace_arityCheck_for_call)
>+{
>+    traceFunctionPrologue(exec, "call arity check", CodeForCall);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(trace_arityCheck_for_construct)
>+{
>+    traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(trace)
>+{
>+    printf("%p / %p: executing bc#%zu, ",
>+           exec->codeBlock(),
>+           exec,
>+           static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()));
>+#ifndef NDEBUG
>+    printf("%s, ", opcodeNames[exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode)]);
>+#else
>+    printf("op#%u, ", exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode));
>+#endif
>+    printf("scope %p\n", exec->scopeChain());
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(special_trace)
>+{
>+    printf("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
>+           exec->codeBlock(),
>+           exec,
>+           static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
>+           exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
>+           exec->returnPC().value());
>+    LLINT_END();
>+}
>+
>+inline bool shouldJIT(ExecState* exec)
>+{
>+    // You can modify this to turn off JITting without rebuilding the world.
>+    return exec->globalData().canUseJIT();
>+}
>+
>+enum EntryKind { Prologue, ArityCheck };
>+static HelperReturnType entryOSR(ExecState* exec, Instruction* pc, CodeBlock* codeBlock, const char *name, EntryKind kind)
>+{
>+#if ENABLE(JIT_VERBOSE_OSR)
>+    printf("%p: Entered %s with executeCounter = %d\n", codeBlock, name, codeBlock->llintExecuteCounter());
>+#endif
>+    
>+    if (!shouldJIT(exec)) {
>+        codeBlock->dontJITAnytimeSoon();
>+        LLINT_RETURN_TWO(0, exec);
>+    }
>+    if (!codeBlock->jitCompile(exec->globalData())) {
>+#if ENABLE(JIT_VERBOSE_OSR)
>+        printf("    Code was already compiled.\n");
>+#endif
>+    }
>+    codeBlock->jitSoon();
>+    if (kind == Prologue)
>+        LLINT_RETURN_TWO(codeBlock->getJITCode().executableAddressAtOffset(0), exec);
>+    ASSERT(kind == ArityCheck);
>+    LLINT_RETURN_TWO(codeBlock->getJITCodeWithArityCheck().executableAddress(), exec);
>+}
>+
>+LLINT_HELPER_DECL(entry_osr)
>+{
>+    return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
>+}
>+
>+LLINT_HELPER_DECL(entry_osr_function_for_call)
>+{
>+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call", Prologue);
>+}
>+
>+LLINT_HELPER_DECL(entry_osr_function_for_construct)
>+{
>+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct", Prologue);
>+}
>+
>+LLINT_HELPER_DECL(entry_osr_function_for_call_arityCheck)
>+{
>+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call_arityCheck", ArityCheck);
>+}
>+
>+LLINT_HELPER_DECL(entry_osr_function_for_construct_arityCheck)
>+{
>+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct_arityCheck", ArityCheck);
>+}
>+
>+LLINT_HELPER_DECL(loop_osr)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    
>+#if ENABLE(JIT_VERBOSE_OSR)
>+    printf("%p: Entered loop_osr with executeCounter = %d\n", codeBlock, codeBlock->llintExecuteCounter());
>+#endif
>+    
>+    if (!shouldJIT(exec)) {
>+        codeBlock->dontJITAnytimeSoon();
>+        LLINT_RETURN_TWO(0, exec);
>+    }
>+    
>+    if (!codeBlock->jitCompile(exec->globalData())) {
>+#if ENABLE(JIT_VERBOSE_OSR)
>+        printf("    Code was already compiled.\n");
>+#endif
>+    }
>+    codeBlock->jitSoon();
>+    
>+    ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
>+    
>+    Vector<BytecodeAndMachineOffset> map;
>+    codeBlock->jitCodeMap()->decode(map);
>+    BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned, BytecodeAndMachineOffset::getBytecodeIndex>(map.begin(), map.size(), pc - codeBlock->instructions().begin());
>+    ASSERT(mapping);
>+    ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
>+    
>+    void* jumpTarget = codeBlock->getJITCode().executableAddressAtOffset(mapping->m_machineCodeOffset);
>+    ASSERT(jumpTarget);
>+    
>+    LLINT_RETURN_TWO(jumpTarget, exec);
>+}
>+
>+LLINT_HELPER_DECL(replace)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    
>+#if ENABLE(JIT_VERBOSE_OSR)
>+    printf("%p: Entered replace with executeCounter = %d\n", codeBlock, codeBlock->llintExecuteCounter());
>+#endif
>+    
>+    if (shouldJIT(exec)) {
>+        if (!codeBlock->jitCompile(exec->globalData())) {
>+#if ENABLE(JIT_VERBOSE_OSR)
>+            printf("    Code was already compiled.\n");
>+#endif
>+        }
>+        codeBlock->jitSoon();
>+    } else
>+        codeBlock->dontJITAnytimeSoon();
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(register_file_check)
>+{
>+#if LLINT_HELPER_TRACING
>+    printf("Checking stack height with exec = %p.\n", exec);
>+    printf("CodeBlock = %p.\n", exec->codeBlock());
>+    printf("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeRegisters);
>+    printf("Num vars = %u.\n", exec->codeBlock()->m_numVars);
>+    printf("Current end is at %p.\n", exec->globalData().interpreter->registerFile().end());
>+#endif
>+    ASSERT(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters] > exec->globalData().interpreter->registerFile().end());
>+    if (UNLIKELY(!exec->globalData().interpreter->registerFile().grow(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters]))) {
>+        exec = exec->callerFrame();
>+        exec->globalData().exception = createStackOverflowError(exec);
>+        interpreterThrowInCaller(exec);
>+        pc = returnToThrowForThrownException(exec);
>+    }
>+    LLINT_END_IMPL();
>+}
>+
>+LLINT_HELPER_DECL(helper_call_arityCheck)
>+{
>+    ExecState* newExec = CommonSlowPaths::arityCheckFor(exec, &exec->globalData().interpreter->registerFile(), CodeForCall);
>+    if (!newExec) {
>+        exec = exec->callerFrame();
>+        exec->globalData().exception = createStackOverflowError(exec);
>+        interpreterThrowInCaller(exec);
>+        LLINT_RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
>+    }
>+    LLINT_RETURN_TWO(0, newExec);
>+}
>+
>+LLINT_HELPER_DECL(helper_construct_arityCheck)
>+{
>+    ExecState* newExec = CommonSlowPaths::arityCheckFor(exec, &exec->globalData().interpreter->registerFile(), CodeForConstruct);
>+    if (!newExec) {
>+        exec = exec->callerFrame();
>+        exec->globalData().exception = createStackOverflowError(exec);
>+        interpreterThrowInCaller(exec);
>+        LLINT_RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
>+    }
>+    LLINT_RETURN_TWO(0, newExec);
>+}
>+
>+LLINT_HELPER_DECL(helper_create_activation)
>+{
>+#if LLINT_HELPER_TRACING
>+    printf("Creating an activation, exec = %p!\n", exec);
>+#endif
>+    JSActivation* activation = JSActivation::create(exec->globalData(), exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
>+    exec->setScopeChain(exec->scopeChain()->push(activation));
>+    LLINT_RETURN(JSValue(activation));
>+}
>+
>+LLINT_HELPER_DECL(helper_create_arguments)
>+{
>+    JSValue arguments = JSValue(Arguments::create(exec->globalData(), exec));
>+    LLINT_CHECK_EXCEPTION();
>+    exec->uncheckedR(pc[1].u.operand) = arguments;
>+    exec->uncheckedR(unmodifiedArgumentsRegister(pc[1].u.operand)) = arguments;
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_create_this)
>+{
>+    JSFunction* constructor = asFunction(exec->callee());
>+    
>+#if !ASSERT_DISABLED
>+    ConstructData constructData;
>+    ASSERT(constructor->methodTable()->getConstructData(constructor, constructData) == ConstructTypeJS);
>+#endif
>+    
>+    Structure* structure;
>+    JSValue proto = LLINT_OP(2).jsValue();
>+    if (proto.isObject())
>+        structure = asObject(proto)->inheritorID(exec->globalData());
>+    else
>+        structure = constructor->scope()->globalObject->emptyObjectStructure();
>+    
>+    LLINT_RETURN(constructEmptyObject(exec, structure));
>+}
>+
>+LLINT_HELPER_DECL(helper_convert_this)
>+{
>+    JSValue v1 = LLINT_OP(1).jsValue();
>+    ASSERT(v1.isPrimitive());
>+    LLINT_RETURN(v1.toThisObject(exec));
>+}
>+
>+LLINT_HELPER_DECL(helper_new_object)
>+{
>+    LLINT_RETURN(constructEmptyObject(exec));
>+}
>+
>+LLINT_HELPER_DECL(helper_new_array)
>+{
>+    LLINT_RETURN(constructArray(exec, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
>+}
>+
>+LLINT_HELPER_DECL(helper_new_array_buffer)
>+{
>+    LLINT_RETURN(constructArray(exec, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
>+}
>+
>+LLINT_HELPER_DECL(helper_new_regexp)
>+{
>+    RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
>+    if (!regExp->isValid())
>+        LLINT_THROW(createSyntaxError(exec, "Invalid flag supplied to RegExp constructor."));
>+    LLINT_RETURN(RegExpObject::create(exec->globalData(), exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp));
>+}
>+
>+LLINT_HELPER_DECL(helper_not)
>+{
>+    LLINT_RETURN(jsBoolean(!LLINT_OP_C(2).jsValue().toBoolean(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_eq)
>+{
>+    LLINT_RETURN(jsBoolean(JSValue::equal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_neq)
>+{
>+    LLINT_RETURN(jsBoolean(!JSValue::equal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_stricteq)
>+{
>+    LLINT_RETURN(jsBoolean(JSValue::strictEqual(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_nstricteq)
>+{
>+    LLINT_RETURN(jsBoolean(!JSValue::strictEqual(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_less)
>+{
>+    LLINT_RETURN(jsBoolean(jsLess<true>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_lesseq)
>+{
>+    LLINT_RETURN(jsBoolean(jsLessEq<true>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_greater)
>+{
>+    LLINT_RETURN(jsBoolean(jsLess<false>(exec, LLINT_OP_C(3).jsValue(), LLINT_OP_C(2).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_greatereq)
>+{
>+    LLINT_RETURN(jsBoolean(jsLessEq<false>(exec, LLINT_OP_C(3).jsValue(), LLINT_OP_C(2).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_pre_inc)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP(1).jsValue().toNumber(exec) + 1));
>+}
>+
>+LLINT_HELPER_DECL(helper_pre_dec)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP(1).jsValue().toNumber(exec) - 1));
>+}
>+
>+LLINT_HELPER_DECL(helper_post_inc)
>+{
>+    double result = LLINT_OP(2).jsValue().toNumber(exec);
>+    LLINT_OP(2) = jsNumber(result + 1);
>+    LLINT_RETURN(jsNumber(result));
>+}
>+
>+LLINT_HELPER_DECL(helper_post_dec)
>+{
>+    double result = LLINT_OP(2).jsValue().toNumber(exec);
>+    LLINT_OP(2) = jsNumber(result - 1);
>+    LLINT_RETURN(jsNumber(result));
>+}
>+
>+LLINT_HELPER_DECL(helper_to_jsnumber)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_negate)
>+{
>+    LLINT_RETURN(jsNumber(-LLINT_OP_C(2).jsValue().toNumber(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_add)
>+{
>+    JSValue v1 = LLINT_OP_C(2).jsValue();
>+    JSValue v2 = LLINT_OP_C(3).jsValue();
>+    
>+#if LLINT_HELPER_TRACING
>+    printf("Trying to add %s", v1.description());
>+    printf(" to %s.\n", v2.description());
>+#endif
>+    
>+    if (v1.isString() && !v2.isObject())
>+        LLINT_RETURN(jsString(exec, asString(v1), v2.toString(exec)));
>+    
>+    if (v1.isNumber() && v2.isNumber())
>+        LLINT_RETURN(jsNumber(v1.asNumber() + v2.asNumber()));
>+    
>+    LLINT_RETURN(jsAddSlowCase(exec, v1, v2));
>+}
>+
>+LLINT_HELPER_DECL(helper_mul)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) * LLINT_OP_C(3).jsValue().toNumber(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_sub)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) - LLINT_OP_C(3).jsValue().toNumber(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_div)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) / LLINT_OP_C(3).jsValue().toNumber(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_mod)
>+{
>+    LLINT_RETURN(jsNumber(fmod(LLINT_OP_C(2).jsValue().toNumber(exec), LLINT_OP_C(3).jsValue().toNumber(exec))));
>+}
>+
>+LLINT_HELPER_DECL(helper_lshift)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) << LLINT_OP_C(3).jsValue().toUInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_rshift)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) >> LLINT_OP_C(3).jsValue().toUInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_urshift)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toUInt32(exec) >> LLINT_OP_C(3).jsValue().toUInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_bitand)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) & LLINT_OP_C(3).jsValue().toInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_bitor)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) | LLINT_OP_C(3).jsValue().toInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_bitxor)
>+{
>+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) ^ LLINT_OP_C(3).jsValue().toInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_bitnot)
>+{
>+    LLINT_RETURN(jsNumber(~LLINT_OP_C(2).jsValue().toInt32(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_check_has_instance)
>+{
>+    JSValue baseVal = LLINT_OP_C(1).jsValue();
>+#ifndef NDEBUG
>+    TypeInfo typeInfo(UnspecifiedType);
>+    ASSERT(!baseVal.isObject()
>+           || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance());
>+#endif
>+    LLINT_THROW(createInvalidParamError(exec, "instanceof", baseVal));
>+}
>+
>+LLINT_HELPER_DECL(helper_instanceof)
>+{
>+    LLINT_RETURN(jsBoolean(CommonSlowPaths::opInstanceOfSlow(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_typeof)
>+{
>+    LLINT_RETURN(jsTypeStringForValue(exec, LLINT_OP_C(2).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_undefined)
>+{
>+    JSValue v = LLINT_OP_C(2).jsValue();
>+    LLINT_RETURN(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_boolean)
>+{
>+    LLINT_RETURN(jsBoolean(LLINT_OP_C(2).jsValue().isBoolean()));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_number)
>+{
>+    LLINT_RETURN(jsBoolean(LLINT_OP_C(2).jsValue().isNumber()));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_string)
>+{
>+    LLINT_RETURN(jsBoolean(isJSString(LLINT_OP_C(2).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_object)
>+{
>+    LLINT_RETURN(jsBoolean(jsIsObjectType(LLINT_OP_C(2).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_is_function)
>+{
>+    LLINT_RETURN(jsBoolean(jsIsFunctionType(LLINT_OP_C(2).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_in)
>+{
>+    LLINT_RETURN(jsBoolean(CommonSlowPaths::opIn(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve)
>+{
>+    LLINT_RETURN_PROFILED(op_resolve, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_skip)
>+{
>+    LLINT_RETURN_PROFILED(
>+        op_resolve_skip,
>+        CommonSlowPaths::opResolveSkip(
>+            exec,
>+            exec->codeBlock()->identifier(pc[2].u.operand),
>+            pc[3].u.operand));
>+}
>+
>+static JSValue resolveGlobal(ExecState* exec, Instruction* pc)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    JSGlobalObject* globalObject = codeBlock->globalObject();
>+    ASSERT(globalObject->isGlobalObject());
>+    int property = pc[2].u.operand;
>+    Structure* structure = pc[3].u.structure.get();
>+    
>+    ASSERT_UNUSED(structure, structure != globalObject->structure());
>+    
>+    Identifier& ident = codeBlock->identifier(property);
>+    PropertySlot slot(globalObject);
>+    
>+    if (globalObject->getPropertySlot(exec, ident, slot)) {
>+        JSValue result = slot.getValue(exec, ident);
>+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary()
>+            && slot.slotBase() == globalObject) {
>+            pc[3].u.structure.set(
>+                exec->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
>+            pc[4] = slot.cachedOffset();
>+        }
>+        
>+        return result;
>+    }
>+    
>+    exec->globalData().exception = createUndefinedVariableError(exec, ident);
>+    return JSValue();
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_global)
>+{
>+    LLINT_RETURN_PROFILED(op_resolve_global, resolveGlobal(exec, pc));
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_global_dynamic)
>+{
>+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, resolveGlobal(exec, pc));
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_for_resolve_global_dynamic)
>+{
>+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_base)
>+{
>+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
>+    if (pc[3].u.operand) {
>+        JSValue base = JSC::resolveBase(exec, ident, exec->scopeChain(), true);
>+        if (!base)
>+            LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
>+        LLINT_RETURN(base);
>+    }
>+    
>+    LLINT_RETURN_PROFILED(op_resolve_base, JSC::resolveBase(exec, ident, exec->scopeChain(), false));
>+}
>+
>+LLINT_HELPER_DECL(helper_ensure_property_exists)
>+{
>+    JSObject* object = asObject(LLINT_OP(1).jsValue());
>+    PropertySlot slot(object);
>+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
>+    if (!object->getPropertySlot(exec, ident, slot))
>+        LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_with_base)
>+{
>+    JSValue result = CommonSlowPaths::opResolveWithBase(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
>+    LLINT_CHECK_EXCEPTION();
>+    LLINT_OP(2) = result;
>+    // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_resolve_with_this)
>+{
>+    JSValue result = CommonSlowPaths::opResolveWithThis(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
>+    LLINT_CHECK_EXCEPTION();
>+    LLINT_OP(2) = result;
>+    // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_get_by_id)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    Identifier& ident = codeBlock->identifier(pc[3].u.operand);
>+    JSValue baseValue = LLINT_OP_C(2).jsValue();
>+    PropertySlot slot(baseValue);
>+
>+    JSValue result = baseValue.get(exec, ident, slot);
>+    LLINT_CHECK_EXCEPTION();
>+    LLINT_OP(1) = result;
>+
>+    if (baseValue.isCell()
>+        && slot.isCacheable()
>+        && slot.slotBase() == baseValue
>+        && slot.cachedPropertyType() == PropertySlot::Value) {
>+        
>+        JSCell* baseCell = baseValue.asCell();
>+        Structure* structure = baseCell->structure();
>+        
>+        if (!structure->isUncacheableDictionary()
>+            && !structure->typeInfo().prohibitsPropertyCaching()) {
>+            pc[4].u.structure.set(
>+                exec->globalData(), codeBlock->ownerExecutable(), structure);
>+            pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
>+        }
>+    }
>+    
>+    pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_get_arguments_length)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    Identifier& ident = codeBlock->identifier(pc[3].u.operand);
>+    JSValue baseValue = LLINT_OP(2).jsValue();
>+    PropertySlot slot(baseValue);
>+    LLINT_RETURN(baseValue.get(exec, ident, slot));
>+}
>+
>+LLINT_HELPER_DECL(helper_put_by_id)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    Identifier& ident = codeBlock->identifier(pc[2].u.operand);
>+    JSValue baseValue = LLINT_OP_C(1).jsValue();
>+    PutPropertySlot slot(codeBlock->isStrictMode());
>+    if (pc[8].u.operand)
>+        asObject(baseValue)->putDirect(exec->globalData(), ident, LLINT_OP_C(3).jsValue(), slot);
>+    else
>+        baseValue.put(exec, ident, LLINT_OP_C(3).jsValue(), slot);
>+    LLINT_CHECK_EXCEPTION();
>+    
>+    if (baseValue.isCell()
>+        && slot.isCacheable()) {
>+        
>+        JSCell* baseCell = baseValue.asCell();
>+        Structure* structure = baseCell->structure();
>+        
>+        if (!structure->isUncacheableDictionary()
>+            && !structure->typeInfo().prohibitsPropertyCaching()
>+            && baseCell == slot.base()) {
>+            
>+            if (slot.type() == PutPropertySlot::NewProperty) {
>+                if (!structure->isDictionary() && structure->previousID()->propertyStorageCapacity() == structure->propertyStorageCapacity()) {
>+                    // This is needed because some of the methods we call
>+                    // below may GC.
>+                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
>+
>+                    normalizePrototypeChain(exec, baseCell);
>+                    
>+                    ASSERT(structure->previousID()->isObject());
>+                    pc[4].u.structure.set(
>+                        exec->globalData(), codeBlock->ownerExecutable(), structure->previousID());
>+                    pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
>+                    pc[6].u.structure.set(
>+                        exec->globalData(), codeBlock->ownerExecutable(), structure);
>+                    StructureChain* chain = structure->prototypeChain(exec);
>+                    ASSERT(chain);
>+                    pc[7].u.structureChain.set(
>+                        exec->globalData(), codeBlock->ownerExecutable(), chain);
>+                    
>+                    if (pc[8].u.operand)
>+                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct);
>+                    else
>+                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal);
>+                }
>+            } else {
>+                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
>+                pc[4].u.structure.set(
>+                    exec->globalData(), codeBlock->ownerExecutable(), structure);
>+                pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
>+            }
>+        }
>+    }
>+    
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_del_by_id)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
>+    bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
>+    LLINT_CHECK_EXCEPTION();
>+    if (!couldDelete && codeBlock->isStrictMode())
>+        LLINT_THROW(createTypeError(exec, "Unable to delete property."));
>+    LLINT_RETURN(jsBoolean(couldDelete));
>+}
>+
>+inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
>+{
>+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
>+        if (JSValue result = baseValue.asCell()->fastGetOwnProperty(exec, asString(subscript)->value(exec)))
>+            return result;
>+    }
>+    
>+    if (subscript.isUInt32()) {
>+        uint32_t i = subscript.asUInt32();
>+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
>+            return asString(baseValue)->getIndex(exec, i);
>+        
>+        if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
>+            return asByteArray(baseValue)->getIndex(exec, i);
>+        
>+        return baseValue.get(exec, i);
>+    }
>+    
>+    Identifier property(exec, subscript.toString(exec)->value(exec));
>+    return baseValue.get(exec, property);
>+}
>+
>+LLINT_HELPER_DECL(helper_get_by_val)
>+{
>+    LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_get_argument_by_val)
>+{
>+    JSValue arguments = LLINT_OP(2).jsValue();
>+    if (!arguments) {
>+        arguments = Arguments::create(exec->globalData(), exec);
>+        LLINT_CHECK_EXCEPTION();
>+        LLINT_OP(2) = arguments;
>+        exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)) = arguments;
>+    }
>+    
>+    LLINT_RETURN(getByVal(exec, arguments, LLINT_OP_C(3).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_get_by_pname)
>+{
>+    LLINT_RETURN(getByVal(exec, LLINT_OP(2).jsValue(), LLINT_OP(3).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_put_by_val)
>+{
>+    JSGlobalData& globalData = exec->globalData();
>+    
>+    JSValue baseValue = LLINT_OP_C(1).jsValue();
>+    JSValue subscript = LLINT_OP_C(2).jsValue();
>+    JSValue value = LLINT_OP_C(3).jsValue();
>+    
>+    if (LIKELY(subscript.isUInt32())) {
>+        uint32_t i = subscript.asUInt32();
>+        if (isJSArray(baseValue)) {
>+            JSArray* jsArray = asArray(baseValue);
>+            if (jsArray->canSetIndex(i))
>+                jsArray->setIndex(globalData, i, value);
>+            else
>+                JSArray::putByIndex(jsArray, exec, i, value);
>+            LLINT_END();
>+        }
>+        if (isJSByteArray(baseValue)
>+            && asByteArray(baseValue)->canAccessIndex(i)) {
>+            JSByteArray* jsByteArray = asByteArray(baseValue);
>+            if (value.isInt32()) {
>+                jsByteArray->setIndex(i, value.asInt32());
>+                LLINT_END();
>+            }
>+            if (value.isNumber()) {
>+                jsByteArray->setIndex(i, value.asNumber());
>+                LLINT_END();
>+            }
>+        }
>+        baseValue.put(exec, i, value);
>+        LLINT_END();
>+    }
>+    
>+    Identifier property(exec, subscript.toString(exec)->value(exec));
>+    LLINT_CHECK_EXCEPTION();
>+    PutPropertySlot slot(exec->codeBlock()->isStrictMode());
>+    baseValue.put(exec, property, value, slot);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_del_by_val)
>+{
>+    JSValue baseValue = LLINT_OP_C(2).jsValue();
>+    JSObject* baseObject = baseValue.toObject(exec);
>+    
>+    JSValue subscript = LLINT_OP_C(3).jsValue();
>+    
>+    bool couldDelete;
>+    
>+    uint32_t i;
>+    if (subscript.getUInt32(i))
>+        couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
>+    else {
>+        LLINT_CHECK_EXCEPTION();
>+        Identifier property(exec, subscript.toString(exec)->value(exec));
>+        LLINT_CHECK_EXCEPTION();
>+        couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
>+    }
>+    
>+    if (!couldDelete && exec->codeBlock()->isStrictMode())
>+        LLINT_THROW(createTypeError(exec, "Unable to delete property."));
>+    
>+    LLINT_RETURN(jsBoolean(couldDelete));
>+}
>+
>+LLINT_HELPER_DECL(helper_put_by_index)
>+{
>+    LLINT_OP_C(1).jsValue().put(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_put_getter)
>+{
>+    ASSERT(LLINT_OP(1).jsValue().isObject());
>+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
>+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
>+    ASSERT(LLINT_OP(3).jsValue().isObject());
>+    baseObj->methodTable()->defineGetter(baseObj, exec, ident, asObject(LLINT_OP(3).jsValue()), 0);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_put_setter)
>+{
>+    ASSERT(LLINT_OP(1).jsValue().isObject());
>+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
>+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
>+    ASSERT(LLINT_OP(3).jsValue().isObject());
>+    baseObj->methodTable()->defineSetter(baseObj, exec, ident, asObject(LLINT_OP(3).jsValue()), 0);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_jmp_scopes)
>+{
>+    unsigned count = pc[1].u.operand;
>+    ScopeChainNode* tmp = exec->scopeChain();
>+    while (count--)
>+        tmp = tmp->pop();
>+    exec->setScopeChain(tmp);
>+    pc += pc[2].u.operand;
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_jtrue)
>+{
>+    LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
>+}
>+
>+LLINT_HELPER_DECL(helper_jfalse)
>+{
>+    LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
>+}
>+
>+LLINT_HELPER_DECL(helper_jless)
>+{
>+    LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jnless)
>+{
>+    LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jgreater)
>+{
>+    LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jngreater)
>+{
>+    LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jlesseq)
>+{
>+    LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jnlesseq)
>+{
>+    LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jgreatereq)
>+{
>+    LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_jngreatereq)
>+{
>+    LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
>+}
>+
>+LLINT_HELPER_DECL(helper_switch_imm)
>+{
>+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
>+    ASSERT(scrutinee.isDouble());
>+    double value = scrutinee.asDouble();
>+    int32_t intValue = static_cast<int32_t>(value);
>+    int defaultOffset = pc[2].u.operand;
>+    if (value == intValue) {
>+        CodeBlock* codeBlock = exec->codeBlock();
>+        pc += codeBlock->immediateSwitchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
>+    } else
>+        pc += defaultOffset;
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_switch_string)
>+{
>+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
>+    int defaultOffset = pc[2].u.operand;
>+    if (!scrutinee.isString())
>+        pc += defaultOffset;
>+    else {
>+        CodeBlock* codeBlock = exec->codeBlock();
>+        pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
>+    }
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_new_func)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    ASSERT(codeBlock->codeType() != FunctionCode
>+           || !codeBlock->needsFullScopeChain()
>+           || exec->uncheckedR(codeBlock->activationRegister()).jsValue());
>+#if LLINT_HELPER_TRACING
>+    printf("Creating function!\n");
>+#endif
>+    LLINT_RETURN(codeBlock->functionDecl(pc[2].u.operand)->make(exec, exec->scopeChain()));
>+}
>+
>+LLINT_HELPER_DECL(helper_new_func_exp)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    FunctionExecutable* function = codeBlock->functionExpr(pc[2].u.operand);
>+    JSFunction* func = function->make(exec, exec->scopeChain());
>+    
>+    if (!function->name().isNull()) {
>+        JSStaticScopeObject* functionScopeObject = JSStaticScopeObject::create(exec, function->name(), func, ReadOnly | DontDelete);
>+        func->setScope(exec->globalData(), func->scope()->push(functionScopeObject));
>+    }
>+    
>+    LLINT_RETURN(func);
>+}
>+
>+static HelperReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
>+{
>+    ExecState* exec = execCallee->callerFrame();
>+    JSGlobalData* globalData = &exec->globalData();
>+
>+    execCallee->setScopeChain(exec->scopeChain());
>+    execCallee->setCodeBlock(0);
>+
>+    if (kind == CodeForCall) {
>+        CallData callData;
>+        CallType callType = getCallData(callee, callData);
>+    
>+        ASSERT(callType != CallTypeJS);
>+    
>+        if (callType == CallTypeHost) {
>+            globalData->hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
>+            
>+            LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
>+        }
>+        
>+#if LLINT_HELPER_TRACING
>+        printf("Call callee is not a function: %s\n", callee.description());
>+#endif
>+
>+        ASSERT(callType == CallTypeNone);
>+        LLINT_CALL_THROW(exec, pc, createNotAFunctionError(exec, callee));
>+    }
>+
>+    ASSERT(kind == CodeForConstruct);
>+    
>+    ConstructData constructData;
>+    ConstructType constructType = getConstructData(callee, constructData);
>+    
>+    ASSERT(constructType != ConstructTypeJS);
>+    
>+    if (constructType == ConstructTypeHost) {
>+        globalData->hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
>+        LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
>+    }
>+    
>+#if LLINT_HELPER_TRACING
>+        printf("Constructor callee is not a function: %s\n", callee.description());
>+#endif
>+
>+    ASSERT(constructType == ConstructTypeNone);
>+    LLINT_CALL_THROW(exec, pc, createNotAConstructorError(exec, callee));
>+}
>+
>+inline HelperReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
>+{
>+    JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
>+    if (!calleeAsFunctionCell)
>+        return handleHostCall(execCallee, pc, calleeAsValue, kind);
>+    
>+    JSFunction* callee = asFunction(calleeAsFunctionCell);
>+    execCallee->setScopeChain(callee->scopeUnchecked());
>+    ExecutableBase* executable = callee->executable();
>+    
>+    MacroAssemblerCodePtr codePtr;
>+    CodeBlock* codeBlock = 0;
>+    if (executable->isHostFunction())
>+        codePtr = executable->generatedJITCodeFor(kind).addressForCall();
>+    else {
>+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
>+        JSObject* error = functionExecutable->compileFor(execCallee, callee->scope(), kind);
>+        if (error)
>+            LLINT_CALL_THROW(execCallee->callerFrame(), pc, error);
>+        codeBlock = &functionExecutable->generatedBytecodeFor(kind);
>+        ASSERT(codeBlock);
>+        if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
>+            codePtr = functionExecutable->generatedJITCodeWithArityCheckFor(kind);
>+        else
>+            codePtr = functionExecutable->generatedJITCodeFor(kind).addressForCall();
>+    }
>+    
>+    if (callLinkInfo) {
>+        if (callLinkInfo->isOnList())
>+            callLinkInfo->remove();
>+        ExecState* execCaller = execCallee->callerFrame();
>+        callLinkInfo->callee.set(execCaller->globalData(), execCaller->codeBlock()->ownerExecutable(), callee);
>+        callLinkInfo->lastSeenCallee.set(execCaller->globalData(), execCaller->codeBlock()->ownerExecutable(), callee);
>+        callLinkInfo->machineCodeTarget = codePtr;
>+        if (codeBlock)
>+            codeBlock->linkIncomingCall(callLinkInfo);
>+    }
>+    
>+    LLINT_CALL_RETURN(execCallee, pc, codePtr.executableAddress());
>+}
>+
>+inline HelperReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
>+{
>+    // This needs to:
>+    // - Set up a call frame.
>+    // - Figure out what to call and compile it if necessary.
>+    // - If possible, link the call's inline cache.
>+    // - Return a tuple of machine code address to call and the new call frame.
>+    
>+    JSValue calleeAsValue = LLINT_OP_C(1).jsValue();
>+    
>+    ExecState* execCallee = exec + pc[3].u.operand;
>+    
>+    execCallee->setArgumentCountIncludingThis(pc[2].u.operand);
>+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
>+    execCallee->setCallerFrame(exec);
>+    
>+    ASSERT(pc[4].u.callLinkInfo);
>+    return setUpCall(execCallee, pc, kind, calleeAsValue, pc[4].u.callLinkInfo);
>+}
>+
>+LLINT_HELPER_DECL(helper_call)
>+{
>+    return genericCall(exec, pc, CodeForCall);
>+}
>+
>+LLINT_HELPER_DECL(helper_construct)
>+{
>+    return genericCall(exec, pc, CodeForConstruct);
>+}
>+
>+LLINT_HELPER_DECL(helper_call_varargs)
>+{
>+    // This needs to:
>+    // - Set up a call frame while respecting the variable arguments.
>+    // - Figure out what to call and compile it if necessary.
>+    // - Return a tuple of machine code address to call and the new call frame.
