[JSC] Remove non-LargeAllocation restriction for JSCallee
https://bugs.webkit.org/show_bug.cgi?id=203260

Reviewed by Saam Barati.

Source/JavaScriptCore:

We now pass JSGlobalObject* instead of ExecState*. And we are getting VM& from JSGlobalObject*.
Because now accessing ExecState::vm() becomes less frequent, we can remove the restriction that
callee is only allocated in non-LargeAllocation, which restriction made ExecState::vm fast.

This patch renames `CallFrame::vm` to `CallFrame::deprecatedVM`. And we avoid using it as much as possible.
And we also remove the restriction that callee needs to be in non-LargeAllocation.

* API/JSContextRef.cpp:
(JSContextCreateBacktrace):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::noticeIncomingCall):
* debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::deprecatedVMEntryGlobalObject const):
(JSC::DebuggerCallFrame::functionName const):
(JSC::DebuggerCallFrame::scope):
(JSC::DebuggerCallFrame::type const):
(JSC::DebuggerCallFrame::evaluateWithScopeExtension):
(JSC::DebuggerCallFrame::positionForCallFrame):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::executeOSRExit):
(JSC::DFG::OSRExit::compileOSRExit):
(JSC::DFG::OSRExit::debugOperationPrintSpeculationFailure):
* dfg/DFGOperations.cpp:
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileFTLOSRExit):
* ftl/FTLOperations.cpp:
(JSC::FTL::compileFTLLazySlowPath):
* inspector/JSInjectedScriptHost.cpp:
(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
* inspector/ScriptCallStackFactory.cpp:
(Inspector::createScriptCallStack):
(Inspector::createScriptCallStackForConsole):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::callerSourceOrigin):
(JSC::CallFrame::friendlyFunctionName):
* interpreter/CallFrame.h:
(JSC::CallFrame::iterate):
* interpreter/Interpreter.cpp:
(JSC::sizeOfVarargs):
(JSC::sizeFrameForVarargs):
(JSC::Interpreter::getStackTrace):
(JSC::Interpreter::unwind):
(JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
(JSC::Interpreter::debug):
* interpreter/Interpreter.h:
* interpreter/ShadowChicken.cpp:
(JSC::ShadowChicken::update):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::StackVisitor):
(JSC::StackVisitor::Frame::functionName const):
* interpreter/StackVisitor.h:
(JSC::StackVisitor::visit):
* jit/HostCallReturnValue.cpp:
(JSC::getHostCallReturnValueWithExecState):
* jit/JITOperations.cpp:
* jit/Repatch.cpp:
(JSC::linkFor):
(JSC::linkPolymorphicCall):
* jit/Repatch.h:
* jsc.cpp:
(functionJSCStack):
(functionRunString):
(functionLoadString):
(functionCallerSourceOrigin):
(functionCallerIsOMGCompiled):
(functionDollarEvalScript):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/Error.cpp:
(JSC::getBytecodeOffset):
* runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
* runtime/JSCellInlines.h:
(JSC::CallFrame::deprecatedVM const):
(JSC::CallFrame::vm const): Deleted.
* runtime/JSFunction.cpp:
(JSC::retrieveArguments):
(JSC::JSFunction::argumentsGetter):
(JSC::retrieveCallerFunction):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGlobalObject.cpp:
(JSC::assertCall):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncEval):
(JSC::globalFuncImportModule):
* runtime/NullSetterFunction.cpp:
(JSC::callerIsStrict):
(JSC::NullSetterFunctionInternal::callReturnUndefined):
* tools/JSDollarVM.cpp:
(IGNORE_WARNINGS_BEGIN):
(JSC::functionLLintTrue):
(JSC::functionJITTrue):
(JSC::functionDumpRegisters):
(JSC::functionShadowChickenFunctionsOnStack):
* tools/VMInspector.cpp:
(JSC::VMInspector::codeBlockForFrame):
(JSC::VMInspector::dumpCallFrame):
(JSC::VMInspector::dumpRegisters):
(JSC::VMInspector::dumpStack):
* wasm/js/WasmToJS.cpp:
(JSC::Wasm::wasmToJS):

Source/WebCore:

Passing VM& instead of calling CallFrame::vm.

* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::callerGlobalObject):
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::responsibleDocument):
* bindings/js/JSDOMWindowBase.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateCallWith):
* testing/Internals.cpp:
(WebCore::Internals::parserMetaData):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251457 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index 46be519..222a4ee 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -334,7 +334,7 @@
 
     ASSERT(maxStackSize);
     BacktraceFunctor functor(builder, maxStackSize);
-    frame->iterate(functor);
+    frame->iterate(vm, functor);
 
     return OpaqueJSString::tryCreate(builder.toString()).leakRef();
 }
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 7381965..7608714 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,113 @@
+2019-10-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Remove non-LargeAllocation restriction for JSCallee
+        https://bugs.webkit.org/show_bug.cgi?id=203260
+
+        Reviewed by Saam Barati.
+
+        We now pass JSGlobalObject* instead of ExecState*. And we are getting VM& from JSGlobalObject*.
+        Because now accessing ExecState::vm() becomes less frequent, we can remove the restriction that
+        callee is only allocated in non-LargeAllocation, which restriction made ExecState::vm fast.
+
+        This patch renames `CallFrame::vm` to `CallFrame::deprecatedVM`. And we avoid using it as much as possible.
+        And we also remove the restriction that callee needs to be in non-LargeAllocation.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::noticeIncomingCall):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::deprecatedVMEntryGlobalObject const):
+        (JSC::DebuggerCallFrame::functionName const):
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::type const):
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        (JSC::DebuggerCallFrame::positionForCallFrame):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::executeOSRExit):
+        (JSC::DFG::OSRExit::compileOSRExit):
+        (JSC::DFG::OSRExit::debugOperationPrintSpeculationFailure):
+        * dfg/DFGOperations.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::compileFTLLazySlowPath):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::callerSourceOrigin):
+        (JSC::CallFrame::friendlyFunctionName):
+        * interpreter/CallFrame.h:
+        (JSC::CallFrame::iterate):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForVarargs):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::StackVisitor):
+        (JSC::StackVisitor::Frame::functionName const):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::visit):
+        * jit/HostCallReturnValue.cpp:
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::linkFor):
+        (JSC::linkPolymorphicCall):
+        * jit/Repatch.h:
+        * jsc.cpp:
+        (functionJSCStack):
+        (functionRunString):
+        (functionLoadString):
+        (functionCallerSourceOrigin):
+        (functionCallerIsOMGCompiled):
+        (functionDollarEvalScript):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Error.cpp:
+        (JSC::getBytecodeOffset):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSCellInlines.h:
+        (JSC::CallFrame::deprecatedVM const):
+        (JSC::CallFrame::vm const): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::retrieveArguments):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::assertCall):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncImportModule):
+        * runtime/NullSetterFunction.cpp:
+        (JSC::callerIsStrict):
+        (JSC::NullSetterFunctionInternal::callReturnUndefined):
+        * tools/JSDollarVM.cpp:
+        (IGNORE_WARNINGS_BEGIN):
+        (JSC::functionLLintTrue):
+        (JSC::functionJITTrue):
+        (JSC::functionDumpRegisters):
+        (JSC::functionShadowChickenFunctionsOnStack):
+        * tools/VMInspector.cpp:
+        (JSC::VMInspector::codeBlockForFrame):
+        (JSC::VMInspector::dumpCallFrame):
+        (JSC::VMInspector::dumpRegisters):
+        (JSC::VMInspector::dumpStack):
+        * wasm/js/WasmToJS.cpp:
+        (JSC::Wasm::wasmToJS):
+
 2019-10-22  Mark Lam  <mark.lam@apple.com>
 
