[JAEGER] Merge.
authorDavid Anderson <danderson@mozilla.com>
Mon, 14 Jun 2010 13:36:05 -0700
changeset 52832 21ea61e0758ebccd27a84e0cdf203373490956fa
parent 52831 0adb7369c0854730ae8a6ad547b2a360201c36d6 (current diff)
parent 52830 988a24e5137e2bfef2766da5ec7ec616ac3e6e44 (diff)
child 52834 8be821f35afec3a56a6f58116bdb24d0ffb53429
push idunknown
push userunknown
push dateunknown
milestone1.9.3a5pre
[JAEGER] Merge.
js/src/methodjit/Compiler.cpp
js/src/methodjit/FrameState-inl.h
js/src/methodjit/FrameState.cpp
js/src/methodjit/FrameState.h
js/src/methodjit/MethodJIT.cpp
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -90,33 +90,36 @@ class BaseAssembler : public JSC::MacroA
 
   public:
     BaseAssembler()
       : callPatches(SystemAllocPolicy())
     {
         startLabel = label();
     }
 
-    void load32FromImm(void *ptr, RegisterID reg) {
-        load32(ptr, reg);
-    }
+    /* Total number of floating-point registers. */
+    static const uint32 TotalFPRegisters = FPRegisters::TotalFPRegisters;
 
     /*
-     * FpReg is used to home the current JSStackFrame*.
+     * JSFrameReg is used to home the current JSStackFrame*.
      */
 #if defined(JS_CPU_X86) || defined(JS_CPU_X64)
-    static const RegisterID FpReg = JSC::X86Registers::ebx;
+    static const RegisterID JSFrameReg = JSC::X86Registers::ebx;
 #elif defined(JS_CPU_ARM)
-    static const RegisterID FpReg = JSC::X86Registers::r11;
+    static const RegisterID JSFrameReg = JSC::X86Registers::r11;
 #endif
 
     size_t distanceOf(Label l) {
         return differenceBetween(startLabel, l);
     }
 
+    void load32FromImm(void *ptr, RegisterID reg) {
+        load32(ptr, reg);
+    }
+
     /*
      * Finds and returns the address of a known object and slot.
      */
     Address objSlotRef(JSObject *obj, RegisterID reg, uint32 slot) {
         if (slot < JS_INITIAL_NSLOTS) {
             void *vp = &obj->getSlotRef(slot);
             move(ImmPtr(vp), reg);
             return Address(reg, 0);
@@ -189,17 +192,17 @@ class BaseAssembler : public JSC::MacroA
         setupVMFrame();
 
         return call(pfun);
     }
 
     void fixScriptStack(uint32 frameDepth) {
         /* sp = fp + slots() + stackDepth */
         addPtr(Imm32(sizeof(JSStackFrame) + frameDepth * sizeof(jsval)),
-               FpReg,
+               JSFrameReg,
                ClobberInCall);
 
         /* regs->sp = sp */
         storePtr(ClobberInCall,
                  FrameAddress(offsetof(VMFrame, regs) + offsetof(JSFrameRegs, sp)));
     }
 
     void setupVMFrame() {
@@ -234,13 +237,16 @@ class BaseAssembler : public JSC::MacroA
 
         for (size_t i = 0; i < callPatches.length(); i++) {
             JSC::MacroAssemblerCodePtr cp(ncode + callPatches[i].distance);
             repatchBuffer.relink(JSC::CodeLocationCall(cp), callPatches[i].fun);
         }
     }
 };
 
+/* Save some typing. */
+const JSC::MacroAssembler::RegisterID JSFrameReg = BaseAssembler::JSFrameReg;
+
 } /* namespace js */
 } /* namespace mjit */
 
 #endif
 
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -328,26 +328,26 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_PUSH)
             frame.push(UndefinedTag());
           END_CASE(JSOP_PUSH)
 
           BEGIN_CASE(JSOP_POPV)
           BEGIN_CASE(JSOP_SETRVAL)
           {
             FrameEntry *fe = frame.peek(-1);
-            frame.storeTo(fe, Address(Assembler::FpReg, offsetof(JSStackFrame, rval)), true);
+            frame.storeTo(fe, Address(JSFrameReg, offsetof(JSStackFrame, rval)), true);
             frame.pop();
           }
           END_CASE(JSOP_POPV)
 