>+    
>+    JSValue calleeAsValue = LLINT_OP_C(1).jsValue();
>+    
>+    ExecState* execCallee = loadVarargs(
>+        exec, &exec->globalData().interpreter->registerFile(),
>+        LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue(), pc[4].u.operand);
>+    LLINT_CALL_CHECK_EXCEPTION(exec, pc);
>+    
>+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
>+    execCallee->setCallerFrame(exec);
>+    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_varargs));
>+    
>+    return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
>+}
>+
>+LLINT_HELPER_DECL(helper_call_eval)
>+{
>+    JSValue calleeAsValue = LLINT_OP(1).jsValue();
>+    
>+    ExecState* execCallee = exec + pc[3].u.operand;
>+    JSGlobalData& globalData = exec->globalData();
>+    
>+    execCallee->setArgumentCountIncludingThis(pc[2].u.operand);
>+    execCallee->setCallerFrame(exec);
>+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
>+    execCallee->setScopeChain(exec->scopeChain());
>+    execCallee->setReturnPC(bitwise_cast<Instruction*>(&llint_generic_return_point));
>+    execCallee->setCodeBlock(0);
>+    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_eval));
>+    
>+    if (!isHostFunction(calleeAsValue, globalFuncEval))
>+        return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
>+    
>+    globalData.hostCallReturnValue = eval(execCallee);
>+    LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
>+}
>+
>+LLINT_HELPER_DECL(helper_tear_off_activation)
>+{
>+    ASSERT(exec->codeBlock()->needsFullScopeChain());
>+    JSValue activationValue = LLINT_OP(1).jsValue();
>+    if (!activationValue) {
>+        if (JSValue v = exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)).jsValue()) {
>+            if (!exec->codeBlock()->isStrictMode())
>+                asArguments(v)->tearOff(exec);
>+        }
>+        LLINT_END();
>+    }
>+    JSActivation* activation = asActivation(activationValue);
>+    activation->tearOff(exec->globalData());
>+    if (JSValue v = exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)).jsValue())
>+        asArguments(v)->didTearOffActivation(exec->globalData(), activation);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_tear_off_arguments)
>+{
>+    ASSERT(exec->codeBlock()->usesArguments() && !exec->codeBlock()->needsFullScopeChain());
>+    asArguments(exec->uncheckedR(unmodifiedArgumentsRegister(pc[1].u.operand)).jsValue())->tearOff(exec);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_strcat)
>+{
>+    LLINT_RETURN(jsString(exec, &LLINT_OP(2), pc[3].u.operand));
>+}
>+
>+LLINT_HELPER_DECL(helper_to_primitive)
>+{
>+    LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
>+}
>+
>+LLINT_HELPER_DECL(helper_get_pnames)
>+{
>+    JSValue v = LLINT_OP(2).jsValue();
>+    if (v.isUndefinedOrNull()) {
>+        pc += pc[5].u.operand;
>+        LLINT_END();
>+    }
>+    
>+    JSObject* o = v.toObject(exec);
>+    Structure* structure = o->structure();
>+    JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
>+    if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(exec))
>+        jsPropertyNameIterator = JSPropertyNameIterator::create(exec, o);
>+    
>+    LLINT_OP(1) = JSValue(jsPropertyNameIterator);
>+    LLINT_OP(2) = JSValue(o);
>+    LLINT_OP(3) = Register::withInt(0);
>+    LLINT_OP(4) = Register::withInt(jsPropertyNameIterator->size());
>+    
>+    pc += OPCODE_LENGTH(op_get_pnames);
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_next_pname)
>+{
>+    JSObject* base = asObject(LLINT_OP(2).jsValue());
>+    JSString* property = asString(LLINT_OP(1).jsValue());
>+    if (base->hasProperty(exec, Identifier(exec, property->value(exec)))) {
>+        // Go to target.
>+        pc += pc[6].u.operand;
>+    } // Else, don't change the PC, so the interpreter will reloop.
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_push_scope)
>+{
>+    JSValue v = LLINT_OP(1).jsValue();
>+    JSObject* o = v.toObject(exec);
>+    LLINT_CHECK_EXCEPTION();
>+    
>+    LLINT_OP(1) = o;
>+    exec->setScopeChain(exec->scopeChain()->push(o));
>+    
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_pop_scope)
>+{
>+    exec->setScopeChain(exec->scopeChain()->pop());
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_push_new_scope)
>+{
>+    CodeBlock* codeBlock = exec->codeBlock();
>+    JSObject* scope = JSStaticScopeObject::create(exec, codeBlock->identifier(pc[2].u.operand), LLINT_OP(3).jsValue(), DontDelete);
>+    exec->setScopeChain(exec->scopeChain()->push(scope));
>+    LLINT_RETURN(scope);
>+}
>+
>+LLINT_HELPER_DECL(helper_throw)
>+{
>+    LLINT_THROW(LLINT_OP_C(1).jsValue());
>+}
>+
>+LLINT_HELPER_DECL(helper_throw_reference_error)
>+{
>+    LLINT_THROW(createReferenceError(exec, LLINT_OP_C(1).jsValue().toString(exec)->value(exec)));
>+}
>+
>+LLINT_HELPER_DECL(helper_debug)
>+{
>+    int debugHookID = pc[1].u.operand;
>+    int firstLine = pc[2].u.operand;
>+    int lastLine = pc[3].u.operand;
>+    
>+    exec->globalData().interpreter->debug(exec, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
>+    
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_profile_will_call)
>+{
>+    (*Profiler::enabledProfilerReference())->willExecute(exec, LLINT_OP(1).jsValue());
>+    LLINT_END();
>+}
>+
>+LLINT_HELPER_DECL(helper_profile_did_call)
>+{
>+    (*Profiler::enabledProfilerReference())->didExecute(exec, LLINT_OP(1).jsValue());
>+    LLINT_END();
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LLIntHelpers.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntHelpers.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntHelpers.h	(revision 0)
>@@ -0,0 +1,172 @@
>+/*
>+ * Copyright (C) 2011 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntHelpers_h
>+#define LLIntHelpers_h
>+
>+#include <wtf/Platform.h>
>+#include <wtf/StdLibExtras.h>
>+
>+#if ENABLE(LLINT)
>+
>+namespace JSC {
>+
>+class ExecState;
>+struct Instruction;
>+
>+namespace LLInt {
>+
>+typedef int64_t HelperReturnType;
>+
>+extern "C" HelperReturnType llint_trace_operand(ExecState*, Instruction*, int fromWhere, int operand);
>+extern "C" HelperReturnType llint_trace_value(ExecState*, Instruction*, int fromWhere, int operand);
>+
>+#define LLINT_HELPER_DECL(name) \
>+    extern "C" HelperReturnType llint_##name(ExecState* exec, Instruction* pc)
>+
>+LLINT_HELPER_DECL(trace_prologue);
>+LLINT_HELPER_DECL(trace_prologue_function_for_call);
>+LLINT_HELPER_DECL(trace_prologue_function_for_construct);
>+LLINT_HELPER_DECL(trace_arityCheck_for_call);
>+LLINT_HELPER_DECL(trace_arityCheck_for_construct);
>+LLINT_HELPER_DECL(trace);
>+LLINT_HELPER_DECL(special_trace);
>+LLINT_HELPER_DECL(entry_osr);
>+LLINT_HELPER_DECL(entry_osr_function_for_call);
>+LLINT_HELPER_DECL(entry_osr_function_for_construct);
>+LLINT_HELPER_DECL(entry_osr_function_for_call_arityCheck);
>+LLINT_HELPER_DECL(entry_osr_function_for_construct_arityCheck);
>+LLINT_HELPER_DECL(loop_osr);
>+LLINT_HELPER_DECL(replace);
>+LLINT_HELPER_DECL(register_file_check);
>+LLINT_HELPER_DECL(helper_call_arityCheck);
>+LLINT_HELPER_DECL(helper_construct_arityCheck);
>+LLINT_HELPER_DECL(helper_create_activation);
>+LLINT_HELPER_DECL(helper_create_arguments);
>+LLINT_HELPER_DECL(helper_create_this);
>+LLINT_HELPER_DECL(helper_convert_this);
>+LLINT_HELPER_DECL(helper_new_object);
>+LLINT_HELPER_DECL(helper_new_array);
>+LLINT_HELPER_DECL(helper_new_array_buffer);
>+LLINT_HELPER_DECL(helper_new_regexp);
>+LLINT_HELPER_DECL(helper_not);
>+LLINT_HELPER_DECL(helper_eq);
>+LLINT_HELPER_DECL(helper_neq);
>+LLINT_HELPER_DECL(helper_stricteq);
>+LLINT_HELPER_DECL(helper_nstricteq);
>+LLINT_HELPER_DECL(helper_less);
>+LLINT_HELPER_DECL(helper_lesseq);
>+LLINT_HELPER_DECL(helper_greater);
>+LLINT_HELPER_DECL(helper_greatereq);
>+LLINT_HELPER_DECL(helper_pre_inc);
>+LLINT_HELPER_DECL(helper_pre_dec);
>+LLINT_HELPER_DECL(helper_post_inc);
>+LLINT_HELPER_DECL(helper_post_dec);
>+LLINT_HELPER_DECL(helper_to_jsnumber);
>+LLINT_HELPER_DECL(helper_negate);
>+LLINT_HELPER_DECL(helper_add);
>+LLINT_HELPER_DECL(helper_mul);
>+LLINT_HELPER_DECL(helper_sub);
>+LLINT_HELPER_DECL(helper_div);
>+LLINT_HELPER_DECL(helper_mod);
>+LLINT_HELPER_DECL(helper_lshift);
>+LLINT_HELPER_DECL(helper_rshift);
>+LLINT_HELPER_DECL(helper_urshift);
>+LLINT_HELPER_DECL(helper_bitand);
>+LLINT_HELPER_DECL(helper_bitor);
>+LLINT_HELPER_DECL(helper_bitxor);
>+LLINT_HELPER_DECL(helper_bitnot);
>+LLINT_HELPER_DECL(helper_check_has_instance);
>+LLINT_HELPER_DECL(helper_instanceof);
>+LLINT_HELPER_DECL(helper_typeof);
>+LLINT_HELPER_DECL(helper_is_undefined);
>+LLINT_HELPER_DECL(helper_is_boolean);
>+LLINT_HELPER_DECL(helper_is_number);
>+LLINT_HELPER_DECL(helper_is_string);
>+LLINT_HELPER_DECL(helper_is_object);
>+LLINT_HELPER_DECL(helper_is_function);
>+LLINT_HELPER_DECL(helper_in);
>+LLINT_HELPER_DECL(helper_resolve);
>+LLINT_HELPER_DECL(helper_resolve_skip);
>+LLINT_HELPER_DECL(helper_resolve_global);
>+LLINT_HELPER_DECL(helper_resolve_global_dynamic);
>+LLINT_HELPER_DECL(helper_resolve_for_resolve_global_dynamic);
>+LLINT_HELPER_DECL(helper_resolve_base);
>+LLINT_HELPER_DECL(helper_ensure_property_exists);
>+LLINT_HELPER_DECL(helper_resolve_with_base);
>+LLINT_HELPER_DECL(helper_resolve_with_this);
>+LLINT_HELPER_DECL(helper_get_by_id);
>+LLINT_HELPER_DECL(helper_get_arguments_length);
>+LLINT_HELPER_DECL(helper_put_by_id);
>+LLINT_HELPER_DECL(helper_del_by_id);
>+LLINT_HELPER_DECL(helper_get_by_val);
>+LLINT_HELPER_DECL(helper_get_argument_by_val);
>+LLINT_HELPER_DECL(helper_get_by_pname);
>+LLINT_HELPER_DECL(helper_put_by_val);
>+LLINT_HELPER_DECL(helper_del_by_val);
>+LLINT_HELPER_DECL(helper_put_by_index);
>+LLINT_HELPER_DECL(helper_put_getter);
>+LLINT_HELPER_DECL(helper_put_setter);
>+LLINT_HELPER_DECL(helper_jmp_scopes);
>+LLINT_HELPER_DECL(helper_jtrue);
>+LLINT_HELPER_DECL(helper_jfalse);
>+LLINT_HELPER_DECL(helper_jless);
>+LLINT_HELPER_DECL(helper_jnless);
>+LLINT_HELPER_DECL(helper_jgreater);
>+LLINT_HELPER_DECL(helper_jngreater);
>+LLINT_HELPER_DECL(helper_jlesseq);
>+LLINT_HELPER_DECL(helper_jnlesseq);
>+LLINT_HELPER_DECL(helper_jgreatereq);
>+LLINT_HELPER_DECL(helper_jngreatereq);
>+LLINT_HELPER_DECL(helper_switch_imm);
>+LLINT_HELPER_DECL(helper_switch_char);
>+LLINT_HELPER_DECL(helper_switch_string);
>+LLINT_HELPER_DECL(helper_new_func);
>+LLINT_HELPER_DECL(helper_new_func_exp);
>+LLINT_HELPER_DECL(helper_call);
>+LLINT_HELPER_DECL(helper_construct);
>+LLINT_HELPER_DECL(helper_call_varargs);
>+LLINT_HELPER_DECL(helper_call_eval);
>+LLINT_HELPER_DECL(helper_tear_off_activation);
>+LLINT_HELPER_DECL(helper_tear_off_arguments);
>+LLINT_HELPER_DECL(helper_strcat);
>+LLINT_HELPER_DECL(helper_to_primitive);
>+LLINT_HELPER_DECL(helper_get_pnames);
>+LLINT_HELPER_DECL(helper_next_pname);
>+LLINT_HELPER_DECL(helper_push_scope);
>+LLINT_HELPER_DECL(helper_pop_scope);
>+LLINT_HELPER_DECL(helper_push_new_scope);
>+LLINT_HELPER_DECL(helper_throw);
>+LLINT_HELPER_DECL(helper_throw_reference_error);
>+LLINT_HELPER_DECL(helper_debug);
>+LLINT_HELPER_DECL(helper_profile_will_call);
>+LLINT_HELPER_DECL(helper_profile_did_call);
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>+
>+#endif // LLIntHelpers_h
>+
>Index: Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h	(revision 0)
>@@ -0,0 +1,69 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntOfflineAsmConfig_h
>+#define LLIntOfflineAsmConfig_h
>+
>+#include "LLIntCommon.h"
>+#include <wtf/Assertions.h>
>+#include <wtf/Platform.h>
>+
>+#if CPU(X86)
>+#define OFFLINE_ASM_X86 1
>+#else
>+#define OFFLINE_ASM_X86 0
>+#endif
>+
>+#if CPU(ARMv7)
>+#define OFFLINE_ASM_ARMv7 1
>+#else
>+#define OFFLINE_ASM_ARMv7 0
>+#endif
>+
>+#if !ASSERT_DISABLED
>+#define OFFLINE_ASM_ASSERT_ENABLED 1
>+#else
>+#define OFFLINE_ASM_ASSERT_ENABLED 0
>+#endif
>+
>+#if CPU(BIG_ENDIAN)
>+#define OFFLINE_ASM_BIG_ENDIAN 1
>+#else
>+#define OFFLINE_ASM_BIG_ENDIAN 0
>+#endif
>+
>+#if ENABLE(LLINT_OSR_TO_JIT)
>+#define OFFLINE_ASM_JIT_ENABLED 1
>+#else
>+#define OFFLINE_ASM_JIT_ENABLED 0
>+#endif
>+
>+#if LLINT_EXECUTION_TRACING
>+#define OFFLINE_ASM_EXECUTION_TRACING 1
>+#else
>+#define OFFLINE_ASM_EXECUTION_TRACING 0
>+#endif
>+
>+#endif // LLIntOfflineAsmConfig_h
>Index: Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(revision 0)
>@@ -0,0 +1,76 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+
>+#include "CodeBlock.h"
>+#include "Executable.h"
>+#include "Heap.h"
>+#include "Interpreter.h"
>+#include "JITStubs.h"
>+#include "JSArray.h"
>+#include "JSCell.h"
>+#include "JSFunction.h"
>+#include "JSGlobalData.h"
>+#include "JSGlobalObject.h"
>+#include "JSObject.h"
>+#include "JSPropertyNameIterator.h"
>+#include "JSString.h"
>+#include "JSTypeInfo.h"
>+#include "JSVariableObject.h"
>+#include "JumpTable.h"
>+#include "LLIntOfflineAsmConfig.h"
>+#include "MarkedSpace.h"
>+#include "RegisterFile.h"
>+#include "ScopeChain.h"
>+#include "Structure.h"
>+#include "StructureChain.h"
>+#include "ValueProfile.h"
>+#include <wtf/text/StringImpl.h>
>+
>+namespace JSC {
>+
>+#define OFFLINE_ASM_OFFSETOF(clazz, field) OBJECT_OFFSETOF(clazz, field)
>+
>+class LLIntOffsetsExtractor {
>+public:
>+    static const unsigned* dummy();
>+};
>+
>+const unsigned* LLIntOffsetsExtractor::dummy()
>+{
>+#include "LLIntDesiredOffsets.h"
>+    return extractorTable;
>+}
>+
>+} // namespace JSC
>+
>+int main(int, char**)
>+{
>+    // Out of an abundance of caution, make sure that LLIntOffsetsExtractor::dummy() is live,
>+    // and the extractorTable is live, too.
>+    printf("%p\n", JSC::LLIntOffsetsExtractor::dummy());
>+    return 0;
>+}
>Index: Source/JavaScriptCore/llint/LLIntThunks.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntThunks.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntThunks.cpp	(revision 0)
>@@ -0,0 +1,81 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LLIntThunks.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "JSInterfaceJIT.h"
>+#include "LinkBuffer.h"
>+#include "LowLevelInterpreter.h"
>+
>+namespace JSC { namespace LLInt {
>+
>+static MacroAssemblerCodeRef generateThunkWithJumpTo(JSGlobalData* globalData, void (*target)())
>+{
>+    JSInterfaceJIT jit;
>+    
>+    // FIXME: there's probably a better way to do it on X86, but I'm not sure I care.
>+    jit.move(JSInterfaceJIT::TrustedImmPtr(bitwise_cast<void*>(target)), JSInterfaceJIT::regT0);
>+    jit.jump(JSInterfaceJIT::regT0);
>+    
>+    LinkBuffer patchBuffer(*globalData, &jit, GLOBAL_THUNK_ID);
>+    return patchBuffer.finalizeCode();
>+}
>+
>+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_function_for_call_prologue);
>+}
>+
>+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_function_for_construct_prologue);
>+}
>+
>+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_function_for_call_arity_check);
>+}
>+
>+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_function_for_construct_arity_check);
>+}
>+
>+MacroAssemblerCodeRef evalEntryThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_eval_prologue);
>+}
>+
>+MacroAssemblerCodeRef programEntryThunkGenerator(JSGlobalData* globalData)
>+{
>+    return generateThunkWithJumpTo(globalData, llint_program_prologue);
>+}
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LLIntThunks.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntThunks.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LLIntThunks.h	(revision 0)
>@@ -0,0 +1,52 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LLIntThunks_h
>+#define LLIntThunks_h
>+
>+#include <wtf/Platform.h>
>+
>+#if ENABLE(LLINT)
>+
>+#include "MacroAssemblerCodeRef.h"
>+
>+namespace JSC {
>+
>+class JSGlobalData;
>+
>+namespace LLInt {
>+
>+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(JSGlobalData*);
>+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(JSGlobalData*);
>+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(JSGlobalData*);
>+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(JSGlobalData*);
>+MacroAssemblerCodeRef evalEntryThunkGenerator(JSGlobalData*);
>+MacroAssemblerCodeRef programEntryThunkGenerator(JSGlobalData*);
>+
>+} } // namespace JSC::LLInt
>+
>+#endif // ENABLE(LLINT)
>+
>+#endif // LLIntThunks_h
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 0)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 0)
>@@ -0,0 +1,2380 @@
>+# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+
>+# Crash course on the language that this is written in (which I just call
>+# "assembly" even though it's more than that):
>+#
>+# - Mostly gas-style operand ordering. The last operand tends to be the
>+#   destination. So "a := b" is written as "mov b, a". But unlike gas,
>+#   comparisons are in-order, so "if (a < b)" is written as
>+#   "bilt a, b, ...".
>+#
>+# - "b" = byte, "h" = 16-bit word, "i" = 32-bit word, "p" = pointer.
>+#   Currently this is just 32-bit so "i" and "p" are interchangeable
>+#   except when an op supports one but not the other.
>+#
>+# - In general, valid operands for macro invocations and instructions are
>+#   registers (eg "t0"), addresses (eg "4[t0]"), base-index addresses
>+#   (eg "7[t0, t1, 2]"), absolute addresses (eg "0xa0000000[]"), or labels
>+#   (eg "_foo" or ".foo"). Macro invocations can also take anonymous
>+#   macros as operands. Instructions cannot take anonymous macros.
>+#
>+# - Labels must have names that begin with either "_" or ".".  A "." label
>+#   is local and gets renamed before code gen to minimize namespace
>+#   pollution. A "_" label is an extern symbol (i.e. ".globl"). The "_"
>+#   may or may not be removed during code gen depending on whether the asm
>+#   conventions for C name mangling on the target platform mandate a "_"
>+#   prefix.
>+#
>+# - A "macro" is a lambda expression, which may be either anonymous or
>+#   named. But this has caveats. "macro" can take zero or more arguments,
>+#   which may be macros or any valid operands, but it can only return
>+#   code. But you can do Turing-complete things via continuation passing
>+#   style: "macro foo (a, b) b(a) end foo(foo, foo)". Actually, don't do
>+#   that, since you'll just crash the assembler.
>+#
>+# - An "if" is a conditional on settings. Any identifier supplied in the
>+#   predicate of an "if" is assumed to be a #define that is available
>+#   during code gen. So you can't use "if" for computation in a macro, but
>+#   you can use it to select different pieces of code for different
>+#   platforms.
>+#
>+# - Arguments to macros follow lexical scoping rather than dynamic scoping.
>+#   Const's also follow lexical scoping and may override (hide) arguments
>+#   or other consts. All variables (arguments and constants) can be bound
>+#   to operands. Additionally, arguments (but not constants) can be bound
>+#   to macros.
>+
>+
>+# These declarations must match interpreter/RegisterFile.h.
>+const CallFrameHeaderSize = 48
>+const ArgumentCount = -48
>+const CallerFrame = -40
>+const Callee = -32
>+const ScopeChain = -24
>+const ReturnPC = -16
>+const CodeBlock = -8
>+
>+const ThisArgumentOffset = -CallFrameHeaderSize - 8
>+
>+# Declare some aliases for the registers we will use.
>+const PC = t4
>+
>+# Offsets needed for reasoning about value representation.
>+if BIG_ENDIAN
>+    const TagOffset = 0
>+    const PayloadOffset = 4
>+else
>+    const TagOffset = 4
>+    const PayloadOffset = 0
>+end
>+
>+# Value representation constants.
>+const Int32Tag = -1
>+const BooleanTag = -2
>+const NullTag = -3
>+const UndefinedTag = -4
>+const CellTag = -5
>+const EmptyValueTag = -6
>+const DeletedValueTag = -7
>+const LowestTag = DeletedValueTag
>+
>+# Type constants.
>+const StringType = 5
>+const ObjectType = 10
>+
>+# Type flags constants.
>+const MasqueradesAsUndefined = 1
>+const ImplementsHasInstance = 2
>+const ImplementsDefaultHasInstance = 8
>+
>+# Heap allocation constants.
>+const JSFinalObjectSizeClassIndex = 3
>+
>+# Bytecode operand constants.
>+const FirstConstantRegisterIndex = 0x40000000
>+
>+# Code type constants.
>+const GlobalCode = 0
>+const EvalCode = 1
>+const FunctionCode = 2
>+
>+# The interpreter steals the tag word of the argument count.
>+const LLIntReturnPC = ArgumentCount + TagOffset
>+
>+# This must match wtf/Vector.h.
>+const VectorSizeOffset = 0
>+const VectorBufferOffset = 4
>+
>+# String flags.
>+const HashFlags8BitBuffer = 64
>+
>+# Utilities
>+macro crash()
>+    storei 0, 0xbbadbeef[]
>+    move 0, t0
>+    call t0
>+end
>+
>+macro assert(assertion)
>+    if ASSERT_ENABLED
>+        assertion(.ok)
>+        crash()
>+    .ok:
>+    end
>+end
>+
>+macro preserveReturnAddressAfterCall(destinationRegister)
>+    if ARMv7
>+        move lr, destinationRegister
>+    elsif X86
>+        pop destinationRegister
>+    else
>+        error
>+    end
>+end
>+
>+macro restoreReturnAddressBeforeReturn(sourceRegister)
>+    if ARMv7
>+        move sourceRegister, lr
>+    elsif X86
>+        push sourceRegister
>+    else
>+        error
>+    end
>+end
>+
>+macro dispatch(advance)
>+    addp advance * 4, PC
>+    jmp [PC]
>+end
>+
>+macro dispatchBranchWithOffset(pcOffset)
>+    lshifti 2, pcOffset
>+    addp pcOffset, PC
>+    jmp [PC]
>+end
>+
>+macro dispatchBranch(pcOffset)
>+    loadi pcOffset, t0
>+    dispatchBranchWithOffset(t0)
>+end
>+
>+macro dispatchAfterCall()
>+    loadi ArgumentCount + TagOffset[cfr], PC
>+    jmp [PC]
>+end
>+
>+macro cCall2(function, arg1, arg2)
>+    if ARMv7
>+        move arg1, t0
>+        move arg2, t1
>+    elsif X86
>+        poke arg1, 0
>+        poke arg2, 1
>+    else
>+        error
>+    end
>+    call function
>+end
>+
>+# This barely works. arg3 and arg4 should probably be immediates.
>+macro cCall4(function, arg1, arg2, arg3, arg4)
>+    if ARMv7
>+        move arg1, t0
>+        move arg2, t1
>+        move arg3, t2
>+        move arg4, t3
>+    elsif X86
>+        poke arg1, 0
>+        poke arg2, 1
>+        poke arg3, 2
>+        poke arg4, 3
>+    else
>+        error
>+    end
>+    call function
>+end
>+
>+macro callHelper(helper)
>+    cCall2(helper, cfr, PC)
>+    move t0, PC
>+    move t1, cfr
>+end
>+
>+# Debugging operation if you'd like to print an operand in the instruction stream. fromWhere
>+# should be an immediate integer - any integer you like; use it to identify the place you're
>+# debugging from. operand should likewise be an immediate, and should identify the operand
>+# in the instruction stream you'd like to print out.
>+macro traceOperand(fromWhere, operand)
>+    cCall4(_llint_trace_operand, cfr, PC, fromWhere, operand)
>+    move t0, PC
>+    move t1, cfr
>+end
>+
>+# Debugging operation if you'd like to print the value of an operand in the instruction
>+# stream. Same as traceOperand(), but assumes that the operand is a register, and prints its
>+# value.
>+macro traceValue(fromWhere, operand)
>+    cCall4(_llint_trace_value, cfr, PC, fromWhere, operand)
>+    move t0, PC
>+    move t1, cfr
>+end
>+
>+macro traceExecution()
>+    if EXECUTION_TRACING
>+        callHelper(_llint_trace)
>+    end
>+end
>+
>+# Call a helper for call opcodes.
>+macro callCallHelper(advance, helper, action)
>+    addp advance * 4, PC, t0
>+    storep t0, ArgumentCount + TagOffset[cfr]
>+    cCall2(helper, cfr, PC)
>+    move t1, cfr
>+    action(t0)
>+end
>+
>+macro slowPathForCall(advance, helper)
>+    callCallHelper(
>+        advance,
>+        helper,
>+        macro (callee)
>+            call callee
>+            dispatchAfterCall()
>+        end)
>+end
>+
>+macro checkSwitchToJIT(increment, action)
>+    if JIT_ENABLED
>+        loadp CodeBlock[cfr], t0
>+        baddis increment, CodeBlock::m_llintExecuteCounter[t0], .continue
>+        action()
>+    .continue:
>+    end
>+end
>+
>+macro checkSwitchToJITForLoop()
>+    checkSwitchToJIT(
>+        1,
>+        macro ()
>+            storei PC, ArgumentCount + TagOffset[cfr]
>+            cCall2(_llint_loop_osr, cfr, PC)
>+            move t1, cfr
>+            btpz t0, .recover
>+            jmp t0
>+        .recover:
>+            loadi ArgumentCount + TagOffset[cfr], PC
>+        end)
>+end
>+
>+macro checkSwitchToJITForEpilogue()
>+    checkSwitchToJIT(
>+        10,
>+        macro ()
>+            callHelper(_llint_replace)
>+        end)
>+end
>+
>+macro assertNotConstant(index)
>+    assert(macro (ok) bilt index, FirstConstantRegisterIndex, ok end)
>+end
>+
>+# Index, tag, and payload must be different registers. Index is not
>+# changed.
>+macro loadConstantOrVariable(index, tag, payload)
>+    bigteq index, FirstConstantRegisterIndex, .constant
>+    loadi TagOffset[cfr, index, 8], tag
>+    loadi PayloadOffset[cfr, index, 8], payload
>+    jmp .done
>+.constant:
>+    loadp CodeBlock[cfr], payload
>+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
>+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
>+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
>+    loadp TagOffset[payload, index, 8], tag
>+    loadp PayloadOffset[payload, index, 8], payload
>+.done:
>+end
>+
>+# Index and payload may be the same register. Index may be clobbered.
>+macro loadConstantOrVariable2Reg(index, tag, payload)
>+    bigteq index, FirstConstantRegisterIndex, .constant
>+    loadi TagOffset[cfr, index, 8], tag
>+    loadi PayloadOffset[cfr, index, 8], payload
>+    jmp .done
>+.constant:
>+    loadp CodeBlock[cfr], tag
>+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
>+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
>+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
>+    lshifti 3, index
>+    addp index, tag
>+    loadp PayloadOffset[tag], payload
>+    loadp TagOffset[tag], tag
>+.done:
>+end
>+
>+macro loadConstantOrVariablePayloadTagCustom(index, tagCheck, payload)
>+    bigteq index, FirstConstantRegisterIndex, .constant
>+    tagCheck(TagOffset[cfr, index, 8])
>+    loadi PayloadOffset[cfr, index, 8], payload
>+    jmp .done
>+.constant:
>+    loadp CodeBlock[cfr], payload
>+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
>+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
>+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
>+    tagCheck(TagOffset[payload, index, 8])
>+    loadp PayloadOffset[payload, index, 8], payload
>+.done:
>+end
>+
>+# Index and payload must be different registers. Index is not mutated. Use
>+# this if you know what the tag of the variable should be. Doing the tag
>+# test as part of loading the variable reduces register use, but may not
>+# be faster than doing loadConstantOrVariable followed by a branch on the
>+# tag.
>+macro loadConstantOrVariablePayload(index, expectedTag, payload, slow)
>+    loadConstantOrVariablePayloadTagCustom(
>+        index,
>+        macro (actualTag) bineq actualTag, expectedTag, slow end,
>+        payload)
>+end
>+
>+macro loadConstantOrVariablePayloadUnchecked(index, payload)
>+    loadConstantOrVariablePayloadTagCustom(
>+        index,
>+        macro (actualTag) end,
>+        payload)
>+end
>+
>+macro writeBarrier(tag, payload)
>+    # Nothing to do, since we don't have a generational or incremental collector.
>+end
>+
>+macro valueProfile(tag, payload, profile)
>+    storei tag, ValueProfile::m_buckets + TagOffset[profile]
>+    storei payload, ValueProfile::m_buckets + PayloadOffset[profile]
>+end
>+
>+
>+# Indicate the beginning of LLInt.
>+_llint_begin:
>+    crash()
>+
>+
>+# Entrypoints into the interpreter
>+
>+macro functionForCallCodeBlockGetter(targetRegister)
>+    loadp Callee[cfr], targetRegister
>+    loadp JSFunction::m_executable[targetRegister], targetRegister
>+    loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
>+end
>+
>+macro functionForConstructCodeBlockGetter(targetRegister)
>+    loadp Callee[cfr], targetRegister
>+    loadp JSFunction::m_executable[targetRegister], targetRegister
>+    loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
>+end
>+
>+macro notFunctionCodeBlockGetter(targetRegister)
>+    loadp CodeBlock[cfr], targetRegister
>+end
>+
>+macro functionCodeBlockSetter(sourceRegister)
>+    storep sourceRegister, CodeBlock[cfr]
>+end
>+
>+macro notFunctionCodeBlockSetter(sourceRegister)
>+    # Nothing to do!
>+end
>+
>+# Do the bare minimum required to execute code. Sets up the PC, leave the CodeBlock*
>+# in t1. May also trigger prologue entry OSR.
>+macro prologue(codeBlockGetter, codeBlockSetter, osrHelper, traceHelper)
>+    preserveReturnAddressAfterCall(t2)
>+    
>+    # Set up the call frame and check if we should OSR.