         Clients of JSArray::tryCreateUninitializedRestricted() should invoke the mutatorFence().
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 09f5073..4e947a3 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -2229,7 +2229,7 @@
 
     // Recursive calls won't be inlined.
     RecursionCheckFunctor functor(callerFrame, this, Options::maximumInliningDepth());
-    vm().topCallFrame->iterate(functor);
+    vm().topCallFrame->iterate(vm(), functor);
 
     if (functor.didRecurse()) {
         if (Options::verboseCallLink())
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 00c7554..2ae0b07 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -124,7 +124,7 @@
     ASSERT(isValid());
     if (!isValid())
         return nullptr;
-    VM& vm = m_validMachineFrame->vm();
+    VM& vm = m_validMachineFrame->deprecatedVM();
     return vm.deprecatedVMEntryGlobalObject(m_validMachineFrame->wasmAwareLexicalGlobalObject(vm));
 }
 
@@ -144,7 +144,7 @@
     if (!isValid())
         return String();
 
-    VM& vm = m_validMachineFrame->vm();
+    VM& vm = m_validMachineFrame->deprecatedVM();
     if (isTailDeleted()) {
         if (JSFunction* func = jsDynamicCast<JSFunction*>(vm, m_shadowChickenFrame.callee))
             return func->calculatedDisplayName(vm);
@@ -161,7 +161,7 @@
         return nullptr;
 
     if (!m_scope) {
-        VM& vm = m_validMachineFrame->vm();
+        VM& vm = m_validMachineFrame->deprecatedVM();
         JSScope* scope;
         CodeBlock* codeBlock = m_validMachineFrame->codeBlock();
         if (isTailDeleted())
@@ -187,7 +187,7 @@
     if (isTailDeleted())
         return FunctionType;
 
-    if (jsDynamicCast<JSFunction*>(m_validMachineFrame->vm(), m_validMachineFrame->jsCallee()))
+    if (jsDynamicCast<JSFunction*>(m_validMachineFrame->deprecatedVM(), m_validMachineFrame->jsCallee()))
         return FunctionType;
 
     return ProgramType;
@@ -226,7 +226,7 @@
     if (!callFrame)
         return jsUndefined();
 
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
     JSLockHolder lock(vm);
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
 
@@ -253,7 +253,7 @@
     VariableEnvironment variablesUnderTDZ;
     JSScope::collectClosureVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ);
 
-    auto* eval = DirectEvalExecutable::create(globalObject, makeSource(script, callFrame->callerSourceOrigin()), codeBlock->isStrictMode(), codeBlock->unlinkedCodeBlock()->derivedContextType(), codeBlock->unlinkedCodeBlock()->isArrowFunction(), evalContextType, &variablesUnderTDZ);
+    auto* eval = DirectEvalExecutable::create(globalObject, makeSource(script, callFrame->callerSourceOrigin(vm)), codeBlock->isStrictMode(), codeBlock->unlinkedCodeBlock()->derivedContextType(), codeBlock->unlinkedCodeBlock()->isArrowFunction(), evalContextType, &variablesUnderTDZ);
     if (UNLIKELY(catchScope.exception())) {
         exception = catchScope.exception();
         catchScope.clearException();
@@ -311,7 +311,7 @@
 TextPosition DebuggerCallFrame::positionForCallFrame(VM& vm, CallFrame* callFrame)
 {
     LineAndColumnFunctor functor;
-    StackVisitor::visit(callFrame, &vm, functor);
+    StackVisitor::visit(callFrame, vm, functor);
     return TextPosition(OrdinalNumber::fromOneBasedInt(functor.line()), OrdinalNumber::fromOneBasedInt(functor.column()));
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index 8ef7834..ac6b9cd 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -335,7 +335,7 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     CallFrame* callFrame = context.fp<CallFrame*>();
-    ASSERT(&callFrame->vm() == &vm);
+    ASSERT(&callFrame->deprecatedVM() == &vm);
     auto& cpu = context.cpu;
 
     if (validateDFGDoesGC) {
@@ -1028,7 +1028,7 @@
 
 void JIT_OPERATION OSRExit::compileOSRExit(CallFrame* callFrame)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (validateDFGDoesGC) {
@@ -1663,7 +1663,7 @@
 
 void JIT_OPERATION OSRExit::debugOperationPrintSpeculationFailure(CallFrame* callFrame, void* debugInfoRaw, void* scratch)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
     NativeCallFrameTracer tracer(vm, callFrame);
 
     SpeculationFailureDebugInfo* debugInfo = static_cast<SpeculationFailureDebugInfo*>(debugInfoRaw);
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 9a72536..d622eb7 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -2847,7 +2847,7 @@
     NativeCallFrameTracer tracer(vm, callFrame);
     JSValue arguments = JSValue::decode(encodedArguments);
     
-    return sizeOfVarargs(globalObject, callFrame, arguments, firstVarArgOffset);
+    return sizeOfVarargs(globalObject, arguments, firstVarArgOffset);
 }
 
 int32_t JIT_OPERATION operationHasOwnProperty(JSGlobalObject* globalObject, JSObject* thisObject, EncodedJSValue encodedKey)
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 98be387..f6b3a74 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -505,7 +505,7 @@
     if (shouldDumpDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit())
         dataLog("Compiling OSR exit with exitID = ", exitID, "\n");
 
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
 
     if (validateDFGDoesGC) {
         // We're about to exit optimized code. So, there's no longer any optimized
diff --git a/Source/JavaScriptCore/ftl/FTLOperations.cpp b/Source/JavaScriptCore/ftl/FTLOperations.cpp
index dcaba31..28c95b1 100644
--- a/Source/JavaScriptCore/ftl/FTLOperations.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOperations.cpp
@@ -609,7 +609,7 @@
 
 extern "C" void* JIT_OPERATION compileFTLLazySlowPath(CallFrame* callFrame, unsigned index)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
 
     // We cannot GC. We've got pointers in evil places.
     DeferGCForAWhile deferGC(vm.heap);
diff --git a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
index 3411569..2e04fa1 100644
--- a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
+++ b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
@@ -136,7 +136,7 @@
 