           BEGIN_CASE(JSOP_RETURN)
           {
             /* Safe point! */
             FrameEntry *fe = frame.peek(-1);
-            frame.storeTo(fe, Address(Assembler::FpReg, offsetof(JSStackFrame, rval)), true);
+            frame.storeTo(fe, Address(JSFrameReg, offsetof(JSStackFrame, rval)), true);
             frame.pop();
             /* :TODO: We only have to forget things that are closed over... */
             frame.forgetEverything();
             emitReturn();
           }
           END_CASE(JSOP_RETURN)
 
           BEGIN_CASE(JSOP_GOTO)
@@ -868,17 +868,17 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_SETARG)
           {
             uint32 slot = GET_SLOTNO(PC);
             FrameEntry *top = frame.peek(-1);
 
             bool popped = PC[JSOP_SETARG_LENGTH] == JSOP_POP;
 
             RegisterID reg = frame.allocReg();
-            masm.loadPtr(Address(Assembler::FpReg, offsetof(JSStackFrame, argv)), reg);
+            masm.loadPtr(Address(JSFrameReg, offsetof(JSStackFrame, argv)), reg);
             Address address = Address(reg, slot * sizeof(Value));
             frame.storeTo(top, address, popped);
             frame.freeReg(reg);
           }
           END_CASE(JSOP_SETARG)
 
           BEGIN_CASE(JSOP_GETLOCAL)
           {
@@ -1056,17 +1056,17 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_TRY)
           END_CASE(JSOP_TRY)
 
           BEGIN_CASE(JSOP_GETDSLOT)
           BEGIN_CASE(JSOP_CALLDSLOT)
           {
             // :FIXME: x64
             RegisterID reg = frame.allocReg();
-            masm.loadPtr(Address(Assembler::FpReg, offsetof(JSStackFrame, argv)), reg);
+            masm.loadPtr(Address(JSFrameReg, offsetof(JSStackFrame, argv)), reg);
             masm.loadData32(Address(reg, int32(sizeof(Value)) * -2), reg);
             masm.loadPtr(Address(reg, offsetof(JSObject, dslots)), reg);
             frame.freeReg(reg);
             frame.push(Address(reg, GET_UINT16(PC) * sizeof(Value)));
             if (op == JSOP_CALLDSLOT)
                 frame.push(NullTag());
           }
           END_CASE(JSOP_CALLDSLOT)
@@ -1449,17 +1449,17 @@ mjit::Compiler::dispatchCall(VoidPtrStub
 
     j.linkTo(masm.label(), &masm);
     restoreFrameRegs();
 }
 
 void
 mjit::Compiler::restoreFrameRegs()
 {
-    masm.loadPtr(FrameAddress(offsetof(VMFrame, fp)), Assembler::FpReg);
+    masm.loadPtr(FrameAddress(offsetof(VMFrame, fp)), JSFrameReg);
 }
 
 bool
 mjit::Compiler::compareTwoValues(JSContext *cx, JSOp op, const Value &lhs, const Value &rhs)
 {
     JS_ASSERT(lhs.isPrimitive());
     JS_ASSERT(rhs.isPrimitive());
 
@@ -1550,17 +1550,17 @@ mjit::Compiler::jsop_getprop_slow()
     frame.pop();
     frame.pushSynced();
 }
 
 void
 mjit::Compiler::jsop_getarg(uint32 index)
 {
     RegisterID reg = frame.allocReg();
-    masm.loadPtr(Address(Assembler::FpReg, offsetof(JSStackFrame, argv)), reg);
+    masm.loadPtr(Address(JSFrameReg, offsetof(JSStackFrame, argv)), reg);
     frame.freeReg(reg);
     frame.push(Address(reg, index * sizeof(Value)));
 }
 
 void
 mjit::Compiler::jsop_this()
 {
     /*
--- a/js/src/methodjit/FrameState-inl.h
+++ b/js/src/methodjit/FrameState-inl.h
@@ -71,45 +71,39 @@ FrameState::popn(uint32 n)
 {
     for (uint32 i = 0; i < n; i++)
         pop();
 }
 
 inline JSC::MacroAssembler::RegisterID
 FrameState::allocReg()
 {
-    return alloc();
+    RegisterID reg;
+    if (!freeRegs.empty())
+        reg = freeRegs.takeAnyReg();
+    else
+        reg = evictSomething();
+    regstate[reg].fe = NULL;
+    return reg;
 }
 
