I implemented a similar fix for .apply(..., arguments). It should be possible to do the same for .call(...) calls. This will probably also give a deltablue improvement. Can't measure how much yet.

This would be a 5% improvement on v8-deltablue

It was simpler than expected.

Comment on attachment 764420 [details] [diff] [review] Patch Review of attachment 764420 [details] [diff] [review]: ----------------------------------------------------------------- Nice! ::: js/src/ion/BaselineBailouts.cpp @@ +656,4 @@ > #ifdef DEBUG > uint32_t expectedDepth = js_ReconstructStackDepth(cx, script, > resumeAfter ? GetNextPc(pc) : pc); > + if (!iter.moreFrames() || resumeAfter) { Nit: I think this would test the assert in more cases: if (op != JSOP_FUNAPPLY || !iter.moreFrames() || resumeAfter) { if (op == JSOP_FUNCALL) { .. } else { .. } } @@ +882,5 @@ > unsigned actualArgc = GET_ARGC(pc); > if (op == JSOP_FUNAPPLY) > actualArgc = blFrame->numActualArgs(); > + if (op == JSOP_FUNCALL) > + actualArgc--; As discussed on IRC, I think you can change this to if (op == JSOP_FUNAPPLY || op == JSOP_FUNCALL) actualArgc = blFrame->numActualArgs(); ::: js/src/ion/IonBuilder.cpp @@ +4545,5 @@ > // |this| becomes implicit in the call. > argc -= 1; > } > > // Call without inlining. Nit: move this comment to the end of the method. ::: js/src/ion/IonFrames.cpp @@ +1255,5 @@ > // Recover the number of actual arguments from the script. > if (JSOp(*pc_) != JSOP_FUNAPPLY) > numActualArgs_ = GET_ARGC(pc_); > + if (JSOp(*pc_) == JSOP_FUNCALL) > + numActualArgs_ = GET_ARGC(pc_) - 1; As discussed on IRC, this probably fails if we don't inline the FUNCALL. I think you can change the FUNAPPLY condition to: if (JSOp(*pc) != JSOP_FUNAPPLY && JSOp(*pc) != JSOP_FUNCALL)