     NakedPtr<Exception> exception;
     JSObject* scopeExtension = callFrame->argument(1).getObject();
-    JSValue result = JSC::evaluateWithScopeExtension(globalObject, makeSource(program, callFrame->callerSourceOrigin()), scopeExtension, exception);
+    JSValue result = JSC::evaluateWithScopeExtension(globalObject, makeSource(program, callFrame->callerSourceOrigin(vm)), scopeExtension, exception);
     if (exception)
         throwException(globalObject, scope, exception);
 
diff --git a/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp b/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
index 8a5654c..6d7d3c5 100644
--- a/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
+++ b/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
@@ -92,11 +92,12 @@
     JSLockHolder locker(globalObject);
     Vector<ScriptCallFrame> frames;
 
-    CallFrame* frame = globalObject->vm().topCallFrame;
+    VM& vm = globalObject->vm();
+    CallFrame* frame = vm.topCallFrame;
     if (!frame)
         return ScriptCallStack::create();
     CreateScriptCallStackFunctor functor(false, frames, maxStackSize);
-    frame->iterate(functor);
+    frame->iterate(vm, functor);
 
     return ScriptCallStack::create(frames);
 }
@@ -109,15 +110,16 @@
     JSLockHolder locker(globalObject);
     Vector<ScriptCallFrame> frames;
 
-    CallFrame* frame = globalObject->vm().topCallFrame;
+    VM& vm = globalObject->vm();
+    CallFrame* frame = vm.topCallFrame;
     if (!frame)
         return ScriptCallStack::create();
     CreateScriptCallStackFunctor functor(true, frames, maxStackSize);
-    frame->iterate(functor);
+    frame->iterate(vm, functor);
 
     if (frames.isEmpty()) {
         CreateScriptCallStackFunctor functor(false, frames, maxStackSize);
-        frame->iterate(functor);
+        frame->iterate(vm, functor);
     }
 
     return ScriptCallStack::create(frames);
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.cpp b/Source/JavaScriptCore/interpreter/CallFrame.cpp
index 80990ce..5232058 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/Source/JavaScriptCore/interpreter/CallFrame.cpp
@@ -233,10 +233,9 @@
     return static_cast<CallFrame*>(unsafeCallerFrameOrEntryFrame());
 }
 
-SourceOrigin CallFrame::callerSourceOrigin()
+SourceOrigin CallFrame::callerSourceOrigin(VM& vm)
 {
     RELEASE_ASSERT(callee().isCell());
-    VM* vm = &this->vm();
     SourceOrigin sourceOrigin;
     bool haveSkippedFirstFrame = false;
     StackVisitor::visit(this, vm, [&](StackVisitor& visitor) {
@@ -292,7 +291,7 @@
         return "global code"_s;
     case FunctionCode:
         if (jsCallee())
-            return getCalculatedDisplayName(vm(), jsCallee());
+            return getCalculatedDisplayName(codeBlock->vm(), jsCallee());
         return emptyString();
     }
 
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index 10e46a7..b7b33e0 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -136,7 +136,9 @@
         // Differs from VM::deprecatedVMEntryGlobalObject() during function calls across web browser frames.
         JSGlobalObject* lexicalGlobalObject() const;
 
-        VM& vm() const;
+        // FIXME: Remove this function
+        // https://bugs.webkit.org/show_bug.cgi?id=203272
+        VM& deprecatedVM() const;
 
         static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
         Register* registers() { return this; }
@@ -151,7 +153,7 @@
         CallFrame* unsafeCallerFrame(EntryFrame*&) const;
         JS_EXPORT_PRIVATE CallFrame* callerFrame(EntryFrame*&) const;
 
-        JS_EXPORT_PRIVATE SourceOrigin callerSourceOrigin();
+        JS_EXPORT_PRIVATE SourceOrigin callerSourceOrigin(VM&);
 
         static ptrdiff_t callerFrameOffset() { return OBJECT_OFFSETOF(CallerFrameAndPC, callerFrame); }
 
@@ -280,15 +282,11 @@
         // FIXME: This method is improper. We rely on the fact that we can call it with a null
         // receiver. We should always be using StackVisitor directly.
         // It's only valid to call this from a non-wasm top frame.
-        template <StackVisitor::EmptyEntryFrameAction action = StackVisitor::ContinueIfTopEntryFrameIsEmpty, typename Functor> void iterate(const Functor& functor)
+        template <StackVisitor::EmptyEntryFrameAction action = StackVisitor::ContinueIfTopEntryFrameIsEmpty, typename Functor> void iterate(VM& vm, const Functor& functor)
         {
-            VM* vm;
             void* rawThis = this;
-            if (!!rawThis) {
+            if (!!rawThis)
                 RELEASE_ASSERT(callee().isCell());
-                vm = &this->vm();
-            } else
-                vm = nullptr;
             StackVisitor::visit<action, Functor>(this, vm, functor);
         }
 
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index c9904cc..e43db29 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -176,9 +176,9 @@
     RELEASE_AND_RETURN(scope, interpreter->execute(eval, globalObject, thisValue, callerScopeChain));
 }
 
-unsigned sizeOfVarargs(JSGlobalObject* globalObject, CallFrame* callFrame, JSValue arguments, uint32_t firstVarArgOffset)
+unsigned sizeOfVarargs(JSGlobalObject* globalObject, JSValue arguments, uint32_t firstVarArgOffset)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (UNLIKELY(!arguments.isCell())) {
@@ -241,7 +241,7 @@
 {
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    unsigned length = sizeOfVarargs(globalObject, callFrame, arguments, firstVarArgOffset);
+    unsigned length = sizeOfVarargs(globalObject, arguments, firstVarArgOffset);
     RETURN_IF_EXCEPTION(scope, 0);
 
     CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);
@@ -440,7 +440,7 @@
 
     size_t framesCount = 0;
     size_t maxFramesCountNeeded = maxStackSize + framesToSkip;
-    StackVisitor::visit(callFrame, &vm, [&] (StackVisitor&) -> StackVisitor::Status {
+    StackVisitor::visit(callFrame, vm, [&] (StackVisitor&) -> StackVisitor::Status {
         if (++framesCount < maxFramesCountNeeded)
             return StackVisitor::Continue;
         return StackVisitor::Done;
@@ -452,7 +452,7 @@
     framesCount = std::min(maxStackSize, framesCount);
 
     GetStackTraceFunctor functor(vm, owner, results, framesToSkip, framesCount);
-    StackVisitor::visit(callFrame, &vm, functor);
+    StackVisitor::visit(callFrame, vm, functor);
     ASSERT(results.size() == results.capacity());
 }
 
@@ -627,7 +627,7 @@
     // Calculate an exception handler vPC, unwinding call frames as necessary.
     HandlerInfo* handler = nullptr;
     UnwindFunctor functor(vm, callFrame, isTerminatedExecutionException(vm, exception), codeBlock, handler);
-    StackVisitor::visit<StackVisitor::TerminateIfTopEntryFrameIsEmpty>(callFrame, &vm, functor);
+    StackVisitor::visit<StackVisitor::TerminateIfTopEntryFrameIsEmpty>(callFrame, vm, functor);
     if (!handler)
         return nullptr;
 