 inline JSC::MacroAssembler::RegisterID
 FrameState::allocReg(uint32 mask)
 {
     RegisterID reg;
     if (freeRegs.hasRegInMask(mask))
         reg = freeRegs.takeRegInMask(mask);
     else
         reg = evictSomething(mask);
     regstate[reg].fe = NULL;
     return reg;
 }
 
 inline JSC::MacroAssembler::RegisterID
-FrameState::alloc()
-{
-    RegisterID reg;
-    if (!freeRegs.empty())
-        reg = freeRegs.takeAnyReg();
-    else
-        reg = evictSomething();
-    regstate[reg].fe = NULL;
-    return reg;
-}
-
-inline JSC::MacroAssembler::RegisterID
-FrameState::alloc(FrameEntry *fe, RematInfo::RematType type, bool weak)
+FrameState::allocReg(FrameEntry *fe, RematInfo::RematType type, bool weak)
 {
     RegisterID reg;
     if (!freeRegs.empty())
         reg = freeRegs.takeAnyReg();
     else
         reg = evictSomething();
     regstate[reg] = RegisterState(fe, type, weak);
     return reg;
@@ -213,25 +207,25 @@ FrameState::push(Address address)
     /* :XXX: X64 */
     fe->resetUnsynced();
 
     /* Prevent us from clobbering this reg. */
     bool free = freeRegs.hasReg(address.base);
     if (free)
         freeRegs.takeReg(address.base);
 
-    RegisterID reg = alloc(fe, RematInfo::DATA, true);
+    RegisterID reg = allocReg(fe, RematInfo::DATA, true);
     masm.loadData32(address, reg);
     fe->data.setRegister(reg);
 
     /* Now it's safe to grab this register again. */
     if (free)
         freeRegs.putReg(address.base);
 
-    reg = alloc(fe, RematInfo::TYPE, true);
+    reg = allocReg(fe, RematInfo::TYPE, true);
     masm.loadTypeTag(address, reg);
     fe->type.setRegister(reg);
 }
 
 inline void
 FrameState::pushRegs(RegisterID type, RegisterID data)
 {
     JS_ASSERT(!freeRegs.hasReg(type) && !freeRegs.hasReg(data));
@@ -287,34 +281,34 @@ FrameState::tempRegForType(FrameEntry *f
     if (fe->isCopy())
         fe = fe->copyOf();
 
     if (fe->type.inRegister())
         return fe->type.reg();
 
     /* :XXX: X64 */
 
-    RegisterID reg = alloc(fe, RematInfo::TYPE, true);
+    RegisterID reg = allocReg(fe, RematInfo::TYPE, true);
     masm.loadTypeTag(addressOf(fe), reg);
     fe->type.setRegister(reg);
     return reg;
 }
 
 inline JSC::MacroAssembler::RegisterID
 FrameState::tempRegForData(FrameEntry *fe)
 {
     JS_ASSERT(!fe->data.isConstant());
 
     if (fe->isCopy())
         fe = fe->copyOf();
 
     if (fe->data.inRegister())
         return fe->data.reg();
 
-    RegisterID reg = alloc(fe, RematInfo::DATA, true);
+    RegisterID reg = allocReg(fe, RematInfo::DATA, true);
     masm.loadData32(addressOf(fe), reg);
     fe->data.setRegister(reg);
     return reg;
 }
 
 inline JSC::MacroAssembler::RegisterID
 FrameState::tempRegForData(FrameEntry *fe, RegisterID reg)
 {
@@ -410,17 +404,17 @@ FrameState::learnType(FrameEntry *fe, JS
 }
 
 inline JSC::MacroAssembler::Address
 FrameState::addressOf(const FrameEntry *fe) const
 {
     uint32 index = (fe - entries);
     JS_ASSERT(index >= nargs);
     index -= nargs;
-    return Address(Assembler::FpReg, sizeof(JSStackFrame) + sizeof(Value) * index);
+    return Address(JSFrameReg, sizeof(JSStackFrame) + sizeof(Value) * index);
 }
 
 inline JSC::MacroAssembler::Jump
 FrameState::testInt32(Assembler::Condition cond, FrameEntry *fe)
 {
     JS_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual);
     if (shouldAvoidTypeRemat(fe))
         return masm.testInt32(cond, addressOf(fe));
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -189,32 +189,32 @@ FrameState::storeTo(FrameEntry *fe, Addr
 
