Put the type feedback vector in the unoptimized JavaScript frame.

src/ia32/lithium-codegen-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 304 matching lines @@
 void LCodeGen::GenerateOsrPrologue() {
   // Generate the OSR entry prologue at the first unknown OSR value, or if there
   // are none, at the OSR entrypoint instruction.
   if (osr_pc_offset_ >= 0) return;
 
   osr_pc_offset_ = masm()->pc_offset();
 
     // Move state of dynamic frame alignment into edx.
   __ Move(edx, Immediate(kNoAlignmentPadding));
 
+  Label remove_vector_finished;
+  int unoptimized_slots = graph()->osr()->UnoptimizedFrameSlots();
   if (support_aligned_spilled_doubles_ && dynamic_frame_alignment_) {
     Label do_not_pad, align_loop;
     // Align ebp + 4 to a multiple of 2 * kPointerSize.
     __ test(ebp, Immediate(kPointerSize));
     __ j(zero, &do_not_pad, Label::kNear);
-    __ push(Immediate(0));
+
     __ mov(ebx, esp);
+    __ add(Operand(ebx), Immediate(kPointerSize * unoptimized_slots));
     __ mov(edx, Immediate(kAlignmentPaddingPushed));
 
-    // Move all parts of the frame over one word. The frame consists of:
-    // unoptimized frame slots, alignment state, context, frame pointer, return
-    // address, receiver, and the arguments.
-    __ mov(ecx, Immediate(scope()->num_parameters() +
-           5 + graph()->osr()->UnoptimizedFrameSlots()));
+    // Move the receiver, parameters and fixed part of the frame above the type
+    // feedback vector over one word, stomping on the vector.
+    __ mov(ecx,
+           Immediate(1 + scope()->num_parameters() +
+                     StandardFrameConstants::kFixedFrameSize / kPointerSize));
 
     __ bind(&align_loop);
     __ mov(eax, Operand(ebx, 1 * kPointerSize));
     __ mov(Operand(ebx, 0), eax);
     __ add(Operand(ebx), Immediate(kPointerSize));
     __ dec(ecx);
     __ j(not_zero, &align_loop, Label::kNear);
     __ mov(Operand(ebx, 0), Immediate(kAlignmentZapValue));
     __ sub(Operand(ebp), Immediate(kPointerSize));
+    __ jmp(&remove_vector_finished);
     __ bind(&do_not_pad);
+    // We have to move locals over one.
+    __ AdaptUnoptimizedFrameForOsrEntry(unoptimized_slots, ebx, eax);
+  } else {
+    // Need to copy locals over by one.
+    __ AdaptUnoptimizedFrameForOsrEntry(unoptimized_slots, ebx, eax);
   }
 
+  __ bind(&remove_vector_finished);
   // Save the first local, which is overwritten by the alignment state.
   Operand alignment_loc = MemOperand(ebp, -3 * kPointerSize);
   __ push(alignment_loc);
 
   // Set the dynamic frame alignment state.
   __ mov(alignment_loc, edx);
 
   // Adjust the frame size, subsuming the unoptimized frame into the
   // optimized frame.
   int slots = GetStackSlotCount() - graph()->osr()->UnoptimizedFrameSlots();
@@ skipping 5408 matching lines @@
   CallRuntime(Runtime::kPushBlockContext, 2, instr);
   RecordSafepoint(Safepoint::kNoLazyDeopt);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32