@@ -649,7 +649,7 @@
             hasCatchHandler = false;
         else {
             GetCatchHandlerFunctor functor;
-            StackVisitor::visit(callFrame, &vm, functor);
+            StackVisitor::visit(callFrame, vm, functor);
             HandlerInfo* handler = functor.handler();
             ASSERT(!handler || handler->isCatchHandler());
             hasCatchHandler = !!handler;
@@ -1214,7 +1214,7 @@
 
 NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookType debugHookType)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
     auto scope = DECLARE_CATCH_SCOPE(vm);
     Debugger* debugger = callFrame->lexicalGlobalObject()->debugger();
     if (!debugger)
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index 6239fe1..86c3246 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -167,7 +167,7 @@
         return CallFrame::create(callFrame->registers() - paddedCalleeFrameOffset);
     }
 
-    unsigned sizeOfVarargs(JSGlobalObject*, CallFrame*, JSValue arguments, uint32_t firstVarArgOffset);
+    unsigned sizeOfVarargs(JSGlobalObject*, JSValue arguments, uint32_t firstVarArgOffset);
     static constexpr unsigned maxArguments = 0x10000;
     unsigned sizeFrameForVarargs(JSGlobalObject*, CallFrame*, VM&, JSValue arguments, unsigned numUsedStackSlots, uint32_t firstVarArgOffset);
     unsigned sizeFrameForForwardArguments(JSGlobalObject*, CallFrame*, VM&, unsigned numUsedStackSlots);
diff --git a/Source/JavaScriptCore/interpreter/ShadowChicken.cpp b/Source/JavaScriptCore/interpreter/ShadowChicken.cpp
index 9cfda09b..864041f 100644
--- a/Source/JavaScriptCore/interpreter/ShadowChicken.cpp
+++ b/Source/JavaScriptCore/interpreter/ShadowChicken.cpp
@@ -173,7 +173,7 @@
     if (!m_stack.isEmpty()) {
         Vector<Frame> stackRightNow;
         StackVisitor::visit(
-            callFrame, &vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
+            callFrame, vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
                 if (visitor->isInlinedFrame())
                     return StackVisitor::Continue;
                 if (visitor->isWasmFrame()) {
@@ -294,7 +294,7 @@
     
     Vector<Frame> toPush;
     StackVisitor::visit(
-        callFrame, &vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
+        callFrame, vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
             if (visitor->isInlinedFrame()) {
                 // FIXME: Handle inlining.
                 // https://bugs.webkit.org/show_bug.cgi?id=155686
diff --git a/Source/JavaScriptCore/interpreter/StackVisitor.cpp b/Source/JavaScriptCore/interpreter/StackVisitor.cpp
index 829bf0c..80c8f68 100644
--- a/Source/JavaScriptCore/interpreter/StackVisitor.cpp
+++ b/Source/JavaScriptCore/interpreter/StackVisitor.cpp
@@ -39,22 +39,21 @@
 
 namespace JSC {
 
-StackVisitor::StackVisitor(CallFrame* startFrame, VM* vm)
+StackVisitor::StackVisitor(CallFrame* startFrame, VM& vm)
 {
     m_frame.m_index = 0;
     m_frame.m_isWasmFrame = false;
     CallFrame* topFrame;
     if (startFrame) {
-        ASSERT(vm);
-        ASSERT(!vm->topCallFrame || reinterpret_cast<void*>(vm->topCallFrame) != vm->topEntryFrame);
+        ASSERT(!vm.topCallFrame || reinterpret_cast<void*>(vm.topCallFrame) != vm.topEntryFrame);
 
-        m_frame.m_entryFrame = vm->topEntryFrame;
-        topFrame = vm->topCallFrame;
+        m_frame.m_entryFrame = vm.topEntryFrame;
+        topFrame = vm.topCallFrame;
 
         if (topFrame && topFrame->isStackOverflowFrame()) {
             topFrame = topFrame->callerFrame(m_frame.m_entryFrame);
-            m_topEntryFrameIsEmpty = (m_frame.m_entryFrame != vm->topEntryFrame);
-            if (startFrame == vm->topCallFrame)
+            m_topEntryFrameIsEmpty = (m_frame.m_entryFrame != vm.topEntryFrame);
+            if (startFrame == vm.topCallFrame)
                 startFrame = topFrame;
         }
 
@@ -303,11 +302,11 @@
     case CodeType::Native: {
         JSCell* callee = this->callee().asCell();
         if (callee)
-            traceLine = getCalculatedDisplayName(callFrame()->vm(), jsCast<JSObject*>(callee)).impl();
+            traceLine = getCalculatedDisplayName(callFrame()->deprecatedVM(), jsCast<JSObject*>(callee)).impl();
         break;
     }
     case CodeType::Function: 
-        traceLine = getCalculatedDisplayName(callFrame()->vm(), jsCast<JSObject*>(this->callee().asCell())).impl();
+        traceLine = getCalculatedDisplayName(callFrame()->deprecatedVM(), jsCast<JSObject*>(this->callee().asCell())).impl();
         break;
     case CodeType::Global:
         traceLine = "global code"_s;
diff --git a/Source/JavaScriptCore/interpreter/StackVisitor.h b/Source/JavaScriptCore/interpreter/StackVisitor.h
index f19427d..63ad408 100644
--- a/Source/JavaScriptCore/interpreter/StackVisitor.h
+++ b/Source/JavaScriptCore/interpreter/StackVisitor.h
@@ -142,7 +142,7 @@
     };
 
     template <EmptyEntryFrameAction action = ContinueIfTopEntryFrameIsEmpty, typename Functor>
-    static void visit(CallFrame* startFrame, VM* vm, const Functor& functor)
+    static void visit(CallFrame* startFrame, VM& vm, const Functor& functor)
     {
         StackVisitor visitor(startFrame, vm);
         if (action == TerminateIfTopEntryFrameIsEmpty && visitor.topEntryFrameIsEmpty())
@@ -162,7 +162,7 @@
     bool topEntryFrameIsEmpty() const { return m_topEntryFrameIsEmpty; }
 
 private:
-    JS_EXPORT_PRIVATE StackVisitor(CallFrame* startFrame, VM*);
+    JS_EXPORT_PRIVATE StackVisitor(CallFrame* startFrame, VM&);
 
     JS_EXPORT_PRIVATE void gotoNextFrame();
 
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
index 82659e5..0e24b35 100644
--- a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
@@ -44,7 +44,7 @@
 {
     if (!callFrame)
         return JSValue::encode(JSValue());
-    return JSValue::encode(callFrame->vm().hostCallReturnValue);
+    return JSValue::encode(callFrame->deprecatedVM().hostCallReturnValue);
 }
 