     /* Cannot clobber the address's register. */
     JS_ASSERT(!freeRegs.hasReg(address.base));
 
     if (fe->data.inRegister()) {
         masm.storeData32(fe->data.reg(), address);
     } else {
         JS_ASSERT(fe->data.inMemory());
-        RegisterID reg = popped ? alloc() : alloc(fe, RematInfo::DATA, true);
+        RegisterID reg = popped ? allocReg() : allocReg(fe, RematInfo::DATA, true);
         masm.loadData32(addressOf(fe), reg);
         masm.storeData32(reg, address);
         if (popped)
             freeReg(reg);
         else
             fe->data.setRegister(reg);
     }
 
     if (fe->isTypeKnown()) {
         masm.storeTypeTag(ImmTag(fe->getTypeTag()), address);
     } else if (fe->type.inRegister()) {
         masm.storeTypeTag(fe->type.reg(), address);
     } else {
         JS_ASSERT(fe->type.inMemory());
-        RegisterID reg = popped ? alloc() : alloc(fe, RematInfo::TYPE, true);
+        RegisterID reg = popped ? allocReg() : allocReg(fe, RematInfo::TYPE, true);
         masm.loadTypeTag(addressOf(fe), reg);
         masm.storeTypeTag(reg, address);
         if (popped)
             freeReg(reg);
         else
             fe->type.setRegister(reg);
     }
 }
@@ -639,24 +639,24 @@ FrameState::copyData(FrameEntry *fe)
     if (fe->data.inRegister()) {
         RegisterID reg = fe->data.reg();
         if (freeRegs.empty()) {
             if (!fe->data.synced())
                 syncData(fe, addressOf(fe), masm);
             fe->data.setMemory();
             regstate[reg].fe = NULL;
         } else {
-            RegisterID newReg = alloc();
+            RegisterID newReg = allocReg();
             masm.move(reg, newReg);
             reg = newReg;
         }
         return reg;
     }
 
-    RegisterID reg = alloc();
+    RegisterID reg = allocReg();
 
     if (!freeRegs.empty())
         masm.move(tempRegForData(fe), reg);
     else
         masm.loadData32(addressOf(fe),reg);
 
     return reg;
 }
@@ -721,41 +721,41 @@ FrameState::ownRegForData(FrameEntry *fe
         if (freeRegs.empty()) {
             /* For now... just steal the register that already exists. */
             if (!backing->data.synced())
                 syncData(backing, addressOf(backing), masm);
             reg = backing->data.reg();
             backing->data.setMemory();
             moveOwnership(reg, NULL);
         } else {
-            reg = alloc();
+            reg = allocReg();
             masm.move(backing->data.reg(), reg);
         }
         return reg;
     }
 
     if (fe->isCopied()) {
         uncopy(fe);
         if (fe->isCopied()) {
-            reg = alloc();
+            reg = allocReg();
             masm.loadData32(addressOf(fe), reg);
             return reg;
         }
     }
     
     if (fe->data.inRegister()) {
         reg = fe->data.reg();
         /* Remove ownership of this register. */
         JS_ASSERT(regstate[reg].fe == fe);
         JS_ASSERT(regstate[reg].type == RematInfo::DATA);
         regstate[reg].fe = NULL;
         fe->data.invalidate();
     } else {
         JS_ASSERT(fe->data.inMemory());
-        reg = alloc();
+        reg = allocReg();
         masm.loadData32(addressOf(fe), reg);
     }
     return reg;
 }
 
 void
 FrameState::pushCopyOf(uint32 index)
 {
--- a/js/src/methodjit/FrameState.h
+++ b/js/src/methodjit/FrameState.h
@@ -396,18 +396,17 @@ class FrameState
 