>+    storep t2, ReturnPC[cfr]
>+    if EXECUTION_TRACING
>+        callHelper(traceHelper)
>+    end
>+    codeBlockGetter(t1)
>+    if JIT_ENABLED
>+        baddis 5, CodeBlock::m_llintExecuteCounter[t1], .continue
>+        cCall2(osrHelper, cfr, PC)
>+        move t1, cfr
>+        btpz t0, .recover
>+        loadp ReturnPC[cfr], t2
>+        restoreReturnAddressBeforeReturn(t2)
>+        jmp t0
>+    .recover:
>+        codeBlockGetter(t1)
>+    .continue:
>+    end
>+    codeBlockSetter(t1)
>+    
>+    # Set up the PC.
>+    loadp CodeBlock::m_instructions[t1], t0
>+    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
>+end
>+
>+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
>+# Must call dispatch(0) after calling this.
>+macro functionInitialization(profileArgSkip)
>+    # Profile the arguments. Unfortunately, we have no choice but to do this. This
>+    # code is pretty horrendous because of the difference in ordering between
>+    # arguments and value profiles, the desire to have a simple loop-down-to-zero
>+    # loop, and the desire to use only three registers so as to preserve the PC and
>+    # the code block. It is likely that this code should be rewritten in a more
>+    # optimal way for architectures that have more than five registers available
>+    # for arbitrary use in the interpreter.
>+    loadi CodeBlock::m_numParameters[t1], t0
>+    addi -profileArgSkip, t0 # Use addi because that's what has the peephole
>+    assert(macro (ok) bigteq t0, 0, ok end)
>+    btiz t0, .argumentProfileDone
>+    loadp CodeBlock::m_argumentValueProfiles + VectorBufferOffset[t1], t3
>+    muli sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
>+    negi t0
>+    lshifti 3, t0
>+    addp t2, t3
>+.argumentProfileLoop:
>+    loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
>+    subp sizeof ValueProfile, t3
>+    storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
>+    loadi ThisArgumentOffset + PayloadOffset + 8 - profileArgSkip * 8[cfr, t0], t2
>+    storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
>+    baddinz 8, t0, .argumentProfileLoop
>+.argumentProfileDone:
>+    
>+    # Check stack height.
>+    loadi CodeBlock::m_numCalleeRegisters[t1], t0
>+    loadp CodeBlock::m_globalData[t1], t2
>+    loadp JSGlobalData::interpreter[t2], t2   # FIXME: Can get to the RegisterFile from the JITStackFrame
>+    lshifti 3, t0
>+    addp t0, cfr, t0
>+    bpaeq Interpreter::m_registerFile + RegisterFile::m_end[t2], t0, .stackHeightOK
>+
>+    # Stack height check failed - need to call a helper.
>+    callHelper(_llint_register_file_check)
>+.stackHeightOK:
>+end
>+
>+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
>+macro functionArityCheck(doneLabel, helper)
>+    loadi PayloadOffset + ArgumentCount[cfr], t0
>+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
>+    cCall2(helper, cfr, PC)   # This helper has a simple protocol: t0 = 0 => no error, t0 != 0 => error
>+    move t1, cfr
>+    btiz t0, .continue
>+    loadp JITStackFrame::globalData[sp], t1
>+    loadp JSGlobalData::callFrameForThrow[t1], t0
>+    jmp JSGlobalData::targetMachinePCForThrow[t1]
>+.continue:
>+    # Reload CodeBlock and PC, since the helper clobbered it.
>+    loadp CodeBlock[cfr], t1
>+    loadp CodeBlock::m_instructions[t1], t0
>+    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
>+    jmp doneLabel
>+end
>+
>+_llint_program_prologue:
>+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
>+    dispatch(0)
>+
>+
>+_llint_eval_prologue:
>+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
>+    dispatch(0)
>+
>+
>+_llint_function_for_call_prologue:
>+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call, _llint_trace_prologue_function_for_call)
>+.functionForCallBegin:
>+    functionInitialization(0)
>+    dispatch(0)
>+    
>+
>+_llint_function_for_construct_prologue:
>+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct, _llint_trace_prologue_function_for_construct)
>+.functionForConstructBegin:
>+    functionInitialization(1)
>+    dispatch(0)
>+    
>+
>+_llint_function_for_call_arity_check:
>+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call_arityCheck, _llint_trace_arityCheck_for_call)
>+    functionArityCheck(.functionForCallBegin, _llint_helper_call_arityCheck)
>+
>+
>+_llint_function_for_construct_arity_check:
>+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct_arityCheck, _llint_trace_arityCheck_for_construct)
>+    functionArityCheck(.functionForConstructBegin, _llint_helper_construct_arityCheck)
>+
>+# Instruction implementations
>+
>+_llint_op_enter:
>+    traceExecution()
>+    loadp CodeBlock[cfr], t2
>+    loadi CodeBlock::m_numVars[t2], t2
>+    btiz t2, .opEnterDone
>+    move UndefinedTag, t0
>+    move 0, t1
>+.opEnterLoop:
>+    subi 1, t2
>+    storei t0, TagOffset[cfr, t2, 8]
>+    storei t1, PayloadOffset[cfr, t2, 8]
>+    btinz t2, .opEnterLoop
>+.opEnterDone:
>+    dispatch(1)
>+
>+
>+_llint_op_create_activation:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateActivationDone
>+    callHelper(_llint_helper_create_activation)
>+.opCreateActivationDone:
>+    dispatch(2)
>+
>+
>+_llint_op_init_lazy_reg:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    storei EmptyValueTag, TagOffset[cfr, t0, 8]
>+    storei 0, PayloadOffset[cfr, t0, 8]
>+    dispatch(2)
>+
>+
>+_llint_op_create_arguments:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateArgumentsDone
>+    callHelper(_llint_helper_create_arguments)
>+.opCreateArgumentsDone:
>+    dispatch(2)
>+
>+
>+macro allocateBasicJSObject(sizeClassIndex, classInfoOffset, structure, result, scratch1, scratch2, slowCase)
>+    const offsetOfMySizeClass = JSGlobalData::heap + Heap::m_objectSpace + MarkedSpace::m_preciseSizeClasses + sizeClassIndex * sizeof MarkedSpace::SizeClass
>+    
>+    # FIXME: we can get the global data in one load from the stack.
>+    loadp CodeBlock[cfr], scratch1
>+    loadp CodeBlock::m_globalData[scratch1], scratch1
>+    
>+    # Get the object from the free list.    
>+    loadp offsetOfMySizeClass + MarkedSpace::SizeClass::firstFreeCell[scratch1], result
>+    btpz result, slowCase
>+    
>+    # Remove the object from the free list.
>+    loadp [result], scratch2
>+    storep scratch2, offsetOfMySizeClass + MarkedSpace::SizeClass::firstFreeCell[scratch1]
>+
>+    # Initialize the object.
>+    loadp classInfoOffset[scratch1], scratch2
>+    storep scratch2, [result]
>+    storep structure, JSCell::m_structure[result]
>+    storep 0, JSObject::m_inheritorID[result]
>+    addp sizeof JSObject, result, scratch1
>+    storep scratch1, JSObject::m_propertyStorage[result]
>+end
>+
>+_llint_op_create_this:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    assertNotConstant(t0)
>+    bineq TagOffset[cfr, t0, 8], CellTag, .opCreateThisSlow
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    loadp JSCell::m_structure[t0], t1
>+    bbb Structure::m_typeInfo + TypeInfo::m_type[t1], ObjectType, .opCreateThisSlow
>+    loadp JSObject::m_inheritorID[t0], t2
>+    btpz t2, .opCreateThisSlow
>+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t2, t0, t1, t3, .opCreateThisSlow)
>+    loadi 4[PC], t1
>+    storei CellTag, TagOffset[cfr, t1, 8]
>+    storei t0, PayloadOffset[cfr, t1, 8]
>+    dispatch(3)
>+
>+.opCreateThisSlow:
>+    callHelper(_llint_helper_create_this)
>+    dispatch(3)
>+
>+
>+_llint_op_get_callee:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    loadp PayloadOffset + Callee[cfr], t1
>+    storei CellTag, TagOffset[cfr, t0, 8]
>+    storei t1, PayloadOffset[cfr, t0, 8]
>+    dispatch(2)
>+
>+
>+_llint_op_convert_this:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    loadp JSCell::m_structure[t0], t0
>+    bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
>+    dispatch(2)
>+
>+.opConvertThisSlow:
>+    callHelper(_llint_helper_convert_this)
>+    dispatch(2)
>+
>+
>+_llint_op_new_object:
>+    traceExecution()
>+    loadp CodeBlock[cfr], t0
>+    loadp CodeBlock::m_globalObject[t0], t0
>+    loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
>+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t1, t0, t2, t3, .opNewObjectSlow)
>+    loadi 4[PC], t1
>+    storei CellTag, TagOffset[cfr, t1, 8]
>+    storei t0, PayloadOffset[cfr, t1, 8]
>+    dispatch(2)
>+
>+.opNewObjectSlow:
>+    callHelper(_llint_helper_new_object)
>+    dispatch(2)
>+
>+
>+_llint_op_new_array:
>+    traceExecution()
>+    callHelper(_llint_helper_new_array)
>+    dispatch(4)
>+
>+
>+_llint_op_new_array_buffer:
>+    traceExecution()
>+    callHelper(_llint_helper_new_array_buffer)
>+    dispatch(4)
>+
>+
>+_llint_op_new_regexp:
>+    traceExecution()
>+    callHelper(_llint_helper_new_regexp)
>+    dispatch(3)
>+
>+
>+_llint_op_mov:
>+    traceExecution()
>+    loadi 8[PC], t1
>+    loadi 4[PC], t0
>+    loadConstantOrVariable(t1, t2, t3)
>+    storei t2, TagOffset[cfr, t0, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+    dispatch(3)
>+
>+
>+_llint_op_not:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t1
>+    loadConstantOrVariable(t0, t2, t3)
>+    bineq t2, BooleanTag, .opNotSlow
>+    xori 1, t3
>+    storei t2, TagOffset[cfr, t1, 8]
>+    storei t3, PayloadOffset[cfr, t1, 8]
>+    dispatch(3)
>+
>+.opNotSlow:
>+    callHelper(_llint_helper_not)
>+    dispatch(3)
>+
>+
>+_llint_op_eq:
>+    traceExecution()
>+    loadi 12[PC], t2
>+    loadi 8[PC], t0
>+    loadConstantOrVariable(t2, t3, t1)
>+    loadConstantOrVariable2Reg(t0, t2, t0)
>+    bineq t2, t3, .opEqSlow
>+    bieq t2, CellTag, .opEqSlow
>+    bib t2, LowestTag, .opEqSlow
>+    loadi 4[PC], t2
>+    cieq t0, t1, t0
>+    storei BooleanTag, TagOffset[cfr, t2, 8]
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    dispatch(4)
>+
>+.opEqSlow:
>+    callHelper(_llint_helper_eq)
>+    dispatch(4)
>+
>+
>+_llint_op_eq_null:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t3
>+    assertNotConstant(t0)
>+    loadi TagOffset[cfr, t0, 8], t1
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    bineq t1, CellTag, .opEqNullImmediate
>+    loadp JSCell::m_structure[t0], t1
>+    tbnz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
>+    jmp .opEqNullNotImmediate
>+.opEqNullImmediate:
>+    cieq t1, NullTag, t2
>+    cieq t1, UndefinedTag, t1
>+    ori t2, t1
>+.opEqNullNotImmediate:
>+    storei BooleanTag, TagOffset[cfr, t3, 8]
>+    storei t1, PayloadOffset[cfr, t3, 8]
>+    dispatch(3)
>+
>+
>+_llint_op_neq:
>+    traceExecution()
>+    loadi 12[PC], t2
>+    loadi 8[PC], t0
>+    loadConstantOrVariable(t2, t3, t1)
>+    loadConstantOrVariable2Reg(t0, t2, t0)
>+    bineq t2, t3, .opNeqSlow
>+    bieq t2, CellTag, .opNeqSlow
>+    bib t2, LowestTag, .opNeqSlow
>+    loadi 4[PC], t2
>+    cineq t0, t1, t0
>+    storei BooleanTag, TagOffset[cfr, t2, 8]
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    dispatch(4)
>+
>+.opNeqSlow:
>+    callHelper(_llint_helper_neq)
>+    dispatch(4)
>+    
>+
>+_llint_op_neq_null:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t3
>+    assertNotConstant(t0)
>+    loadi TagOffset[cfr, t0, 8], t1
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    bineq t1, CellTag, .opNeqNullImmediate
>+    loadp JSCell::m_structure[t0], t1
>+    tbz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
>+    jmp .opNeqNullNotImmediate
>+.opNeqNullImmediate:
>+    cineq t1, NullTag, t2
>+    cineq t1, UndefinedTag, t1
>+    andi t2, t1
>+.opNeqNullNotImmediate:
>+    storei BooleanTag, TagOffset[cfr, t3, 8]
>+    storei t1, PayloadOffset[cfr, t3, 8]
>+    dispatch(3)
>+
>+
>+macro strictEq(equalityOperation, helper)
>+    loadi 12[PC], t2
>+    loadi 8[PC], t0
>+    loadConstantOrVariable(t2, t3, t1)
>+    loadConstantOrVariable2Reg(t0, t2, t0)
>+    bineq t2, t3, .slow
>+    bib t2, LowestTag, .slow
>+    bineq t2, CellTag, .notString
>+    loadp JSCell::m_structure[t0], t2
>+    loadp JSCell::m_structure[t1], t3
>+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .notString
>+    bbeq Structure::m_typeInfo + TypeInfo::m_type[t3], StringType, .slow
>+.notString:
>+    loadi 4[PC], t2
>+    equalityOperation(t0, t1, t0)
>+    storei BooleanTag, TagOffset[cfr, t2, 8]
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    dispatch(4)
>+
>+.slow:
>+    callHelper(helper)
>+    dispatch(4)
>+end
>+
>+_llint_op_stricteq:
>+    traceExecution()
>+    strictEq(macro (left, right, result) cieq left, right, result end, _llint_helper_stricteq)
>+
>+
>+_llint_op_nstricteq:
>+    traceExecution()
>+    strictEq(macro (left, right, result) cineq left, right, result end, _llint_helper_nstricteq)
>+
>+
>+_llint_op_less:
>+    traceExecution()
>+    callHelper(_llint_helper_less)
>+    dispatch(4)
>+
>+
>+_llint_op_lesseq:
>+    traceExecution()
>+    callHelper(_llint_helper_lesseq)
>+    dispatch(4)
>+
>+
>+_llint_op_greater:
>+    traceExecution()
>+    callHelper(_llint_helper_greater)
>+    dispatch(4)
>+
>+
>+_llint_op_greatereq:
>+    traceExecution()
>+    callHelper(_llint_helper_greatereq)
>+    dispatch(4)
>+
>+
>+_llint_op_pre_inc:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreIncSlow
>+    loadi PayloadOffset[cfr, t0, 8], t1
>+    baddio 1, t1, .opPreIncSlow
>+    storei t1, PayloadOffset[cfr, t0, 8]
>+    dispatch(2)
>+
>+.opPreIncSlow:
>+    callHelper(_llint_helper_pre_inc)
>+    dispatch(2)
>+
>+
>+_llint_op_pre_dec:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreDecSlow
>+    loadi PayloadOffset[cfr, t0, 8], t1
>+    bsubio 1, t1, .opPreDecSlow
>+    storei t1, PayloadOffset[cfr, t0, 8]
>+    dispatch(2)
>+
>+.opPreDecSlow:
>+    callHelper(_llint_helper_pre_dec)
>+    dispatch(2)
>+
>+
>+_llint_op_post_inc:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t1
>+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostIncSlow
>+    bieq t0, t1, .opPostIncDone
>+    loadi PayloadOffset[cfr, t0, 8], t2
>+    move t2, t3
>+    baddio 1, t3, .opPostIncSlow
>+    storei Int32Tag, TagOffset[cfr, t1, 8]
>+    storei t2, PayloadOffset[cfr, t1, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+.opPostIncDone:
>+    dispatch(3)
>+
>+.opPostIncSlow:
>+    callHelper(_llint_helper_post_inc)
>+    dispatch(3)
>+
>+
>+_llint_op_post_dec:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t1
>+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostDecSlow
>+    bieq t0, t1, .opPostDecDone
>+    loadi PayloadOffset[cfr, t0, 8], t2
>+    move t2, t3
>+    bsubio 1, t3, .opPostDecSlow
>+    storei Int32Tag, TagOffset[cfr, t1, 8]
>+    storei t2, PayloadOffset[cfr, t1, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+.opPostDecDone:
>+    dispatch(3)
>+
>+.opPostDecSlow:
>+    callHelper(_llint_helper_post_dec)
>+    dispatch(3)
>+
>+
>+_llint_op_to_jsnumber:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t1
>+    loadConstantOrVariable(t0, t2, t3)
>+    bieq t2, Int32Tag, .opToJsnumberIsInt
>+    biaeq t2, EmptyValueTag, .opToJsnumberSlow
>+.opToJsnumberIsInt:
>+    storei t2, TagOffset[cfr, t1, 8]
>+    storei t3, PayloadOffset[cfr, t1, 8]
>+    dispatch(3)
>+
>+.opToJsnumberSlow:
>+    callHelper(_llint_helper_to_jsnumber)
>+    dispatch(3)
>+
>+
>+_llint_op_negate:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t3
>+    loadConstantOrVariable(t0, t1, t2)
>+    bineq t1, Int32Tag, .opNegateSrcNotInt
>+    btiz t2, 0x7fffffff, .opNegateSlow
>+    negi t2
>+    storei Int32Tag, TagOffset[cfr, t3, 8]
>+    storei t2, PayloadOffset[cfr, t3, 8]
>+    dispatch(3)
>+.opNegateSrcNotInt:
>+    bia t1, LowestTag, .opNegateSlow
>+    xori 0x80000000, t1
>+    storei t1, TagOffset[cfr, t3, 8]
>+    storei t2, PayloadOffset[cfr, t3, 8]
>+    dispatch(3)
>+
>+.opNegateSlow:
>+    callHelper(_llint_helper_negate)
>+    dispatch(3)
>+
>+
>+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, helper)
>+    loadi 12[PC], t2
>+    loadi 8[PC], t0
>+    loadConstantOrVariable(t2, t3, t1)
>+    loadConstantOrVariable2Reg(t0, t2, t0)
>+    bineq t2, Int32Tag, .op1NotInt
>+    bineq t3, Int32Tag, .op2NotInt
>+    loadi 4[PC], t2
>+    integerOperationAndStore(t3, t1, t0, .slow, t2)
>+    dispatch(5)
>+
>+.op1NotInt:
>+    # First operand is definitely not an int, the second operand could be anything.
>+    bia t2, LowestTag, .slow
>+    bib t3, LowestTag, .op1NotIntOp2Double
>+    bineq t3, Int32Tag, .slow
>+    ci2d t1, ft1
>+    jmp .op1NotIntReady
>+.op1NotIntOp2Double:
>+    fii2d t1, t3, ft1
>+.op1NotIntReady:
>+    loadi 4[PC], t1
>+    fii2d t0, t2, ft0
>+    doubleOperation(ft1, ft0)
>+    stored ft0, [cfr, t1, 8]
>+    dispatch(5)
>+
>+.op2NotInt:
>+    # First operand is definitely an int, the second operand is definitely not.
>+    loadi 4[PC], t2
>+    bia t3, LowestTag, .slow
>+    ci2d t0, ft0
>+    fii2d t1, t3, ft1
>+    doubleOperation(ft1, ft0)
>+    stored ft0, [cfr, t2, 8]
>+    dispatch(5)
>+
>+.slow:
>+    callHelper(helper)
>+    dispatch(5)
>+end
>+
>+macro binaryOp(integerOperation, doubleOperation, helper)
>+    binaryOpCustomStore(
>+        macro (int32Tag, left, right, slow, index)
>+            integerOperation(left, right, slow)
>+            storei int32Tag, TagOffset[cfr, index, 8]
>+            storei right, PayloadOffset[cfr, index, 8]
>+        end,
>+        doubleOperation, helper)
>+end
>+
>+_llint_op_add:
>+    traceExecution()
>+    binaryOp(
>+        macro (left, right, slow) baddio left, right, slow end,
>+        macro (left, right) addd left, right end,
>+        _llint_helper_add)
>+
>+
>+_llint_op_mul:
>+    traceExecution()
>+    binaryOpCustomStore(
>+        macro (int32Tag, left, right, slow, index)
>+            const scratch = int32Tag   # We know that we can reuse the int32Tag register since it has a constant.
>+            move right, scratch
>+            bmulio left, scratch, slow
>+            btinz scratch, .done
>+            bilt left, 0, .slow
>+            bilt right, 0, .slow
>+        .done:
>+            storei Int32Tag, TagOffset[cfr, index, 8]
>+            storei scratch, PayloadOffset[cfr, index, 8]
>+        end,
>+        macro (left, right) muld left, right end,
>+        _llint_helper_mul)
>+
>+
>+_llint_op_sub:
>+    traceExecution()
>+    binaryOp(
>+        macro (left, right, slow) bsubio left, right, slow end,
>+        macro (left, right) subd left, right end,
>+        _llint_helper_sub)
>+
>+
>+_llint_op_div:
>+    traceExecution()
>+    binaryOpCustomStore(
>+        macro (int32Tag, left, right, slow, index)
>+            ci2d left, ft0
>+            ci2d right, ft1
>+            divd ft0, ft1
>+            bcd2i ft1, right, .notInt
>+            storei int32Tag, TagOffset[cfr, index, 8]
>+            storei right, PayloadOffset[cfr, index, 8]
>+            jmp .done
>+        .notInt:
>+            stored ft1, [cfr, index, 8]
>+        .done:
>+        end,
>+        macro (left, right) divd left, right end,
>+        _llint_helper_div)
>+
>+
>+_llint_op_mod:
>+    traceExecution()
>+    callHelper(_llint_helper_mod)
>+    dispatch(4)
>+
>+
>+macro bitOp(operation, helper, advance)
>+    loadi 12[PC], t2
>+    loadi 8[PC], t0
>+    loadConstantOrVariable(t2, t3, t1)
>+    loadConstantOrVariable2Reg(t0, t2, t0)
>+    bineq t3, Int32Tag, .slow
>+    bineq t2, Int32Tag, .slow
>+    loadi 4[PC], t2
>+    operation(t1, t0, .slow)
>+    storei t3, TagOffset[cfr, t2, 8]
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    dispatch(advance)
>+
>+.slow:
>+    callHelper(helper)
>+    dispatch(advance)
>+end
>+
>+_llint_op_lshift:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow) lshifti left, right end,
>+        _llint_helper_lshift,
>+        4)
>+
>+
>+_llint_op_rshift:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow) rshifti left, right end,
>+        _llint_helper_rshift,
>+        4)
>+
>+
>+_llint_op_urshift:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow)
>+            urshifti left, right
>+            bilt right, 0, slow
>+        end,
>+        _llint_helper_urshift,
>+        4)
>+
>+
>+_llint_op_bitand:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow) andi left, right end,
>+        _llint_helper_bitand,
>+        5)
>+
>+
>+_llint_op_bitxor:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow) xori left, right end,
>+        _llint_helper_bitxor,
>+        5)
>+
>+
>+_llint_op_bitor:
>+    traceExecution()
>+    bitOp(
>+        macro (left, right, slow) ori left, right end,
>+        _llint_helper_bitor,
>+        5)
>+
>+
>+_llint_op_bitnot:
>+    traceExecution()
>+    loadi 8[PC], t1
>+    loadi 4[PC], t0
>+    loadConstantOrVariable(t1, t2, t3)
>+    bineq t2, Int32Tag, .opBitnotSlow
>+    noti t3
>+    storei t2, TagOffset[cfr, t0, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+    dispatch(3)
>+
>+.opBitnotSlow:
>+    callHelper(_llint_helper_bitnot)
>+    dispatch(3)
>+
>+
>+_llint_op_check_has_instance:
>+    traceExecution()
>+    loadi 4[PC], t1
>+    loadConstantOrVariablePayload(t1, CellTag, t0, .opCheckHasInstanceSlow)
>+    loadp JSCell::m_structure[t0], t0
>+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsHasInstance, .opCheckHasInstanceSlow
>+    dispatch(2)
>+
>+.opCheckHasInstanceSlow:
>+    callHelper(_llint_helper_check_has_instance)
>+    dispatch(2)
>+
>+
>+_llint_op_instanceof:
>+    traceExecution()
>+    # Check that baseVal implements the default HasInstance behavior.
>+    # FIXME: This should be deprecated.
>+    loadi 12[PC], t1
>+    loadConstantOrVariablePayloadUnchecked(t1, t0)
>+    loadp JSCell::m_structure[t0], t0
>+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opInstanceofSlow
>+    
>+    # Actually do the work.
>+    loadi 16[PC], t0
>+    loadi 4[PC], t3
>+    loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
>+    loadp JSCell::m_structure[t1], t2
>+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
>+    loadi 8[PC], t0
>+    loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
>+    
>+    # Register state: t1 = prototype, t2 = value
>+    move 1, t0
>+.opInstanceofLoop:
>+    loadp JSCell::m_structure[t2], t2
>+    loadi Structure::m_prototype + PayloadOffset[t2], t2
>+    bpeq t2, t1, .opInstanceofDone
>+    btinz t2, .opInstanceofLoop
>+
>+    move 0, t0
>+.opInstanceofDone:
>+    storei BooleanTag, TagOffset[cfr, t3, 8]
>+    storei t0, PayloadOffset[cfr, t3, 8]
>+    dispatch(5)
>+
>+.opInstanceofSlow:
>+    callHelper(_llint_helper_instanceof)
>+    dispatch(5)
>+
>+
>+_llint_op_typeof:
>+    traceExecution()
>+    callHelper(_llint_helper_typeof)
>+    dispatch(3)
>+
>+
>+_llint_op_is_undefined:
>+    traceExecution()
>+    callHelper(_llint_helper_is_undefined)
>+    dispatch(3)
>+
>+
>+_llint_op_is_boolean:
>+    traceExecution()
>+    callHelper(_llint_helper_is_boolean)
>+    dispatch(3)
>+
>+
>+_llint_op_is_number:
>+    traceExecution()
>+    callHelper(_llint_helper_is_number)
>+    dispatch(3)
>+
>+
>+_llint_op_is_string:
>+    traceExecution()
>+    callHelper(_llint_helper_is_string)
>+    dispatch(3)
>+
>+
>+_llint_op_is_object:
>+    traceExecution()
>+    callHelper(_llint_helper_is_object)
>+    dispatch(3)
>+
>+
>+_llint_op_is_function:
>+    traceExecution()
>+    callHelper(_llint_helper_is_function)
>+    dispatch(3)
>+
>+
>+_llint_op_in:
>+    traceExecution()
>+    callHelper(_llint_helper_in)
>+    dispatch(4)
>+
>+
>+_llint_op_resolve:
>+    traceExecution()
>+    callHelper(_llint_helper_resolve)
>+    dispatch(4)
>+
>+
>+_llint_op_resolve_skip:
>+    traceExecution()
>+    callHelper(_llint_helper_resolve_skip)
>+    dispatch(5)
>+
>+
>+macro resolveGlobal(size, slow)
>+    # Operands are as follows:
>+    # 4[PC]   Destination for the load.
>+    # 8[PC]   Property identifier index in the code block.
>+    # 12[PC]  Structure pointer, initialized to 0 by bytecode generator.
>+    # 16[PC]  Offset in global object, initialized to 0 by bytecode generator.
>+    loadp CodeBlock[cfr], t0
>+    loadp CodeBlock::m_globalObject[t0], t0
>+    loadp JSCell::m_structure[t0], t1
>+    bpneq t1, 12[PC], slow
>+    loadi 16[PC], t1
>+    loadp JSObject::m_propertyStorage[t0], t0
>+    loadi TagOffset[t0, t1, 8], t2
>+    loadi PayloadOffset[t0, t1, 8], t3
>+    loadi 4[PC], t0
>+    storei t2, TagOffset[cfr, t0, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+    loadi (size - 1) * 4[PC], t0
>+    valueProfile(t2, t3, t0)
>+end
>+
>+_llint_op_resolve_global:
>+    traceExecution()
>+    resolveGlobal(6, .opResolveGlobalSlow)
>+    dispatch(6)
>+
>+.opResolveGlobalSlow:
>+    callHelper(_llint_helper_resolve_global)
>+    dispatch(6)
>+
>+
>+# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
>+# scopes as they are traversed. scopeCheck() is called with two arguments: the register
>+# holding the scope, and a register that can be used for scratch. Note that this does not
>+# use t3, so you can hold stuff in t3 if need be.
>+macro getScope(deBruijinIndexOperand, scopeCheck)
>+    loadp ScopeChain + PayloadOffset[cfr], t0
>+    loadi deBruijinIndexOperand, t2
>+    
>+    btiz t2, .done
>+    
>+    loadp CodeBlock[cfr], t1
>+    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
>+    btbz CodeBlock::m_needsFullScopeChain[t1], .loop
>+    
>+    loadi CodeBlock::m_activationRegister[t1], t1
>+
>+    # Need to conditionally skip over one scope.
>+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .noActivation
>+    scopeCheck(t0, t1)
>+    loadp ScopeChainNode::next[t0], t0
>+.noActivation:
>+    subi 1, t2
>+    
>+    btiz t2, .done
>+.loop:
>+    scopeCheck(t0, t1)
>+    loadp ScopeChainNode::next[t0], t0
>+    subi 1, t2
>+    btinz t2, .loop
>+
>+.done:
>+end
>+
>+_llint_op_resolve_global_dynamic:
>+    traceExecution()
>+    loadp JITStackFrame::globalData[sp], t3
>+    loadp JSGlobalData::activationStructure[t3], t3
>+    getScope(
>+        20[PC],
>+        macro (scope, scratch)
>+            loadp ScopeChainNode::object[scope], scratch
>+            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
>+        end)
>+    resolveGlobal(7, .opResolveGlobalDynamicSlow)
>+    dispatch(7)
>+
>+.opResolveGlobalDynamicSuperSlow:
>+    callHelper(_llint_helper_resolve_for_resolve_global_dynamic)
>+    dispatch(7)
>+
>+.opResolveGlobalDynamicSlow:
>+    callHelper(_llint_helper_resolve_global_dynamic)
>+    dispatch(7)
>+
>+
>+_llint_op_get_scoped_var:
>+    traceExecution()
>+    # Operands are as follows:
>+    # 4[PC]   Destination for the load.
>+    # 8[PC]   Index of register in the scope.
>+    # 12[PC]  De Bruijin index.
>+    getScope(12[PC], macro (scope, scratch) end)
>+    loadi 4[PC], t1
>+    loadi 8[PC], t2
>+    loadp ScopeChainNode::object[t0], t0
>+    loadp JSVariableObject::m_registers[t0], t0
>+    loadi TagOffset[t0, t2, 8], t3
>+    loadi PayloadOffset[t0, t2, 8], t0
>+    storei t3, TagOffset[cfr, t1, 8]
>+    storei t0, PayloadOffset[cfr, t1, 8]
>+    loadi 16[PC], t1
>+    valueProfile(t3, t0, t1)
>+    dispatch(5)
>+
>+
>+_llint_op_put_scoped_var:
>+    traceExecution()
>+    getScope(8[PC], macro (scope, scratch) end)
>+    loadi 12[PC], t1
>+    loadConstantOrVariable(t1, t3, t2)
>+    loadi 4[PC], t1
>+    writeBarrier(t3, t2)
>+    loadp ScopeChainNode::object[t0], t0
>+    loadp JSVariableObject::m_registers[t0], t0
>+    storei t3, TagOffset[t0, t1, 8]
>+    storei t2, PayloadOffset[t0, t1, 8]
>+    dispatch(4)
>+
>+
>+_llint_op_get_global_var:
>+    traceExecution()
>+    loadi 8[PC], t1
>+    loadi 4[PC], t3
>+    loadp CodeBlock[cfr], t0
>+    loadp CodeBlock::m_globalObject[t0], t0
>+    loadp JSGlobalObject::m_registers[t0], t0
>+    loadi TagOffset[t0, t1, 8], t2
>+    loadi PayloadOffset[t0, t1, 8], t1
>+    storei t2, TagOffset[cfr, t3, 8]
>+    storei t1, PayloadOffset[cfr, t3, 8]
>+    loadi 12[PC], t3
>+    valueProfile(t2, t1, t3)
>+    dispatch(4)
>+
>+
>+_llint_op_put_global_var:
>+    traceExecution()
>+    loadi 8[PC], t1
>+    loadp CodeBlock[cfr], t0
>+    loadp CodeBlock::m_globalObject[t0], t0
>+    loadp JSGlobalObject::m_registers[t0], t0
>+    loadConstantOrVariable(t1, t2, t3)
>+    loadi 4[PC], t1
>+    writeBarrier(t2, t3)
>+    storei t2, TagOffset[t0, t1, 8]
>+    storei t3, PayloadOffset[t0, t1, 8]
>+    dispatch(3)
>+
>+
>+_llint_op_resolve_base:
>+    traceExecution()
>+    callHelper(_llint_helper_resolve_base)
>+    dispatch(5)
>+
>+
>+_llint_op_ensure_property_exists:
>+    traceExecution()
>+    callHelper(_llint_helper_ensure_property_exists)
>+    dispatch(3)
>+
>+
>+_llint_op_resolve_with_base:
>+    traceExecution()
>+    callHelper(_llint_helper_resolve_with_base)
>+    dispatch(5)
>+
>+
>+_llint_op_resolve_with_this:
>+    traceExecution()
>+    callHelper(_llint_helper_resolve_with_this)
>+    dispatch(5)
>+
>+
>+_llint_op_get_by_id:
>+    traceExecution()
>+    # We only do monomorphic get_by_id caching for now, and we do not modify the
>+    # opcode. We do, however, allow for the cache to change anytime if fails, since
>+    # ping-ponging is free. At best we get lucky and the get_by_id will continue
>+    # to take fast path on the new cache. At worst we take slow path, which is what
>+    # we would have been doing anyway.