 #if COMPILER(GCC_COMPATIBLE) && CPU(X86_64)
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index b33c306..88d508a 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -1094,7 +1094,7 @@
             if (!callLinkInfo->seenOnce())
                 callLinkInfo->setSeen();
             else
-                linkFor(calleeFrame, *callLinkInfo, nullptr, internalFunction, codePtr);
+                linkFor(vm, calleeFrame, *callLinkInfo, nullptr, internalFunction, codePtr);
 
             void* linkedTarget = codePtr.executableAddress();
             return encodeResult(linkedTarget, reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
@@ -1142,7 +1142,7 @@
     if (!callLinkInfo->seenOnce())
         callLinkInfo->setSeen();
     else
-        linkFor(calleeFrame, *callLinkInfo, codeBlock, callee, codePtr);
+        linkFor(vm, calleeFrame, *callLinkInfo, codeBlock, callee, codePtr);
 
     return encodeResult(codePtr.executableAddress(), reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
 }
diff --git a/Source/JavaScriptCore/jit/Repatch.cpp b/Source/JavaScriptCore/jit/Repatch.cpp
index 7c8f40f..b5ec97c 100644
--- a/Source/JavaScriptCore/jit/Repatch.cpp
+++ b/Source/JavaScriptCore/jit/Repatch.cpp
@@ -833,7 +833,7 @@
 }
 
 void linkFor(
-    CallFrame* callFrame, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock,
+    VM& vm, CallFrame* callFrame, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock,
     JSObject* callee, MacroAssemblerCodePtr<JSEntryPtrTag> codePtr)
 {
     ASSERT(!callLinkInfo.stub());
@@ -843,7 +843,6 @@
     // this from Wasm, we ensure the callee is a cell.
     ASSERT(callerFrame->callee().isCell());
 
-    VM& vm = callerFrame->vm();
     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
 
     // WebAssembly -> JS stubs don't have a valid CodeBlock.
@@ -962,7 +961,7 @@
     RELEASE_ASSERT(callLinkInfo.allowStubs());
 
     CallFrame* callerFrame = callFrame->callerFrame();
-    VM& vm = callerFrame->vm();
+    VM& vm = globalObject->vm();
 
     // During execution of linkPolymorphicCall, we strongly assume that we never do GC.
     // GC jettisons CodeBlocks, changes CallLinkInfo etc. and breaks assumption done before and after this call.
diff --git a/Source/JavaScriptCore/jit/Repatch.h b/Source/JavaScriptCore/jit/Repatch.h
index fabc3fa..9a527cc 100644
--- a/Source/JavaScriptCore/jit/Repatch.h
+++ b/Source/JavaScriptCore/jit/Repatch.h
@@ -43,7 +43,7 @@
 void repatchPutByID(JSGlobalObject*, CodeBlock*, JSValue, Structure*, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
 void repatchInByID(JSGlobalObject*, CodeBlock*, JSObject*, const Identifier&, bool wasFound, const PropertySlot&, StructureStubInfo&);
 void repatchInstanceOf(JSGlobalObject*, CodeBlock*, JSValue value, JSValue prototype, StructureStubInfo&, bool wasFound);
-void linkFor(CallFrame*, CallLinkInfo&, CodeBlock*, JSObject* callee, MacroAssemblerCodePtr<JSEntryPtrTag>);
+void linkFor(VM&, CallFrame*, CallLinkInfo&, CodeBlock*, JSObject* callee, MacroAssemblerCodePtr<JSEntryPtrTag>);
 void linkDirectFor(CallFrame*, CallLinkInfo&, CodeBlock*, MacroAssemblerCodePtr<JSEntryPtrTag>);
 void linkSlowFor(CallFrame*, CallLinkInfo&);
 void unlinkFor(VM&, CallLinkInfo&);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index a662dca..626fdeb 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -1338,13 +1338,14 @@
     StringBuilder& m_trace;
 };
 
-EncodedJSValue JSC_HOST_CALL functionJSCStack(JSGlobalObject*, CallFrame* callFrame)
+EncodedJSValue JSC_HOST_CALL functionJSCStack(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
+    VM& vm = globalObject->vm();
     StringBuilder trace;
     trace.appendLiteral("--> Stack trace:\n");
 
     FunctionJSCStackFunctor functor(trace);
-    callFrame->iterate(functor);
+    callFrame->iterate(vm, functor);
     fprintf(stderr, "%s", trace.toString().utf8().data());
     return JSValue::encode(jsUndefined());
 }
@@ -1514,7 +1515,7 @@
     realm->putDirect(vm, Identifier::fromString(vm, "arguments"), array);
 
     NakedPtr<Exception> exception;
-    evaluate(realm, jscSource(source, callFrame->callerSourceOrigin()), JSValue(), exception);
+    evaluate(realm, jscSource(source, callFrame->callerSourceOrigin(vm)), JSValue(), exception);
 
     if (exception) {
         scope.throwException(realm, exception);
@@ -1551,7 +1552,7 @@
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
     NakedPtr<Exception> evaluationException;
-    JSValue result = evaluate(globalObject, jscSource(sourceCode, callFrame->callerSourceOrigin()), JSValue(), evaluationException);
+    JSValue result = evaluate(globalObject, jscSource(sourceCode, callFrame->callerSourceOrigin(vm)), JSValue(), evaluationException);
     if (evaluationException)
         throwException(globalObject, scope, evaluationException);
     return JSValue::encode(result);
@@ -1660,10 +1661,11 @@
 
 EncodedJSValue JSC_HOST_CALL functionCallerSourceOrigin(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
-    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin();
+    VM& vm = globalObject->vm();
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
     if (sourceOrigin.isNull())
         return JSValue::encode(jsNull());
-    return JSValue::encode(jsString(globalObject->vm(), sourceOrigin.string()));
+    return JSValue::encode(jsString(vm, sourceOrigin.string()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionReadline(JSGlobalObject* globalObject, CallFrame*)
@@ -1729,14 +1731,14 @@
         return JSValue::encode(jsBoolean(true));
 
     CallerFunctor wasmToJSFrame;
-    StackVisitor::visit(callFrame, &vm, wasmToJSFrame);
+    StackVisitor::visit(callFrame, vm, wasmToJSFrame);
     if (!wasmToJSFrame.callerFrame()->isAnyWasmCallee())
         return throwVMError(globalObject, scope, "caller is not a wasm->js import function");
 
     // We have a wrapper frame that we generate for imports. If we ever can direct call from wasm we would need to change this.
     ASSERT(!wasmToJSFrame.callerFrame()->callee().isWasm());
     CallerFunctor wasmFrame;
-    StackVisitor::visit(wasmToJSFrame.callerFrame(), &vm, wasmFrame);
+    StackVisitor::visit(wasmToJSFrame.callerFrame(), vm, wasmFrame);
     ASSERT(wasmFrame.callerFrame()->callee().isWasm());
 #if ENABLE(WEBASSEMBLY)
     auto mode = wasmFrame.callerFrame()->callee().asWasmCallee()->compilationMode();
@@ -1878,7 +1880,7 @@
         return JSValue::encode(throwException(globalObject, scope, createError(globalObject, "Expected global to point to a global object"_s)));
     