 #ifdef DEBUG
     void assertValidRegisterState() const;
 #endif
 
     Address addressOf(const FrameEntry *fe) const;
 
   private:
-    inline RegisterID alloc();
-    inline RegisterID alloc(FrameEntry *fe, RematInfo::RematType type, bool weak);
+    inline RegisterID allocReg(FrameEntry *fe, RematInfo::RematType type, bool weak);
     inline void forgetReg(RegisterID reg);
     RegisterID evictSomething(uint32 mask);
     void evictReg(RegisterID reg);
     inline FrameEntry *rawPush();
     inline FrameEntry *addToTracker(uint32 index);
     inline void syncType(const FrameEntry *fe, Address to, Assembler &masm) const;
     inline void syncData(const FrameEntry *fe, Address to, Assembler &masm) const;
     inline FrameEntry *getLocal(uint32 slot);
--- a/js/src/methodjit/MachineRegs.h
+++ b/js/src/methodjit/MachineRegs.h
@@ -157,21 +157,21 @@ struct Registers {
         freeMask = other.freeMask;
         return *this;
     }
 
     void reset() {
         freeMask = AvailRegs;
     }
 
-    bool empty() {
+    bool empty() const {
         return !freeMask;
     }
 
-    bool empty(uint32 mask) {
+    bool empty(uint32 mask) const {
         return !(freeMask & mask);
     }
 
     RegisterID takeAnyReg() {
         JS_ASSERT(!empty());
         RegisterID reg = (RegisterID)(31 - js_bitscan_clz32(freeMask));
         takeReg(reg);
         return reg;
@@ -209,14 +209,117 @@ struct Registers {
 
     bool operator ==(const Registers &other) {
         return freeMask == other.freeMask;
     }
 
     uint32 freeMask;
 };
 
+
+struct FPRegisters {
+
+    typedef JSC::MacroAssembler::FPRegisterID FPRegisterID;
+
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+    static const uint32 TotalFPRegisters = 8;
+    static const uint32 TempFPRegs =
+          (1 << JSC::X86Registers::xmm0)
+        | (1 << JSC::X86Registers::xmm1)
+        | (1 << JSC::X86Registers::xmm2)
+        | (1 << JSC::X86Registers::xmm3)
+        | (1 << JSC::X86Registers::xmm4)
+        | (1 << JSC::X86Registers::xmm5)
+        | (1 << JSC::X86Registers::xmm6)
+        | (1 << JSC::X86Registers::xmm7);
+#elif defined(JS_CPU_ARM)
+    static const uint32 TotalFPRegisters = 4;
+    static const uint32 TempFPRegs = 
+          (1 << JSC::ARMRegisters::d0)
+        | (1 << JSC::ARMRegisters::d1)
+        | (1 << JSC::ARMRegisters::d2)
+        | (1 << JSC::ARMRegisters::d3);
+#else
+# error "Unsupported platform"
+#endif
+
+    static const uint32 AvailFPRegs = TempFPRegs;
+
+    FPRegisters()
+      : freeFPMask(AvailFPRegs)
+    { }
+
+    FPRegisters(uint32 freeFPMask)
+      : freeFPMask(freeFPMask)
+    { }
+
+    FPRegisters(const FPRegisters &other)
+      : freeFPMask(other.freeFPMask)
+    { }
+
+    FPRegisters & operator =(const FPRegisters &other)
+    {
+        freeFPMask = other.freeFPMask;
+        return *this;
+    }
+
+    void reset() {
+        freeFPMask = AvailFPRegs;
+    }
+
+    bool empty() const {
+        return !freeFPMask;
+    }
+
+    bool empty(uint32 mask) const {
+        return !(freeFPMask & mask);
+    }
+
+    FPRegisterID takeAnyReg() {
+        JS_ASSERT(!empty());
+        FPRegisterID reg = (FPRegisterID)(31 - js_bitscan_clz32(freeFPMask));
+        takeReg(reg);
+        return reg;
+    }
+
+    bool hasRegInMask(uint32 mask) const {
+        FPRegisters temp(freeFPMask & mask);
+        return !temp.empty();
+    }
+
+    FPRegisterID takeRegInMask(uint32 mask) {
+        FPRegisters temp(freeFPMask & mask);
+        FPRegisterID reg = temp.takeAnyReg();
+        takeReg(reg);
+        return reg;
+    }
+
+    bool hasReg(FPRegisterID fpreg) const {
+        return !!(freeFPMask & (1 << fpreg));
+    }
+
+    void putRegUnchecked(FPRegisterID fpreg) {
+        freeFPMask |= (1 << fpreg);
+    }
+
+    void putReg(FPRegisterID fpreg) {
+        JS_ASSERT(!hasReg(fpreg));
+        putRegUnchecked(fpreg);
+    }
+
+    void takeReg(FPRegisterID fpreg) {
+        JS_ASSERT(hasReg(fpreg));
+        freeFPMask &= ~(1 << fpreg);
+    }
+
+    bool operator ==(const FPRegisters &other) {
+        return freeFPMask == other.freeFPMask;
+    }
+
+    uint32 freeFPMask;
+};
+
 } /* namespace mjit */
 