>+    loadi 8[PC], t0
>+    loadi 16[PC], t1
>+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
>+    loadi 20[PC], t2
>+    loadp JSObject::m_propertyStorage[t3], t0
>+    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
>+    loadi 4[PC], t1
>+    loadi TagOffset[t0, t2], t3
>+    loadi PayloadOffset[t0, t2], t2
>+    storei t3, TagOffset[cfr, t1, 8]
>+    storei t2, PayloadOffset[cfr, t1, 8]
>+    loadi 32[PC], t1
>+    valueProfile(t3, t2, t1)
>+    dispatch(9)
>+
>+.opGetByIdSlow:
>+    callHelper(_llint_helper_get_by_id)
>+    dispatch(9)
>+
>+
>+_llint_op_get_arguments_length:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 4[PC], t1
>+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentsLengthSlow
>+    loadi ArgumentCount + PayloadOffset[cfr], t2
>+    subi 1, t2
>+    storei Int32Tag, TagOffset[cfr, t1, 8]
>+    storei t2, PayloadOffset[cfr, t1, 8]
>+    dispatch(4)
>+
>+.opGetArgumentsLengthSlow:
>+    callHelper(_llint_helper_get_arguments_length)
>+    dispatch(4)
>+
>+
>+_llint_op_put_by_id:
>+    traceExecution()
>+    loadi 4[PC], t3
>+    loadi 16[PC], t1
>+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
>+    loadi 12[PC], t2
>+    loadp JSObject::m_propertyStorage[t0], t3
>+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
>+    loadi 20[PC], t1
>+    loadConstantOrVariable2Reg(t2, t0, t2)
>+    writeBarrier(t0, t2)
>+    storei t0, TagOffset[t3, t1]
>+    storei t2, PayloadOffset[t3, t1]
>+    dispatch(9)
>+
>+.opPutByIdSlow:
>+    callHelper(_llint_helper_put_by_id)
>+    dispatch(9)
>+
>+
>+macro putByIdTransition(additionalChecks)
>+    traceExecution()
>+    loadi 4[PC], t3
>+    loadi 16[PC], t1
>+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
>+    loadi 12[PC], t2
>+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
>+    additionalChecks(t1, t3, .opPutByIdSlow)
>+    loadi 20[PC], t1
>+    loadp JSObject::m_propertyStorage[t0], t3
>+    addp t1, t3
>+    loadConstantOrVariable2Reg(t2, t1, t2)
>+    writeBarrier(t1, t2)
>+    storei t1, TagOffset[t3]
>+    loadi 24[PC], t1
>+    storei t2, PayloadOffset[t3]
>+    storep t1, JSCell::m_structure[t0]
>+    dispatch(9)
>+end
>+
>+_llint_op_put_by_id_transition_direct:
>+    putByIdTransition(macro (oldStructure, scratch, slow) end)
>+
>+
>+_llint_op_put_by_id_transition_normal:
>+    putByIdTransition(
>+        macro (oldStructure, scratch, slow)
>+            const protoCell = oldStructure   # Reusing the oldStructure register for the proto
>+        
>+            loadp 28[PC], scratch
>+            assert(macro (ok) btpnz scratch, ok end)
>+            loadp StructureChain::m_vector[scratch], scratch
>+            assert(macro (ok) btpnz scratch, ok end)
>+            bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
>+        .loop:
>+            loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
>+            loadp JSCell::m_structure[protoCell], oldStructure
>+            bpneq oldStructure, [scratch], slow
>+            addp 4, scratch
>+            bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
>+        .done:
>+        end)
>+
>+
>+_llint_op_del_by_id:
>+    traceExecution()
>+    callHelper(_llint_helper_del_by_id)
>+    dispatch(4)
>+
>+
>+_llint_op_get_by_val:
>+    traceExecution()
>+    loadp CodeBlock[cfr], t1
>+    loadi 8[PC], t2
>+    loadi 12[PC], t3
>+    loadp CodeBlock::m_globalData[t1], t1
>+    loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow)
>+    loadp JSGlobalData::jsArrayClassInfo[t1], t2
>+    loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow)
>+    bpneq [t0], t2, .opGetByValSlow
>+    loadp JSArray::m_storage[t0], t3
>+    biaeq t1, JSArray::m_vectorLength[t0], .opGetByValSlow
>+    loadi 4[PC], t0
>+    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
>+    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
>+    bieq t2, EmptyValueTag, .opGetByValSlow
>+    storei t2, TagOffset[cfr, t0, 8]
>+    storei t1, PayloadOffset[cfr, t0, 8]
>+    loadi 16[PC], t0
>+    valueProfile(t2, t1, t0)
>+    dispatch(5)
>+
>+.opGetByValSlow:
>+    callHelper(_llint_helper_get_by_val)
>+    dispatch(5)
>+
>+
>+_llint_op_get_argument_by_val:
>+    traceExecution()
>+    loadi 8[PC], t0
>+    loadi 12[PC], t1
>+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentByValSlow
>+    loadConstantOrVariablePayload(t1, Int32Tag, t2, .opGetArgumentByValSlow)
>+    addi 1, t2
>+    loadi ArgumentCount + PayloadOffset[cfr], t1
>+    biaeq t2, t1, .opGetArgumentByValSlow
>+    negi t2
>+    loadi 4[PC], t3
>+    loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
>+    loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t1
>+    storei t0, TagOffset[cfr, t3, 8]
>+    storei t1, PayloadOffset[cfr, t3, 8]
>+    dispatch(4)
>+
>+.opGetArgumentByValSlow:
>+    callHelper(_llint_helper_get_argument_by_val)
>+    dispatch(4)
>+
>+
>+_llint_op_get_by_pname:
>+    traceExecution()
>+    loadi 12[PC], t0
>+    loadConstantOrVariablePayload(t0, CellTag, t1, .opGetByPnameSlow)
>+    loadi 16[PC], t0
>+    bpneq t1, PayloadOffset[cfr, t0, 8], .opGetByPnameSlow
>+    loadi 8[PC], t0
>+    loadConstantOrVariablePayload(t0, CellTag, t2, .opGetByPnameSlow)
>+    loadi 20[PC], t0
>+    loadi PayloadOffset[cfr, t0, 8], t3
>+    loadp JSCell::m_structure[t2], t0
>+    bpneq t0, JSPropertyNameIterator::m_cachedStructure[t3], .opGetByPnameSlow
>+    loadi 24[PC], t0
>+    loadi [cfr, t0, 8], t0
>+    subi 1, t0
>+    biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
>+    loadp JSObject::m_propertyStorage[t2], t2
>+    loadi TagOffset[t2, t0, 8], t1
>+    loadi PayloadOffset[t2, t0, 8], t3
>+    loadi 4[PC], t0
>+    storei t1, TagOffset[cfr, t0, 8]
>+    storei t3, PayloadOffset[cfr, t0, 8]
>+    dispatch(7)
>+
>+.opGetByPnameSlow:
>+    callHelper(_llint_helper_get_by_pname)
>+    dispatch(7)
>+
>+
>+_llint_op_put_by_val:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    loadConstantOrVariablePayload(t0, CellTag, t1, .opPutByValSlow)
>+    loadi 8[PC], t0
>+    loadConstantOrVariablePayload(t0, Int32Tag, t2, .opPutByValSlow)
>+    loadp CodeBlock[cfr], t0
>+    loadp CodeBlock::m_globalData[t0], t0
>+    loadp JSGlobalData::jsArrayClassInfo[t0], t0
>+    bpneq [t1], t0, .opPutByValSlow
>+    biaeq t2, JSArray::m_vectorLength[t1], .opPutByValSlow
>+    loadp JSArray::m_storage[t1], t0
>+    bieq ArrayStorage::m_vector + TagOffset[t0, t2, 8], EmptyValueTag, .opPutByValEmpty
>+.opPutByValStoreResult:
>+    loadi 12[PC], t3
>+    loadConstantOrVariable2Reg(t3, t1, t3)
>+    writeBarrier(t1, t3)
>+    storei t1, ArrayStorage::m_vector + TagOffset[t0, t2, 8]
>+    storei t3, ArrayStorage::m_vector + PayloadOffset[t0, t2, 8]
>+    dispatch(4)
>+
>+.opPutByValEmpty:
>+    addi 1, ArrayStorage::m_numValuesInVector[t0]
>+    bib t2, ArrayStorage::m_length[t0], .opPutByValStoreResult
>+    addi 1, t2, t1
>+    storei t1, ArrayStorage::m_length[t0]
>+    jmp .opPutByValStoreResult
>+
>+.opPutByValSlow:
>+    callHelper(_llint_helper_put_by_val)
>+    dispatch(4)
>+
>+
>+_llint_op_del_by_val:
>+    traceExecution()
>+    callHelper(_llint_helper_del_by_val)
>+    dispatch(4)
>+
>+
>+_llint_op_put_by_index:
>+    traceExecution()
>+    callHelper(_llint_helper_put_by_index)
>+    dispatch(4)
>+
>+
>+_llint_op_put_getter:
>+    traceExecution()
>+    callHelper(_llint_helper_put_getter)
>+    dispatch(4)
>+
>+
>+_llint_op_put_setter:
>+    traceExecution()
>+    callHelper(_llint_helper_put_setter)
>+    dispatch(4)
>+
>+
>+_llint_op_loop:
>+    nop
>+_llint_op_jmp:
>+    traceExecution()
>+    dispatchBranch(4[PC])
>+
>+
>+_llint_op_jmp_scopes:
>+    traceExecution()
>+    callHelper(_llint_helper_jmp_scopes)
>+    dispatch(0)
>+
>+
>+macro jumpTrueOrFalse(conditionOp, slow)
>+    loadi 4[PC], t1
>+    loadConstantOrVariablePayload(t1, BooleanTag, t0, .slow)
>+    conditionOp(t0, .target)
>+    dispatch(3)
>+
>+.target:
>+    dispatchBranch(8[PC])
>+
>+.slow:
>+    callHelper(slow)
>+    dispatch(0)
>+end
>+
>+_llint_op_loop_if_true:
>+    nop
>+_llint_op_jtrue:
>+    traceExecution()
>+    jumpTrueOrFalse(
>+        macro (value, target) btinz value, target end,
>+        _llint_helper_jtrue)
>+
>+
>+_llint_op_loop_if_false:
>+    nop
>+_llint_op_jfalse:
>+    traceExecution()
>+    jumpTrueOrFalse(
>+        macro (value, target) btiz value, target end,
>+        _llint_helper_jfalse)
>+
>+
>+macro equalNull(cellHandler, immediateHandler)
>+    loadi 4[PC], t0
>+    loadi TagOffset[cfr, t0, 8], t1
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    bineq t1, CellTag, .immediate
>+    loadp JSCell::m_structure[t0], t2
>+    cellHandler(Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
>+    dispatch(3)
>+
>+.target:
>+    dispatchBranch(8[PC])
>+
>+.immediate:
>+    ori 1, t1
>+    immediateHandler(t1, .target)
>+    dispatch(3)
>+end
>+
>+_llint_op_jeq_null:
>+    traceExecution()
>+    equalNull(
>+        macro (value, target) btbnz value, MasqueradesAsUndefined, target end,
>+        macro (value, target) bieq value, NullTag, target end)
>+    
>+
>+_llint_op_jneq_null:
>+    traceExecution()
>+    equalNull(
>+        macro (value, target) btbz value, MasqueradesAsUndefined, target end,
>+        macro (value, target) bineq value, NullTag, target end)
>+
>+
>+_llint_op_jneq_ptr:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    loadi 8[PC], t1
>+    bineq TagOffset[cfr, t0, 8], CellTag, .opJneqPtrBranch
>+    bpeq PayloadOffset[cfr, t0, 8], t1, .opJneqPtrFallThrough
>+.opJneqPtrBranch:
>+    dispatchBranch(12[PC])
>+.opJneqPtrFallThrough:
>+    dispatch(4)
>+
>+
>+macro compare(integerCompare, doubleCompare, helper)
>+    loadi 4[PC], t2
>+    loadi 8[PC], t3
>+    loadConstantOrVariable(t2, t0, t1)
>+    loadConstantOrVariable2Reg(t3, t2, t3)
>+    bineq t0, Int32Tag, .op1NotInt
>+    bineq t2, Int32Tag, .op2NotInt
>+    integerCompare(t1, t3, .jumpTarget)
>+    dispatch(4)
>+
>+.op1NotInt:
>+    bia t0, LowestTag, .slow
>+    bib t2, LowestTag, .op1NotIntOp2Double
>+    bineq t2, Int32Tag, .slow
>+    ci2d t3, ft1
>+    jmp .op1NotIntReady
>+.op1NotIntOp2Double:
>+    fii2d t3, t2, ft1
>+.op1NotIntReady:
>+    fii2d t1, t0, ft0
>+    doubleCompare(ft0, ft1, .jumpTarget)
>+    dispatch(4)
>+
>+.op2NotInt:
>+    ci2d t1, ft0
>+    bia t2, LowestTag, .slow
>+    fii2d t3, t2, ft1
>+    doubleCompare(ft0, ft1, .jumpTarget)
>+    dispatch(4)
>+
>+.jumpTarget:
>+    dispatchBranch(12[PC])
>+
>+.slow:
>+    callHelper(helper)
>+    dispatch(0)
>+end
>+
>+_llint_op_loop_if_less:
>+    nop
>+_llint_op_jless:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bilt left, right, target end,
>+        macro (left, right, target) bdlt left, right, target end,
>+        _llint_helper_jless)
>+
>+
>+_llint_op_jnless:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bigteq left, right, target end,
>+        macro (left, right, target) bdgtequn left, right, target end,
>+        _llint_helper_jnless)
>+
>+
>+_llint_op_loop_if_greater:
>+    nop
>+_llint_op_jgreater:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bigt left, right, target end,
>+        macro (left, right, target) bdgt left, right, target end,
>+        _llint_helper_jgreater)
>+
>+
>+_llint_op_jngreater:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bilteq left, right, target end,
>+        macro (left, right, target) bdltequn left, right, target end,
>+        _llint_helper_jngreater)
>+
>+
>+_llint_op_loop_if_lesseq:
>+    nop
>+_llint_op_jlesseq:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bilteq left, right, target end,
>+        macro (left, right, target) bdlteq left, right, target end,
>+        _llint_helper_jlesseq)
>+
>+
>+_llint_op_jnlesseq:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bigt left, right, target end,
>+        macro (left, right, target) bdgtun left, right, target end,
>+        _llint_helper_jnlesseq)
>+
>+
>+_llint_op_loop_if_greatereq:
>+    nop
>+_llint_op_jgreatereq:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bigteq left, right, target end,
>+        macro (left, right, target) bdgteq left, right, target end,
>+        _llint_helper_jgreatereq)
>+
>+
>+_llint_op_jngreatereq:
>+    traceExecution()
>+    compare(
>+        macro (left, right, target) bilt left, right, target end,
>+        macro (left, right, target) bdltun left, right, target end,
>+        _llint_helper_jngreatereq)
>+
>+
>+_llint_op_loop_hint:
>+    traceExecution()
>+    checkSwitchToJITForLoop()
>+    dispatch(1)
>+
>+
>+_llint_op_switch_imm:
>+    traceExecution()
>+    loadi 12[PC], t2
>+    loadi 4[PC], t3
>+    loadConstantOrVariable(t2, t1, t0)
>+    loadp CodeBlock[cfr], t2
>+    loadp CodeBlock::m_rareData[t2], t2
>+    muli sizeof SimpleJumpTable, t3   # FIXME: would be nice to peephole this!
>+    loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
>+    addp t3, t2
>+    bineq t1, Int32Tag, .opSwitchImmNotInt
>+    subi SimpleJumpTable::min[t2], t0
>+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
>+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
>+    loadi [t3, t0, 4], t1
>+    btiz t1, .opSwitchImmFallThrough
>+    dispatchBranchWithOffset(t1)
>+
>+.opSwitchImmNotInt:
>+    bib t1, LowestTag, .opSwitchImmSlow  # Go to slow path if it's a double.
>+.opSwitchImmFallThrough:
>+    dispatchBranch(8[PC])
>+
>+.opSwitchImmSlow:
>+    callHelper(_llint_helper_switch_imm)
>+    dispatch(0)
>+
>+
>+_llint_op_switch_char:
>+    traceExecution()
>+    loadi 12[PC], t2
>+    loadi 4[PC], t3
>+    loadConstantOrVariable(t2, t1, t0)
>+    loadp CodeBlock[cfr], t2
>+    loadp CodeBlock::m_rareData[t2], t2
>+    muli sizeof SimpleJumpTable, t3
>+    loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
>+    addp t3, t2
>+    bineq t1, CellTag, .opSwitchCharFallThrough
>+    loadp JSCell::m_structure[t0], t1
>+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t1], StringType, .opSwitchCharFallThrough
>+    loadp JSString::m_value[t0], t0
>+    bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
>+    loadp StringImpl::m_data8[t0], t1
>+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
>+    loadh [t1], t0
>+    jmp .opSwitchCharReady
>+.opSwitchChar8Bit:
>+    loadb [t1], t0
>+.opSwitchCharReady:
>+    subi SimpleJumpTable::min[t2], t0
>+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
>+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
>+    loadi [t2, t0, 4], t1
>+    btiz t1, .opSwitchImmFallThrough
>+    dispatchBranchWithOffset(t1)
>+
>+.opSwitchCharFallThrough:
>+    dispatchBranch(8[PC])
>+
>+
>+_llint_op_switch_string:
>+    traceExecution()
>+    callHelper(_llint_helper_switch_string)
>+    dispatch(0)
>+
>+
>+_llint_op_new_func:
>+    traceExecution()
>+    btiz 12[PC], .opNewFuncUnchecked
>+    loadi 4[PC], t1
>+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNewFuncDone
>+.opNewFuncUnchecked:
>+    callHelper(_llint_helper_new_func)
>+.opNewFuncDone:
>+    dispatch(4)
>+
>+
>+_llint_op_new_func_exp:
>+    traceExecution()
>+    callHelper(_llint_helper_new_func_exp)
>+    dispatch(3)
>+
>+
>+macro doCall(helper)
>+    loadi 4[PC], t0
>+    loadi 16[PC], t1
>+    loadp LLIntCallLinkInfo::callee[t1], t2
>+    loadConstantOrVariablePayload(t0, CellTag, t3, .opCallSlow)
>+    bineq t3, t2, .opCallSlow
>+    loadi 12[PC], t3
>+    addp 24, PC
>+    lshifti 3, t3
>+    addp cfr, t3  # t3 contains the new value of cfr
>+    loadp JSFunction::m_scopeChain[t2], t0
>+    storei t2, Callee + PayloadOffset[t3]
>+    storei t0, ScopeChain + PayloadOffset[t3]
>+    loadi 8 - 24[PC], t2
>+    storei PC, ArgumentCount + TagOffset[cfr]
>+    storep cfr, CallerFrame[t3]
>+    storei t2, ArgumentCount + PayloadOffset[t3]
>+    storei CellTag, Callee + TagOffset[t3]
>+    storei CellTag, ScopeChain + TagOffset[t3]
>+    move t3, cfr
>+    call LLIntCallLinkInfo::machineCodeTarget[t1]
>+    dispatchAfterCall()
>+
>+.opCallSlow:
>+    slowPathForCall(6, helper)
>+end
>+
>+_llint_op_call:
>+    traceExecution()
>+    doCall(_llint_helper_call)
>+
>+
>+_llint_op_construct:
>+    traceExecution()
>+    doCall(_llint_helper_construct)
>+
>+
>+_llint_op_call_varargs:
>+    traceExecution()
>+    slowPathForCall(6, _llint_helper_call_varargs)
>+
>+
>+_llint_op_call_eval:
>+    traceExecution()
>+    
>+    # Eval is executed in one of two modes:
>+    #
>+    # 1) We find that we're really invoking eval() in which case the
>+    #    execution is perfomed entirely inside the helper, and it
>+    #    returns the PC of a function that just returns the return value
>+    #    that the eval returned.
>+    #
>+    # 2) We find that we're invoking something called eval() that is not
>+    #    the real eval. Then the helper returns the PC of the thing to
>+    #    call, and we call it.
>+    #
>+    # This allows us to handle two cases, which would require a total of
>+    # up to four pieces of state that cannot be easily packed into two
>+    # registers (C functions can return up to two registers, easily):
>+    #
>+    # - The call frame register. This may or may not have been modified
>+    #   by the helper, but the convention is that it returns it. It's not
>+    #   totally clear if that's necessary, since the cfr is callee save.
>+    #   But that's our style in this here interpreter so we stick with it.
>+    #
>+    # - A bit to say if the helper successfully executed the eval and has
>+    #   the return value, or did not execute the eval but has a PC for us
>+    #   to call.
>+    #
>+    # - Either:
>+    #   - The JS return value (two registers), or
>+    #
>+    #   - The PC to call.
>+    #
>+    # It turns out to be easier to just always have this return the cfr
>+    # and a PC to call, and that PC may be a dummy thunk that just
>+    # returns the JS value that the eval returned.
>+    
>+    slowPathForCall(4, _llint_helper_call_eval)
>+
>+
>+_llint_generic_return_point:
>+    dispatchAfterCall()
>+
>+
>+_llint_op_tear_off_activation:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    loadi 8[PC], t1
>+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffActivationCreated
>+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .opTearOffActivationNotCreated
>+.opTearOffActivationCreated:
>+    callHelper(_llint_helper_tear_off_activation)
>+.opTearOffActivationNotCreated:
>+    dispatch(3)
>+
>+
>+_llint_op_tear_off_arguments:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    subi 1, t0   # Get the unmodifiedArgumentsRegister
>+    bieq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffArgumentsNotCreated
>+    callHelper(_llint_helper_tear_off_arguments)
>+.opTearOffArgumentsNotCreated:
>+    dispatch(2)
>+
>+
>+macro doReturn()
>+    loadp ReturnPC[cfr], t2
>+    loadp CallerFrame[cfr], cfr
>+    restoreReturnAddressBeforeReturn(t2)
>+    ret
>+end
>+
>+_llint_op_ret:
>+    traceExecution()
>+    checkSwitchToJITForEpilogue()
>+    loadi 4[PC], t2
>+    loadConstantOrVariable(t2, t1, t0)
>+    doReturn()
>+
>+
>+_llint_op_call_put_result:
>+    loadi 4[PC], t2
>+    loadi 8[PC], t3
>+    storei t1, TagOffset[cfr, t2, 8]
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    valueProfile(t1, t0, t3)
>+    traceExecution() # Needs to be here because it would clobber t1, t0
>+    dispatch(3)
>+
>+
>+_llint_op_ret_object_or_this:
>+    traceExecution()
>+    checkSwitchToJITForEpilogue()
>+    loadi 4[PC], t2
>+    loadConstantOrVariable(t2, t1, t0)
>+    bineq t1, CellTag, .opRetObjectOrThisNotObject
>+    loadp JSCell::m_structure[t0], t2
>+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
>+    doReturn()
>+
>+.opRetObjectOrThisNotObject:
>+    loadi 8[PC], t2
>+    loadConstantOrVariable(t2, t1, t0)
>+    doReturn()
>+
>+
>+_llint_op_method_check:
>+    traceExecution()
>+    # We ignore method checks and use normal get_by_id optimizations.
>+    dispatch(1)
>+
>+
>+_llint_op_strcat:
>+    traceExecution()
>+    callHelper(_llint_helper_strcat)
>+    dispatch(4)
>+
>+
>+_llint_op_to_primitive:
>+    traceExecution()
>+    loadi 8[PC], t2
>+    loadi 4[PC], t3
>+    loadConstantOrVariable(t2, t1, t0)
>+    bineq t1, CellTag, .opToPrimitiveIsImm
>+    loadp JSCell::m_structure[t0], t2
>+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
>+.opToPrimitiveIsImm:
>+    storei t1, TagOffset[cfr, t3, 8]
>+    storei t0, PayloadOffset[cfr, t3, 8]
>+    dispatch(3)
>+
>+.opToPrimitiveSlowCase:
>+    callHelper(_llint_helper_to_primitive)
>+    dispatch(3)
>+
>+
>+_llint_op_get_pnames:
>+    traceExecution()
>+    callHelper(_llint_helper_get_pnames)
>+    dispatch(0) # The helper either advances the PC or jumps us to somewhere else.
>+
>+
>+_llint_op_next_pname:
>+    traceExecution()
>+    loadi 12[PC], t1
>+    loadi 16[PC], t2
>+    loadi PayloadOffset[cfr, t1, 8], t0
>+    bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
>+    loadi 20[PC], t2
>+    loadi PayloadOffset[cfr, t2, 8], t2
>+    loadp JSPropertyNameIterator::m_jsStrings[t2], t3
>+    loadi [t3, t0, 8], t3
>+    addi 1, t0
>+    storei t0, PayloadOffset[cfr, t1, 8]
>+    loadi 4[PC], t1
>+    storei CellTag, TagOffset[cfr, t1, 8]
>+    storei t3, PayloadOffset[cfr, t1, 8]
>+    loadi 8[PC], t3
>+    loadi PayloadOffset[cfr, t3, 8], t3
>+    loadp JSCell::m_structure[t3], t1
>+    bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
>+    loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
>+    loadp StructureChain::m_vector[t0], t0
>+    btpz [t0], .opNextPnameTarget
>+.opNextPnameCheckPrototypeLoop:
>+    bieq Structure::m_prototype + TagOffset[t1], NullTag, .opNextPnameSlow
>+    loadp Structure::m_prototype + PayloadOffset[t1], t2
>+    loadp JSCell::m_structure[t2], t1
>+    bpneq t1, [t0], .opNextPnameSlow
>+    addp 4, t0
>+    btpnz [t0], .opNextPnameCheckPrototypeLoop
>+.opNextPnameTarget:
>+    dispatchBranch(24[PC])
>+
>+.opNextPnameEnd:
>+    dispatch(7)
>+
>+.opNextPnameSlow:
>+    callHelper(_llint_helper_next_pname) # This either keeps the PC where it was (causing us to loop) or sets it to target.
>+    dispatch(0)
>+
>+
>+_llint_op_push_scope:
>+    traceExecution()
>+    callHelper(_llint_helper_push_scope)
>+    dispatch(2)
>+
>+
>+_llint_op_pop_scope:
>+    traceExecution()
>+    callHelper(_llint_helper_pop_scope)
>+    dispatch(1)
>+
>+
>+_llint_op_push_new_scope:
>+    traceExecution()
>+    callHelper(_llint_helper_push_new_scope)
>+    dispatch(4)
>+
>+
>+_llint_op_catch:
>+    # This is where we end up from the JIT's throw trampoline (because the
>+    # machine code return address will be set to _llint_op_catch), and from
>+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
>+    # The JIT throwing protocol calls for the cfr to be in t0. The throwing
>+    # code must have known that we were throwing to the interpreter, and have
>+    # set JSGlobalData::targetInterpreterPCForThrow.
>+    move t0, cfr
>+    loadp JITStackFrame::globalData[sp], t3
>+    loadi JSGlobalData::targetInterpreterPCForThrow[t3], PC
>+    loadi JSGlobalData::exception + PayloadOffset[t3], t0
>+    loadi JSGlobalData::exception + TagOffset[t3], t1
>+    storei 0, JSGlobalData::exception + PayloadOffset[t3]
>+    storei EmptyValueTag, JSGlobalData::exception + TagOffset[t3]       
>+    loadi 4[PC], t2
>+    storei t0, PayloadOffset[cfr, t2, 8]
>+    storei t1, TagOffset[cfr, t2, 8]
>+    traceExecution()  # This needs to be here because we don't want to clobber t0, t1, t2, t3 above.
>+    dispatch(2)
>+
>+
>+_llint_op_throw:
>+    traceExecution()
>+    callHelper(_llint_helper_throw)
>+    dispatch(2)
>+
>+
>+_llint_op_throw_reference_error:
>+    traceExecution()
>+    callHelper(_llint_helper_throw_reference_error)
>+    dispatch(2)
>+
>+
>+_llint_op_jsr:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    addi 3 * 4, PC, t1
>+    storei t1, [cfr, t0, 8]
>+    dispatchBranch(8[PC])
>+
>+
>+_llint_op_sret:
>+    traceExecution()
>+    loadi 4[PC], t0
>+    loadp [cfr, t0, 8], PC
>+    dispatch(0)
>+
>+
>+_llint_op_debug:
>+    traceExecution()
>+    callHelper(_llint_helper_debug)
>+    dispatch(4)
>+
>+
>+_llint_op_profile_will_call:
>+    traceExecution()
>+    loadp JITStackFrame::enabledProfilerReference[sp], t0
>+    btpz [t0], .opProfileWillCallDone
>+    callHelper(_llint_helper_profile_will_call)
>+.opProfileWillCallDone:
>+    dispatch(2)
>+
>+
>+_llint_op_profile_did_call:
>+    traceExecution()
>+    loadp JITStackFrame::enabledProfilerReference[sp], t0
>+    btpz [t0], .opProfileWillCallDone
>+    callHelper(_llint_helper_profile_did_call)
>+.opProfileDidCallDone:
>+    dispatch(2)
>+
>+
>+_llint_op_end:
>+    traceExecution()
>+    checkSwitchToJITForEpilogue()
>+    loadi 4[PC], t0
>+    loadi TagOffset[cfr, t0, 8], t1
>+    loadi PayloadOffset[cfr, t0, 8], t0
>+    doReturn()
>+
>+
>+_llint_throw_from_helper_trampoline:
>+    # When throwing from the interpreter (i.e. throwing from LLIntHelpers), so
>+    # the throw target is not necessarily interpreted code, we come to here.
>+    # This essentially emulates the JIT's throwing protocol.
>+    loadp JITStackFrame::globalData[sp], t1
>+    loadp JSGlobalData::callFrameForThrow[t1], t0
>+    jmp JSGlobalData::targetMachinePCForThrow[t1]
>+
>+
>+_llint_throw_during_call_trampoline:
>+    preserveReturnAddressAfterCall(t2)
>+    loadp JITStackFrame::globalData[sp], t1
>+    loadp JSGlobalData::callFrameForThrow[t1], t0
>+    jmp JSGlobalData::targetMachinePCForThrow[t1]
>+
>+
>+# Lastly, make sure that we can link even though we don't support all opcodes.
>+# These opcodes should never arise when using LLInt or either JIT. We assert
>+# as much.
>+
>+macro notSupported()
>+    if ASSERT_ENABLED
>+        crash()
>+    else
>+        # We should use whatever the smallest possible instruction is, just to
>+        # ensure that there is a gap between instruction labels. If multiple
>+        # smallest instructions exist, we should pick the one that is most
>+        # likely result in execution being halted. Currently that is the break
>+        # instruction on all architectures we're interested in. (Break is int3
>+        # on Intel, which is 1 byte, and bkpt on ARMv7, which is 2 bytes.)
>+        break
>+    end
>+end
>+
>+_llint_op_get_array_length:
>+    notSupported()
>+
>+_llint_op_get_by_id_chain:
>+    notSupported()
>+
>+_llint_op_get_by_id_custom_chain:
>+    notSupported()
>+
>+_llint_op_get_by_id_custom_proto:
>+    notSupported()
>+
>+_llint_op_get_by_id_custom_self:
>+    notSupported()
>+
>+_llint_op_get_by_id_generic:
>+    notSupported()
>+
>+_llint_op_get_by_id_getter_chain:
>+    notSupported()
>+
>+_llint_op_get_by_id_getter_proto:
>+    notSupported()
>+
>+_llint_op_get_by_id_getter_self:
>+    notSupported()
>+
>+_llint_op_get_by_id_proto:
>+    notSupported()
>+
>+_llint_op_get_by_id_self:
>+    notSupported()
>+
>+_llint_op_get_string_length:
>+    notSupported()
>+
>+_llint_op_put_by_id_generic:
>+    notSupported()
>+
>+_llint_op_put_by_id_replace:
>+    notSupported()
>+
>+_llint_op_put_by_id_transition:
>+    notSupported()
>+
>+
>+# Indicate the end of LLInt.