     NakedPtr<Exception> evaluationException;
-    JSValue result = evaluate(realm, jscSource(sourceCode, callFrame->callerSourceOrigin()), JSValue(), evaluationException);
+    JSValue result = evaluate(realm, jscSource(sourceCode, callFrame->callerSourceOrigin(vm)), JSValue(), evaluationException);
     if (evaluationException)
         throwException(globalObject, scope, evaluationException);
     return JSValue::encode(result);
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index 51ff776..4b05f68 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -1772,7 +1772,7 @@
 
 LLINT_SLOW_PATH_DECL(slow_path_handle_exception)
 {
-    VM& vm = callFrame->vm();
+    VM& vm = callFrame->deprecatedVM();
     NativeCallFrameTracer tracer(vm, callFrame);
     genericUnwind(vm, callFrame);
     LLINT_END_IMPL();
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index ee84c8b..c8e1ad5 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -169,7 +169,7 @@
 void getBytecodeOffset(VM& vm, CallFrame* startCallFrame, Vector<StackFrame>* stackTrace, CallFrame*& callFrame, unsigned& bytecodeOffset)
 {
     FindFirstCallerFrameWithCodeblockFunctor functor(startCallFrame);
-    StackVisitor::visit(vm.topCallFrame, &vm, functor);
+    StackVisitor::visit(vm.topCallFrame, vm, functor);
     callFrame = functor.foundCallFrame();
     unsigned stackIndex = functor.index();
     bytecodeOffset = 0;
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index eceaa55..eec3416 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -190,7 +190,7 @@
 JSObject* constructFunction(JSGlobalObject* globalObject, CallFrame* callFrame, const ArgList& args, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
 {
     VM& vm = globalObject->vm();
-    return constructFunction(globalObject, args, vm.propertyNames->anonymous, callFrame->callerSourceOrigin(), String(), TextPosition(), functionConstructionMode, newTarget);
+    return constructFunction(globalObject, args, vm.propertyNames->anonymous, callFrame->callerSourceOrigin(vm), String(), TextPosition(), functionConstructionMode, newTarget);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSCellInlines.h b/Source/JavaScriptCore/runtime/JSCellInlines.h
index 548d22b..b8cf9d9 100644
--- a/Source/JavaScriptCore/runtime/JSCellInlines.h
+++ b/Source/JavaScriptCore/runtime/JSCellInlines.h
@@ -138,14 +138,12 @@
 {
 }
 
-ALWAYS_INLINE VM& CallFrame::vm() const
+ALWAYS_INLINE VM& CallFrame::deprecatedVM() const
 {
     JSCell* callee = this->callee().asCell();
     ASSERT(callee);
     ASSERT(&callee->vm());
-    ASSERT(!callee->isLargeAllocation());
-    // This is an important optimization since we access this so often.
-    return callee->markedBlock().vm();
+    return callee->vm();
 }
 
 template<typename CellType, SubspaceAccess>
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index e76cc9c..04b871e 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -297,20 +297,21 @@
     mutable JSValue m_result;
 };
 
-static JSValue retrieveArguments(CallFrame* callFrame, JSFunction* functionObj)
+static JSValue retrieveArguments(VM& vm, CallFrame* callFrame, JSFunction* functionObj)
 {
     RetrieveArgumentsFunctor functor(functionObj);
     if (callFrame)
-        callFrame->iterate(functor);
+        callFrame->iterate(vm, functor);
     return functor.result();
 }
 
 EncodedJSValue JSFunction::argumentsGetter(JSGlobalObject* globalObject, EncodedJSValue thisValue, PropertyName)
 {
+    VM& vm = globalObject->vm();
     JSFunction* thisObj = jsCast<JSFunction*>(JSValue::decode(thisValue));
     ASSERT(!thisObj->isHostFunction());
 
-    return JSValue::encode(retrieveArguments(globalObject->vm().topCallFrame, thisObj));
+    return JSValue::encode(retrieveArguments(vm, vm.topCallFrame, thisObj));
 }
 
 class RetrieveCallerFunctionFunctor {
@@ -356,11 +357,11 @@
     mutable JSValue m_result;
 };
 
-static JSValue retrieveCallerFunction(CallFrame* callFrame, JSFunction* functionObj)
+static JSValue retrieveCallerFunction(VM& vm, CallFrame* callFrame, JSFunction* functionObj)
 {
     RetrieveCallerFunctionFunctor functor(functionObj);
     if (callFrame)
-        callFrame->iterate(functor);
+        callFrame->iterate(vm, functor);
     return functor.result();
 }
 
@@ -371,7 +372,7 @@
 
     JSFunction* thisObj = jsCast<JSFunction*>(JSValue::decode(thisValue));
     ASSERT(!thisObj->isHostFunction());
-    JSValue caller = retrieveCallerFunction(vm.topCallFrame, thisObj);
+    JSValue caller = retrieveCallerFunction(vm, vm.topCallFrame, thisObj);
 
     // See ES5.1 15.3.5.4 - Function.caller may not be used to retrieve a strict caller.
     if (!caller.isObject() || !asObject(caller)->inherits<JSFunction>(vm)) {
@@ -595,7 +596,7 @@
 
         valueCheck = !descriptor.value();
         if (!valueCheck) {
-            valueCheck = sameValue(globalObject, descriptor.value(), retrieveArguments(vm.topCallFrame, thisObject));
+            valueCheck = sameValue(globalObject, descriptor.value(), retrieveArguments(vm, vm.topCallFrame, thisObject));
             RETURN_IF_EXCEPTION(scope, false);
         }
     } else if (propertyName == vm.propertyNames->caller) {
@@ -604,7 +605,7 @@
 
         valueCheck = !descriptor.value();
         if (!valueCheck) {
-            valueCheck = sameValue(globalObject, descriptor.value(), retrieveCallerFunction(vm.topCallFrame, thisObject));
+            valueCheck = sameValue(globalObject, descriptor.value(), retrieveCallerFunction(vm, vm.topCallFrame, thisObject));
             RETURN_IF_EXCEPTION(scope, false);
         }
     } else {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index ae92667..63e3c86 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -296,7 +296,7 @@
 }
 