 } /* namespace js */
 
 #endif /* jsjaeger_regstate_h__ */
 
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -311,17 +311,17 @@ SYMBOL_STRING(JaegerTrampoline) ":"     
      * supposedly benefits Cortex-A9. TODO: Check that this is actually a benefit. */
 "   push    {r10,r11,lr}"                   "\n"
 "   push    {r7-r9}"                        "\n"
 "   push    {r4-r6}"                        "\n"
 "   mov     r11, #0"                        "\n"   /* r11 = inlineCallCount */
 "   push    {r11}"                          "\n"   /* inlineCallCount   */
 "   push    {r0}"                           "\n"   /* cx                */
 "   push    {r1}"                           "\n"   /* fp                */
-"   mov     r11, r1"                        "\n"   /* FpReg             */
+"   mov     r11, r1"                        "\n"   /* JSFrameReg        */
 
     /* Leave space for the VMFrame arguments. The largest slot appears to be 8 bytes for 32-bit
      * architectures, though hard-coding this doesn't seem sensible. TODO: Use sizeof here and for
      * the other targets. */
 
 "   sub     sp, sp, #(8*4)"                 "\n"
 
 "   mov     r0, sp"                         "\n"
--- a/js/src/methodjit/nunbox/FastOps.cpp
+++ b/js/src/methodjit/nunbox/FastOps.cpp
@@ -48,17 +48,17 @@
 
 using namespace js;
 using namespace js::mjit;
 
 void
 mjit::Compiler::jsop_bindname(uint32 index)
 {
     RegisterID reg = frame.allocReg();
-    Address scopeChain(Assembler::FpReg, offsetof(JSStackFrame, scopeChain));
+    Address scopeChain(JSFrameReg, offsetof(JSStackFrame, scopeChain));
     masm.loadData32(scopeChain, reg);
 
     Address address(reg, offsetof(JSObject, fslots) + JSSLOT_PARENT * sizeof(jsval));
 
     Jump j = masm.branch32(Assembler::NotEqual, masm.payloadOf(address), Imm32(0));
 
     stubcc.linkExit(j);
     stubcc.leave();
@@ -740,17 +740,17 @@ mjit::Compiler::jsop_localinc(JSOp op, u
         ovf = masm.branchAdd32(Assembler::Overflow, Imm32(1), reg);
     else
         ovf = masm.branchSub32(Assembler::Overflow, Imm32(1), reg);
     stubcc.linkExit(ovf);
 
     /* Note, stub call will push original value again no matter what. */
     stubcc.leave();
     stubcc.masm.addPtr(Imm32(sizeof(Value) * slot + sizeof(JSStackFrame)),
-                       Assembler::FpReg,
+                       JSFrameReg,
                        Registers::ArgReg1);
     stubcc.vpInc(op, depth);
 
     /* :TODO: We can do slightly better here. */
     frame.pushUntypedPayload(JSVAL_MASK32_INT32, reg);
     frame.storeLocal(slot);
 
     if (post || popped)
@@ -779,17 +779,17 @@ mjit::Compiler::jsop_arginc(JSOp op, uin
 
     Jump ovf;
     if (amt > 0)
         ovf = masm.branchAdd32(Assembler::Overflow, Imm32(1), reg);
     else
         ovf = masm.branchSub32(Assembler::Overflow, Imm32(1), reg);
     stubcc.linkExit(ovf);
 
-    Address argv(Assembler::FpReg, offsetof(JSStackFrame, argv));
+    Address argv(JSFrameReg, offsetof(JSStackFrame, argv));
 
     stubcc.leave();
     stubcc.masm.loadPtr(argv, Registers::ArgReg1);
     stubcc.masm.addPtr(Imm32(sizeof(Value) * slot), Registers::ArgReg1, Registers::ArgReg1);
     stubcc.vpInc(op, depth);
 
     frame.pushTypedPayload(JSVAL_MASK32_INT32, reg);
     fe = frame.peek(-1);