>+_llint_end:
>+    crash()
>+
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.cpp	(revision 0)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.cpp	(revision 0)
>@@ -0,0 +1,36 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "LowLevelInterpreter.h"
>+
>+#if ENABLE(LLINT)
>+
>+#include "LLIntOfflineAsmConfig.h"
>+#include <wtf/InlineASM.h>
>+
>+#include "LLIntAssembly.h"
>+
>+#endif // ENABLE(LLINT)
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.h
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.h	(revision 0)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.h	(revision 0)
>@@ -0,0 +1,53 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef LowLevelInterpreter_h
>+#define LowLevelInterpreter_h
>+
>+#include <wtf/Platform.h>
>+
>+#if ENABLE(LLINT)
>+
>+#include "Opcode.h"
>+
>+#define LLINT_INSTRUCTION_DECL(opcode, length) extern "C" void llint_##opcode();
>+    FOR_EACH_OPCODE_ID(LLINT_INSTRUCTION_DECL);
>+#undef LLINT_INSTRUCTION_DECL
>+
>+extern "C" void llint_begin();
>+extern "C" void llint_end();
>+extern "C" void llint_program_prologue();
>+extern "C" void llint_eval_prologue();
>+extern "C" void llint_function_for_call_prologue();
>+extern "C" void llint_function_for_construct_prologue();
>+extern "C" void llint_function_for_call_arity_check();
>+extern "C" void llint_function_for_construct_arity_check();
>+extern "C" void llint_generic_return_point();
>+extern "C" void llint_throw_from_helper_trampoline();
>+extern "C" void llint_throw_during_call_trampoline();
>+
>+#endif // ENABLE(LLINT)
>+
>+#endif // LowLevelInterpreter_h
>Index: Source/JavaScriptCore/offlineasm/armv7.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/armv7.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/armv7.rb	(revision 0)
>@@ -0,0 +1,193 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+class SpecialRegister
>+  def initialize(name)
>+    @name = name
>+  end
>+  
>+  def armV7Operand
>+    @name
>+  end
>+end
>+
>+ARMv7_DATA_REG = SpecialRegister.new("ip")
>+ARMv7_ADDR_REG = SpecialRegister.new("r3")
>+
>+def moveImmediate(value, register)
>+  # Currently we only handle the simple cases, and fall back to mov/movt for the complex ones.
>+  if value >= 0 && value < 256
>+    $asm.puts "movw \##{value}, #{register.armV7Operand}"
>+  elsif (~value) >= 0 && (~value) < 256
>+    $asm.puts "mvnw \##{~value}, #{register.armV7Operand}"
>+  else
>+    $asm.puts "movw \##{value & 0xffff}, #{register.armV7Operand}"
>+    if (value & 0xffff0000) != 0
>+      $asm.puts "movt \##{value >> 16}, #{register.armV7Operand}"
>+    end
>+  end
>+end
>+
>+class RegisterID
>+  def armV7Operand
>+    case name
>+    when "t0", "a0", "r0"
>+      "r0"
>+    when "t1", "a1", "r1"
>+      "r1"
>+    when "t2", "a2"
>+      "r2"
>+    when "a3"
>+      "r3"
>+    when "t3"
>+      "r4"
>+    when "t4"
>+      "r7"
>+    when "cfr"
>+      "r5"
>+    else
>+      raise
>+    end
>+  end
>+  
>+  def armV7PreparePossibleMemoryOperand
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    armV7Operand
>+  end
>+  
>+  def armV7LoadStoreWrap
>+    yield
>+  end
>+end
>+
>+class FPRegisterID
>+  def armV7Operand
>+    case name
>+    when "ft0", "fr"
>+      "d0"
>+    when "fr1",
>+      "d1"
>+    when "fr2"
>+      "d2"
>+    when "fr3"
>+      "d3"
>+    when "fr4"
>+      "d4"
>+    when "fr5"
>+      "d5"
>+    else
>+      raise
>+    end
>+  end
>+  
>+  def armV7PreparePossibleMemoryOperand
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    armV7Operand
>+  end
>+  
>+  def armV7LoadStoreWrap
>+    yield self
>+  end
>+end
>+
>+class Immediate
>+  def armV7Operand
>+    raise "Invalid immediate #{value}" if value < 0 or value > 255
>+    "#${value}"
>+  end
>+  
>+  def armV7PreparePossibleMemoryOperand
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    armV7Operand
>+  end
>+  
>+  def armV7LoadStoreWrap
>+    yield self
>+  end
>+end
>+
>+module ARMv7AddressUtilities
>+  def armV7LoadStoreWrap
>+    self.armV7PreparePossibleMemoryOperand
>+    $asm.puts "\tldr #{self.armV7PossiblyMemoryOperand}, #{ARMv7_DATA_REG.armV7Operand}"
>+    yield ARMv7_DATA_REG
>+    $asm.puts "\tstr #{ARMv7_DATA_REG.armV7Operand}, #{self.armV7PossiblyMemoryOperand}"
>+  end
>+end
>+
>+class Address
>+  include ARMv7AddressUtilities
>+
>+  def armV7PreparePossibleMemoryOperand
>+    if offset.value < -0xff || offset.value > 0xfff
>+      moveImmediate(offset.value, ARMv7_ADDR_REG)
>+    end
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    if offset.value < -0xff || offset.value > 0xfff
>+      "[#{base.armV7Operand}, #{ARMv7_ADDR_REG.armV7Operand}]"
>+    else
>+      "[#{base.armV7Operand}, #{offset.armV7Operand}]"
>+    end
>+  end
>+end
>+
>+class BaseIndex
>+  include ARMv7AddressUtilities
>+
>+  def armV7PreparePossibleMemoryOperand
>+    if offset.value != 0
>+      moveImmediate(offset.value, ARMv7_ADDR_REG)
>+      $asm.puts "addw #{ARMv7_ADDR_REG.armV7Operand}, #{base.armV7Operand}"
>+    end
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    if offset.value != 0
>+      "[#{ARMv7_ADDR_REG.armV7Operand}, #{index.armV7Operand}, lsl \##{scale}]"
>+    else
>+      "[#{base.armV7Operand}, #{index.armV7Operand}, lsl \##{scale}]"
>+    end
>+  end
>+end
>+
>+class AbsoluteAddress
>+  include ARMv7AddressUtilities
>+  
>+  def armV7PreparePossibleMemoryOperand
>+    moveImmediate(address.value, ARMv7_ADDR_REG)
>+  end
>+  
>+  def armV7PossibleMemoryOperand
>+    "[#{ARMv7_ADDR_REG.armV7Operand}]"
>+  end
>+end
>+
>+
>Index: Source/JavaScriptCore/offlineasm/asm.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/asm.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/asm.rb	(revision 0)
>@@ -0,0 +1,135 @@
>+#!/usr/bin/env ruby
>+
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+$: << File.dirname(__FILE__)
>+
>+require "backends"
>+require "digest/sha1"
>+require "offsets"
>+require "parser"
>+require "self_hash"
>+require "settings"
>+require "transform"
>+
>+class Assembler
>+  def initialize(outp)
>+    @outp = outp
>+    @state = :cpp
>+  end
>+  
>+  def enterAsm
>+    @outp.puts "asm ("
>+    @state = :asm
>+  end
>+  
>+  def leaveAsm
>+    @outp.puts ");"
>+    @state = :cpp
>+  end
>+  
>+  def inAsm
>+    enterAsm
>+    yield
>+    leaveAsm
>+  end
>+  
>+  def puts(*line)
>+    raise unless @state == :asm
>+    @outp.puts("\"\\t" + line.join('') + "\\n\"")
>+  end
>+  
>+  def print(line)
>+    raise unless @state == :asm
>+    @outp.print("\"" + line + "\"")
>+  end
>+  
>+  def putsLabel(labelName)
>+    raise unless @state == :asm
>+    @outp.puts("\".globl \" SYMBOL_STRING(#{labelName}) \"\\n\"")
>+    @outp.puts("HIDE_SYMBOL(#{labelName}) \"\\n\"")
>+    @outp.puts("SYMBOL_STRING(#{labelName}) \":\\n\"")
>+  end
>+  
>+  def putsLocalLabel(labelName)
>+    raise unless @state == :asm
>+    @outp.puts("LOCAL_LABEL_STRING(#{labelName}) \":\\n\"")
>+  end
>+  
>+  def self.labelReference(labelName)
>+    "\" SYMBOL_STRING(#{labelName}) \""
>+  end
>+  
>+  def self.localLabelReference(labelName)
>+    "\" LOCAL_LABEL_STRING(#{labelName}) \""
>+  end
>+  
>+  def comment(text)
>+    @outp.puts "// #{text}"
>+  end
>+end
>+
>+asmFile = ARGV.shift
>+offsetsFile = ARGV.shift
>+outputFlnm = ARGV.shift
>+
>+offsetsList, configIndex = offsetsAndConfigurationIndex(offsetsFile)
>+inputData = IO::read(asmFile)
>+
>+inputHash =
>+  "// offlineasm input hash: " + Digest::SHA1.hexdigest(inputData) +
>+  " " + Digest::SHA1.hexdigest((offsetsList + [configIndex]).join(' ')) +
>+  " " + selfHash
>+
>+if FileTest.exist? outputFlnm
>+  File.open(outputFlnm, "r") {
>+    | inp |
>+    firstLine = inp.gets
>+    if firstLine and firstLine.chomp == inputHash
>+      $stderr.puts "Nothing changed."
>+      exit 0
>+    end
>+  }
>+end
>+
>+File.open(outputFlnm, "w") {
>+  | outp |
>+  $output = outp
>+  $output.puts inputHash
>+  
>+  $asm = Assembler.new($output)
>+  
>+  ast = parse(lex(inputData))
>+  
>+  forSettings(computeSettingsCombinations(ast)[configIndex], ast) {
>+    | concreteSettings, lowLevelAST, backend |
>+    assertConfiguration(concreteSettings)
>+    lowLevelAST = lowLevelAST.resolve(*buildOffsetsMap(lowLevelAST, offsetsList))
>+    emitCodeInConfiguration(concreteSettings, lowLevelAST, backend) {
>+      $asm.inAsm {
>+        lowLevelAST.lower(backend)
>+      }
>+    }
>+  }
>+}
>Index: Source/JavaScriptCore/offlineasm/ast.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/ast.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/ast.rb	(revision 0)
>@@ -0,0 +1,813 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+#
>+# Base utility types for the AST.
>+#
>+
>+# Valid methods for Node:
>+#
>+# node.children -> Returns an array of immediate children.
>+#
>+# node.descendents -> Returns an array of all strict descendants (children
>+#     and children of children, transitively).
>+#
>+# node.flatten -> Returns an array containing the strict descendants and
>+#     the node itself.
>+#
>+# node.filter(type) -> Returns an array containing those elements in
>+#     node.flatten that are of the given type (is_a? type returns true).
>+#
>+# node.mapChildren{|v| ...} -> Returns a new node with all children
>+#     replaced according to the given block.
>+#
>+# Examples:
>+#
>+# node.filter(Setting).uniq -> Returns all of the settings that the AST's
>+#     IfThenElse blocks depend on.
>+#
>+# node.filter(StructOffset).uniq -> Returns all of the structure offsets
>+#     that the AST depends on.
>+
>+class Node
>+  attr_reader :codeOrigin
>+  
>+  def initialize(codeOrigin)
>+    @codeOrigin = codeOrigin
>+  end
>+  
>+  def codeOriginString
>+    "line number #{@codeOrigin}"
>+  end
>+  
>+  def descendants
>+    children.collect{|v| v.flatten}.flatten
>+  end
>+  
>+  def flatten
>+    [self] + descendants
>+  end
>+  
>+  def filter(type)
>+    flatten.select{|v| v.is_a? type}
>+  end
>+end
>+
>+class NoChildren < Node
>+  def initialize(codeOrigin)
>+    super(codeOrigin)
>+  end
>+  
>+  def children
>+    []
>+  end
>+  
>+  def mapChildren
>+    self
>+  end
>+end
>+
>+class StructOffsetKey
>+  attr_reader :struct, :field
>+  
>+  def initialize(struct, field)
>+    @struct = struct
>+    @field = field
>+  end
>+  
>+  def hash
>+    @struct.hash + @field.hash * 3
>+  end
>+  
>+  def eql?(other)
>+    @struct == other.struct and @field == other.field
>+  end
>+end
>+    
>+#
>+# AST nodes.
>+#
>+
>+class StructOffset < NoChildren
>+  attr_reader :struct, :field
>+  
>+  def initialize(codeOrigin, struct, field)
>+    super(codeOrigin)
>+    @struct = struct
>+    @field = field
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forField(codeOrigin, struct, field)
>+    key = StructOffsetKey.new(struct, field)
>+    
>+    unless @@mapping[key]
>+      @@mapping[key] = StructOffset.new(codeOrigin, struct, field)
>+    end
>+    @@mapping[key]
>+  end
>+  
>+  def dump
>+    "#{struct}::#{field}"
>+  end
>+  
>+  def <=>(other)
>+    if @struct != other.struct
>+      return @struct <=> other.struct
>+    end
>+    @field <=> other.field
>+  end
>+end
>+
>+class Sizeof < NoChildren
>+  attr_reader :struct
>+  
>+  def initialize(codeOrigin, struct)
>+    super(codeOrigin)
>+    @struct = struct
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forName(codeOrigin, struct)
>+    unless @@mapping[struct]
>+      @@mapping[struct] = Sizeof.new(codeOrigin, struct)
>+    end
>+    @@mapping[struct]
>+  end
>+  
>+  def dump
>+    "sizeof #{@struct}"
>+  end
>+  
>+  def <=>(other)
>+    @struct <=> other.struct
>+  end
>+end
>+
>+class Immediate < NoChildren
>+  attr_reader :value
>+  
>+  def initialize(codeOrigin, value)
>+    super(codeOrigin)
>+    @value = value
>+  end
>+  
>+  def dump
>+    "#{value}"
>+  end
>+  
>+  def ==(other)
>+    other.is_a? Immediate and other.value == @value
>+  end
>+end
>+
>+class AddImmediates < Node
>+  attr_reader :left, :right
>+  
>+  def initialize(codeOrigin, left, right)
>+    super(codeOrigin)
>+    @left = left
>+    @right = right
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    AddImmediates.new(codeOrigin, (yield @left), (yield @right))
>+  end
>+  
>+  def dump
>+    "(#{left.dump} + #{right.dump})"
>+  end
>+end
>+
>+class SubImmediates < Node
>+  attr_reader :left, :right
>+  
>+  def initialize(codeOrigin, left, right)
>+    super(codeOrigin)
>+    @left = left
>+    @right = right
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    SubImmediates.new(codeOrigin, (yield @left), (yield @right))
>+  end
>+  
>+  def dump
>+    "(#{left.dump} - #{right.dump})"
>+  end
>+end
>+
>+class MulImmediates < Node
>+  attr_reader :left, :right
>+  
>+  def initialize(codeOrigin, left, right)
>+    super(codeOrigin)
>+    @left = left
>+    @right = right
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    MulImmediates.new(codeOrigin, (yield @left), (yield @right))
>+  end
>+  
>+  def dump
>+    "(#{left.dump} * #{right.dump})"
>+  end
>+end
>+
>+class NegImmediate < Node
>+  attr_reader :child
>+  
>+  def initialize(codeOrigin, child)
>+    super(codeOrigin)
>+    @child = child
>+  end
>+  
>+  def children
>+    [@child]
>+  end
>+  
>+  def mapChildren
>+    NegImmediate.new(codeOrigin, (yield @child))
>+  end
>+  
>+  def dump
>+    "(-#{@child.dump})"
>+  end
>+end
>+
>+class RegisterID < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forName(codeOrigin, name)
>+    unless @@mapping[name]
>+      @@mapping[name] = RegisterID.new(codeOrigin, name)
>+    end
>+    @@mapping[name]
>+  end
>+  
>+  def dump
>+    name
>+  end
>+end
>+
>+class FPRegisterID < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forName(codeOrigin, name)
>+    unless @@mapping[name]
>+      @@mapping[name] = FPRegisterID.new(codeOrigin, name)
>+    end
>+    @@mapping[name]
>+  end
>+  
>+  def dump
>+    name
>+  end
>+end
>+
>+class Variable < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forName(codeOrigin, name)
>+    unless @@mapping[name]
>+      @@mapping[name] = Variable.new(codeOrigin, name)
>+    end
>+    @@mapping[name]
>+  end
>+  
>+  def dump
>+    name
>+  end
>+end
>+
>+class Address < Node
>+  attr_reader :base, :offset
>+  
>+  def initialize(codeOrigin, base, offset)
>+    super(codeOrigin)
>+    @base = base
>+    @offset = offset
>+  end
>+  
>+  def children
>+    [@base, @offset]
>+  end
>+  
>+  def mapChildren
>+    Address.new(codeOrigin, (yield @base), (yield @offset))
>+  end
>+  
>+  def dump
>+    "#{offset.dump}[#{base.dump}]"
>+  end
>+end
>+
>+class BaseIndex < Node
>+  attr_reader :base, :index, :scale, :offset
>+  
>+  def initialize(codeOrigin, base, index, scale, offset)
>+    super(codeOrigin)
>+    @base = base
>+    @index = index
>+    @scale = scale
>+    raise unless [1, 2, 4, 8].member? @scale
>+    @offset = offset
>+  end
>+  
>+  def children
>+    [@base, @index, @offset]
>+  end
>+  
>+  def mapChildren
>+    BaseIndex.new(codeOrigin, (yield @base), (yield @index), @scale, (yield @offset))
>+  end
>+  
>+  def dump
>+    "#{offset.dump}[#{base.dump}, #{index.dump}, #{scale}]"
>+  end
>+end
>+
>+class AbsoluteAddress < NoChildren
>+  attr_reader :address
>+  
>+  def initialize(codeOrigin, address)
>+    super(codeOrigin)
>+    @address = address
>+  end
>+  
>+  def dump
>+    "#{address.dump}[]"
>+  end
>+end
>+
>+class Instruction < Node
>+  attr_reader :opcode, :operands
>+  
>+  def initialize(codeOrigin, opcode, operands)
>+    super(codeOrigin)
>+    @opcode = opcode
>+    @operands = operands
>+  end
>+  
>+  def children
>+    operands
>+  end
>+  
>+  def mapChildren(&proc)
>+    Instruction.new(codeOrigin, @opcode, @operands.map(&proc))
>+  end
>+  
>+  def dump
>+    "\t" + opcode.to_s + " " + operands.collect{|v| v.dump}.join(", ")
>+  end
>+end
>+
>+class Error < NoChildren
>+  def initialize(codeOrigin)
>+    super(codeOrigin)
>+  end
>+  
>+  def dump
>+    "\terror"
>+  end
>+end
>+
>+class ConstDecl < Node
>+  attr_reader :variable, :value
>+  
>+  def initialize(codeOrigin, variable, value)
>+    super(codeOrigin)
>+    @variable = variable
>+    @value = value
>+  end
>+  
>+  def children
>+    [@variable, @value]
>+  end
>+  
>+  def mapChildren
>+    ConstDecl.new(codeOrigin, (yield @variable), (yield @value))
>+  end
>+  
>+  def dump
>+    "const #{@variable.dump} = #{@value.dump}"
>+  end
>+end
>+
>+$labelMapping = {}
>+
>+class Label < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+  
>+  def self.forName(codeOrigin, name)
>+    if $labelMapping[name]
>+      raise "Label name collision: #{name}" unless $labelMapping[name].is_a? Label
>+    else
>+      $labelMapping[name] = Label.new(codeOrigin, name)
>+    end
>+    $labelMapping[name]
>+  end
>+  
>+  def dump
>+    "#{name}:"
>+  end
>+end
>+
>+class LocalLabel < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+
>+  @@uniqueNameCounter = 0
>+  
>+  def self.forName(codeOrigin, name)
>+    if $labelMapping[name]
>+      raise "Label name collision: #{name}" unless $labelMapping[name].is_a? LocalLabel
>+    else
>+      $labelMapping[name] = LocalLabel.new(codeOrigin, name)
>+    end
>+    $labelMapping[name]
>+  end
>+  
>+  def self.unique(comment)
>+    newName = "_#{comment}"
>+    if $labelMapping[newName]
>+      while $labelMapping[newName = "_#{@@uniqueNameCounter}_#{comment}"]
>+        @@uniqueNameCounter += 1
>+      end
>+    end
>+    forName(nil, newName)
>+  end
>+  
>+  def cleanName
>+    if name =~ /^\./
>+      "_" + name[1..-1]
>+    else
>+      name
>+    end
>+  end
>+  
>+  def dump
>+    "#{name}:"
>+  end
>+end
>+
>+class LabelReference < Node
>+  attr_reader :label
>+  
>+  def initialize(codeOrigin, label)
>+    super(codeOrigin)
>+    @label = label
>+  end
>+  
>+  def children
>+    [@label]
>+  end
>+  
>+  def mapChildren
>+    LabelReference.new(codeOrigin, (yield @label))
>+  end
>+  
>+  def name
>+    label.name
>+  end
>+  
>+  def dump
>+    label.name
>+  end
>+end
>+
>+class LocalLabelReference < NoChildren
>+  attr_reader :label
>+  
>+  def initialize(codeOrigin, label)
>+    super(codeOrigin)
>+    @label = label
>+  end
>+  
>+  def children
>+    [@label]
>+  end
>+  
>+  def mapChildren
>+    LocalLabelReference.new(codeOrigin, (yield @label))
>+  end
>+  
>+  def name
>+    label.name
>+  end
>+  
>+  def dump
>+    label.name
>+  end
>+end
>+
>+class Sequence < Node
>+  attr_reader :list
>+  
>+  def initialize(codeOrigin, list)
>+    super(codeOrigin)
>+    @list = list
>+  end
>+  
>+  def children
>+    list
>+  end
>+  
>+  def mapChildren(&proc)
>+    Sequence.new(codeOrigin, @list.map(&proc))
>+  end
>+  
>+  def dump
>+    list.collect{|v| v.dump}.join("\n")
>+  end
>+end
>+
>+class True < NoChildren
>+  def initialize
>+    super(nil)
>+  end
>+  
>+  @@instance = True.new
>+  
>+  def self.instance
>+    @@instance
>+  end
>+  
>+  def value
>+    true
>+  end
>+  
>+  def dump
>+    "true"
>+  end
>+end
>+
>+class False < NoChildren
>+  def initialize
>+    super(nil)
>+  end
>+  
>+  @@instance = False.new
>+  
>+  def self.instance
>+    @@instance
>+  end
>+  
>+  def value
>+    false
>+  end
>+  
>+  def dump
>+    "false"
>+  end
>+end
>+
>+class TrueClass
>+  def asNode
>+    True.instance
>+  end
>+end
>+
>+class FalseClass
>+  def asNode
>+    False.instance
>+  end
>+end
>+
>+class Setting < NoChildren
>+  attr_reader :name
>+  
>+  def initialize(codeOrigin, name)
>+    super(codeOrigin)
>+    @name = name
>+  end
>+  
>+  @@mapping = {}
>+  
>+  def self.forName(codeOrigin, name)
>+    unless @@mapping[name]
>+      @@mapping[name] = Setting.new(codeOrigin, name)
>+    end
>+    @@mapping[name]
>+  end
>+  
>+  def dump
>+    name
>+  end
>+end
>+
>+class And < Node
>+  attr_reader :left, :right
>+  
>+  def initialize(codeOrigin, left, right)
>+    super(codeOrigin)
>+    @left = left
>+    @right = right
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    And.new(codeOrigin, (yield @left), (yield @right))
>+  end
>+  
>+  def dump
>+    "(#{left.dump} and #{right.dump})"
>+  end
>+end
>+
>+class Or < Node
>+  attr_reader :left, :right
>+  
>+  def initialize(codeOrigin, left, right)
>+    super(codeOrigin)
>+    @left = left
>+    @right = right
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    Or.new(codeOrigin, (yield @left), (yield @right))
>+  end
>+  
>+  def dump
>+    "(#{left.dump} or #{right.dump})"
>+  end
>+end
>+
>+class Not < Node
>+  attr_reader :child
>+  
>+  def initialize(codeOrigin, child)
>+    super(codeOrigin)
>+    @child = child
>+  end
>+  
>+  def children
>+    [@left, @right]
>+  end
>+  
>+  def mapChildren
>+    Not.new(codeOrigin, (yield @child))
>+  end
>+  
>+  def dump
>+    "(not #{child.dump})"
>+  end
>+end
>+
>+class Skip < NoChildren
>+  def initialize(codeOrigin)
>+    super(codeOrigin)
>+  end
>+  
>+  def dump
>+    "\tskip"
>+  end
>+end
>+
>+class IfThenElse < Node
>+  attr_reader :predicate, :thenCase
>+  attr_accessor :elseCase
>+  
>+  def initialize(codeOrigin, predicate, thenCase)
>+    super(codeOrigin)
>+    @predicate = predicate
>+    @thenCase = thenCase
>+    @elseCase = Skip.new(codeOrigin)
>+  end
>+  
>+  def children
>+    if @elseCase
>+      [@predicate, @thenCase, @elseCase]
>+    else
>+      [@predicate, @thenCase]
>+    end
>+  end
>+  
>+  def mapChildren
>+    IfThenElse.new(codeOrigin, (yield @predicate), (yield @thenCase), (yield @elseCase))
>+  end
>+  
>+  def dump
>+    "if #{predicate.dump}\n" + thenCase.dump + "\nelse\n" + elseCase.dump + "\nend"
>+  end
>+end
>+
>+class Macro < Node
>+  attr_reader :name, :variables, :body
>+  
>+  def initialize(codeOrigin, name, variables, body)
>+    super(codeOrigin)
>+    @name = name
>+    @variables = variables
>+    @body = body
>+  end
>+  
>+  def children
>+    @variables + [@body]
>+  end
>+  
>+  def mapChildren
>+    Macro.new(codeOrigin, @name, @variables.map{|v| yield v}, (yield @body))
>+  end
>+  
>+  def dump
>+    "macro #{name}(" + variables.collect{|v| v.dump}.join(", ") + ")\n" + body.dump + "\nend"
>+  end
>+end
>+
>+class MacroCall < Node
>+  attr_reader :name, :operands
>+  
>+  def initialize(codeOrigin, name, operands)
>+    super(codeOrigin)
>+    @name = name
>+    @operands = operands
>+    raise unless @operands
>+    @operands.each{|v| raise unless v}
>+  end
>+  
>+  def children
>+    @operands
>+  end
>+  
>+  def mapChildren(&proc)
>+    MacroCall.new(codeOrigin, @name, @operands.map(&proc))
>+  end
>+  
>+  def dump
>+    "\t#{name}(" + operands.collect{|v| v.dump}.join(", ") + ")"
>+  end
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/backends.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/backends.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/backends.rb	(revision 0)
>@@ -0,0 +1,85 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "ast"
>+require "x86"
>+
>+BACKENDS =
>+  [
>+   "X86",
>+   "ARMv7"
>+  ]
>+
>+WORKING_BACKENDS =
>+  [
>+   "X86"
>+  ]
>+
>+BACKEND_PATTERN = Regexp.new('\\A(' + BACKENDS.join(')|(') + ')\\Z')
>+
>+class Node
>+  def lower(name)
>+    send("lower" + name)
>+  end
>+end
>+
>+# Overrides for lower() for those nodes that are backend-agnostic
>+
>+class Label
>+  def lower(name)
>+    $asm.putsLabel(self.name[1..-1])
>+  end
>+end
>+
>+class LocalLabel
>+  def lower(name)
>+    $asm.putsLocalLabel "_offlineasm_#{self.name[1..-1]}"
>+  end
>+end
>+
>+class LabelReference
>+  def asmLabel
>+    Assembler.labelReference(name[1..-1])
>+  end
>+end
>+
>+class LocalLabelReference
>+  def asmLabel
>+    Assembler.localLabelReference("_offlineasm_"+name[1..-1])
>+  end
>+end
>+
>+class Skip
>+  def lower(name)
>+  end
>+end
>+
>+class Sequence
>+  def lower(name)
>+    @list.each {
>+      | node |
>+      node.lower(name)
>+    }
>+  end
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb	(revision 0)
>@@ -0,0 +1,88 @@
>+#!/usr/bin/env ruby
>+
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+$: << File.dirname(__FILE__)
>+
>+require "backends"
>+require "digest/sha1"
>+require "offsets"
>+require "parser"
>+require "self_hash"
>+require "settings"
>+require "transform"
>+
>+inputFlnm = ARGV.shift
>+outputFlnm = ARGV.shift
>+
>+def emitMagicNumber
>+  OFFSET_MAGIC_NUMBERS.each {
>+    | number |
>+    $output.puts "#{number},"
>+  }
>+end
>+
>+inputData = IO::read(inputFlnm)
>+inputHash = "// offlineasm input hash: #{Digest::SHA1.hexdigest(inputData)} #{selfHash}"
>+
>+if FileTest.exist? outputFlnm
>+  File.open(outputFlnm, "r") {
>+    | inp |
>+    firstLine = inp.gets
>+    if firstLine and firstLine.chomp == inputHash
>+      $stderr.puts "Nothing changed."
>+      exit 0
>+    end
>+  }
>+end
>+
>+originalAST = parse(lex(inputData))
>+
>+File.open(outputFlnm, "w") {
>+  | outp |
>+  $output = outp
>+  outp.puts inputHash
>+  emitCodeInAllConfigurations(originalAST) {
>+    | settings, ast, backend, index |
>+    offsetsList = ast.filter(StructOffset).uniq.sort
>+    sizesList = ast.filter(Sizeof).uniq.sort
>+    
>+    length = (OFFSET_MAGIC_NUMBERS.size + 1) * (1 + offsetsList.size + sizesList.size)
>+    
>+    outp.puts "static const unsigned extractorTable[#{length}] = {"
>+    emitMagicNumber
>+    outp.puts "#{index},"
>+    offsetsList.each {
>+      | offset |
>+      emitMagicNumber
>+      outp.puts "OFFLINE_ASM_OFFSETOF(#{offset.struct}, #{offset.field}),"
>+    }
>+    sizesList.each {
>+      | offset |
>+      emitMagicNumber
>+      outp.puts "sizeof(#{offset.struct}),"
>+    }
>+    outp.puts "};"
>+  }
>+}
>Index: Source/JavaScriptCore/offlineasm/instructions.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/instructions.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/instructions.rb	(revision 0)
>@@ -0,0 +1,188 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+MACRO_INSTRUCTIONS =
>+  [
>+   "addi",
>+   "andi",
>+   "lshifti",
>+   "muli",
>+   "negi",
>+   "noti",
>+   "ori",
>+   "rshifti",
>+   "urshifti",
>+   "subi",
>+   "xori",
>+   "loadi",
>+   "loadb",
>+   "loadh",
>+   "storei",
>+   "storeb",
>+   "loadd",
>+   "moved",
>+   "stored",
>+   "addd",
>+   "divd",
>+   "subd",
>+   "muld",
>+   "sqrtd",
>+   "ci2d",
>+   "fii2d", # usage: fii2d <gpr with least significant bits>, <gpr with most significant bits>, <fpr>
>+   "fd2ii", # usage: fd2ii <fpr>, <gpr with least significant bits>, <gpr with most significant bits>
>+   "bdeq",
>+   "bdneq",
>+   "bdgt",
>+   "bdgteq",
>+   "bdlt",
>+   "bdlteq",
>+   "bdequn",
>+   "bdnequn",
>+   "bdgtun",
>+   "bdgtequn",
>+   "bdltun",
>+   "bdltequn",
>+   "btd2i",
>+   "td2i",
>+   "bcd2i",
>+   "movdz",
>+   "pop",
>+   "push",
>+   "move",
>+   "sxi2p",
>+   "zxi2p",
>+   "nop",
>+   "bieq",
>+   "bineq",
>+   "bia",
>+   "biaeq",
>+   "bib",
>+   "bibeq",
>+   "bigt",
>+   "bigteq",
>+   "bilt",
>+   "bilteq",
>+   "bbeq",
>+   "bbneq",
>+   "bba",
>+   "bbaeq",
>+   "bbb",
>+   "bbbeq",
>+   "bbgt",
>+   "bbgteq",
>+   "bblt",
>+   "bblteq",
>+   "btio",
>+   "btis",
>+   "btiz",
>+   "btinz",
>+   "btbo",
>+   "btbs",
>+   "btbz",
>+   "btbnz",
>+   "jmp",
>+   "baddio",
>+   "baddis",
>+   "baddiz",
>+   "baddinz",
>+   "bsubio",
>+   "bsubis",
>+   "bsubiz",
>+   "bsubinz",
>+   "bmulio",
>+   "bmulis",
>+   "bmuliz",
>+   "bmulinz",
>+   "borio",
>+   "boris",
>+   "boriz",
>+   "borinz",
>+   "break",
>+   "call",
>+   "ret",
>+   "cieq",
>+   "cineq",
>+   "cia",
>+   "ciaeq",
>+   "cib",
>+   "cibeq",
>+   "cigt",
>+   "cigteq",
>+   "cilt",
>+   "cilteq",
>+   "tio",
>+   "tis",
>+   "tiz",
>+   "tinz",
>+   "tbo",
>+   "tbs",
>+   "tbz",
>+   "tbnz",
>+   "peek",
>+   "poke",
>+   "bpeq",
>+   "bpneq",
>+   "bpa",
>+   "bpaeq",
>+   "bpb",
>+   "bpbeq",
>+   "bpgt",
>+   "bpgteq",
>+   "bplt",
>+   "bplteq",
>+   "addp",
>+   "andp",
>+   "orp",
>+   "subp",
>+   "xorp",
>+   "loadp",
>+   "cpeq",
>+   "cpneq",
>+   "cpa",
>+   "cpaeq",
>+   "cpb",
>+   "cpbeq",
>+   "cpgt",
>+   "cpgteq",
>+   "cplt",
>+   "cplteq",
>+   "storep",
>+   "btpo",
>+   "btps",
>+   "btpz",
>+   "btpnz",
>+   "baddpo",
>+   "baddps",
>+   "baddpz",
>+   "baddpnz"
>+  ]
>+
>+X86_INSTRUCTIONS =
>+  [
>+   "cdqi",
>+   "idivi"
>+  ]
>+
>+INSTRUCTIONS = MACRO_INSTRUCTIONS + X86_INSTRUCTIONS
>+
>+INSTRUCTION_PATTERN = Regexp.new('\\A((' + INSTRUCTIONS.join(')|(') + '))\\Z')
>Index: Source/JavaScriptCore/offlineasm/offset_extractor_constants.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/offset_extractor_constants.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/offset_extractor_constants.rb	(revision 0)
>@@ -0,0 +1,26 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+MAGIC_NUMBERS = [ 0xec577ac7, 0x0ff5e755 ]
>+
>+
>Index: Source/JavaScriptCore/offlineasm/offsets.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/offsets.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/offsets.rb	(revision 0)
>@@ -0,0 +1,150 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "ast"
>+require "offset_extractor_constants"
>+
>+OFFSET_MAGIC_NUMBERS = [ 0xec577ac7, 0x0ff5e755 ]
>+
>+#
>+# offsetsList(ast)
>+# sizesList(ast)
>+#
>+# Returns a list of offsets and sizes used by the AST.