 #if !ASSERT_DISABLED
-static EncodedJSValue JSC_HOST_CALL assertCall(JSGlobalObject*, CallFrame* callFrame)
+static EncodedJSValue JSC_HOST_CALL assertCall(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
     RELEASE_ASSERT(callFrame->argument(0).isBoolean());
     if (callFrame->argument(0).asBoolean())
@@ -305,7 +305,7 @@
     bool iteratedOnce = false;
     CodeBlock* codeBlock = nullptr;
     unsigned line;
-    callFrame->iterate([&] (StackVisitor& visitor) {
+    callFrame->iterate(globalObject->vm(), [&] (StackVisitor& visitor) {
         if (!iteratedOnce) {
             iteratedOnce = true;
             return StackVisitor::Continue;
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index bfc6f55..ad6b934 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -507,7 +507,7 @@
     if (parsedObject)
         return JSValue::encode(parsedObject);
 
-    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin();
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
     EvalExecutable* eval = IndirectEvalExecutable::create(globalObject, makeSource(s, sourceOrigin), false, DerivedContextType::None, false, EvalContextType::None);
     EXCEPTION_ASSERT(!!scope.exception() == !eval);
     if (!eval)
@@ -820,7 +820,7 @@
         return JSValue::encode(promise->promise());
     };
 
-    auto sourceOrigin = callFrame->callerSourceOrigin();
+    auto sourceOrigin = callFrame->callerSourceOrigin(vm);
     RELEASE_ASSERT(callFrame->argumentCount() == 1);
     auto* specifier = callFrame->uncheckedArgument(0).toString(globalObject);
     if (Exception* exception = catchScope.exception())
diff --git a/Source/JavaScriptCore/runtime/NullSetterFunction.cpp b/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
index 89420aa..10f8872 100644
--- a/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
+++ b/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
@@ -63,10 +63,10 @@
     mutable bool m_callerIsStrict;
 };
 
-static bool callerIsStrict(CallFrame* callFrame)
+static bool callerIsStrict(VM& vm, CallFrame* callFrame)
 {
     GetCallerStrictnessFunctor iter;
-    callFrame->iterate(iter);
+    callFrame->iterate(vm, iter);
     return iter.callerIsStrict();
 }
 
@@ -76,7 +76,7 @@
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    if (callerIsStrict(callFrame))
+    if (callerIsStrict(vm, callFrame))
         return JSValue::encode(throwTypeError(globalObject, scope, "Setting a property that has only a getter"_s));
     return JSValue::encode(jsUndefined());
 }
diff --git a/Source/JavaScriptCore/tools/JSDollarVM.cpp b/Source/JavaScriptCore/tools/JSDollarVM.cpp
index 18d74f2..19c8899 100644
--- a/Source/JavaScriptCore/tools/JSDollarVM.cpp
+++ b/Source/JavaScriptCore/tools/JSDollarVM.cpp
@@ -119,7 +119,7 @@
 
         unsigned frameIndex = 0;
         bool isValid = false;
-        callFrame->iterate([&] (StackVisitor& visitor) {
+        callFrame->iterate(vm, [&] (StackVisitor& visitor) {
             DollarVMAssertScope assertScope;
 
             if (frameIndex++ != requestedFrameIndex)
@@ -1578,25 +1578,27 @@
 
 // Returns true if the current frame is a LLInt frame.
 // Usage: isLLInt = $vm.llintTrue()
-static EncodedJSValue JSC_HOST_CALL functionLLintTrue(JSGlobalObject*, CallFrame* callFrame)
+static EncodedJSValue JSC_HOST_CALL functionLLintTrue(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
     DollarVMAssertScope assertScope;
+    VM& vm = globalObject->vm();
     if (!callFrame)
         return JSValue::encode(jsUndefined());
     CallerFrameJITTypeFunctor functor;
-    callFrame->iterate(functor);
+    callFrame->iterate(vm, functor);
     return JSValue::encode(jsBoolean(functor.jitType() == JITType::InterpreterThunk));
 }
 
 // Returns true if the current frame is a baseline JIT frame.
 // Usage: isBaselineJIT = $vm.jitTrue()
-static EncodedJSValue JSC_HOST_CALL functionJITTrue(JSGlobalObject*, CallFrame* callFrame)
+static EncodedJSValue JSC_HOST_CALL functionJITTrue(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
     DollarVMAssertScope assertScope;
+    VM& vm = globalObject->vm();
     if (!callFrame)
         return JSValue::encode(jsUndefined());
     CallerFrameJITTypeFunctor functor;
-    callFrame->iterate(functor);
+    callFrame->iterate(vm, functor);
     return JSValue::encode(jsBoolean(functor.jitType() == JITType::BaselineJIT));
 }
 
@@ -1837,9 +1839,10 @@
 // Usage: $vm.dumpRegisters() // dump the registers of the current CallFrame.
 // FIXME: Currently, this function dumps the physical frame. We should make
 // it dump the logical frame (i.e. be able to dump inlined frames as well).
-static EncodedJSValue JSC_HOST_CALL functionDumpRegisters(JSGlobalObject*, CallFrame* callFrame)
+static EncodedJSValue JSC_HOST_CALL functionDumpRegisters(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
     DollarVMAssertScope assertScope;
+    VM& vm = globalObject->vm();
     unsigned requestedFrameIndex = 1;
     if (callFrame->argumentCount() >= 1) {
         JSValue value = callFrame->uncheckedArgument(0);
@@ -1853,7 +1856,7 @@
     }
 
     unsigned frameIndex = 0;
-    callFrame->iterate([&] (StackVisitor& visitor) {
+    callFrame->iterate(vm, [&] (StackVisitor& visitor) {
         DollarVMAssertScope assertScope;
         if (frameIndex++ != requestedFrameIndex)
             return StackVisitor::Continue;
@@ -2253,7 +2256,7 @@
 
     JSArray* result = constructEmptyArray(globalObject, 0);
     RETURN_IF_EXCEPTION(scope, { });
-    StackVisitor::visit(callFrame, &vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
+    StackVisitor::visit(callFrame, vm, [&] (StackVisitor& visitor) -> StackVisitor::Status {
         DollarVMAssertScope assertScope;
         if (visitor->isInlinedFrame())
             return StackVisitor::Continue;
diff --git a/Source/JavaScriptCore/tools/VMInspector.cpp b/Source/JavaScriptCore/tools/VMInspector.cpp
index 364ea44..244d22e 100644
--- a/Source/JavaScriptCore/tools/VMInspector.cpp
+++ b/Source/JavaScriptCore/tools/VMInspector.cpp
@@ -294,6 +294,7 @@
 
 CodeBlock* VMInspector::codeBlockForFrame(JSGlobalObject* globalObject, CallFrame* topCallFrame, unsigned frameNumber)
 {
+    VM& vm = globalObject->vm();
     if (!ensureCurrentThreadOwnsJSLock(globalObject))
         return nullptr;
 
@@ -323,7 +324,7 @@
     };
 
     FetchCodeBlockFunctor functor(frameNumber);
-    topCallFrame->iterate(functor);
+    topCallFrame->iterate(vm, functor);
     return functor.codeBlock;
 }
 
@@ -364,7 +365,7 @@
     if (!ensureCurrentThreadOwnsJSLock(globalObject))
         return;
     DumpFrameFunctor functor(DumpFrameFunctor::DumpOne, framesToSkip);
-    callFrame->iterate(functor);
+    callFrame->iterate(globalObject->vm(), functor);
 }
 
 void VMInspector::dumpRegisters(CallFrame* callFrame)
@@ -402,7 +403,7 @@
     dataLogF("-----------------------------------------------------------------------------\n");
     dataLogF("[ArgumentCount]            | %10p | %lu \n", it, (unsigned long) callFrame->argumentCount());
 
-    callFrame->iterate([&] (StackVisitor& visitor) {
+    callFrame->iterate(vm, [&] (StackVisitor& visitor) {
         if (visitor->callFrame() == callFrame) {
             unsigned line = 0;
             unsigned unusedColumn = 0;
@@ -420,7 +421,7 @@
     dataLogLn(codeBlock);
     --it;
 #if ENABLE(JIT)
-    AbstractPC pc = callFrame->abstractReturnPC(callFrame->vm());
+    AbstractPC pc = callFrame->abstractReturnPC(callFrame->deprecatedVM());
     if (pc.hasJITReturnAddress())
         dataLogF("[ReturnPC]                 | %10p | %p \n", it, pc.jitReturnAddress().value());
     --it;
@@ -465,7 +466,7 @@
     if (!topCallFrame)
         return;
     DumpFrameFunctor functor(DumpFrameFunctor::DumpAll, framesToSkip);
-    topCallFrame->iterate(functor);
+    topCallFrame->iterate(globalObject->vm(), functor);
 }
 
 void VMInspector::dumpValue(JSValue value)
diff --git a/Source/JavaScriptCore/wasm/js/WasmToJS.cpp b/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
index b56a727..90c6277 100644
--- a/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
+++ b/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
@@ -301,8 +301,9 @@
             GPRReg dest = wasmCallInfo.results[0].gpr();
 
             int32_t (*convertToI32)(CallFrame*, JSValue) = [] (CallFrame* callFrame, JSValue v) -> int32_t {
-                // FIXME
-                VM& vm = callFrame->vm();
+                // FIXME: Consider passing JSWebAssemblyInstance* instead.
+                // https://bugs.webkit.org/show_bug.cgi?id=203206
+                VM& vm = callFrame->deprecatedVM();
                 NativeCallFrameTracer tracer(vm, callFrame);
                 return v.toInt32(callFrame->lexicalGlobalObject());
             };
@@ -336,7 +337,7 @@
             float (*convertToF32)(CallFrame*, JSValue) = [] (CallFrame* callFrame, JSValue v) -> float {
                 // FIXME: Consider passing JSWebAssemblyInstance* instead.
                 // https://bugs.webkit.org/show_bug.cgi?id=203206
-                VM& vm = callFrame->vm();
+                VM& vm = callFrame->deprecatedVM();
                 NativeCallFrameTracer tracer(vm, callFrame);
                 return static_cast<float>(v.toNumber(callFrame->lexicalGlobalObject()));
             };
@@ -375,7 +376,7 @@
             double (*convertToF64)(CallFrame*, JSValue) = [] (CallFrame* callFrame, JSValue v) -> double {
                 // FIXME: Consider passing JSWebAssemblyInstance* instead.
                 // https://bugs.webkit.org/show_bug.cgi?id=203206
-                VM& vm = callFrame->vm();
+                VM& vm = callFrame->deprecatedVM();
                 NativeCallFrameTracer tracer(vm, callFrame);
                 return v.toNumber(callFrame->lexicalGlobalObject());
             };
@@ -491,7 +492,7 @@
         void (*doUnwinding)(CallFrame*) = [] (CallFrame* callFrame) -> void {
             // FIXME: Consider passing JSWebAssemblyInstance* instead.
             // https://bugs.webkit.org/show_bug.cgi?id=203206
-            VM& vm = callFrame->vm();
+            VM& vm = callFrame->deprecatedVM();
             NativeCallFrameTracer tracer(vm, callFrame);
             genericUnwind(vm, callFrame);
             ASSERT(!!vm.callFrameForCatch);
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 1958d59..e999c8c 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2019-10-22  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Remove non-LargeAllocation restriction for JSCallee
+        https://bugs.webkit.org/show_bug.cgi?id=203260
+
+        Reviewed by Saam Barati.
+
+        Passing VM& instead of calling CallFrame::vm.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::callerGlobalObject):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::responsibleDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallWith):
+        * testing/Internals.cpp:
+        (WebCore::Internals::parserMetaData):
+
 2019-10-22  Zalan Bujtas  <zalan@apple.com>
 
         [LFC][IFC] Add support for continuous content/commit boundary check
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
index e635652..72ed893 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -268,7 +268,7 @@
     };
 
     GetCallerGlobalObjectFunctor iter;
-    callFrame.iterate(iter);
+    callFrame.iterate(lexicalGlobalObject.vm(), iter);
     if (iter.globalObject())
         return *jsCast<JSDOMGlobalObject*>(iter.globalObject());
 
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index 3e98304..406bab3 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -273,10 +273,10 @@
     return asJSDOMWindow(vm.deprecatedVMEntryGlobalObject(&lexicalGlobalObject))->wrapped();
 }
 
-Document* responsibleDocument(CallFrame& callFrame)
+Document* responsibleDocument(VM& vm, CallFrame& callFrame)
 {
     CallerFunctor functor;
-    callFrame.iterate(functor);
+    callFrame.iterate(vm, functor);
     auto* callerFrame = functor.callerFrame();
     if (!callerFrame)
         return nullptr;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 5ca179a..6a0f7d7 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -133,6 +133,6 @@
 //        (https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-open-steps steps 4
 //        and 23 and https://html.spec.whatwg.org/multipage/webappapis.html#responsible-document). It is only
 //        used by JSDocument.
-Document* responsibleDocument(JSC::CallFrame&);
+Document* responsibleDocument(JSC::VM&, JSC::CallFrame&);
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index f240446..df1b81c 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -5672,7 +5672,7 @@
     if ($codeGenerator->ExtendedAttributeContains($callWith, "ResponsibleDocument")) {
         AddToImplIncludes("DOMWindow.h");
         AddToImplIncludes("JSDOMWindowBase.h");
-        push(@callWithArgs, "responsibleDocument($callFrameReference)");
+        push(@callWithArgs, "responsibleDocument(${globalObject}->vm(), $callFrameReference)");
     }
     if ($codeGenerator->ExtendedAttributeContains($callWith, "ActiveWindow")) {
         AddToImplIncludes("DOMWindow.h");
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index e9a5a09..4f1f14f 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -2211,7 +2211,7 @@
 
     if (!code || code.isNull() || code.isUndefined()) {
         GetCallerCodeBlockFunctor iter;
-        callFrame->iterate(iter);
+        callFrame->iterate(vm, iter);
         CodeBlock* codeBlock = iter.codeBlock();
         executable = codeBlock->ownerExecutable();
     } else if (code.isFunction(vm)) {