>+#
>+
>+def offsetsList(ast)
>+  ast.filter(StructOffset).uniq.sort
>+end
>+
>+def sizesList(ast)
>+  ast.filter(Sizeof).uniq.sort
>+end
>+
>+#
>+# offsetsAndConfigurationIndex(ast, file) ->
>+#     [offsets, index]
>+#
>+# Parses the offsets from a file and returns a list of offsets and the
>+# index of the configuration that is valid in this build target.
>+#
>+
>+def offsetsAndConfigurationIndex(file)
>+  index = nil
>+  offsets = []
>+  endiannessMarkerBytes = nil
>+  
>+  def readInt(endianness, inp)
>+    bytes = []
>+    4.times {
>+      bytes << inp.getbyte
>+    }
>+    
>+    if endianness == :little
>+      # Little endian
>+      (bytes[0] << 0 |
>+       bytes[1] << 8 |
>+       bytes[2] << 16 |
>+       bytes[3] << 24)
>+    else
>+      # Big endian
>+      (bytes[0] << 24 |
>+       bytes[1] << 16 |
>+       bytes[2] << 8 |
>+       bytes[3] << 0)
>+    end
>+  end
>+  
>+  [:little, :big].each {
>+    | endianness |
>+    magicBytes = []
>+    MAGIC_NUMBERS.each {
>+      | number |
>+      currentBytes = []
>+      4.times {
>+        currentBytes << (number & 0xff)
>+        number >>= 8
>+      }
>+      if endianness == :big
>+        currentBytes.reverse!
>+      end
>+      magicBytes += currentBytes
>+    }
>+    
>+    File.open(file, "r") {
>+      | inp |
>+      whereInMarker = 0
>+      loop {
>+        byte = inp.getbyte
>+        break unless byte
>+        if byte == magicBytes[whereInMarker]
>+          whereInMarker += 1
>+          if whereInMarker == magicBytes.size
>+            # We have a match! If we have not yet read the endianness marker and index,
>+            # then read those now; otherwise read an offset.
>+            
>+            if not index
>+              index = readInt(endianness, inp)
>+            else
>+              offsets << readInt(endianness, inp)
>+            end
>+            
>+            whereInMarker = 0
>+          end
>+        else
>+          whereInMarker = 0
>+        end
>+      }
>+    }
>+    
>+    break if index
>+  }
>+  
>+  raise unless index
>+  
>+  [offsets, index]
>+end
>+
>+#
>+# buildOffsetsMap(ast, offsetsList) -> [offsets, sizes]
>+#
>+# Builds a mapping between StructOffset nodes and their values.
>+#
>+
>+def buildOffsetsMap(ast, offsetsList)
>+  offsetsMap = {}
>+  sizesMap = {}
>+  astOffsetsList = offsetsList(ast)
>+  astSizesList = sizesList(ast)
>+  raise unless astOffsetsList.size + astSizesList.size == offsetsList.size
>+  offsetsList(ast).each_with_index {
>+    | structOffset, index |
>+    offsetsMap[structOffset] = offsetsList.shift
>+  }
>+  sizesList(ast).each_with_index {
>+    | sizeof, index |
>+    sizesMap[sizeof] = offsetsList.shift
>+  }
>+  [offsetsMap, sizesMap]
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/parser.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/parser.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/parser.rb	(revision 0)
>@@ -0,0 +1,585 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "ast"
>+require "instructions"
>+require "registers"
>+
>+class Token
>+  attr_reader :codeOrigin, :string
>+  
>+  def initialize(codeOrigin, string)
>+    @codeOrigin = codeOrigin
>+    @string = string
>+  end
>+  
>+  def ==(other)
>+    if other.is_a? Token
>+      @string == other.string
>+    else
>+      @string == other
>+    end
>+  end
>+  
>+  def =~(other)
>+    @string =~ other
>+  end
>+  
>+  def to_s
>+    "#{@string.inspect} at line #{codeOrigin}"
>+  end
>+  
>+  def parseError(*comment)
>+    if comment.empty?
>+      raise "Parse error: #{to_s}"
>+    else
>+      raise "Parse error: #{to_s}: #{comment[0]}"
>+    end
>+  end
>+end
>+
>+#
>+# The lexer. Takes a string and returns an array of tokens.
>+#
>+
>+def lex(str)
>+  result = []
>+  lineNumber = 1
>+  while not str.empty?
>+    case str
>+    when /\A\#([^\n]*)/
>+      # comment, ignore
>+    when /\A\n/
>+      result << Token.new(lineNumber, $&)
>+      lineNumber += 1
>+    when /\A[a-zA-Z]([a-zA-Z0-9_]*)/
>+      result << Token.new(lineNumber, $&)
>+    when /\A\.([a-zA-Z0-9_]*)/
>+      result << Token.new(lineNumber, $&)
>+    when /\A_([a-zA-Z0-9_]*)/
>+      result << Token.new(lineNumber, $&)
>+    when /\A([ \t]+)/
>+      # whitespace, ignore
>+    when /\A0x([0-9a-fA-F]+)/
>+      result << Token.new(lineNumber, $&.hex.to_s)
>+    when /\A0([0-7]+)/
>+      result << Token.new(lineNumber, $&.oct.to_s)
>+    when /\A([0-9]+)/
>+      result << Token.new(lineNumber, $&)
>+    when /\A::/
>+      result << Token.new(lineNumber, $&)
>+    when /\A[:,\[\]=\+\-*]/
>+      result << Token.new(lineNumber, $&)
>+    else
>+      raise "Lexer error at line number #{lineNumber}, unexpected sequence #{str[0..20].inspect}"
>+    end
>+    str = $~.post_match
>+  end
>+  result
>+end
>+
>+#
>+# Token identification.
>+#
>+
>+def isRegister(token)
>+  token =~ REGISTER_PATTERN
>+end
>+
>+def isInstruction(token)
>+  token =~ INSTRUCTION_PATTERN
>+end
>+
>+def isKeyword(token)
>+  token =~ /\A((true)|(false)|(if)|(then)|(else)|(elsif)|(end)|(and)|(or)|(not)|(macro)|(const)|(sizeof)|(error))\Z/ or
>+    token =~ REGISTER_PATTERN or
>+    token =~ INSTRUCTION_PATTERN
>+end
>+
>+def isIdentifier(token)
>+  token =~ /\A[a-zA-Z]([a-zA-Z0-9_]*)\Z/ and not isKeyword(token)
>+end
>+
>+def isLabel(token)
>+  token =~ /\A_([a-zA-Z0-9_]*)\Z/
>+end
>+
>+def isLocalLabel(token)
>+  token =~ /\A\.([a-zA-Z0-9_]*)\Z/
>+end
>+
>+def isVariable(token)
>+  isIdentifier(token) or isRegister(token)
>+end
>+
>+def isInteger(token)
>+  token =~ /\A[0-9]/
>+end
>+
>+#
>+# The parser. Takes an array of tokens and returns an AST. Methods
>+# other than parse(tokens) are not for public consumption.
>+#
>+
>+class Parser
>+  def initialize(tokens)
>+    @tokens = tokens
>+    @idx = 0
>+  end
>+  
>+  def parseError(*comment)
>+    if @tokens[@idx]
>+      @tokens[@idx].parseError(*comment)
>+    else
>+      if comment.empty?
>+        raise "Parse error at end of file"
>+      else
>+        raise "Parse error at end of file: #{comment[0]}"
>+      end
>+    end
>+  end
>+  
>+  def consume(regexp)
>+    if regexp
>+      parseError unless @tokens[@idx] =~ regexp
>+    else
>+      parseError unless @idx == @tokens.length
>+    end
>+    @idx += 1
>+  end
>+  
>+  def skipNewLine
>+    while @tokens[@idx] == "\n"
>+      @idx += 1
>+    end
>+  end
>+  
>+  def parsePredicateAtom
>+    if @tokens[@idx] == "not"
>+      @idx += 1
>+      parsePredicateAtom
>+    elsif @tokens[@idx] == "("
>+      @idx += 1
>+      skipNewLine
>+      result = parsePredicate
>+      parseError unless @tokens[@idx] == ")"
>+      @idx += 1
>+      result
>+    elsif @tokens[@idx] == "true"
>+      result = True.instance
>+      @idx += 1
>+      result
>+    elsif @tokens[@idx] == "false"
>+      result = False.instance
>+      @idx += 1
>+      result
>+    elsif isIdentifier @tokens[@idx]
>+      result = Setting.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+      @idx += 1
>+      result
>+    else
>+      parseError
>+    end
>+  end
>+  
>+  def parsePredicateAnd
>+    result = parsePredicateAtom
>+    while @tokens[@idx] == "and"
>+      codeOrigin = @tokens[@idx].codeOrigin
>+      @idx += 1
>+      skipNewLine
>+      right = parsePredicateAtom
>+      result = And.new(codeOrigin, result, right)
>+    end
>+    result
>+  end
>+  
>+  def parsePredicate
>+    # some examples of precedence:
>+    # not a and b -> (not a) and b
>+    # a and b or c -> (a and b) or c
>+    # a or b and c -> a or (b and c)
>+    
>+    result = parsePredicateAnd
>+    while @tokens[@idx] == "or"
>+      codeOrigin = @tokens[@idx].codeOrigin
>+      @idx += 1
>+      skipNewLine
>+      right = parsePredicateAnd
>+      result = Or.new(codeOrigin, result, right)
>+    end
>+    result
>+  end
>+  
>+  def parseVariable
>+    if isRegister(@tokens[@idx])
>+      if @tokens[@idx] =~ FPR_PATTERN
>+        result = FPRegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+      else
>+        result = RegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+      end
>+    elsif isIdentifier(@tokens[@idx])
>+      result = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+    else
>+      parseError
>+    end
>+    @idx += 1
>+    result
>+  end
>+  
>+  def parseAddress(offset)
>+    parseError unless @tokens[@idx] == "["
>+    codeOrigin = @tokens[@idx].codeOrigin
>+    
>+    # Three possibilities:
>+    # []       -> AbsoluteAddress
>+    # [a]      -> Address
>+    # [a,b]    -> BaseIndex with scale = 1
>+    # [a,b,c]  -> BaseIndex
>+    
>+    @idx += 1
>+    if @tokens[@idx] == "]"
>+      @idx += 1
>+      return AbsoluteAddress.new(codeOrigin, offset)
>+    end
>+    a = parseVariable
>+    if @tokens[@idx] == "]"
>+      result = Address.new(codeOrigin, a, offset)
>+    else
>+      parseError unless @tokens[@idx] == ","
>+      @idx += 1
>+      b = parseVariable
>+      if @tokens[@idx] == "]"
>+        result = BaseIndex.new(codeOrigin, a, b, 1, offset)
>+      else
>+        parseError unless @tokens[@idx] == ","
>+        @idx += 1
>+        parseError unless ["1", "2", "4", "8"].member? @tokens[@idx].string
>+        c = @tokens[@idx].string.to_i
>+        @idx += 1
>+        parseError unless @tokens[@idx] == "]"
>+        result = BaseIndex.new(codeOrigin, a, b, c, offset)
>+      end
>+    end
>+    @idx += 1
>+    result
>+  end
>+  
>+  def parseColonColon
>+    skipNewLine
>+    codeOrigin = @tokens[@idx].codeOrigin
>+    parseError unless isIdentifier @tokens[@idx]
>+    names = [@tokens[@idx].string]
>+    @idx += 1
>+    while @tokens[@idx] == "::"
>+      @idx += 1
>+      parseError unless isIdentifier @tokens[@idx]
>+      names << @tokens[@idx].string
>+      @idx += 1
>+    end
>+    raise if names.empty?
>+    [codeOrigin, names]
>+  end
>+  
>+  def parseExpressionAtom
>+    skipNewLine
>+    if @tokens[@idx] == "-"
>+      @idx += 1
>+      NegImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
>+    elsif @tokens[@idx] == "("
>+      @idx += 1
>+      result = parseExpression
>+      parseError unless @tokens[@idx] == ")"
>+      @idx += 1
>+      result
>+    elsif isInteger @tokens[@idx]
>+      result = Immediate.new(@tokens[@idx].codeOrigin, @tokens[@idx].string.to_i)
>+      @idx += 1
>+      result
>+    elsif isIdentifier @tokens[@idx]
>+      codeOrigin, names = parseColonColon
>+      if names.size > 1
>+        StructOffset.forField(codeOrigin, names[0..-2].join('::'), names[-1])
>+      else
>+        Variable.forName(codeOrigin, names[0])
>+      end
>+    elsif isRegister @tokens[@idx]
>+      parseVariable
>+    elsif @tokens[@idx] == "sizeof"
>+      @idx += 1
>+      codeOrigin, names = parseColonColon
>+      Sizeof.forName(codeOrigin, names.join('::'))
>+    else
>+      parseError
>+    end
>+  end
>+  
>+  def parseExpressionMul
>+    skipNewLine
>+    result = parseExpressionAtom
>+    while @tokens[@idx] == "*"
>+      if @tokens[@idx] == "*"
>+        @idx += 1
>+        result = MulImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAtom)
>+      else
>+        raise
>+      end
>+    end
>+    result
>+  end
>+  
>+  def couldBeExpression
>+    @tokens[@idx] == "-" or @tokens[@idx] == "sizeof" or isInteger(@tokens[@idx]) or isVariable(@tokens[@idx]) or @tokens[@idx] == "("
>+  end
>+  
>+  def parseExpression
>+    skipNewLine
>+    result = parseExpressionMul
>+    while @tokens[@idx] == "+" or @tokens[@idx] == "-"
>+      if @tokens[@idx] == "+"
>+        @idx += 1
>+        result = AddImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
>+      elsif @tokens[@idx] == "-"
>+        @idx += 1
>+        result = SubImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
>+      else
>+        raise
>+      end
>+    end
>+    result
>+  end
>+  
>+  def parseOperand(comment)
>+    if couldBeExpression
>+      expr = parseExpression
>+      if @tokens[@idx] == "["
>+        parseAddress(expr)
>+      else
>+        expr
>+      end
>+    elsif @tokens[@idx] == "["
>+      parseAddress(Immediate.new(@tokens[@idx].codeOrigin, 0))
>+    elsif isLabel @tokens[@idx]
>+      result = LabelReference.new(@tokens[@idx].codeOrigin, Label.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
>+      @idx += 1
>+      result
>+    elsif isLocalLabel @tokens[@idx]
>+      result = LocalLabelReference.new(@tokens[@idx].codeOrigin, LocalLabel.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
>+      @idx += 1
>+      result
>+    else
>+      parseError(comment)
>+    end
>+  end
>+  
>+  def parseMacroVariables
>+    skipNewLine
>+    consume(/\A\(\Z/)
>+    variables = []
>+    loop {
>+      skipNewLine
>+      if @tokens[@idx] == ")"
>+        @idx += 1
>+        break
>+      elsif isIdentifier(@tokens[@idx])
>+        variables << Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+        @idx += 1
>+        skipNewLine
>+        if @tokens[@idx] == ")"
>+          @idx += 1
>+          break
>+        elsif @tokens[@idx] == ","
>+          @idx += 1
>+        else
>+          parseError
>+        end
>+      else
>+        parseError
>+      end
>+    }
>+    variables
>+  end
>+  
>+  def parseSequence(final, comment)
>+    firstCodeOrigin = @tokens[@idx].codeOrigin
>+    list = []
>+    loop {
>+      if (@idx == @tokens.length and not final) or (final and @tokens[@idx] =~ final)
>+        break
>+      elsif @tokens[@idx] == "\n"
>+        # ignore
>+        @idx += 1
>+      elsif @tokens[@idx] == "const"
>+        @idx += 1
>+        parseError unless isVariable @tokens[@idx]
>+        variable = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
>+        @idx += 1
>+        parseError unless @tokens[@idx] == "="
>+        @idx += 1
>+        value = parseOperand("while inside of const #{variable.name}")
>+        list << ConstDecl.new(@tokens[@idx].codeOrigin, variable, value)
>+      elsif @tokens[@idx] == "error"
>+        list << Error.new(@tokens[@idx].codeOrigin)
>+        @idx += 1
>+      elsif @tokens[@idx] == "if"
>+        codeOrigin = @tokens[@idx].codeOrigin
>+        @idx += 1
>+        skipNewLine
>+        predicate = parsePredicate
>+        consume(/\A((then)|(\n))\Z/)
>+        skipNewLine
>+        ifThenElse = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
>+        list << ifThenElse
>+        while @tokens[@idx] == "elsif"
>+          codeOrigin = @tokens[@idx].codeOrigin
>+          @idx += 1
>+          skipNewLine
>+          predicate = parsePredicate
>+          consume(/\A((then)|(\n))\Z/)
>+          skipNewLine
>+          elseCase = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
>+          ifThenElse.elseCase = elseCase
>+          ifThenElse = elseCase
>+        end
>+        if @tokens[@idx] == "else"
>+          @idx += 1
>+          ifThenElse.elseCase = parseSequence(/\Aend\Z/, "while inside of else case for \"if #{predicate.dump}\"")
>+          @idx += 1
>+        else
>+          parseError unless @tokens[@idx] == "end"
>+          @idx += 1
>+        end
>+      elsif @tokens[@idx] == "macro"
>+        codeOrigin = @tokens[@idx].codeOrigin
>+        @idx += 1
>+        skipNewLine
>+        parseError unless isIdentifier(@tokens[@idx])
>+        name = @tokens[@idx].string
>+        @idx += 1
>+        variables = parseMacroVariables
>+        body = parseSequence(/\Aend\Z/, "while inside of macro #{name}")
>+        @idx += 1
>+        list << Macro.new(codeOrigin, name, variables, body)
>+      elsif isInstruction @tokens[@idx]
>+        codeOrigin = @tokens[@idx].codeOrigin
>+        name = @tokens[@idx].string
>+        @idx += 1
>+        if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
>+          # Zero operand instruction, and it's the last one.
>+          list << Instruction.new(codeOrigin, name, [])
>+          break
>+        elsif @tokens[@idx] == "\n"
>+          # Zero operand instruction.
>+          list << Instruction.new(codeOrigin, name, [])
>+          @idx += 1
>+        else
>+          # It's definitely an instruction, and it has at least one operand.
>+          operands = []
>+          endOfSequence = false
>+          loop {
>+            operands << parseOperand("while inside of instruction #{name}")
>+            if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
>+              # The end of the instruction and of the sequence.
>+              endOfSequence = true
>+              break
>+            elsif @tokens[@idx] == ","
>+              # Has another operand.
>+              @idx += 1
>+            elsif @tokens[@idx] == "\n"
>+              # The end of the instruction.
>+              @idx += 1
>+              break
>+            else
>+              parseError("Expected a comma, newline, or #{final} after #{operands.last.dump}")
>+            end
>+          }
>+          list << Instruction.new(codeOrigin, name, operands)
>+          if endOfSequence
>+            break
>+          end
>+        end
>+      elsif isIdentifier @tokens[@idx]
>+        codeOrigin = @tokens[@idx].codeOrigin
>+        name = @tokens[@idx].string
>+        @idx += 1
>+        if @tokens[@idx] == "("
>+          # Macro invocation.
>+          @idx += 1
>+          operands = []
>+          skipNewLine
>+          if @tokens[@idx] == ")"
>+            @idx += 1
>+          else
>+            loop {
>+              skipNewLine
>+              if @tokens[@idx] == "macro"
>+                # It's a macro lambda!
>+                codeOriginInner = @tokens[@idx].codeOrigin
>+                @idx += 1
>+                variables = parseMacroVariables
>+                body = parseSequence(/\Aend\Z/, "while inside of anonymous macro passed as argument to #{name}")
>+                @idx += 1
>+                operands << Macro.new(codeOriginInner, nil, variables, body)
>+              else
>+                operands << parseOperand("while inside of macro call to #{name}")
>+              end
>+              skipNewLine
>+              if @tokens[@idx] == ")"
>+                @idx += 1
>+                break
>+              elsif @tokens[@idx] == ","
>+                @idx += 1
>+              else
>+                parseError "Unexpected #{@tokens[@idx].string.inspect} while parsing invocation of macro #{name}"
>+              end
>+            }
>+          end
>+          list << MacroCall.new(codeOrigin, name, operands)
>+        else
>+          parseError "Expected \"(\" after #{name}"
>+        end
>+      elsif isLabel @tokens[@idx] or isLocalLabel @tokens[@idx]
>+        codeOrigin = @tokens[@idx].codeOrigin
>+        name = @tokens[@idx].string
>+        @idx += 1
>+        parseError unless @tokens[@idx] == ":"
>+        # It's a label.
>+        if isLabel name
>+          list << Label.forName(codeOrigin, name)
>+        else
>+          list << LocalLabel.forName(codeOrigin, name)
>+        end
>+        @idx += 1
>+      else
>+        parseError "Expecting terminal #{final} #{comment}"
>+      end
>+    }
>+    Sequence.new(firstCodeOrigin, list)
>+  end
>+end
>+
>+def parse(tokens)
>+  parser = Parser.new(tokens)
>+  parser.parseSequence(nil, "")
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/registers.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/registers.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/registers.rb	(revision 0)
>@@ -0,0 +1,59 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+GPRS =
>+  [
>+   "t0",
>+   "t1",
>+   "t2",
>+   "t3",
>+   "t4",
>+   "cfr",
>+   "a0",
>+   "a1",
>+   "r0",
>+   "r1",
>+   "sp"
>+  ]
>+
>+FPRS =
>+  [
>+   "ft0",
>+   "ft1",
>+   "ft2",
>+   "ft3",
>+   "ft4",
>+   "ft5",
>+   "fa0",
>+   "fa1",
>+   "fa2",
>+   "fa3",
>+   "fr"
>+  ]
>+
>+REGISTERS = GPRS + FPRS
>+
>+GPR_PATTERN = Regexp.new('\\A((' + GPRS.join(')|(') + '))\\Z')
>+FPR_PATTERN = Regexp.new('\\A((' + FPRS.join(')|(') + '))\\Z')
>+
>+REGISTER_PATTERN = Regexp.new('\\A((' + REGISTERS.join(')|(') + '))\\Z')
>Index: Source/JavaScriptCore/offlineasm/self_hash.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/self_hash.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/self_hash.rb	(revision 0)
>@@ -0,0 +1,48 @@
>+#!/usr/bin/env ruby
>+
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "digest/sha1"
>+require "pathname"
>+
>+#
>+# selfHash -> SHA1 hexdigest
>+#
>+# Returns a hash of the offlineasm source code. This allows dependency
>+# tracking for not just changes in input, but also changes in the assembler
>+# itself.
>+#
>+
>+def selfHash
>+  contents = ""
>+  myPath = Pathname.new(__FILE__).dirname
>+  Dir.foreach(myPath) {
>+    | entry |
>+    if entry =~ /\.rb$/
>+      contents += IO::read(myPath + entry)
>+    end
>+  }
>+  return Digest::SHA1.hexdigest(contents)
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/settings.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/settings.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/settings.rb	(revision 0)
>@@ -0,0 +1,205 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "ast"
>+require "backends"
>+require "parser"
>+require "transform"
>+
>+#
>+# computeSettingsCombinations(ast) -> settingsCombiations
>+#
>+# Computes an array of settings maps, where a settings map constitutes
>+# a configuration for the assembly code being generated. The map
>+# contains key value pairs where keys are settings names (strings) and
>+# the values are booleans (true for enabled, false for disabled).
>+#
>+
>+def computeSettingsCombinations(ast)
>+  settingsCombinations = []
>+  
>+  def settingsCombinator(settingsCombinations, mapSoFar, remaining)
>+    if remaining.empty?
>+      settingsCombinations << mapSoFar
>+      return
>+    end
>+    
>+    newMap = mapSoFar.dup
>+    newMap[remaining[0]] = true
>+    settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
>+    
>+    newMap = mapSoFar.dup
>+    newMap[remaining[0]] = false
>+    settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
>+  end
>+  
>+  settingsCombinator(settingsCombinations, {}, (ast.filter(Setting).uniq.collect{|v| v.name} + ["X86", "ARMv7"]).uniq)
>+  
>+  settingsCombinations
>+end
>+
>+#
>+# forSettings(concreteSettings, ast) {
>+#     | concreteSettings, lowLevelAST, backend | ... }
>+#
>+# Determines if the settings combination is valid, and if so, calls
>+# the block with the information you need to generate code.
>+#
>+
>+def forSettings(concreteSettings, ast)
>+  # Check which architectures this combinator claims to support.
>+  numClaimedBackends = 0
>+  selectedBackend = nil
>+  BACKENDS.each {
>+    | backend |
>+    isSupported = concreteSettings[backend]
>+    raise unless isSupported != nil
>+    numClaimedBackends += if isSupported then 1 else 0 end
>+    if isSupported
>+      selectedBackend = backend
>+    end
>+  }
>+  
>+  return if numClaimedBackends > 1
>+  
>+  # Resolve the AST down to a low-level form (no macros or conditionals).
>+  lowLevelAST = ast.resolveSettings(concreteSettings)
>+  
>+  yield concreteSettings, lowLevelAST, selectedBackend
>+end
>+
>+#
>+# forEachValidSettingsCombination(ast) {
>+#     | concreteSettings, ast, backend, index | ... }
>+#
>+# forEachValidSettingsCombination(ast, settingsCombinations) {
>+#     | concreteSettings, ast, backend, index | ... }
>+#
>+# Executes the given block for each valid settings combination in the
>+# settings map. The ast passed into the block is resolved
>+# (ast.resolve) against the settings.
>+#
>+# The first form will call computeSettingsCombinations(ast) for you.
>+#
>+
>+def forEachValidSettingsCombination(ast, *optionalSettingsCombinations)
>+  raise if optionalSettingsCombinations.size > 1
>+  
>+  if optionalSettingsCombinations.empty?
>+    settingsCombinations = computeSettingsCombinations(ast)
>+  else
>+    settingsCombinations = optionalSettingsCombiations[0]
>+  end
>+  
>+  settingsCombinations.each_with_index {
>+    | concreteSettings, index |
>+    forSettings(concreteSettings, ast) {
>+      | concreteSettings_, lowLevelAST, backend |
>+      yield concreteSettings, lowLevelAST, backend, index
>+    }
>+  }
>+end
>+
>+#
>+# cppSettingsTest(concreteSettings)
>+#
>+# Returns the C++ code used to test if we are in a configuration that
>+# corresponds to the given concrete settings.
>+#
>+
>+def cppSettingsTest(concreteSettings)
>+  "#if " + concreteSettings.to_a.collect{
>+    | pair |
>+    (if pair[1]
>+       ""
>+     else
>+       "!"
>+     end) + "OFFLINE_ASM_" + pair[0]
>+  }.join(" && ")
>+end
>+
>+#
>+# isASTErroneous(ast)
>+#
>+# Tests to see if the AST claims that there is an error - i.e. if the
>+# user's code, after settings resolution, has Error nodes.
>+#
>+
>+def isASTErroneous(ast)
>+  not ast.filter(Error).empty?
>+end
>+
>+#
>+# assertConfiguration(concreteSettings)
>+#
>+# Emits a check that asserts that we're using the given configuration.
>+#
>+
>+def assertConfiguration(concreteSettings)
>+  $output.puts cppSettingsTest(concreteSettings)
>+  $output.puts "#else"
>+  $output.puts "#error \"Configuration mismatch.\""
>+  $output.puts "#endif"
>+end
>+
>+#
>+# emitCodeInConfiguration(concreteSettings, ast, backend) {
>+#     | concreteSettings, ast, backend | ... }
>+#
>+# Emits all relevant guards to see if the configuration holds and
>+# calls the block if the configuration is not erroneous.
>+#
>+
>+def emitCodeInConfiguration(concreteSettings, ast, backend)
>+  $output.puts cppSettingsTest(concreteSettings)
>+  
>+  if isASTErroneous(ast)
>+    $output.puts "#error \"Invalid configuration.\""
>+  elsif not WORKING_BACKENDS.include? backend
>+    $output.puts "#error \"This backend is not supported yet.\""
>+  else
>+    yield concreteSettings, ast, backend
>+  end
>+  
>+  $output.puts "#endif"
>+end
>+
>+#
>+# emitCodeInAllConfigurations(ast) {
>+#     | concreteSettings, ast, backend, index | ... }
>+#
>+# Emits guard codes for all valid configurations, and calls the block
>+# for those configurations that are valid and not erroneous.
>+#
>+
>+def emitCodeInAllConfigurations(ast)
>+  forEachValidSettingsCombination(ast) {
>+    | concreteSettings, lowLevelAST, backend, index |
>+    $output.puts cppSettingsTest(concreteSettings)
>+    yield concreteSettings, lowLevelAST, backend, index
>+    $output.puts "#endif"
>+  }
>+end
>+
>+
>+
>Index: Source/JavaScriptCore/offlineasm/transform.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/transform.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/transform.rb	(revision 0)
>@@ -0,0 +1,342 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+require "ast"
>+
>+#
>+# node.resolveSettings(settings)
>+#
>+# Construct a new AST that does not have any IfThenElse nodes by
>+# substituting concrete boolean values for each Setting.
>+#
>+
>+class Node
>+  def resolveSettings(settings)
>+    mapChildren {
>+      | child |
>+      child.resolveSettings(settings)
>+    }
>+  end
>+end
>+
>+class True
>+  def resolveSettings(settings)
>+    self
>+  end
>+end
>+
>+class False
>+  def resolveSettings(settings)
>+    self
>+  end
>+end
>+
>+class Setting
>+  def resolveSettings(settings)
>+    settings[@name].asNode
>+  end
>+end
>+
>+class And
>+  def resolveSettings(settings)
>+    (@left.resolveSettings(settings).value and @right.resolveSettings(settings).value).asNode
>+  end
>+end
>+
>+class Or
>+  def resolveSettings(settings)
>+    (@left.resolveSettings(settings).value or @right.resolveSettings(settings).value).asNode
>+  end
>+end
>+
>+class Not
>+  def resolveSettings(settings)
>+    (not @child.resolveSettings(settings).value).asNode
>+  end
>+end
>+
>+class IfThenElse
>+  def resolveSettings(settings)
>+    if @predicate.resolveSettings(settings).value
>+      @thenCase.resolveSettings(settings)
>+    else
>+      @elseCase.resolveSettings(settings)
>+    end
>+  end
>+end
>+
>+class Sequence
>+  def resolveSettings(settings)
>+    newList = []
>+    @list.each {
>+      | item |
>+      item = item.resolveSettings(settings)
>+      if item.is_a? Sequence
>+        newList += item.list
>+      else
>+        newList << item
>+      end
>+    }
>+    Sequence.new(codeOrigin, newList)
>+  end
>+end
>+
>+#
>+# node.demacroify(macros)
>+# node.substitute(mapping)
>+#
>+# demacroify() constructs a new AST that does not have any Macro
>+# nodes, while substitute() replaces Variable nodes with the given
>+# nodes in the mapping.
>+#
>+
>+class Node
>+  def demacroify(macros)
>+    mapChildren {
>+      | child |
>+      child.demacroify(macros)
>+    }
>+  end
>+  
>+  def substitute(mapping)
>+    mapChildren {
>+      | child |
>+      child.substitute(mapping)
>+    }
>+  end
>+  
>+  def substituteLabels(mapping)
>+    mapChildren {
>+      | child |
>+      child.substituteLabels(mapping)
>+    }
>+  end
>+end
>+
>+class Macro
>+  def substitute(mapping)
>+    myMapping = {}
>+    mapping.each_pair {
>+      | key, value |
>+      unless @variables.include? key
>+        myMapping[key] = value
>+      end
>+    }
>+    mapChildren {
>+      | child |
>+      child.substitute(myMapping)
>+    }
>+  end
>+end
>+
>+class Variable
>+  def substitute(mapping)
>+    if mapping[self]
>+      mapping[self]
>+    else
>+      self
>+    end
>+  end
>+end
>+
>+class LocalLabel
>+  def substituteLabels(mapping)
>+    if mapping[self]
>+      mapping[self]
>+    else
>+      self
>+    end
>+  end
>+end
>+
>+class Sequence
>+  def substitute(constants)
>+    newList = []
>+    myConstants = constants.dup
>+    @list.each {
>+      | item |
>+      if item.is_a? ConstDecl
>+        myConstants[item.variable] = item.value.substitute(myConstants)
>+      else
>+        newList << item.substitute(myConstants)
>+      end
>+    }
>+    Sequence.new(codeOrigin, newList)
>+  end
>+  
>+  def renameLabels(comment)
>+    mapping = {}
>+    
>+    @list.each {
>+      | item |
>+      if item.is_a? LocalLabel
>+        mapping[item] = LocalLabel.unique(if comment then comment + "_" else "" end + item.cleanName)
>+      end
>+    }
>+    
>+    substituteLabels(mapping)
>+  end
>+  
>+  def demacroify(macros)
>+    myMacros = macros.dup
>+    @list.each {
>+      | item |
>+      if item.is_a? Macro
>+        myMacros[item.name] = item
>+      end
>+    }
>+    newList = []
>+    @list.each {
>+      | item |
>+      if item.is_a? Macro
>+        # Ignore.
>+      elsif item.is_a? MacroCall
>+        mapping = {}
>+        myMyMacros = myMacros.dup
>+        raise "Could not find macro #{item.name} at #{item.codeOriginString}" unless myMacros[item.name]
>+        raise "Argument count mismatch for call to #{item.name} at #{item.codeOriginString}" unless item.operands.size == myMacros[item.name].variables.size
>+        item.operands.size.times {
>+          | idx |
>+          if item.operands[idx].is_a? Variable and myMacros[item.operands[idx].name]
>+            myMyMacros[myMacros[item.name].variables[idx].name] = myMacros[item.operands[idx].name]
>+            mapping[myMacros[item.name].variables[idx].name] = nil
>+          elsif item.operands[idx].is_a? Macro
>+            myMyMacros[myMacros[item.name].variables[idx].name] = item.operands[idx]
>+            mapping[myMacros[item.name].variables[idx].name] = nil
>+          else
>+            myMyMacros[myMacros[item.name].variables[idx]] = nil
>+            mapping[myMacros[item.name].variables[idx]] = item.operands[idx]
>+          end
>+        }
>+        newList += myMacros[item.name].body.substitute(mapping).demacroify(myMyMacros).renameLabels(item.name).list
>+      else
>+        newList << item.demacroify(myMacros)
>+      end
>+    }
>+    Sequence.new(codeOrigin, newList).substitute({})
>+  end
>+end
>+
>+#
>+# node.resolveOffsets(offsets, sizes)
>+#
>+# Construct a new AST that has offset values instead of symbolic
>+# offsets.
>+#
>+
>+class Node
>+  def resolveOffsets(offsets, sizes)
>+    mapChildren {
>+      | child |
>+      child.resolveOffsets(offsets, sizes)
>+    }
>+  end
>+end
>+
>+class StructOffset
>+  def resolveOffsets(offsets, sizes)
>+    if offsets[self]
>+      Immediate.new(codeOrigin, offsets[self])
>+    else
>+      self
>+    end
>+  end
>+end
>+
>+class Sizeof
>+  def resolveOffsets(offsets, sizes)
>+    if sizes[self]
>+      Immediate.new(codeOrigin, sizes[self])
>+    else
>+      puts "Could not find #{self.inspect} in #{sizes.keys.inspect}"
>+      puts "sizes = #{sizes.inspect}"
>+      self
>+    end
>+  end
>+end
>+
>+#
>+# node.fold
>+#
>+# Resolve constant references and compute arithmetic expressions.
>+#
>+
>+class Node
>+  def fold
>+    mapChildren {
>+      | child |
>+      child.fold
>+    }
>+  end
>+end
>+
>+class AddImmediates
>+  def fold
>+    @left = @left.fold
>+    @right = @right.fold
>+    return self unless @left.is_a? Immediate
>+    return self unless @right.is_a? Immediate
>+    Immediate.new(codeOrigin, @left.value + @right.value)
>+  end
>+end
>+
>+class SubImmediates
>+  def fold
>+    @left = @left.fold
>+    @right = @right.fold
>+    return self unless @left.is_a? Immediate
>+    return self unless @right.is_a? Immediate
>+    Immediate.new(codeOrigin, @left.value - @right.value)
>+  end
>+end
>+
>+class MulImmediates
>+  def fold
>+    @left = @left.fold
>+    @right = @right.fold
>+    return self unless @left.is_a? Immediate
>+    return self unless @right.is_a? Immediate
>+    Immediate.new(codeOrigin, @left.value * @right.value)
>+  end
>+end
>+
>+class NegImmediate
>+  def fold
>+    @child = @child.fold
>+    return self unless @child.is_a? Immediate
>+    Immediate.new(codeOrigin, -@child.value)
>+  end
>+end
>+
>+#
>+# node.resolveAfterSettings(offsets, sizes)
>+#
>+# Compile assembly against a set of offsets.
>+#
>+
>+class Node
>+  def resolve(offsets, sizes)
>+    demacroify({}).resolveOffsets(offsets, sizes).fold
>+  end
>+end
>+
>Index: Source/JavaScriptCore/offlineasm/x86.rb
>===================================================================
>--- Source/JavaScriptCore/offlineasm/x86.rb	(revision 0)
>+++ Source/JavaScriptCore/offlineasm/x86.rb	(revision 0)
>@@ -0,0 +1,667 @@
>+# Copyright (C) 2011 Apple Inc. All rights reserved.
>+#
>+# Redistribution and use in source and binary forms, with or without
>+# modification, are permitted provided that the following conditions
>+# are met:
>+# 1. Redistributions of source code must retain the above copyright
>+#    notice, this list of conditions and the following disclaimer.
>+# 2. Redistributions in binary form must reproduce the above copyright
>+#    notice, this list of conditions and the following disclaimer in the
>+#    documentation and/or other materials provided with the distribution.
>+#
>+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+# THE POSSIBILITY OF SUCH DAMAGE.
>+
>+class RegisterID
>+  def supports8BitOnX86
>+    case name
>+    when "t0", "a0", "r0", "t1", "a1", "r1", "t2", "t3"
>+      true
>+    when "t4", "cfr"
>+      false
>+    else
>+      raise
>+    end
>+  end
>+  
>+  def x86Operand(kind)
>+    case name
>+    when "t0", "a0", "r0"
>+      case kind
>+      when :byte
>+        "%al"
>+      when :half
>+        "%ax"
>+      when :int
>+        "%eax"
>+      else
>+        raise
>+      end
>+    when "t1", "a1", "r1"
>+      case kind
>+      when :byte
>+        "%dl"
>+      when :half
>+        "%dx"
>+      when :int
>+        "%edx"
>+      else
>+        raise
>+      end
>+    when "t2"
>+      case kind
>+      when :byte
>+        "%cl"
>+      when :half
>+        "%cx"
>+      when :int
>+        "%ecx"
>+      else
>+        raise
>+      end
>+    when "t3"
>+      case kind
>+      when :byte
>+        "%bl"
>+      when :half
>+        "%bx"
>+      when :int
>+        "%ebx"
>+      else
>+        raise
>+      end
>+    when "t4"
>+      case kind
>+      when :byte
>+        "%sil"
>+      when :half
>+        "%si"
>+      when :int
>+        "%esi"
>+      else
>+        raise
>+      end
>+    when "cfr"
>+      case kind
>+      when :byte
>+        "%dil"
>+      when :half
>+        "%di"
>+      when :int
>+        "%edi"
>+      else
>+        raise
>+      end
>+    when "sp"
>+      case kind
>+      when :byte
>+        "%spl"
>+      when :half
>+        "%sp"
>+      when :int
>+        "%esp"
>+      else
>+        raise
>+      end
>+    else
>+      raise
>+    end
>+  end
>+  def x86CallOperand(kind)
>+    "*#{x86Operand(kind)}"
>+  end
>+end
>+
>+class FPRegisterID
>+  def x86Operand(kind)
>+    raise unless kind == :double
>+    case name
>+    when "ft0", "fa0", "fr"
>+      "%xmm0"
>+    when "ft1", "fa1"
>+      "%xmm1"
>+    when "ft2", "fa2"
>+      "%xmm2"
>+    when "ft3", "fa3"
>+      "%xmm3"
>+    when "ft4"
>+      "%xmm4"
>+    when "ft5"
>+      "%xmm5"
>+    else
>+      raise
>+    end
>+  end
>+  def x86CallOperand(kind)
>+    "*#{x86Operand(kind)}"
>+  end
>+end
>+
>+class Immediate
>+  def x86Operand(kind)
>+    "$#{value}"
>+  end
>+  def x86CallOperand(kind)
>+    "#{value}"
>+  end
>+end
>+
>+class Address
>+  def supports8BitOnX86
>+    true
>+  end
>+    
>+  def x86Operand(kind)
>+    "#{offset.value}(#{base.x86Operand(:int)})"
>+  end
>+  def x86CallOperand(kind)
>+    "*#{x86Operand(kind)}"
>+  end
>+end
>+
>+class BaseIndex
>+  def supports8BitOnX86
>+    true
>+  end
>+    
>+  def x86Operand(kind)
>+    "#{offset.value}(#{base.x86Operand(:int)}, #{index.x86Operand(:int)}, #{scale})"
>+  end
>+
>+  def x86CallOperand(kind)
>+    "*#{x86operand(kind)}"
>+  end
>+end
>+
>+class AbsoluteAddress
>+  def supports8BitOnX86
>+    true
>+  end
>+    
>+  def x86Operand(kind)
>+    "#{address.value}"
>+  end
>+
>+  def x86CallOperand(kind)
>+    "*#{address.value}"
>+  end
>+end
>+
>+class LabelReference
>+  def x86CallOperand(kind)
>+    asmLabel
>+  end
>+end
>+
>+class LocalLabelReference
>+  def x86CallOperand(kind)
>+    asmLabel
>+  end
>+end
>+
>+class Instruction
>+  def x86Operands(*kinds)
>+    raise unless kinds.size == operands.size
>+    result = []
>+    kinds.size.times {
>+      | idx |
>+      result << operands[idx].x86Operand(kinds[idx])
>+    }
>+    result.join(", ")
>+  end
>+
>+  def x86Suffix(kind)
>+    case kind
>+    when :byte
>+      "b"
>+    when :half
>+      "w"
>+    when :int
>+      "l"
>+    when :double
>+      "sd"
>+    else
>+      raise
>+    end
>+  end
>+  
>+  def handleX86OpWithNumOperands(opcode, kind, numOperands)
>+    if numOperands == 3
>+      if operands[0] == operands[2]
>+        $asm.puts "#{opcode} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
>+      elsif operands[1] == operands[2]
>+        $asm.puts "#{opcode} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
>+      else
>+        $asm.puts "mov#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
>+        $asm.puts "#{opcode} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
>+      end
>+    else
>+      $asm.puts "#{opcode} #{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}"
>+    end
>+  end
>+  
>+  def handleX86Op(opcode, kind)
>+    handleX86OpWithNumOperands(opcode, kind, operands.size)
>+  end
>+  
>+  def handleX86Shift(opcode, kind)
>+    if operands[0].is_a? Immediate or operands[0] == RegisterID.forName(nil, "t2")
>+      $asm.puts "#{opcode} #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(kind)}"
>+    else
>+      $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
>+      $asm.puts "#{opcode} %cl, #{operands[1].x86Operand(kind)}"
>+      $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
>+    end
>+  end
>+  
>+  def handleX86DoubleBranch(branchOpcode, mode)
>+    case mode
>+    when :normal
>+      $asm.puts "ucomisd #{operands[1].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
>+    when :reverse
>+      $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
>+    else
>+      raise mode.inspect
>+    end
>+    $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
>+  end
>+  
>+  def handleX86IntCompare(opcodeSuffix, kind)
>+    if operands[0].is_a? Immediate and operands[0].value == 0 and operands[1].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
>+      $asm.puts "test#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}"
>+    elsif operands[1].is_a? Immediate and operands[1].value == 0 and operands[0].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
>+      $asm.puts "test#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}"
>+    else
>+      $asm.puts "cmp#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[0].x86Operand(kind)}"
>+    end
>+  end
>+  
>+  def handleX86IntBranch(branchOpcode, kind)
>+    handleX86IntCompare(branchOpcode[1..-1], kind)
>+    $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
>+  end
>+  
>+  def handleX86Set(setOpcode, operand)
>+    if operand.supports8BitOnX86
>+      $asm.puts "#{setOpcode} #{operand.x86Operand(:byte)}"
>+      $asm.puts "movzbl #{operand.x86Operand(:byte)}, #{operand.x86Operand(:int)}"
>+    else
>+      $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
>+      $asm.puts "#{setOpcode} %al"
>+      $asm.puts "movzbl %al, %eax"
>+      $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
>+    end
>+  end
>+  
>+  def handleX86IntCompareSet(setOpcode, kind)
>+    handleX86IntCompare(setOpcode[3..-1], kind)
>+    handleX86Set(setOpcode, operands[2])
>+  end
>+  
>+  def handleX86Test(kind)
>+    value = operands[0]
>+    case operands.size
>+    when 2
>+      mask = Immediate.new(codeOrigin, -1)
>+    when 3
>+      mask = operands[1]
>+    else
>+      raise "Expected 2 or 3 operands, but got #{operands.size} at #{codeOriginString}"
>+    end
>+    
>+    if mask.is_a? Immediate and mask.value == -1
>+      if value.is_a? RegisterID
>+        $asm.puts "test#{x86Suffix(kind)} #{value.x86Operand(kind)}, #{value.x86Operand(kind)}"
>+      else
>+        $asm.puts "cmp#{x86Suffix(kind)} $0, #{value.x86Operand(kind)}"
>+      end
>+    else
>+      $asm.puts "test#{x86Suffix(kind)} #{mask.x86Operand(kind)}, #{value.x86Operand(kind)}"
>+    end
>+  end
>+  
>+  def handleX86BranchTest(branchOpcode, kind)
>+    handleX86Test(kind)
>+    $asm.puts "#{branchOpcode} #{operands.last.asmLabel}"
>+  end
>+  
>+  def handleX86SetTest(setOpcode, kind)
>+    handleX86Test(kind)
>+    handleX86Set(setOpcode, operands.last)
>+  end
>+  
>+  def handleX86OpBranch(opcode, branchOpcode, kind)
>+    handleX86OpWithNumOperands(opcode, kind, operands.size - 1)
>+    case operands.size
>+    when 4
>+      jumpTarget = operands[3]
>+    when 3
>+      jumpTarget = operands[2]
>+    else
>+      raise self.inspect
>+    end
>+    $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
>+  end
>+  
>+  def handleX86SubBranch(branchOpcode, kind)
>+    if operands.size == 4 and operands[1] == operands[2]
>+      $asm.puts "negl #{operands[2].x86Operand(:int)}"
>+      $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
>+    else
>+      handleX86OpWithNumOperands("sub#{x86Suffix(kind)}", kind, operands.size - 1)
>+    end
>+    case operands.size
>+    when 4
>+      jumpTarget = operands[3]
>+    when 3
>+      jumpTarget = operands[2]
>+    else
>+      raise self.inspect
>+    end
>+    $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
>+  end
>+  
>+  def lowerX86
>+    $asm.comment codeOriginString
>+    case opcode
>+    when "addi", "addp"
>+      if operands.size == 3 and operands[0].is_a? Immediate
>+        raise unless operands[1].is_a? RegisterID
>+        raise unless operands[2].is_a? RegisterID
>+        if operands[0].value == 0
>+          unless operands[1] == operands[2]
>+            $asm.puts "movl #{operands[1].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
>+          end
>+        else
>+          $asm.puts "leal #{operands[0].value}(#{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
>+        end
>+      elsif operands.size == 3 and operands[0].is_a? RegisterID
>+        raise unless operands[1].is_a? RegisterID
>+        raise unless operands[2].is_a? RegisterID
>+        $asm.puts "leal (#{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
>+      else
>+        unless Immediate.new(nil, 0) == operands[0]
>+          $asm.puts "addl #{x86Operands(:int, :int)}"
>+        end
>+      end
>+    when "andi", "andp"
>+      handleX86Op("andl", :int)
>+    when "lshifti"
>+      handleX86Shift("sall", :int)
>+    when "muli"
>+      if operands.size == 3 and operands[0].is_a? Immediate
>+        $asm.puts "imull #{x86Operands(:int, :int, :int)}"
>+      else
>+        # FIXME: could do some peephole in case the left operand is immediate and it's
>+        # a power of two.
>+        handleX86Op("imull", :int)
>+      end
>+    when "negi"
>+      $asm.puts "negl #{x86Operands(:int)}"
>+    when "noti"
>+      $asm.puts "notl #{x86Operands(:int)}"
>+    when "ori", "orp"
>+      handleX86Op("orl", :int)
>+    when "rshifti"
>+      handleX86Shift("sarl", :int)
>+    when "urshifti"
>+      handleX86Shift("shrl", :int)
>+    when "subi", "subp"
>+      if operands.size == 3 and operands[1] == operands[2]
>+        $asm.puts "negl #{operands[2].x86Operand(:int)}"
>+        $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
>+      else
>+        handleX86Op("subl", :int)
>+      end
>+    when "xori", "xorp"
>+      handleX86Op("xorl", :int)
>+    when "loadi", "storei", "loadp", "storep"
>+      $asm.puts "movl #{x86Operands(:int, :int)}"
>+    when "loadb"
>+      $asm.puts "movzbl #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(:int)}"
>+    when "loadh"
>+      $asm.puts "movzwl #{operands[0].x86Operand(:half)}, #{operands[1].x86Operand(:int)}"
>+    when "storeb"
>+      $asm.puts "movb #{x86Operands(:byte, :byte)}"
>+    when "loadd", "moved", "stored"
>+      $asm.puts "movsd #{x86Operands(:double, :double)}"
>+    when "addd"
>+      $asm.puts "addsd #{x86Operands(:double, :double)}"
>+    when "divd"
>+      $asm.puts "divsd #{x86Operands(:double, :double)}"
>+    when "subd"
>+      $asm.puts "subsd #{x86Operands(:double, :double)}"
>+    when "muld"
>+      $asm.puts "mulsd #{x86Operands(:double, :double)}"
>+    when "sqrtd"
>+      $asm.puts "sqrtsd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
>+    when "ci2d"
>+      $asm.puts "cvtsi2sd #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:double)}"
>+    when "bdeq"
>+      isUnordered = LocalLabel.unique("bdeq")
>+      $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
>+      $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
>+      $asm.puts "je #{LabelReference.new(codeOrigin, operands[2]).asmLabel}"
>+      isUnordered.lower("X86")
>+    when "bdneq"
>+      handleX86DoubleBranch("jne", :normal)
>+    when "bdgt"
>+      handleX86DoubleBranch("ja", :normal)
>+    when "bdgteq"
>+      handleX86DoubleBranch("jae", :normal)
>+    when "bdlt"
>+      handleX86DoubleBranch("ja", :reverse)
>+    when "bdlteq"
>+      handleX86DoubleBranch("jae", :reverse)
>+    when "bdequn"
>+      handleX86DoubleBranch("je", :normal)
>+    when "bdnequn"
>+      isUnordered = LocalLabel.unique("bdnequn")
>+      isEqual = LocalLabel.unique("bdnequn")
>+      $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
>+      $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
>+      $asm.puts "je #{LabelReference.new(codeOrigin, isEqual).asmLabel}"
>+      isUnordered.lower("X86")
>+      $asm.puts "jmp #{operands[2].asmLabel}"
>+      isEqual.lower("X86")
>+    when "bdgtun"
>+      handleX86DoubleBranch("jb", :reverse)
>+    when "bdgtequn"
>+      handleX86DoubleBranch("jbe", :reverse)
>+    when "bdltun"
>+      handleX86DoubleBranch("jb", :normal)
>+    when "bdltequn"
>+      handleX86DoubleBranch("jbe", :normal)
>+    when "btd2i"
>+      $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
>+      $asm.puts "cmpl $0x80000000 #{operands[1].x86Operand(:int)}"
>+      $asm.puts "je #{operands[2].asmLabel}"
>+    when "td2i"
>+      $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
>+    when "bcd2i"
>+      $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
>+      $asm.puts "testl #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
>+      $asm.puts "je #{operands[2].asmLabel}"
>+      $asm.puts "cvtsi2sd #{operands[1].x86Operand(:int)}, %xmm7"
>+      $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, %xmm7"
>+      $asm.puts "jp #{operands[2].asmLabel}"
>+      $asm.puts "jne #{operands[2].asmLabel}"
>+    when "movdz"
>+      $asm.puts "xorpd #{operands[0].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
>+    when "pop"
>+      $asm.puts "pop #{operands[0].x86Operand(:int)}"
>+    when "push"
>+      $asm.puts "push #{operands[0].x86Operand(:int)}"
>+    when "move", "sxi2p", "zxi2p"
>+      if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
>+        $asm.puts "xorl #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
>+      elsif operands[0] != operands[1]
>+        $asm.puts "movl #{x86Operands(:int, :int)}"
>+      end
>+    when "nop"
>+      $asm.puts "nop"
>+    when "bieq", "bpeq"
>+      handleX86IntBranch("je", :int)
>+    when "bineq", "bpneq"
>+      handleX86IntBranch("jne", :int)
>+    when "bia", "bpa"
>+      handleX86IntBranch("ja", :int)
>+    when "biaeq", "bpaeq"
>+      handleX86IntBranch("jae", :int)
>+    when "bib", "bpb"
>+      handleX86IntBranch("jb", :int)
>+    when "bibeq", "bpbeq"
>+      handleX86IntBranch("jbe", :int)
>+    when "bigt", "bpgt"
>+      handleX86IntBranch("jg", :int)
>+    when "bigteq", "bpgteq"
>+      handleX86IntBranch("jge", :int)
>+    when "bilt", "bplt"
>+      handleX86IntBranch("jl", :int)
>+    when "bilteq", "bplteq"
>+      handleX86IntBranch("jle", :int)
>+    when "bbeq"
>+      handleX86IntBranch("je", :byte)
>+    when "bbneq"
>+      handleX86IntBranch("jne", :byte)
>+    when "bba"
>+      handleX86IntBranch("ja", :byte)
>+    when "bbaeq"
>+      handleX86IntBranch("jae", :byte)
>+    when "bbb"
>+      handleX86IntBranch("jb", :byte)
>+    when "bbbeq"
>+      handleX86IntBranch("jbe", :byte)
>+    when "bbgt"
>+      handleX86IntBranch("jg", :byte)
>+    when "bbgteq"
>+      handleX86IntBranch("jge", :byte)
>+    when "bblt"
>+      handleX86IntBranch("jl", :byte)
>+    when "bblteq"
>+      handleX86IntBranch("jlteq", :byte)
>+    when "btio", "btpo"
>+      handleX86BranchTest("jo", :int)
>+    when "btis", "btps"
>+      handleX86BranchTest("js", :int)
>+    when "btiz", "btpz"
>+      handleX86BranchTest("jz", :int)
>+    when "btinz", "btpnz"
>+      handleX86BranchTest("jnz", :int)
>+    when "btbo"
>+      handleX86BranchTest("jo", :byte)
>+    when "btbs"
>+      handleX86BranchTest("js", :byte)
>+    when "btbz"
>+      handleX86BranchTest("jz", :byte)
>+    when "btbnz"
>+      handleX86BranchTest("jnz", :byte)
>+    when "jmp"
>+      $asm.puts "jmp #{operands[0].x86CallOperand(:int)}"
>+    when "baddio", "baddpo"
>+      handleX86OpBranch("addl", "jo", :int)
>+    when "baddis", "baddps"
>+      handleX86OpBranch("addl", "js", :int)
>+    when "baddiz", "baddpz"
>+      handleX86OpBranch("addl", "jz", :int)
>+    when "baddinz", "baddpnz"
>+      handleX86OpBranch("addl", "jnz", :int)
>+    when "bsubio"
>+      handleX86SubBranch("jo", :int)
>+    when "bsubis"
>+      handleX86SubBranch("js", :int)
>+    when "bsubiz"
>+      handleX86SubBranch("jz", :int)
>+    when "bsubinz"
>+      handleX86SubBranch("jnz", :int)
>+    when "bmulio"
>+      handleX86OpBranch("imull", "jo", :int)
>+    when "bmulis"
>+      handleX86OpBranch("imull", "js", :int)
>+    when "bmuliz"
>+      handleX86OpBranch("imull", "jz", :int)
>+    when "bmulinz"
>+      handleX86OpBranch("imull", "jnz", :int)
>+    when "borio"
>+      handleX86OpBranch("orl", "jo", :int)
>+    when "boris"
>+      handleX86OpBranch("orl", "js", :int)
>+    when "boriz"
>+      handleX86OpBranch("orl", "jz", :int)
>+    when "borinz"
>+      handleX86OpBranch("orl", "jnz", :int)
>+    when "break"
>+      $asm.puts "int $3"
>+    when "call"
>+      $asm.puts "call #{operands[0].x86CallOperand(:int)}"
>+    when "ret"
>+      $asm.puts "ret"
>+    when "cieq", "cpeq"
>+      handleX86IntCompareSet("sete", :int)
>+    when "cineq", "cpneq"
>+      handleX86IntCompareSet("setne", :int)
>+    when "cia", "cpa"
>+      handleX86IntCompareSet("seta", :int)
>+    when "ciaeq", "cpaeq"
>+      handleX86IntCompareSet("setae", :int)
>+    when "cib", "cpb"
>+      handleX86IntCompareSet("setb", :int)
>+    when "cibeq", "cpbeq"
>+      handleX86IntCompareSet("setbe", :int)
>+    when "cigt", "cpgt"
>+      handleX86IntCompareSet("setg", :int)
>+    when "cigteq", "cpgteq"
>+      handleX86IntCompareSet("setge", :int)
>+    when "cilt", "cplt"
>+      handleX86IntCompareSet("setl", :int)
>+    when "cilteq", "cplteq"
>+      handleX86IntCompareSet("setle", :int)
>+    when "tio"
>+      handleX86SetTest("seto", :int)
>+    when "tis"
>+      handleX86SetTest("sets", :int)
>+    when "tiz"
>+      handleX86SetTest("setz", :int)
>+    when "tinz"
>+      handleX86SetTest("setnz", :int)
>+    when "tbo"
>+      handleX86SetTest("seto", :byte)
>+    when "tbs"
>+      handleX86SetTest("sets", :byte)
>+    when "tbz"
>+      handleX86SetTest("setz", :byte)
>+    when "tbnz"
>+      handleX86SetTest("setnz", :byte)
>+    when "peek"
>+      $asm.puts "movl #{operands[0].value * 4}(%esp), #{operands[1].x86Operand(:int)}"
>+    when "poke"
>+      $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].value * 4}(%esp)"
>+    when "cdqi"
>+      $asm.puts "cdq"
>+    when "idivi"
>+      $asm.puts "idivl #{operands[0].x86Operand(:int)}"
>+    when "fii2d"
>+      $asm.puts "movd #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:double)}"
>+      $asm.puts "movd #{operands[1].x86Operand(:int)}, %xmm7"
>+      $asm.puts "psllq $32, %xmm7"
>+      $asm.puts "por %xmm7, #{operands[2].x86Operand(:double)}"
>+    when "fd2ii"
>+      $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
>+      $asm.puts "movsd #{operands[0].x86Operand(:double)}, %xmm7"
>+      $asm.puts "psrlq $32, %xmm7"
>+      $asm.puts "movsd %xmm7, #{operands[2].x86Operand(:int)}"
>+    else
>+      raise "Bad opcode: #{opcode}"
>+    end
>+  end
>+end
>+
>Index: Source/JavaScriptCore/runtime/CodeSpecializationKind.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CodeSpecializationKind.h	(revision 0)
>+++ Source/JavaScriptCore/runtime/CodeSpecializationKind.h	(revision 0)
>@@ -0,0 +1,36 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef CodeSpecializationKind_h
>+#define CodeSpecializationKind_h
>+
>+namespace JSC {
>+
>+enum CodeSpecializationKind { CodeForCall, CodeForConstruct };
>+
>+} // namespace JSC
>+
>+#endif // CodeSpecializationKind_h
>+
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.h	(working copy)
>@@ -27,6 +27,7 @@
> #define CommonSlowPaths_h
> 
> #include "CodeBlock.h"
>+#include "CodeSpecializationKind.h"
> #include "ExceptionHelpers.h"
> #include "JSArray.h"
> 
>@@ -41,6 +42,38 @@ namespace JSC {
> 
> namespace CommonSlowPaths {
> 
>+ALWAYS_INLINE ExecState* arityCheckFor(ExecState* exec, RegisterFile* registerFile, CodeSpecializationKind kind)
>+{
>+    JSFunction* callee = asFunction(exec->callee());
>+    ASSERT(!callee->isHostFunction());
>+    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecodeFor(kind);
>+    int argumentCountIncludingThis = exec->argumentCountIncludingThis();
>+
>+    // This ensures enough space for the worst case scenario of zero arguments passed by the caller.
>+    if (!registerFile->grow(exec->registers() + newCodeBlock->numParameters() + newCodeBlock->m_numCalleeRegisters))
>+        return 0;
>+
>+    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
>+
>+    // Too few arguments -- copy call frame and arguments, then fill in missing arguments with undefined.
>+    size_t delta = newCodeBlock->numParameters() - argumentCountIncludingThis;
>+    Register* src = exec->registers();
>+    Register* dst = exec->registers() + delta;
>+
>+    int i;
>+    int end = -ExecState::offsetFor(argumentCountIncludingThis);
>+    for (i = -1; i >= end; --i)
>+        dst[i] = src[i];
>+
>+    end -= delta;
>+    for ( ; i >= end; --i)
>+        dst[i] = jsUndefined();
>+
>+    ExecState* newExec = ExecState::create(dst);
>+    ASSERT((void*)newExec <= registerFile->end());
>+    return newExec;
>+}
>+
> ALWAYS_INLINE bool opInstanceOfSlow(ExecState* exec, JSValue value, JSValue baseVal, JSValue proto)
> {
>     ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
>Index: Source/JavaScriptCore/runtime/Executable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.cpp	(revision 106153)
>+++ Source/JavaScriptCore/runtime/Executable.cpp	(working copy)
>@@ -29,6 +29,7 @@
> #include "BytecodeGenerator.h"
> #include "CodeBlock.h"
> #include "DFGDriver.h"
>+#include "ExecutionHarness.h"
> #include "JIT.h"
> #include "JITDriver.h"
> #include "Parser.h"
>@@ -84,7 +85,7 @@ Intrinsic NativeExecutable::intrinsic() 
> template<typename T>
> static void jettisonCodeBlock(JSGlobalData& globalData, OwnPtr<T>& codeBlock)
> {
>-    ASSERT(codeBlock->getJITType() != JITCode::BaselineJIT);
>+    ASSERT(JITCode::isOptimizingJIT(codeBlock->getJITType()));
>     ASSERT(codeBlock->alternative());
>     OwnPtr<T> codeBlockToJettison = codeBlock.release();
>     codeBlock = static_pointer_cast<T>(codeBlockToJettison->releaseAlternative());
>@@ -167,9 +168,30 @@ JSObject* EvalExecutable::compileOptimiz
>     return error;
> }
> 
>+void EvalExecutable::jitCompile(JSGlobalData& globalData)
>+{
>+    bool result = jitCompileIfAppropriate(globalData, m_evalCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
>+    ASSERT_UNUSED(result, result);
>+}
>+
>+inline const char* samplingDescription(JITCode::JITType jitType)
>+{
>+    switch (jitType) {
>+    case JITCode::InterpreterThunk:
>+        return "Interpreter Compilation (TOTAL)";
>+    case JITCode::BaselineJIT:
>+        return "Baseline Compilation (TOTAL)";
>+    case JITCode::DFGJIT:
>+        return "DFG Compilation (TOTAL)";
>+    default:
>+        ASSERT_NOT_REACHED();
>+        return 0;
>+    }
>+}
>+
> JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
> {
>-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
>+    SamplingRegion samplingRegion(samplingDescription(jitType));
>     
> #if !ENABLE(JIT)
>     UNUSED_PARAM(jitType);
>@@ -210,7 +232,7 @@ JSObject* EvalExecutable::compileInterna
>     }
> 
> #if ENABLE(JIT)
>-    if (!jitCompileIfAppropriate(*globalData, m_evalCodeBlock, m_jitCodeForCall, jitType))
>+    if (!prepareForExecution(*globalData, m_evalCodeBlock, m_jitCodeForCall, jitType))
>         return 0;
> #endif
> 
>@@ -295,9 +317,15 @@ JSObject* ProgramExecutable::compileOpti
>     return error;
> }
> 
>+void ProgramExecutable::jitCompile(JSGlobalData& globalData)
>+{
>+    bool result = jitCompileIfAppropriate(globalData, m_programCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
>+    ASSERT_UNUSED(result, result);
>+}
>+
> JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
> {
>-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
>+    SamplingRegion samplingRegion(samplingDescription(jitType));
>     
> #if !ENABLE(JIT)
>     UNUSED_PARAM(jitType);
>@@ -336,7 +364,7 @@ JSObject* ProgramExecutable::compileInte
>     }
> 
> #if ENABLE(JIT)
>-    if (!jitCompileIfAppropriate(*globalData, m_programCodeBlock, m_jitCodeForCall, jitType))
>+    if (!prepareForExecution(*globalData, m_programCodeBlock, m_jitCodeForCall, jitType))
>         return 0;
> #endif
> 
>@@ -412,7 +440,7 @@ FunctionCodeBlock* FunctionExecutable::b
>     while (result->alternative())
>         result = static_cast<FunctionCodeBlock*>(result->alternative());
>     ASSERT(result);
>-    ASSERT(result->getJITType() == JITCode::BaselineJIT);
>+    ASSERT(JITCode::isBaselineCode(result->getJITType()));
>     return result;
> }
> 
>@@ -438,6 +466,18 @@ JSObject* FunctionExecutable::compileOpt
>     return error;
> }
> 
>+void FunctionExecutable::jitCompileForCall(JSGlobalData& globalData)
>+{
>+    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
>+    ASSERT_UNUSED(result, result);
>+}
>+
>+void FunctionExecutable::jitCompileForConstruct(JSGlobalData& globalData)
>+{
>+    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
>+    ASSERT_UNUSED(result, result);
>+}
>+
> FunctionCodeBlock* FunctionExecutable::codeBlockWithBytecodeFor(CodeSpecializationKind kind)
> {
>     FunctionCodeBlock* codeBlock = baselineCodeBlockFor(kind);
>@@ -482,7 +522,7 @@ PassOwnPtr<FunctionCodeBlock> FunctionEx
> 
> JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
> {
>-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
>+    SamplingRegion samplingRegion(samplingDescription(jitType));
>     
> #if !ENABLE(JIT)
>     UNUSED_PARAM(exec);
>@@ -504,7 +544,7 @@ JSObject* FunctionExecutable::compileFor
>     m_symbolTable = m_codeBlockForCall->sharedSymbolTable();
> 
> #if ENABLE(JIT)
>-    if (!jitCompileFunctionIfAppropriate(exec->globalData(), m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType))
>+    if (!prepareFunctionForExecution(exec->globalData(), m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType, CodeForCall))
>         return 0;
> #endif
> 
>@@ -524,7 +564,7 @@ JSObject* FunctionExecutable::compileFor
> 
> JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
> {
>-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
>+    SamplingRegion samplingRegion(samplingDescription(jitType));
>     
> #if !ENABLE(JIT)
>     UNUSED_PARAM(jitType);
>@@ -546,7 +586,7 @@ JSObject* FunctionExecutable::compileFor
>     m_symbolTable = m_codeBlockForConstruct->sharedSymbolTable();
> 
> #if ENABLE(JIT)
>-    if (!jitCompileFunctionIfAppropriate(exec->globalData(), m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType))
>+    if (!prepareFunctionForExecution(exec->globalData(), m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType, CodeForConstruct))
>         return 0;
> #endif
> 
>Index: Source/JavaScriptCore/runtime/Executable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/Executable.h	(working copy)
>@@ -27,6 +27,7 @@
> #define Executable_h
> 
> #include "CallData.h"
>+#include "CodeSpecializationKind.h"
> #include "JSFunction.h"
> #include "Interpreter.h"
> #include "Nodes.h"
>@@ -39,12 +40,12 @@ namespace JSC {
>     class Debugger;
>     class EvalCodeBlock;
>     class FunctionCodeBlock;
>+    class LLIntOffsetsExtractor;
>     class ProgramCodeBlock;
>     class ScopeChainNode;
> 
>     struct ExceptionInfo;
>     
>-    enum CodeSpecializationKind { CodeForCall, CodeForConstruct };
>     enum CompilationKind { FirstCompilation, OptimizingCompilation };
> 
>     inline bool isCall(CodeSpecializationKind kind)
>@@ -319,6 +320,7 @@ namespace JSC {
>     };
> 
>     class EvalExecutable : public ScriptExecutable {
>+        friend class LLIntOffsetsExtractor;
>     public:
>         typedef ScriptExecutable Base;
> 
>@@ -338,6 +340,7 @@ namespace JSC {
>         
> #if ENABLE(JIT)
>         void jettisonOptimizedCode(JSGlobalData&);
>+        void jitCompile(JSGlobalData&);
> #endif
> 
>         EvalCodeBlock& generatedBytecode()
>@@ -384,6 +387,7 @@ namespace JSC {
>     };
> 
>     class ProgramExecutable : public ScriptExecutable {
>+        friend class LLIntOffsetsExtractor;
>     public:
>         typedef ScriptExecutable Base;
> 
>@@ -411,6 +415,7 @@ namespace JSC {
>         
> #if ENABLE(JIT)
>         void jettisonOptimizedCode(JSGlobalData&);
>+        void jitCompile(JSGlobalData&);
> #endif
> 
>         ProgramCodeBlock& generatedBytecode()
>@@ -453,6 +458,7 @@ namespace JSC {
> 
>     class FunctionExecutable : public ScriptExecutable {
>         friend class JIT;
>+        friend class LLIntOffsetsExtractor;
>     public:
>         typedef ScriptExecutable Base;
> 
>@@ -508,6 +514,7 @@ namespace JSC {
>         
> #if ENABLE(JIT)
>         void jettisonOptimizedCodeForCall(JSGlobalData&);
>+        void jitCompileForCall(JSGlobalData&);
> #endif
> 
>         bool isGeneratedForCall() const
>@@ -535,6 +542,7 @@ namespace JSC {
>         
> #if ENABLE(JIT)
>         void jettisonOptimizedCodeForConstruct(JSGlobalData&);
>+        void jitCompileForConstruct(JSGlobalData&);
> #endif
> 
>         bool isGeneratedForConstruct() const
>@@ -582,6 +590,16 @@ namespace JSC {
>                 jettisonOptimizedCodeForConstruct(globalData);
>             }
>         }
>+        
>+        void jitCompileFor(JSGlobalData& globalData, CodeSpecializationKind kind)
>+        {
>+            if (kind == CodeForCall) {
>+                jitCompileForCall(globalData);
>+                return;
>+            }
>+            ASSERT(kind == CodeForConstruct);
>+            jitCompileForConstruct(globalData);
>+        }
> #endif
>         
>         bool isGeneratedFor(CodeSpecializationKind kind)
>Index: Source/JavaScriptCore/runtime/ExecutionHarness.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ExecutionHarness.h	(revision 0)
>+++ Source/JavaScriptCore/runtime/ExecutionHarness.h	(revision 0)
>@@ -0,0 +1,72 @@
>+/*
>+ * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef ExecutionHarness_h
>+#define ExecutionHarness_h
>+
>+#include <wtf/Platform.h>
>+
>+#if ENABLE(JIT)
>+
>+#include "JITDriver.h"
>+#include "LLIntEntrypoints.h"
>+
>+namespace JSC {
>+
>+template<typename CodeBlockType>
>+inline bool prepareForExecution(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType)
>+{
>+#if ENABLE(LLINT)
>+    if (JITCode::isBaselineCode(jitType)) {
>+        // Start off in the low level interpreter.
>+        LLInt::getEntrypoint(globalData, codeBlock.get(), jitCode);
>+        codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr());
>+        return true;
>+    }
>+#endif // ENABLE(LLINT)
>+    return jitCompileIfAppropriate(globalData, codeBlock, jitCode, jitType);
>+}
>+
>+inline bool prepareFunctionForExecution(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, CodeSpecializationKind kind)
>+{
>+#if ENABLE(LLINT)
>+    if (JITCode::isBaselineCode(jitType)) {
>+        // Start off in the low level interpreter.
>+        LLInt::getFunctionEntrypoint(globalData, kind, jitCode, jitCodeWithArityCheck);
>+        codeBlock->setJITCode(jitCode, jitCodeWithArityCheck);
>+        return true;
>+    }
>+#else
>+    UNUSED_PARAM(kind);
>+#endif // ENABLE(LLINT)
>+    return jitCompileFunctionIfAppropriate(globalData, codeBlock, jitCode, jitCodeWithArityCheck, symbolTable, jitType);
>+}
>+
>+} // namespace JSC
>+
>+#endif // ENABLE(JIT)
>+
>+#endif // ExecutionHarness_h
>+
>Index: Source/JavaScriptCore/runtime/JSActivation.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSActivation.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSActivation.h	(working copy)
>@@ -124,7 +124,7 @@ namespace JSC {
> 
>         OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[registerArraySize]);
>         WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
>-
>+        
>         // Copy all arguments that can be captured by name or by the arguments object.
>         for (int i = 0; i < m_numCapturedArgs; ++i) {
>             int index = CallFrame::argumentOffset(i);
>Index: Source/JavaScriptCore/runtime/JSArray.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSArray.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSArray.h	(working copy)
>@@ -28,6 +28,7 @@
> namespace JSC {
> 
>     class JSArray;
>+    class LLIntOffsetsExtractor;
> 
>     struct SparseArrayEntry : public WriteBarrier<Unknown> {
>         typedef WriteBarrier<Unknown> Base;
>@@ -122,6 +123,7 @@ namespace JSC {
>     };
> 
>     class JSArray : public JSNonFinalObject {
>+        friend class LLIntOffsetsExtractor;
>         friend class Walker;
> 
>     protected:
>Index: Source/JavaScriptCore/runtime/JSCell.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSCell.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSCell.h	(working copy)
>@@ -36,9 +36,10 @@
> namespace JSC {
> 
>     class JSGlobalObject;
>-    class Structure;
>+    class LLIntOffsetsExtractor;
>     class PropertyDescriptor;
>     class PropertyNameArray;
>+    class Structure;
> 
>     enum EnumerationMode {
>         ExcludeDontEnumProperties,
>@@ -164,6 +165,8 @@ namespace JSC {
>         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         const ClassInfo* m_classInfo;
>         WriteBarrier<Structure> m_structure;
>     };
>Index: Source/JavaScriptCore/runtime/JSFunction.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSFunction.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSFunction.h	(working copy)
>@@ -33,6 +33,7 @@ namespace JSC {
>     class FunctionPrototype;
>     class JSActivation;
>     class JSGlobalObject;
>+    class LLIntOffsetsExtractor;
>     class NativeExecutable;
>     class SourceCode;
>     namespace DFG {
>@@ -140,6 +141,8 @@ namespace JSC {
>         static void visitChildren(JSCell*, SlotVisitor&);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         JS_EXPORT_PRIVATE bool isHostFunctionNonInline() const;
> 
>         static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
>Index: Source/JavaScriptCore/runtime/JSGlobalData.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalData.cpp	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSGlobalData.cpp	(working copy)
>@@ -141,6 +141,8 @@ JSGlobalData::JSGlobalData(GlobalDataTyp
>     , keywords(adoptPtr(new Keywords(this)))
>     , interpreter(0)
>     , heap(this, heapSize)
>+    , jsArrayClassInfo(&JSArray::s_info)
>+    , jsFinalObjectClassInfo(&JSFinalObject::s_info)
> #if ENABLE(DFG_JIT)
>     , sizeOfLastScratchBuffer(0)
> #endif
>@@ -216,7 +218,7 @@ JSGlobalData::JSGlobalData(GlobalDataTyp
>     jitStubs = adoptPtr(new JITThunks(this));
> #endif
> 
>-    interpreter->initialize(this->canUseJIT());
>+    interpreter->initialize(&llintData, this->canUseJIT());
> 
>     heap.notifyIsSafeToCollect();
> }
>Index: Source/JavaScriptCore/runtime/JSGlobalData.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalData.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSGlobalData.h	(working copy)
>@@ -30,15 +30,16 @@
> #define JSGlobalData_h
> 
> #include "CachedTranscendentalFunction.h"
>-#include "Intrinsic.h"
> #include "DateInstanceCache.h"
> #include "ExecutableAllocator.h"
> #include "Heap.h"
>-#include "Strong.h"
>+#include "Intrinsic.h"
> #include "JITStubs.h"
> #include "JSValue.h"
>+#include "LLIntData.h"
> #include "NumericStrings.h"
> #include "SmallStrings.h"
>+#include "Strong.h"
> #include "Terminator.h"
> #include "TimeoutChecker.h"
> #include "WeakRandom.h"
>@@ -65,6 +66,7 @@ namespace JSC {
>     class JSGlobalObject;
>     class JSObject;
>     class Keywords;
>+    class LLIntOffsetsExtractor;
>     class NativeExecutable;
>     class ParserArena;
>     class RegExpCache;
>@@ -241,6 +243,12 @@ namespace JSC {
>         Heap heap;
> 
>         JSValue exception;
>+
>+        const ClassInfo* const jsArrayClassInfo;
>+        const ClassInfo* const jsFinalObjectClassInfo;
>+
>+        LLInt::Data llintData;
>+
> #if ENABLE(JIT)
>         ReturnAddressPtr exceptionLocation;
>         JSValue hostCallReturnValue;
>@@ -346,6 +354,8 @@ namespace JSC {
> #undef registerTypedArrayFunction
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         JSGlobalData(GlobalDataType, ThreadStackType, HeapSize);
>         static JSGlobalData*& sharedInstanceInternal();
>         void createNativeThunk();
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.h	(working copy)
>@@ -44,6 +44,7 @@ namespace JSC {
>     class FunctionPrototype;
>     class GetterSetter;
>     class GlobalCodeBlock;
>+    class LLIntOffsetsExtractor;
>     class NativeErrorConstructor;
>     class ProgramCodeBlock;
>     class RegExpConstructor;
>@@ -335,6 +336,8 @@ namespace JSC {
>         JS_EXPORT_PRIVATE void addStaticGlobals(GlobalPropertyInfo*, int count);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         // FIXME: Fold reset into init.
>         JS_EXPORT_PRIVATE void init(JSObject* thisValue);
>         void reset(JSValue prototype);
>Index: Source/JavaScriptCore/runtime/JSObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSObject.h	(working copy)
>@@ -49,6 +49,7 @@ namespace JSC {
>     class GetterSetter;
>     class HashEntry;
>     class InternalFunction;
>+    class LLIntOffsetsExtractor;
>     class MarkedBlock;
>     class PropertyDescriptor;
>     class PropertyNameArray;
>@@ -269,6 +270,8 @@ namespace JSC {
>         JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         // Nobody should ever ask any of these questions on something already known to be a JSObject.
>         using JSCell::isAPIValueWrapper;
>         using JSCell::isGetterSetter;
>@@ -381,6 +384,8 @@ COMPILE_ASSERT((JSFinalObject_inlineStor
>         static void destroy(JSCell*);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
>             : JSObject(globalData, structure, m_inlineStorage)
>         {
>Index: Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSPropertyNameIterator.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSPropertyNameIterator.h	(working copy)
>@@ -38,6 +38,7 @@ namespace JSC {
> 
>     class Identifier;
>     class JSObject;
>+    class LLIntOffsetsExtractor;
> 
>     class JSPropertyNameIterator : public JSCell {
>         friend class JIT;
>@@ -96,6 +97,8 @@ namespace JSC {
>         }
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
> 
>         WriteBarrier<Structure> m_cachedStructure;
>Index: Source/JavaScriptCore/runtime/JSString.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSString.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSString.h	(working copy)
>@@ -32,6 +32,7 @@
> namespace JSC {
> 
>     class JSString;
>+    class LLIntOffsetsExtractor;
> 
>     JSString* jsEmptyString(JSGlobalData*);
>     JSString* jsEmptyString(ExecState*);
>@@ -240,6 +241,8 @@ namespace JSC {
>         static void visitChildren(JSCell*, SlotVisitor&);
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         JS_EXPORT_PRIVATE void resolveRope(ExecState*) const;
>         void resolveRopeSlowCase8(LChar*) const;
>         void resolveRopeSlowCase(UChar*) const;
>Index: Source/JavaScriptCore/runtime/JSTypeInfo.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSTypeInfo.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSTypeInfo.h	(working copy)
>@@ -34,6 +34,8 @@
> 
> namespace JSC {
> 
>+    class LLIntOffsetsExtractor;
>+
>     static const unsigned MasqueradesAsUndefined = 1; // WebCore uses MasqueradesAsUndefined to make document.all undetectable.
>     static const unsigned ImplementsHasInstance = 1 << 1;
>     static const unsigned OverridesHasInstance = 1 << 2;
>@@ -87,6 +89,8 @@ namespace JSC {
>         }
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         bool isSetOnFlags1(unsigned flag) const { ASSERT(flag <= (1 << 7)); return m_flags & flag; }
>         bool isSetOnFlags2(unsigned flag) const { ASSERT(flag >= (1 << 8)); return m_flags2 & (flag >> 8); }
> 
>Index: Source/JavaScriptCore/runtime/JSValue.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSValue.cpp	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSValue.cpp	(working copy)
>@@ -116,10 +116,9 @@ JSObject* JSValue::synthesizePrototype(E
>     return JSNotAnObject::create(exec);
> }
> 
>-#ifndef NDEBUG
> char* JSValue::description()
> {
>-    static const size_t size = 64;
>+    static const size_t size = 128;
>     static char description[size];
> 
>     if (!*this)
>@@ -128,14 +127,14 @@ char* JSValue::description()
>         snprintf(description, size, "Int32: %d", asInt32());
>     else if (isDouble()) {
> #if USE(JSVALUE64)
>-        snprintf(description, size, "Double: %lf, %lx", asDouble(), reinterpretDoubleToIntptr(asDouble()));
>+        snprintf(description, size, "Double: %lx, %lf", reinterpretDoubleToIntptr(asDouble()), asDouble());
> #else
>         union {
>             double asDouble;
>             uint32_t asTwoInt32s[2];
>         } u;
>         u.asDouble = asDouble();
>-        snprintf(description, size, "Double: %lf, %08x:%08x", asDouble(), u.asTwoInt32s[1], u.asTwoInt32s[0]);
>+        snprintf(description, size, "Double: %08x:%08x, %lf", u.asTwoInt32s[1], u.asTwoInt32s[0], asDouble());
> #endif
>     } else if (isCell())
>         snprintf(description, size, "Cell: %p", asCell());
>@@ -152,7 +151,6 @@ char* JSValue::description()
> 
>     return description;
> }
>-#endif
> 
> // This in the ToInt32 operation is defined in section 9.5 of the ECMA-262 spec.
> // Note that this operation is identical to ToUInt32 other than to interpretation
>Index: Source/JavaScriptCore/runtime/JSValue.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSValue.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSValue.h	(working copy)
>@@ -232,9 +232,7 @@ namespace JSC {
>         JSCell* asCell() const;
>         JS_EXPORT_PRIVATE bool isValidCallee();
> 
>-#ifndef NDEBUG
>         char* description();
>-#endif
> 
>     private:
>         template <class T> JSValue(WriteBarrierBase<T>);
>Index: Source/JavaScriptCore/runtime/JSVariableObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSVariableObject.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/JSVariableObject.h	(working copy)
>@@ -38,10 +38,12 @@
> 
> namespace JSC {
> 
>+    class LLIntOffsetsExtractor;
>     class Register;
> 
>     class JSVariableObject : public JSNonFinalObject {
>         friend class JIT;
>+        friend class LLIntOffsetsExtractor;
> 
>     public:
>         typedef JSNonFinalObject Base;
>Index: Source/JavaScriptCore/runtime/Options.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Options.cpp	(revision 106153)
>+++ Source/JavaScriptCore/runtime/Options.cpp	(working copy)
>@@ -52,6 +52,10 @@ unsigned maximumFunctionForConstructInli
> 
> unsigned maximumInliningDepth;
> 
>+int32_t executionCounterValueForJITAfterWarmUp;
>+int32_t executionCounterValueForDontJITAnytimeSoon;
>+int32_t executionCounterValueForJITSoon;
>+
> int32_t executionCounterValueForOptimizeAfterWarmUp;
> int32_t executionCounterValueForOptimizeAfterLongWarmUp;
> int32_t executionCounterValueForDontOptimizeAnytimeSoon;
>@@ -137,6 +141,10 @@ void initializeOptions()
>     
>     SET(maximumInliningDepth, 5);
> 
>+    SET(executionCounterValueForJITAfterWarmUp,     -100);
>+    SET(executionCounterValueForDontJITAnytimeSoon, std::numeric_limits<int32_t>::min());
>+    SET(executionCounterValueForJITSoon,            -100);
>+
>     SET(executionCounterValueForOptimizeAfterWarmUp,     -1000);
>     SET(executionCounterValueForOptimizeAfterLongWarmUp, -5000);
>     SET(executionCounterValueForDontOptimizeAnytimeSoon, std::numeric_limits<int32_t>::min());
>@@ -185,6 +193,8 @@ void initializeOptions()
>     if (cpusToUse < 1)
>         cpusToUse = 1;
>     
>+    cpusToUse = 1;
>+    
>     SET(numberOfGCMarkers, cpusToUse);
> 
>     ASSERT(executionCounterValueForDontOptimizeAnytimeSoon <= executionCounterValueForOptimizeAfterLongWarmUp);
>Index: Source/JavaScriptCore/runtime/Options.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Options.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/Options.h	(working copy)
>@@ -37,6 +37,10 @@ extern unsigned maximumFunctionForConstr
> 
> extern unsigned maximumInliningDepth; // Depth of inline stack, so 1 = no inlining, 2 = one level, etc.
> 
>+extern int32_t executionCounterValueForJITAfterWarmUp;
>+extern int32_t executionCounterValueForDontJITAnytimeSoon;
>+extern int32_t executionCounterValueForJITSoon;
>+
> extern int32_t executionCounterValueForOptimizeAfterWarmUp;
> extern int32_t executionCounterValueForOptimizeAfterLongWarmUp;
> extern int32_t executionCounterValueForDontOptimizeAnytimeSoon;
>Index: Source/JavaScriptCore/runtime/ScopeChain.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ScopeChain.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/ScopeChain.h	(working copy)
>@@ -30,6 +30,7 @@ namespace JSC {
>     class JSGlobalData;
>     class JSGlobalObject;
>     class JSObject;
>+    class LLIntOffsetsExtractor;
>     class ScopeChainIterator;
>     class SlotVisitor;
>     
>@@ -91,6 +92,8 @@ namespace JSC {
>         static JS_EXPORTDATA const ClassInfo s_info;
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         static const unsigned StructureFlags = OverridesVisitChildren;
>     };
> 
>Index: Source/JavaScriptCore/runtime/Structure.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Structure.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/Structure.h	(working copy)
>@@ -45,6 +45,7 @@
> 
> namespace JSC {
> 
>+    class LLIntOffsetsExtractor;
>     class PropertyNameArray;
>     class PropertyNameArrayData;
>     class StructureChain;
>@@ -196,6 +197,8 @@ namespace JSC {
>         static JS_EXPORTDATA const ClassInfo s_info;
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         JS_EXPORT_PRIVATE Structure(JSGlobalData&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*);
>         Structure(JSGlobalData&);
>         Structure(JSGlobalData&, const Structure*);
>Index: Source/JavaScriptCore/runtime/StructureChain.h
>===================================================================
>--- Source/JavaScriptCore/runtime/StructureChain.h	(revision 106153)
>+++ Source/JavaScriptCore/runtime/StructureChain.h	(working copy)
>@@ -37,6 +37,7 @@
> 
> namespace JSC {
> 
>+    class LLIntOffsetsExtractor;
>     class Structure;
> 
>     class StructureChain : public JSCell {
>@@ -74,6 +75,8 @@ namespace JSC {
>         }
> 
>     private:
>+        friend class LLIntOffsetsExtractor;
>+        
>         StructureChain(JSGlobalData&, Structure*);
>         static void destroy(JSCell*);
>         OwnArrayPtr<WriteBarrier<Structure> > m_vector;
>Index: Source/JavaScriptCore/wtf/InlineASM.h
>===================================================================
>--- Source/JavaScriptCore/wtf/InlineASM.h	(revision 106153)
>+++ Source/JavaScriptCore/wtf/InlineASM.h	(working copy)
>@@ -68,4 +68,11 @@
> #define HIDE_SYMBOL(name)
> #endif
> 
>+// FIXME: figure out how this works on all the platforms. I know that
>+// on Linux, the preferred form is ".Lstuff" as opposed to "Lstuff".
>+// Don't know about any of the others.
>+#if PLATFORM(MAC)
>+#define LOCAL_LABEL_STRING(name) "L" #name
>+#endif
>+
> #endif // InlineASM_h
>Index: Source/JavaScriptCore/wtf/Platform.h
>===================================================================
>--- Source/JavaScriptCore/wtf/Platform.h	(revision 106153)
>+++ Source/JavaScriptCore/wtf/Platform.h	(working copy)
>@@ -920,6 +920,18 @@
> #define ENABLE_JIT 1
> #endif
> 
>+/* On some of the platforms where we have a JIT, we want to also have the 
>+   low-level interpreter. */
>+#if !defined(ENABLE_LLINT) && ENABLE(JIT) && PLATFORM(MAC) && USE(JSVALUE32_64)
>+#define ENABLE_LLINT 1
>+#endif
>+
>+/* If we have LLInt enabled and the JIT enabled, we also enable OSRing from
>+   LLInt to the JIT. */
>+#if !defined(ENABLE_LLINT_OSR_TO_JIT) && ENABLE(JIT) && ENABLE(LLINT)
>+#define ENABLE_LLINT_OSR_TO_JIT 1
>+#endif
>+
> #if !defined(ENABLE_DFG_JIT) && ENABLE(JIT)
> /* Enable the DFG JIT on X86 and X86_64.  Only tested on Mac and GNU/Linux. */
> #if (CPU(X86) || CPU(X86_64)) && (PLATFORM(MAC) || OS(LINUX))
>Index: Source/JavaScriptCore/wtf/SentinelLinkedList.h
>===================================================================
>--- Source/JavaScriptCore/wtf/SentinelLinkedList.h	(revision 106153)
>+++ Source/JavaScriptCore/wtf/SentinelLinkedList.h	(working copy)
>@@ -86,6 +86,8 @@ public:
> 
>     iterator begin();
>     iterator end();
>+    
>+    bool isEmpty() { return begin() == end(); }
> 
> private:
>     RawNode m_headSentinel;
>Index: Source/JavaScriptCore/wtf/text/StringImpl.h
>===================================================================
>--- Source/JavaScriptCore/wtf/text/StringImpl.h	(revision 106153)
>+++ Source/JavaScriptCore/wtf/text/StringImpl.h	(working copy)
>@@ -43,6 +43,7 @@ typedef const struct __CFString * CFStri
> // Landing the file moves in one patch, will follow on with patches to change the namespaces.
> namespace JSC {
> struct IdentifierCStringTranslator;
>+class LLIntOffsetsExtractor;
> template <typename T> struct IdentifierCharBufferTranslator;
> struct IdentifierLCharFromUCharTranslator;
> }
>@@ -72,7 +73,8 @@ class StringImpl {
>     friend struct WTF::SubstringTranslator;
>     friend struct WTF::UCharBufferTranslator;
>     friend class AtomicStringImpl;
>-
>+    friend class JSC::LLIntOffsetsExtractor;
>+    
> private:
>     enum BufferOwnership {
>         BufferInternal,
>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 106153)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,17 @@
>+2012-01-26  Filip Pizlo  <fpizlo@apple.com>
>+
>+        JSC should be a triple-tier VM
>+        https://bugs.webkit.org/show_bug.cgi?id=75812
>+        <rdar://problem/10079694>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Changed EFL's build system to include a new directory in JavaScriptCore.
>+        
>+        No new tests because no behavior changed.
>+
>+        * CMakeLists.txt:
>+
> 2012-01-27  Ken Buchanan  <kenrb@chromium.org>
> 
>         Crash in updateFirstLetter() from unnecessary anonymous block
>Index: Source/WebCore/CMakeLists.txt
>===================================================================
>--- Source/WebCore/CMakeLists.txt	(revision 106153)
>+++ Source/WebCore/CMakeLists.txt	(working copy)
>@@ -74,6 +74,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
>     "${JAVASCRIPTCORE_DIR}/debugger"
>     "${JAVASCRIPTCORE_DIR}/interpreter"
>     "${JAVASCRIPTCORE_DIR}/jit"
>+    "${JAVASCRIPTCORE_DIR}/llint"
>     "${JAVASCRIPTCORE_DIR}/parser"
>     "${JAVASCRIPTCORE_DIR}/profiler"
>     "${JAVASCRIPTCORE_DIR}/runtime"
>Index: Source/WebKit/ChangeLog
>===================================================================
>--- Source/WebKit/ChangeLog	(revision 106153)
>+++ Source/WebKit/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2012-01-26  Filip Pizlo  <fpizlo@apple.com>
>+
>+        JSC should be a triple-tier VM
>+        https://bugs.webkit.org/show_bug.cgi?id=75812
>+        <rdar://problem/10079694>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Changed EFL's build system to include a new directory in JavaScriptCore.
>+        
>+        * CMakeLists.txt:
>+
> 2012-01-11  Jacky Jiang  <zhajiang@rim.com>
> 
>         [BlackBerry] ASSERT failure in BackingStorePrivate::blitVisibleContents()
>Index: Source/WebKit/CMakeLists.txt
>===================================================================
>--- Source/WebKit/CMakeLists.txt	(revision 106153)
>+++ Source/WebKit/CMakeLists.txt	(working copy)
>@@ -44,6 +44,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
>     "${JAVASCRIPTCORE_DIR}/debugger"
>     "${JAVASCRIPTCORE_DIR}/interpreter"
>     "${JAVASCRIPTCORE_DIR}/jit"
>+    "${JAVASCRIPTCORE_DIR}/llint"
>     "${JAVASCRIPTCORE_DIR}/parser"
>     "${JAVASCRIPTCORE_DIR}/profiler"
>     "${JAVASCRIPTCORE_DIR}/runtime"
>Index: Tools/ChangeLog
>===================================================================
>--- Tools/ChangeLog	(revision 106153)
>+++ Tools/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2012-01-27  Filip Pizlo  <fpizlo@apple.com>
>+
>+        JSC should be a triple-tier VM
>+        https://bugs.webkit.org/show_bug.cgi?id=75812
>+        <rdar://problem/10079694>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Changed EFL's build system to include a new directory in JavaScriptCore.
>+
>+        * DumpRenderTree/efl/CMakeLists.txt:
>+
> 2012-01-27  Martin Robinson  <mrobinson@igalia.com>
> 
>         [GTK] [WK2] Implement the policy client
>Index: Tools/DumpRenderTree/efl/CMakeLists.txt
>===================================================================
>--- Tools/DumpRenderTree/efl/CMakeLists.txt	(revision 106153)
>+++ Tools/DumpRenderTree/efl/CMakeLists.txt	(working copy)
>@@ -68,10 +68,12 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
>     ${JAVASCRIPTCORE_DIR}
>     ${JAVASCRIPTCORE_DIR}/API
>     ${JAVASCRIPTCORE_DIR}/assembler
>+    ${JAVASCRIPTCORE_DIR}/bytecode
>     ${JAVASCRIPTCORE_DIR}/dfg
>     ${JAVASCRIPTCORE_DIR}/heap
>     ${JAVASCRIPTCORE_DIR}/interpreter
>     ${JAVASCRIPTCORE_DIR}/jit
>+    ${JAVASCRIPTCORE_DIR}/llint
>     ${JAVASCRIPTCORE_DIR}/runtime
>     ${JAVASCRIPTCORE_DIR}/ForwardingHeaders
>     ${JAVASCRIPTCORE_DIR}/wtf

Actions: View | Formatted Diff | Diff

Attachments on bug 75812: 121601 | 121607 | 121617 | 121624 | 121744 | 121769 | 121809 | 121915 | 121946 | 122140 | 122163 | 122172 | 122310 | 122371 | 122701 | 122841 | 122872 | 123042 | 123055 | 123066 | 123089 | 123518 | 123633 | 123701 | 123783 | 123822 | 123855 | 123858 | 123880 | 123970 | 124199 | 124201 | 124225 | 124229 | 124248 | 124360 | 124372 | 124373 | 124374 | 124432 | 124478 | 124496 | 124608 | 124619 | 124646 | 124872 | 124875 | 124888 | 125035 | 125085 | 125091 | 125186 | 125194 | 125715 | 125735 | 127001 | 127706 | 127707 | 127825 | 127932 | 127938 | 128019